@desplega.ai/agent-swarm 1.131.1 → 1.134.0

package/src/be/db.ts

@@ -116,19 +116,28 @@ import type {
 } from "../types";
 import {
   AgentAvatarSchema,
+  type CreateTaskOptions,
+  CreateTaskOptionsSchema,
   FollowUpConfigSchema,
   isTerminalTaskStatus,
   type ModelTier,
   parseModelTier,
   ReasoningEffortSchema,
   RoutingAffinitySchema,
+  SERVER_GENERATED_ATTACHMENT_CAPABILITY,
   SessionCostModelBreakdownSchema,
 } from "../types";
 import { deriveProviderFromKeyType } from "../utils/credentials";
 import { isEnvFlagEnabled } from "../utils/env-flag";
 import type { RateLimitWindowTelemetry } from "../utils/error-tracker";
+import { extractGitHubPullRequestUrls } from "../utils/github-pull-request";
+import {
+  type BudgetedIdentityField,
+  checkIdentityFieldBudget,
+  IdentityFieldBudgetError,
+} from "../utils/identity-field-budget";
 import { getCurrentRequestUserId } from "../utils/request-auth-context";
-import { scrubSecrets } from "../utils/secret-scrubber";
+import { registerVolatileSecret, scrubSecrets } from "../utils/secret-scrubber";
 import { auditAssetKeys, enforceAssetKeyStartupAudit } from "./asset-key-audit";
 import { migrateLegacyCredentialBindingBlob } from "./connection-bindings-blob-migration";
 import { decryptSecret, encryptSecret, getEncryptionKey, resolveEncryptionKey } from "./crypto";
@@ -181,6 +190,40 @@ export function isSqliteVecAvailable(): boolean {
   return sqliteVecAvailable;
 }
 
+/**
+ * Resolve the sqlite-vec loadable extension path without opening a Database.
+ * Mirrors loadSqliteVec's env-var-first, npm-fallback resolution, but returns
+ * the path instead of loading it: the bounded db-query child process (see
+ * src/http/db-query-bounded.ts) opens its own read-only connection and must
+ * load the extension itself, so the parent resolves the path once and passes
+ * it along. The result is memoized — `undefined` is a valid resolved answer
+ * (extension genuinely unavailable) and is cached too, so a failing
+ * `require` doesn't retry on every query.
+ */
+let cachedSqliteVecExtensionPath: string | undefined | null = null;
+
+export function resolveSqliteVecExtensionPath(): string | undefined {
+  if (cachedSqliteVecExtensionPath !== null) return cachedSqliteVecExtensionPath;
+  const extensionPath = process.env.SQLITE_VEC_EXTENSION_PATH;
+  if (extensionPath) {
+    cachedSqliteVecExtensionPath = extensionPath;
+    return cachedSqliteVecExtensionPath;
+  }
+  try {
+    cachedSqliteVecExtensionPath = (
+      require("sqlite-vec") as { getLoadablePath(): string }
+    ).getLoadablePath();
+  } catch {
+    cachedSqliteVecExtensionPath = undefined;
+  }
+  return cachedSqliteVecExtensionPath;
+}
+
+/** Test-only: clear the memoized sqlite-vec extension path cache. */
+export function __resetSqliteVecExtensionPathCacheForTests(): void {
+  cachedSqliteVecExtensionPath = null;
+}
+
 function loadSqliteVec(database: Database): void {
   sqliteVecAvailable = false;
   try {
@@ -247,7 +290,17 @@ export function initDb(dbPath = "./agent-swarm-db.sqlite"): Database {
   loadSqliteVec(database);
 
   // Run database migrations (schema creation + incremental changes)
-  runMigrations(database);
+  try {
+    runMigrations(database);
+  } catch (error) {
+    db = null;
+    try {
+      database.close();
+    } catch (closeError) {
+      console.error("[migrations] Failed to close database after migration failure:", closeError);
+    }
+    throw error;
+  }
 
   // Compatibility migration for legacy databases that predate profile fields
   ensureAgentProfileColumns(database);
@@ -432,6 +485,13 @@ const VERSIONABLE_FIELDS: VersionableField[] = [
   "heartbeatMd",
 ];
 
+const BUDGETED_IDENTITY_FIELDS: BudgetedIdentityField[] = [
+  "soulMd",
+  "identityMd",
+  "claudeMd",
+  "toolsMd",
+];
+
 function ensureAgentProfileColumns(database: Database): void {
   const existingColumns = new Set(
     database
@@ -775,6 +835,19 @@ export function updateAgentCredentialState(
   return row ? rowToAgent(row) : null;
 }
 
+/**
+ * Record which env vars a worker is missing without touching status — the
+ * logical status is derived from runtime readiness in multi-runtime mode.
+ */
+export function updateAgentCredentialMissing(agentId: string, missing: string[] | null): void {
+  const json = missing && missing.length > 0 ? JSON.stringify(missing) : null;
+  getDb()
+    .prepare(
+      "UPDATE agents SET credentialMissing = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?",
+    )
+    .run(json, agentId);
+}
+
 export function createAgent(
   agent: Omit<Agent, "id" | "createdAt" | "lastUpdatedAt"> & { id?: string },
 ): Agent {
@@ -1014,12 +1087,22 @@ export function deleteAgent(id: string): boolean {
  * Get the count of active (in_progress) tasks for an agent.
  * Used to determine current capacity usage.
  */
+/**
+ * Tasks occupying one of the agent's concurrency slots.
+ *
+ * A claimed offer counts too — omitting it let a second concurrent poll take
+ * another task past the limit. It is counted only through `offeredTo`, the
+ * agent actually reviewing it: `agentId` on an offer may still be the lead
+ * that created it, which would otherwise consume the lead's own capacity.
+ */
 export function getActiveTaskCount(agentId: string): number {
   const result = getDb()
-    .prepare<{ count: number }, [string]>(
-      "SELECT COUNT(*) as count FROM agent_tasks WHERE agentId = ? AND status = 'in_progress'",
+    .prepare<{ count: number }, [string, string]>(
+      `SELECT COUNT(*) as count FROM agent_tasks
+       WHERE (agentId = ? AND status = 'in_progress')
+          OR (offeredTo = ? AND status = 'reviewing')`,
     )
-    .get(agentId);
+    .get(agentId, agentId);
   return result?.count ?? 0;
 }
 
@@ -1202,6 +1285,7 @@ type AgentTaskRow = {
   credentialKeySuffix: string | null;
   credentialKeyType: string | null;
   requestedByUserId: string | null;
+  requestedByUserIdInherited: number;
   swarmVersion: string | null;
   provider: string | null;
   providerMeta: string | null;
@@ -2143,13 +2227,29 @@ export function updateTaskVcs(
     vcsUrl: string;
   },
 ): AgentTask | null {
-  const row = getDb()
-    .prepare<AgentTaskRow, [string, string, number, string, string, string]>(
-      `UPDATE agent_tasks
-       SET vcsProvider = ?, vcsRepo = ?, vcsNumber = ?, vcsUrl = ?, lastUpdatedAt = ?
-       WHERE id = ? RETURNING *`,
-    )
-    .get(vcs.vcsProvider, vcs.vcsRepo, vcs.vcsNumber, vcs.vcsUrl, new Date().toISOString(), taskId);
+  const row = getDb().transaction(() => {
+    const updated = getDb()
+      .prepare<AgentTaskRow, [string, string, number, string, string, string]>(
+        `UPDATE agent_tasks
+         SET vcsProvider = ?, vcsRepo = ?, vcsNumber = ?, vcsUrl = ?, lastUpdatedAt = ?
+         WHERE id = ? RETURNING *`,
+      )
+      .get(
+        vcs.vcsProvider,
+        vcs.vcsRepo,
+        vcs.vcsNumber,
+        vcs.vcsUrl,
+        new Date().toISOString(),
+        taskId,
+      );
+    if (updated) {
+      reconcileTaskPullRequestAttachments(taskId, updated.agentId, [
+        updated.output,
+        vcs.vcsProvider === "github" ? vcs.vcsUrl : null,
+      ]);
+    }
+    return updated;
+  })();
   return row ? rowToAgentTask(row) : null;
 }
 
