@desplega.ai/agent-swarm 2.0.0 → 2.1.0

package/src/be/db/model-profiles.ts

@@ -0,0 +1,315 @@
+/**
+ * Model profiles: a named (harness, model, effort) picked per task (`profile`)
+ * or applied as an agent's default (agent-scoped `MODEL_PROFILE` config row).
+ * Claim resolves them (`src/be/model-tier-resolution.ts`). See
+ * runbooks/model-tiers.md § Model profiles.
+ */
+import {
+  type ModelProfile,
+  type ProviderName,
+  ProviderNameSchema,
+  type ReasoningEffort,
+  ReasoningEffortSchema,
+} from "../../types";
+import { vcsRepoName, vcsRepoUrlMatches } from "../../utils/vcs-repo-match";
+import { getDbClient } from "./runtime";
+import { SUPERSEDED_RESUME_REPAIR_WINDOW_MS } from "./tasks/read";
+
+/** Agent-scoped swarm_config key holding the agent's default profile name. */
+export const MODEL_PROFILE_CONFIG_KEY = "MODEL_PROFILE";
+
+type ModelProfileRow = {
+  id: string;
+  name: string;
+  harness: string;
+  model: string;
+  effort: string | null;
+  allowCustomModel: number;
+  description: string | null;
+  seededFrom: string | null;
+  createdAt: string;
+  lastUpdatedAt: string;
+};
+
+function rowToModelProfile(row: ModelProfileRow): ModelProfile {
+  return {
+    id: row.id,
+    name: row.name,
+    harness: ProviderNameSchema.parse(row.harness),
+    model: row.model,
+    effort: ReasoningEffortSchema.safeParse(row.effort).success
+      ? (row.effort as ReasoningEffort)
+      : null,
+    allowCustomModel: row.allowCustomModel === 1,
+    description: row.description,
+    seededFrom: row.seededFrom,
+    createdAt: row.createdAt,
+    lastUpdatedAt: row.lastUpdatedAt,
+  };
+}
+
+export async function listModelProfiles(
+  filter: { harness?: ProviderName } = {},
+): Promise<ModelProfile[]> {
+  const rows = filter.harness
+    ? await getDbClient().query<ModelProfileRow>(
+        "SELECT * FROM model_profiles WHERE harness = ? ORDER BY harness, name",
+        [filter.harness],
+      )
+    : await getDbClient().query<ModelProfileRow>(
+        "SELECT * FROM model_profiles ORDER BY harness, name",
+      );
+  return rows.map(rowToModelProfile);
+}
+
+export async function getModelProfileByName(name: string): Promise<ModelProfile | null> {
+  const row = await getDbClient().get<ModelProfileRow>(
+    "SELECT * FROM model_profiles WHERE name = ?",
+    [name.trim()],
+  );
+  return row ? rowToModelProfile(row) : null;
+}
+
+export interface ModelProfileInput {
+  name: string;
+  harness: ProviderName;
+  model: string;
+  effort?: ReasoningEffort | null;
+  allowCustomModel?: boolean;
+  description?: string | null;
+  seededFrom?: string | null;
+}
+
+/** Insert a profile. Returns null when the name is taken. */
+export async function createModelProfile(
+  input: ModelProfileInput,
+  audit: { userId?: string | null } = {},
+): Promise<ModelProfile | null> {
+  const now = new Date().toISOString();
+  const row = await getDbClient().get<ModelProfileRow>(
+    `INSERT INTO model_profiles
+       (id, name, harness, model, effort, allowCustomModel, description, seededFrom, createdAt, lastUpdatedAt, created_by, updated_by)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(name) DO NOTHING
+     RETURNING *`,
+    [
+      crypto.randomUUID(),
+      input.name,
+      input.harness,
+      input.model,
+      input.effort ?? null,
+      input.allowCustomModel ? 1 : 0,
+      input.description ?? null,
+      input.seededFrom ?? null,
+      now,
+      now,
+      audit.userId ?? null,
+      audit.userId ?? null,
+    ],
+  );
+  return row ? rowToModelProfile(row) : null;
+}
+
+export type ModelProfilePatch = Partial<
+  Pick<ModelProfileInput, "model" | "effort" | "allowCustomModel" | "description">
+>;
+
+/** Update a profile's model, effort or description. The name and harness are fixed. */
+export async function updateModelProfile(
+  name: string,
+  patch: ModelProfilePatch,
+  audit: { userId?: string | null } = {},
+): Promise<ModelProfile | null> {
+  const sets: string[] = [];
+  const params: (string | number | null)[] = [];
