@humwick/server 0.130.1 → 0.130.2

package/src/mcp/tools-spawn.ts

@@ -16,7 +16,7 @@ import { workflowForBuilderSpawn } from "../services/workflow-auto-start";
 import { optionalEnum } from "../validation";
 import { cleanTaskDispatch } from "../db/task-entity";
 import { DISPATCH_SHAPE_SCHEMA } from "./dispatch-shape-schema";
-import { APPROVAL_MODES, AUTO_MERGE_POLICIES, LAUNCH_MODES, REPORT_VERBOSITIES, SPAWN_PROVIDERS, stringValue, VALID_AGENT_LIFECYCLES, VALID_EFFORTS, VALID_WORKSPACE_MODES } from "@humwick/sdk";
+import { APPROVAL_MODES, AUTO_MERGE_POLICIES, LAUNCH_MODES, REPORT_VERBOSITIES, SPAWN_PROVIDERS, stringValue, VALID_AGENT_LIFECYCLES, VALID_WORKSPACE_MODES } from "@humwick/sdk";
 import type { ProviderEffort } from "@humwick/sdk/provider-catalog";
 import type { AgentCard, AgentLifecycle, Command, SpawnApprovalMode, SpawnProvider, WorkspaceAutoMergePolicy, WorkspaceLandingPolicy, WorkspaceLandMechanism, WorkspaceMode, WorkspaceRecord } from "../types";
 import { projectMyAgent, projectSpawnTargets, type MyAgentFullPresentation, type PresentationVerbosity } from "./presentation";
@@ -43,7 +43,7 @@ export const SPAWN_TOOLS: ToolDefinition[] = [
         env: { type: "object", additionalProperties: { type: "string" }, description: "Vault refs: secret:<name>." },
         label: { type: "string" },
         model: { type: "string" },
-        effort: { enum: VALID_EFFORTS },
+        effort: { type: "string" },
         approvalMode: { enum: APPROVAL_MODES, description: "Use open; read-only blocks reports/tests; guarded waits for prompts." },
         prompt: { type: "string" },
         taskId: { oneOf: [{ type: "integer", minimum: 1 }, { type: "string" }], description: "Task id or TNNNN; loads its spec." },
@@ -70,7 +70,7 @@ export const SPAWN_TOOLS: ToolDefinition[] = [
         hostPinned: { type: "boolean" },
         landBlocked: { type: "boolean", description: "Permanent ban; for review use a Task hold." },
         selfEffort: { type: "boolean" },
-        selfEffortCeiling: { enum: VALID_EFFORTS },
+        selfEffortCeiling: { type: "string" },
         profile: { type: "string" },
         role: { type: "string", description: "Default-branch project role; mutually exclusive with profile." },
         tags: { type: "array", items: { type: "string" } },
@@ -229,6 +229,7 @@ export async function relaySpawnAgent(auth: McpAuthContext, args: Record<string,
     ...(result.taskId !== undefined ? { taskId: result.taskId } : {}),
     ...(result.task ? { task: result.task } : {}),
     ...(result.warnings ? { warnings: result.warnings } : {}),
+    ...(result.spawnPolicy ? { spawnPolicy: result.spawnPolicy } : {}),
     ...(result.dispatchDecision ? { dispatchDecision: { target: result.dispatchDecision.target, rationale: result.dispatchDecision.rationale, warnings: result.dispatchDecision.warnings } } : {}),
     ...(workflow.reason ? { workflow: { started: false, reason: workflow.reason } } : {}),
   };

package/src/mcp-agent-action.ts

@@ -1,7 +1,6 @@
 import { REPORT_VERBOSITIES } from "@humwick/sdk";
 import { setAgentReportVerbosity } from "./services/agent-reporting";
 import { INCLUDED_TOOL_SCOPE_NEEDS } from "./mcp/tool-groups";
-import { VALID_EFFORTS } from "@humwick/sdk/provider-catalog";
 import { cleanEnum, cleanString } from "./validation";
 import { AgentActionTargetError, dispatchAgentAction, type AgentAction } from "./services/agent-action";
 import { authContextFromMcp } from "./services/auth-context";
@@ -37,7 +36,7 @@ export const SET_EFFORT_TOOL = {
   inputSchema: {
     type: "object",
     properties: {
-      effort: { type: "string", enum: VALID_EFFORTS },
+      effort: { type: "string" },
       reason: { type: "string" },
       requestId: { type: "string" },
     },

package/src/mcp-issue-ref-tools.ts

@@ -1,9 +1,10 @@
-import { deleteIssueRef, getIssueRef, getIssueRefByExternalKey, issueRefClosedCompleted, issueRefForRefString, listIssueRefs, resolveIssueRefByExternalKey, resolveIssueRefFromString, updateIssueRef, upsertIssueRef } from "./db/issue-refs";
+import { getIssueRef, getIssueRefByExternalKey, issueRefClosedCompleted, issueRefForRefString, listIssueRefs } from "./db/issue-refs";
+import { deleteIssueRefAsync, resolveIssueRefByExternalKeyAsync, resolveIssueRefFromStringAsync, updateIssueRefAsync, upsertIssueRefAsync } from "./db/issue-refs-async";
 import { McpNotFoundError } from "./mcp-errors";
 import { cleanEnum, cleanString, optionalEnum } from "./validation";
 import { ISSUE_REF_CLOSE_REASONS, ISSUE_PROVIDERS, ISSUE_REF_STATUSES, isRecord, type IssueProvider, type IssueRef, type IssueRefCloseReason, type IssueRefStatus } from "./types";
 import { ValidationError } from "./db";
-import { advanceTerminalPlanRefs } from "./services/plan-terminal-refs";
+import { advanceTerminalPlanRefsAsync } from "./services/plan-terminal-refs";
 
 export const ISSUE_REF_TOOLS = [
   {
@@ -126,11 +127,11 @@ function currentRefFor(args: Record<string, unknown>) {
   return null;
 }
 