@@ -2931,13 +3031,23 @@ export function completeTask(id: string, output?: string): AgentTask | null {
     return null;
   }
 
-  const finishedAt = new Date().toISOString();
-  let row = taskQueries.updateStatus().get("completed", finishedAt, id);
-  if (!row) return null;
+  const row = getDb().transaction(() => {
+    const finishedAt = new Date().toISOString();
+    let completed = taskQueries.updateStatus().get("completed", finishedAt, id);
+    if (!completed) return null;
 
-  if (output) {
-    row = taskQueries.setOutput().get(scrubSecrets(output), id);
-  }
+    if (output) {
+      completed = taskQueries.setOutput().get(scrubSecrets(output), id);
+    }
+    if (completed) {
+      reconcileTaskPullRequestAttachments(id, completed.agentId, [
+        completed.output,
+        completed.vcsProvider === "github" ? completed.vcsUrl : null,
+      ]);
+    }
+    return completed;
+  })();
+  if (!row) return null;
 
   if (row && oldTask) {
     emitTaskLifecycleTelemetryAfterCommit(
@@ -2961,8 +3071,8 @@ export function completeTask(id: string, output?: string): AgentTask | null {
         newValue: "completed",
       });
     } catch {}
-    try {
-      import("../workflows/event-bus").then(({ workflowEventBus }) => {
+    import("../workflows/event-bus")
+      .then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.completed", {
           taskId: id,
           output,
@@ -2970,8 +3080,13 @@ export function completeTask(id: string, output?: string): AgentTask | null {
           workflowRunId: row.workflowRunId,
           workflowRunStepId: row.workflowRunStepId,
         });
-      });
-    } catch {}
+      })
+      .catch((err) =>
+        console.error(
+          "[db] task.completed event not emitted:",
+          scrubSecrets(err instanceof Error ? err.message : String(err)),
+        ),
+      );
     try {
       promotePendingSteeringForTask(id, "Task completed before steering was delivered");
     } catch (error) {
@@ -3022,8 +3137,8 @@ export function failTask(id: string, reason: string): AgentTask | null {
         metadata: { reason: scrubbedReason },
       });
     } catch {}
-    try {
-      import("../workflows/event-bus").then(({ workflowEventBus }) => {
+    import("../workflows/event-bus")
+      .then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.failed", {
           taskId: id,
           failureReason: reason,
@@ -3031,8 +3146,13 @@ export function failTask(id: string, reason: string): AgentTask | null {
           workflowRunId: row.workflowRunId,
           workflowRunStepId: row.workflowRunStepId,
         });
-      });
-    } catch {}
+      })
+      .catch((err) =>
+        console.error(
+          "[db] task.failed event not emitted:",
+          scrubSecrets(err instanceof Error ? err.message : String(err)),
+        ),
+      );
     try {
       promotePendingSteeringForTask(id, "Task failed before steering was delivered");
     } catch (error) {
@@ -3070,7 +3190,16 @@ export function overwriteTerminalTaskResultText(
     patch.failureReason !== undefined
       ? scrubSecrets(patch.failureReason)
       : (task.failureReason ?? null);
-  const row = taskQueries.setTerminalResultText().get(output, failureReason, id) ?? null;
+  const row = getDb().transaction(() => {
+    const updated = taskQueries.setTerminalResultText().get(output, failureReason, id) ?? null;
+    if (updated && patch.output !== undefined) {
+      reconcileTaskPullRequestAttachments(id, updated.agentId, [
+        updated.output,
+        updated.vcsProvider === "github" ? updated.vcsUrl : null,
+      ]);
+    }
+    return updated;
+  })();
 
   return row ? rowToAgentTask(row) : task;
 }
@@ -3113,16 +3242,21 @@ export function cancelTask(id: string, reason?: string): AgentTask | null {
         metadata: reason ? { reason } : undefined,
       });
     } catch {}
-    try {
-      import("../workflows/event-bus").then(({ workflowEventBus }) => {
+    import("../workflows/event-bus")
+      .then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.cancelled", {
           taskId: id,
           agentId: row.agentId,
           workflowRunId: row.workflowRunId,
           workflowRunStepId: row.workflowRunStepId,
         });
-      });
-    } catch {}
+      })
+      .catch((err) =>
+        console.error(
+          "[db] task.cancelled event not emitted:",
+          scrubSecrets(err instanceof Error ? err.message : String(err)),
+        ),
+      );
     try {
       promotePendingSteeringForTask(id, "Task was cancelled before steering was delivered");
     } catch (error) {
@@ -3203,8 +3337,8 @@ export function supersedeTask(
         metadata: { reason: args.reason, resumeTaskId: args.resumeTaskId },
       });
     } catch {}
-    try {
-      import("../workflows/event-bus").then(({ workflowEventBus }) => {
+    import("../workflows/event-bus")
+      .then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.superseded", {
           taskId: id,
           reason: args.reason,
@@ -3213,8 +3347,13 @@ export function supersedeTask(
           workflowRunId: row.workflowRunId,
           workflowRunStepId: row.workflowRunStepId,
         });
-      });
-    } catch {}
+      })
+      .catch((err) =>
+        console.error(
+          "[db] task.superseded event not emitted:",
+          scrubSecrets(err instanceof Error ? err.message : String(err)),
+        ),
+      );
 
     try {
       cascadeFailDependents(id, "superseded");
@@ -3443,15 +3582,20 @@ export function updateTaskProgress(id: string, progress: string): AgentTask | nu
         newValue: scrubbedProgress,
       });
     } catch {}
-    try {
-      import("../workflows/event-bus").then(({ workflowEventBus }) => {
+    import("../workflows/event-bus")
+      .then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.progress", {
           taskId: id,
           progress: scrubbedProgress,
           agentId: row.agentId,
         });
-      });
-    } catch {}
+      })
+      .catch((err) =>
+        console.error(
+          "[db] task.progress event not emitted:",
+          scrubSecrets(err instanceof Error ? err.message : String(err)),
+        ),
+      );
   }
   return row ? rowToAgentTask(row) : null;
 }
@@ -3592,6 +3736,101 @@ export function insertTaskAttachment(input: InsertTaskAttachmentInput): TaskAtta
   })();
 }
 
