@humwick/server 0.130.1 → 0.130.2

package/src/routes/workflows.ts

@@ -1,7 +1,7 @@
 import { parseWorkflowDecisionResponse } from "../services/workflow-decisions";
 // #3076 — the dashboard's workflow run reads: the run list (by status and project), one run, the stats
 // window and the workflows that ran, all from the workflow run records relay_workflow_get reads, with its visibility rule.
-// #3120 — the catalog. #3166 — cancel a run, as relay_workflow_cancel does.
+// #3120 — the catalog. #3166 — cancel a run, as relay_workflow_cancel does. #3757 — pause and unpause one.
 import { OpError } from "@humwick/kernel";
 import { isRecord, WORKFLOW_STATS_WINDOWS, type WorkflowStatsWindow } from "@humwick/sdk";
 import { resolveProjectAsync, ValidationError } from "../db";
@@ -10,7 +10,7 @@ import { authContextFromRequest } from "../services/auth-context";
 import { ServiceAuthError } from "../services/errors";
 import { readWorkflowCatalog } from "../services/workflow-catalog";
 import { requireSpawnBudget } from "../spawn-budget";
-import { amendWorkflowRunBudget, cancelWorkflowRun, getWorkflowRun, readWorkflowRunBudget, listWorkflowRuns, resumeWorkflowRun, startWorkflowRun } from "../services/workflow-runs";
+import { amendWorkflowRunBudget, cancelWorkflowRun, getWorkflowRun, pauseWorkflowRun, readWorkflowRunBudget, listWorkflowRuns, resumeWorkflowRun, startWorkflowRun } from "../services/workflow-runs";
 import { workflowDefinitions, workflowStats } from "../services/workflow-stats";
 import { cleanString, taskIdField } from "../validation";
 import { error, json, parseBody, type Handler } from "./_shared";
@@ -83,7 +83,22 @@ export const postWorkflowRunCancelRoute: Handler = async (req, params) => {
   }
 };
 
-function budgetRouteError(e: unknown): Response {
+/** #3757 — pause (a `reason` is required) or unpause a run, as relay_workflow_resume's `pause` does; the dashboard's buttons use these. */
+function workflowRunPauseRoute(pause: boolean): Handler {
+  return async (req, params) => {
+    const parsed = await parseBody<unknown>(req);
+    if (!parsed.ok) return error(parsed.error, parsed.status);
+    if (parsed.body !== null && !isRecord(parsed.body)) return error("body must be a JSON object", 400);
+    try {
+      const reason = cleanString(parsed.body?.reason, "reason", { max: 2000 });
+      return json(await pauseWorkflowRun({ runId: params.runId!, pause, ...(reason ? { reason } : {}) }, authContextFromRequest(req)));
+    } catch (e) { return runRouteError(e); }
+  };
+}
+export const postWorkflowRunPauseRoute = workflowRunPauseRoute(true);
+export const postWorkflowRunUnpauseRoute = workflowRunPauseRoute(false);
+
+function runRouteError(e: unknown): Response {
   if (e instanceof McpNotFoundError) return error(e.message, 404);
   if (e instanceof ServiceAuthError) return error(e.message, 403);
   if (e instanceof ValidationError) return error(e.message, 400);
@@ -91,7 +106,7 @@ function budgetRouteError(e: unknown): Response {
 }
 
 export const getWorkflowRunBudgetRoute: Handler = async (req, params) => {
-  try { return json(await readWorkflowRunBudget(params.runId!, authContextFromRequest(req))); } catch (e) { return budgetRouteError(e); }
+  try { return json(await readWorkflowRunBudget(params.runId!, authContextFromRequest(req))); } catch (e) { return runRouteError(e); }
 };
 
 export const patchWorkflowRunBudgetRoute: Handler = async (req, params) => {
@@ -100,7 +115,7 @@ export const patchWorkflowRunBudgetRoute: Handler = async (req, params) => {
   try {
     const { tokenCap } = requireSpawnBudget(parsed.body);
     return json(await amendWorkflowRunBudget({ runId: params.runId!, tokenCap }, authContextFromRequest(req)));
-  } catch (e) { return budgetRouteError(e); }
+  } catch (e) { return runRouteError(e); }
 };
 
