@gotcos/glasses-server 6.43.3 → 6.44.0

package/CHANGELOG.md

@@ -1,3 +1,53 @@
+## 6.44.0
+
+Task store: one COS `tasks.md` contract with a durable lock, columns, and a run ledger.
+
+- Bridge subcommands `task-rows`, `task-capture`, `task-set-run-at`, `task-set-marker`, `task-move`, and `task-check` are first-class. Standalone installs without a COS pipeline return `cos_pipeline_not_configured` instead of an empty object.
+- `GET /api/tasks` and `/api/tasks/runs` project the board and the ledger. Capture, check, move, and schedule go through the same writer lock the Python side uses.
+- Morning-brief config gains `taskCatchUpMinutes` (default 180). Task due/missed math uses `taskInstant`, which steps a spring-forward gap by 60 minutes instead of pretending `zonedInstant` already did that.
+- Health advertises `capabilities.tasks.gate` so a new client can tell an old server from a new one.
+- `POST /api/tasks/:id/run` is Run now: a restricted Claude job (`Read` / `Grep` / `Glob`) on the same durable path as the morning brief. The same task already live → 409 `task_running`. A second different task while the slot is reserved → 503 `dispatch_slots_busy`.
+- `GET /api/tasks` returns `{ tasks, workBadge, gate }`. A client that still expects a domain map must adapt.
+
+## 6.43.4
+
+Every message now says who started it.
+
+- **Server-started jobs carry an origin label.** A durable job request may
+  carry `origin: { kind: 'routine' | 'task', id }`; the scheduled morning
+  brief sends `{ kind: 'routine', id: 'morning-brief' }`. The label lands on
+  both halves of the projected exchange (`origin`, `originId`), on the display
+  bus (`start`, `done`, `error`, flattened to the same two keys), and on the
+  today/all-messages and day-archive views the phone and COS Control read.
+  A prompt typed on the phone carries nothing; the phone's own `G2` stamp
+  never reaches the server. Nothing is inferred from the label's absence.
+- **The request fingerprint is pinned to the sixteen identity keys it always
+  had.** `origin` (and any future provenance or enforcement key) is outside
+  it, so a build that does not know the key still hydrates a journal written
+  by one that does, and a rollback from this version to 6.43.3 keeps every
+  retained job. Stored fingerprints are byte-identical before and after.
+- **Admission is strict only about a known kind with a bad id (400
+  `invalid_origin`).** An unknown kind, and the phone's bare-string stamp, are
+  dropped and counted on both paths, so a newer client's label degrades to
+  unlabeled and never refuses the job; hydration is lenient throughout. Two new
+  store counters on `/api/health`: `originDropped` (once per job created, once
+  per journal record hydrated) and `fingerprintMismatches` — the second is a
+  job that did NOT hydrate, and the first mismatch logs at error level. No
+  client reads either yet; `/api/health` is where a human sees them.
+- **The label is validated at every boundary it crosses.** The conversation
+  store drops an unknown kind (and an orphan id) when it loads from disk, and
+  the bus stamp is spread after provider metadata so no provider key can
+  overwrite it. A real 6.43.3-written journal is committed as a fixture and
+  hydrated by the suite, in addition to the in-process hash oracle.
+- **The scheduler adopts an admitted brief on every scheduled fire**, not only
+  on the crash-resume branch, and replaces the last of the day's scheduled
+  ledger rows instead of pushing another; "Run now" and the scheduled tick
+  are serialised, so two overlapping admissions can no longer interleave. A
+  manual and a scheduled brief on the same day remain two briefs, by design.
+- Briefs that ran on 6.43.0–6.43.3 stay unlabeled; badges start with runs
+  from this version. A routine's reply is unlabeled while it is still running
+  and gains the label when it lands.
+
 ## 6.43.3
 
