@humwick/server 0.130.1 → 0.130.3

package/src/services/spawn-issue-activity.ts

@@ -1,6 +1,8 @@
+import { resolveIssueRefFromStringAsync } from "../db/issue-refs-async";
+
 import { isRecord } from "@humwick/sdk";
 import { resolveProjectForCwd, spawnIssuePromptAsync } from "../db";
-import { resolveIssueRefFromString } from "../db/issue-refs";
+
 import { defaultIssueRepo } from "../config";
 import { parseJson } from "../utils";
 import { recordAndEmitIssueActivity } from "./issue-activity";
@@ -32,8 +34,8 @@ export async function recordSpawnPromptIssueActivity(agent: AgentCard, spawnRequ
       if (!num || seen.has(num)) continue;
       seen.add(num);
       try {
-        const issueRef = resolveIssueRefFromString({ ref: `#${num}`, defaultRepo: issueRepo });
-        recordAndEmitIssueActivity({
+        const issueRef = await resolveIssueRefFromStringAsync({ ref: `#${num}`, defaultRepo: issueRepo });
+        await recordAndEmitIssueActivity({
           agentId: agent.id,
           action: "edit",
           issueRefId: issueRef.id,
@@ -58,7 +60,7 @@ export async function recordSpawnPromptIssueActivity(agent: AgentCard, spawnRequ
  * as recordSpawnPromptIssueActivity so prompt + branch refs for the same issue
  * are deduplicated at the DB layer.
  */
-export function recordWorkspaceIssueActivity(workspace: WorkspaceRecord): void {
+export async function recordWorkspaceIssueActivity(workspace: WorkspaceRecord): Promise<void> {
   const agentId = workspace.ownerAgentId;
   if (!agentId || workspace.mode !== "isolated") return;
 
@@ -86,8 +88,8 @@ export function recordWorkspaceIssueActivity(workspace: WorkspaceRecord): void {
 
   for (const num of seen) {
     try {
-      const issueRef = resolveIssueRefFromString({ ref: `#${num}`, defaultRepo: issueRepo });
-      recordAndEmitIssueActivity({
+      const issueRef = await resolveIssueRefFromStringAsync({ ref: `#${num}`, defaultRepo: issueRepo });
+      await recordAndEmitIssueActivity({
         agentId,
         action: "edit",
         issueRefId: issueRef.id,

package/src/services/spawn-launch.ts

@@ -1,7 +1,7 @@
 import { memoryRetirementMessage } from "../memory-retirement";
 // #3121 — the provider, model and effort a spawn launches with, resolved in one place: spawnAgent uses it, and a
 // caller that must know a launch before anything spawns (a workflow's start check) asks the same seam.
-import type { SpawnProvider, TaskDispatch } from "@humwick/sdk";
+import { errMessage, type SpawnProvider, type TaskDispatch } from "@humwick/sdk";
 import { isProviderEnabled, type ProviderCatalogEntry } from "@humwick/sdk/provider-catalog";
 import { builtInProfileSpawnDefaults, profileProviderRefusal } from "../agent-profile-catalog";
 import { DEFAULT_SPAWN_PROFILE_NAME, getAgentProfile } from "../config-store";
@@ -14,6 +14,7 @@ import { captureDispatchContext, withProbeUncertainty, type DispatchSnapshot } f
 import { finalizeLaunchDecision } from "./spawn-launch-decision";
 import type { SpawnCapOptions } from "../spawn-placement";
 import { resolveProjectRoleForProvider } from "./spawn-project-role";
+import { PinnedHostCapacityError } from "../spawn-admission";
 
 export interface SpawnLaunchInput {
   profile?: string;
@@ -82,6 +83,21 @@ export async function resolveSpawnLaunch(input: SpawnLaunchInput, captured?: Dis
     mustResolveAvailable: mustResolveAvailableFor(input.dispatchShape), orchestratorId: input.orchestratorId, spawnCap: input.spawnCap,
     avoidProviders: input.avoidProviders,
   });
+  try {
+    return await resolveLaunch(input, snapshot);
+  } catch (error) {
+    if (!input.orchestratorId || !snapshot.pinnedHostAtAgentCap) throw error;
+    // #3816 — prove capacity is the only refusal using the same full launch resolver.
+    try {
+      await resolveSpawnLaunch({ ...input, spawnCap: { ...input.spawnCap, attach: true } });
+    } catch {
+      throw error;
+    }
+    throw new PinnedHostCapacityError(errMessage(error), input.orchestratorId);
+  }
+}
+
+async function resolveLaunch(input: SpawnLaunchInput, snapshot: DispatchSnapshot): Promise<SpawnLaunch> {
   const { catalog } = snapshot;
   let provider = input.provider;
   const profile = input.profile ? getAgentProfile(input.profile)?.value : undefined;