 export const postWorkflowRunResumeRoute: Handler = async (req, params) => {

package/src/routing-policy-normalize.ts

@@ -1,5 +1,4 @@
 import { ValidationError } from "@humwick/sdk";
-import { currentDispatchModels } from "./routing-model-aliases";
 import { normalizeStepRoutingDefaults } from "./routing-step-defaults";
 import {
   isRecord,
@@ -199,7 +198,7 @@ export function normalizeDispatchPolicy(raw: unknown): DispatchPolicy {
  */
 /** Pure projection used by reader-gateway callers that already captured the policy snapshot. */
 export function dispatchPolicyFor(policy: RoutingPolicy): DispatchPolicy {
-  return policy.dispatch ? currentDispatchModels(policy.dispatch) : DEFAULT_DISPATCH_POLICY;
+  return policy.dispatch ?? DEFAULT_DISPATCH_POLICY;
 }
 
 const MAX_RULES = 100;

package/src/routing-step-defaults.ts

@@ -1,5 +1,4 @@
 import { cleanString, isRecord, isSpawnProvider, ValidationError, type StepRoutingDefaults, type StepRoutingTarget } from "@humwick/sdk";
-import { VALID_EFFORTS } from "@humwick/sdk/provider-catalog";
 import { WORKFLOW_PIN_FIELDS } from "@humwick/kernel/workflow-definition";
 
 export function normalizeStepRoutingDefaults(raw: unknown): StepRoutingDefaults {
@@ -25,7 +24,6 @@ function normalizeRoles(raw: unknown, where: string): Record<string, StepRouting
     for (const key of Object.keys(target)) if (!(WORKFLOW_PIN_FIELDS as readonly string[]).includes(key)) throw new ValidationError(`${where}.${role}.${key} is not a routing field`);
     const fields = Object.fromEntries(Object.entries(target).map(([key, value]) => [key, cleanString(value, `${where}.${role}.${key}`, { required: true, max: 200 })]));
     if (fields.provider !== undefined && !isSpawnProvider(fields.provider)) throw new ValidationError(`${where}.${role}.provider is not a provider`);
-    if (fields.effort !== undefined && !(VALID_EFFORTS as readonly string[]).includes(fields.effort)) throw new ValidationError(`${where}.${role}.effort must be ${VALID_EFFORTS.join(", ")}`);
     return [role, fields as StepRoutingTarget];
   }));
 }

package/src/runner-token-mint-limit.ts

@@ -0,0 +1,63 @@
+// #3775 — per-subject cap on runner token successor mints (renew, orchestrator re-mint, boundary
+// re-derive). A runner stuck re-minting after 401 minted 700-1,400 tokens/min and overloaded the
+// hub writer; this refuses the excess before any token row is written. A spawn subject
+// (`runner:spawn:<id>`) keeps one subject across its whole token lineage, so it is the key. Only a
+// real mint is charged: a replayed handoff (retry or concurrent caller) writes nothing.
+
+/** At most this many new tokens per subject in any rolling window. */
+export const RUNNER_TOKEN_MINTS_PER_WINDOW = 3;
+export const RUNNER_TOKEN_MINT_WINDOW_MS = 60_000;
+const MAX_TRACKED_SUBJECTS = 10_000;
+
+export class RunnerTokenMintLimit {
+  /** Recent mint times per subject, oldest first, at most RUNNER_TOKEN_MINTS_PER_WINDOW long. */
+  private readonly mints = new Map<string, number[]>();
+  /** Subjects currently refused, so a trip logs once rather than once per refused mint. */
+  private readonly tripped = new Set<string>();
+  private readonly now: () => number;
+  private readonly log: (message: string) => void;
+
+  constructor(options: { now?: () => number; log?: (message: string) => void } = {}) {
+    this.now = options.now ?? Date.now;
+    this.log = options.log ?? console.warn;
+  }
+
+  /** Seconds `sub` must wait before its next mint, or undefined when it may mint now. Charges nothing. */
+  refusal(sub: string): number | undefined {
+    const recent = this.recent(sub);
+    if (recent.length < RUNNER_TOKEN_MINTS_PER_WINDOW) {
+      this.tripped.delete(sub);
+      return undefined;
+    }
+    if (!this.tripped.has(sub)) {
+      if (this.tripped.size >= MAX_TRACKED_SUBJECTS) this.tripped.clear();
+      this.tripped.add(sub);
+      this.log(`[token-mint] rate limit tripped for ${sub}: ${RUNNER_TOKEN_MINTS_PER_WINDOW} tokens minted in the last ${RUNNER_TOKEN_MINT_WINDOW_MS / 1000}s; refusing until the window frees`);
+    }
+    return Math.max(1, Math.ceil((recent[0]! + RUNNER_TOKEN_MINT_WINDOW_MS - this.now()) / 1000));
+  }
+
+  /** Record one new token minted for `sub`. */
+  charge(sub: string): void {
+    const recent = this.recent(sub);
+    if (!this.mints.has(sub) && this.mints.size >= MAX_TRACKED_SUBJECTS) this.mints.delete(this.mints.keys().next().value!);
+    recent.push(this.now());
+    if (recent.length > RUNNER_TOKEN_MINTS_PER_WINDOW) recent.shift();
+    this.mints.set(sub, recent);
+  }
+
+  reset(): void {
+    this.mints.clear();
+    this.tripped.clear();
+  }
+
+  private recent(sub: string): number[] {
+    const since = this.now() - RUNNER_TOKEN_MINT_WINDOW_MS;
+    const recent = (this.mints.get(sub) ?? []).filter((at) => at > since);
+    if (recent.length) this.mints.set(sub, recent);
+    else this.mints.delete(sub);
+    return recent;
+  }
+}
+
+export const runnerTokenMintLimit = new RunnerTokenMintLimit();