+  if (patch.model !== undefined) {
+    sets.push("model = ?");
+    params.push(patch.model);
+  }
+  if (patch.effort !== undefined) {
+    sets.push("effort = ?");
+    params.push(patch.effort);
+  }
+  if (patch.allowCustomModel !== undefined) {
+    sets.push("allowCustomModel = ?");
+    params.push(patch.allowCustomModel ? 1 : 0);
+  }
+  if (patch.description !== undefined) {
+    sets.push("description = ?");
+    params.push(patch.description);
+  }
+  sets.push("lastUpdatedAt = ?", "updated_by = ?");
+  params.push(new Date().toISOString(), audit.userId ?? null);
+  const row = await getDbClient().get<ModelProfileRow>(
+    `UPDATE model_profiles SET ${sets.join(", ")} WHERE name = ? RETURNING *`,
+    [...params, name],
+  );
+  return row ? rowToModelProfile(row) : null;
+}
+
+/**
+ * Tasks (alias `t`) that still hold their profile: unfinished ones, and
+ * superseded ones still owed a resume. The resume copies the profile in a
+ * later write than the supersede (HTTP supersede, heartbeat remediation), and
+ * after a restart the heartbeat's orphan repair makes it, inside the same
+ * window (`SUPERSEDED_RESUME_REPAIR_WINDOW_MS`). Binds one parameter: the
+ * oldest `finishedAt` the repair still covers.
+ */
+const TASK_HOLDS_PROFILE_SQL = `(
+  t.status NOT IN ('completed', 'failed', 'cancelled', 'superseded')
+  OR (t.status = 'superseded'
+      AND t.workflowRunStepId IS NULL
+      AND (t.finishedAt IS NULL OR t.finishedAt > ?)
+      AND NOT EXISTS (
+        SELECT 1 FROM agent_tasks c WHERE c.parentTaskId = t.id AND c.taskType = 'resume')))`;
+
+function repairWindowStart(): string {
+  return new Date(Date.now() - SUPERSEDED_RESUME_REPAIR_WINDOW_MS).toISOString();
+}
+
+/** Who still points at a profile: agents with it as default, and tasks that still hold it. */
+export async function modelProfileReferences(
+  name: string,
+): Promise<{ agentIds: string[]; openTaskCount: number }> {
+  const agents = await getDbClient().query<{ scopeId: string }>(
+    "SELECT scopeId FROM swarm_config WHERE scope = 'agent' AND key = ? AND value = ?",
+    [MODEL_PROFILE_CONFIG_KEY, name],
+  );
+  const tasks = await getDbClient().get<{ n: number }>(
+    `SELECT COUNT(*) AS n FROM agent_tasks t WHERE t.profile = ? AND ${TASK_HOLDS_PROFILE_SQL}`,
+    [name, repairWindowStart()],
+  );
+  return { agentIds: agents.map((a) => a.scopeId), openTaskCount: tasks?.n ?? 0 };
+}
+
+/**
+ * Which migration-220 reference trigger refused a write: `missing` when a task
+ * or an agent default names a profile that does not exist.
+ */
+export function modelProfileRefError(error: unknown): "missing" | null {
+  const message = error instanceof Error ? error.message : "";
+  return message.includes("model-profile-missing:") ? "missing" : null;
+}
+
+/**
+ * Delete a profile unless a task still holds it (`TASK_HOLDS_PROFILE_SQL`) or
+ * an agent default names it. The check is part of the DELETE statement, so a
+ * reference written after the caller's own count still makes it `in-use`; the
+ * triggers in migration 220 refuse the opposite order (a reference written
+ * after this delete).
+ */
+export async function deleteModelProfile(name: string): Promise<"deleted" | "missing" | "in-use"> {
+  const row = await getDbClient().get<{ id: string }>(
+    `DELETE FROM model_profiles
+      WHERE name = ?
+        AND NOT EXISTS (
+          SELECT 1 FROM agent_tasks t
+           WHERE t.profile = model_profiles.name AND ${TASK_HOLDS_PROFILE_SQL})
+        AND NOT EXISTS (
+          SELECT 1 FROM swarm_config
+           WHERE scope = 'agent' AND key = ? AND trim(value) = model_profiles.name)
+      RETURNING id`,
+    [name, repairWindowStart(), MODEL_PROFILE_CONFIG_KEY],
+  );
+  if (row) return "deleted";
+  return (await getModelProfileByName(name)) ? "in-use" : "missing";
+}
+
+/** The agent's default profile name (agent-scoped MODEL_PROFILE), or null. */
+export async function getAgentDefaultProfileName(agentId: string): Promise<string | null> {
+  const row = await getDbClient().get<{ value: string }>(
