@humwick/server 0.130.1 → 0.130.3

package/src/db/plan-tools-include-migration.ts

@@ -0,0 +1,36 @@
+// #3812 — backfill relay_plan_start/import into stored per-tool allowlists (the lean coordinator
+// from #3472 froze before they existed, so tools/list never carried them).
+// Narrow: only an include list already holding relay_plan_get, and not excluding the tool.
+// json_insert, not parse+reserialize (#1456); patches `$.relay.tools` and its `sources` mirror, and
+// the -v1-backup namespace, whose bytes are served while the matrix flag is off.
+import { getDb } from "./connection.ts";
+import { runMigrationOnce } from "./migration-marker.ts";
+
+const PROFILE_NAMESPACES = ["agent-profile", "agent-profile-override", "agent-profile-override-v1-backup"] as const;
+const SELECTION_PATHS = ["$.relay.tools", "$.sources.agentRelay.mcp"] as const;
+const BACKFILLED_TOOLS = ["relay_plan_start", "relay_plan_import"] as const;
+const EVIDENCE_TOOL = "relay_plan_get";
+
+export function backfillPlanToolsIntoToolIncludes(): void {
+  runMigrationOnce("plan-tools-include-backfill-v1", () => {
+    const db = getDb();
+    const namespaces = PROFILE_NAMESPACES.map(() => "?").join(", ");
+    // The outer table is aliased: inside the subqueries a bare `value` binds to json_each.value.
+    const holds = (path: string, field: "include" | "exclude", tool: string) =>
+      `EXISTS (SELECT 1 FROM json_each(c.value, '${path}.${field}') je WHERE je.value = '${tool}')`;
+    db.transaction(() => {
+      for (const path of SELECTION_PATHS) {
+        for (const tool of BACKFILLED_TOOLS) {
+          db.query(
+            `UPDATE config AS c SET value = json_insert(c.value, '${path}.include[#]', ?)
+             WHERE c.namespace IN (${namespaces}) AND json_valid(c.value)
+               AND json_type(c.value, '${path}.include') = 'array'
+               AND ${holds(path, "include", EVIDENCE_TOOL)}
+               AND NOT ${holds(path, "include", tool)}
+               AND NOT ${holds(path, "exclude", tool)}`,
+          ).run(tool, ...PROFILE_NAMESPACES);
+        }
+      }
+    })();
+  });
+}

package/src/db/plans-write-ops.ts

@@ -1,7 +1,9 @@
 import { createPlanRow, deletePlan, replacePlanIfVersion, setPlanArchived } from "./plans.ts";
+import { PLAN_READY_NOTICE_WRITE_OPS } from "./plan-ready-notices.ts";
 import type { WriterOpContext, WriterOpSpec } from "./write-ops.ts";
 
 export const PLANS_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = Object.freeze({
+  ...PLAN_READY_NOTICE_WRITE_OPS,
   "plans.create": { offLoop: true, idempotent: false, fn: (args: { input: Parameters<typeof createPlanRow>[0] }, ctx: WriterOpContext) => createPlanRow(args.input, ctx.now) },
   "plans.replace": { offLoop: true, idempotent: false, fn: (args: { input: Parameters<typeof replacePlanIfVersion>[0]; changedBy?: string }, ctx: WriterOpContext) => replacePlanIfVersion(args.input, args.changedBy, ctx.now, false) },
   "plans.setArchived": { offLoop: true, idempotent: true, fn: (args: { id: string; archived: boolean }, ctx: WriterOpContext) => setPlanArchived(args.id, args.archived, ctx.now) },

package/src/db/presence-buffer.ts

@@ -104,6 +104,11 @@ export function snapshotBufferedPresence(): PresenceSnapshot {
  *  current, and the caller's surrounding status/ready predicates constrain the match. */
 export function bufferedLiveAgentIds(cutoff: number): string[] {
   const ids: string[] = [];
+  const snapshot = writerPresenceSnapshot();
+  if (snapshot) {
+    for (const beat of snapshot) if (beat.lastSeen > cutoff) ids.push(beat.id);
+    return ids;
+  }
   for (const [id, pending] of pendingPresence) {
     if (pending.lastSeen > cutoff) ids.push(id);
   }

package/src/db/presence-loop.ts

@@ -1,3 +1,4 @@
+import { framed } from "../hub-metrics";
 import { assertMainThreadState } from "./main-thread-state";
 // Lifecycle glue for the coalesced presence buffer. Kept outside agents.ts so its writer-op body
 // never depends on the gateway-facing facade (ADR 0001 §3.1).
@@ -6,53 +7,47 @@ import { errMessage } from "@humwick/sdk";
 import { PRESENCE_FLUSH_MS } from "../config";
 import { drainPendingLandSettleSideEffects } from "../land-settle-dispatch";
 import { onShutdown } from "../shutdown";
-import { flushPresence } from "./agents.ts";
+import { flushPresenceAsync } from "./presence-write.ts";
 import { pendingPresence } from "./presence-buffer.ts";
 
 let presenceFlushTimer: ReturnType<typeof setInterval> | undefined;
-let asyncPresenceFlusher: (() => Promise<{ flushed: number }>) | undefined;
 let removeShutdownHook: (() => void) | undefined;
 