package/src/runtime-grant.ts

@@ -24,7 +24,9 @@ const SPAWN_SCOPES = ["command:spawn", "command:shutdown"] as const;
 const FLEET_OPS_PROFILES = new Set(["coordinator", "ops-assistant"]);
 // #1925 H10 — fleet visibility is coordinator-facing. Keep this a fixed trusted-profile allowlist,
 // like command:fleet, rather than a user-editable profile setting that could widen worker tokens.
-const HOST_READ_PROFILES = new Set(["coordinator"]);
+const HOST_WRITE_PROFILES = new Set(["coordinator"]);
+// #3772 — the reboot runbook reads resource_control held/waiter counts from /api/hosts; ops profiles read, never write.
+const HOST_READ_PROFILES = new Set([...HOST_WRITE_PROFILES, "ops-assistant", "sec-ops"]);
 // #3073 — coordinator-only groups (not in WORKER_TOOL_GROUPS) a coordinator always gets, even when its stored override predates them.
 const COORDINATOR_ONLY_TOOL_GROUPS = ["decisions", "workflows", "project", "routing"] as const;
 // #3327 — the coordinator edits routing preferences, like Edin in the dashboard.
@@ -109,7 +111,7 @@ export function deriveRunnerGrant(profile: string | undefined, authority: Deriva
     ...nonTrustedBaseline(agentInitiated),
     ...(fleetOps ? [FLEET_SCOPE] : []),
     ...(hostsRead ? ["hosts:read"] : []),
-    ...(!agentInitiated && Boolean(profile && HOST_READ_PROFILES.has(profile)) && callerMayMintHostsScope(callerScopes, "hosts:write") ? ["hosts:write"] : []),
+    ...(!agentInitiated && Boolean(profile && HOST_WRITE_PROFILES.has(profile)) && callerMayMintHostsScope(callerScopes, "hosts:write") ? ["hosts:write"] : []),
     ...(grantsSecretsScope(profile, toolGroups, callerScopes) ? [SECRETS_WRITE_SCOPE] : []),
     ...(!agentInitiated && (COORDINATOR_PROFILE_NAMES as readonly string[]).includes(profile ?? "") && (callerScopes === undefined || hasScope(callerScopes, ROUTING_WRITE_SCOPE)) ? [ROUTING_WRITE_SCOPE] : []),
     ...(grant.canSpawn ? SPAWN_SCOPES.filter(scope => !agentInitiated || callerScopes === undefined || hasScope(callerScopes, scope)) : []),

package/src/runtime-tokens.ts

@@ -2,8 +2,9 @@ import { registryToolName } from "@humwick/sdk";
 import { writeChildEnv } from "@humwick/sdk/env";
 import { deriveRunnerGrant, successorGrant } from "./runtime-grant";
 export { runnerSpawnGrantForAgent } from "./runtime-grant";
-import { TOKEN_RECOVERY_WINDOW_SECONDS, createToken, getToken, getTokenProfile, type CreateTokenInput } from "./token-db";
-import { createTokenAsync, handoffTokenAsync } from "./token-db-write";
+import { TOKEN_RECOVERY_WINDOW_SECONDS, createToken, getToken, getTokenProfile, type CreateTokenInput, type HandoffTokenInput, type TokenHandoff } from "./token-db";
+import { runnerTokenMintLimit } from "./runner-token-mint-limit";
+import { createRunnerTokenAsync, createTokenAsync, handoffTokenAsync } from "./token-db-write";
 import { FLEET_SCOPE, verifyComponentTokenAllowExpired } from "./security";
 import { getAgentProfile, hostPinForProfile, spawnGrantForProfile, toolGroupsForProfile } from "./config-store";
 import { toolAllowlistForRunner } from "./mcp-tool-allowlist";
@@ -38,6 +39,22 @@ interface RuntimeTokenResult {
   record: TokenRecord;
 }
 