 Managed-server updates no longer hinge on one vendor's meter.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.43.3",
+  "version": "6.44.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -59,6 +59,7 @@ import { promptEditRouter } from './routes/prompt-edit.js'
 import { bookmarksRouter } from './routes/bookmarks.js'
 import { welcomeContextRouter } from './routes/welcome-context.js'
 import { liveCuesRouter } from './routes/live-cues.js'
+import { tasksRouter } from './routes/tasks.js'
 import { memoryRouter } from './routes/memory.js'
 import { threadsRouter } from './routes/threads.js'
 import { shutdownLiveCues } from './lib/live-cues-engine.js'
@@ -689,6 +690,7 @@ app.use('/api', promptEditRouter)
 app.use('/api', bookmarksRouter)
 app.use('/api', welcomeContextRouter)
 app.use('/api', liveCuesRouter)
+app.use('/api', tasksRouter)
 
 // OpenAI-compatible endpoint for the G2 Agent (ER "Add Agent")
 // Mounted at root — routes are /v1/chat/completions and /v1/models

package/server/lib/__fixtures__/query-jobs-6.43.3/2099-01-01.jsonl

@@ -0,0 +1,2 @@
+{"schemaVersion":1,"recordId":"02b09947-ed7d-47ef-99c5-4985af3ec924","partitionDay":"2099-01-01","persistedAt":"2099-01-01T12:00:00.000Z","bootId":"boot-6-43-3-fixture","jobId":"43b397bd-dd67-4312-9a5c-4c5d4b246f1d","clientJobId":"11111111-1111-4111-8111-111111111111","generation":2,"turnId":"a456fd1d-1e82-4b2d-8a20-5d34681201fd","requestFingerprint":"024966024134bf0d46090335da03a732a7fb7eaea161b1fd07dc4c5b9d536e95","eventSeq":1,"type":"accepted","status":"accepted","request":{"clientJobId":"11111111-1111-4111-8111-111111111111","generation":2,"query":"written by 6.43.3","sessionId":"session-6-43-3","model":"opus","effort":"high","cursorExecutionMode":"ask","messageEra":"era1","globalMsgNum":78,"reference":{"query":"earlier q","response":"earlier a"},"handoffCode":"ABCD","handoffLatest":true,"clientQueueItemId":"q1","attachmentIds":[],"attachmentRefs":[],"activityToolMode":"status"},"patch":{},"eventData":{"requestFingerprint":"024966024134bf0d46090335da03a732a7fb7eaea161b1fd07dc4c5b9d536e95"}}
+{"schemaVersion":1,"recordId":"a1145a40-2ced-4da3-9cf7-76d84cffc946","partitionDay":"2099-01-01","persistedAt":"2099-01-01T12:00:00.000Z","bootId":"boot-6-43-3-fixture","jobId":"64c5b502-13f2-4871-b6c4-007b91be2414","clientJobId":"22222222-2222-4222-8222-222222222222","generation":1,"turnId":"843e633f-0f92-4fe3-b2a1-9dc683715791","requestFingerprint":"91edfdeeb088e9fb3b1ffab4202bca02d3e7a23674d8b54dd51a50ce9adbf638","eventSeq":1,"type":"accepted","status":"accepted","request":{"clientJobId":"22222222-2222-4222-8222-222222222222","generation":1,"query":"minimal by 6.43.3","sessionId":"session-6-43-3-min","attachmentIds":[],"attachmentRefs":[],"activityToolMode":"status"},"patch":{},"eventData":{"requestFingerprint":"91edfdeeb088e9fb3b1ffab4202bca02d3e7a23674d8b54dd51a50ce9adbf638"}}

package/server/lib/archive.ts

@@ -472,7 +472,8 @@ export function getArchiveChats(date: string): ArchiveChatSummary[] {
 }
 