-export function relayIssueRefTool(_auth: IssueRefToolAuth, name: string, args: Record<string, unknown>): Record<string, unknown> {
+export async function relayIssueRefTool(_auth: IssueRefToolAuth, name: string, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   if (!isRecord(args)) throw new ValidationError("arguments must be an object");
   if (name === "relay_issue_ref_upsert") {
     const before = currentRefFor(args);
-    const issueRef = upsertIssueRef({
+    const issueRef = await upsertIssueRefAsync({
       provider: providerArg(args.provider),
       repo: cleanString(args.repo, "repo", { required: true, max: 500 })!,
       externalKey: cleanString(args.externalKey, "externalKey", { required: true, max: 240 })!,
@@ -141,7 +142,7 @@ export function relayIssueRefTool(_auth: IssueRefToolAuth, name: string, args: R
       statusSyncedAt: timestampArg(args.statusSyncedAt),
     });
     // #2520 — the cached ref flipped to a completed close: propagate to bound plan nodes.
-    if (issueRefClosedCompleted(before, issueRef)) advanceTerminalPlanRefs({ issueRefId: issueRef.id, actor: _auth.actor });
+    if (issueRefClosedCompleted(before, issueRef)) await advanceTerminalPlanRefsAsync({ issueRefId: issueRef.id, actor: _auth.actor });
     return issueRef as unknown as Record<string, unknown>;
   }
   if (name === "relay_issue_ref_resolve") {
@@ -153,7 +154,7 @@ export function relayIssueRefTool(_auth: IssueRefToolAuth, name: string, args: R
       ? issueRefForRefString(ref, cleanString(args.defaultRepo ?? args.repo, "defaultRepo", { max: 500 }))
       : currentRefFor(args);
     const issueRef = (ref
-      ? resolveIssueRefFromString({
+      ? await resolveIssueRefFromStringAsync({
         ref,
         defaultRepo: cleanString(args.defaultRepo ?? args.repo, "defaultRepo", { max: 500 }),
         provider: optionalEnum(args.provider, "provider", ISSUE_PROVIDERS, "github") as IssueProvider,
@@ -162,7 +163,7 @@ export function relayIssueRefTool(_auth: IssueRefToolAuth, name: string, args: R
         closeReason: closeReasonArg(args.closeReason),
         statusSyncedAt: timestampArg(args.statusSyncedAt),
       })
-      : resolveIssueRefByExternalKey({
+      : await resolveIssueRefByExternalKeyAsync({
         provider: providerArg(args.provider),
         repo: cleanString(args.repo, "repo", { required: true, max: 500 })!,
         externalKey: cleanString(args.externalKey, "externalKey", { required: true, max: 240 })!,
@@ -172,7 +173,7 @@ export function relayIssueRefTool(_auth: IssueRefToolAuth, name: string, args: R
         closeReason: closeReasonArg(args.closeReason),
         statusSyncedAt: timestampArg(args.statusSyncedAt),
       })) as unknown as IssueRef;
-    if (issueRefClosedCompleted(before, issueRef)) advanceTerminalPlanRefs({ issueRefId: issueRef.id, actor: _auth.actor });
+    if (issueRefClosedCompleted(before, issueRef)) await advanceTerminalPlanRefsAsync({ issueRefId: issueRef.id, actor: _auth.actor });
     return issueRef as unknown as Record<string, unknown>;
   }
   if (name === "relay_issue_ref_get") {
@@ -192,7 +193,7 @@ export function relayIssueRefTool(_auth: IssueRefToolAuth, name: string, args: R
   }
   if (name === "relay_issue_ref_update") {
     const before = currentRefFor(args);
-    const issueRef = updateIssueRef(cleanString(args.id, "id", { required: true, max: 120 })!, {
+    const issueRef = await updateIssueRefAsync(cleanString(args.id, "id", { required: true, max: 120 })!, {
       url: cleanString(args.url, "url", { max: 2000 }),
       title: cleanString(args.title, "title", { max: 500 }),
       status: statusArg(args.status),
@@ -201,11 +202,11 @@ export function relayIssueRefTool(_auth: IssueRefToolAuth, name: string, args: R
     });
     if (!issueRef) throw new McpNotFoundError("issue ref not found");
     // #2520 — the cached ref flipped to a completed close: propagate to bound plan nodes.
-    if (issueRefClosedCompleted(before, issueRef)) advanceTerminalPlanRefs({ issueRefId: issueRef.id, actor: _auth.actor });
+    if (issueRefClosedCompleted(before, issueRef)) await advanceTerminalPlanRefsAsync({ issueRefId: issueRef.id, actor: _auth.actor });
     return { issueRef };
   }
   if (name === "relay_issue_ref_delete") {
-    const deleted = deleteIssueRef(cleanString(args.id, "id", { required: true, max: 120 })!);
+    const deleted = await deleteIssueRefAsync(cleanString(args.id, "id", { required: true, max: 120 })!);
     if (!deleted) throw new McpNotFoundError("issue ref not found");
     return { deleted };
   }