+const GENERATED_PULL_REQUEST_PROVIDER_ID = "github";
+const GENERATED_PULL_REQUEST_INTENT = "task-deliverable";
+const GENERATED_PULL_REQUEST_DESCRIPTION = "Pull request shipped by this task";
+const GENERATED_PULL_REQUEST_SOURCE = "task-pull-request-recorder";
+
+function pullRequestKey(pullRequest: { owner: string; repo: string; number: number }): string {
+  return `${pullRequest.owner.toLowerCase()}/${pullRequest.repo.toLowerCase()}#${pullRequest.number}`;
+}
+
+/**
+ * Persist PRs detected by server-owned task lifecycle paths. Existing URL
+ * attachments win regardless of display name, so an agent-authored row and an
+ * automatic row never duplicate the same task deliverable. A capability key
+ * rejected by AttachmentInputSchema marks server-generated rows so
+ * reconciliation cannot mistake caller-authored metadata for provenance.
+ */
+export function recordTaskPullRequestAttachments(
+  taskId: string,
+  agentId: string | null,
+  text: string | null | undefined,
+): TaskAttachment[] {
+  const pullRequests = extractGitHubPullRequestUrls(text);
+  if (pullRequests.length === 0) return [];
+
+  const existingPullRequests = new Set(
+    getDb()
+      .prepare<{ url: string }, [string]>(
+        "SELECT url FROM task_attachments WHERE task_id = ? AND kind = 'url' AND url IS NOT NULL",
+      )
+      .all(taskId)
+      .flatMap((row) => extractGitHubPullRequestUrls(row.url))
+      .map(pullRequestKey),
+  );
+  const stored: TaskAttachment[] = [];
+  for (const pullRequest of pullRequests) {
+    const dedupeKey = pullRequestKey(pullRequest);
+    if (existingPullRequests.has(dedupeKey)) continue;
+    stored.push(
+      insertTaskAttachment({
+        taskId,
+        agentId,
+        name: `GitHub pull request #${pullRequest.number}`,
+        kind: "url",
+        url: pullRequest.url,
+        providerId: GENERATED_PULL_REQUEST_PROVIDER_ID,
+        capabilities: {
+          [SERVER_GENERATED_ATTACHMENT_CAPABILITY]: GENERATED_PULL_REQUEST_SOURCE,
+        },
+        intent: GENERATED_PULL_REQUEST_INTENT,
+        description: GENERATED_PULL_REQUEST_DESCRIPTION,
+      }),
+    );
+    existingPullRequests.add(dedupeKey);
+  }
+  return stored;
+}
+
+/** Reconcile only lifecycle-generated PR rows against their current source text. */
+function reconcileTaskPullRequestAttachments(
+  taskId: string,
+  agentId: string | null,
+  sourceTexts: Array<string | null | undefined>,
+): TaskAttachment[] {
+  const desiredPullRequests = sourceTexts.flatMap(extractGitHubPullRequestUrls);
+  const desiredKeys = new Set(desiredPullRequests.map(pullRequestKey));
+  const generatedRows = getDb()
+    .prepare<{ id: string; name: string; url: string }, [string, string]>(
+      `SELECT id, name, url
+       FROM task_attachments
+       WHERE task_id = ?
+         AND kind = 'url'
+         AND url IS NOT NULL
+         AND json_extract(capabilities, '$.${SERVER_GENERATED_ATTACHMENT_CAPABILITY}') = ?`,
+    )
+    .all(taskId, GENERATED_PULL_REQUEST_SOURCE);
+
+  for (const row of generatedRows) {
+    const pullRequest = extractGitHubPullRequestUrls(row.url)[0];
+    const expectedName = pullRequest ? `GitHub pull request #${pullRequest.number}` : null;
+    if (
+      !pullRequest ||
+      row.name !== expectedName ||
+      !desiredKeys.has(pullRequestKey(pullRequest))
+    ) {
+      getDb().run("DELETE FROM task_attachments WHERE id = ?", [row.id]);
+    }
+  }
+
+  return recordTaskPullRequestAttachments(
+    taskId,
+    agentId,
+    desiredPullRequests.map((pullRequest) => pullRequest.url).join("\n"),
+  );
+}
+
 function insertTaskAttachmentRow(input: InsertTaskAttachmentInput): TaskAttachment {
   const db = getDb();
 
@@ -4638,89 +4877,11 @@ export function getAllLogs(limit?: number): AgentLog[] {
 // Task Pool Operations
 // ============================================================================
 
-export interface CreateTaskOptions {
-  key?: string;
-  agentId?: string | null;
-  creatorAgentId?: string;
-  source?: AgentTaskSource;
-  taskType?: string;
-  tags?: string[];
-  priority?: number;
-  dependsOn?: string[];
-  offeredTo?: string;
-  status?: "backlog" | "unassigned"; // Explicitly set initial status
-  slackChannelId?: string;
-  slackThreadTs?: string;
-  /** Exact Slack message that directly triggered this task; never inherited. */
-  slackTriggerMessageTs?: string;
-  slackUserId?: string;
-  /**
-   * Opt out of the residual Slack/contextKey normalization below (see the
-   * "Residual-mismatch guard" comment near the INSERT): a deliberate
-   * cross-channel/thread dispatch (e.g. `send-task`'s
-   * `overrideSlackContext: true`) sets this so its explicit slackChannelId/
-   * slackThreadTs survive even when they disagree with a slack-family
-   * `contextKey`/parent. Trusted callers that don't set this get normalized —
-   * this boundary must not let a caller silently persist a mismatch.
-   */
-  overrideSlackContext?: boolean;
-  vcsProvider?: "github" | "gitlab";
-  vcsRepo?: string;
-  vcsEventType?: string;
-  vcsNumber?: number;
-  vcsCommentId?: number;
-  vcsAuthor?: string;
-  vcsUrl?: string;
-  vcsInstallationId?: number;
-  vcsNodeId?: string;
-  agentmailInboxId?: string;
-  agentmailMessageId?: string;
-  agentmailThreadId?: string;
-  mentionMessageId?: string;
-  mentionChannelId?: string;
-  dir?: string;
-  parentTaskId?: string;
-  model?: string;
-  modelTier?: ModelTier;
-  effort?: ReasoningEffort;
-  scheduleId?: string;
-  workflowRunId?: string;
-  workflowRunStepId?: string;
-  sourceTaskId?: string;
-  /**
-   * Optional JSON Schema the agent's final output must conform to.
-   *
-   * Enforced via the MCP `store-progress` tool (validated in
-   * `src/tools/store-progress.ts`). NOT enforced when the task runs on
-   * default-mode Devin (no MCP) — see runbooks/harness-providers.md
-   * ("Per-task outputSchema support"). Callers reading `task.output` for
-   * a schema'd task should be defensive about JSON parsing.
-   */
-  outputSchema?: Record<string, unknown>;
-  /**
-   * When a `parentTaskId` is set, the child inherits the parent's `outputSchema`
-   * by default. Set this to `false` to opt out — used by control-plane children
-   * (e.g. the Lead `reroute-decision` task) that must inherit Slack/VCS context
-   * from the parent but must NOT be forced to satisfy the original work's output
-   * contract on completion (which would block the control task — DES-523).
-   */
-  inheritParentOutputSchema?: boolean;
-  followUpConfig?: FollowUpConfig;
-  requestedByUserId?: string;
-  contextKey?: string;
-  /**
-   * Internal control-plane escape hatch for continuations that MUST coexist
-   * with their active Linear parent (for example promoted steering). General
-   * task creation keeps tracker-context dedup enabled.
-   */
-  bypassTrackerContextDedup?: boolean;
-  /**
-   * Routing-affinity snapshot gating pool eligibility (see
-   * `isAgentEligibleForTask`). Inherited from the parent (via `parentTaskId`)
-   * when not explicitly set — same treatment as `vcsRepo`/`contextKey`.
-   */
-  routingAffinity?: RoutingAffinity;
-}
+// The runtime contract for task creation lives in src/types.ts
+// (`CreateTaskOptionsSchema`); `createTaskExtended` parses options against it.
+// The type is re-exported so existing importers (src/tasks/sibling-awareness.ts)
+// keep resolving it from this module.
+export type { CreateTaskOptions } from "../types";
 
