@humwick/server 0.130.0 → 0.130.2

package/src/mcp-workflow-tools.ts

@@ -5,7 +5,7 @@ import { McpAuthError } from "./mcp-errors";
 import { ValidationError } from "./db";
 import { authContextFromMcp } from "./services/auth-context";
 import { ServiceAuthError } from "./services/errors";
-import { cancelWorkflowRun, getWorkflowRun, resumeWorkflowRun, startWorkflowRun } from "./services/workflow-runs";
+import { cancelWorkflowRun, getWorkflowRun, pauseWorkflowRun, resumeWorkflowRun, startWorkflowRun } from "./services/workflow-runs";
 import { parseWorkflowPins } from "./services/workflow-pins";
 import { cleanString, taskIdField } from "./validation";
 
@@ -48,7 +48,7 @@ export const WORKFLOW_TOOLS = [
   {
     name: "relay_workflow_resume",
     description:
-      "Resume or answer/escalate a decision.",
+      "Resume, pause/unpause, or answer/escalate a decision.",
     requiredScopes: ["task:write"],
     inputSchema: {
       type: "object",
@@ -66,6 +66,7 @@ export const WORKFLOW_TOOLS = [
         activationId: { type: "string" },
         step: { type: "string" },
         note: { type: "string" },
+        pause: { type: "boolean" },
         pins: PINS_PROP,
       },
       required: ["runId"],
@@ -112,7 +113,7 @@ type McpAuthLike = Parameters<typeof authContextFromMcp>[0];
 
 function mutationReceipt(full: Record<string, unknown>, verbose: unknown): Record<string, unknown> {
   if (verbose === true) return full;
-  const fields = ["runId", "taskId", "workflow", "status", "step", "round", "callerAgentId", "budget", "existing", "resumed", "cancelled", "reason", "warnings"];
+  const fields = ["runId", "taskId", "workflow", "status", "step", "round", "callerAgentId", "budget", "existing", "resumed", "cancelled", "paused", "reason", "warnings"];
   return Object.fromEntries(fields.filter(key => full[key] !== undefined).map(key => [key, full[key]]));
 }
 
@@ -132,6 +133,12 @@ export async function relayWorkflowTool(auth: McpAuthLike, name: string, args: R
       if (!runId) throw new ValidationError("runId is required");
       const step = cleanString(args.step, "step", { max: 64 });
       const note = cleanString(args.note, "note", { max: 8000 });
+      if (args.pause !== undefined) {
+        // #3757 — pause (note is the required reason) or unpause; nothing else rides along.
+        if (typeof args.pause !== "boolean") throw new ValidationError("pause must be a boolean");
+        if (step || args.pins !== undefined || args.decision !== undefined || args.activationId !== undefined) throw new ValidationError("pause takes only runId and, to pause, note as the reason");
+        return mutationReceipt(await pauseWorkflowRun({ runId, pause: args.pause, ...(note ? { reason: note } : {}) }, ctx), args.verbose);
+      }
       const pins = parseWorkflowPins(args.pins);
       return mutationReceipt(await resumeWorkflowRun({ runId, decision: parseWorkflowDecisionResponse(args.decision), activationId: cleanString(args.activationId, "activationId", { max: 2000 }), ...(step ? { step } : {}), ...(note ? { note } : {}), ...(pins ? { pins } : {}) }, ctx), args.verbose);
     }

package/src/notification-types.ts

@@ -97,7 +97,8 @@ export type NotificationType =
   | "ci.config_mismatch"
   | "ci.root_missing"
   // #1645 — a critical maintenance job is not running (disabled, held indefinitely, a lapsed pause
-  // nobody resumed, or simply silent past several of its own intervals).
+  // nobody resumed, or simply silent past several of its own intervals). Also carries host disk
+  // alerts (#3762) — a new type would grow three MCP tool schemas past their pinned budgets.
   | "maintenance.degraded";
 
 /**

package/src/operator-alarm.ts

@@ -1,4 +1,5 @@
 import { createActivityEventWithResult } from "./db";
+import { createActivityEventByClientIdAsync } from "./db/activity-async";
 import { emitRelayEvent } from "./events";
 