+    "SELECT value FROM swarm_config WHERE scope = 'agent' AND scopeId = ? AND key = ?",
+    [agentId, MODEL_PROFILE_CONFIG_KEY],
+  );
+  return row?.value.trim() || null;
+}
+
+/**
+ * Which of MODEL_OVERRIDE / REASONING_EFFORT_OVERRIDE the task's repo sets at
+ * repo scope, exported or not. The worker env takes a repo row over the
+ * agent's own (repo > agent), and a withheld one removes the key, so the
+ * agent's default profile must not supply that axis. Finds the repo the way
+ * the worker does (`fetchRepoConfig`). `includeSecrets: false` leaves out
+ * secret rows, as `/api/config/resolved` does for a worker that cannot read
+ * them (`readsRepoSecrets`): that worker's env never gets them.
+ */
+export async function repoModelOverrideKeys(
+  vcsRepo: string | null | undefined,
+  { includeSecrets = true }: { includeSecrets?: boolean } = {},
+): Promise<Set<string>> {
+  if (!vcsRepo?.trim()) return new Set();
+  const repos = await getDbClient().query<{ id: string; url: string }>(
+    "SELECT id, url FROM swarm_repos WHERE name = ? ORDER BY name ASC",
+    [vcsRepoName(vcsRepo)],
+  );
+  const repo = repos.find((r) => vcsRepoUrlMatches(r.url, vcsRepo));
+  if (!repo) return new Set();
+  const rows = await getDbClient().query<{ key: string }>(
+    `SELECT key FROM swarm_config
+      WHERE scope = 'repo' AND scopeId = ? AND key IN ('MODEL_OVERRIDE', 'REASONING_EFFORT_OVERRIDE')
+        ${includeSecrets ? "" : "AND isSecret = 0"}`,
+    [repo.id],
+  );
+  return new Set(rows.map((row) => row.key));
+}
+
+/**
+ * Why a task cannot ask for `profile`, or null when it can. PR 1 validity is
+ * the harness only: the profile must exist and, when the target agent is known
+ * and has a harness, run on that harness. `profile` is exclusive with `model`
+ * and `modelTier`, which pick the model another way.
+ */
+export async function taskProfileError(check: {
+  profile?: string | null;
+  model?: string | null;
+  modelTier?: string | null;
+  agentId?: string | null;
+}): Promise<string | null> {
+  const name = check.profile?.trim();
+  if (!name) return null;
+  if (check.model?.trim() || check.modelTier?.trim()) {
+    return "Pass `profile`, or `model`/`modelTier`, not both.";
+  }
+  const profile = await getModelProfileByName(name);
+  if (!profile) {
+    return `Unknown model profile "${name}". List profiles with list-model-profiles.`;
+  }
+  if (!check.agentId) return null;
+  const agent = await getDbClient().get<{ harness: string | null }>(
+    "SELECT COALESCE(harness_provider, provider) AS harness FROM agents WHERE id = ?",
+    [check.agentId],
+  );
+  if (agent?.harness && agent.harness !== profile.harness) {
+    return `Model profile "${name}" runs on the ${profile.harness} harness; the target agent runs ${agent.harness}.`;
+  }
+  return null;
+}
+
+type OverrideRowState = { value: string; exportToEnv?: number } | null;
+
+/** What a config row does to the worker env: its value, withheld (exportToEnv off), or absent. */
+function effectiveOverride(row: OverrideRowState): string | null {
+  if (!row) return null;
+  return row.exportToEnv === 0 ? "\u0000withheld" : row.value;
+}
+
+/**
+ * An agent's default model profile (MODEL_PROFILE) beats its MODEL_OVERRIDE and
+ * REASONING_EFFORT_OVERRIDE at claim. An effective change to either override, by
+ * any path, drops the profile default, so a stale default never beats a fresh
+ * override. Effective means what the worker env sees: the value, and whether
+ * the row is exported (`exportToEnv`).
+ */
+export async function clearAgentModelProfileOnOverrideChange(
+  agentId: string,
+  key: string,
+  before: OverrideRowState,
+  after: OverrideRowState,
+): Promise<void> {
+  if (key !== "MODEL_OVERRIDE" && key !== "REASONING_EFFORT_OVERRIDE") return;
+  if (effectiveOverride(before) === effectiveOverride(after)) return;
+  await getDbClient().run(
+    "DELETE FROM swarm_config WHERE scope = 'agent' AND scopeId = ? AND key = ?",
+    [agentId, MODEL_PROFILE_CONFIG_KEY],
+  );
+}