-/** Attach the gateway-backed normal-tick flusher without importing the gateway into agents.ts. */
-export function setAsyncPresenceFlusher(flusher: () => Promise<{ flushed: number }>): void {
-  assertMainThreadState("presence-loop.ts");
-  asyncPresenceFlusher = flusher;
-}
-
 /** Start the periodic presence-buffer flush loop (server boot). */
 export function startPresenceFlushLoop(intervalMs: number = PRESENCE_FLUSH_MS): void {
   assertMainThreadState("presence-loop.ts");
   if (presenceFlushTimer) return;
-  presenceFlushTimer = setInterval(() => {
-    const flush = asyncPresenceFlusher;
-    if (!flush) return flushPresenceQuietly(); // Bootstrap/isolated compatibility fallback.
-    void flush().catch((err) => console.warn(`[presence] flush failed: ${errMessage(err)}`));
-  }, intervalMs);
+  presenceFlushTimer = setInterval(framed("timer presence-flush", () =>
+    flushPresenceAsync().catch((err) => console.warn(`[presence] flush failed: ${errMessage(err)}`))), intervalMs);
   presenceFlushTimer.unref?.();
-  process.once("beforeExit", flushPresenceQuietly);
-  removeShutdownHook = onShutdown("presence", () => {
-    drainPendingLandSettleSideEffects();
-    stopPresenceFlushLoop();
+  process.once("beforeExit", flushPresenceBeforeExit);
+  removeShutdownHook = onShutdown("presence", async () => {
+    await drainPendingLandSettleSideEffects();
+    await stopPresenceFlushLoop();
   });
 }
 
 /** Stop the loop and persist whatever is buffered (graceful shutdown / test teardown). */
-export function stopPresenceFlushLoop(): void {
+function detachPresenceLoop(): void {
   assertMainThreadState("presence-loop.ts");
   removeShutdownHook?.();
   removeShutdownHook = undefined;
-  process.removeListener("beforeExit", flushPresenceQuietly);
+  process.removeListener("beforeExit", flushPresenceBeforeExit);
   if (presenceFlushTimer) clearInterval(presenceFlushTimer);
   presenceFlushTimer = undefined;
-  flushPresenceQuietly();
 }
 
-function flushPresenceQuietly(): void {
-  try { flushPresence(); } catch (err) { console.warn(`[presence] flush failed: ${errMessage(err)}`); }
+export async function stopPresenceFlushLoop(): Promise<void> {
+  detachPresenceLoop();
+  await flushPresenceAsync();
+}
+
+function flushPresenceBeforeExit(): void {
+  void flushPresenceAsync().catch(err => console.warn(`[presence] flush failed: ${errMessage(err)}`));
 }
 
 /** Test-only: drop the buffered presence and stop the flush loop. */
 export function resetPresenceBufferForTests(): void {
   pendingPresence.clear();
-  stopPresenceFlushLoop();
+  detachPresenceLoop();
 }

package/src/db/presence-write.ts

@@ -3,7 +3,6 @@ import { assertMainThreadState } from "./main-thread-state";
 // Kept outside agents.ts because the writer registry imports the op body from that module; importing
 // the gateway there would make the writer-stack cycle gateway → write-ops → agents → gateway.
 
-import { setAsyncPresenceFlusher } from "./presence-loop.ts";
 import { settlePendingPresenceFlush, snapshotPendingPresenceFlush, type PresenceFlushPayload } from "./presence-buffer.ts";
 import { getGateway } from "./gateway.ts";
 
@@ -31,8 +30,3 @@ export function flushPresenceAsync(now: number = Date.now()): Promise<{ flushed:
     .finally(() => { activeFlush = undefined; });
   return activeFlush;
 }
-
-// The timer remains owned by presence-loop.ts for its synchronous shutdown guarantee, while normal ticks
-// arrive here through an injected callback. This direction deliberately avoids a writer-op → gateway
-// dependency cycle; the callback carries no DB closure across the worker seam.
-setAsyncPresenceFlusher(flushPresenceAsync);