 export interface OperatorAlarmInput {
@@ -20,22 +21,36 @@ export interface OperatorAlarmInput {
 // done. This raises a distinct `operator.alarm` relay event (dashboard banner) plus a
 // persisted `operator`-kind activity event, so a relay with no reachable escalation target
 // is observable instead of looping forever in the dark.
-export function raiseOperatorAlarm(input: OperatorAlarmInput): boolean {
-  const { created } = createActivityEventWithResult({
-    clientId: input.clientId,
-    kind: "operator",
-    title: input.subject,
-    body: input.detail,
-    icon: "ti-alert-octagon",
-    view: input.view ?? "orchestrators",
-    metadata: { source: input.source, operatorAlarm: true, ...(input.metadata ?? {}) },
-  });
-  if (input.dedupeEvent && !created) return false;
+const alarmEvent = (input: OperatorAlarmInput) => ({
+  clientId: input.clientId,
+  kind: "operator" as const,
+  title: input.subject,
+  body: input.detail,
+  icon: "ti-alert-octagon",
+  view: input.view ?? "orchestrators",
+  metadata: { source: input.source, operatorAlarm: true, ...(input.metadata ?? {}) },
+});
+
+function emitAlarm(input: OperatorAlarmInput): void {
   emitRelayEvent({
     type: "operator.alarm",
     source: input.source,
     subject: input.subject,
     data: { subject: input.subject, detail: input.detail, ...(input.metadata ?? {}) },
   });
+}
+
+export function raiseOperatorAlarm(input: OperatorAlarmInput): boolean {
+  const { created } = createActivityEventWithResult(alarmEvent(input));
+  if (input.dedupeEvent && !created) return false;
+  emitAlarm(input);
+  return true;
+}
+
+/** Same as `raiseOperatorAlarm`, with the activity row written on the writer thread. */
+export async function raiseOperatorAlarmAsync(input: OperatorAlarmInput): Promise<boolean> {
+  const { created } = await createActivityEventByClientIdAsync(alarmEvent(input));
+  if (input.dedupeEvent && !created) return false;
+  emitAlarm(input);
   return true;
 }

package/src/package-pack.ts

@@ -131,6 +131,42 @@ export function privateWorkspaceDependencies(packageDir: string): string[] {
   return privateDeps;
 }
 
+type DependencyMap = Record<string, string>;
+export type ConsumerManifest = {
+  dependencies?: DependencyMap;
+  optionalDependencies?: DependencyMap;
+  bundleDependencies?: string[];
+};
+export type VendoredManifest = {
+  version?: string;
+  dependencies?: DependencyMap;
+  optionalDependencies?: DependencyMap;
+  peerDependencies?: DependencyMap;
+};
+
+// Pin and bundle a vendored private dep on its consumer (bundleDependencies keeps the nested copy
+// across reinstall/prune, #1772), and move the dep's own dependencies onto the consumer. npm counts
+// every dependency a bundled package declares as bundled too and never extracts it, so a global
+// install left @humwick/sdk, hono, zod … as empty folders (#3301). The vendored code still resolves
+// them by walking up node_modules.
+export function bundleVendoredDependency(consumer: ConsumerManifest, depName: string, vendored: VendoredManifest): void {
+  delete consumer.optionalDependencies?.[depName];
+  consumer.dependencies ??= {};
+  consumer.dependencies[depName] = vendored.version ?? "0.0.0";
+  consumer.bundleDependencies ??= [];
+  if (!consumer.bundleDependencies.includes(depName)) consumer.bundleDependencies.push(depName);
+  for (const field of ["dependencies", "optionalDependencies", "peerDependencies"] as const) {
+    for (const [name, spec] of Object.entries(vendored[field] ?? {})) {
+      const declared = consumer.dependencies[name] ?? consumer.optionalDependencies?.[name];
+      if (declared !== undefined && declared !== spec) {
+        fail(`package-pack: bundled ${depName} needs ${name}@${spec} but its consumer declares ${name}@${declared}; align the two specs`);
+      }
+      if (declared === undefined) consumer.dependencies[name] = spec;
+    }
+    delete vendored[field];
+  }
+}
+
 // Vendor a PRIVATE (unpublished, `workspace:*`) workspace dependency into the packed
 // tarball as a nested `node_modules/<dep>` package, pin its bundled version in
 // the packed manifest, and merge its own runtime dependencies up into the consumer so
@@ -148,31 +184,19 @@ async function bundlePrivateWorkspaceDeps(cwd: string, packageDir: string, tarba
   try {
     tar(["-xzf", tarball, "-C", stage]);
     const pkgRoot = join(stage, "package");
-    const packed = JSON.parse(readFileSync(join(pkgRoot, "package.json"), "utf8")) as {
-      dependencies?: Record<string, string>;
-      optionalDependencies?: Record<string, string>;
-      bundleDependencies?: string[];
-    };
+    const packed = JSON.parse(readFileSync(join(pkgRoot, "package.json"), "utf8")) as ConsumerManifest;
 
     for (const depName of privateDeps) {
       const depDir = dirByName.get(depName);
       if (!depDir) fail(`package-pack: private workspace dep ${depName} not found in root workspaces`);
       const depSrc = resolve(cwd, depDir);
-      const depManifest = JSON.parse(readFileSync(join(depSrc, "package.json"), "utf8")) as {
-        version?: string;
-        dependencies?: Record<string, string>;
-      };
 