package/src/be/db/tasks/read.ts

@@ -92,6 +92,8 @@ export type AgentTaskRow = {
   resolvedModel?: string | null;
   modelSource?: string | null;
   modelAlias?: string | null;
+  profile?: string | null;
+  resolvedProfile?: string | null;
   scheduleId: string | null;
   workflowRunId: string | null;
   workflowRunStepId: string | null;
@@ -322,6 +324,8 @@ export function rowToAgentTask(row: AgentTaskRow): AgentTask {
     resolvedEffort: ReasoningEffortSchema.safeParse(row.resolvedEffort).success
       ? (row.resolvedEffort as ReasoningEffort)
       : undefined,
+    profile: row.profile ?? undefined,
+    resolvedProfile: row.resolvedProfile ?? undefined,
     scheduleId: row.scheduleId ?? undefined,
     workflowRunId: row.workflowRunId ?? undefined,
     workflowRunStepId: row.workflowRunStepId ?? undefined,
@@ -456,6 +460,9 @@ export async function hasNonTerminalResumeChild(parentId: string): Promise<boole
   return row !== undefined && row !== null;
 }
 
+/** How far back the heartbeat repairs a superseded task that never got a resume. */
+export const SUPERSEDED_RESUME_REPAIR_WINDOW_MS = 24 * 60 * 60 * 1000;
+
 /**
  * Superseded tasks that never got a resume child. Both supersede paths
  * (heartbeat remediation and `POST /api/tasks/:id/supersede`) supersede

package/src/be/db.ts

@@ -193,6 +193,7 @@ import {
   createContextVersion,
   getLatestContextVersion,
 } from "./db/context-versions";
+import { clearAgentModelProfileOnOverrideChange } from "./db/model-profiles";
 import { getDb, getDbClient } from "./db/runtime";
 import { classifyTaskHumanFree, reclassifyTaskHumanFree } from "./db/tasks/human-free";
 import {
@@ -342,6 +343,7 @@ export {
   type PendingChatRelay,
   recordChatRelayError,
   resetTasksNotified,
+  SUPERSEDED_RESUME_REPAIR_WINDOW_MS,
   type TaskFilters,
 } from "./db/tasks/read";
 
@@ -2857,9 +2859,9 @@ export async function createTaskExtended(
         vcsProvider, vcsRepo, vcsEventType, vcsNumber, vcsCommentId, vcsAuthor, vcsUrl,
         vcsInstallationId, vcsNodeId,
         agentmailInboxId, agentmailMessageId, agentmailThreadId,
-        mentionMessageId, mentionChannelId, dir, parentTaskId, model, modelTier, effort, scheduleId,
+        mentionMessageId, mentionChannelId, dir, parentTaskId, model, modelTier, effort, profile, scheduleId,
         workflowRunId, workflowRunStepId, outputSchema, followUpConfig, requestedByUserId, requestedByUserIdInherited, contextKey, routingAffinity, swarmVersion, createdAt, lastUpdatedAt, created_by, updated_by, isHumanFree
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
       [
         id,
         assetKey,
@@ -2901,6 +2903,7 @@ export async function createTaskExtended(
         options?.model ?? null,
         options?.modelTier ?? null,
         options?.effort ?? null,
+        options?.profile?.trim() || null,
         options?.scheduleId ?? null,
         options?.workflowRunId ?? null,
         options?.workflowRunStepId ?? null,
@@ -6662,55 +6665,55 @@ export async function upsertSwarmConfig(data: {
   const row = await getDbClient().transaction(async () => {
     const existing =
       scopeId === null
-        ? await getDbClient().get<{ id: string }>(
-            "SELECT id FROM swarm_config WHERE scope = ? AND scopeId IS NULL AND key = ?",
+        ? await getDbClient().get<SwarmConfigRow>(
+            "SELECT * FROM swarm_config WHERE scope = ? AND scopeId IS NULL AND key = ?",
             [data.scope, data.key],
           )
-        : await getDbClient().get<{ id: string }>(
-            "SELECT id FROM swarm_config WHERE scope = ? AND scopeId = ? AND key = ?",
+        : await getDbClient().get<SwarmConfigRow>(
+            "SELECT * FROM swarm_config WHERE scope = ? AND scopeId = ? AND key = ?",
             [data.scope, scopeId, data.key],
           );
 