 /** Get paired Q&A messages for a specific chat within a day. Request refs on
- * the user turn and model-output refs on the assistant turn surface together. */
+ * the user turn and model-output refs on the assistant turn surface together.
+ * Deliberately no origin label here (6.43.4): the day view carries it. */
 export function getArchiveChatMessages(
   date: string,
   chatIndex: number,
@@ -507,11 +508,11 @@ export function getArchiveChatMessages(
  *  (sessionId, timestamp) instead of bare timestamp (collision-prone). */
 export function getArchiveDayMessages(
   date: string,
-): Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; attachments?: MediaAttachmentRef[] }> {
+): Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; origin?: 'routine' | 'task'; originId?: string; attachments?: MediaAttachmentRef[] }> {
   const archive = loadArchive(date)
   if (!archive) return []
 
-  const messages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; attachments?: MediaAttachmentRef[] }> = []
+  const messages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; no?: number; globalMsgNum?: number; messageEra?: string; modelPreference?: string; origin?: 'routine' | 'task'; originId?: string; attachments?: MediaAttachmentRef[] }> = []
   for (const chat of archive.chats) {
     for (let i = 0; i < chat.exchanges.length; i++) {
       const ex = chat.exchanges[i]
@@ -522,6 +523,8 @@ export function getArchiveDayMessages(
           const globalMsgNum = ex.globalMsgNum ?? next.globalMsgNum
           const messageEra = ex.messageEra ?? next.messageEra
           const modelPreference = resolveExchangePairModel(ex, next, null)
+          // Same one-half rule as the live view (routes/sessions.ts).
+          const stamped = ex.origin ? ex : next
           messages.push({
             query: ex.content,
             text: next.content,
@@ -531,6 +534,7 @@ export function getArchiveDayMessages(
             ...(globalMsgNum != null ? { no: globalMsgNum, globalMsgNum } : {}),
             ...(messageEra ? { messageEra } : {}),
             ...(modelPreference ? { modelPreference } : {}),
+            ...(stamped.origin ? { origin: stamped.origin, ...(stamped.originId ? { originId: stamped.originId } : {}) } : {}),
             ...(attachments.length > 0 ? { attachments } : {}),
           })
           i++

package/server/lib/claude-bridge.ts

@@ -54,6 +54,7 @@ import {
   buildClaudeToolList,
   claudeMcpConfigArgs,
   claudeToolCapabilityPrompt,
+  readOnlyCapabilityPrompt,
 } from './claude-tool-access.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
 import { claudePermissionArgs, getClaudeTrustMode } from './claude-permissions.js'
@@ -388,6 +389,8 @@ export interface CallOptions {
   cursorExecutionMode?: import('../../shared/model-preference.js').CursorExecutionMode
   /** Durable coordinator already owns the per-session provider lease. */
   sessionLockHeld?: boolean
+  /** Read-only scheduled-task dispatch. Same shape as QueryJobRequest.dispatch. */
+  dispatch?: { restricted: true; tools: readonly string[] }
 }
 
 export async function callClaudeStreaming(
@@ -418,7 +421,7 @@ export async function callClaudeStreaming(
   // Notify client immediately — model is known before any async work
   // Pass existing CLI session ID if resuming (new sessions get it after first result)
   const resolvedCliKey = cliSessionKey(sid, resolvedModel)
-  let existingCliSession = cliSessionMap.get(resolvedCliKey)
+  let existingCliSession = options?.dispatch ? undefined : cliSessionMap.get(resolvedCliKey)
   callbacks.onStart?.(resolvedModel, sid, existingCliSession, {
     clientJobId: options?.clientJobId,
     generation: options?.generation,
@@ -461,14 +464,18 @@ export async function callClaudeStreaming(
   const allowedToolList = buildClaudeToolList({
     publisherTool: outputImagePublisher?.claudeAllowedTool,
   })
-  let mcpConfigArgs: string[]
-  try {
-    mcpConfigArgs = claudeMcpConfigArgs()
-  } catch (err) {
-    outputImagePublisher?.cleanup()
-    throw err
+  let mcpConfigArgs: string[] = []
+  if (!options?.dispatch) {
+    try {
+      mcpConfigArgs = claudeMcpConfigArgs()
+    } catch (err) {
+      outputImagePublisher?.cleanup()
+      throw err
+    }
   }
-  systemPrompt = `${systemPrompt}\n\n${claudeToolCapabilityPrompt(allowedToolList)}`
+  systemPrompt = options?.dispatch
+    ? `${systemPrompt}\n\n${readOnlyCapabilityPrompt('scheduled task dispatch', 'Read, Grep and Glob only; no writes, no shell, no web', 'the task owner on the Mac')}`
+    : `${systemPrompt}\n\n${claudeToolCapabilityPrompt(allowedToolList)}`
   if (outputImagePublisher) systemPrompt = `${systemPrompt}\n\n${outputImagePublisher.promptInstructions}`
 