 /**
  * Find recent tasks within a time window for deduplication checks.
@@ -4759,6 +4920,15 @@ export function findRecentSimilarTasks(opts: {
 }
 
 export function createTaskExtended(task: string, options?: CreateTaskOptions): AgentTask {
+  if (typeof task !== "string" || task.trim().length === 0) {
+    throw new Error("createTaskExtended: 'task' must be a non-empty string");
+  }
+  // Single runtime enforcement point for every task write (REST, MCP,
+  // scripts bridge, webhooks, scheduler, internal callers). Reject, never
+  // coerce: a bad shape throws before anything reaches the INSERT; absent
+  // fields keep the `??` defaults at the bind site below.
+  options = CreateTaskOptionsSchema.parse(options ?? {});
+  let requestedByUserIdInherited = false;
   const id = crypto.randomUUID();
   const now = new Date().toISOString();
   const status: AgentTaskStatus = options?.offeredTo
@@ -4894,6 +5064,7 @@ export function createTaskExtended(task: string, options?: CreateTaskOptions): A
       // Attribution
       if (parent.requestedByUserId && !options.requestedByUserId) {
         options.requestedByUserId = parent.requestedByUserId;
+        requestedByUserIdInherited = true;
       }
       if (parent.key && !options.key) {
         options.key = parent.key;
@@ -5009,8 +5180,8 @@ export function createTaskExtended(task: string, options?: CreateTaskOptions): A
         vcsInstallationId, vcsNodeId,
         agentmailInboxId, agentmailMessageId, agentmailThreadId,
         mentionMessageId, mentionChannelId, dir, parentTaskId, model, modelTier, effort, scheduleId,
-        workflowRunId, workflowRunStepId, outputSchema, followUpConfig, requestedByUserId, contextKey, routingAffinity, swarmVersion, createdAt, lastUpdatedAt, created_by, updated_by
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
+        workflowRunId, workflowRunStepId, outputSchema, followUpConfig, requestedByUserId, requestedByUserIdInherited, contextKey, routingAffinity, swarmVersion, createdAt, lastUpdatedAt, created_by, updated_by
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
     )
     .get(
       id,
@@ -5055,6 +5226,7 @@ export function createTaskExtended(task: string, options?: CreateTaskOptions): A
       options?.outputSchema ? JSON.stringify(options.outputSchema) : null,
       options?.followUpConfig ? JSON.stringify(options.followUpConfig) : null,
       options?.requestedByUserId ?? null,
+      requestedByUserIdInherited ? 1 : 0,
       options?.contextKey ?? null,
       options?.routingAffinity ? JSON.stringify(options.routingAffinity) : null,
       pkg.version,
@@ -5088,8 +5260,8 @@ export function createTaskExtended(task: string, options?: CreateTaskOptions): A
     (task) => task !== null,
   );
 
-  try {
-    import("../workflows/event-bus").then(({ workflowEventBus }) => {
+  import("../workflows/event-bus")
+    .then(({ workflowEventBus }) => {
       workflowEventBus.emit("task.created", {
         taskId: row.id,
         task: row.task,
@@ -5099,8 +5271,13 @@ export function createTaskExtended(task: string, options?: CreateTaskOptions): A
         workflowRunId: row.workflowRunId,
         workflowRunStepId: row.workflowRunStepId,
       });
-    });
-  } catch {}
+    })
+    .catch((err) =>
+      console.error(
+        "[db] task.created event not emitted:",
+        scrubSecrets(err instanceof Error ? err.message : String(err)),
+      ),
+    );
 
   return rowToAgentTask(row);
 }
@@ -5330,6 +5507,41 @@ export function releaseStaleReviewingTasks(timeoutMinutes: number = 30): number
   return result.changes;
 }
 
+/**
+ * Release 'offered' tasks whose offeree can no longer possibly poll for them
+ * — the agent was deleted, or is `offline` (multi-runtime expiry once its
+ * last runtime instance ages out, or an explicit graceful close). Returns
+ * them to `unassigned` rather than back to `offered`: a stuck offer is
+ * invisible to `autoAssignPoolTasks` (which only scans `unassigned`) and to
+ * the poll-based accept/reject path (which only the original offeree can
+ * reach), so `offered` is a dead end once the offeree is gone (#1190).
+ *
+ * Deliberately gated on liveness, not elapsed time: a fixed timeout would
+ * either yank a live offer out from under an offeree that is simply slow to
+ * poll, or (set generously) leave a genuinely dead offeree's task stranded
+ * for the full window regardless of how obviously offline it already is.
+ * `agents.status = 'offline'` already encodes the staleness threshold that
+ * matters — `runtimeStaleThresholdMinutes()` / `RUNTIME_STALE_THRESHOLD_MIN`
+ * for multi-runtime expiry, or immediate for an explicit close — so no
+ * separate timeout knob is introduced here.
+ */
+export function releaseStaleOfferedTasksForOfflineAgents(): number {
+  const now = new Date().toISOString();
+
+  const result = getDb().run(
+    `UPDATE agent_tasks
+     SET status = 'unassigned', offeredTo = NULL, offeredAt = NULL, lastUpdatedAt = ?
+     WHERE status = 'offered'
+       AND offeredTo IS NOT NULL
+       AND NOT EXISTS (
+         SELECT 1 FROM agents WHERE agents.id = agent_tasks.offeredTo AND agents.status != 'offline'
+       )`,
+    [now],
+  );
+
+  return result.changes;
+}
+
 export function getOfferedTasksForAgent(agentId: string): AgentTask[] {
   return getDb()
     .prepare<AgentTaskRow, [string]>(
@@ -5556,6 +5768,7 @@ export {
 export function updateAgentProfile(
   id: string,
   updates: {
+    name?: string;
     description?: string;
     role?: string;
     capabilities?: string[];
@@ -5579,6 +5792,31 @@ export function updateAgentProfile(
       .get(id);
     if (!current) return null;
 
+    for (const field of BUDGETED_IDENTITY_FIELDS) {
+      const nextValue = updates[field];
+      if (nextValue === undefined) continue;
+
+      const result = checkIdentityFieldBudget({
+        field,
+        currentValue: current[field] ?? "",
+        nextValue,
+      });
+      if (!result.ok) {
+        throw new IdentityFieldBudgetError(
+          result,
+          computeContentHash(current[field] ?? ""),
+          computeContentHash(nextValue),
+        );
+      }
+    }
+
+    if (updates.name !== undefined) {
+      const existingAgent = database
+        .prepare<AgentRow, [string, string]>("SELECT * FROM agents WHERE name = ? AND id != ?")
+        .get(updates.name, id);
+      if (existingAgent) throw new Error("Agent name already exists");
+    }
+
     // Create context versions for changed fields
     for (const field of VERSIONABLE_FIELDS) {
       const newValue = updates[field];
@@ -5631,6 +5869,7 @@ export function updateAgentProfile(
           string | null,
           string | null,
           string | null,
+          string | null,
           number,
           string | null,
           string,
@@ -5638,6 +5877,7 @@ export function updateAgentProfile(
         ]
       >(
         `UPDATE agents SET
+          name = COALESCE(?, name),
           description = COALESCE(?, description),
           role = COALESCE(?, role),
           capabilities = COALESCE(?, capabilities),
@@ -5652,6 +5892,7 @@ export function updateAgentProfile(
          WHERE id = ? RETURNING *`,
       )
       .get(
+        updates.name ?? null,
         updates.description ?? null,
         updates.role ?? null,
         updates.capabilities ? JSON.stringify(updates.capabilities) : null,
@@ -5672,23 +5913,7 @@ export function updateAgentProfile(
 }
 