package/src/db/project-entries-async.ts

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+import type { writeProjectEntry, promoteBlackboardEntry } from "./project-entries";
 // Async project-entries facades (T4060 hub on-loop). Kept outside
 // project-entries.ts to avoid a gateway cycle.
 import { getGateway } from "./gateway.ts";
@@ -16,3 +18,15 @@ export const searchProjectEntriesAsync = (
   query: string,
   opts: ProjectEntrySearchOptions = {},
 ): Promise<ProjectEntrySearchResult[]> => read("projectEntries.search", { projectId, query, ...opts });
+
+export const getProjectEntryAsync = (id: string): Promise<ProjectEntry | null> => read("projectEntries.get", { id });
+export const getProjectEntryChainAsync = (id: string): Promise<ProjectEntry[]> => read("projectEntries.chain", { id });
+export const listActiveEntriesInAreaAsync = (projectId: string, area: string): Promise<ProjectEntry[]> => read("projectEntries.inArea", { projectId, area });
+export const countActivePinnedEntriesInAreaAsync = (projectId: string, area: string): Promise<number> => read("projectEntries.countPinnedInArea", { projectId, area });
+
+export const writeProjectEntryAsync = (input: Parameters<typeof writeProjectEntry>[0], requestId: string = randomUUID()): Promise<ProjectEntry> =>
+  getGateway().write("projectEntries.write", input, { idempotencyKey: requestId }) as unknown as Promise<ProjectEntry>;
+export const retractProjectEntryAsync = (id: string): Promise<ProjectEntry | null> =>
+  getGateway().write("projectEntries.retract", { id }) as unknown as Promise<ProjectEntry | null>;
+export const promoteBlackboardEntryAsync = (input: Parameters<typeof promoteBlackboardEntry>[0], requestId: string = randomUUID()): Promise<ProjectEntry> =>
+  getGateway().write("projectEntries.promoteBlackboard", input, { idempotencyKey: requestId }) as unknown as Promise<ProjectEntry>;

package/src/db/project-entries-read-ops.ts

@@ -1,10 +1,14 @@
 // Project-entries reader operations (T4060 hub on-loop). The MCP memory/project
 // read tools ran these scans synchronously on the event loop — including the
 // temp-B-TREE display ORDER BY over cells whose rows are ~95% retracted.
-import { listProjectEntries, searchProjectEntries } from "./project-entries.ts";
+import { countActivePinnedEntriesInArea, getProjectEntry, getProjectEntryChain, listActiveEntriesInArea, listProjectEntries, searchProjectEntries } from "./project-entries.ts";
 import type { ProjectEntryKind, ProjectEntryStatus, ProjectEntrySearchOptions } from "../types";
 
 export const PROJECT_ENTRIES_READ_OPS = {
+  "projectEntries.get": (args: { id: string }) => getProjectEntry(args.id),
+  "projectEntries.chain": (args: { id: string }) => getProjectEntryChain(args.id),
+  "projectEntries.inArea": (args: { projectId: string; area: string }) => listActiveEntriesInArea(args.projectId, args.area),
+  "projectEntries.countPinnedInArea": (args: { projectId: string; area: string }) => countActivePinnedEntriesInArea(args.projectId, args.area),
   "projectEntries.list": (args: {
     projectId: string;
     kind?: ProjectEntryKind;

package/src/db/project-entries-write-ops.ts

@@ -0,0 +1,8 @@
+import { promoteBlackboardEntry, retractProjectEntry, writeProjectEntry } from "./project-entries";
+import type { WriterOpSpec } from "./write-ops";
+
+export const PROJECT_ENTRIES_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = {
+  "projectEntries.write": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof writeProjectEntry>[0], ctx) => writeProjectEntry(args, ctx.now) },
+  "projectEntries.retract": { offLoop: true, idempotent: true, fn: (args: { id: string }, ctx) => retractProjectEntry(args.id, ctx.now) },
+  "projectEntries.promoteBlackboard": { offLoop: true, idempotent: false, fn: (args: Parameters<typeof promoteBlackboardEntry>[0], ctx) => promoteBlackboardEntry(args, ctx.now) },
+};

package/src/db/project-entries.ts

@@ -1,7 +1,7 @@
 import { isolateMemoryEntry } from "../memory-entry-safety";
 import { validateProjectEntryText } from "../validation";
 import { randomUUID } from "node:crypto";
-import { getDb, writeTransaction, ValidationError } from "./connection.ts";
+import { getDb, inWriteTransaction, ValidationError } from "./connection.ts";
 import { getEntry as getBlackboardEntry, listEntries as listBlackboardEntries } from "./blackboard.ts";
 import { parseJson } from "../utils";
 import {
@@ -211,7 +211,7 @@ function assertProjectKnowledge(projectId: string): void {
   }
 }
 
-export function writeProjectEntry(input: WriteProjectEntryInput): ProjectEntry {
+export function writeProjectEntry(input: WriteProjectEntryInput, now: number = Date.now()): ProjectEntry {
   validateProjectEntryText(input);
   assertProjectKnowledge(input.projectId);
   assertKind(input.kind);
@@ -234,8 +234,7 @@ export function writeProjectEntry(input: WriteProjectEntryInput): ProjectEntry {
     supersedes = latestEntryByTitle(input.projectId, input.kind, input.title)?.id;
   }
   const id = projectEntryId();
-  const now = Date.now();
-  writeTransaction(() => {
+  inWriteTransaction(() => {
     let inheritedAreas: string[] | null = null;
     if (supersedes) {
       const previous = getProjectEntry(supersedes);
@@ -404,21 +403,25 @@ export function countActivePinnedEntriesInArea(projectId: string, area: string):
 }
 