package/src/services/spawn-loss-escalation.ts

@@ -224,7 +224,7 @@ export async function escalateLostSpawnCommand(command: Command): Promise<SpawnL
   // A child that DID register is alive regardless of what happened to its command row; never
   // convert a bookkeeping loss into a phantom failure for a running agent.
   if (spawnRequestId && await spawnWatchdogHasRegisteredAsync(spawnRequestId)) return null;
-  notifyAgentSpawnFailed({
+  await notifyAgentSpawnFailed({
     parent,
     ...(spawnRequestId ? { spawnRequestId } : {}),
     ...(isRecord(command.params) && stringValue(command.params.provider) ? { provider: stringValue(command.params.provider)! } : {}),

package/src/services/spawn-policy.ts

@@ -0,0 +1,68 @@
+// #3736 — the one spawn-policy check. spawnAgent runs it for every spawn (relay_spawn_agent,
+// relay_task_dispatch, POST /api/agents/spawn, workflow steps, sub-coordinators); the workflow
+// auto-start asks it which workflow a Task's work runs through. A project without the file, or with
+// an invalid or unreadable one, is not restricted: stored config never fails a spawn.
+import { stringValue, type AgentCard } from "@humwick/sdk";
+import {
+  matchSpawnPolicy, SPAWN_POLICY_FILE, spawnPolicyAtCommit, spawnPolicyRefusal, spawnPolicyWorkflow,
+  type SpawnerKind, type SpawnPolicy, type SpawnPolicySubject, type SpawnPolicyTask,
+} from "@humwick/sdk/spawn-policy";
+import { ValidationError } from "../db";
+import type { AuthContext } from "./auth-context";
+import { readProjectConfigFirst, type ProjectCheckout } from "./project-config-read";
+
+/** Where the policy is read: the spawn's own checkout first, then the project's registered roots. */
+export interface SpawnPolicyWhere {
+  projectId?: string;
+  checkout?: ProjectCheckout;
+}
+
+/** The rules that applied, for the caller's receipt. */
+export interface AppliedSpawnPolicy {
+  file: string;
+  ref: string;
+  sha: string;
+  rules: string[];
+}
+
+interface LoadedSpawnPolicy {
+  policy: SpawnPolicy;
+  ref: string;
+  sha: string;
+}
+
+async function loadSpawnPolicy(where: SpawnPolicyWhere): Promise<LoadedSpawnPolicy | undefined> {
+  if (!where.projectId) return undefined;
+  const { lookup } = await readProjectConfigFirst(where.projectId, where.checkout ? [where.checkout] : [], SPAWN_POLICY_FILE, spawnPolicyAtCommit, "spawns are not restricted until it is fixed");
+  return lookup?.status === "found" ? { policy: lookup.config, ref: lookup.ref, sha: lookup.sha } : undefined;
+}
+
+/** A workflow run's step, a sub-coordinator, any other agent, or a caller with no agent (dashboard, operator). */
+export function spawnerKind(ctx: AuthContext, input: { workflowRunId?: string }, caller: AgentCard | undefined): SpawnerKind {
+  if (ctx.actor.kind === "system" && input.workflowRunId) return "workflow";
+  if (!caller) return "operator";
+  return stringValue(caller.meta?.profile) === "sub-coordinator" ? "sub-coordinator" : "coordinator";
+}
+
+export function spawnPolicyTask(task: { id: number; tags?: readonly string[]; paths?: readonly string[] } | undefined): SpawnPolicyTask | undefined {
+  return task ? { id: task.id, ...(task.tags ? { tags: task.tags } : {}), ...(task.paths ? { paths: task.paths } : {}) } : undefined;
+}
+
+/** Refuses a spawn the project's policy does not allow (a `ValidationError` naming the rule, the
+ *  allowed set and the hint); otherwise the rules that applied, if any. */
+export async function enforceSpawnPolicy(where: SpawnPolicyWhere, facts: { spawner: SpawnerKind; task?: SpawnPolicyTask; subject: SpawnPolicySubject }): Promise<AppliedSpawnPolicy | undefined> {
+  const loaded = await loadSpawnPolicy(where);
+  if (!loaded) return undefined;
+  const rules = matchSpawnPolicy(loaded.policy, facts);
+  if (!rules.length) return undefined;
+  const refusal = spawnPolicyRefusal(rules, facts.subject, facts.task);
+  if (refusal) throw new ValidationError(refusal);
+  return { file: SPAWN_POLICY_FILE, ref: loaded.ref, sha: loaded.sha, rules: rules.map((rule) => rule.name) };
+}
+
+/** The workflow the project's policy routes this Task's work through, and the rule that says so. */
+export async function spawnPolicyWorkflowFor(where: SpawnPolicyWhere, facts: { spawner: SpawnerKind; task: SpawnPolicyTask }): Promise<{ workflow: string; rule: string } | undefined> {
+  const loaded = await loadSpawnPolicy(where);
+  const chosen = loaded && spawnPolicyWorkflow(matchSpawnPolicy(loaded.policy, facts));
+  return chosen ? { workflow: chosen.workflow, rule: chosen.rule.name } : undefined;
+}