package/src/mcp-maintenance-tools.ts

@@ -11,7 +11,7 @@
 
 import { ValidationError } from "./db";
 import { McpNotFoundError } from "./mcp-errors";
-import { listMaintenanceJobs } from "./maintenance";
+import { listMaintenanceJobsAsync } from "./maintenance";
 import { listPauses, pauseJob, resumeJobAsync } from "./maintenance/pauses";
 import { authContextFromMcp } from "./services/auth-context";
 import { cleanString } from "./validation";
@@ -72,7 +72,7 @@ export async function relayMaintenanceTool(auth: McpAuthLike, name: string, args
   }
 
   if (name === "relay_maintenance_jobs") {
-    const jobs = listMaintenanceJobs();
+    const jobs = await listMaintenanceJobsAsync();
     const jobId = cleanString(args.jobId, "jobId", { max: 120 });
     if (!jobId) return { jobs, count: jobs.length };
     const job = jobs.find(candidate => candidate.id === jobId);

package/src/mcp-profile-trust-tools.ts

@@ -3,7 +3,7 @@ import { INCLUDED_TOOL_SCOPE_NEEDS } from "./mcp/tool-groups";
 import { ValidationError } from "./db";
 import { callerAgentId } from "./mcp/identity";
 import { optionalEnum } from "./validation";
-import { approveProfileProjectTrust, PROJECT_REVIEW_MODES, PROJECT_TRUST_CAPABILITIES, updateProfileProjectTrust } from "./services/profile-trust";
+import { approveProfileProjectTrust, PROJECT_REVIEW_MODES, PROJECT_TRUST_CAPABILITIES, updateProfileProjectTrustAsync } from "./services/profile-trust";
 import type { McpAuthContext, ToolDefinition } from "./mcp/types";
 
 export const PROFILE_TRUST_TOOL: ToolDefinition = {
@@ -31,17 +31,17 @@ function text(args: Record<string, unknown>, field: string): string {
   return value.trim();
 }
 
-export function relayProfileTrust(auth: McpAuthContext, args: Record<string, unknown>): unknown {
+export async function relayProfileTrust(auth: McpAuthContext, args: Record<string, unknown>): Promise<unknown> {
   const name = text(args, "profile");
   const by = callerAgentId(auth) ?? auth.actor;
   if (args.action === "set-review") {
     const review = optionalEnum(args.review, "review", PROJECT_REVIEW_MODES);
     if (!review) throw new ValidationError("review is required");
-    return { trust: updateProfileProjectTrust(name, { review }, by).value.sources?.project?.trust };
+    return { trust: (await updateProfileProjectTrustAsync(name, { review }, by)).value.sources?.project?.trust };
   }
   const capability = optionalEnum(args.capability, "capability", PROJECT_TRUST_CAPABILITIES);
   if (!capability) throw new ValidationError("capability is required");
-  if (args.action === "ack") return { ack: updateProfileProjectTrust(name, { ack: [capability] }, by).value.sources?.project?.[capability]?.ack };
+  if (args.action === "ack") return { ack: (await updateProfileProjectTrustAsync(name, { ack: [capability] }, by)).value.sources?.project?.[capability]?.ack };
   if (args.action === "approve") return { approval: approveProfileProjectTrust({ name, capability, repoKey: text(args, "repoKey"), value: text(args, "value"), by }) };
   throw new ValidationError("action must be set-review, ack or approve");
 }

package/src/mcp-provider-catalog.ts

@@ -1,9 +1,9 @@
-import { VALID_EFFORTS, isRecord } from "@humwick/sdk";
+import { isRecord } from "@humwick/sdk";
 import { effectiveProviderEffortLevelsAsync } from "./db";
 
 export async function providerCatalogToolInputSchema(name: string, inputSchema: Record<string, unknown>): Promise<Record<string, unknown>> {
   if (name !== "relay_spawn_agent") return inputSchema;
   const efforts = await effectiveProviderEffortLevelsAsync();
   const properties = isRecord(inputSchema.properties) ? inputSchema.properties : {};
-  return { ...inputSchema, properties: { ...properties, effort: { type: "string", enum: efforts.length ? efforts : VALID_EFFORTS } } };
+  return { ...inputSchema, properties: { ...properties, effort: { type: "string", enum: efforts }, selfEffortCeiling: { type: "string", enum: efforts } } };
 }

