@humwick/server 0.130.0 → 0.130.2

package/src/routes/stats.ts

@@ -7,7 +7,7 @@ import { listPauses, pauseJob, resumeJobAsync } from "../maintenance/pauses";
 import { defaultIssueRepo } from "../config";
 import { listSpawnPolicies } from "../config-store";
 import { disabledBackingPolicyNames } from "../channel-policy-health";
-import { cancelMaintenanceRun, listMaintenanceJobs, listRecentMaintenanceRuns, listRunningMaintenanceRuns, runLegacyMaintenanceReaper, runMaintenanceJobNow } from "../maintenance";
+import { cancelMaintenanceRun, listMaintenanceJobsAsync, listRecentMaintenanceRuns, listRunningMaintenanceRuns, runLegacyMaintenanceReaper, runMaintenanceJobNow } from "../maintenance";
 import { claudeAppOAuthHealth } from "../claude-app/oauth-http";
 import { getConnector } from "../connectors";
 import { channelsHostEnsureHealthCheck } from "../connector-boot-health";
@@ -66,7 +66,7 @@ export const getHealthRoute: Handler = async () => {
 // #3606 — rolling 60 s load breakdown: callers by rate and CPU, emits, reader-pool ops.
 export const getHubMetricsRoute: Handler = () => json(hubMetricsReport());
 
-export const getMaintenanceJobs: Handler = () => json(listMaintenanceJobs());
+export const getMaintenanceJobs: Handler = async () => json(await listMaintenanceJobsAsync());
 
 // #1728 stage 0 — a POST-HOC diagnostic surface, not a live incident one: it reads the in-memory
 // run registry the scheduler maintains (see src/maintenance/scheduler.ts). That registry can only
@@ -87,7 +87,7 @@ export const postMaintenanceJobRun: Handler = async (req, params) => {
     const parsed = await parseBody<{ overridePause?: unknown }>(req);
     const overridePause = parsed.ok && parsed.body?.overridePause === true;
     const run = await runMaintenanceJobNow(params.id!, { overridePause });
-    return json({ run, jobs: listMaintenanceJobs() }, run.status === "failed" ? 500 : 202);
+    return json({ run, jobs: await listMaintenanceJobsAsync() }, run.status === "failed" ? 500 : 202);
   } catch (e) {
     if (e instanceof Error && e.message.includes("not found")) return error(e.message, 404);
     throw e;
@@ -110,7 +110,7 @@ export const postMaintenanceJobCancel: Handler = async (req, params) => {
   if (cancelledRunIds.length === 0) {
     return json({ ok: false, error: "maintenance job is not running", cancelledRunIds: [] }, 404);
   }
-  return json({ ok: true, cancelledRunIds, requester, jobs: listMaintenanceJobs() });
+  return json({ ok: true, cancelledRunIds, requester, jobs: await listMaintenanceJobsAsync() });
 };
 
 export const getMaintenancePauses: Handler = () => {
@@ -136,7 +136,7 @@ export const postMaintenanceJobPause: Handler = async (req, params) => {
     if (!result.ok) {
       return json({ ok: false, error: "maintenance job already paused", pause: result.pause }, 409);
     }
-    return json({ ok: true, pause: result.pause, jobs: listMaintenanceJobs() });
+    return json({ ok: true, pause: result.pause, jobs: await listMaintenanceJobsAsync() });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;
@@ -147,7 +147,7 @@ export const postMaintenanceJobResume: Handler = async (_req, params) => {
   try {
     const result = await resumeJobAsync({ jobId: params.id! });
     if (!result.resumed) return error("maintenance job is not paused", 404);
-    return json({ ok: true, ...result, jobs: listMaintenanceJobs() });
+    return json({ ok: true, ...result, jobs: await listMaintenanceJobsAsync() });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;