package/src/services/spawn-registration-watchdog.ts

@@ -209,12 +209,12 @@ export async function reapUnregisteredSpawnCommands(
     const representativeId = unconfirmedIds[unconfirmedIds.length - 1] ?? group.rows[group.rows.length - 1]!.id;
     if (undispatchable) {
       lostSpawnCommandIds.push(representativeId);
-      notifyAgentSpawnFailed({ parent: group.parent, spawnRequestId: group.spawnRequestId, provider: group.provider, reason });
+      await notifyAgentSpawnFailed({ parent: group.parent, spawnRequestId: group.spawnRequestId, provider: group.provider, reason });
       continue;
     }
     if (group.latestUpdatedAt >= notifyCutoff) {
       notifiedUnconfirmedSpawnCommandIds.push(representativeId);
-      notifyAgentSpawnUnconfirmed({
+      await notifyAgentSpawnUnconfirmed({
         parent: group.parent,
         spawnRequestId: group.spawnRequestId,
         provider: group.provider,

package/src/services/spawn-repo-probe.ts

@@ -1,4 +1,5 @@
 import { cleanLandPlacement, readRepoLandPlacement } from "@humwick/sdk/land-gates";
+import { repoWorkspaceDepsDisabled } from "@humwick/sdk/worktree-config";
 import { existsSync } from "node:fs";
 import { isAbsolute } from "node:path";
 import { isRecord, normalizeGitRemoteIdentity, ValidationError, type Orchestrator } from "@humwick/sdk";
@@ -9,7 +10,7 @@ import { findGitRepoRoot } from "./canonical-root";
 import { runGit, toProjectGitResult } from "./git-process";
 import { remoteUrlFromGitRemoteAsync } from "./git-remote";
 
-export type RepoProbe = { kind: "present"; repoRoot?: string; remoteIdentity?: string; placementPlatforms?: string[]; toolchainError?: string }
+export type RepoProbe = { kind: "present"; repoRoot?: string; remoteIdentity?: string; placementPlatforms?: string[]; workspaceDepsDisabled?: boolean; toolchainError?: string }
   /** `occupied`: the path exists but is not inside a git checkout, so no clone can land there (#3347). */
   | { kind: "absent"; occupied?: boolean } | { kind: "timeout" } | { kind: "unavailable"; reason?: string };
 
@@ -77,17 +78,18 @@ export async function probeLocalSourceRepo(path: string, baseRef?: string | null
   if (!root) return { kind: "absent", occupied: true };
   const remote = await remoteUrlFromGitRemoteAsync(root, { refresh: true });
   let placementPlatforms: string[] | undefined;
+  const workspaceDepsDisabled = await repoWorkspaceDepsDisabled(placementGit(root));
   if (baseRef !== undefined) {
     try {
       placementPlatforms = await readRepoLandPlacement(baseRef ?? undefined, placementGit(root));
     } catch (error) { return { kind: "unavailable", reason: String(error) }; }
   }
-  return { kind: "present", repoRoot: root, ...(placementPlatforms ? { placementPlatforms } : {}), ...(remote ? { remoteIdentity: normalizeGitRemoteIdentity(remote) } : {}) };
+  return { kind: "present", repoRoot: root, workspaceDepsDisabled, ...(placementPlatforms ? { placementPlatforms } : {}), ...(remote ? { remoteIdentity: normalizeGitRemoteIdentity(remote) } : {}) };
 }
 