 export function updateAgentName(id: string, newName: string): Agent | null {
-  // Check if another agent already has this name
-  const existingAgent = getDb()
-    .prepare<AgentRow, [string, string]>("SELECT * FROM agents WHERE name = ? AND id != ?")
-    .get(newName, id);
-
-  if (existingAgent) {
-    throw new Error("Agent name already exists");
-  }
-
-  const now = new Date().toISOString();
-  const row = getDb()
-    .prepare<AgentRow, [string, string, string]>(
-      "UPDATE agents SET name = ?, lastUpdatedAt = ? WHERE id = ? RETURNING *",
-    )
-    .get(newName, now, id);
-
-  return row ? rowToAgent(row) : null;
+  return updateAgentProfile(id, { name: newName });
 }
 
 // ============================================================================
@@ -6873,8 +7098,30 @@ export interface SessionCostSummaryTotals {
   totalDurationMs: number;
   totalSessions: number;
   avgCostPerSession: number;
-  /** Share of `totalCostUsd` whose task carries a human requester. */
+  /**
+   * Cost of tasks with a human requester, over `attributableCostUsd` (not
+   * `totalCostUsd`) — see `attributableCostUsd` for why. Also excludes cost on
+   * a structurally-human-free task that happens to carry a stale/inherited
+   * `requestedByUserId` (measured 2026-08-19: ~5% of the naive-attributed
+   * population), so the two totals stay a consistent partition.
+   */
   attributedCostUsd: number;
+  /**
+   * The corrected coverage denominator: `totalCostUsd` minus the cost of
+   * structurally-human-free tasks (heartbeat/boot-triage, scheduled runs, and
+   * `source='system'` follow-ups whose parent itself had no human requester —
+   * i.e. follow-ups of the swarm's own self-maintenance, not of human work).
+   * These tasks have no human requester *by construction*; stamping one on
+   * them would be a lie, not coverage, so they don't belong in the
+   * denominator at all. `attributedCostUsd / attributableCostUsd` is the
+   * number to show as "coverage" — dividing by `totalCostUsd` instead
+   * silently deflates it with a population that could never have scored.
+   */
+  attributableCostUsd: number;
+  /** Cost of the structurally-human-free population excluded from `attributableCostUsd`. */
+  excludedCostUsd: number;
+  /** Distinct tasks behind `excludedCostUsd` — surfaced so the UI can name the exclusion count, not just wave at a percentage. */
+  excludedTaskCount: number;
 }
 
 export interface SessionCostDailyRow {
@@ -6907,6 +7154,60 @@ export interface SessionCostByUserRow {
 /** `opts.userId` sentinel selecting spend with no human requester. */
 export const UNATTRIBUTED_USER_ID = "unattributed";
 
+// Structurally-human-free tasks and their descendants. An explicitly supplied
+// requester is a human handoff and stops propagation; a requester copied from
+// the parent does not.
+const HUMAN_FREE_TASKS_CTE = `human_free_tasks(id) AS (
+        SELECT task.id
+        FROM agent_tasks task
+        LEFT JOIN agent_tasks parent ON parent.id = task.parentTaskId
+        WHERE COALESCE(task.taskType, '') IN ('heartbeat', 'heartbeat-checklist', 'boot-triage')
+          OR COALESCE(task.tags, '[]') LIKE '%"heartbeat"%'
+          OR (COALESCE(task.source, '') = 'schedule' AND task.requestedByUserId IS NULL)
+          OR (
+            task.parentTaskId IS NULL
+            AND COALESCE(task.source, '') = 'workflow'
+            AND task.requestedByUserId IS NULL
+            AND EXISTS (
+              SELECT 1
+              FROM workflow_runs run
+              WHERE run.id = task.workflowRunId
+                AND run.triggerType = 'schedule'
+                AND run.created_by IS NULL
+            )
+          )
+          OR (
+            COALESCE(task.source, '') = 'system'
+            AND parent.id IS NOT NULL
+            AND parent.requestedByUserId IS NULL
+          )
+
+        UNION
+
+        SELECT child.id
+        FROM agent_tasks child
+        JOIN human_free_tasks parent ON child.parentTaskId = parent.id
+        WHERE child.requestedByUserId IS NULL
+          OR child.requestedByUserIdInherited = 1
+      )`;
+const HUMAN_FREE_SQL = "EXISTS (SELECT 1 FROM human_free_tasks WHERE id = t.id)";
+const ROOT_HUMAN_FREE_SQL = `(
+        COALESCE(t.taskType, '') IN ('heartbeat', 'heartbeat-checklist', 'boot-triage')
+        OR COALESCE(t.tags, '[]') LIKE '%"heartbeat"%'
+        OR (COALESCE(t.source, '') = 'schedule' AND t.requestedByUserId IS NULL)
+        OR (
+          COALESCE(t.source, '') = 'workflow'
+          AND t.requestedByUserId IS NULL
+          AND EXISTS (
+            SELECT 1
+            FROM workflow_runs run
+            WHERE run.id = t.workflowRunId
+              AND run.triggerType = 'schedule'
+              AND run.created_by IS NULL
+          )
+        )
+      )`;
+
 export function getSessionCostSummary(opts: {
   startDate?: string;
   endDate?: string;
@@ -6925,6 +7226,15 @@ export function getSessionCostSummary(opts: {
   // through the task (same shape as `getDailySpendForUser`). Every column is
   // `sc.`-qualified because `createdAt`/`agentId` exist on both sides.
   const from = "FROM session_costs sc LEFT JOIN agent_tasks t ON t.id = sc.taskId";
+
+  // Structurally-human-free: the swarm maintaining itself, with no human
+  // requester by construction — heartbeat/boot-triage tasks, scheduled runs
+  // without a human creator (including workflow roots launched by such a
+  // schedule), and `source='system'` follow-ups whose parent itself has no
+  // human requester. That classification propagates through descendants while
+  // they remain unattributed, so autonomous fan-out cannot leak back into the
+  // denominator. An explicitly attributed child is an independent handoff and
+  // stops propagation down that branch.
   const conditions: string[] = [];
   const params: string[] = [];
 
@@ -6941,9 +7251,9 @@ export function getSessionCostSummary(opts: {
     params.push(opts.agentId);
   }
   if (opts.userId === UNATTRIBUTED_USER_ID) {
-    conditions.push("t.requestedByUserId IS NULL");
+    conditions.push(`(t.requestedByUserId IS NULL OR ${HUMAN_FREE_SQL})`);
   } else if (opts.userId) {
-    conditions.push("t.requestedByUserId = ?");
+    conditions.push(`(t.requestedByUserId = ? AND NOT ${HUMAN_FREE_SQL})`);
     params.push(opts.userId);
   }
 
