@desplega.ai/agent-swarm 1.173.0 → 2.1.0

package/src/be/migrations/217_chat_sdk_state.sql

@@ -0,0 +1,104 @@
+-- Chat SDK (chat-sdk.dev) channel: StateAdapter tables + durable outbound relay.
+--
+-- The five chat_* state tables back `SqliteChatState` (src/integrations/chat-sdk/state.ts).
+-- Keys and thread ids written by the SDK already carry the adapter prefix
+-- (`telegram:...`, `slack:...`), so no adapter column is needed.
+-- Expiry columns are epoch milliseconds; NULL means no expiry.
+
+CREATE TABLE chat_state_kv (
+  key        TEXT PRIMARY KEY,
+  value      TEXT NOT NULL,
+  expires_at INTEGER
+);
+
+CREATE TABLE chat_subscriptions (
+  thread_id  TEXT PRIMARY KEY,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+
+CREATE TABLE chat_locks (
+  thread_id  TEXT PRIMARY KEY,
+  token      TEXT NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+
+CREATE TABLE chat_lists (
+  key        TEXT NOT NULL,
+  seq        INTEGER NOT NULL,
+  value      TEXT NOT NULL,
+  expires_at INTEGER,
+  PRIMARY KEY (key, seq)
+);
+
+CREATE TABLE chat_queue (
+  id        INTEGER PRIMARY KEY AUTOINCREMENT,
+  thread_id TEXT NOT NULL,
+  entry     TEXT NOT NULL
+);
+
+CREATE INDEX idx_chat_queue_thread ON chat_queue(thread_id, id);
+
+-- Persist the obligation to publish a terminal result for every Chat SDK-rooted
+-- task. Mirrors 144_slack_relay_obligations.sql, plus an attempt cap: a poison
+-- row is marked given up (with the reason) instead of retrying forever.
+CREATE TABLE chat_relay_obligations (
+  task_id         TEXT PRIMARY KEY REFERENCES agent_tasks(id) ON DELETE CASCADE,
+  delivered_at    TEXT,
+  attempt_count   INTEGER NOT NULL DEFAULT 0,
+  last_attempt_at TEXT,
+  given_up_at     TEXT,
+  last_error      TEXT,
+  created_at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  created_by      TEXT,
+  updated_by      TEXT
+);
+
+CREATE INDEX idx_chat_relay_obligations_pending
+  ON chat_relay_obligations(last_attempt_at, created_at)
+  WHERE delivered_at IS NULL AND given_up_at IS NULL;
+
+-- Lead follow-ups (`source='system'`, `taskType='follow-up'`) inherit the chat
+-- contextKey and carry the lead's final answer, so they relay too. A resume
+-- (`source='system'`, `taskType='resume'`, from `createResumeFollowUp` after a
+-- graceful shutdown or crash recovery) inherits the contextKey too. It relays
+-- only when a lead owns it: a worker task (resumed or not) reports back through
+-- a lead follow-up, and the lead never gets one for its own tasks. Other system
+-- tasks that inherit the key stay silent. GLOB, not LIKE: LIKE is
+-- case-insensitive in SQLite.
+CREATE TRIGGER enqueue_chat_relay_after_terminal_update
+AFTER UPDATE OF status ON agent_tasks
+WHEN OLD.status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
+  AND NEW.status IN ('completed', 'failed', 'cancelled')
+  AND NEW.contextKey GLOB 'task:chat-sdk:*'
+  AND (
+    NEW.source = 'chat'
+    OR (NEW.source = 'system' AND NEW.taskType = 'follow-up')
+    OR (
+      NEW.source = 'system'
+      AND NEW.taskType = 'resume'
+      AND EXISTS (SELECT 1 FROM agents WHERE agents.id = NEW.agentId AND agents.isLead = 1)
+    )
+  )
+BEGIN
+  INSERT OR IGNORE INTO chat_relay_obligations (task_id)
+  VALUES (NEW.id);
+END;
+
+CREATE TRIGGER enqueue_chat_relay_after_terminal_insert
+AFTER INSERT ON agent_tasks
+WHEN NEW.status IN ('completed', 'failed', 'cancelled')
+  AND NEW.contextKey GLOB 'task:chat-sdk:*'
+  AND (
+    NEW.source = 'chat'
+    OR (NEW.source = 'system' AND NEW.taskType = 'follow-up')
+    OR (
+      NEW.source = 'system'
+      AND NEW.taskType = 'resume'
+      AND EXISTS (SELECT 1 FROM agents WHERE agents.id = NEW.agentId AND agents.isLead = 1)
+    )
+  )
+BEGIN
+  INSERT OR IGNORE INTO chat_relay_obligations (task_id)
+  VALUES (NEW.id);
+END;