       // Vendor the private package's REAL published file set by packing it exactly as it would be
       // published — `npm pack` honors the dep's own `files`/`exports` and runs its `prepack` build —
       // then extract the packed `package/` into node_modules/<dep>. Copying only flat root *.ts (the
       // pre-#1838 behavior) silently shipped a package.json-ONLY stub for any dep whose entrypoint is
-      // a BUILT dist or lives in a nested dir: @humwick/offload's `main` is ./dist/index.js with
-      // source under src/, so the vendored copy carried no dist and the installed consumer crashed at
-      // import with "Cannot find package '@humwick/offload'". Packing is the canonical publish
-      // representation and works for BOTH a raw-.ts dep (@humwick/kernel, exports ./index.ts) and a
-      // built-dist dep (@humwick/offload) — and for any future published-package offload adopter
-      // (orchestrator #1807, later waves) with no per-dep special-casing here.
+      // a BUILT dist or lives in a nested dir (@humwick/offload's `main` is ./dist/index.js). Packing
+      // works for BOTH a raw-.ts dep (@humwick/kernel) and a built-dist dep with no special-casing.
       const vendorDir = join(pkgRoot, "node_modules", depName);
       const depStage = mkdtempSync(join(packDir, "dep-pack-"));
       try {
@@ -186,30 +210,9 @@ async function bundlePrivateWorkspaceDeps(cwd: string, packageDir: string, tarba
       } finally {
         rmSync(depStage, { recursive: true, force: true });
       }
-
-      // Replace the unresolvable workspace:* spec with the vendored version AND declare the
-      // dep as a bundleDependency. This is the canonical npm/bun representation of a bundled
-      // package: the nested node_modules/<dep> is treated as an intentional, protected part of
-      // the tarball — preserved on install, never fetched from the registry (bundled wins over
-      // the pinned version), and — critically — never pruned as "extraneous" on a second
-      // `npm install` / `npm ci` / dedupe / prune pass. Merely DROPPING the workspace:* spec
-      // (the pre-#1772 behavior) let the FIRST install keep the vendored copy but any later
-      // tree reconciliation deleted node_modules/<dep> entirely, breaking every
-      // `<dep>/<subpath>` import at runtime (e.g. @humwick/kernel/workflow-journal-codec
-      // → CLI crash at startup). See #1772.
-      for (const field of ["dependencies", "optionalDependencies"] as const) {
-        if (packed[field]) delete packed[field][depName];
-      }
-      packed.dependencies ??= {};
-      packed.dependencies[depName] = depManifest.version ?? "0.0.0";
-      packed.bundleDependencies ??= [];
-      if (!packed.bundleDependencies.includes(depName)) packed.bundleDependencies.push(depName);
-
-      // Hoist the private dep's own runtime deps so the clean-env install resolves them from
-      // the registry (kernel imports zod/hono/…).
-      for (const [name, spec] of Object.entries(depManifest.dependencies ?? {})) {
-        packed.dependencies[name] ??= spec;
-      }
+      const vendored = JSON.parse(readFileSync(join(vendorDir, "package.json"), "utf8")) as VendoredManifest;
+      bundleVendoredDependency(packed, depName, vendored);
+      writeFileSync(join(vendorDir, "package.json"), JSON.stringify(vendored, null, 2) + "\n");
     }
 
     writeFileSync(join(pkgRoot, "package.json"), JSON.stringify(packed, null, 2) + "\n");

package/src/project-instructions.ts

@@ -2,6 +2,7 @@ import { composeMemoryPreambleAsync } from "./memory-preamble-async";
 import { composeHostAwareness } from "./host-awareness";
 import { composeGuideIndex } from "./guides";
 import { profileInstructionBlocks } from "./profile-instruction-blocks";
+import { projectProfileInstructionBlock } from "./project-profile-instructions";
 // Spawn-time instruction sources (#557) — the relay-owned composer that assembles what a spawned
 // agent's systemPromptAppend says, from declared sources only, never from host CLAUDE.md.
 //
@@ -283,6 +284,7 @@ export function composeSpawnInstructionsWithEvents(input: {
    * host → project`, audience-filtered by `profile`). Absent → no memory block at all, so a
    * caller that does not know the identity produces a byte-identical pre-#1565 spawn. */
   memoryIdentity?: MemoryIdentity;
+  projectId?: string;
   profile?: Pick<AgentProfile, "instructions" | "maxSpawnedAgents" | "hostAwareness" | "roleAssets"> & { name?: string; relay?: AgentProfile["relay"] };
   spawnedBy?: string;
   /** #3045 — a workflow step agent: its step reporting block replaces the spawned-child report-up. */
@@ -475,6 +477,8 @@ export function composeSpawnInstructionsWithEvents(input: {
   const { system: profileSystem, append: profileAppend } = profileInstructionBlocks(input.profile, input.memoryIdentity?.provider);
   if (profileSystem) appendBlocks.push(profileSystem);
   appendBlocks.push(...profileAppend);
+  const projectProfile = projectProfileInstructionBlock(input.projectId ?? input.memoryIdentity?.projectId, input.profile?.name ?? input.memoryIdentity?.profile);
+  if (projectProfile) { appendBlocks.push(projectProfile.content); relayInjectionEvents.push(projectProfile.event); }
   // After the profile, so the step rule is the last word over a charter's report-to-spawner text.
   if (input.workflowRunId) {
     const instruction = renderTemplate("spawn.reportup.workflow-step", { runId: input.workflowRunId });