   // Phase: thinking (waiting for Claude to start)
@@ -519,7 +526,8 @@ export async function callClaudeStreaming(
 
   // Check if we have a prior CLI session for this COS session.
   // If not, use the pre-warmed session (eliminates 2-15s cold start on first query).
-  if (!existingCliSession && preWarmedCliSessionId && resolvedModel === DEFAULT_MODEL) {
+  // Restricted dispatch never steals the pre-warmed unrestricted session.
+  if (!options?.dispatch && !existingCliSession && preWarmedCliSessionId && resolvedModel === DEFAULT_MODEL) {
     // Only the default model consumes the pre-warmed session.
     // Hey Even (Haiku) cold-starts its own session to avoid model contamination.
     existingCliSession = preWarmedCliSessionId
@@ -540,11 +548,21 @@ export async function callClaudeStreaming(
     '--output-format', 'stream-json',
     '--verbose',  // Required: stream-json requires --verbose
     '--system-prompt', systemPrompt,
-    ...mcpConfigArgs,
+    ...(options?.dispatch ? [] : mcpConfigArgs),
   ]
 
   // Full and lightweight paths share the same explicit MCP selector contract.
-  if (options?.lightweight) {
+  if (options?.dispatch) {
+    args.push(
+      '--restricted',
+      '--tools', options.dispatch.tools.join(','),
+      '--permission-mode', 'dontAsk',
+      '--strict-mcp-config',
+      '--mcp-config', '{"mcpServers":{}}',
+      '--no-session-persistence',
+      '--include-partial-messages',
+    )
+  } else if (options?.lightweight) {
     args.push(...claudePermissionArgs(getClaudeTrustMode(), tools))
   } else {
     args.push(...claudePermissionArgs(getClaudeTrustMode(), tools), '--include-partial-messages')
@@ -929,7 +947,7 @@ export async function callClaudeStreaming(
             continue
           }
           // Capture CLI session ID for future --resume (avoids cold start on next query)
-          if (event.session_id) {
+          if (event.session_id && !options?.dispatch) {
             cliSessionMap.set(resolvedCliKey, event.session_id)
             scheduleCliSessionSave()
             updateClaudeRun(run.runId, { cliSessionId: event.session_id })

package/server/lib/conversation.ts

@@ -37,6 +37,20 @@ export interface Exchange {
    * photos on the user exchange, model-published images on the assistant
    * exchange. Bytes, filesystem paths, and capabilities never persist here. */
   attachments?: MediaAttachmentRef[]
+  /** Who started the job that produced this pair, when it was not the person
+   * on the phone or the glasses: `routine` (the scheduler) or `task` (a
+   * dispatched task). Absent on every human prompt. The phone's own `g2` stamp
+   * never reaches the server; this is the server's half of the label. */
+  origin?: 'routine' | 'task'
+  /** `morning-brief`, or a task's 12-hex id. */
+  originId?: string
+}
+
+/** Structural twin of `QueryJobOrigin` so the conversation store takes no
+ * import from the job module. */
+export interface ExchangeOriginStamp {
+  kind: 'routine' | 'task'
+  id: string
 }
 