package/src/be/migrations/219_relabel_pi_context_compactions.sql

@@ -0,0 +1,22 @@
+-- The pi extension posted its per-LLM-call `context` usage snapshot as
+-- eventType 'compaction', so every pi turn drew an AUTO COMPACTION divider and
+-- bumped agent_tasks.compactionCount. Those rows never carry compactTrigger or
+-- preCompactTokens (real compactions from every harness do). Relabel them as
+-- 'progress' and recompute the counter for the pi tasks.
+
+UPDATE task_context_snapshots
+SET eventType = 'progress'
+WHERE eventType = 'compaction'
+  AND compactTrigger IS NULL
+  AND preCompactTokens IS NULL
+  AND sessionId LIKE 'pi-%'
+  AND taskId IN (SELECT id FROM agent_tasks WHERE provider = 'pi');
+
+UPDATE agent_tasks
+SET compactionCount = (
+  SELECT COUNT(*)
+  FROM task_context_snapshots s
+  WHERE s.taskId = agent_tasks.id AND s.eventType = 'compaction'
+)
+WHERE provider = 'pi'
+  AND COALESCE(compactionCount, 0) > 0;

package/src/be/migrations/220_model_profiles.sql

@@ -0,0 +1,137 @@
+-- Model profiles (runbooks/model-tiers.md § Model profiles): a named
+-- (harness, model, effort) that Lead picks per task or that applies as an
+-- agent's default. Claim stamps the profile on the task. The tier seeds
+-- (`<harness>-<tier>`) are written at boot by src/be/seed-model-profiles.ts.
+CREATE TABLE IF NOT EXISTS model_profiles (
+  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+  name TEXT NOT NULL UNIQUE,
+  harness TEXT NOT NULL,
+  model TEXT NOT NULL,
+  effort TEXT,
+  allowCustomModel INTEGER NOT NULL DEFAULT 0,
+  description TEXT,
+  -- `tier:<tier>` for a boot seed, `agent-config` for a profile this migration
+  -- made from an agent's MODEL_OVERRIDE, NULL for one an operator created.
+  seededFrom TEXT,
+  createdAt TEXT NOT NULL,
+  lastUpdatedAt TEXT NOT NULL,
+  created_by TEXT REFERENCES users(id),
+  updated_by TEXT REFERENCES users(id)
+);
+
+-- `profile` is the creator's ask; `resolvedProfile` is the name claim applied
+-- (the task's ask or the agent's default), mirroring model / resolvedModel.
+ALTER TABLE agent_tasks ADD COLUMN profile TEXT;
+ALTER TABLE agent_tasks ADD COLUMN resolvedProfile TEXT;
+
+-- A profile name a task asks for, or an agent has as its default, must exist
+-- when the row is written. Enforced here so the check and the write are one
+-- statement: an app-level check before a separate insert races a concurrent
+-- delete. The delete side is the matching single-statement guard in
+-- deleteModelProfile (src/be/db/model-profiles.ts). It is not a trigger on
+-- model_profiles because one reading agent_tasks would break every later
+-- migration that rebuilds agent_tasks (DROP + RENAME re-parses that trigger).
+CREATE TRIGGER IF NOT EXISTS model_profiles_task_ref_insert
+BEFORE INSERT ON agent_tasks
+WHEN NEW.profile IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM model_profiles WHERE name = NEW.profile)
+BEGIN
+  SELECT RAISE(ABORT, 'model-profile-missing: the task''s model profile does not exist');
+END;
+
+CREATE TRIGGER IF NOT EXISTS model_profiles_task_ref_update
+BEFORE UPDATE OF profile ON agent_tasks
+WHEN NEW.profile IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM model_profiles WHERE name = NEW.profile)
+BEGIN
+  SELECT RAISE(ABORT, 'model-profile-missing: the task''s model profile does not exist');
+END;
+
+CREATE TRIGGER IF NOT EXISTS model_profiles_default_ref_insert
+BEFORE INSERT ON swarm_config
+WHEN NEW.scope = 'agent' AND NEW.key = 'MODEL_PROFILE'
+  AND NOT EXISTS (SELECT 1 FROM model_profiles WHERE name = trim(NEW.value))