package/src/mcp-task-tools.ts

@@ -74,7 +74,7 @@ const TASK_ID_PROP = { oneOf: [{ type: "integer", minimum: 1 }, { type: "string"
 export const TASK_TOOLS = [
   {
     name: "relay_task_create",
-    description: "Create a durable Task. fromIssue digests GitHub title, body, acceptance, labels and references; explicit fields win.",
+    description: "Create Task; fromIssue imports GitHub content; explicit fields win.",
     requiredScopes: ["task:write"],
     inputSchema: {
       type: "object",
@@ -84,9 +84,11 @@ export const TASK_TOOLS = [
         intent: { type: "string" },
         fromIssue: { type: "string", description: "GitHub URL or owner/repo#number. Fetch once before atomic create." },
         tags: { type: "array", items: { type: "string" } },
+        paths: { type: "array", items: { type: "string" } },
         complexity: { type: "string", enum: TASK_DISPATCH_COMPLEXITIES },
         context: { type: "string" },
-        terminalStage: { type: "string", enum: TASK_TERMINAL_STAGES },
+        terminalStage: { enum: TASK_TERMINAL_STAGES },
+        onDeploy: { type: "string" },
         doneWhen: { type: "string" },
         teamId: { type: "string" },
         projectId: { type: "string" },
@@ -108,8 +110,8 @@ export const TASK_TOOLS = [
     },
   },
   { name: "relay_task_get", description: "Read a lean Task hydration; verbose:true includes full intent, gates and history projections.", requiredScopes: ["task:read"], inputSchema: { type: "object", properties: { taskId: TASK_ID_PROP, verbose: { type: "boolean" } }, required: ["taskId"], additionalProperties: false } },
-  { name: "relay_task_list", description: "List your Tasks by default; mine:false lists all. mode:brief is id/label/status; lean is default.", requiredScopes: ["task:read"], inputSchema: { type: "object", properties: { status: { type: "string", enum: DELIVERABLE_STATUS_ENUM }, deliverableStage: { type: "string", enum: TASK_DELIVERABLE_STAGES }, teamId: { type: "string" }, projectId: { type: "string" }, repo: { type: "string" }, mine: { type: "boolean" }, inFlight: { type: "boolean" }, staleOwnerGone: { type: "boolean" }, limit: { type: "integer", minimum: 1, maximum: 500 }, mode: { type: "string", enum: ["brief", "lean", "full"] }, verbose: { type: "boolean" } }, additionalProperties: false } },
-  { name: "relay_task_update", description: "Update Task intent, steer, criteria or dispatch.", requiredScopes: ["task:write"], inputSchema: { type: "object", properties: { taskId: TASK_ID_PROP, refreshIssue: { type: "object", description: "Explicit source refresh: {expectedRevision, resolutions?: {title|intent|doneWhen|tags: source|local}}. Conflicts require resolution." }, verbose: { type: "boolean" }, title: { type: "string" }, label: { type: "string" }, intent: { type: "string" }, complexity: { type: "string", enum: TASK_DISPATCH_COMPLEXITIES }, context: { type: "string" }, latestSteer: { type: "string" }, doneWhen: { type: "string" }, terminalStage: { anyOf: [{ type: "string", enum: TASK_TERMINAL_STAGES }, { type: "null" }] }, dispatch: DISPATCH_SHAPE_SCHEMA, teamId: { type: "string" }, projectId: { type: "string" }, repo: { type: "string" } }, required: ["taskId"], additionalProperties: false } },
+  { name: "relay_task_list", description: "List your Tasks by default; mine:false lists all. mode:brief is id/label/status; lean is default.", requiredScopes: ["task:read"], inputSchema: { type: "object", properties: { status: { enum: DELIVERABLE_STATUS_ENUM }, deliverableStage: { enum: [...TASK_DELIVERABLE_STAGES, "awaiting-deploy"] }, teamId: { type: "string" }, projectId: { type: "string" }, repo: { type: "string" }, mine: { type: "boolean" }, inFlight: { type: "boolean" }, staleOwnerGone: { type: "boolean" }, limit: { type: "integer", minimum: 1, maximum: 500 }, mode: { type: "string", enum: ["brief", "lean", "full"] }, verbose: { type: "boolean" } }, additionalProperties: false } },
+  { name: "relay_task_update", description: "Update Task intent, steer, criteria or dispatch.", requiredScopes: ["task:write"], inputSchema: { type: "object", properties: { taskId: TASK_ID_PROP, refreshIssue: { type: "object", description: "{expectedRevision, resolutions?: {title|intent|doneWhen|tags: source|local}}." }, verbose: { type: "boolean" }, title: { type: "string" }, label: { type: "string" }, intent: { type: "string" }, complexity: { type: "string", enum: TASK_DISPATCH_COMPLEXITIES }, context: { type: "string" }, latestSteer: { type: "string" }, onDeploy: { type: "string" }, doneWhen: { type: "string" }, terminalStage: { enum: [...TASK_TERMINAL_STAGES, null] }, dispatch: DISPATCH_SHAPE_SCHEMA, teamId: { type: "string" }, projectId: { type: "string" }, repo: { type: "string" }, paths: { type: "array", items: { type: "string" } } }, required: ["taskId"], additionalProperties: false } },