package/src/project-profile-instruction-text.ts

@@ -0,0 +1,6 @@
+import { assertNoControlBytes, ValidationError } from "@humwick/sdk";
+
+export function validateProjectProfileInstructionText(value: unknown, source: string): asserts value is string {
+  if (typeof value !== "string" || value.length > 16_000) throw new ValidationError(`${source} must be a string up to 16000 characters`);
+  assertNoControlBytes(value, source);
+}

package/src/project-profile-instructions.ts

@@ -0,0 +1,20 @@
+import { errMessage } from "@humwick/sdk";
+import { getProjectProfileInstructions } from "./db/project-profile-instructions";
+import { validateProjectProfileInstructionText } from "./project-profile-instruction-text";
+
+/** #3515 — one optional block at the charter seam, independent of project memory's switch. */
+export function projectProfileInstructionBlock(projectId: string | undefined, profile: string | undefined) {
+  if (!projectId || !profile) return;
+  const source = `project ${projectId} profile ${profile} instructions`;
+  try {
+    const entry = getProjectProfileInstructions({ projectId, profile });
+    validateProjectProfileInstructionText(entry.template, source);
+    const content = entry.template.trim();
+    if (!content) return;
+    return { content, event: { category: "instructions" as const,
+      summary: `injected ${source} v${entry.version}`,
+      detail: { source: "project-profile-instructions", projectId, profile, version: entry.version, content } } };
+  } catch (error) {
+    console.warn(`[launch] skipped ${source}: ${errMessage(error)}`);
+  }
+}

package/src/provider-catalog-store.ts

@@ -1,7 +1,7 @@
 import {
   deriveProviderDisabledState,
   disabledProviderSet,
-  providerCatalogList,
+  providerMetadataList,
   type ProviderCatalogEntry,
   type ProviderContextThreshold,
   type ProviderEnablementSetting,
@@ -44,7 +44,7 @@ export interface ProviderModelOverrideInput {
 
 function listProviderModelOverrides(): ProviderModelOverride[] {
   const rows = getDb()
-    .query("SELECT * FROM provider_model_overrides ORDER BY provider ASC, alias ASC")
+    .query("SELECT * FROM provider_model_overrides ORDER BY provider ASC, rowid ASC")
     .all() as ProviderModelOverrideRow[];
   return rows.map(rowToOverride).filter((entry): entry is ProviderModelOverride => Boolean(entry));
 }
@@ -120,7 +120,7 @@ export function setProviderDefaultModel(provider: SpawnProvider, alias: string,
 }
 
 export function effectiveProviderCatalogList(now = Date.now()): ProviderCatalogEntry[] {
-  const catalog = mergeProviderCatalog(providerCatalogList(), listProviderModelOverrides());
+  const catalog = mergeProviderCatalog(providerMetadataList(), listProviderModelOverrides());
   const defaults = getDb().query("SELECT provider, alias FROM provider_model_defaults").all() as Array<{ provider: string; alias: string }>;
   for (const { provider, alias } of defaults) {
     const entry = catalog.find((item) => item.provider === provider);
@@ -215,9 +215,6 @@ function normalizeOverrideInput(input: ProviderModelOverrideInput): ProviderMode
   if (limits) entry.limits = limits;
   else delete entry.limits;
   delete entry.disabled;
-  // #368 — unavailable is a static catalog fact (provider-side suspension), not an operator toggle;
-  // strip it from DB overrides so an admin can't accidentally clear a catalog-level suspension.
-  delete entry.unavailable;
   // #2598 — `deleted` is a row-level tombstone column, never part of a stored entry blob.
   delete (entry as unknown as Record<string, unknown>).deleted;
   return {
@@ -288,49 +285,6 @@ function allowlistedLimitConfidence(value: unknown): ProviderModelLimitWindow["c
     : "declared";
 }
 