+BEGIN
+  SELECT RAISE(ABORT, 'model-profile-missing: the agent''s default model profile does not exist');
+END;
+
+CREATE TRIGGER IF NOT EXISTS model_profiles_default_ref_update
+BEFORE UPDATE OF scope, key, value ON swarm_config
+WHEN NEW.scope = 'agent' AND NEW.key = 'MODEL_PROFILE'
+  AND NOT EXISTS (SELECT 1 FROM model_profiles WHERE name = trim(NEW.value))
+BEGIN
+  SELECT RAISE(ABORT, 'model-profile-missing: the agent''s default model profile does not exist');
+END;
+
+-- Each agent's MODEL_OVERRIDE + REASONING_EFFORT_OVERRIDE pair becomes a
+-- profile, deduped by (harness, model, effort), and that agent's default
+-- (agent-scoped MODEL_PROFILE, never exported to the worker env). Claim then
+-- supplies the same model and effort the worker read from its env before.
+-- A row with exportToEnv = 0 never reached the worker, so it is not carried
+-- over: a withheld model makes no default, a withheld effort no profile effort.
+-- ACP keeps MODEL_OVERRIDE (no portable mapping); `latest:` aliases are not
+-- valid agent defaults, so they are left alone too.
+CREATE TEMP TABLE _model_profile_overrides AS
+SELECT
+  a.id AS agentId,
+  COALESCE(a.harness_provider, a.provider) AS harness,
+  trim(m.value) AS model,
+  CASE
+    WHEN lower(trim(e.value)) IN ('off', 'low', 'medium', 'high', 'xhigh', 'max')
+      THEN lower(trim(e.value))
+  END AS effort
+FROM agents a
+JOIN swarm_config m
+  ON m.scope = 'agent' AND m.scopeId = a.id AND m.key = 'MODEL_OVERRIDE'
+  AND m.isSecret = 0 AND m.encrypted = 0 AND m.exportToEnv = 1
+LEFT JOIN swarm_config e
+  ON e.scope = 'agent' AND e.scopeId = a.id AND e.key = 'REASONING_EFFORT_OVERRIDE'
+  AND e.isSecret = 0 AND e.encrypted = 0 AND e.exportToEnv = 1
+WHERE COALESCE(a.harness_provider, a.provider) IS NOT NULL
+  AND COALESCE(a.harness_provider, a.provider) <> 'acp'
+  AND trim(m.value) <> ''
+  AND lower(trim(m.value)) NOT LIKE 'latest:%';
+
+-- Name: `<harness>-<model>[-<effort>]`, without repeating a harness prefix the
+-- model already carries, e.g. `codex-gpt-6.1-sol-xhigh`, `claude-opus-5-5-high`.
+INSERT OR IGNORE INTO model_profiles
+  (name, harness, model, effort, allowCustomModel, description, seededFrom, createdAt, lastUpdatedAt)
+SELECT
+  lower(replace(replace(
+    CASE WHEN lower(model) LIKE lower(harness) || '-%' THEN model ELSE harness || '-' || model END,
+    '/', '-'), ':', '-')) || COALESCE('-' || effort, ''),
+  harness,
+  model,
+  effort,
+  1,
+  'Created from an agent''s MODEL_OVERRIDE and REASONING_EFFORT_OVERRIDE.',
+  'agent-config',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+FROM _model_profile_overrides
+GROUP BY harness, model, effort;
+
+INSERT OR IGNORE INTO swarm_config
+  (id, scope, scopeId, key, value, isSecret, envPath, description, createdAt, lastUpdatedAt, encrypted, exportToEnv)
+SELECT
+  lower(hex(randomblob(4))) || '-' || lower(hex(randomblob(2))) || '-4' ||
+    substr(lower(hex(randomblob(2))), 2) || '-' ||
+    substr('89ab', 1 + (abs(random()) % 4), 1) || substr(lower(hex(randomblob(2))), 2) || '-' ||
+    lower(hex(randomblob(6))),
+  'agent',
+  o.agentId,
+  'MODEL_PROFILE',
+  p.name,
+  0,
+  NULL,
+  'Default model profile, created from this agent''s MODEL_OVERRIDE.',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+  0,
+  0
+FROM _model_profile_overrides o
+JOIN model_profiles p
+  ON p.harness = o.harness AND p.model = o.model AND p.effort IS o.effort
+  AND p.seededFrom = 'agent-config';
+
+DROP TABLE _model_profile_overrides;