-    if (existing) {
-      // COALESCE keeps the stored flag when the caller did not send one.
-      return await getDbClient().get<SwarmConfigRow>(
-        `UPDATE swarm_config SET value = ?, isSecret = ?, envPath = ?, description = ?, encrypted = ?, lastUpdatedAt = ?,
-           exportToEnv = CASE WHEN ? THEN 0 ELSE COALESCE(?, exportToEnv) END
-         WHERE id = ? RETURNING *`,
-        [
-          storedValue,
-          isSecret,
-          envPath,
-          description,
-          encryptedFlag,
-          now,
-          restricted ? 1 : 0,
-          data.exportToEnv === undefined ? null : data.exportToEnv ? 1 : 0,
-          existing.id,
-        ],
-      );
+    // COALESCE keeps the stored flag when the caller did not send one.
+    const written = existing
+      ? await getDbClient().get<SwarmConfigRow>(
+          `UPDATE swarm_config SET value = ?, isSecret = ?, envPath = ?, description = ?, encrypted = ?, lastUpdatedAt = ?,
+             exportToEnv = CASE WHEN ? THEN 0 ELSE COALESCE(?, exportToEnv) END
+           WHERE id = ? RETURNING *`,
+          [
+            storedValue,
+            isSecret,
+            envPath,
+            description,
+            encryptedFlag,
+            now,
+            restricted ? 1 : 0,
+            data.exportToEnv === undefined ? null : data.exportToEnv ? 1 : 0,
+            existing.id,
+          ],
+        )
+      : await getDbClient().get<SwarmConfigRow>(
+          `INSERT INTO swarm_config (id, scope, scopeId, key, value, isSecret, envPath, description, createdAt, lastUpdatedAt, encrypted, exportToEnv)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
+          [
+            crypto.randomUUID(),
+            data.scope,
+            scopeId,
+            data.key,
+            storedValue,
+            isSecret,
+            envPath,
+            description,
+            now,
+            now,
+            encryptedFlag,
+            restricted ? 0 : (data.exportToEnv ?? defaultExportToEnv(data.key)) ? 1 : 0,
+          ],
+        );
+    if (data.scope === "agent" && scopeId) {
+      await clearAgentModelProfileOnOverrideChange(scopeId, data.key, existing, written);
     }
-
-    const id = crypto.randomUUID();
-    const exportToEnv = restricted ? 0 : (data.exportToEnv ?? defaultExportToEnv(data.key)) ? 1 : 0;
-    return await getDbClient().get<SwarmConfigRow>(
-      `INSERT INTO swarm_config (id, scope, scopeId, key, value, isSecret, envPath, description, createdAt, lastUpdatedAt, encrypted, exportToEnv)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
-      [
-        id,
-        data.scope,
-        scopeId,
-        data.key,
-        storedValue,
-        isSecret,
-        envPath,
-        description,
-        now,
-        now,
-        encryptedFlag,
-        exportToEnv,
-      ],
-    );
+    return written;
   });
 
   if (!row) throw new Error("Failed to upsert swarm config");
@@ -6759,10 +6762,13 @@ export async function emitBuiltInIntegrationConnectedOnce(
  * predate hardening must remain removable through remediation paths.
  */
 export async function deleteSwarmConfig(id: string): Promise<boolean> {
-  const row = await getDbClient().get<Pick<SwarmConfigRow, "scope" | "scopeId">>(
-    "DELETE FROM swarm_config WHERE id = ? RETURNING scope, scopeId",
+  const row = await getDbClient().get<SwarmConfigRow>(
+    "DELETE FROM swarm_config WHERE id = ? RETURNING *",
     [id],
   );
+  if (row?.scope === "agent" && row.scopeId) {
+    await clearAgentModelProfileOnOverrideChange(row.scopeId, row.key, row, null);
+  }
   if (row) getDbClient().afterCommit(() => publishWorkerConfigNudge(row.scope, row.scopeId));
   return row !== null;
 }