package/src/routes/task-http.ts

@@ -1,4 +1,5 @@
-import { resolveActingUser, requestUserAddress, resolveActorLabel, error } from "./_shared";
+import { isRecord } from "@humwick/sdk";
+import { resolveActingUser, requestUserAddress, resolveActorLabel, error, parseBody, parseId } from "./_shared";
 import { ValidationError } from "../db/connection";
 import { authContextFromRequest } from "../services/auth-context";
 import { isRequestAuthorizedFor } from "../security";
@@ -25,3 +26,16 @@ export function taskEntityError(e: unknown): Response {
   }
   throw e;
 }
+
+export async function parseTaskMutation(req: Request, rawId: string | undefined): Promise<
+  { ok: true; id: number; body: Record<string, unknown> } | { ok: false; response: Response }
+> {
+  const id = parseId(rawId);
+  if (id === null) return { ok: false, response: error("invalid task id") };
+  const forbidden = await requireTaskMutationAuth(req, id);
+  if (forbidden) return { ok: false, response: forbidden };
+  const parsed = await parseBody<Record<string, unknown>>(req);
+  if (!parsed.ok) return { ok: false, response: error(parsed.error, parsed.status) };
+  if (!isRecord(parsed.body)) return { ok: false, response: error("JSON object body required") };
+  return { ok: true, id, body: parsed.body };
+}

package/src/routes/task-issues.ts

@@ -6,18 +6,13 @@ import { cleanIssueRefRelation } from "../db/task-issue-relation";
 import { issueRefsFromArgs } from "../services/issue-refs";
 import { cleanString } from "../validation";
 import { isRecord } from "@humwick/sdk";
-import { error, json, parseBody, parseId, type Handler } from "./_shared";
-import { taskHttpActor as actorOf, requireTaskMutationAuth, taskEntityError as entityError } from "./task-http";
+import { error, json, type Handler } from "./_shared";
+import { taskHttpActor as actorOf, parseTaskMutation, taskEntityError as entityError } from "./task-http";
 
 export const postTaskRef: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     // Same alias tolerance + attach-nothing rejection as relay_task_add_ref (#2214), one body.
     return json(await attachTaskRefs(id, {
@@ -33,14 +28,9 @@ export const postTaskRef: Handler = async (req, params) => {
   }
 };
 export const deleteTaskRef: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await removeTaskEntityRefAsync(id, {
       issueRefId: cleanString(body.issueRefId, "issueRefId", { max: 120 }),
@@ -57,14 +47,9 @@ export const deleteTaskRef: Handler = async (req, params) => {
 // #833 — comment-on-Task writes THROUGH to the linked GitHub issue (discussion lives in
 // GitHub, never a relay table). Execution telemetry never reaches this path.
 export const postTaskComment: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const result = await commentOnTaskThrough({
       taskId: id,

package/src/routes/tasks.ts

@@ -2,9 +2,9 @@
 export { postTaskRef, deleteTaskRef, postTaskComment } from "./task-issues";
 import { createPlanTaskAsync, isPlanTaskCreate } from "../services/plan-task-create";
 import { prepareIssueTaskCreate, refreshTaskIssueUpdateAsync } from "../services/task-from-issue";
-import { taskHttpActor as actorOf, requireTaskMutationAuth, taskEntityError as entityError } from "./task-http";
+import { taskHttpActor as actorOf, requireTaskMutationAuth, parseTaskMutation, taskEntityError as entityError } from "./task-http";
 import { MAX_BODY_BYTES } from "../config";
-import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacksInBackground, emitCommand, error, json, normalizeAgentSessionGuard, parseBody, parseId, type Handler } from "./_shared";
+import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacksInBackground, error, json, normalizeAgentSessionGuard, parseBody, parseId, type Handler } from "./_shared";
 import { isRequestAuthorizedFor } from "../security";
 import { authContextFromRequest } from "../services/auth-context";
 import { hasTaskReadAdminScope } from "../task-authz";
@@ -25,7 +25,7 @@ import { cleanIssueRefRelation } from "../db/task-issue-relation";
 import { issueRefsFromArgs } from "../services/issue-refs";
 import { cleanEpoch, cleanMeta, cleanString, dependencyRefField, optionalEnum, taskIdField } from "../validation";
 import { emitMessageClaimed, emitTaskChanged } from "../sse";
-import { errMessage, isRecord, TASK_TERMINAL_STAGES, TASK_DELIVERABLE_STAGES, TASK_DISPATCH_COMPLEXITIES, type TaskBlocker, type TaskDispatch, type TaskGateStatus, type TaskPriority } from "@humwick/sdk";
+import { isRecord, TASK_TERMINAL_STAGES, TASK_DELIVERABLE_STAGES, TASK_DISPATCH_COMPLEXITIES, type TaskBlocker, type TaskDispatch, type TaskGateStatus, type TaskPriority } from "@humwick/sdk";
 import { type AgentSessionGuard, type TaskStatus, type TaskStatusInput } from "../types";
 