package/src/be/model-catalog-store.ts

@@ -13,6 +13,7 @@
  * See runbooks/model-catalog.md.
  */
 
+import { withAgentChatRegistrySections } from "@desplega/model-catalog";
 import { type RuntimeCatalog, setRuntimeModelCatalog } from "../utils/runtime-model-catalog";
 import {
   getActivePricingRow,
@@ -180,7 +181,10 @@ function pickNumber(value: unknown): number | undefined {
 }
 
 /** Project a models.dev payload into `model_catalog` rows for CATALOG_PROVIDER_IDS. */
-export function buildCatalogEntries(cache: ModelsDevCache, checkedAt: number): ModelCatalogEntry[] {
+export function buildCatalogEntries(raw: ModelsDevCache, checkedAt: number): ModelCatalogEntry[] {
+  // A live models.dev payload still carries the embeddings and image models of
+  // the registry gateways (`vercel`); pi and opencode cannot run them.
+  const cache = withAgentChatRegistrySections(raw);
   const entries: ModelCatalogEntry[] = [];
   for (const providerId of CATALOG_PROVIDER_IDS) {
     const provider = cache[providerId];

package/src/be/model-tier-resolution.ts

@@ -7,9 +7,12 @@
  *
  * Precedence (first hit wins):
  *   1. task `model`                         → modelSource "model"
- *   2. the claiming worker's MODEL_TIER_*   → "worker-env"  (agents.modelTierOverrides)
- *   3. swarm_config MODEL_TIER_<PROV>_<TIER> → "tier-config"
- *   4. DEFAULT_MODEL_TIER_MAP                → "tier-default"
+ *   2. task `profile`                       → "profile:task"
+ *   3. the claiming worker's MODEL_TIER_*   → "worker-env"  (agents.modelTierOverrides)
+ *   4. swarm_config MODEL_TIER_<PROV>_<TIER> → "tier-config"
+ *   5. DEFAULT_MODEL_TIER_MAP                → "tier-default"
+ *   6. the agent's default profile          → "profile:agent-default" (no model, no tier,
+ *      no repo-scoped MODEL_OVERRIDE on the task's repo)
  *
  * Any layer may hold a `latest:` alias. An alias that resolves to nothing
  * (empty catalog, everything filtered) falls through to the next layer.
@@ -45,8 +48,14 @@ import {
   type ProviderName,
   ProviderNameSchema,
   parseModelTier,
+  type ReasoningEffort,
 } from "../types";
 import { getDbClient } from "./db";
+import {
+  getAgentDefaultProfileName,
+  getModelProfileByName,
+  repoModelOverrideKeys,
+} from "./db/model-profiles";
 import {
   CLI_PINNED_HARNESSES,
   fallbackForUnsupportedModel,
@@ -74,7 +83,9 @@ export type ModelSource =
   | "tier-config"
   | "tier-default"
   | "fallback:cli-unsupported"
-  | "fallback:cli-unsupported:model";
+  | "fallback:cli-unsupported:model"
+  | "profile:task"
+  | "profile:agent-default";
 