+/** A refused successor mint; `retryAfterSeconds` marks a per-subject rate limit (HTTP 429). */
+export type RunnerTokenMintRefusal = { error: string; retryAfterSeconds?: number };
+
+/** #3775 — the one way a runner token's successor is minted: within the subject's mint limit, charged per new token. */
+export async function handoffRunnerTokenAsync(sub: string, input: HandoffTokenInput): Promise<TokenHandoff | null | { retryAfterSeconds: number }> {
+  const retryAfterSeconds = runnerTokenMintLimit.refusal(sub);
+  if (retryAfterSeconds !== undefined) return { retryAfterSeconds };
+  const handoff = await handoffTokenAsync(input);
+  if (handoff && !handoff.replayed) runnerTokenMintLimit.charge(sub);
+  return handoff;
+}
+
+function mintRateLimited(handoff: object | null): handoff is { retryAfterSeconds: number } {
+  return handoff !== null && "retryAfterSeconds" in handoff;
+}
+
 function runnerTokenOwnedByOrchestratorHost(
   constraints: NonNullable<ReturnType<typeof verifyComponentTokenAllowExpired>>["constraints"],
   orchestratorId: string,
@@ -68,7 +85,7 @@ export async function reissueRunnerRuntimeToken(input: {
   expiredToken: string;
   orchestratorId: string;
   createdBy?: string;
-}): Promise<RuntimeTokenResult | { error: string }> {
+}): Promise<RuntimeTokenResult | RunnerTokenMintRefusal> {
   const payload = verifyComponentTokenAllowExpired(input.expiredToken, { allowStaleRevoked: true });
   // #3133 — recovery hands off from the token's record, which holds its standing; a token without one recovers nothing.
   if (!payload?.jti) return { error: "invalid or revoked runner token" };
@@ -95,7 +112,8 @@ export async function reissueRunnerRuntimeToken(input: {
     constraints: payload.constraints,
     createdBy: input.createdBy ?? `remint:${payload.jti}`,
   };
-  const handoff = await handoffTokenAsync({ jti: payload.jti, successor, recoverExpiredWithinSeconds: TOKEN_RECOVERY_WINDOW_SECONDS, createdBy: successor.createdBy });
+  const handoff = await handoffRunnerTokenAsync(payload.sub, { jti: payload.jti, successor, recoverExpiredWithinSeconds: TOKEN_RECOVERY_WINDOW_SECONDS, createdBy: successor.createdBy });
+  if (mintRateLimited(handoff)) return { error: "runner token mint rate limited", retryAfterSeconds: handoff.retryAfterSeconds };
   return handoff ?? { error: "invalid or revoked runner token" };
 }
 
@@ -122,7 +140,7 @@ function runnerGrantKey(scope: readonly string[] | undefined, constraints: Token
  * (current profile, lineage ceiling) and the presented token's launch identity. An identical grant is left
  * alone; otherwise the token is handed off like a renewal, so a lost response is recovered by a retry.
  */
-export async function remintRunnerRuntimeToken(auth: ComponentToken, createdBy: string): Promise<RunnerTokenRemint | { unchanged: true; jti: string } | { error: string }> {
+export async function remintRunnerRuntimeToken(auth: ComponentToken, createdBy: string): Promise<RunnerTokenRemint | { unchanged: true; jti: string } | RunnerTokenMintRefusal> {
   const previous = auth.jti ? getToken(auth.jti) : null;
   const c = auth.constraints ?? {};
   const agentId = c.agents?.length === 1 ? c.agents[0] : undefined;
@@ -149,7 +167,8 @@ export async function remintRunnerRuntimeToken(auth: ComponentToken, createdBy:
   });
   if (token.constraints?.orchestrators?.includes("")) return { error: "the agent's host is unknown, so its host pin cannot be kept" };
   if (runnerGrantKey(previous.scope, previous.constraints) === runnerGrantKey(token.scope, token.constraints)) return { unchanged: true, jti: previous.jti };
-  const handoff = await handoffTokenAsync({ jti: previous.jti, allowedProfileIds: ["provider-agent"], successor: token, createdBy });
+  const handoff = await handoffRunnerTokenAsync(auth.sub, { jti: previous.jti, allowedProfileIds: ["provider-agent"], successor: token, createdBy });
+  if (mintRateLimited(handoff)) return { error: "runner token mint rate limited", retryAfterSeconds: handoff.retryAfterSeconds };
   if (!handoff) return { error: "the presented token was already rotated" };
   const { record } = handoff;
   return {
@@ -306,6 +325,7 @@ function runnerTokenSpec(input: RunnerRuntimeTokenInput): { token: CreateTokenIn
     : { kind: "root", ...(authority.kind === "delegated" ? { launcherScopes: authority.callerScopes } : {}), ...(profile ? { profile } : {}) } };
 }
 