 async function taskDetailOr404(id: number) {
@@ -100,6 +100,7 @@ export const postTaskCreate: Handler = async (req) => {
       complexity: optionalEnum(body.complexity, "complexity", TASK_DISPATCH_COMPLEXITIES),
       context: cleanString(body.context, "context", { max: MAX_BODY_BYTES }),
       terminalStage: optionalEnum(body.terminalStage, "terminalStage", TASK_TERMINAL_STAGES),
+      onDeploy: cleanString(body.onDeploy, "onDeploy", { max: 500 }),
       doneWhen: cleanString(body.doneWhen, "doneWhen", { max: MAX_BODY_BYTES }),
       teamId: cleanString(body.teamId, "teamId", { max: 200 }),
       projectId: cleanString(body.projectId, "projectId", { max: 120 }),
@@ -109,6 +110,7 @@ export const postTaskCreate: Handler = async (req) => {
       // Raw passthrough (same convention as `dispatch` above) — validated inside
       // createDeliverableTask (cleanTags / cleanTaskPriority), not at the route layer.
       tags: body.tags as string[] | undefined,
+      paths: body.paths as string[] | undefined,
       priority: body.priority as TaskPriority | undefined,
       // Same alias-tolerant normalization the MCP surface uses (#2214) — one home, both transports.
       issueRefs: issueRefsFromArgs(body),
@@ -148,21 +150,10 @@ export const postTaskCreate: Handler = async (req) => {
   }
 };
 
-
-
-
-
-
-
 export const patchTaskEntity: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     if (body.refreshIssue !== undefined) return json(await refreshTaskIssueUpdateAsync(id, body, actorOf(req)));
     const detail = await updateTaskEntityAsync(id, {
@@ -171,6 +162,7 @@ export const patchTaskEntity: Handler = async (req, params) => {
       ...(body.complexity !== undefined ? { complexity: optionalEnum(body.complexity, "complexity", TASK_DISPATCH_COMPLEXITIES) } : {}),
       ...(body.context !== undefined ? { context: cleanString(body.context, "context", { max: MAX_BODY_BYTES }) ?? "" } : {}),
       ...(body.latestSteer !== undefined ? { latestSteer: cleanString(body.latestSteer, "latestSteer", { max: MAX_BODY_BYTES }) ?? "" } : {}),
+      ...(body.onDeploy !== undefined ? { onDeploy: cleanString(body.onDeploy, "onDeploy", { max: 500 }) ?? "" } : {}),
       ...(body.doneWhen !== undefined ? { doneWhen: cleanString(body.doneWhen, "doneWhen", { max: MAX_BODY_BYTES }) ?? "" } : {}),
       ...(body.dispatch !== undefined ? { dispatch: body.dispatch as TaskDispatch } : {}),
       ...(body.teamId !== undefined ? { teamId: cleanString(body.teamId, "teamId", { max: 200 }) ?? "" } : {}),
@@ -180,6 +172,7 @@ export const patchTaskEntity: Handler = async (req, params) => {
       // survive into updateDeliverableTask, which cleanString's `?? ""` collapse would erase.
       ...(body.terminalStage !== undefined ? { terminalStage: body.terminalStage === null ? null : optionalEnum(body.terminalStage, "terminalStage", TASK_TERMINAL_STAGES) } : {}),
       ...(body.tags !== undefined ? { tags: body.tags as string[] | null } : {}),
+      ...(body.paths !== undefined ? { paths: body.paths as string[] | null } : {}),
       ...(body.priority !== undefined ? { priority: body.priority as TaskPriority | null } : {}),
       actor: actorOf(req),
     });
@@ -190,14 +183,9 @@ export const patchTaskEntity: Handler = async (req, params) => {
 };
 