 async function probeRemoteRepo(host: Orchestrator, path: string, baseRef?: string | null, toolchain = false): Promise<RepoProbe> {
   if (!host.apiUrl || !isTrustedOrchestratorApiUrl(host.apiUrl)) return { kind: "unavailable" };
-  const result = await fetchHostJson<{ isGitRepo: boolean; definite?: boolean; pathExists?: boolean; repoRoot?: string; remoteIdentity?: string; placementPlatforms?: string[]; placementError?: string; toolchainError?: string }>(host.apiUrl, "/api/repo/identity", {
+  const result = await fetchHostJson<{ isGitRepo: boolean; definite?: boolean; pathExists?: boolean; repoRoot?: string; remoteIdentity?: string; placementPlatforms?: string[]; workspaceDepsDisabled?: boolean; placementError?: string; toolchainError?: string }>(host.apiUrl, "/api/repo/identity", {
     query: new URLSearchParams({ path, ...(toolchain ? { toolchain: "1" } : {}), ...(baseRef ? { baseRef } : baseRef === null ? { placement: "1" } : {}) }), timeoutMs: toolchain ? 50_000 : 20_000,
     validate: (body) => {
       if (!isRecord(body) || typeof body.isGitRepo !== "boolean"
@@ -101,14 +103,14 @@ async function probeRemoteRepo(host: Orchestrator, path: string, baseRef?: strin
       let placementPlatforms: string[] | undefined;
       try { placementPlatforms = cleanLandPlacement({ placement: { platforms: body.placementPlatforms } })?.platforms; }
       catch (error) { console.warn(`${host.id}: invalid repository placement: ${String(error)}`); }
-      return { ok: true, value: { ...(typeof body.toolchainError === "string" ? { toolchainError: body.toolchainError } : {}), isGitRepo: body.isGitRepo, definite: body.definite === true, pathExists: body.pathExists === true, ...(typeof body.placementError === "string" ? { placementError: body.placementError } : {}), ...(placementPlatforms ? { placementPlatforms } : {}),
+      return { ok: true, value: { workspaceDepsDisabled: body.workspaceDepsDisabled === true, ...(typeof body.toolchainError === "string" ? { toolchainError: body.toolchainError } : {}), isGitRepo: body.isGitRepo, definite: body.definite === true, pathExists: body.pathExists === true, ...(typeof body.placementError === "string" ? { placementError: body.placementError } : {}), ...(placementPlatforms ? { placementPlatforms } : {}),
         ...(typeof body.repoRoot === "string" ? { repoRoot: body.repoRoot } : {}),
         ...(typeof body.remoteIdentity === "string" ? { remoteIdentity: body.remoteIdentity } : {}) } };
     },
   });
   if (result.ok && baseRef !== undefined && result.value.placementError) return { kind: "unavailable", reason: result.value.placementError };
   if (result.ok) return result.value.isGitRepo
-    ? { kind: "present", ...(result.value.toolchainError ? { toolchainError: result.value.toolchainError } : {}), ...(result.value.repoRoot ? { repoRoot: result.value.repoRoot } : {}), ...(result.value.placementPlatforms ? { placementPlatforms: result.value.placementPlatforms } : {}), ...(result.value.remoteIdentity ? { remoteIdentity: result.value.remoteIdentity } : {}) }
+    ? { kind: "present", workspaceDepsDisabled: result.value.workspaceDepsDisabled, ...(result.value.toolchainError ? { toolchainError: result.value.toolchainError } : {}), ...(result.value.repoRoot ? { repoRoot: result.value.repoRoot } : {}), ...(result.value.placementPlatforms ? { placementPlatforms: result.value.placementPlatforms } : {}), ...(result.value.remoteIdentity ? { remoteIdentity: result.value.remoteIdentity } : {}) }
     // Old orchestrators also returned false for a killed/timed-out probe (#2715).
     : result.value.definite === true ? { kind: "absent", ...(result.value.pathExists ? { occupied: true } : {}) } : { kind: "unavailable" };
   const failure = result.failure;

package/src/services/spawn-tree-cleanup.ts

@@ -2,36 +2,35 @@ import { errMessage, stringValue } from "@humwick/sdk";
 import type { WorkflowEffect } from "@humwick/kernel/workflow.pilot";
 import { getGateway } from "../db/gateway";
 import { getAgentAsync } from "../db";
+import { isTerminalCommandStatus } from "../db/command-terminal-status";
 import { shutdownAgent } from "./shutdown-agent";
 import { currentStop } from "./workflow-effects";
-import { invoke, testOptions, type Supervisor } from "./workflow-supervisor-state";
+import { invoke, retryResult, supervisorNow, type Supervisor } from "./workflow-supervisor-state";
 
 /** Every retry resumes the same outbox effect; only host witnesses release reservations. */
 export async function performSpawnTreeCleanup(sup: Supervisor, effect: WorkflowEffect): Promise<boolean> {
-  const now = (testOptions.now ?? Date.now)();
-  if (typeof effect.result?.nextAttemptAt === "number" && effect.result.nextAttemptAt > now) return false;
+  const now = supervisorNow();
   const agentId = String(effect.payload.agentId);
   await getGateway().write("spawnTree.prepareCleanup", { agentId });
   const targets = await getGateway().read("spawnTree.cleanupTargets", { agentId });
   const retry: Array<{ spawnRequestId: string; error: string }> = [];
+  let inFlight = false;
   for (const target of targets) {
     if (target.processGone) continue;
     try {
       const agent = await getAgentAsync(target.agentId);
       const generation = stringValue(agent?.meta?.spawnRequestId) ?? target.spawnRequestId;
-      const { id, prior } = await currentStop(`${effect.id}:stop:${target.spawnRequestId}:${generation}`, command =>
-        command.result?.targetNotFound !== true || now - command.updatedAt >= 15 * 60_000);
+      const { id, prior } = await currentStop(`${effect.id}:stop:${target.spawnRequestId}:${generation}`, now);
       const command = prior ?? (await shutdownAgent({
         ...(agent ? { agentId: agent.id } : {}), spawnRequestId: generation, orchestratorId: target.orchestratorId,
         commandId: id, requireProcessTreeProof: true, graceful: false, force: true,
         reason: String(effect.payload.reason), requestedVia: "bus", requestedBy: "workflow",
       }, { actor: { id: "workflow", kind: "system" }, scopes: [] })).command;
       if (command.status !== "succeeded" || command.result?.processTreeStopped !== true) retry.push({ spawnRequestId: target.spawnRequestId, error: `shutdown ${command.id}: ${command.status}` });
+      if (!isTerminalCommandStatus(command.status)) inFlight = true;
     } catch (error) { retry.push({ spawnRequestId: target.spawnRequestId, error: errMessage(error) }); }
   }
-  const delay = Math.min(60_000, 1000 * 2 ** Math.min(effect.attempts, 6));
-  await invoke(sup, "settleEffect", { id: effect.id, status: retry.length ? "pending" : "done", result: {
-    targets: targets.length, retry, checkedAt: now, ...(retry.length ? { nextAttemptAt: now + delay } : {}),
-  } });
+  const result = { targets: targets.length, retry, checkedAt: now, ...(inFlight ? { inFlight } : {}) };
+  await invoke(sup, "settleEffect", { id: effect.id, status: retry.length ? "pending" : "done", result: retry.length ? retryResult(effect.result, result, now) : result });
   return retry.length === 0;
 }