 export interface ExchangeJobProvenance {
@@ -159,6 +173,14 @@ function loadFromDisk(): void {
         if (refs.length > 0) exchange.attachments = refs
         else delete exchange.attachments
       }
+      // Same boundary for the origin label (6.43.4): only the two kinds this
+      // build renders survive a load, and an id never survives without its kind.
+      if (exchange.origin !== 'routine' && exchange.origin !== 'task') {
+        delete exchange.origin
+        delete exchange.originId
+      } else if (typeof exchange.originId !== 'string' || !exchange.originId) {
+        delete exchange.originId
+      }
     }
     sessions.set(id, session)
     loaded++
@@ -528,6 +550,7 @@ export function reconcileExchangeByJobIdentity(
   attachments?: MediaAttachmentRef[],
   messageEra?: string,
   modelPreference?: ModelPreference | null,
+  origin?: ExchangeOriginStamp,
 ): ReconciledExchange {
   if (!validClientJobId(identity.clientJobId) || !validGeneration(identity.generation)) {
     throw new Error('conversation: invalid durable job identity')
@@ -572,6 +595,7 @@ export function reconcileExchangeByJobIdentity(
       generation: identity.generation,
       ...(stampedModel ? { modelPreference: stampedModel } : {}),
       ...(validatedAttachments.length > 0 ? { attachments: validatedAttachments } : {}),
+      ...(origin ? { origin: origin.kind, originId: origin.id } : {}),
     }
     session.exchanges.push(exchange)
   } else {
@@ -580,6 +604,9 @@ export function reconcileExchangeByJobIdentity(
     exchange.globalMsgNum = globalMsgNum
     exchange.messageEra = projectedMessageEra
     if (stampedModel) exchange.modelPreference = stampedModel
+    // Guarded like the model: the cursor and ollama bridges reconcile the user
+    // half mid-run WITHOUT an origin, and must not erase the runtime's stamp.
+    if (origin) { exchange.origin = origin.kind; exchange.originId = origin.id }
     if (validatedAttachments.length > 0) exchange.attachments = validatedAttachments
     else delete exchange.attachments
 

package/server/lib/maintenance-lifecycle.ts

@@ -54,6 +54,12 @@ export type MaintenanceWorkKind =
   // budget must stay under COS Control's 90s drain timeout (main.swift:1853)
   // or every drain that catches a cue in flight hard-fails to Repair.
   | 'live_cue_pipeline'
+  // Scheduled-task dispatch and reconcile (6.44.0). Held for
+  // TASK_LEASE_CEILING_MS so an Update Server drain cannot unload the
+  // server while a restricted Claude submit or marker write is live.
+  // Two `task_dispatch` leases (dispatch + reconcile) are expected —
+  // acquire() is a concurrent Map, not a per-kind mutex.
+  | 'task_dispatch'
   // Miles-triggered recovery of a quarantined unsaved capture (6.19.0):
   // batch-transcribes retained WAVs into a durable scribe. Held for the whole
   // background run so an Update Server drain waits for it like any batch.

package/server/lib/model-router.ts

@@ -105,6 +105,10 @@ export async function callModelStreaming(
   }
 
   try {
+    if (options?.dispatch && !isClaudeModel(resolvedModel)) {
+      await lockedCallbacks.onError('dispatch_requires_claude')
+      return sid
+    }
     // Cursor slots fail closed — never fall through to Claude/Codex.
     if (isCursorModel(resolvedModel)) {
       await getCursorModelCatalog()

package/server/lib/morning-brief-config.ts

@@ -29,6 +29,12 @@ import {
 export const MORNING_BRIEF_PROTOCOL_VERSION = 1 as const
 export const MORNING_BRIEF_CONFIG_VERSION = 1 as const
 