-/**
- * #2598 — additive, idempotent backfill of every static-catalog model into `provider_model_overrides`,
- * so the whole catalogue is uniformly DB-backed and operator-editable. Rules:
- *   - INSERT-ONLY-IF-ABSENT (`ON CONFLICT DO NOTHING`): an existing row — a prior seed OR an operator
- *     edit OR an operator delete-tombstone — is never touched, so operator edits ALWAYS win and a
- *     deleted static model is never resurrected. Re-runnable; a re-run inserts only genuinely NEW
- *     static models (e.g. added by a later release).
- *   - SKIP disabled/unavailable static models: materializing them would strip those flags at the
- *     write chokepoint (#368/#643) and resurrect a suspended model as spawnable. They stay
- *     static-only until an operator explicitly adds them.
- * Stamped `updated_by = <stamp>` (e.g. `seed:<version>`) purely for provenance; precedence is decided
- * by row EXISTENCE, not by parsing the stamp.
- */
-export function seedProviderModelOverrides(stamp: string, now = Date.now()): { inserted: number } {
-  const db = getDb();
-  const existing = new Map<string, Set<string>>();
-  for (const row of db.query("SELECT provider, alias FROM provider_model_overrides").all() as Array<{ provider: string; alias: string }>) {
-    let aliases = existing.get(row.provider);
-    if (!aliases) existing.set(row.provider, (aliases = new Set()));
-    aliases.add(row.alias);
-  }
-  let inserted = 0;
-  const insert = db.query(`
-    INSERT INTO provider_model_overrides (provider, alias, entry, deleted, disabled, updated_at, updated_by)
-    VALUES (?, ?, ?, 0, 0, ?, ?)
-    ON CONFLICT(provider, alias) DO NOTHING
-  `);
-  const seed = db.transaction(() => {
-    for (const providerEntry of providerCatalogList()) {
-      const seen = existing.get(providerEntry.provider);
-      for (const model of providerEntry.models) {
-        if (model.disabled || model.unavailable) continue;
-        if (seen?.has(model.alias)) continue;
-        const normalized = normalizeOverrideInput({ provider: providerEntry.provider, alias: model.alias, entry: model, updatedBy: stamp });
-        const result = insert.run(normalized.provider, normalized.alias, JSON.stringify(normalized.entry), now, normalized.updatedBy ?? null);
-        if (result.changes > 0) inserted++;
-      }
-    }
-  });
-  seed();
-  return { inserted };
-}
-
 function rowToOverride(row: ProviderModelOverrideRow): ProviderModelOverride | undefined {
   const parsed = parseJson<ProviderModelCatalogEntry | undefined>(row.entry, undefined);
   if (!parsed || typeof parsed.alias !== "string") return undefined;

package/src/provider-config-store.ts

@@ -4,7 +4,8 @@ import { hostname } from "node:os";
 import { join } from "node:path";
 import { ValidationError, listOrchestrators } from "./db";
 import { isSecretEnvKey } from "./db/provider-config-secrets";
-import { getConfig, listConfig, setConfig } from "./config-store";
+import { getConfig, listConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
 import { localOrchestratorIdFromEnv, providerConfigHomeFromEnv } from "./config";
 import { cleanString, cleanStringArray, optionalEnum } from "./validation";
 import { emitConfigChanged } from "./sse";
@@ -90,11 +91,11 @@ export function listProviderConfigEntries(host = defaultProviderConfigHost()): R
   ) as Record<SpawnProvider, ProviderConfigEntry>;
 }
 
-export function setProviderConfig(
+export async function setProviderConfigAsync(
   provider: string,
   value: unknown,
   opts: { host?: string; updatedBy?: string } = {},
-): ProviderConfigEntry {
+): Promise<ProviderConfigEntry> {
   const cleanProvider = normalizeProviderConfigProvider(provider);
   const host = normalizeProviderConfigHost(opts.host ?? defaultProviderConfigHost());
   const normalized = cleanProviderConfig(cleanProvider, resolveMaskedEnvSentinels(value, host, cleanProvider));
@@ -102,7 +103,7 @@ export function setProviderConfig(
   ensureProviderConfigDescriptors([key]);
   const validation = validateSettingValue(PROVIDER_CONFIG_NAMESPACE, key, normalized);
   if (!validation.valid) throw new ValidationError(validation.errors.join("; "));
-  return setConfig(PROVIDER_CONFIG_NAMESPACE, key, normalized, opts.updatedBy) as ProviderConfigEntry;
+  return await setConfigAsync(PROVIDER_CONFIG_NAMESPACE, key, normalized, opts.updatedBy) as ProviderConfigEntry;
 }
 