+/** Sync twin for in-process tests; every runtime launch path mints through the writer op below. */
 export function issueRunnerRuntimeToken(input: RunnerRuntimeTokenInput): RuntimeTokenResult {
   const spec = runnerTokenSpec(input);
   const issued = createToken(spec.token);
@@ -314,6 +334,11 @@ export function issueRunnerRuntimeToken(input: RunnerRuntimeTokenInput): Runtime
   return issued;
 }
 
+export function issueRunnerRuntimeTokenAsync(input: RunnerRuntimeTokenInput): Promise<RuntimeTokenResult> {
+  const spec = runnerTokenSpec(input);
+  return createRunnerTokenAsync(spec.token, spec.launchFact ? { agentId: input.agentId, fact: spec.launchFact } : undefined);
+}
+
 export function issueInteractiveRunnerRuntimeToken(input: {
   provider: string;
   cwd: string;
@@ -393,7 +418,14 @@ export function issueIntegrationRuntimeToken(input: {
 }
 
 export function runnerRuntimeTokenEnv(input: RunnerRuntimeTokenInput): Record<string, string> {
-  const issued = issueRunnerRuntimeToken(input);
+  return runnerTokenEnv(input, issueRunnerRuntimeToken(input));
+}
+
+export async function runnerRuntimeTokenEnvAsync(input: RunnerRuntimeTokenInput): Promise<Record<string, string>> {
+  return runnerTokenEnv(input, await issueRunnerRuntimeTokenAsync(input));
+}
+
+function runnerTokenEnv(input: RunnerRuntimeTokenInput, issued: RuntimeTokenResult): Record<string, string> {
   return writeChildEnv({}, {
     AGENT_RELAY_TOKEN: issued.token,
     AGENT_RELAY_TOKEN_JTI: issued.record.jti,

package/src/security.ts

@@ -233,6 +233,8 @@ export function isOrchestratorRegistrationAuthorized(req: Request): boolean {
 }
 
 const SHARED_UI_ROUTE_SCOPES: Record<string, string> = {
+  "/api/orchestrators/bootstrap": "token:write",
+  "/api/orchestrators/bootstrap/exchange": "token:write",
   "/api/claude-api-budget/summary": "agent:read",
   "/api/claude-api-budget": "system:admin",
   "/api/stats": "stats:read",
@@ -252,6 +254,15 @@ function sharedUiRouteScope(pathname: string, method: string): string | undefine
   if (/^\/api\/api-budgets\/[^/]+\/summary$/.test(pathname)) return "agent:read";
   if (/^\/api\/api-budgets\/[^/]+$/.test(pathname)) return "system:admin";
   if (/^\/api\/shipping\/incidents\/[^/]+\/abandon$/.test(pathname)) return "command:write";
+  if (pathname === "/api/teams/config") return method === "GET" ? "teams:read" : "settings:write:teams";
+  if (pathname.startsWith("/api/teams")) return method === "GET" ? "teams:read" : "teams:write";
+  if (pathname === "/api/decisions" && method === "POST") return "teams:write"; // #2914: filing = the relay_decision scope
+  if (pathname.startsWith("/api/decisions")) return method === "GET" ? "teams:read" : "message:send"; // #2885: answering = messaging the coordinator
+  if (pathname.startsWith("/api/blackboard")) return method === "GET" ? "blackboard:read" : "blackboard:write";
+  if (pathname.startsWith("/api/issue-associations")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-activity")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-lifecycle")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-refs")) return method === "GET" ? "issue:read" : "issue:write";
   return Object.hasOwn(SHARED_UI_ROUTE_SCOPES, pathname) ? SHARED_UI_ROUTE_SCOPES[pathname] : undefined;
 }
 