package/src/services/steward-reaper.ts

@@ -164,13 +164,13 @@ export async function reapIdleStewards(opts: { now?: number; signal?: AbortSigna
       if (entry.attempts >= STEWARD_REAP_MAX_ATTEMPTS) {
         if (!entry.alarmed) {
           entry.alarmed = true;
-          raiseOperatorAlarm({
+          (await raiseOperatorAlarm({
             clientId: `steward-zombie-blocking-${agent.id}`,
             source: "steward-reaper",
             subject: "Steward zombie is blocking a repo/host steward slot",
             detail: `Steward \`${agent.id}\` (${agent.label ?? "unlabelled"}, host ${agent.machine ?? "unknown"}) ignored ${entry.attempts} shutdown attempt(s) and is holding the one-per-repo/host steward slot — no new steward can spawn there until it is killed. Investigate and terminate it manually.`,
             metadata: { maintenanceJobId: "steward-reaper", agentId: agent.id, label: agent.label, machine: agent.machine, attempts: entry.attempts },
-          });
+          }));
         }
         reapTracker.set(agent.id, entry);
         alarmed.push(agent.id);
@@ -192,7 +192,7 @@ export async function reapIdleStewards(opts: { now?: number; signal?: AbortSigna
       entry.lastAt = now;
       reapTracker.set(agent.id, entry);
       if (graceful) {
-        requestTransientAgentShutdown(agent, {
+        (await requestTransientAgentShutdown(agent, {
           reason: disabled ? "steward-disabled" : "steward-orphan-idle",
           requestedBy: "steward-reaper",
           activityTitle: disabled ? "Orphaned steward reaped (spawning disabled)" : "Orphaned steward reaped",
@@ -201,7 +201,7 @@ export async function reapIdleStewards(opts: { now?: number; signal?: AbortSigna
             : "Steward has no live managed policy state and has been idle past the keepalive grace; reaping.",
           landReason: disabled ? "steward-disabled" : "steward-orphan-idle",
           now,
-        });
+        }));
       } else {
         // A plain agent-targeted `agent.shutdown` — graceful or not — is INERT against a runner that
         // has stopped reading its own commands (runner-core keys kill-hardness off the command TYPE,

package/src/services/task-context-hydration.ts

@@ -48,6 +48,10 @@ export interface TaskHydrationFacets {
   /** #2728 — the Task's `context` facet (free-text facts a coordinator must not resend by message). */
   context?: string;
   doneWhen?: string;
+  /** #3808 — the Task's `terminalStage` (deployed = deploy/live proof happens after land). */
+  terminalStage?: string;
+  /** #3808 — the Task's `onDeploy` follow-up, run after the deploy, not by the worker. */
+  onDeploy?: string;
   issues: ResolvedIssueSpec[];
   /** Decisions/rules: discussion + milestone write-throughs and steers (the narrative ledger). */
   decisions: TaskEvent[];
@@ -165,12 +169,28 @@ function renderContextFacet(value: string | undefined): string {
   return `\nContext (Task data):\n${fence(truncate(text, TASK_CONTEXT_LIMIT))}\n`;
 }
 