@@ -6959,11 +7269,15 @@ export function getSessionCostSummary(opts: {
     totalDurationMs: number;
     totalSessions: number;
     attributedCostUsd: number;
+    attributableCostUsd: number;
+    excludedCostUsd: number;
+    excludedTaskCount: number;
   };
 
   const totalsRow = getDb()
     .prepare<TotalsRow, string[]>(
-      `SELECT
+      `WITH RECURSIVE ${HUMAN_FREE_TASKS_CTE}
+      SELECT
         COALESCE(SUM(sc.totalCostUsd), 0) as totalCostUsd,
         COALESCE(SUM(sc.inputTokens), 0) as totalInputTokens,
         COALESCE(SUM(sc.outputTokens), 0) as totalOutputTokens,
@@ -6971,8 +7285,13 @@ export function getSessionCostSummary(opts: {
         COALESCE(SUM(sc.cacheWriteTokens), 0) as totalCacheWriteTokens,
         COALESCE(SUM(sc.durationMs), 0) as totalDurationMs,
         COUNT(*) as totalSessions,
-        COALESCE(SUM(CASE WHEN t.requestedByUserId IS NOT NULL THEN sc.totalCostUsd ELSE 0 END), 0)
-          as attributedCostUsd
+        COALESCE(SUM(CASE WHEN t.requestedByUserId IS NOT NULL AND NOT ${HUMAN_FREE_SQL}
+          THEN sc.totalCostUsd ELSE 0 END), 0) as attributedCostUsd,
+        COALESCE(SUM(CASE WHEN NOT ${HUMAN_FREE_SQL}
+          THEN sc.totalCostUsd ELSE 0 END), 0) as attributableCostUsd,
+        COALESCE(SUM(CASE WHEN ${HUMAN_FREE_SQL}
+          THEN sc.totalCostUsd ELSE 0 END), 0) as excludedCostUsd,
+        COUNT(DISTINCT CASE WHEN ${HUMAN_FREE_SQL} THEN t.id END) as excludedTaskCount
       ${from} ${where}`,
     )
     .get(...params);
@@ -6993,6 +7312,9 @@ export function getSessionCostSummary(opts: {
         totalSessions: 0,
         avgCostPerSession: 0,
         attributedCostUsd: 0,
+        attributableCostUsd: 0,
+        excludedCostUsd: 0,
+        excludedTaskCount: 0,
       };
 
   // Daily breakdown
@@ -7010,7 +7332,8 @@ export function getSessionCostSummary(opts: {
         },
         string[]
       >(
-        `SELECT
+        `WITH RECURSIVE ${HUMAN_FREE_TASKS_CTE}
+        SELECT
           DATE(sc.createdAt) as date,
           COALESCE(SUM(sc.totalCostUsd), 0) as costUsd,
           COALESCE(SUM(sc.inputTokens), 0) as inputTokens,
@@ -7038,7 +7361,8 @@ export function getSessionCostSummary(opts: {
         },
         string[]
       >(
-        `SELECT
+        `WITH RECURSIVE ${HUMAN_FREE_TASKS_CTE}
+        SELECT
           sc.agentId as agentId,
           COALESCE(SUM(sc.totalCostUsd), 0) as costUsd,
           COALESCE(SUM(sc.inputTokens), 0) as inputTokens,
@@ -7052,22 +7376,22 @@ export function getSessionCostSummary(opts: {
       .all(...params);
   }
 
-  // Per-requester breakdown. The `userId IS NULL` bucket is a real row, not a
-  // gap: autonomous spend (heartbeat, boot triage) has no human requester and
-  // must stay visible rather than being folded into a person.
+  // Per-requester breakdown. Structurally-human-free work is assigned to the
+  // autonomous bucket even if a stale requester id survives on the task.
   let byUser: SessionCostByUserRow[] = [];
   if (groupBy === "user" || groupBy === "both") {
     byUser = getDb()
       .prepare<SessionCostByUserRow, string[]>(
-        `SELECT
-          t.requestedByUserId as userId,
+        `WITH RECURSIVE ${HUMAN_FREE_TASKS_CTE}
+        SELECT
+          CASE WHEN ${HUMAN_FREE_SQL} THEN NULL ELSE t.requestedByUserId END as userId,
           COALESCE(SUM(sc.totalCostUsd), 0) as costUsd,
           COALESCE(SUM(sc.inputTokens), 0) as inputTokens,
           COALESCE(SUM(sc.outputTokens), 0) as outputTokens,
           COUNT(DISTINCT sc.taskId) as tasks,
           COALESCE(SUM(sc.durationMs), 0) as durationMs
         ${from} ${where}
-        GROUP BY t.requestedByUserId
+        GROUP BY CASE WHEN ${HUMAN_FREE_SQL} THEN NULL ELSE t.requestedByUserId END
         ORDER BY costUsd DESC`,
       )
       .all(...params);
@@ -7076,6 +7400,235 @@ export function getSessionCostSummary(opts: {
   return { totals, daily, byAgent, byUser };
 }
 