@@ -266,8 +277,6 @@ export function requiredScopeFor(method: string, pathname: string): string | nul
   if (pathname === "/api/route") return "agent:read";
   if (pathname === "/api/notifications/preview") return "notifications:read";
   if (pathname === "/api/mcp") return "mcp:use";
-  if (pathname === "/api/orchestrators/bootstrap/exchange") return "token:write";
-  if (pathname === "/api/orchestrators/bootstrap") return "token:write";
   if (pathname.match(/^\/api\/orchestrators\/[^/]+\/logs\//)) return "logs:read";
   if (pathname.match(/^\/api\/orchestrators\/[^/]+\/terminal\/[^/]+\/input$/)) return "terminal:write";
   if (pathname.match(/^\/api\/orchestrators\/[^/]+\/terminal\//)) return "terminal:read";
@@ -323,16 +332,8 @@ export function requiredScopeFor(method: string, pathname: string): string | nul
   if (pathname.match(/^\/api\/provider-quotas\/[^/]+\/reset-fired$/)) return "quota:write";
   if (pathname === "/api/provider-quotas") return method === "GET" ? "agent:read" : "quota:write";
   if (pathname === "/api/routing-policy") return method === "GET" ? "agent:read" : "settings:write:routing";
-  if (pathname === "/api/teams/config") return method === "GET" ? "teams:read" : "settings:write:teams";
   if (pathname === "/api/settings/prompts" || pathname.startsWith("/api/settings/prompts/")) return method === "GET" ? "agent:read" : "system:admin";
-  if (pathname.startsWith("/api/teams")) return method === "GET" ? "teams:read" : "teams:write";
-  if (pathname === "/api/decisions" && method === "POST") return "teams:write"; // #2914: filing = the relay_decision scope
-  if (pathname.startsWith("/api/decisions")) return method === "GET" ? "teams:read" : "message:send"; // #2885: answering = messaging the coordinator
-  if (pathname.startsWith("/api/blackboard")) return method === "GET" ? "blackboard:read" : "blackboard:write";
-  if (pathname.startsWith("/api/issue-associations")) return method === "GET" ? "issue:read" : "issue:write";
-  if (pathname.startsWith("/api/issue-activity")) return method === "GET" ? "issue:read" : "issue:write";
-  if (pathname.startsWith("/api/issue-lifecycle")) return method === "GET" ? "issue:read" : "issue:write";
-  if (pathname.startsWith("/api/issue-refs")) return method === "GET" ? "issue:read" : "issue:write";
+  if (/^\/api\/projects\/[^/]+\/profile-instructions(?:\/|$)/.test(pathname)) return method === "GET" ? "agent:read" : "agent:write";
   if (pathname.startsWith("/api/projects")) return method === "GET" ? "project:read" : "project:write";
   // Insights config (the feature toggle) stays admin-only via the default; only the
   // mechanical observation feed is writable by lower-privilege callers.
@@ -466,7 +467,6 @@ export function requiredComponentScopeFor(method: string, pathname: string): str
   if (pathname === "/api/routing-policy") {
     return method === "GET" ? "agent:read" : "settings:write:routing";
   }
-  if (pathname === "/api/teams/config") return method === "GET" ? "teams:read" : "settings:write:teams";
   if (pathname === "/api/settings/prompts" || pathname.startsWith("/api/settings/prompts/")) {
     return method === "GET" ? "agent:read" : versionedPromptsEnabled() ? "agent:write" : "system:admin";
   }
@@ -477,16 +477,9 @@ export function requiredComponentScopeFor(method: string, pathname: string): str
   if (pathname.startsWith("/api/workflows")) return method === "GET" ? "task:read" : "task:write";
   if (pathname.startsWith("/api/orchestrators")) return method === "GET" ? "agent:read" : "command:write";
   if (pathname.startsWith("/api/plans")) return method === "GET" ? "plans:read" : "plans:write";
-  if (pathname.startsWith("/api/teams")) return method === "GET" ? "teams:read" : "teams:write";
-  if (pathname === "/api/decisions" && method === "POST") return "teams:write"; // #2914: filing = the relay_decision scope
-  if (pathname.startsWith("/api/decisions")) return method === "GET" ? "teams:read" : "message:send"; // #2885: answering = messaging the coordinator
-  if (pathname.startsWith("/api/blackboard")) return method === "GET" ? "blackboard:read" : "blackboard:write";
-  if (pathname.startsWith("/api/issue-associations")) return method === "GET" ? "issue:read" : "issue:write";
-  if (pathname.startsWith("/api/issue-activity")) return method === "GET" ? "issue:read" : "issue:write";
-  if (pathname.startsWith("/api/issue-lifecycle")) return method === "GET" ? "issue:read" : "issue:write";
-  if (pathname.startsWith("/api/issue-refs")) return method === "GET" ? "issue:read" : "issue:write";
   // Fail-closed default returns system:admin, so this case is load-bearing: without it
   // every /api/projects call from a scoped component token would 403-blackhole (#405).
+  if (/^\/api\/projects\/[^/]+\/profile-instructions(?:\/|$)/.test(pathname)) return method === "GET" ? "agent:read" : "agent:write";
   if (pathname.startsWith("/api/projects")) return method === "GET" ? "project:read" : "project:write";
   // The Runner posts the #184 context-gathering signal here (source:"server") via its
   // provider token. Without this case the path fell through to the system:admin default