 /** #3410 — active entries of one cell that name `area`, newest first. Same index as the count above. */
-export function listActiveEntriesInArea(projectId: string, area: string): ProjectEntry[] {
-  const rows = getDb().query(`
+export function buildActiveEntriesInAreaQuery(projectId: string, area: string): { sql: string; params: string[] } {
+  return { sql: `
     SELECT * FROM project_entries
     WHERE project_id = ? AND status = 'active' AND areas LIKE ? ESCAPE '\\'
     ORDER BY updated_at DESC, created_at DESC, id DESC
-  `).all(projectId, `%${escapeLike(JSON.stringify(area))}%`) as ProjectEntryRow[];
-  return rows.map(rowToEntry);
+  `, params: [projectId, `%${escapeLike(JSON.stringify(area))}%`] };
 }
 
-export function retractProjectEntry(id: string): ProjectEntry | null {
+export function listActiveEntriesInArea(projectId: string, area: string): ProjectEntry[] {
+  const { sql, params } = buildActiveEntriesInAreaQuery(projectId, area);
+  return (getDb().query(sql).all(...params) as ProjectEntryRow[]).map(rowToEntry);
+}
+
+export function retractProjectEntry(id: string, now: number = Date.now()): ProjectEntry | null {
   const existing = getProjectEntry(id);
   if (!existing) return null;
   assertStatus("retracted");
   getDb().query("UPDATE project_entries SET status = 'retracted', updated_at = ? WHERE id = ?")
-    .run(Date.now(), id);
+    .run(now, id);
   return getProjectEntry(id);
 }
 
@@ -472,7 +475,7 @@ function activePromotedEntry(projectId: string, originRef: string): ProjectEntry
  * project supersedes the prior promoted copy rather than duplicating it, so the durable
  * ledger holds at most one active entry per promoted finding while keeping the full
  * supersede chain for audit. */
-export function promoteBlackboardEntry(input: PromoteBlackboardEntryInput): ProjectEntry {
+export function promoteBlackboardEntry(input: PromoteBlackboardEntryInput, now: number = Date.now()): ProjectEntry {
   const source = getBlackboardEntry(input.blackboardEntryId);
   if (!source) throw new ValidationError(`blackboard entry ${input.blackboardEntryId} not found`);
   if (source.status !== "active") {
@@ -489,7 +492,7 @@ export function promoteBlackboardEntry(input: PromoteBlackboardEntryInput): Proj
     source: "promoted",
     originRef: source.id,
     ...(existing ? { supersedes: existing.id } : {}),
-  });
+  }, now);
 }
 
 export interface UnpromotedBlackboardSummary {

package/src/db/project-journal.ts

@@ -203,7 +203,7 @@ export function setProjectJournalFields(input: {
   fields: Record<string, string | null>;
   changedBy: string;
   now?: number;
-}): ProjectJournalFieldChange[] {
+}, submittedAt: number = Date.now()): ProjectJournalFieldChange[] {
   const entries = Object.entries(input.fields);
   if (!entries.length) throw new ValidationError("fields must name at least one journal field");
   const plan: Array<{ field: ProjectJournalField; value: string | null; previous: string | null }> = [];
@@ -222,7 +222,7 @@ export function setProjectJournalFields(input: {
     plan.push({ field, value: value === "" ? null : value, previous });
   }
 
-  const now = input.now ?? Date.now();
+  const now = input.now ?? submittedAt;
   const changes: ProjectJournalFieldChange[] = [];
   writeTransaction(() => {
     for (const { field, value, previous } of plan) {