   { name: "relay_task_set_status", description: "Transition Task execution status. done requires met validation; force requires explicit override authority.", requiredScopes: ["task:write"], inputSchema: { type: "object", properties: { taskId: TASK_ID_PROP, status: { type: "string", enum: DELIVERABLE_STATUS_ENUM }, force: { type: "boolean" }, blockedBy: { type: "array", items: BLOCKER_SCHEMA }, note: { type: "string" }, verbose: { type: "boolean" } }, required: ["taskId", "status"], additionalProperties: false } },
   { name: "relay_task_set_stage", description: "Set Task delivery stage/branch/commit; normally maintained by the land/deploy pipeline.", requiredScopes: ["task:write"], inputSchema: { type: "object", properties: { taskId: TASK_ID_PROP, deliverableStage: { type: "string", enum: TASK_DELIVERABLE_STAGES }, branch: { type: "string" }, commit: COMMIT_SCHEMA }, required: ["taskId", "deliverableStage"], additionalProperties: false } },
   { name: "relay_task_confirm_carry", description: "Confirm a protected-tip revert's delivered change was carried to current main; clears only carry-pending.", requiredScopes: ["task:write"], inputSchema: { type: "object", properties: { taskId: TASK_ID_PROP, commit: COMMIT_SCHEMA, branch: { type: "string" }, note: { type: "string" } }, required: ["taskId"], additionalProperties: false } },
@@ -175,6 +177,7 @@ export async function relayTaskTool(auth: McpAuthLike, name: string, args: Recor
       complexity: optionalEnum(args.complexity, "complexity", TASK_DISPATCH_COMPLEXITIES),
       context: cleanString(args.context, "context", { max: 1_000_000 }),
       terminalStage: optionalEnum(args.terminalStage, "terminalStage", TASK_TERMINAL_STAGES),
+      onDeploy: cleanString(args.onDeploy, "onDeploy", { max: 500 }),
       doneWhen: cleanString(args.doneWhen, "doneWhen", { max: 1_000_000 }),
       teamId: cleanString(args.teamId, "teamId", { max: 200 }),
       projectId: cleanString(args.projectId, "projectId", { max: 120 }),
@@ -182,6 +185,7 @@ export async function relayTaskTool(auth: McpAuthLike, name: string, args: Recor
       branch: cleanString(args.branch, "branch", { max: 500 }),
       dispatch: args.dispatch as TaskDispatch | undefined,
       tags: args.tags as string[] | undefined,
+      paths: args.paths as string[] | undefined,
       // Alias-tolerant (#2214): a ref passed as `refs`/`issues`/`externalKey`/… used to be dropped
       // silently, leaving the Task's issues[] empty and its spawn brief without the linked spec.
       issueRefs: issueRefsFromArgs(args),
@@ -218,7 +222,7 @@ export async function relayTaskTool(auth: McpAuthLike, name: string, args: Recor
   if (name === "relay_task_list") {
     const tasks = await listTaskEntitySummariesAsync({
       status: optionalEnum(args.status, "status", DELIVERABLE_STATUS_ENUM),
-      deliverableStage: optionalEnum(args.deliverableStage, "deliverableStage", TASK_DELIVERABLE_STAGES),
+      deliverableStage: optionalEnum(args.deliverableStage, "deliverableStage", [...TASK_DELIVERABLE_STAGES, "awaiting-deploy"] as const),
       teamId: cleanString(args.teamId, "teamId", { max: 200 }),
       projectId: cleanString(args.projectId, "projectId", { max: 120 }),
       repo: cleanString(args.repo, "repo", { max: 500 }),
@@ -246,12 +250,14 @@ export async function relayTaskTool(auth: McpAuthLike, name: string, args: Recor
       ...(args.complexity !== undefined ? { complexity: optionalEnum(args.complexity, "complexity", TASK_DISPATCH_COMPLEXITIES) } : {}),
       ...(args.context !== undefined ? { context: cleanString(args.context, "context", { max: 1_000_000 }) ?? "" } : {}),
       ...(args.latestSteer !== undefined ? { latestSteer: cleanString(args.latestSteer, "latestSteer", { max: 1_000_000 }) ?? "" } : {}),
+      ...(args.onDeploy !== undefined ? { onDeploy: cleanString(args.onDeploy, "onDeploy", { max: 500 }) ?? "" } : {}),
       ...(args.doneWhen !== undefined ? { doneWhen: cleanString(args.doneWhen, "doneWhen", { max: 1_000_000 }) ?? "" } : {}),
       ...(args.terminalStage !== undefined ? { terminalStage: args.terminalStage === null ? null : optionalEnum(args.terminalStage, "terminalStage", TASK_TERMINAL_STAGES) } : {}),
       ...(args.dispatch !== undefined ? { dispatch: args.dispatch as TaskDispatch } : {}),
       ...(args.teamId !== undefined ? { teamId: cleanString(args.teamId, "teamId", { max: 200 }) ?? "" } : {}),
       ...(args.projectId !== undefined ? { projectId: cleanString(args.projectId, "projectId", { max: 120 }) ?? "" } : {}),
       ...(args.repo !== undefined ? { repo: cleanString(args.repo, "repo", { max: 500 }) ?? "" } : {}),
+      ...(args.paths !== undefined ? { paths: args.paths as string[] | null } : {}),
     };
     const task = await updateTaskEntityAsync(taskIdArg(args.taskId), { ...patch, actor });
     if (args.verbose === true) return task as unknown as Record<string, unknown>;