+export const TASK_CATCH_UP_LIMITS = Object.freeze({
+  defaultMinutes: 180,
+  minMinutes: 30,
+  maxMinutes: 720,
+})
+
 export const MORNING_BRIEF_LIMITS = Object.freeze({
   /** How late after the slot a missed fire may still happen (Mac was asleep). */
   maxCatchUpMinutes: 12 * 60,
@@ -91,6 +97,8 @@ export interface MorningBriefConfig {
   /** 0 = Sunday … 6 = Saturday. */
   days: number[]
   catchUpMinutes: number
+  /** How late a task runAt may still count as due (not missed). */
+  taskCatchUpMinutes: number
   model?: ModelPreference
   effort?: EffortPreference
   /** Ordered: section order in the brief. */
@@ -271,6 +279,7 @@ export function defaultMorningBriefConfig(now = new Date()): MorningBriefConfig
     timezone: serverTimezone(),
     days: [1, 2, 3, 4, 5],
     catchUpMinutes: MORNING_BRIEF_LIMITS.defaultCatchUpMinutes,
+    taskCatchUpMinutes: TASK_CATCH_UP_LIMITS.defaultMinutes,
     sources: defaultSources(),
     closingInstruction: '',
     updatedAt: now.toISOString(),
@@ -389,6 +398,13 @@ export function applyMorningBriefPatch(current: MorningBriefConfig, raw: unknown
     }
     next.catchUpMinutes = minutes
   }
+  if ('taskCatchUpMinutes' in patch) {
+    const minutes = Number(patch.taskCatchUpMinutes)
+    if (!Number.isSafeInteger(minutes) || minutes < TASK_CATCH_UP_LIMITS.minMinutes || minutes > TASK_CATCH_UP_LIMITS.maxMinutes) {
+      throw new MorningBriefConfigError('invalid_task_catch_up', `taskCatchUpMinutes must be ${TASK_CATCH_UP_LIMITS.minMinutes} to ${TASK_CATCH_UP_LIMITS.maxMinutes}.`)
+    }
+    next.taskCatchUpMinutes = minutes
+  }
   if ('model' in patch) {
     if (patch.model == null || patch.model === '') {
       delete next.model
@@ -429,6 +445,7 @@ export function coerceMorningBriefConfig(raw: unknown, now = new Date()): Mornin
   const input = raw as Record<string, unknown>
   const time = typeof input.time === 'string' && TIME_RE.test(input.time.trim()) ? input.time.trim() : base.time
   const catchUp = Number(input.catchUpMinutes)
+  const taskCatchUp = Number(input.taskCatchUpMinutes)
   const model = normalizeModelPreference(input.model)
   const effort = normalizeEffortPreference(input.effort)
   let sources: MorningBriefSource[]
@@ -441,6 +458,10 @@ export function coerceMorningBriefConfig(raw: unknown, now = new Date()): Mornin
     days: normalizeDays(input.days, base.days),
     catchUpMinutes: Number.isSafeInteger(catchUp) && catchUp >= 0 && catchUp <= MORNING_BRIEF_LIMITS.maxCatchUpMinutes
       ? catchUp : base.catchUpMinutes,
+    taskCatchUpMinutes: Number.isSafeInteger(taskCatchUp)
+      && taskCatchUp >= TASK_CATCH_UP_LIMITS.minMinutes
+      && taskCatchUp <= TASK_CATCH_UP_LIMITS.maxMinutes
+      ? taskCatchUp : base.taskCatchUpMinutes,
     ...(model ? { model } : {}),
     ...(effort ? { effort } : {}),
     sources,
@@ -463,7 +484,7 @@ export function morningBriefPaths(root?: string): MorningBriefStorePaths {
   return { config: `${base}/config.json`, runs: `${base}/runs.json` }
 }
 