 export interface TaskModelResolution {
   resolvedModel: string;
@@ -490,15 +501,21 @@ async function applyCliSupport(
   if (!fallback) return resolution;
   noticeCliUnsupported(harness, cliVersion, resolution.resolvedModel, fallback);
   // Keep the winning layer in the source: a fallback from the task's own `latest:` alias is
-  // still a task-level pin (a resume carries it), one from a tier layer is not.
-  const modelSource =
-    resolution.modelSource === "model"
+  // still a task-level pin (a resume carries it), one from a tier layer is not. A profile keeps
+  // its own source; `resolvedProfile` still names it and `resolvedModel` shows the swap.
+  const modelSource = resolution.modelSource.startsWith("profile:")
+    ? resolution.modelSource
+    : resolution.modelSource === "model"
       ? "fallback:cli-unsupported:model"
       : "fallback:cli-unsupported";
   return { ...resolution, resolvedModel: fallback, modelSource };
 }
 
 export type ClaimModelFields = Partial<TaskModelResolution> & {
+  /** The profile claim applied (`agent_tasks.resolvedProfile`). */
+  resolvedProfile?: string;
+  /** The profile's effort, when it has one and the task set none; the worker spawns with it. */
+  effort?: ReasoningEffort;
   /**
    * Set when the task's explicit model is rejected by this worker's CLI, or belongs to another
    * harness family (`[model-harness-mismatch]`); the worker fails the task without a spawn.
@@ -506,22 +523,150 @@ export type ClaimModelFields = Partial<TaskModelResolution> & {
   modelUnsupported?: string;
 };
 