 export function providerConfigPublic(entry: ProviderConfigEntry, opts: { maskEnv?: boolean } = {}): Record<string, unknown> {
@@ -138,11 +139,11 @@ export function providerConfigPublic(entry: ProviderConfigEntry, opts: { maskEnv
  * This is the server-authority write path: callers are in-process (local migration
  * or the orchestrator command-bus result handler), so no HTTP scope is required.
  */
-export function seedProviderConfigs(
+export async function seedProviderConfigsAsync(
   host: string,
   rawByProvider: Record<string, unknown>,
   opts: { legacyHost?: string } = {},
-): ProviderConfigEntry[] {
+): Promise<ProviderConfigEntry[]> {
   const seeded: ProviderConfigEntry[] = [];
   const cleanHost = normalizeProviderConfigHost(host);
   const legacyHost = opts.legacyHost ? normalizeProviderConfigHost(opts.legacyHost) : undefined;
@@ -159,7 +160,7 @@ export function seedProviderConfigs(
     // still validates; the relay owns the schema, the reporter stays dumb.
     const value = legacy?.value ?? { ...providerConfigDefaults(provider), ...(isRecord(raw) ? raw : {}) };
     try {
-      const entry = setProviderConfig(provider, value, { host: cleanHost, updatedBy: `migration:${cleanHost}` });
+      const entry = await setProviderConfigAsync(provider, value, { host: cleanHost, updatedBy: `migration:${cleanHost}` });
       emitConfigChanged(entry.namespace, entry.key, entry.version);
       seeded.push(entry);
     } catch {
@@ -174,16 +175,16 @@ export function seedProviderConfigs(
  * owns the stable-id/legacy-hostname resolution together so command routes do
  * not re-parse or accidentally bypass the migration authority rules.
  */
-export function seedMigratedProviderConfigs(result: unknown): { host: string; seeded: ProviderConfigEntry[] } | null {
+export async function seedMigratedProviderConfigsAsync(result: unknown): Promise<{ host: string; seeded: ProviderConfigEntry[] } | null> {
   if (!isRecord(result)) return null;
   const host = cleanString(result.host, "result.host", { max: 120 });
   const hostname = cleanString(result.hostname, "result.hostname", { max: 120 });
   const configs = isRecord(result.configs) ? result.configs : undefined;
   if (!host || !configs) return null;
-  return { host, seeded: seedProviderConfigs(host, configs, { legacyHost: hostname }) };
+  return { host, seeded: await seedProviderConfigsAsync(host, configs, { legacyHost: hostname }) };
 }
 
-export function migrateLocalProviderConfigs(home = humwickHome(), host = defaultProviderConfigHost()): ProviderConfigEntry[] {
+export async function migrateLocalProviderConfigsAsync(home = humwickHome(), host = defaultProviderConfigHost()): Promise<ProviderConfigEntry[]> {
   const dir = join(home, "providers");
   if (!existsSync(dir)) return [];
   const raw: Record<string, unknown> = {};
@@ -192,7 +193,7 @@ export function migrateLocalProviderConfigs(home = humwickHome(), host = default
     if (!VALID_PROVIDER_CONFIGS.includes(provider as SpawnProvider)) continue;
     raw[provider] = loadLocalProviderConfig(provider, home);
   }
-  return seedProviderConfigs(host, raw);
+  return seedProviderConfigsAsync(host, raw);
 }
 
 function normalizeProviderConfigHost(host: string): string {

package/src/provider-model-seed.ts

@@ -1,18 +1 @@
-import { getConfig, setConfig } from "./config-store";
-import { seedProviderModelOverrides } from "./provider-catalog-store";
-import { reconcileClaudeCatalogSeeds } from "./db/claude-catalog-reconcile";
-import { VERSION } from "./config";
-import { errMessage } from "@humwick/sdk";
-
-// Stamp only after the transactional seed succeeds so a failure retries next boot.
-export function reconcileProviderModelSeed(): void {
-  try {
-    reconcileClaudeCatalogSeeds();
-    const stamp = `seed:${VERSION}`;
-    if (getConfig<string>("system", "provider-model-seed-version")?.value === stamp) return;
-    seedProviderModelOverrides(stamp);
-    setConfig("system", "provider-model-seed-version", stamp, "server-startup");
-  } catch (err) {
-    console.warn(`[provider-model-seed] skipped: ${errMessage(err)}`);
-  }
-}
+export { reconcileProviderModelSeed, seedProviderModelOverrides } from "./db/provider-model-seed";

package/src/provider-quota-config-store.ts

@@ -9,7 +9,8 @@
 // provider *spawn* config (provider-config-store.ts) by design — different scope,
 // different cardinality.
 import { ValidationError } from "./db";
-import { getConfig, listConfig, setConfig } from "./config-store";
+import { getConfig, listConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
 import { emitConfigChanged } from "./sse";
 import {
   DEFAULT_PROVIDER_QUOTA_CONFIG,
@@ -47,14 +48,14 @@ export function listProviderQuotaConfigs(): ProviderQuotaConfigMap {
  * clamped to 5m–15m, unset fields defaulted), so a partial body still validates.
  * Emits `config.changed` so the orchestrator + dashboard pick it up live.
  */
-export function setProviderQuotaConfig(
+export async function setProviderQuotaConfigAsync(
   provider: string,
   value: unknown,
   opts: { updatedBy?: string } = {},
-): ProviderQuotaConfig {
+): Promise<ProviderQuotaConfig> {
   const clean = assertValidProvider(provider);
   const normalized = normalizeProviderQuotaConfig(value);
-  const entry = setConfig(PROVIDER_QUOTA_CONFIG_NAMESPACE, clean, normalized, opts.updatedBy);
+  const entry = await setConfigAsync(PROVIDER_QUOTA_CONFIG_NAMESPACE, clean, normalized, opts.updatedBy);
   emitConfigChanged(entry.namespace, entry.key, entry.version);
   return normalized;
 }

package/src/provider-secrets.test-fixture.ts

@@ -1,5 +1,5 @@
 import { getDb } from "./db";
-import { setProviderConfig } from "./provider-config-store";
+import { setProviderConfigAsync } from "./provider-config-store";
 