package/src/db/project-profile-instructions.ts

@@ -0,0 +1,50 @@
+import type { ProjectProfileInstructions } from "../types";
+import { getDb, ValidationError } from "./connection";
+import { promptHistory, writePromptVersion } from "./prompt-versions";
+import type { WriterOpContext, WriterOpSpec } from "./write-ops";
+
+export const PROJECT_PROFILE_INSTRUCTIONS_SCHEMA_SQL = `
+  CREATE TABLE IF NOT EXISTS project_profile_instructions (
+    project_id TEXT NOT NULL REFERENCES projects(id), profile TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE, PRIMARY KEY (project_id, profile)
+  );
+  CREATE INDEX IF NOT EXISTS project_profile_instructions_profile ON project_profile_instructions(profile);
+`;
+
+export interface ProjectProfileKey { projectId: string; profile: string }
+const columns = `p.project_id AS projectId, p.profile, coalesce(h.template, '') AS template,
+  coalesce(h.version, 0) AS version, coalesce(h.updated_at, 0) AS updatedAt`;
+
+export function getProjectProfileInstructions(key: ProjectProfileKey): ProjectProfileInstructions {
+  return getDb().query(`SELECT ${columns} FROM project_profile_instructions p
+    LEFT JOIN prompt_heads h ON h.slug = p.slug WHERE p.project_id = ? AND p.profile = ?`)
+    .get(key.projectId, key.profile) as ProjectProfileInstructions | null
+    ?? { ...key, template: "", version: 0, updatedAt: 0 };
+}
+
+function instructionSlug(key: ProjectProfileKey): string {
+  return `project-profile:${JSON.stringify([key.projectId, key.profile])}`;
+}
+
+export function writeProjectProfileInstructions(args: ProjectProfileKey & {
+  template?: string; expectedVersion: number; actor: string; reason?: string; restoreVersion?: number;
+}, now: number): ProjectProfileInstructions {
+  if (!getDb().query("SELECT 1 FROM projects WHERE id = ?").get(args.projectId)) throw new ValidationError("project not found");
+  getDb().query("INSERT OR IGNORE INTO project_profile_instructions VALUES (?, ?, ?)").run(args.projectId, args.profile, instructionSlug(args));
+  writePromptVersion({ ...args, slug: instructionSlug(args), action: args.restoreVersion === undefined ? undefined : "restore" }, now);
+  return getProjectProfileInstructions(args);
+}
+
+export const PROJECT_PROFILE_INSTRUCTION_READ_OPS = {
+  "projectProfileInstructions.get": getProjectProfileInstructions,
+  "projectProfileInstructions.history": (key: ProjectProfileKey) => promptHistory(instructionSlug(key)),
+  "projectProfileInstructions.list": (key: { projectId?: string; profile?: string }) => getDb().query(`SELECT ${columns}
+    FROM project_profile_instructions p LEFT JOIN prompt_heads h ON h.slug = p.slug
+    WHERE (?1 IS NULL OR p.project_id = ?1) AND (?2 IS NULL OR p.profile = ?2)`)
+    .all(key.projectId ?? null, key.profile ?? null) as ProjectProfileInstructions[],
+};
+
+export const PROJECT_PROFILE_INSTRUCTION_WRITE_OPS: Readonly<Record<string, WriterOpSpec>> = {
+  "projectProfileInstructions.write": { offLoop: true, idempotent: false,
+    fn: (args: Parameters<typeof writeProjectProfileInstructions>[0], ctx: WriterOpContext) => writeProjectProfileInstructions(args, ctx.now) },
+};

package/src/db/project-trust-approvals.ts

@@ -68,9 +68,9 @@ export interface UpsertProjectTrustApprovalInput {
 /** Records `approvedValue` as the trusted content for this (profile, repo, capability), replacing
  * any prior approval — used both by the operator-triggered dashboard approve action and by the
  * gate's own grandfather-on-first-encounter path (decision #4). */
-export function upsertProjectTrustApproval(input: UpsertProjectTrustApprovalInput): ProjectTrustApproval {
+export function upsertProjectTrustApproval(input: UpsertProjectTrustApprovalInput, submittedAt: number = Date.now()): ProjectTrustApproval {
   return writeTransaction(() => {
-    const now = Date.now();
+    const now = submittedAt;
     const existing = getDb().query(`
       SELECT id FROM project_trust_approvals WHERE profile_name = ? AND repo_key = ? AND capability = ?
     `).get(input.profileName, input.repoKey, input.capability) as { id: string } | null;

package/src/db/prompt-templates.ts

@@ -74,8 +74,8 @@ export function listTemplates(category?: string): PromptTemplateRecord[] {
   return templates;
 }
 
-export function upsertTemplate(slug: string, template: string): void {
-  const now = Date.now();
+export function upsertTemplate(slug: string, template: string, submittedAt: number = Date.now()): void {
+  const now = submittedAt;
   if (versionedPromptSlot(slug)) {
     throw new ValidationError("Use the versioned prompt writer with expectedVersion and actor");
   }
@@ -83,11 +83,11 @@ export function upsertTemplate(slug: string, template: string): void {
   if ((result.changes ?? 0) === 0) throw new ValidationError(`prompt template ${slug} not found`);
 }
 
-export function resetTemplate(slug: string): void {
+export function resetTemplate(slug: string, submittedAt: number = Date.now()): void {
   if (versionedPromptSlot(slug)) {
     throw new ValidationError("Use the versioned prompt writer with expectedVersion and actor");
   }
-  const now = Date.now();
+  const now = submittedAt;
   const result = getDb().query("UPDATE prompt_templates SET template = default_template, updated_at = ? WHERE slug = ?").run(now, slug);
   if ((result.changes ?? 0) === 0) throw new ValidationError(`prompt template ${slug} not found`);
 }

package/src/db/prompt-versions.ts

@@ -5,6 +5,7 @@ import { PROFILE_PROMPT_SCHEMA_SQL } from "./prompt-version-migration";
 export { migratePromptVersions, promptLegacyHistory } from "./prompt-version-migration";
 import { bundledPrompt, hasBundledPrompt, BUNDLED_PROMPT_MANIFEST, profilePromptSlug, versionedPromptsEnabled } from "../versioned-prompts";
 import { getDb, ValidationError } from "./connection";
+import { validateProjectProfileInstructionText } from "../project-profile-instruction-text";
 