package/src/be/migrations/219_relabel_pi_context_compactions.sql

@@ -0,0 +1,22 @@
+-- The pi extension posted its per-LLM-call `context` usage snapshot as
+-- eventType 'compaction', so every pi turn drew an AUTO COMPACTION divider and
+-- bumped agent_tasks.compactionCount. Those rows never carry compactTrigger or
+-- preCompactTokens (real compactions from every harness do). Relabel them as
+-- 'progress' and recompute the counter for the pi tasks.
+
+UPDATE task_context_snapshots
+SET eventType = 'progress'
+WHERE eventType = 'compaction'
+  AND compactTrigger IS NULL
+  AND preCompactTokens IS NULL
+  AND sessionId LIKE 'pi-%'
+  AND taskId IN (SELECT id FROM agent_tasks WHERE provider = 'pi');
+
+UPDATE agent_tasks
+SET compactionCount = (
+  SELECT COUNT(*)
+  FROM task_context_snapshots s
+  WHERE s.taskId = agent_tasks.id AND s.eventType = 'compaction'
+)
+WHERE provider = 'pi'
+  AND COALESCE(compactionCount, 0) > 0;

package/src/be/migrations/220_model_profiles.sql

@@ -0,0 +1,137 @@
+-- Model profiles (runbooks/model-tiers.md § Model profiles): a named
+-- (harness, model, effort) that Lead picks per task or that applies as an
+-- agent's default. Claim stamps the profile on the task. The tier seeds
+-- (`<harness>-<tier>`) are written at boot by src/be/seed-model-profiles.ts.
+CREATE TABLE IF NOT EXISTS model_profiles (
+  id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+  name TEXT NOT NULL UNIQUE,
+  harness TEXT NOT NULL,
+  model TEXT NOT NULL,
+  effort TEXT,
+  allowCustomModel INTEGER NOT NULL DEFAULT 0,
+  description TEXT,
+  -- `tier:<tier>` for a boot seed, `agent-config` for a profile this migration
+  -- made from an agent's MODEL_OVERRIDE, NULL for one an operator created.
+  seededFrom TEXT,
+  createdAt TEXT NOT NULL,
+  lastUpdatedAt TEXT NOT NULL,
+  created_by TEXT REFERENCES users(id),
+  updated_by TEXT REFERENCES users(id)
+);
+
+-- `profile` is the creator's ask; `resolvedProfile` is the name claim applied
+-- (the task's ask or the agent's default), mirroring model / resolvedModel.
+ALTER TABLE agent_tasks ADD COLUMN profile TEXT;
+ALTER TABLE agent_tasks ADD COLUMN resolvedProfile TEXT;
+
+-- A profile name a task asks for, or an agent has as its default, must exist
+-- when the row is written. Enforced here so the check and the write are one
+-- statement: an app-level check before a separate insert races a concurrent
+-- delete. The delete side is the matching single-statement guard in
+-- deleteModelProfile (src/be/db/model-profiles.ts). It is not a trigger on
+-- model_profiles because one reading agent_tasks would break every later
+-- migration that rebuilds agent_tasks (DROP + RENAME re-parses that trigger).
+CREATE TRIGGER IF NOT EXISTS model_profiles_task_ref_insert
+BEFORE INSERT ON agent_tasks
+WHEN NEW.profile IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM model_profiles WHERE name = NEW.profile)
+BEGIN
+  SELECT RAISE(ABORT, 'model-profile-missing: the task''s model profile does not exist');
+END;
+
+CREATE TRIGGER IF NOT EXISTS model_profiles_task_ref_update
+BEFORE UPDATE OF profile ON agent_tasks
+WHEN NEW.profile IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM model_profiles WHERE name = NEW.profile)
+BEGIN
+  SELECT RAISE(ABORT, 'model-profile-missing: the task''s model profile does not exist');
+END;
+
+CREATE TRIGGER IF NOT EXISTS model_profiles_default_ref_insert
+BEFORE INSERT ON swarm_config
+WHEN NEW.scope = 'agent' AND NEW.key = 'MODEL_PROFILE'
+  AND NOT EXISTS (SELECT 1 FROM model_profiles WHERE name = trim(NEW.value))