 // #3402 — fake values under every key name the hub's central provider config holds, plus one no masking
 // list knows, so a test proves masking follows the configured values rather than key names.
@@ -25,9 +25,9 @@ export function leakedProviderSecrets(text: string): string[] {
 }
 
 /** Seeds the central provider config of `host` and returns its rows the way `sqlite3 ... select` prints them. */
-export function seedProviderSecrets(host: string): string {
+export async function seedProviderSecrets(host: string): Promise<string> {
   for (const [provider, env] of Object.entries(PROVIDER_SECRET_ENV)) {
-    setProviderConfig(provider, { command: provider, env: { ...env, OPENCODE_CONFIG: "/srv/opencode.json" } }, { host });
+    await setProviderConfigAsync(provider, { command: provider, env: { ...env, OPENCODE_CONFIG: "/srv/opencode.json" } }, { host });
   }
   return (getDb().query("SELECT namespace, key, value FROM config WHERE namespace = 'provider-config'").all() as Array<Record<string, string>>)
     .map((row) => `${row.namespace}|${row.key}|${row.value}`).join("\n");

package/src/recipe-runner.ts

@@ -15,7 +15,7 @@ import {
   validateRecipeArtifactRefsAsync,
 } from "./recipe-async";
 import type { AttachmentRef, Command, RecipeInstance } from "./types";
-import { SYSTEM_LAUNCH, runnerRuntimeTokenEnv } from "./runtime-tokens";
+import { SYSTEM_LAUNCH, runnerRuntimeTokenEnvAsync } from "./runtime-tokens";
 import { generateSpawnAgentId } from "./services/spawn-identity";
 
 interface StartRecipeInput {
@@ -114,7 +114,7 @@ export async function startRecipe(input: StartRecipeInput): Promise<StartRecipeR
           env: {
             ...(agent.env ?? {}),
             ...(attachments.length ? writeChildEnv({}, { AGENT_RELAY_RECIPE_ARTIFACTS: JSON.stringify(attachments) }) : {}),
-            ...runnerRuntimeTokenEnv({ authority: SYSTEM_LAUNCH,
+            ...await runnerRuntimeTokenEnvAsync({ authority: SYSTEM_LAUNCH,
               agentId,
               orchestratorId: orchestrator.id,
               cwd,

package/src/repo-config-source.ts

@@ -6,7 +6,8 @@
 import { dirname, resolve } from "node:path";
 import { isRecord, stringValue } from "@humwick/sdk";
 import { isTrustedOrchestratorApiUrl, relayAuthHeaders } from "./config";
-import { getConfig, setConfig } from "./config-store";
+import { getConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
 import { listOrchestrators, reportedRepoRootForCwd } from "./db";
 import { hostIsRelayHost } from "./relay-host-locality";
 import { normalizeHostToken, parseJson, sameHostIdentity } from "./utils";
@@ -70,11 +71,16 @@ export function hostRepoConfigSource<T>(spec: HostRepoConfigSpec<T>): HostRepoCo
     return null;
   }
 
-  function writeCached(host: string, keys: readonly string[], found: RepoConfigSource<T> | null): void {
+  /** #1870 S7: writes on the writer thread, and only when the answer changed. `at` is evidence, not a
+   *  TTL, so re-stamping an identical answer on every read only bumped the version and history. */
+  async function writeCached(host: string, keys: readonly string[], found: RepoConfigSource<T> | null): Promise<void> {
     const at = Date.now();
+    const answer = JSON.stringify(found);
     for (const key of keys) {
       try {
-        setConfig<CachedRepoConfigSource<T>>(spec.cacheNamespace, cacheKey(host, key), { found, at }, spec.cacheNamespace);
+        const current = getConfig<CachedRepoConfigSource<T>>(spec.cacheNamespace, cacheKey(host, key))?.value;
+        if (current?.at && JSON.stringify(current.found) === answer) continue;
+        await setConfigAsync<CachedRepoConfigSource<T>>(spec.cacheNamespace, cacheKey(host, key), { found, at }, spec.cacheNamespace);
       } catch {
         // The cache is an optimization for the sync paths; failing to record it must never fail a caller.
       }
@@ -149,7 +155,7 @@ export function hostRepoConfigSource<T>(spec: HostRepoConfigSpec<T>): HostRepoCo
       if (hostIsRelayHost(host)) return { known: true, found: await spec.findLocalAsync(cwd) };
       const read = await readFromHost(cwd, host!);
       if (read.known) {
-        writeCached(host!, cacheWriteKeys(cwd, read.found, opts.alsoCacheFor), read.found);
+        await writeCached(host!, cacheWriteKeys(cwd, read.found, opts.alsoCacheFor), read.found);
         return read;
       }
       return cachedLookup(host!, cwd);