 export const postTaskEntityStatus: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await setTaskStatusControl(id, {
       status: body.status as TaskStatus,
@@ -213,14 +201,9 @@ export const postTaskEntityStatus: Handler = async (req, params) => {
 };
 
 export const postTaskEntityStage: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await setTaskEntityStageAsync(id, {
       deliverableStage: optionalEnum(body.deliverableStage, "deliverableStage", TASK_DELIVERABLE_STAGES) as any,
@@ -235,14 +218,9 @@ export const postTaskEntityStage: Handler = async (req, params) => {
 };
 
 export const postTaskEntityGate: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     return json(await recordTaskEntityGateAsync(id, {
       gate: cleanString(body.gate, "gate", { required: true, max: 120 })!,
@@ -345,14 +323,9 @@ export const deleteTaskRelated: Handler = async (req, params) => {
 };
 
 export const postTaskAssign: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await assignTaskEntityAgentAsync(id, cleanString(body.agentId, "agentId", { required: true, max: 200 })!, cleanString(body.role, "role", { max: 120 }), actorOf(req));
     return json(detail);
@@ -444,10 +417,6 @@ export const postWorkspaceWithdrawLand: Handler = async (req) => {
   }
 };
 
-
-
-
-
 export const postClaimTask: Handler = async (req, params) => {
   const id = parseId(params.id);
   if (id === null) return error("invalid task id");

package/src/routes/team-templates.ts

@@ -1,5 +1,5 @@
 import { authContextFromRequest } from "../services/auth-context";
-import { deleteTeamTemplate, getTeamTemplate, listTeamTemplates, saveTeamTemplate } from "../services/team-templates";
+import { deleteTeamTemplateAsync, getTeamTemplate, listTeamTemplates, saveTeamTemplateAsync } from "../services/team-templates";
 import { cleanString } from "../validation";
 import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared";
 
@@ -39,7 +39,7 @@ export const postTeamTemplateRoute: Handler = async (req) => {
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(saveTeamTemplate(parsed.body ?? {}, updatedBy(req)), 201);
+    return json(await saveTeamTemplateAsync(parsed.body ?? {}, updatedBy(req)), 201);
   } catch (err) {
     return routeError(err);
   }
@@ -51,15 +51,15 @@ export const putTeamTemplateRoute: Handler = async (req, params) => {
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(saveTeamTemplate({ ...(parsed.body ?? {}), slug: slugParam(params) }, updatedBy(req)));
+    return json(await saveTeamTemplateAsync({ ...(parsed.body ?? {}), slug: slugParam(params) }, updatedBy(req)));
   } catch (err) {
     return routeError(err);
   }
 };
 
-export const deleteTeamTemplateRoute: Handler = (req, params) => {
+export const deleteTeamTemplateRoute: Handler = async (req, params) => {
   const denied = authorizeRoute(req, { scope: "system:admin" });
   if (denied) return denied;
   const slug = slugParam(params);
-  return json({ slug, deleted: deleteTeamTemplate(slug, updatedBy(req)) });
+  return json({ slug, deleted: await deleteTeamTemplateAsync(slug, updatedBy(req)) });
 };

package/src/routes/teams-config.ts

@@ -1,4 +1,4 @@
-import { getTeamsConfig, setTeamsConfig } from "../teams-config-store";
+import { getTeamsConfig, setTeamsConfigAsync } from "../teams-config-store";
 import { cleanString } from "../validation";
 import { error, json, parseBody, type Handler } from "./_shared";
 import { isRecord } from "@humwick/sdk";
@@ -11,5 +11,5 @@ export const putTeamsConfigRoute: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const updatedBy = isRecord(parsed.body) ? cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 }) : undefined;
-  return json(setTeamsConfig(parsed.body, { updatedBy }));
+  return json(await setTeamsConfigAsync(parsed.body, { updatedBy }));
 };