+/** #3808 — post-deploy criteria rendered apart from the worker's acceptance: they are checked after land
+ *  (QA / onDeploy) and must never read as unmet delivery criteria. Empty when the Task has none, so the
+ *  template line collapses to a blank line (the `{{context}}` seam's shape). */
+function renderAfterLandFacet(facets: Pick<TaskHydrationFacets, "terminalStage" | "onDeploy">): string {
+  const onDeploy = facets.onDeploy?.trim();
+  const deployed = facets.terminalStage === "deployed";
+  if (!onDeploy && !deployed) return "";
+  const parts = [
+    "\nAfter land (checked by QA/onDeploy once the change is live; NOT yours and never blocks delivery — deliver `complete` when code, tests and the delivery gate pass):",
+  ];
+  if (deployed) parts.push("- Terminal stage is deployed: deploy, live-check and independent-reproduction criteria in the acceptance above belong here, not to your delivery.");
+  if (onDeploy) parts.push(`- onDeploy follow-up:\n${fence(truncate(onDeploy, TASK_CONTEXT_LIMIT))}`);
+  return `${parts.join("\n")}\n`;
+}
+
 export function renderTaskHydration(facets: TaskHydrationFacets): string {
   const issues = facets.issues.length ? facets.issues.map(renderIssue).join("\n") : "- none linked";
   const decisions = facets.decisions.length ? facets.decisions.map(renderEvent).join("\n") : "- none recorded";
   const history = facets.history.length ? facets.history.map(renderEvent).join("\n") : "- none yet";
   const memory = facets.memory ? `\n${fence(facets.memory)}\n` : "";
   const context = renderContextFacet(facets.context);
+  const afterLand = renderAfterLandFacet(facets);
   const rendered = renderTemplate("task.hydration", {
     taskId: String(facets.taskId),
     title: inlineSafe(facets.title),
@@ -180,6 +200,7 @@ export function renderTaskHydration(facets: TaskHydrationFacets): string {
     intent: fence(facets.intent || "(no intent recorded)"),
     context,
     doneWhen: fence(facets.doneWhen || "(no explicit acceptance recorded)"),
+    afterLand,
     issues,
     decisions,
     history,
@@ -187,7 +208,8 @@ export function renderTaskHydration(facets: TaskHydrationFacets): string {
     steer: fence(facets.steer || "(no steer provided — proceed toward the acceptance above)"),
   }).trimEnd();
   // Saved operator templates can predate {{context}}; required Task data must still reach the worker (#3245).
-  return context && !rendered.includes(context.trim()) ? `${rendered}\n${context}`.trimEnd() : rendered;
+  const withContext = context && !rendered.includes(context.trim()) ? `${rendered}\n${context}`.trimEnd() : rendered;
+  return afterLand && !withContext.includes(afterLand.trim()) ? `${withContext}\n${afterLand}`.trimEnd() : withContext;
 }
 
 function hasTaskMemory(envelope: TaskMemoryEnvelope): boolean {
@@ -346,6 +368,8 @@ export async function hydrateTaskContext(input: HydrateTaskContextInput): Promis
     intent: task.intent ?? task.title,
     ...(task.context?.trim() ? { context: task.context } : {}),
     ...(task.doneWhen ? { doneWhen: task.doneWhen } : {}),
+    ...(task.terminalStage ? { terminalStage: task.terminalStage } : {}),
+    ...(task.onDeploy?.trim() ? { onDeploy: task.onDeploy } : {}),
     issues,
     decisions,
     history,

package/src/services/task-delivery.ts

@@ -1,20 +1,6 @@
-import {
-  getTaskDetail,
-  getWorkspace,
-  insertTaskEvent,
-  markTaskDeliverableEffectsCompleteAsync,
-  ownedIsolatedWorkspace,
-  recordGateAsync,
-  recordTaskDeliverableAsync,
-  recordTaskDeliverableWithLandingIngressAsync,
-  setTaskStage,
-  setTaskStatus,
-  setTaskStatusAsync,
-  transitionWorkspaceLandStateAsync,
-  workspaceLandAuthorization, workspaceLandAuthorizationWithdrawn,
-  ValidationError,
-  type CompleteDeliveryArmOutcome,
-} from "../db";
+import { setTaskStatusAsync, setTaskStageAsync } from "../db/task-entity-async";
+import { insertTaskEventAsync } from "../db/runtime-tail-async";
+import { getTaskDetail, getWorkspace, markTaskDeliverableEffectsCompleteAsync, ownedIsolatedWorkspace, recordGateAsync, recordTaskDeliverableAsync, recordTaskDeliverableWithLandingIngressAsync, transitionWorkspaceLandStateAsync, workspaceLandAuthorization, workspaceLandAuthorizationWithdrawn, ValidationError, type CompleteDeliveryArmOutcome } from "../db";
 import { refreshWorkspaceGitState } from "../workspace-probe";
 import { pinWorkspaceDeliveryTip } from "../workspace-delivery-tip";
 import { recoverIsolatedWorkspace, type WorkspaceRecoveryHint } from "./workspace-recovery";
@@ -25,7 +11,7 @@ import { emitTaskChanged, emitNewMessages } from "../sse";
 import { agentBoundTaskIds, hasTaskReadAdminScope } from "../task-authz";
 import { applyWorkspaceAction } from "../workspace-actions";
 import { LAND_IN_FLIGHT_STATUSES, LAND_REQUEST_STALE_ON_HEAD_ADVANCE_STATUSES } from "../workspace-phase";
-import { findLatestCommandByCorrelation } from "../commands-db";
+import { findLatestCommandByCorrelationAsync } from "../commands-write";
 import { mergeCommandNeedsRetry } from "../workspace-merge-progress";
 import { workspaceLandNeedsRearm } from "../workspace-land-retry";
 import { emitTaskSemanticNotification } from "./task-semantic-events";
@@ -120,7 +106,7 @@ function shouldRebindToWorkspace(task: TaskDetail, ws: WorkspaceRecord | undefin
   return Boolean(task.branch && ws?.branch && task.branch !== ws.branch);
 }
 