 export const PROMPT_VERSIONS_SCHEMA_SQL = PROFILE_PROMPT_SCHEMA_SQL + `
   CREATE TABLE IF NOT EXISTS prompt_heads (
@@ -32,7 +33,10 @@ export function promptVersionMetadata(slug: string): Partial<PromptTemplate> | u
   if (!versionedPromptsEnabled()) return;
   const current = head(slug);
   const bundle = hasBundledPrompt(slug) ? bundledPrompt(slug) : undefined;
-  if (!current && !bundle) return;
+  if (!current && !bundle) {
+    if (getDb().query("SELECT 1 FROM project_profile_instructions WHERE slug = ?").get(slug)) return { template: "", version: 0, updatedAt: 0, source: "canonical" };
+    return;
+  }
   return {
     template: current?.template ?? bundle!.template,
     version: current?.version ?? 0, seedHash: current?.seed_hash ?? null,
@@ -50,7 +54,8 @@ export function promptHistory(slug: string): PromptRevision[] {
 function checkedPromptHead(args: Pick<PromptWrite, "slug" | "expectedVersion">, current = head(args.slug)): Head | null {
   if (!versionedPromptsEnabled()) throw new ValidationError("versioned prompt not found");
   const mapped = !current && !hasBundledPrompt(args.slug) ? getDb().query(`SELECT 1 FROM prompt_profile_slots
-    WHERE system_slug = ?1 OR EXISTS (SELECT 1 FROM json_each(append_slugs) WHERE value = ?1) LIMIT 1`).get(args.slug) : true;
+    WHERE system_slug = ?1 OR EXISTS (SELECT 1 FROM json_each(append_slugs) WHERE value = ?1)
+    UNION ALL SELECT 1 FROM project_profile_instructions WHERE slug = ?1 LIMIT 1`).get(args.slug) : true;
   if (!mapped) throw new ValidationError("versioned prompt not found");
   if (!Number.isSafeInteger(args.expectedVersion) || args.expectedVersion! < 0) throw new ValidationError(`expectedVersion for ${args.slug} must be a non-negative integer`);
   if (args.expectedVersion !== (current?.version ?? 0)) throw new PromptVersionConflictError(JSON.stringify({ slug: args.slug, ...promptVersionMetadata(args.slug), version: current?.version ?? 0 }));
@@ -70,6 +75,8 @@ function appendPromptVersion(args: PromptWrite, current: Head | null, now: numbe
   if (args.action === "restore" && !restored) throw new ValidationError("prompt revision not found");
   const template = args.action === "adopt" ? bundle!.template : restored?.template ?? args.template;
   if (template === undefined) throw new ValidationError("template required");
+  const projectProfile = getDb().query("SELECT project_id, profile FROM project_profile_instructions WHERE slug = ?").get(args.slug) as { project_id: string; profile: string } | null;
+  if (projectProfile) validateProjectProfileInstructionText(template, `project ${projectProfile.project_id} profile ${projectProfile.profile} instructions`);
   const seedHash = args.action === "adopt" ? bundle!.hash : restored ? restored.seedHash ?? null : current?.seed_hash ?? null;
   const version = (current?.version ?? 0) + 1;
   getDb().query("INSERT INTO prompt_revisions VALUES (?, ?, ?, ?, ?, ?, ?)")

package/src/db/provider-config-history.ts

@@ -13,11 +13,16 @@ function redactionPatch(env: unknown, nextEnv?: Record<string, unknown>): Record
   ).map(([key]) => [key, SECRET_VALUE_MASK]));
 }
 
-/** Update and delete archive through the same seam so neither persists credentials (#3540). */
-export function recordConfigHistory(entry: ConfigEntry, changedAt: string, changedBy?: string, nextValue?: unknown): void {
-  const value = entry.namespace === "provider-config" && isRecord(entry.value) && isRecord(entry.value.env)
+/** A config value with its provider credentials masked: what any copy outside the live row stores (#3540). */
+export function credentialFreeConfigValue(entry: ConfigEntry, nextValue?: unknown): unknown {
+  return entry.namespace === "provider-config" && isRecord(entry.value) && isRecord(entry.value.env)
     ? { ...entry.value, env: { ...entry.value.env, ...redactionPatch(entry.value.env, isRecord(nextValue) && isRecord(nextValue.env) ? nextValue.env : undefined) } }
     : entry.value;
+}
+
+/** Update and delete archive through the same seam so neither persists credentials (#3540). */
+export function recordConfigHistory(entry: ConfigEntry, changedAt: string, changedBy?: string, nextValue?: unknown): void {
+  const value = credentialFreeConfigValue(entry, nextValue);
   getDb().query(`
     INSERT INTO config_history (namespace, key, value, version, changed_at, changed_by)
     VALUES (?, ?, ?, ?, ?, ?)