+/**
+ * Resolve a model profile for a claim. Null when the profile does not apply:
+ * an agent default that is missing or on another harness falls through to the
+ * tier chain. For a task's own `profile` both are a hard stop.
+ */
+async function resolveClaimProfile(
+  name: string,
+  source: "profile:task" | "profile:agent-default",
+  harness: ProviderName | null,
+): Promise<
+  | { profile: { name: string; effort: ReasoningEffort | null }; resolution: TaskModelResolution }
+  | { modelUnsupported: string }
+  | null
+> {
+  const isTask = source === "profile:task";
+  const profile = await getModelProfileByName(name);
+  if (!profile) {
+    return isTask
+      ? { modelUnsupported: `[model-profile-missing] Model profile "${name}" no longer exists.` }
+      : null;
+  }
+  if (profile.harness !== harness) {
+    if (!isTask) return null;
+    return {
+      modelUnsupported: `[model-harness-mismatch] Model profile "${name}" runs on the ${profile.harness} harness, not on the ${harness ?? "unknown"} harness of this worker. Re-create the task with a ${harness ?? "matching"} profile.`,
+    };
+  }
+  let resolution: TaskModelResolution = {
+    resolvedModel: profile.model,
+    modelSource: source,
+    modelAlias: null,
+  };
+  if (isAlias(profile.model)) {
+    const resolved = await resolveLatestAlias(profile.model);
+    if (!resolved) {
+      if (!isTask) return null;
+      return {
+        modelUnsupported: `[model-profile-unresolved] Model profile "${name}" names ${profile.model}, which resolves to no usable model.`,
+      };
+    }
+    resolution = {
+      resolvedModel: resolved,
+      modelSource: source,
+      modelAlias: profile.model.trim().toLowerCase(),
+    };
+  }
+  return { profile: { name: profile.name, effort: profile.effort }, resolution };
+}
+
 /**
  * Resolve and record the model for a task the given agent is claiming. Runs
  * inside the claim transaction. Returns the fields to merge into the trigger.
+ * `task.model` must be the task's own pin (`taskModelPin`), never the model a
+ * previous session reported into the column.
  */
 export async function recordClaimModelResolution(
-  task: { id: string; model?: string | null; modelTier?: string | null },
+  task: {
+    id: string;
+    model?: string | null;
+    modelTier?: string | null;
+    profile?: string | null;
+    effort?: string | null;
+    vcsRepo?: string | null;
+  },
   agent: { id: string; harnessProvider?: ProviderName | null; provider?: ProviderName | null },
+  /**
+   * Whether the claiming worker's config read includes secret repo rows
+   * (`readsRepoSecrets`). A secret repo override it never receives cannot
+   * beat its default profile. Defaults to true (an operator-key worker).
+   */
+  { includeRepoSecrets = true }: { includeRepoSecrets?: boolean } = {},
 ): Promise<ClaimModelFields> {
   const harnessProvider = agent.harnessProvider ?? agent.provider ?? null;
+
+  if (!task.model?.trim()) {
+    const taskProfile = task.profile?.trim();
+    const agentDefault =
+      taskProfile || parseModelTier(task.modelTier)
+        ? null
+        : await getAgentDefaultProfileName(agent.id);
+    // The agent default is agent-scoped config: a repo-scoped MODEL_OVERRIDE or
+    // REASONING_EFFORT_OVERRIDE on the task's repo still beats it on that axis
+    // (repo > agent), as it beats the agent's own override in the worker env.
+    // A task's own profile is the creator's pick and beats repo config.
+    const repoKeys = agentDefault
+      ? await repoModelOverrideKeys(task.vcsRepo, { includeSecrets: includeRepoSecrets })
+      : new Set<string>();
+    const defaultProfile = repoKeys.has("MODEL_OVERRIDE") ? null : agentDefault;
+    const picked = taskProfile
+      ? await resolveClaimProfile(taskProfile, "profile:task", harnessProvider)
+      : defaultProfile
+        ? await resolveClaimProfile(defaultProfile, "profile:agent-default", harnessProvider)
+        : null;
+    if (picked && "modelUnsupported" in picked)
+      return { modelUnsupported: picked.modelUnsupported };
+    if (picked) {
+      const checked = await applyCliSupport(
+        picked.resolution,
+        harnessProvider,
+        await getAgentHarnessCliVersion(agent.id),
+      );
+      // Profiles never fail fast on the CLI check (only a raw task pin does), so this is a resolution.
+      const resolution = "unsupported" in checked ? picked.resolution : checked;
+      await getDbClient().run(
+        "UPDATE agent_tasks SET resolvedModel = ?, modelSource = ?, modelAlias = ?, resolvedProfile = ? WHERE id = ?",
+        [
+          resolution.resolvedModel,
+          resolution.modelSource,
+          resolution.modelAlias,
+          picked.profile.name,
+          task.id,
+        ],
+      );
+      return {
+        resolvedModel: resolution.resolvedModel,
+        modelSource: resolution.modelSource,
+        ...(resolution.modelAlias ? { modelAlias: resolution.modelAlias } : {}),
+        resolvedProfile: picked.profile.name,
+        // A task's own effort stays the pin; the profile's fills only an unset one,
+        // and an agent default's yields to the repo's effort override.
+        ...(!task.effort && picked.profile.effort && !repoKeys.has("REASONING_EFFORT_OVERRIDE")
+          ? { effort: picked.profile.effort }
+          : {}),
+      };
+    }
+  }
+
   const resolved = await resolveTaskModel({
     model: task.model,
     modelTier: task.modelTier,
     harnessProvider,
     workerOverrides: await getAgentModelTierOverrides(agent.id),
   });
-  if (!resolved) return {};
+  if (!resolved) {
+    // A re-claimed row keeps the claim record of its previous run; drop it so
+    // the trigger and the row do not replay that run's model.
+    await getDbClient().run(
+      `UPDATE agent_tasks SET resolvedModel = NULL, modelSource = NULL, modelAlias = NULL, resolvedProfile = NULL
+         WHERE id = ? AND (resolvedModel IS NOT NULL OR modelSource IS NOT NULL OR modelAlias IS NOT NULL
+           OR resolvedProfile IS NOT NULL)`,
+      [task.id],
+    );
+    return {};
+  }
   if ("harnessMismatch" in resolved) return { modelUnsupported: resolved.harnessMismatch };
   const checked = await applyCliSupport(
     resolved,
@@ -533,7 +678,7 @@ export async function recordClaimModelResolution(
   }
   const resolution = checked;
   await getDbClient().run(
-    "UPDATE agent_tasks SET resolvedModel = ?, modelSource = ?, modelAlias = ? WHERE id = ?",
+    "UPDATE agent_tasks SET resolvedModel = ?, modelSource = ?, modelAlias = ?, resolvedProfile = NULL WHERE id = ?",
     [resolution.resolvedModel, resolution.modelSource, resolution.modelAlias, task.id],
   );
   return resolution.modelAlias