-function resolveWorkspace(ctx: AuthContext, input: Pick<DeliverTaskInput, "workspaceId" | "workspace" | "idempotencyKey">, taskId: number, opts: { allowRebind?: boolean } = {}): WorkspaceRecord | undefined {
+async function resolveWorkspace(ctx: AuthContext, input: Pick<DeliverTaskInput, "workspaceId" | "workspace" | "idempotencyKey">, taskId: number, opts: { allowRebind?: boolean } = {}): Promise<WorkspaceRecord | undefined> {
   const caller = ctx.callerAgentId;
   const explicit = input.workspaceId?.trim();
   let ws = explicit ? getWorkspace(explicit) : caller ? ownedIsolatedWorkspace(caller) : undefined;
@@ -133,7 +119,7 @@ function resolveWorkspace(ctx: AuthContext, input: Pick<DeliverTaskInput, "works
   // server-authoritative recovery (signed spawn-request association + immutable agent.spawn params +
   // orchestrator baseDir containment); the descriptor is an untrusted hint, never trusted verbatim.
   if (!ws && input.workspace) {
-    const recovery = recoverIsolatedWorkspace(ctx, input.workspace, explicit);
+    const recovery = (await recoverIsolatedWorkspace(ctx, input.workspace, explicit));
     if (recovery.ok) ws = recovery.workspace;
   }
   if (!ws) return undefined;
@@ -149,18 +135,18 @@ function resolveWorkspace(ctx: AuthContext, input: Pick<DeliverTaskInput, "works
   return ws;
 }
 
-function rebindTaskToWorkspaceIfNeeded(task: TaskDetail, ws: WorkspaceRecord | undefined, actor: string): TaskDetail {
+async function rebindTaskToWorkspaceIfNeeded(task: TaskDetail, ws: WorkspaceRecord | undefined, actor: string): Promise<TaskDetail> {
   if (!shouldRebindToWorkspace(task, ws)) return task;
-  setTaskStatus(task.id, {
+  (await setTaskStatusAsync(task.id, {
     status: "in_progress",
     note: `fix-forward rebind to workspace ${ws.id} (${ws.branch})`,
     actor,
-  });
-  return setTaskStage(task.id, {
+  }));
+  return (await setTaskStageAsync(task.id, {
     deliverableStage: "committed-on-branch",
     branch: ws.branch,
     actor,
-  });
+  }));
 }
 