package/src/routes/tokens.ts

@@ -6,13 +6,19 @@ import { ValidationError, getOrchestrator, upsertIntegrationRegistry } from "../
 import { auditEvent, authAuditMetadata, authorizeRoute, error, isRootCredentialRequest, json, parseBody, resolveActingUser, type Handler } from "./_shared";
 import { cleanString, cleanStringArray, cleanTokenConstraints, optionalEnum } from "../validation";
 import { deleteTokenProfile, getToken, getTokenProfile, listTokenProfiles, listTokens, updateTokenProfile, upsertTokenProfile } from "../token-db";
-import { createTokenAsync, handoffTokenAsync, revokeTokenAsync } from "../token-db-write";
+import { createTokenAsync, revokeTokenAsync } from "../token-db-write";
 import { getComponentAuth, getIntegrationAuth, isAuthorized } from "../security";
-import { issueIntegrationRuntimeToken, issueInteractiveRunnerRuntimeToken, issueMcpRuntimeToken, reissueRunnerRuntimeToken, remintRunnerRuntimeToken } from "../runtime-tokens";
+import { handoffRunnerTokenAsync, issueIntegrationRuntimeToken, issueInteractiveRunnerRuntimeToken, issueMcpRuntimeToken, reissueRunnerRuntimeToken, remintRunnerRuntimeToken, type RunnerTokenMintRefusal } from "../runtime-tokens";
 import { type SpawnProvider } from "../types";
 
 export const getTokens: Handler = () => json(listTokens());
 
+// #3775 — a rate-limited runner token mint is a 429 with Retry-After; any other refusal stays 403.
+function mintRefused(refusal: RunnerTokenMintRefusal): Response {
+  if (refusal.retryAfterSeconds === undefined) return error(refusal.error, 403);
+  return Response.json({ error: refusal.error, retryAfterSeconds: refusal.retryAfterSeconds }, { status: 429, headers: { "Retry-After": String(refusal.retryAfterSeconds) } });
+}
+
 export const getTokenMe: Handler = (req) => {
   const component = getComponentAuth(req);
   if (component) {
@@ -103,11 +109,12 @@ export const postRuntimeTokenRenew: Handler = async (req) => {
   const auth = getComponentAuth(req);
   if (!auth?.jti) return error("scoped runtime token required", 403);
   if (auth.role !== "provider") return error("provider runtime token required", 403);
-  const renewed = await handoffTokenAsync({
+  const renewed = await handoffRunnerTokenAsync(auth.sub, {
     jti: auth.jti,
     allowedProfileIds: ["provider-agent", "provider-interactive"],
     createdBy: `renew:${auth.jti}`,
   });
+  if (renewed && "retryAfterSeconds" in renewed) return mintRefused({ error: "runtime token mint rate limited", ...renewed });
   if (!renewed) return error("runtime token cannot be renewed", 403);
   await auditEvent({
     // Keyed by the successor, so a replayed handoff (#1245) records one renewal.
@@ -151,7 +158,7 @@ export const postRuntimeTokenRemint: Handler = async (req) => {
     throw e;
   }
   const result = await remintRunnerRuntimeToken(auth, `remint:${auth.jti}`);
-  if ("error" in result) return error(result.error, 403);
+  if ("error" in result) return mintRefused(result);
   if ("unchanged" in result) return json(result);
   await auditEvent({
     clientId: "server-runtime-token-remint-" + result.record.jti,
@@ -180,7 +187,7 @@ export const postOrchestratorRunnerToken: Handler = async (req, params) => {
     orchestratorId: orch.id,
     createdBy: `orchestrator-remint:${orch.id}`,
   });
-  if ("error" in result) return error(result.error, 403);
+  if ("error" in result) return mintRefused(result);
   await auditEvent({
     clientId: "server-runner-token-remint-" + result.record.jti,
     kind: "state",