package/src/mcp-team-template-tools.ts

@@ -2,7 +2,7 @@ import { INCLUDED_TOOL_SCOPE_NEEDS } from "./mcp/tool-groups";
 import { APPROVAL_MODES, SPAWN_PROVIDERS, VALID_AGENT_LIFECYCLES, VALID_WORKSPACE_MODES } from "@humwick/sdk";
 import { McpAuthError } from "./mcp-errors";
 import { authContextFromMcp } from "./services/auth-context";
-import { deleteTeamTemplate, getTeamTemplate, instantiateTeamTemplate, listTeamTemplates, saveTeamTemplate } from "./services/team-templates";
+import { deleteTeamTemplateAsync, getTeamTemplate, instantiateTeamTemplate, listTeamTemplates, saveTeamTemplateAsync } from "./services/team-templates";
 import { summarizeSpawnCommandForCaller } from "./services/spawn-agent";
 import { ValidationError } from "./db";
 
@@ -111,7 +111,7 @@ function slugArg(args: Record<string, unknown>): string {
 export async function relayTeamTemplateTool(auth: McpAuthLike, name: string, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   if (name === "relay_team_template_save") {
     requireScope(auth, "teams:write");
-    return saveTeamTemplate(args, auth.actor) as unknown as Record<string, unknown>;
+    return await saveTeamTemplateAsync(args, auth.actor) as unknown as Record<string, unknown>;
   }
   if (name === "relay_team_template_list") return { templates: listTeamTemplates() };
   if (name === "relay_team_template_get") {
@@ -121,7 +121,7 @@ export async function relayTeamTemplateTool(auth: McpAuthLike, name: string, arg
   }
   if (name === "relay_team_template_delete") {
     requireScope(auth, "teams:write");
-    return { slug: slugArg(args), deleted: deleteTeamTemplate(slugArg(args), auth.actor) };
+    return { slug: slugArg(args), deleted: await deleteTeamTemplateAsync(slugArg(args), auth.actor) };
   }
   if (name === "relay_team_spawn_from_template") {
     requireScope(auth, "teams:write");

package/src/mcp-workflow-tools.ts

@@ -5,7 +5,7 @@ import { McpAuthError } from "./mcp-errors";
 import { ValidationError } from "./db";
 import { authContextFromMcp } from "./services/auth-context";
 import { ServiceAuthError } from "./services/errors";
-import { cancelWorkflowRun, getWorkflowRun, resumeWorkflowRun, startWorkflowRun } from "./services/workflow-runs";
+import { cancelWorkflowRun, getWorkflowRun, pauseWorkflowRun, resumeWorkflowRun, startWorkflowRun } from "./services/workflow-runs";
 import { parseWorkflowPins } from "./services/workflow-pins";
 import { cleanString, taskIdField } from "./validation";
 
@@ -48,7 +48,7 @@ export const WORKFLOW_TOOLS = [
   {
     name: "relay_workflow_resume",
     description:
-      "Resume or answer/escalate a decision.",
+      "Resume, pause/unpause, or answer/escalate a decision.",
     requiredScopes: ["task:write"],
     inputSchema: {
       type: "object",
@@ -66,6 +66,7 @@ export const WORKFLOW_TOOLS = [
         activationId: { type: "string" },
         step: { type: "string" },
         note: { type: "string" },
+        pause: { type: "boolean" },
         pins: PINS_PROP,
       },
       required: ["runId"],
@@ -112,7 +113,7 @@ type McpAuthLike = Parameters<typeof authContextFromMcp>[0];
 
 function mutationReceipt(full: Record<string, unknown>, verbose: unknown): Record<string, unknown> {
   if (verbose === true) return full;
-  const fields = ["runId", "taskId", "workflow", "status", "step", "round", "callerAgentId", "budget", "existing", "resumed", "cancelled", "reason", "warnings"];
+  const fields = ["runId", "taskId", "workflow", "status", "step", "round", "callerAgentId", "budget", "existing", "resumed", "cancelled", "paused", "reason", "warnings"];
   return Object.fromEntries(fields.filter(key => full[key] !== undefined).map(key => [key, full[key]]));
 }
 
@@ -132,6 +133,12 @@ export async function relayWorkflowTool(auth: McpAuthLike, name: string, args: R
       if (!runId) throw new ValidationError("runId is required");
       const step = cleanString(args.step, "step", { max: 64 });
       const note = cleanString(args.note, "note", { max: 8000 });
+      if (args.pause !== undefined) {
+        // #3757 — pause (note is the required reason) or unpause; nothing else rides along.
+        if (typeof args.pause !== "boolean") throw new ValidationError("pause must be a boolean");
+        if (step || args.pins !== undefined || args.decision !== undefined || args.activationId !== undefined) throw new ValidationError("pause takes only runId and, to pause, note as the reason");
+        return mutationReceipt(await pauseWorkflowRun({ runId, pause: args.pause, ...(note ? { reason: note } : {}) }, ctx), args.verbose);
+      }
       const pins = parseWorkflowPins(args.pins);
       return mutationReceipt(await resumeWorkflowRun({ runId, decision: parseWorkflowDecisionResponse(args.decision), activationId: cleanString(args.activationId, "activationId", { max: 2000 }), ...(step ? { step } : {}), ...(note ? { note } : {}), ...(pins ? { pins } : {}) }, ctx), args.verbose);
     }

package/src/notification-types.ts

@@ -97,7 +97,8 @@ export type NotificationType =
   | "ci.config_mismatch"
   | "ci.root_missing"
   // #1645 — a critical maintenance job is not running (disabled, held indefinitely, a lapsed pause
-  // nobody resumed, or simply silent past several of its own intervals).
+  // nobody resumed, or simply silent past several of its own intervals). Also carries host disk
+  // alerts (#3762) — a new type would grow three MCP tool schemas past their pinned budgets.
   | "maintenance.degraded";
 