+// --- Per-person attribution (four-metric view) ---
+
+export interface AttributionByPersonRow {
+  userId: string;
+  /** Root tasks (`parentTaskId IS NULL`) only — counting fan-out children would let
+   *  whoever triggers the biggest decomposition win by accident. */
+  problemsInitiated: number;
+  /** Roots that completed AND show shippable evidence — see `getAttributionByPerson` doc. */
+  problemsShipped: number;
+  /** Distinct agents engaged across the person's entire task tree (not root-scoped —
+   *  a root that fans out to nine agents is nine agents of reach). */
+  agentsReached: number;
+  reposReached: number;
+  surfacesReached: number;
+  /**
+   * Share of root tasks completed without a re-dispatch or a human correction.
+   * Deliberately `null`: distinguishing a legitimate multi-agent fan-out from a
+   * correction-driven re-dispatch isn't computable from a single query pass
+   * (would need to inspect *why* a child task was created, which isn't a stored
+   * fact), and a task-count-based proxy would misclassify normal delegation as
+   * rework. Render as "not yet computed" — do not invent a stand-in.
+   */
+  firstPassYield: null;
+}
+
+/**
+ * Four metrics per human requester, reported side by side — never summed into
+ * a composite score. Scope is root tasks (`problemsInitiated`/`problemsShipped`)
+ * or the person's entire task tree (`*Reached`); `requestedByUserId IS NULL`
+ * (autonomous work) and structurally-human-free rows with a stale/inherited
+ * requester (see `HUMAN_FREE_SQL` in `getSessionCostSummary`) are excluded —
+ * neither belongs to a person.
+ *
+ * "Problems shipped" detection walks each root's full task tree, preferring a
+ * `task_attachments` row (`kind='url'` matching a GitHub PR or GitLab MR URL,
+ * or `kind='page'` for a published artifact) and falling back to the same
+ * provider-specific URL match on any task output. GitLab matching is host
+ * agnostic so self-hosted instances are covered. This does NOT detect a closed ticket (no
+ * Linear/Jira issue-state table exists locally) — "shipped" undercounts
+ * ticket-only outcomes until the real artifacts join lands.
+ */
+export function getAttributionByPerson(opts: {
+  startDate?: string;
+  endDate?: string;
+}): AttributionByPersonRow[] {
+  const conditions: string[] = ["t.requestedByUserId IS NOT NULL"];
+  const params: string[] = [];
+  if (opts.startDate) {
+    conditions.push("t.createdAt >= ?");
+    params.push(opts.startDate);
+  }
+  if (opts.endDate) {
+    // A date-only value represents the whole UTC day. Preserve inclusive
+    // timestamp semantics for callers that provide an exact instant.
+    const dateOnlyEnd = /^\d{4}-\d{2}-\d{2}$/.test(opts.endDate)
+      ? new Date(`${opts.endDate}T00:00:00.000Z`)
+      : null;
+    if (
+      dateOnlyEnd &&
+      !Number.isNaN(dateOnlyEnd.getTime()) &&
+      dateOnlyEnd.toISOString().slice(0, 10) === opts.endDate
+    ) {
+      dateOnlyEnd.setUTCDate(dateOnlyEnd.getUTCDate() + 1);
+      conditions.push("t.createdAt < ?");
+      params.push(dateOnlyEnd.toISOString());
+    } else {
+      conditions.push("t.createdAt <= ?");
+      params.push(opts.endDate);
+    }
+  }
+  const where = `WHERE ${conditions.join(" AND ")}`;
+
+  type RootRow = { userId: string; initiated: number; shipped: number };
+  const rootRows = getDb()
+    .prepare<RootRow, string[]>(
+      `WITH RECURSIVE selected_roots(id, requestedByUserId, status, output) AS (
+        SELECT t.id, t.requestedByUserId, t.status, t.output
+        FROM agent_tasks t
+        ${where} AND t.parentTaskId IS NULL AND NOT ${ROOT_HUMAN_FREE_SQL}
+      ),
+      task_tree(rootId, taskId, output) AS (
+        SELECT id, id, output
+        FROM selected_roots
+
+        UNION ALL
+
+        SELECT tree.rootId, child.id, child.output
+        FROM agent_tasks child
+        JOIN task_tree tree ON child.parentTaskId = tree.taskId
+      )
+      SELECT
+        t.requestedByUserId as userId,
+        COUNT(*) as initiated,
+        SUM(CASE WHEN t.status = 'completed' AND (
+          EXISTS (
+            SELECT 1
+            FROM task_tree tree
+            JOIN task_attachments ta ON ta.task_id = tree.taskId
+            WHERE tree.rootId = t.id
+              AND ta.kind = 'url'
+              AND (
+                ta.url LIKE '%github.com/%/pull/%'
+                OR ta.url LIKE '%/-/merge_requests/%'
+              )
+          )
+          OR EXISTS (
+            SELECT 1 FROM task_attachments ta
+            JOIN task_tree tree ON tree.taskId = ta.task_id
+            WHERE tree.rootId = t.id AND ta.kind = 'page'
+          )
+          OR EXISTS (
+            SELECT 1 FROM task_tree tree
+            WHERE tree.rootId = t.id
+              AND (
+                tree.output LIKE '%github.com/%/pull/%'
+                OR tree.output LIKE '%/-/merge_requests/%'
+              )
+          )
+        ) THEN 1 ELSE 0 END) as shipped
+      FROM selected_roots t
+      GROUP BY t.requestedByUserId`,
+    )
+    .all(...params);
+
+  type ReachRow = {
+    userId: string;
+    agentsReached: number;
+    reposReached: number;
+    surfacesReached: number;
+  };
+  const reachRows = getDb()
+    .prepare<ReachRow, string[]>(
+      `WITH RECURSIVE report_tasks AS (
+        SELECT t.*
+        FROM agent_tasks t
+        ${where}
+      ),
+      task_ancestry(
+        taskId, id, parentTaskId, requestedByUserId, requestedByUserIdInherited,
+        taskType, tags, source, workflowRunId
+      ) AS (
+        SELECT
+          id, id, parentTaskId, requestedByUserId, requestedByUserIdInherited,
+          taskType, tags, source, workflowRunId
+        FROM report_tasks
+
+        UNION ALL
+
+        SELECT
+          child.taskId, parent.id, parent.parentTaskId, parent.requestedByUserId,
+          parent.requestedByUserIdInherited, parent.taskType, parent.tags,
+          parent.source, parent.workflowRunId
+        FROM agent_tasks parent
+        JOIN task_ancestry child ON parent.id = child.parentTaskId
+        WHERE child.requestedByUserId IS NULL
+          OR child.requestedByUserIdInherited = 1
+      ),
+      human_free_report_tasks(id) AS (
+        SELECT DISTINCT ancestor.taskId
+        FROM task_ancestry ancestor
+        LEFT JOIN agent_tasks parent ON parent.id = ancestor.parentTaskId
+        WHERE COALESCE(ancestor.taskType, '') IN ('heartbeat', 'heartbeat-checklist', 'boot-triage')
+          OR COALESCE(ancestor.tags, '[]') LIKE '%"heartbeat"%'
+          OR (COALESCE(ancestor.source, '') = 'schedule' AND ancestor.requestedByUserId IS NULL)
+          OR (
+            ancestor.parentTaskId IS NULL
+            AND COALESCE(ancestor.source, '') = 'workflow'
+            AND ancestor.requestedByUserId IS NULL
+            AND EXISTS (
+              SELECT 1
+              FROM workflow_runs run
+              WHERE run.id = ancestor.workflowRunId
+                AND run.triggerType = 'schedule'
+                AND run.created_by IS NULL
+            )
+          )
+          OR (
+            COALESCE(ancestor.source, '') = 'system'
+            AND parent.id IS NOT NULL
+            AND parent.requestedByUserId IS NULL
+          )
+      )
+      SELECT
+        t.requestedByUserId as userId,
+        COUNT(DISTINCT t.agentId) as agentsReached,
+        COUNT(DISTINCT t.vcsRepo) as reposReached,
+        COUNT(DISTINCT t.source) as surfacesReached
+      FROM report_tasks t
+      WHERE NOT EXISTS (SELECT 1 FROM human_free_report_tasks WHERE id = t.id)
+      GROUP BY t.requestedByUserId`,
+    )
+    .all(...params);
+
+  const byUser = new Map<string, AttributionByPersonRow>();
+  for (const r of rootRows) {
+    byUser.set(r.userId, {
+      userId: r.userId,
+      problemsInitiated: r.initiated,
+      problemsShipped: r.shipped,
+      agentsReached: 0,
+      reposReached: 0,
+      surfacesReached: 0,
+      firstPassYield: null,
+    });
+  }
+  for (const r of reachRows) {
+    const existing = byUser.get(r.userId);
+    if (existing) {
+      existing.agentsReached = r.agentsReached;
+      existing.reposReached = r.reposReached;
+      existing.surfacesReached = r.surfacesReached;
+    } else {
+      // Reach with no root task in-window (e.g. only fan-out children whose
+      // root predates the window) — still a real person row.
+      byUser.set(r.userId, {
+        userId: r.userId,
+        problemsInitiated: 0,
+        problemsShipped: 0,
+        agentsReached: r.agentsReached,
+        reposReached: r.reposReached,
+        surfacesReached: r.surfacesReached,
+        firstPassYield: null,
+      });
+    }
+  }
+
+  return Array.from(byUser.values());
+}
+
 // --- Dashboard cost summary (P4) ---
 
 export interface DashboardCostSummary {
@@ -8224,6 +8777,10 @@ export function upsertSwarmConfig(data: {
     }
   }
 
+  if (config.isSecret) {
+    registerVolatileSecret(config.value, `config:${config.key}`);
+  }
+
   return config;
 }
 