package/src/routes/workflows.ts

@@ -1,7 +1,7 @@
 import { parseWorkflowDecisionResponse } from "../services/workflow-decisions";
 // #3076 — the dashboard's workflow run reads: the run list (by status and project), one run, the stats
 // window and the workflows that ran, all from the workflow run records relay_workflow_get reads, with its visibility rule.
-// #3120 — the catalog. #3166 — cancel a run, as relay_workflow_cancel does.
+// #3120 — the catalog. #3166 — cancel a run, as relay_workflow_cancel does. #3757 — pause and unpause one.
 import { OpError } from "@humwick/kernel";
 import { isRecord, WORKFLOW_STATS_WINDOWS, type WorkflowStatsWindow } from "@humwick/sdk";
 import { resolveProjectAsync, ValidationError } from "../db";
@@ -10,7 +10,7 @@ import { authContextFromRequest } from "../services/auth-context";
 import { ServiceAuthError } from "../services/errors";
 import { readWorkflowCatalog } from "../services/workflow-catalog";
 import { requireSpawnBudget } from "../spawn-budget";
-import { amendWorkflowRunBudget, cancelWorkflowRun, getWorkflowRun, readWorkflowRunBudget, listWorkflowRuns, resumeWorkflowRun, startWorkflowRun } from "../services/workflow-runs";
+import { amendWorkflowRunBudget, cancelWorkflowRun, getWorkflowRun, pauseWorkflowRun, readWorkflowRunBudget, listWorkflowRuns, resumeWorkflowRun, startWorkflowRun } from "../services/workflow-runs";
 import { workflowDefinitions, workflowStats } from "../services/workflow-stats";
 import { cleanString, taskIdField } from "../validation";
 import { error, json, parseBody, type Handler } from "./_shared";
@@ -83,7 +83,22 @@ export const postWorkflowRunCancelRoute: Handler = async (req, params) => {
   }
 };
 
-function budgetRouteError(e: unknown): Response {
+/** #3757 — pause (a `reason` is required) or unpause a run, as relay_workflow_resume's `pause` does; the dashboard's buttons use these. */
+function workflowRunPauseRoute(pause: boolean): Handler {
+  return async (req, params) => {
+    const parsed = await parseBody<unknown>(req);
+    if (!parsed.ok) return error(parsed.error, parsed.status);
+    if (parsed.body !== null && !isRecord(parsed.body)) return error("body must be a JSON object", 400);
+    try {
+      const reason = cleanString(parsed.body?.reason, "reason", { max: 2000 });
+      return json(await pauseWorkflowRun({ runId: params.runId!, pause, ...(reason ? { reason } : {}) }, authContextFromRequest(req)));
+    } catch (e) { return runRouteError(e); }
+  };
+}
+export const postWorkflowRunPauseRoute = workflowRunPauseRoute(true);
+export const postWorkflowRunUnpauseRoute = workflowRunPauseRoute(false);
+
+function runRouteError(e: unknown): Response {
   if (e instanceof McpNotFoundError) return error(e.message, 404);
   if (e instanceof ServiceAuthError) return error(e.message, 403);
   if (e instanceof ValidationError) return error(e.message, 400);
@@ -91,7 +106,7 @@ function budgetRouteError(e: unknown): Response {
 }
 
 export const getWorkflowRunBudgetRoute: Handler = async (req, params) => {
-  try { return json(await readWorkflowRunBudget(params.runId!, authContextFromRequest(req))); } catch (e) { return budgetRouteError(e); }
+  try { return json(await readWorkflowRunBudget(params.runId!, authContextFromRequest(req))); } catch (e) { return runRouteError(e); }
 };
 
 export const patchWorkflowRunBudgetRoute: Handler = async (req, params) => {
@@ -100,7 +115,7 @@ export const patchWorkflowRunBudgetRoute: Handler = async (req, params) => {
   try {
     const { tokenCap } = requireSpawnBudget(parsed.body);
     return json(await amendWorkflowRunBudget({ runId: params.runId!, tokenCap }, authContextFromRequest(req)));
-  } catch (e) { return budgetRouteError(e); }
+  } catch (e) { return runRouteError(e); }
 };
 