 function cleanReason(value: unknown, disposition: "blocked" | "failed"): string {
@@ -189,7 +175,7 @@ function skippedRequiredGateReports(reason: string): Required<Pick<TaskDeliveryG
 // Non-landing dispositions (blocked/failed/needs-review, and a verdict-only complete that closes on
 // delivery with no land) keep their honest existing wording. #2518 adds the third shape: a complete
 // delivery ACCEPTED but HELD for coordinator review — it says exactly that and never claims landing.
-function notifyDelivery(taskId: number, eventId: number, metadata: TaskDeliverableEventMetadata, landing: boolean): void {
+async function notifyDelivery(taskId: number, eventId: number, metadata: TaskDeliverableEventMetadata, landing: boolean): Promise<void> {
   const task = getTaskDetail(taskId);
   if (!task) return;
   const linkedIssues = task.issues.map((issue) => ({ provider: issue.provider, repo: issue.repo, externalKey: issue.externalKey, title: issue.title, status: issue.status }));
@@ -227,7 +213,7 @@ function notifyDelivery(taskId: number, eventId: number, metadata: TaskDeliverab
   const notArmedWarning = metadata.landNotArmedReason && unmergedAhead > 0
     ? `\n⚠ NOT landed: ${unmergedAhead} unmerged commit(s) remain on ${metadata.workspaceId ?? "the workspace"} (no land armed — ${metadata.landNotArmedReason}). Land it explicitly if this work belongs on main.`
     : "";
-  const delivered = routeNotification({
+  const delivered = await routeNotification({
     type: "task.deliverable",
     scope: {
       taskId: String(taskId),
@@ -309,7 +295,7 @@ export async function deliverTask(input: DeliverTaskInput, ctx: AuthContext): Pr
   // `complete` changes, from a hard reject to the same owner-authorized resolve the land path had.
   // The TASK-record rebind itself (rebindTaskToWorkspaceIfNeeded) is still gated on `wantsLand`.
   let workspace = input.disposition === "complete" || input.workspaceId
-    ? resolveWorkspace(ctx, input, taskId, { allowRebind: input.disposition === "complete" })
+    ? (await resolveWorkspace(ctx, input, taskId, { allowRebind: input.disposition === "complete" }))
     : undefined;
   // A workspace that could actually carry a land: isolated, live on disk, and on a branch. Mirrors
   // the preconditions enforced below (:live isolated workspace / :exact resolved source ref), so a
@@ -459,7 +445,7 @@ export async function deliverTask(input: DeliverTaskInput, ctx: AuthContext): Pr
     }
     if (ahead > 0) landNotArmed = { reason: workspaceLandBlocked(workspace) ? "workspace-land-blocked" : landDecision.reason, unmergedAhead: ahead };
   }
-  const currentTask = wantsLand && !noWork ? rebindTaskToWorkspaceIfNeeded(before, workspace, actor) : before;
+  const currentTask = wantsLand && !noWork ? (await rebindTaskToWorkspaceIfNeeded(before, workspace, actor)) : before;
   const sourceRef = wantsLand ? replayLand?.sourceRef ?? workspace?.branch?.trim() : undefined;
   // Only the HEAD returned by THIS host probe can authorize ingress. Persisted metadata may be
   // stale, and the caller's commit list is a self-report; neither is authority for a mutable ref.
@@ -520,7 +506,7 @@ export async function deliverTask(input: DeliverTaskInput, ctx: AuthContext): Pr
     // Pin the delivered tip captured at delivery; the host publishes it ONLY if reachable from the
     // verified workspace tip, else REFUSES (H1 — fail closed), so no unrelated local commit rides in.
     const deliveredSha = input.commits?.length ? input.commits[input.commits.length - 1]?.sha : undefined;
-    reviewPublish = dispatchReviewPublish(reviewWorkspace, { requestedBy: actor, taskId, sha: deliveredSha, emit: emitCommand });
+    reviewPublish = (await dispatchReviewPublish(reviewWorkspace, { requestedBy: actor, taskId, sha: deliveredSha, emit: emitCommand }));
   }
   const deliveryInput = {
       ...input,
@@ -617,9 +603,9 @@ export async function deliverTask(input: DeliverTaskInput, ctx: AuthContext): Pr
     const detail = getTaskDetail(taskId) ?? currentTask;
     if (detail) {
       emitTaskChanged(detail, "task.deliverable");
-      notifyDelivery(taskId, delivery.event.id, eventMeta ?? (delivery.event.metadata as unknown as TaskDeliverableEventMetadata), wantsLand && armOutcome === "armed");
+      await notifyDelivery(taskId, delivery.event.id, eventMeta ?? (delivery.event.metadata as unknown as TaskDeliverableEventMetadata), wantsLand && armOutcome === "armed");
       if (input.disposition === "failed") {
-        emitTaskSemanticNotification({ task: detail, transition: "gate-failed", actor, occurrenceKey: `event:${delivery.event.id}`, outcome: { disposition: "failed" } });
+        await emitTaskSemanticNotification({ task: detail, transition: "gate-failed", actor, occurrenceKey: `event:${delivery.event.id}`, outcome: { disposition: "failed" } });
       }
     }
   }
@@ -685,7 +671,7 @@ export async function deliverTask(input: DeliverTaskInput, ctx: AuthContext): Pr
     // into same-head `already-requested`; only terminal non-PR attempts qualify,
     // so a currently running merge or a PR waiting on GitHub is never doubled.
     const priorMerge = LAND_IN_FLIGHT_STATUSES.has(liveWorkspace.status)
-      ? findLatestCommandByCorrelation("workspace.merge", liveWorkspace.id)
+      ? await findLatestCommandByCorrelationAsync("workspace.merge", liveWorkspace.id)
       : null;
     const retryableMergePlan = mergeCommandNeedsRetry(priorMerge);
     const withdrawnLand = !hadLandAuthorization
@@ -697,7 +683,7 @@ export async function deliverTask(input: DeliverTaskInput, ctx: AuthContext): Pr
       // exhausted. applyWorkspaceAction clears the old retry incident before re-arming it.
       || retryableMergePlan || workspaceLandNeedsRearm(liveWorkspace) || withdrawnLand;
     if (reenterLand) {
-      markAgentWorkFinal(actor, "task-deliver");
+      (await markAgentWorkFinal(actor, "task-deliver"));
       const result = await applyWorkspaceAction(liveWorkspace, {
         action: "ready",
         agentId: actor,

package/src/services/task-dispatch.ts

@@ -105,6 +105,7 @@ export interface TaskDispatchSpawnInput {
   /** #3045 — the workflow run dispatching this step; #3091 the base profile its step pins, the run's checkout standing in
    *  for the Task's repo root, and the host its role is read on first. Service-only. */
   workflowRunId?: string;
+  workflowNames?: string[];
   workflowCaller?: SpawnAgentInput["workflowCaller"];
   roleProfile?: string;
   taskRepoCwd?: string;
@@ -139,6 +140,7 @@ export async function spawnTaskDispatch(input: TaskDispatchSpawnInput, ctx: Auth
       role,
       roleSha, roleSnapshot,
       workflowRunId,
+      workflowNames: input.workflowNames,
       workflowCaller: input.workflowCaller,
       roleProfile,
       taskRepoCwd,
@@ -173,6 +175,7 @@ export async function spawnTaskDispatch(input: TaskDispatchSpawnInput, ctx: Auth
     ...(decision ? { decision } : {}),
     ...(reviewTaskId !== undefined ? { reviewTaskId } : {}),
     ...(spawn.warnings ? { warnings: spawn.warnings } : {}),
+    ...(spawn.spawnPolicy ? { spawnPolicy: spawn.spawnPolicy } : {}),
     ...(verbose ? { command: summarizeSpawnCommandForCaller(spawn.command) } : {}),
   };
 }