@@ -8565,6 +9122,7 @@ export function insertActiveSession(session: {
   inboxMessageId?: string;
   taskDescription?: string;
   runnerSessionId?: string;
+  runtimeInstanceId?: string;
 }): ActiveSession {
   const id = crypto.randomUUID();
   const now = new Date().toISOString();
@@ -8580,12 +9138,13 @@ export function insertActiveSession(session: {
         string | null,
         string | null,
         string | null,
+        string | null,
         string,
         string,
       ]
     >(
-      `INSERT INTO active_sessions (id, agentId, taskId, triggerType, inboxMessageId, taskDescription, runnerSessionId, startedAt, lastHeartbeatAt)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `INSERT INTO active_sessions (id, agentId, taskId, triggerType, inboxMessageId, taskDescription, runnerSessionId, runtimeInstanceId, startedAt, lastHeartbeatAt)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        RETURNING *`,
     )
     .get(
@@ -8596,6 +9155,7 @@ export function insertActiveSession(session: {
       session.inboxMessageId ?? null,
       session.taskDescription ?? null,
       session.runnerSessionId ?? null,
+      session.runtimeInstanceId ?? null,
       now,
       now,
     );
@@ -9208,9 +9768,11 @@ type WorkflowRunRow = {
   id: string;
   workflowId: string;
   status: string;
+  triggerType: string;
   triggerData: string | null;
   context: string | null;
   error: string | null;
+  created_by: string | null;
   startedAt: string;
   lastUpdatedAt: string;
   finishedAt: string | null;
@@ -9224,6 +9786,7 @@ function rowToWorkflowRun(row: WorkflowRunRow): WorkflowRun {
     triggerData: row.triggerData ? JSON.parse(row.triggerData) : undefined,
     context: row.context ? (JSON.parse(row.context) as Record<string, unknown>) : undefined,
     error: row.error ?? undefined,
+    createdBy: row.created_by ?? undefined,
     startedAt: normalizeDateRequired(row.startedAt),
     lastUpdatedAt: normalizeDateRequired(row.lastUpdatedAt),
     finishedAt: normalizeDate(row.finishedAt) ?? undefined,
@@ -9233,14 +9796,23 @@ function rowToWorkflowRun(row: WorkflowRunRow): WorkflowRun {
 export function createWorkflowRun(data: {
   id: string;
   workflowId: string;
+  triggerType?: "schedule" | "manual" | "event" | "api";
   triggerData?: unknown;
+  createdBy?: string;
 }): WorkflowRun {
   const now = new Date().toISOString();
   const row = getDb()
-    .prepare<WorkflowRunRow, [string, string, string, string | null]>(
-      `INSERT INTO workflow_runs (id, workflowId, startedAt, triggerData) VALUES (?, ?, ?, ?) RETURNING *`,
+    .prepare<WorkflowRunRow, [string, string, string, string, string | null, string | null]>(
+      `INSERT INTO workflow_runs (id, workflowId, triggerType, startedAt, triggerData, created_by) VALUES (?, ?, ?, ?, ?, ?) RETURNING *`,
     )
-    .get(data.id, data.workflowId, now, data.triggerData ? JSON.stringify(data.triggerData) : null);
+    .get(
+      data.id,
+      data.workflowId,
+      data.triggerType ?? "manual",
+      now,
+      data.triggerData ? JSON.stringify(data.triggerData) : null,
+      data.createdBy ?? null,
+    );
   if (!row) throw new Error("Failed to create workflow run");
   return rowToWorkflowRun(row);
 }
@@ -13161,13 +13733,104 @@ export function updateUser(
   return row ? rowToUser(row) : null;
 }
 
-export function deleteUser(id: string): boolean {
-  // Clear any task references before deleting
-  getDb()
-    .prepare("UPDATE agent_tasks SET requestedByUserId = NULL WHERE requestedByUserId = ?")
-    .run(id);
-  const result = getDb().prepare("DELETE FROM users WHERE id = ?").run(id);
-  return result.changes > 0;
+type UserReferenceRow = {
+  tableName: string;
+  columnName: string;
+};
+
+function quoteSqlIdentifier(identifier: string): string {
+  return `"${identifier.replaceAll('"', '""')}"`;
+}
+
+export function deleteUser(id: string, replacementUserId?: string): boolean {
+  if (replacementUserId === id) {
+    throw new Error("Replacement user must differ from deleted user");
+  }
+
+  const database = getDb();
+  return database.transaction(() => {
+    const userExists = database
+      .prepare<{ present: number }, [string]>(
+        "SELECT EXISTS(SELECT 1 FROM users WHERE id = ?) AS present",
+      )
+      .get(id)?.present;
+    if (!userExists) return false;
+
+    if (replacementUserId) {
+      const replacementExists = database
+        .prepare<{ present: number }, [string]>(
+          "SELECT EXISTS(SELECT 1 FROM users WHERE id = ?) AS present",
+        )
+        .get(replacementUserId)?.present;
+      if (!replacementExists) throw new Error("Replacement user not found");
+    }
+
+    // Preserve rows that carry user attribution but lack ON DELETE semantics.
+    // Schema discovery keeps this correct as new nullable user audit columns are added.
+    // Migration 103 accidentally dropped the scheduled_tasks audit FKs while
+    // recreating that table, so discover those two known logical references as
+    // well until the table is next rebuilt with its original constraints.
+    const references = database
+      .prepare<UserReferenceRow, []>(
+        `SELECT tables.name AS tableName, foreign_keys."from" AS columnName
+         FROM sqlite_schema AS tables
+         JOIN pragma_foreign_key_list(tables.name) AS foreign_keys
+         JOIN pragma_table_info(tables.name) AS columns
+           ON columns.name = foreign_keys."from"
+         WHERE tables.type = 'table'
+           AND foreign_keys."table" = 'users'
+           AND foreign_keys.on_delete IN ('NO ACTION', 'RESTRICT')
+           AND columns."notnull" = 0
+         UNION ALL
+         SELECT 'scheduled_tasks' AS tableName, columns.name AS columnName
+         FROM pragma_table_info('scheduled_tasks') AS columns
+         WHERE columns.name IN ('created_by', 'updated_by')
+           AND columns."notnull" = 0
+           AND NOT EXISTS (
+             SELECT 1
+             FROM pragma_foreign_key_list('scheduled_tasks') AS foreign_keys
+             WHERE foreign_keys."from" = columns.name
+               AND foreign_keys."table" = 'users'
+           )`,
+      )
+      .all();
+    const replacement = replacementUserId ?? null;
+    for (const reference of references) {
+      const table = quoteSqlIdentifier(reference.tableName);
+      const column = quoteSqlIdentifier(reference.columnName);
+      database
+        .prepare<unknown, [string | null, string]>(
+          `UPDATE ${table} SET ${column} = ? WHERE ${column} = ?`,
+        )
+        .run(replacement, id);
+    }
+
+    // Workflow context is persisted JSON rather than a relational column, but
+    // it exposes the same requester identity to downstream interpolation. Keep
+    // it consistent with workflow_runs.created_by inside this transaction.
+    if (replacementUserId) {
+      database
+        .prepare<unknown, [string, string]>(
+          `UPDATE workflow_runs
+           SET context = json_set(context, '$.swarm.requestedByUserId', ?)
+           WHERE json_valid(context)
+             AND json_extract(context, '$.swarm.requestedByUserId') = ?`,
+        )
+        .run(replacementUserId, id);
+    } else {
+      database
+        .prepare<unknown, [string]>(
+          `UPDATE workflow_runs
+           SET context = json_remove(context, '$.swarm.requestedByUserId')
+           WHERE json_valid(context)
+             AND json_extract(context, '$.swarm.requestedByUserId') = ?`,
+        )
+        .run(id);
+    }
+
+    const result = database.prepare("DELETE FROM users WHERE id = ?").run(id);
+    return result.changes > 0;
+  })();
 }
 
 // ============================================================================