 export const postWorkflowRunResumeRoute: Handler = async (req, params) => {

package/src/routing-policy-normalize.ts

@@ -1,5 +1,4 @@
 import { ValidationError } from "@humwick/sdk";
-import { currentDispatchModels } from "./routing-model-aliases";
 import { normalizeStepRoutingDefaults } from "./routing-step-defaults";
 import {
   isRecord,
@@ -199,7 +198,7 @@ export function normalizeDispatchPolicy(raw: unknown): DispatchPolicy {
  */
 /** Pure projection used by reader-gateway callers that already captured the policy snapshot. */
 export function dispatchPolicyFor(policy: RoutingPolicy): DispatchPolicy {
-  return policy.dispatch ? currentDispatchModels(policy.dispatch) : DEFAULT_DISPATCH_POLICY;
+  return policy.dispatch ?? DEFAULT_DISPATCH_POLICY;
 }
 
 const MAX_RULES = 100;

package/src/routing-step-defaults.ts

@@ -1,5 +1,4 @@
 import { cleanString, isRecord, isSpawnProvider, ValidationError, type StepRoutingDefaults, type StepRoutingTarget } from "@humwick/sdk";
-import { VALID_EFFORTS } from "@humwick/sdk/provider-catalog";
 import { WORKFLOW_PIN_FIELDS } from "@humwick/kernel/workflow-definition";
 
 export function normalizeStepRoutingDefaults(raw: unknown): StepRoutingDefaults {
@@ -25,7 +24,6 @@ function normalizeRoles(raw: unknown, where: string): Record<string, StepRouting
     for (const key of Object.keys(target)) if (!(WORKFLOW_PIN_FIELDS as readonly string[]).includes(key)) throw new ValidationError(`${where}.${role}.${key} is not a routing field`);
     const fields = Object.fromEntries(Object.entries(target).map(([key, value]) => [key, cleanString(value, `${where}.${role}.${key}`, { required: true, max: 200 })]));
     if (fields.provider !== undefined && !isSpawnProvider(fields.provider)) throw new ValidationError(`${where}.${role}.provider is not a provider`);
-    if (fields.effort !== undefined && !(VALID_EFFORTS as readonly string[]).includes(fields.effort)) throw new ValidationError(`${where}.${role}.effort must be ${VALID_EFFORTS.join(", ")}`);
     return [role, fields as StepRoutingTarget];
   }));
 }

package/src/runner-token-mint-limit.ts

@@ -0,0 +1,63 @@
+// #3775 — per-subject cap on runner token successor mints (renew, orchestrator re-mint, boundary
+// re-derive). A runner stuck re-minting after 401 minted 700-1,400 tokens/min and overloaded the
+// hub writer; this refuses the excess before any token row is written. A spawn subject
+// (`runner:spawn:<id>`) keeps one subject across its whole token lineage, so it is the key. Only a
+// real mint is charged: a replayed handoff (retry or concurrent caller) writes nothing.
+
+/** At most this many new tokens per subject in any rolling window. */
+export const RUNNER_TOKEN_MINTS_PER_WINDOW = 3;
+export const RUNNER_TOKEN_MINT_WINDOW_MS = 60_000;
+const MAX_TRACKED_SUBJECTS = 10_000;
+
+export class RunnerTokenMintLimit {
+  /** Recent mint times per subject, oldest first, at most RUNNER_TOKEN_MINTS_PER_WINDOW long. */
+  private readonly mints = new Map<string, number[]>();
+  /** Subjects currently refused, so a trip logs once rather than once per refused mint. */
+  private readonly tripped = new Set<string>();
+  private readonly now: () => number;
+  private readonly log: (message: string) => void;
+
+  constructor(options: { now?: () => number; log?: (message: string) => void } = {}) {
+    this.now = options.now ?? Date.now;
+    this.log = options.log ?? console.warn;
+  }
+
+  /** Seconds `sub` must wait before its next mint, or undefined when it may mint now. Charges nothing. */
+  refusal(sub: string): number | undefined {
+    const recent = this.recent(sub);
+    if (recent.length < RUNNER_TOKEN_MINTS_PER_WINDOW) {
+      this.tripped.delete(sub);
+      return undefined;
+    }
+    if (!this.tripped.has(sub)) {
+      if (this.tripped.size >= MAX_TRACKED_SUBJECTS) this.tripped.clear();
+      this.tripped.add(sub);
+      this.log(`[token-mint] rate limit tripped for ${sub}: ${RUNNER_TOKEN_MINTS_PER_WINDOW} tokens minted in the last ${RUNNER_TOKEN_MINT_WINDOW_MS / 1000}s; refusing until the window frees`);
+    }
+    return Math.max(1, Math.ceil((recent[0]! + RUNNER_TOKEN_MINT_WINDOW_MS - this.now()) / 1000));
+  }
+
+  /** Record one new token minted for `sub`. */
+  charge(sub: string): void {
+    const recent = this.recent(sub);
+    if (!this.mints.has(sub) && this.mints.size >= MAX_TRACKED_SUBJECTS) this.mints.delete(this.mints.keys().next().value!);
+    recent.push(this.now());
+    if (recent.length > RUNNER_TOKEN_MINTS_PER_WINDOW) recent.shift();
+    this.mints.set(sub, recent);
+  }
+
+  reset(): void {
+    this.mints.clear();
+    this.tripped.clear();
+  }
+
+  private recent(sub: string): number[] {
+    const since = this.now() - RUNNER_TOKEN_MINT_WINDOW_MS;
+    const recent = (this.mints.get(sub) ?? []).filter((at) => at > since);
+    if (recent.length) this.mints.set(sub, recent);
+    else this.mints.delete(sub);
+    return recent;
+  }
+}
+
+export const runnerTokenMintLimit = new RunnerTokenMintLimit();