+BEGIN
+  SELECT RAISE(ABORT, 'model-profile-missing: the agent''s default model profile does not exist');
+END;
+
+CREATE TRIGGER IF NOT EXISTS model_profiles_default_ref_update
+BEFORE UPDATE OF scope, key, value ON swarm_config
+WHEN NEW.scope = 'agent' AND NEW.key = 'MODEL_PROFILE'
+  AND NOT EXISTS (SELECT 1 FROM model_profiles WHERE name = trim(NEW.value))
+BEGIN
+  SELECT RAISE(ABORT, 'model-profile-missing: the agent''s default model profile does not exist');
+END;
+
+-- Each agent's MODEL_OVERRIDE + REASONING_EFFORT_OVERRIDE pair becomes a
+-- profile, deduped by (harness, model, effort), and that agent's default
+-- (agent-scoped MODEL_PROFILE, never exported to the worker env). Claim then
+-- supplies the same model and effort the worker read from its env before.
+-- A row with exportToEnv = 0 never reached the worker, so it is not carried
+-- over: a withheld model makes no default, a withheld effort no profile effort.
+-- ACP keeps MODEL_OVERRIDE (no portable mapping); `latest:` aliases are not
+-- valid agent defaults, so they are left alone too.
+CREATE TEMP TABLE _model_profile_overrides AS
+SELECT
+  a.id AS agentId,
+  COALESCE(a.harness_provider, a.provider) AS harness,
+  trim(m.value) AS model,
+  CASE
+    WHEN lower(trim(e.value)) IN ('off', 'low', 'medium', 'high', 'xhigh', 'max')
+      THEN lower(trim(e.value))
+  END AS effort
+FROM agents a
+JOIN swarm_config m
+  ON m.scope = 'agent' AND m.scopeId = a.id AND m.key = 'MODEL_OVERRIDE'
+  AND m.isSecret = 0 AND m.encrypted = 0 AND m.exportToEnv = 1
+LEFT JOIN swarm_config e
+  ON e.scope = 'agent' AND e.scopeId = a.id AND e.key = 'REASONING_EFFORT_OVERRIDE'
+  AND e.isSecret = 0 AND e.encrypted = 0 AND e.exportToEnv = 1
+WHERE COALESCE(a.harness_provider, a.provider) IS NOT NULL
+  AND COALESCE(a.harness_provider, a.provider) <> 'acp'
+  AND trim(m.value) <> ''
+  AND lower(trim(m.value)) NOT LIKE 'latest:%';
+
+-- Name: `<harness>-<model>[-<effort>]`, without repeating a harness prefix the
+-- model already carries, e.g. `codex-gpt-6.1-sol-xhigh`, `claude-opus-5-5-high`.
+INSERT OR IGNORE INTO model_profiles
+  (name, harness, model, effort, allowCustomModel, description, seededFrom, createdAt, lastUpdatedAt)
+SELECT
+  lower(replace(replace(
+    CASE WHEN lower(model) LIKE lower(harness) || '-%' THEN model ELSE harness || '-' || model END,
+    '/', '-'), ':', '-')) || COALESCE('-' || effort, ''),
+  harness,
+  model,
+  effort,
+  1,
+  'Created from an agent''s MODEL_OVERRIDE and REASONING_EFFORT_OVERRIDE.',
+  'agent-config',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+FROM _model_profile_overrides
+GROUP BY harness, model, effort;
+
+INSERT OR IGNORE INTO swarm_config
+  (id, scope, scopeId, key, value, isSecret, envPath, description, createdAt, lastUpdatedAt, encrypted, exportToEnv)
+SELECT
+  lower(hex(randomblob(4))) || '-' || lower(hex(randomblob(2))) || '-4' ||
+    substr(lower(hex(randomblob(2))), 2) || '-' ||
+    substr('89ab', 1 + (abs(random()) % 4), 1) || substr(lower(hex(randomblob(2))), 2) || '-' ||
+    lower(hex(randomblob(6))),
+  'agent',
+  o.agentId,
+  'MODEL_PROFILE',
+  p.name,
+  0,
+  NULL,
+  'Default model profile, created from this agent''s MODEL_OVERRIDE.',
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+  0,
+  0
+FROM _model_profile_overrides o
+JOIN model_profiles p
+  ON p.harness = o.harness AND p.model = o.model AND p.effort IS o.effort
+  AND p.seededFrom = 'agent-config';
+
+DROP TABLE _model_profile_overrides;