package/src/server-background.ts

@@ -19,6 +19,6 @@ export function startServerBackgroundJobs(): void {
     { name: "connectors", start: startConnectorStatusPoller },
     { name: "maintenance", start: startMaintenanceScheduler },
     { name: "steward-rekey-notices", start: async () => (await import("./workspace-rekey")).drainStewardRekeyNotices() },
-    { name: "deploy-notice", start: () => { if (!isEphemeralMode()) notifyCdDeployLive(); } },
+    { name: "deploy-notice", start: async () => { if (!isEphemeralMode()) await notifyCdDeployLive(); } },
   ]);
 }

package/src/server.ts

@@ -7,6 +7,8 @@ import { inviteLinkRedirect } from "./invite-link";
 import { claudeAppBoundary, CLAUDE_APP_PATH, isClaudeAppPath } from "./claude-app-auth";
 import { handleClaudeApp } from "./claude-app-gateway";
 import { handleClaudeAppOAuth } from "./claude-app/oauth-http";
+import { installTimerIngressSchema } from "./db/timer-ingress";
+import { beginMainWriteBootPhase, endMainWriteBootPhase } from "./db/main-connection-writes";
 import { markServerBound, timePostBindPhase } from "./post-bind-startup";
 import type { ServerWebSocket } from "bun";
 import { beginStartupPhase, enableStartupTiming, timeStartupPhase } from "./startup-timing";
@@ -24,7 +26,6 @@ import { reconcileAutomationRuns, runDueAutomationsAsync, type AutomationDispatc
 import { getLifecycleManager } from "./lifecycle-manager";
 import { reconcileStewardPolicyModels } from "./steward-policy-model-reconcile";
 import { getConfig, setConfig } from "./config-store";
-import { reconcileProviderModelSeed } from "./provider-model-seed";
 export { reconcileProviderModelSeed } from "./provider-model-seed";
 import { ensureEscalationChannelRegistered } from "./connectors";
 import { installNotificationSubscriptionRule } from "./notification-subscription-rules";
@@ -111,6 +112,7 @@ export async function startServer(): Promise<void> {
   startArtifactCheckoutLease();
 
   assertSafeNetworkConfig(HOST);
+  beginMainWriteBootPhase();
   timeStartupPhase("server.database", () => initDb(DB_PATH));
   // #1960 T2 — stand the gateway up EXPLICITLY here rather than leaving it to the lazy self-init
   // (`getGateway()` on first call, gateway.ts), which would race the rest of this boot sequence.
@@ -136,7 +138,6 @@ export async function startServer(): Promise<void> {
   installNotificationSubscriptionRule();
   startPlanLiveBindings();
   reconcileRelayVersion();
-  if (!isEphemeralMode()) reconcileProviderModelSeed();
   // Register the ntfy escalation channel row from persisted connector config BEFORE the
   // warning check, so a correctly-configured relay doesn't spuriously warn while the async
   // channels-host connect is still in flight (#1510).
@@ -174,7 +175,9 @@ export async function startServer(): Promise<void> {
     }, AUTOMATION_INTERVAL_MS);
   }
 
+  installTimerIngressSchema();
   finishServices();
+  endMainWriteBootPhase();
   timeStartupPhase("server.bind", () => Bun.serve<RelaySocketData>({
     port: PORT,
     hostname: HOST,

package/src/services/host-utilization.ts

@@ -11,10 +11,14 @@
 //   2. the §4.4 in-memory last-hour series, ONLY once the durable write landed, so the Monitor
 //      chart can never show a point the Fleet card cannot corroborate;
 //   3. #2822 — the one operator page a gate-capacity transition owes, decided by that same write.
+//   4. #3762 — the one low-disk page (ntfy + coordinator) a disk level change owes, same write.
 import type { HostDaemonSample, HostMachineSample } from "@humwick/sdk";
 import { recordHostUtilizationAsync } from "../db";
 import { recordHostUtilizationSample } from "../host/utilization-buffer";
 import { composeGateCapacityNotice, type GateCapacityAlert } from "../host/gate-capacity-alert";
+import { composeDiskNotice, type DiskAlert } from "../host/disk-alert";
+import { stewardFallbackTarget } from "../config";
+import { notifyTarget } from "../maintenance/events";
 import { notifyWorkspaceHumanEscalation } from "../workspace-human-escalation";
 