package/src/runtime-grant.ts

@@ -24,7 +24,9 @@ const SPAWN_SCOPES = ["command:spawn", "command:shutdown"] as const;
 const FLEET_OPS_PROFILES = new Set(["coordinator", "ops-assistant"]);
 // #1925 H10 — fleet visibility is coordinator-facing. Keep this a fixed trusted-profile allowlist,
 // like command:fleet, rather than a user-editable profile setting that could widen worker tokens.
-const HOST_READ_PROFILES = new Set(["coordinator"]);
+const HOST_WRITE_PROFILES = new Set(["coordinator"]);
+// #3772 — the reboot runbook reads resource_control held/waiter counts from /api/hosts; ops profiles read, never write.
+const HOST_READ_PROFILES = new Set([...HOST_WRITE_PROFILES, "ops-assistant", "sec-ops"]);
 // #3073 — coordinator-only groups (not in WORKER_TOOL_GROUPS) a coordinator always gets, even when its stored override predates them.
 const COORDINATOR_ONLY_TOOL_GROUPS = ["decisions", "workflows", "project", "routing"] as const;
 // #3327 — the coordinator edits routing preferences, like Edin in the dashboard.
@@ -109,7 +111,7 @@ export function deriveRunnerGrant(profile: string | undefined, authority: Deriva
     ...nonTrustedBaseline(agentInitiated),
     ...(fleetOps ? [FLEET_SCOPE] : []),
     ...(hostsRead ? ["hosts:read"] : []),
-    ...(!agentInitiated && Boolean(profile && HOST_READ_PROFILES.has(profile)) && callerMayMintHostsScope(callerScopes, "hosts:write") ? ["hosts:write"] : []),
+    ...(!agentInitiated && Boolean(profile && HOST_WRITE_PROFILES.has(profile)) && callerMayMintHostsScope(callerScopes, "hosts:write") ? ["hosts:write"] : []),
     ...(grantsSecretsScope(profile, toolGroups, callerScopes) ? [SECRETS_WRITE_SCOPE] : []),
     ...(!agentInitiated && (COORDINATOR_PROFILE_NAMES as readonly string[]).includes(profile ?? "") && (callerScopes === undefined || hasScope(callerScopes, ROUTING_WRITE_SCOPE)) ? [ROUTING_WRITE_SCOPE] : []),
     ...(grant.canSpawn ? SPAWN_SCOPES.filter(scope => !agentInitiated || callerScopes === undefined || hasScope(callerScopes, scope)) : []),