-function ensurePrivateDir(file: string): void {
+export function ensurePrivateDir(file: string): void {
   const dir = dirname(file)
   mkdirSync(dir, { recursive: true, mode: 0o700 })
   try { chmodSync(dir, 0o700) } catch { /* best effort */ }

package/server/lib/morning-brief-prompt.ts

@@ -30,6 +30,8 @@ export interface MorningBriefPromptInput {
   day: string
   ownerName: string
   trigger: 'scheduled' | 'manual'
+  /** Optional TASKS digest. Kept only when the full prompt still fits. */
+  taskDigest?: string
 }
 
 const WEEKDAY_NAMES = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday']
@@ -200,7 +202,7 @@ const KNOWN_IDS = new Set<MorningBriefSourceId>(MORNING_BRIEF_SOURCES.map(spec =
 
 /** Compose the brief prompt. Enabled sources become numbered sections in the
  * user's order; a section whose source has nothing to say is skipped. */
-export function composeMorningBriefPrompt(input: MorningBriefPromptInput): string {
+function assembleMorningBriefPrompt(input: MorningBriefPromptInput, includeDigest: boolean): string {
   const { config, day, ownerName, trigger } = input
   const slotMinutes = parseTime(config.time)
   const slot = `${String(Math.floor(slotMinutes / 60)).padStart(2, '0')}:${String(slotMinutes % 60).padStart(2, '0')}`
@@ -244,6 +246,11 @@ export function composeMorningBriefPrompt(input: MorningBriefPromptInput): strin
     lines.push('')
   }
 
+  if (includeDigest && input.taskDigest) {
+    lines.push(input.taskDigest)
+    lines.push('')
+  }
+
   lines.push(
     'Format for the glasses: plain text only. No markdown headings, tables, or bullet symbols; a section is its label on one line followed by short lines. ' +
     'Keep every line under 60 characters where you can, because the lens is 576 pixels wide and wraps silently. Keep the whole brief under about 60 lines; ' +
@@ -256,7 +263,14 @@ export function composeMorningBriefPrompt(input: MorningBriefPromptInput): strin
   )
   lines.push('Do not say "here is" or "I found". Do not add a preamble or a sign-off.')
 
-  const prompt = lines.join('\n')
+  return lines.join('\n')
+}
+
+export function composeMorningBriefPrompt(input: MorningBriefPromptInput): string {
+  const withDigest = assembleMorningBriefPrompt(input, true)
+  const prompt = input.taskDigest && withDigest.length <= MORNING_BRIEF_PROMPT_MAX_CHARS
+    ? withDigest
+    : assembleMorningBriefPrompt(input, false)
   return prompt.length > MORNING_BRIEF_PROMPT_MAX_CHARS
     ? `${prompt.slice(0, MORNING_BRIEF_PROMPT_MAX_CHARS - 1)}…`
     : prompt

package/server/lib/morning-brief-runtime.ts

@@ -13,9 +13,16 @@ import { maxGlobalMsgNumInDir } from '../routes/message-ref.js'
 import { dataPath } from './data-dir.js'
 import { getOwnerName } from './profile.js'
 import { durableQueryJobsEnabled } from './query-job-feature.js'
-import { queryJobCoordinator } from './query-job-runtime.js'
+import { projectPublicConversationTerminal, queryJobCoordinator } from './query-job-runtime.js'
 import { maintenanceAdmissionsOpen } from './maintenance-lifecycle.js'
 import { maxReservedGlobalMsgNum, registerMessageReservationSource } from './message-reservations.js'
+import {
+  bindTaskDispatcher,
+  dispatchDueTasks,
+  reconcileDispatch,
+  reservationsForEra,
+} from './task-dispatcher.js'
+import { composeTaskDigest, listBoard } from './task-store.js'
 import { morningBriefPaths } from './morning-brief-config.js'
 import { MorningBriefScheduler } from './morning-brief-scheduler.js'
 import {
@@ -162,9 +169,25 @@ export function probeSkill(rawName: string, workDir = resolveProviderWorkDir({ s
 
 let scheduler: MorningBriefScheduler | null = null
 let unregisterReservations: (() => void) | null = null
+let unregisterTaskReservations: (() => void) | null = null
 