 /**

package/src/operator-alarm.ts

@@ -1,4 +1,5 @@
 import { createActivityEventWithResult } from "./db";
+import { createActivityEventByClientIdAsync } from "./db/activity-async";
 import { emitRelayEvent } from "./events";
 
 export interface OperatorAlarmInput {
@@ -20,22 +21,36 @@ export interface OperatorAlarmInput {
 // done. This raises a distinct `operator.alarm` relay event (dashboard banner) plus a
 // persisted `operator`-kind activity event, so a relay with no reachable escalation target
 // is observable instead of looping forever in the dark.
-export function raiseOperatorAlarm(input: OperatorAlarmInput): boolean {
-  const { created } = createActivityEventWithResult({
-    clientId: input.clientId,
-    kind: "operator",
-    title: input.subject,
-    body: input.detail,
-    icon: "ti-alert-octagon",
-    view: input.view ?? "orchestrators",
-    metadata: { source: input.source, operatorAlarm: true, ...(input.metadata ?? {}) },
-  });
-  if (input.dedupeEvent && !created) return false;
+const alarmEvent = (input: OperatorAlarmInput) => ({
+  clientId: input.clientId,
+  kind: "operator" as const,
+  title: input.subject,
+  body: input.detail,
+  icon: "ti-alert-octagon",
+  view: input.view ?? "orchestrators",
+  metadata: { source: input.source, operatorAlarm: true, ...(input.metadata ?? {}) },
+});
+
+function emitAlarm(input: OperatorAlarmInput): void {
   emitRelayEvent({
     type: "operator.alarm",
     source: input.source,
     subject: input.subject,
     data: { subject: input.subject, detail: input.detail, ...(input.metadata ?? {}) },
   });
+}
+
+export function raiseOperatorAlarm(input: OperatorAlarmInput): boolean {
+  const { created } = createActivityEventWithResult(alarmEvent(input));
+  if (input.dedupeEvent && !created) return false;
+  emitAlarm(input);
+  return true;
+}
+
+/** Same as `raiseOperatorAlarm`, with the activity row written on the writer thread. */
+export async function raiseOperatorAlarmAsync(input: OperatorAlarmInput): Promise<boolean> {
+  const { created } = await createActivityEventByClientIdAsync(alarmEvent(input));
+  if (input.dedupeEvent && !created) return false;
+  emitAlarm(input);
   return true;
 }

package/src/project-instructions.ts

@@ -2,6 +2,7 @@ import { composeMemoryPreambleAsync } from "./memory-preamble-async";
 import { composeHostAwareness } from "./host-awareness";
 import { composeGuideIndex } from "./guides";
 import { profileInstructionBlocks } from "./profile-instruction-blocks";
+import { projectProfileInstructionBlock } from "./project-profile-instructions";
 // Spawn-time instruction sources (#557) — the relay-owned composer that assembles what a spawned
 // agent's systemPromptAppend says, from declared sources only, never from host CLAUDE.md.
 //
@@ -283,6 +284,7 @@ export function composeSpawnInstructionsWithEvents(input: {
    * host → project`, audience-filtered by `profile`). Absent → no memory block at all, so a
    * caller that does not know the identity produces a byte-identical pre-#1565 spawn. */
   memoryIdentity?: MemoryIdentity;
+  projectId?: string;
   profile?: Pick<AgentProfile, "instructions" | "maxSpawnedAgents" | "hostAwareness" | "roleAssets"> & { name?: string; relay?: AgentProfile["relay"] };
   spawnedBy?: string;
   /** #3045 — a workflow step agent: its step reporting block replaces the spawned-child report-up. */
@@ -475,6 +477,8 @@ export function composeSpawnInstructionsWithEvents(input: {
   const { system: profileSystem, append: profileAppend } = profileInstructionBlocks(input.profile, input.memoryIdentity?.provider);
   if (profileSystem) appendBlocks.push(profileSystem);
   appendBlocks.push(...profileAppend);
+  const projectProfile = projectProfileInstructionBlock(input.projectId ?? input.memoryIdentity?.projectId, input.profile?.name ?? input.memoryIdentity?.profile);
+  if (projectProfile) { appendBlocks.push(projectProfile.content); relayInjectionEvents.push(projectProfile.event); }
   // After the profile, so the step rule is the last word over a charter's report-to-spawner text.
   if (input.workflowRunId) {
     const instruction = renderTemplate("spawn.reportup.workflow-step", { runId: input.workflowRunId });

package/src/project-profile-instruction-text.ts

@@ -0,0 +1,6 @@
+import { assertNoControlBytes, ValidationError } from "@humwick/sdk";
+
+export function validateProjectProfileInstructionText(value: unknown, source: string): asserts value is string {
+  if (typeof value !== "string" || value.length > 16_000) throw new ValidationError(`${source} must be a string up to 16000 characters`);
+  assertNoControlBytes(value, source);
+}

package/src/project-profile-instructions.ts

@@ -0,0 +1,20 @@
+import { errMessage } from "@humwick/sdk";
+import { getProjectProfileInstructions } from "./db/project-profile-instructions";
+import { validateProjectProfileInstructionText } from "./project-profile-instruction-text";
+
+/** #3515 — one optional block at the charter seam, independent of project memory's switch. */
+export function projectProfileInstructionBlock(projectId: string | undefined, profile: string | undefined) {
+  if (!projectId || !profile) return;
+  const source = `project ${projectId} profile ${profile} instructions`;
+  try {
+    const entry = getProjectProfileInstructions({ projectId, profile });
+    validateProjectProfileInstructionText(entry.template, source);
+    const content = entry.template.trim();
+    if (!content) return;
+    return { content, event: { category: "instructions" as const,
+      summary: `injected ${source} v${entry.version}`,
+      detail: { source: "project-profile-instructions", projectId, profile, version: entry.version, content } } };
+  } catch (error) {
+    console.warn(`[launch] skipped ${source}: ${errMessage(error)}`);
+  }
+}