package/src/be/model-validation.ts

@@ -29,8 +29,10 @@ import {
   type ModelsDevCatalog,
   parseAlias,
 } from "@desplega/model-catalog";
+import { type TaskModelPinFields, taskModelPin } from "../tasks/model-pin";
 import { ampModelError, ampPinCatalogError, ampPinProviderError } from "../utils/amp-models";
 import { getAgentById, getAllAgents } from "./db";
+import { getModelProfileByName } from "./db/model-profiles";
 import { loadModelsCatalog } from "./model-catalog-store";
 import { resolveLatestAlias } from "./model-tier-resolution";
 
@@ -99,10 +101,18 @@ export async function harnessModelErrorFor(
  * stays sync and catalog-free; this runs next to it.
  */
 export async function poolTaskRunsOnHarness(
-  task: { model?: string | null } | null | undefined,
+  task: (TaskModelPinFields & { profile?: string | null }) | null | undefined,
   harness: string | null | undefined,
 ): Promise<boolean> {
-  const model = task?.model?.trim();
+  // A task's model profile runs on one harness only; other workers leave it in the pool.
+  const profileName = task?.profile?.trim();
+  if (profileName) {
+    const profile = await getModelProfileByName(profileName);
+    return !profile || !harness || profile.harness === harness;
+  }
+  // Only the task's own pin restricts harnesses; a model a previous run
+  // reported into `model` does not.
+  const model = taskModelPin(task ?? {})?.trim();
   if (!model) return true;
   return (await harnessModelErrorFor(model, harness)) === null;
 }

package/src/be/models-catalog.ts

@@ -1,3 +1,4 @@
+import { openAICompatibleProviderIds, registryCatalogSections } from "@desplega/model-catalog";
 import { loadModelsDevCache, type ModelsDevCache, type ModelsDevModel } from "./modelsdev-cache";
 
 /**
@@ -15,13 +16,18 @@ import { loadModelsDevCache, type ModelsDevCache, type ModelsDevModel } from "./
  * same snapshot as its own fallback while the request is in flight.
  */
 
-/** Mirrors the provider groups used by the direct harness and ACP model pickers. */
+/**
+ * Mirrors the provider groups used by the direct harness and ACP model
+ * pickers, plus every OpenAI-compatible registry provider
+ * (`@desplega/model-catalog`).
+ */
 export const CATALOG_PROVIDER_IDS = [
   "openrouter",
   "anthropic",
   "openai",
   "amazon-bedrock",
   "opencode",
+  ...openAICompatibleProviderIds(),
 ] as const;
 
 export type CatalogProviderId = (typeof CATALOG_PROVIDER_IDS)[number];
@@ -163,6 +169,24 @@ function mergePinnedEntries(catalog: ModelsCatalog): void {
   }
 }
 
+/**
+ * Registry-synthesized sections (`catalog: "registry"` entries such as
+ * `helmcode`) are never on models.dev, so the live catalog built from it
+ * lacks them. Fill them from the bundled snapshot, which carries them
+ * (`loadModelsDevCache`); models already present (an overlay row) win.
+ */
+function mergeRegistrySections(catalog: ModelsCatalog): void {
+  const snapshot = bundledSnapshotCatalog();
+  for (const providerId of Object.keys(registryCatalogSections()) as CatalogProviderId[]) {
+    const section = snapshot[providerId];
+    if (!section) continue;
+    catalog[providerId] ??= { ...section, models: {} };
+    for (const [modelId, model] of Object.entries(section.models)) {
+      catalog[providerId].models[modelId] ??= model;
+    }
+  }
+}
+
 /**
  * Install a freshly built live catalog (already merged with the persistent
  * table + overlay by `src/be/model-catalog-store.ts`). Pinned snapshot entries
@@ -170,6 +194,7 @@ function mergePinnedEntries(catalog: ModelsCatalog): void {
  */
 export function setLiveModelsCatalog(catalog: ModelsCatalog, updatedAt: number | null): void {
   mergePinnedEntries(catalog);
+  mergeRegistrySections(catalog);
   liveCatalog = catalog;
   liveUpdatedAt = updatedAt;
 }