 export function getMorningBriefScheduler(): MorningBriefScheduler {
   if (!scheduler) {
+    bindTaskDispatcher({
+      submit: raw => queryJobCoordinator.submit(raw),
+      findByClientGeneration: (clientJobId, generation) => queryJobCoordinator.getByClientGeneration(clientJobId, generation),
+      getSnapshot: jobId => queryJobCoordinator.getSnapshot(jobId),
+      getExecution: jobId => queryJobCoordinator.store.getExecution(jobId),
+      cancel: (jobId, generation) => queryJobCoordinator.cancel(jobId, generation),
+      complete: (jobId, input) => queryJobCoordinator.store.complete(jobId, input),
+      createSession,
+      currentMessageEra,
+      currentMessageMax,
+      durableJobsEnabled: durableQueryJobsEnabled,
+      admissionsOpen: maintenanceAdmissionsOpen,
+      projectTerminal: projectPublicConversationTerminal,
+      finishIfActive: jobId => queryJobCoordinator.finishIfActive(jobId),
+    })
     const instance = new MorningBriefScheduler({
       paths: morningBriefPaths(),
       submit: raw => queryJobCoordinator.submit(raw),
@@ -184,9 +207,15 @@ export function getMorningBriefScheduler(): MorningBriefScheduler {
         reflection: probeReflection,
         skill: name => probeSkill(name),
       }),
+      dispatchDueTasks,
+      reconcileDispatch,
+      taskDigest: async () => {
+        try { return composeTaskDigest(await listBoard()) } catch { return '' }
+      },
     })
     // The ledger row exists before the job does; its number must count.
     unregisterReservations = registerMessageReservationSource(() => instance.liveReservations(currentMessageEra()))
+    unregisterTaskReservations = registerMessageReservationSource(() => reservationsForEra(currentMessageEra()))
     scheduler = instance
   }
   return scheduler
@@ -200,4 +229,6 @@ export function stopMorningBriefScheduler(): void {
   scheduler?.stop()
   unregisterReservations?.()
   unregisterReservations = null
+  unregisterTaskReservations?.()
+  unregisterTaskReservations = null
 }

package/server/lib/morning-brief-schedule.ts

@@ -74,8 +74,10 @@ export function shiftDay(day: string, delta: number): string {
  * The instant at which `day` reaches `minutes` past midnight in `timezone`.
  * Two-pass offset correction: read the zone's wall clock at a UTC guess, apply
  * the difference, and re-check once so a DST transition between the guess and
- * the target lands on the right side. On a non-existent local time (spring
- * forward) this returns the first instant after the gap.
+ * the target lands on the right side. A non-existent local time local-clocks
+ * ~60 min early on the old offset (02:30 CDT gap → 01:30; 02:00 → 01:00);
+ * 03:00 lands on 03:00 CDT. `taskInstant` adds 60 min when earlier:
+ * 02:00→03:00, 02:30→03:30.
  */
 export function zonedInstant(day: string, minutes: number, timezone: string): number {
   const [y, m, d] = day.split('-').map(Number)
@@ -90,6 +92,21 @@ export function zonedInstant(day: string, minutes: number, timezone: string): nu
   return guess
 }
 
+/** Instant for a task runAt. If the rendered local (day, minutes) is earlier
+ * than requested (spring-forward gap), add 60 minutes up to three times.
+ * Fall back to the first zonedInstant. */
+export function taskInstant(day: string, minutes: number, timezone: string): number {
+  const first = zonedInstant(day, minutes, timezone)
+  let instant = first
+  for (let pass = 0; pass < 3; pass++) {
+    const clock = localClock(instant, timezone)
+    const earlier = clock.day < day || (clock.day === day && clock.minutes < minutes)
+    if (!earlier) return instant
+    instant += 60 * 60_000
+  }
+  return first
+}
+
 function daysBetween(fromDay: string, toDay: string): number {
   const [fy, fm, fd] = fromDay.split('-').map(Number)
   const [ty, tm, td] = toDay.split('-').map(Number)