package/src/db/provider-model-seed.ts

@@ -0,0 +1,34 @@
+import { providerCatalogList } from "@humwick/sdk/provider-catalog";
+import { getDb } from "./connection";
+
+const SEED_KEY = "provider-model-db-catalog-v1";
+
+/** One migration backfills missing rows; later boots and releases leave the database alone. */
+export function reconcileProviderModelSeed(): void {
+  const db = getDb();
+  if (db.query("SELECT 1 FROM config WHERE namespace = 'system' AND key = ?").get(SEED_KEY)) return;
+  db.transaction(() => {
+    seedProviderModelOverrides("seed:db-catalog-v1");
+    db.query("INSERT INTO config (namespace, key, value, version, updated_at, updated_by) VALUES ('system', ?, 'true', 1, ?, 'server-startup')")
+      .run(SEED_KEY, Date.now());
+  })();
+}
+
+/** Insert-only migration: operator edits, disabled entries and tombstones always win. */
+export function seedProviderModelOverrides(stamp: string, now = Date.now()): { inserted: number } {
+  const db = getDb();
+  const insert = db.query(`INSERT INTO provider_model_overrides (provider, alias, entry, deleted, disabled, updated_at, updated_by)
+    VALUES (?, ?, ?, 0, ?, ?, ?) ON CONFLICT(provider, alias) DO NOTHING`);
+  const defaultModel = db.query(`INSERT INTO provider_model_defaults (provider, alias, updated_at, updated_by)
+    VALUES (?, ?, ?, ?) ON CONFLICT(provider) DO NOTHING`);
+  return db.transaction(() => {
+    let inserted = 0;
+    for (const provider of providerCatalogList()) {
+      for (const model of provider.models) {
+        inserted += insert.run(provider.provider, model.alias, JSON.stringify(model), model.disabled ? 1 : 0, now, stamp).changes;
+      }
+      if (provider.defaultModel) defaultModel.run(provider.provider, provider.defaultModel, now, stamp);
+    }
+    return { inserted };
+  })();
+}

package/src/db/read-op-marshaling-fixtures.ts

@@ -101,6 +101,9 @@ export const KERNEL_ENTITY_CATALOG = {
 } as const;
 
 export const READ_OP_MARSHALING_FIXTURES: ReadOpFixtures = {
+  "projectProfileInstructions.get": { args: { projectId: "missing", profile: "worker" } },
+  "projectProfileInstructions.history": { args: { projectId: "missing", profile: "worker" } },
+  "projectProfileInstructions.list": { args: { projectId: "missing" } },
   "planGraph.import.preview": { args: { scope: "import-fixture", actor: "system", expectedVersion: 0, requestKey: "preview", documentHash: "h", requestHash: "h", newPlanId: "plan-fixture", executions: { a: { workflow: "build-review" } }, document: { version: 1, key: "fixture", revision: "r1", title: "Fixture", acceptance: [{ id: "works", text: "Works" }], tasks: [{ key: "a", title: "A", intent: "Build A" }] } } },
   "guides.search": { args: { query: "violet", guides: [{ id: "workflows", title: "Workflows", summary: "Build and review", tags: ["review"], body: "A violet checksum", revision: "fixture-revision" }] } },
   "commands.latestByCorrelation": { args: { type: "scheduler.cancel", correlationId: "fixture" } },
@@ -164,6 +167,7 @@ export const READ_OP_MARSHALING_FIXTURES: ReadOpFixtures = {
 
   // --- channels / projects / teams / hosts --------------------------------------------------------
   "channels.bindingOwner": { args: { id: "binding-t9" } },
+  "integrations.taskStats": { args: undefined },
   "channels.snapshot": { args: undefined },
   "channels.bindings": { args: {} },
   "channels.routes": { args: { channelId: "channel-t9" } },
@@ -187,6 +191,16 @@ export const READ_OP_MARSHALING_FIXTURES: ReadOpFixtures = {
   "projects.resolveEntries": { args: { projectId: SEED.projectId } },
   "projects.readMemoryEntriesByIds": { args: { identity: { projectId: SEED.projectId }, ids: ["pe_t9_alpha"] } },
   "projects.memoryPreamble": { args: { identity: { projectId: SEED.projectId }, options: {} } },
+  "issueRefs.list": { args: { limit: 10 } },
+  "automations.listRuns": { args: { limit: 10 } },
+  "automations.pendingPrecheckRuns": { args: undefined },
+  "automations.reconcilableRuns": { args: undefined },
+  "automations.dispatchableQueuedRuns": { args: undefined },
+  "automations.dueAutomations": { args: { now: 1_700_000_000_000 } },
+  "projectEntries.get": { args: { id: "pe_t9_alpha" } },
+  "projectEntries.chain": { args: { id: "pe_t9_alpha" } },
+  "projectEntries.inArea": { args: { projectId: SEED.projectId, area: "db" } },
+  "projectEntries.countPinnedInArea": { args: { projectId: SEED.projectId, area: "db" } },
   "projectEntries.list": { args: { projectId: SEED.projectId } },
   "projectEntries.search": { args: { projectId: SEED.projectId, query: "t9" } },
   "teams.spawnDelegation.get": { args: { teamId: SEED.teamId } },
@@ -216,6 +230,7 @@ export const READ_OP_MARSHALING_FIXTURES: ReadOpFixtures = {
   "ciIncidents.sha.hasExpired": { args: { now: FIXTURE_NOW } },
   "ciIncidents.lease.hasExpired": { args: { now: FIXTURE_NOW } },
   "deployEvents.get": { args: { id: "dep-t9" } },
+  "deployEvents.forCommit": { args: { commitSha: "a".repeat(40) } },
   // #2189 P7 — restart-epoch reads. Every one is a point/keyset read against ids that do not exist in
   // the fixture DB, which is the point: marshaling has to survive the empty answer too.
   "restartEpoch.openAll": { args: undefined },
@@ -237,6 +252,7 @@ export const READ_OP_MARSHALING_FIXTURES: ReadOpFixtures = {
   // --- commands / codex reset / inbox / insights --------------------------------------------------
   "commands.spawnOutcome": { args: { spawnRequestId: "spawn-t9" } },
   "commands.get": { args: { id: SEED.commandId } },
+  "commands.latestAttempt": { args: { baseId: SEED.commandId } },
   "commands.listLegacyLandingBackfillCandidates": { args: { afterId: "", limit: 10 } },
   // `observedAt` is the dispatcher's own `ctx.now`, so the in-process and worker runs legitimately
   // stamp different clock readings for the same DB state — normalize it out or the #1960 worker-seam
@@ -709,6 +725,12 @@ export function seedReadOpMarshalingData(): void {
      VALUES ('t9', 't9 claimed task', 't9', 'info', 'in_progress', 't9', 'claim', ?, ?, ?, ?, ?)`,
   ).run(SEED.agentId, t - 1, t, t, t);
 