package/src/routes/agent-profiles.ts

@@ -1,12 +1,12 @@
 import { PromptVersionConflictError } from "../prompt-version-errors";
 import { versionedPromptsEnabled } from "../versioned-prompts";
 import { promptActor } from "../services/prompt-version-writer";
-import { setConfigAsync } from "../config-store-write";
+import { deleteAgentProfileAsync, setAgentProfileAsync, setConfigAsync } from "../config-store-write";
 import { memoryRetirementMessage } from "../memory-retirement";
 // Auto-split from routes.ts (#299). Domain: agent-profiles.
 import { ValidationError, withResolvedProvisioningAsync } from "../db";
 import { cleanString, optionalEnum } from "../validation";
-import { deleteAgentProfile, getAgentProfile, listAgentProfiles, resolveAgentProfileKey, setAgentProfile, validateAgentProfile } from "../config-store";
+import { getAgentProfile, listAgentProfiles, resolveAgentProfileKey, validateAgentProfile } from "../config-store";
 import { RELAY_TOOL_GROUPS } from "../mcp";
 import { emitConfigChanged } from "../sse";
 import { error, isAdminRequest, json, normalizeConfigPathParam, parseBody, type Handler } from "./_shared";
@@ -140,8 +140,8 @@ export const putAgentProfileRoute: Handler = async (req, params) => {
       return json(saved);
     }
     const profile = existing?.value.builtIn && isAdminRequest(req)
-      ? setAgentProfile({ ...parsed.body, name } as AgentProfile, updatedBy, { overrideBuiltIn: true })
-      : setAgentProfile({ ...parsed.body, name } as AgentProfile, updatedBy);
+      ? await setAgentProfileAsync({ ...parsed.body, name } as AgentProfile, updatedBy, { overrideBuiltIn: true })
+      : await setAgentProfileAsync({ ...parsed.body, name } as AgentProfile, updatedBy);
     emitConfigChanged(profile.namespace, profile.key, profile.version);
     return json(profile, existing ? 200 : profile.version === 1 ? 201 : 200);
   } catch (e) {
@@ -151,14 +151,14 @@ export const putAgentProfileRoute: Handler = async (req, params) => {
   }
 };
 
-export const deleteAgentProfileRoute: Handler = (req, params) => {
+export const deleteAgentProfileRoute: Handler = async (req, params) => {
   try {
     const name = normalizeConfigPathParam(params.name, "name");
     const existing = getAgentProfile(name);
     if (!existing) return error(memoryRetirementMessage(name) ?? "agent profile not found", 404);
     const updatedBy = versionedPromptsEnabled() ? promptActor(req) : cleanString(new URL(req.url).searchParams.get("updatedBy") ?? undefined, "updatedBy", { max: 200 });
     if (existing.value.builtIn && !isAdminRequest(req)) return error("built-in agent profiles are managed by Relay", 400);
-    deleteAgentProfile(name, updatedBy, { resetBuiltInOverride: existing.value.builtIn });
+    await deleteAgentProfileAsync(name, updatedBy, { resetBuiltInOverride: existing.value.builtIn });
     emitConfigChanged(existing.namespace, existing.key, existing.version + 1);
     return json({ ok: true });
   } catch (e) {

package/src/routes/agents-spawn.ts

@@ -208,7 +208,7 @@ export const postAgentSpawn: Handler = async (req) => {
     // strip the heavy inlined provisioning file contents from the echoed-back summary.
     return json({
       ok: true, spawnRequestId: result.spawnRequestId, harnessSubagents: result.harnessSubagents, orchestratorId: result.orchestratorId, placementReason: result.placementReason, provider: result.provider, command: summarizeSpawnCommandForCaller(result.command),
-      ...(result.task ? { task: result.task } : {}), ...(result.warnings ? { warnings: result.warnings } : {}), ...(result.dispatchDecision ? { dispatchDecision: result.dispatchDecision } : {}), ...(workflow.reason ? { workflow: { started: false, reason: workflow.reason } } : {}),
+      ...(result.task ? { task: result.task } : {}), ...(result.warnings ? { warnings: result.warnings } : {}), ...(result.spawnPolicy ? { spawnPolicy: result.spawnPolicy } : {}), ...(result.dispatchDecision ? { dispatchDecision: result.dispatchDecision } : {}), ...(workflow.reason ? { workflow: { started: false, reason: workflow.reason } } : {}),
     }, 202);
   } catch (e) {
     if (e instanceof McpAuthError) return error(e.message, 403);