package/src/provider-catalog-store.ts

@@ -1,7 +1,7 @@
 import {
   deriveProviderDisabledState,
   disabledProviderSet,
-  providerCatalogList,
+  providerMetadataList,
   type ProviderCatalogEntry,
   type ProviderContextThreshold,
   type ProviderEnablementSetting,
@@ -44,7 +44,7 @@ export interface ProviderModelOverrideInput {
 
 function listProviderModelOverrides(): ProviderModelOverride[] {
   const rows = getDb()
-    .query("SELECT * FROM provider_model_overrides ORDER BY provider ASC, alias ASC")
+    .query("SELECT * FROM provider_model_overrides ORDER BY provider ASC, rowid ASC")
     .all() as ProviderModelOverrideRow[];
   return rows.map(rowToOverride).filter((entry): entry is ProviderModelOverride => Boolean(entry));
 }
@@ -120,7 +120,7 @@ export function setProviderDefaultModel(provider: SpawnProvider, alias: string,
 }
 
 export function effectiveProviderCatalogList(now = Date.now()): ProviderCatalogEntry[] {
-  const catalog = mergeProviderCatalog(providerCatalogList(), listProviderModelOverrides());
+  const catalog = mergeProviderCatalog(providerMetadataList(), listProviderModelOverrides());
   const defaults = getDb().query("SELECT provider, alias FROM provider_model_defaults").all() as Array<{ provider: string; alias: string }>;
   for (const { provider, alias } of defaults) {
     const entry = catalog.find((item) => item.provider === provider);
@@ -215,9 +215,6 @@ function normalizeOverrideInput(input: ProviderModelOverrideInput): ProviderMode
   if (limits) entry.limits = limits;
   else delete entry.limits;
   delete entry.disabled;
-  // #368 — unavailable is a static catalog fact (provider-side suspension), not an operator toggle;
-  // strip it from DB overrides so an admin can't accidentally clear a catalog-level suspension.
-  delete entry.unavailable;
   // #2598 — `deleted` is a row-level tombstone column, never part of a stored entry blob.
   delete (entry as unknown as Record<string, unknown>).deleted;
   return {
@@ -288,49 +285,6 @@ function allowlistedLimitConfidence(value: unknown): ProviderModelLimitWindow["c
     : "declared";
 }
 
-/**
- * #2598 — additive, idempotent backfill of every static-catalog model into `provider_model_overrides`,
- * so the whole catalogue is uniformly DB-backed and operator-editable. Rules:
- *   - INSERT-ONLY-IF-ABSENT (`ON CONFLICT DO NOTHING`): an existing row — a prior seed OR an operator
- *     edit OR an operator delete-tombstone — is never touched, so operator edits ALWAYS win and a
- *     deleted static model is never resurrected. Re-runnable; a re-run inserts only genuinely NEW
- *     static models (e.g. added by a later release).
- *   - SKIP disabled/unavailable static models: materializing them would strip those flags at the
- *     write chokepoint (#368/#643) and resurrect a suspended model as spawnable. They stay
- *     static-only until an operator explicitly adds them.
- * Stamped `updated_by = <stamp>` (e.g. `seed:<version>`) purely for provenance; precedence is decided
- * by row EXISTENCE, not by parsing the stamp.
- */
-export function seedProviderModelOverrides(stamp: string, now = Date.now()): { inserted: number } {
-  const db = getDb();
-  const existing = new Map<string, Set<string>>();
-  for (const row of db.query("SELECT provider, alias FROM provider_model_overrides").all() as Array<{ provider: string; alias: string }>) {
-    let aliases = existing.get(row.provider);
-    if (!aliases) existing.set(row.provider, (aliases = new Set()));
-    aliases.add(row.alias);
-  }
-  let inserted = 0;
-  const insert = db.query(`
-    INSERT INTO provider_model_overrides (provider, alias, entry, deleted, disabled, updated_at, updated_by)
-    VALUES (?, ?, ?, 0, 0, ?, ?)
-    ON CONFLICT(provider, alias) DO NOTHING
-  `);
-  const seed = db.transaction(() => {
-    for (const providerEntry of providerCatalogList()) {
-      const seen = existing.get(providerEntry.provider);
-      for (const model of providerEntry.models) {
-        if (model.disabled || model.unavailable) continue;
-        if (seen?.has(model.alias)) continue;
-        const normalized = normalizeOverrideInput({ provider: providerEntry.provider, alias: model.alias, entry: model, updatedBy: stamp });
-        const result = insert.run(normalized.provider, normalized.alias, JSON.stringify(normalized.entry), now, normalized.updatedBy ?? null);
-        if (result.changes > 0) inserted++;
-      }
-    }
-  });
-  seed();
-  return { inserted };
-}
-
 function rowToOverride(row: ProviderModelOverrideRow): ProviderModelOverride | undefined {
   const parsed = parseJson<ProviderModelCatalogEntry | undefined>(row.entry, undefined);
   if (!parsed || typeof parsed.alias !== "string") return undefined;