 export interface RecordHostUtilizationInput {
@@ -52,9 +56,28 @@ export async function recordHostUtilization(input: RecordHostUtilizationInput):
   }
   recordHostUtilizationSample(input.hostId, input.machine, input.now ?? Date.now());
   if (recorded?.gateAlert) notifyGateCapacity(input.hostId, recorded.hostLabel ?? input.hostId, recorded.gateAlert, input.now ?? Date.now());
+  if (recorded?.diskAlert) notifyDisk(input.hostId, recorded.hostLabel ?? input.hostId, recorded.diskAlert);
   return true;
 }
 
+/** Operator ntfy plus the steward/coordinator target — the same two recipients as the critical-job watchdog. */
+function notifyDisk(hostId: string, label: string, alert: DiskAlert): void {
+  const notice = composeDiskNotice(hostId, label, alert);
+  const payload = { ...alert, kind: `host-disk.${alert.kind}`, hostId };
+  const human = notifyWorkspaceHumanEscalation({
+    subject: notice.subject,
+    body: notice.body,
+    priority: notice.priority,
+    tags: ["agent-relay", "host-disk"],
+    source: "host-disk",
+    payload,
+    idempotencyKey: notice.idempotencyKey,
+  });
+  const target = stewardFallbackTarget();
+  const routed = target ? notifyTarget("maintenance.degraded", {}, target, notice.subject, notice.body, payload, notice.idempotencyKey) : null;
+  console.warn(`[relay] ${notice.subject}${human.accepted || routed ? "" : " — nobody was notified (no ntfy channel or steward target)"}`);
+}
+
 function notifyGateCapacity(hostId: string, label: string, alert: GateCapacityAlert, now: number): void {
   const notice = composeGateCapacityNotice(hostId, label, alert, now);
   const result = notifyWorkspaceHumanEscalation({

package/src/services/idle-epics.ts

@@ -3,8 +3,8 @@ import { isTerminalTaskStatus } from "./task-entity";
 import { errMessage } from "@humwick/sdk";
 import { coordinatedTeamIds } from "../db/coordinator-seat";
 import { teamEpicWork } from "../db/team-epics";
-import { clearIssueTrackerNotFound, issueTrackerNotFoundCount, recordIssueTrackerNotFound, getIssueHierarchy, putIssueHierarchy } from "../db/long-running-work";
-import { updateIssueRef } from "../db/issue-refs";
+import { issueTrackerNotFoundCount, getIssueHierarchy } from "../db/long-running-work";
+import { putIssueHierarchyAsync, recordIssueRefLiveStatusAsync, recordIssueTrackerNotFoundAsync } from "../db/issue-refs-async";
 import { resolveIssueTrackerAdapter } from "../issue-tracker";
 import { GitHubApiError } from "../issue-tracker/github";
 import { routeNotification } from "../notification-router";
@@ -41,14 +41,13 @@ export async function refreshTeamEpicHierarchy(teamId: string, signal?: AbortSig
       const live = await adapter.getStatus(issue);
       if (signal?.aborted) break;
       statusLoaded = true;
-      clearIssueTrackerNotFound(issue.id);
-      updateIssueRef(issue.id, { status: live.status, title: live.title, closeReason: live.closeReason, statusSyncedAt: Date.now() });
+      await recordIssueRefLiveStatusAsync(issue.id, { status: live.status, title: live.title, closeReason: live.closeReason, statusSyncedAt: Date.now() });
       if (live.status !== "open") continue;
       const children = adapter.listSubIssues ? await adapter.listSubIssues(issue) : await adapter.listOpenSubIssues?.(issue);
-      if (children) putIssueHierarchy(issue.id, children);
+      if (children) await putIssueHierarchyAsync(issue.id, children);
     } catch (error) {
       if (!statusLoaded && error instanceof GitHubApiError && error.statusCode === 404
-        && recordIssueTrackerNotFound(issue.id) >= 2) {
+        && await recordIssueTrackerNotFoundAsync(issue.id) >= 2) {
         reportUnresolvable(teamId, issue);
         continue;
       }