+  // An open task-bound run so the automation scan ops marshal a NON-trivial run (meta/result JSON parsed worker-side).
+  db.query(
+    `INSERT INTO automation_runs (id, automation_id, status, scheduled_for, orchestrator_id, task_id, meta, created_at, updated_at)
+     VALUES ('run-t9', 'automation-t9', 'running', ?, 'orch-t9', 1, '{"k":"v"}', ?, ?)`,
+  ).run(t, t, t);
+
   // Project-entries rows so `projectEntries.list`/`search` marshal NON-trivial results:
   // two active rows the query term hits, plus a retracted row proving mixed-status parity.
   for (const [id, title, body, status, updatedAt] of [
@@ -720,5 +742,6 @@ export function seedReadOpMarshalingData(): void {
       `INSERT INTO project_entries (id, project_id, kind, title, body, status, tags, author_id, source, audience, inject, sensitivity, created_at, updated_at)
        VALUES (?, ?, 'rule', ?, ?, ?, '["t9"]', ?, 'manual', 'all', 'indexed', 'normal', ?, ?)`,
     ).run(id, SEED.projectId, title, body, status, SEED.agentId, updatedAt, updatedAt);
+    db.query("UPDATE project_entries SET areas = ?, inject = ? WHERE id = ?").run('["db"]', "pinned", id);
   }
 }

package/src/db/read-ops.ts

@@ -1,4 +1,6 @@
+import { INTEGRATIONS_READ_OPS } from "./integrations-ops.ts";
 import { PROMPT_VERSION_READ_OPS } from "./prompt-versions-ops";
+import { PROJECT_PROFILE_INSTRUCTION_READ_OPS } from "./project-profile-instructions";
 import { VAULT_READ_OPS } from "./secrets-vault";
 import { GUIDE_READ_OPS } from "./guides-search";
 import { ROUTING_POLICY_READ_OPS } from "./routing-policy";
@@ -61,6 +63,8 @@ import { ARTIFACTS_READ_OPS } from "./artifacts-read-ops.ts";
 import { PLANS_READ_OPS } from "./plans-read-ops.ts";
 import { CONTINUATION_ARCHIVES_READ_OPS } from "./continuation-archives-read-ops.ts";
 import { WORKFLOW_JOURNAL_READ_OPS } from "./workflow-journal-read-ops.ts";
+import { AUTOMATION_READ_OPS } from "./automation-read-ops.ts";
+import { ISSUE_REFS_READ_OPS } from "./issue-refs-read-ops.ts";
 import { PROJECTS_READ_OPS } from "./projects-read-ops.ts";
 import { PROJECT_ENTRIES_READ_OPS } from "./project-entries-read-ops.ts";
 import { CHANNELS_READ_OPS } from "./channels-read-ops.ts";
@@ -129,6 +133,7 @@ const SPIN_MAX_MS = 2_000;
 export const readOps = {
   ...GUIDE_READ_OPS,
   ...PROMPT_VERSION_READ_OPS,
+  ...PROJECT_PROFILE_INSTRUCTION_READ_OPS,
   ...SERVICE_ACCESS_READ_OPS,
   ...VAULT_TOKEN_READ_OPS,
   ...VAULT_HEALTH_READ_OPS,
@@ -253,7 +258,10 @@ export const readOps = {
   ...WORKFLOW_JOURNAL_READ_OPS,
   ...PROJECTS_READ_OPS,
   ...PROJECT_ENTRIES_READ_OPS,
+  ...AUTOMATION_READ_OPS,
+  ...ISSUE_REFS_READ_OPS,
   ...CHANNELS_READ_OPS,
+  ...INTEGRATIONS_READ_OPS,
 } satisfies Record<string, ReadOpFn>;
 
 /** The registered read-op names. */