@humwick/server 0.130.2 → 0.130.3

package/src/project-trust.ts

@@ -1,8 +1,9 @@
+import { upsertProjectTrustApprovalAsync } from "./db/runtime-tail-async";
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { shellEscape, ValidationError, type AgentProfile, type ProfileAssetCell, type ProfileProjectCells, type ProfileProjectGate, type ProfileProjectReviewMode, type ProfileProjectTrustScope, type Project } from "@humwick/sdk";
 import { rootsForProject, resolveProjectForCwd } from "./db/projects";
-import { getProjectTrustApproval, upsertProjectTrustApproval, type ProjectTrustApproval, type ProjectTrustCapability } from "./db/project-trust-approvals";
+import { getProjectTrustApproval, type ProjectTrustApproval, type ProjectTrustCapability } from "./db/project-trust-approvals";
 import { observeCapabilityReview } from "./project-trust-fingerprint";
 import { canonicalRoot } from "./services/canonical-root";
 import { isPathWithinBase } from "./utils";
@@ -35,26 +36,26 @@ function repoKeyFor(cwd: string): string {
 /** Records `approvedValue` (a `sha256:<hex>` or `commit:<sha>`, matching `mode`) as trusted for
  * this (profile, repo, capability) — the dashboard/API one-click approve action. Format-validated
  * here so a malformed value can never be written through the trust store's only public writer. */
-export function approveProjectCapabilityReview(input: {
+export async function approveProjectCapabilityReview(input: {
   profileName: string;
   repoKey: string;
   capability: ProjectCapability;
   mode: "fingerprint" | "commit";
   approvedValue: string;
   approvedBy: string;
-}): ProjectTrustApproval {
+}): Promise<ProjectTrustApproval> {
   const prefix = input.mode === "commit" ? "commit:" : "sha256:";
   if (!input.approvedValue.startsWith(prefix)) {
     throw new ValidationError(`approved value must be prefixed "${prefix}" for ${input.mode} review`);
   }
-  return upsertProjectTrustApproval({
+  return (await upsertProjectTrustApprovalAsync({
     profileName: input.profileName,
     repoKey: input.repoKey,
     capability: input.capability,
     reviewMode: input.mode,
     approvedValue: input.approvedValue,
     approvedBy: input.approvedBy,
-  });
+  }));
 }
 
 /** Stable JSON is intentionally local to this small trust seam. The hash is an
@@ -142,13 +143,13 @@ export interface ProjectCapabilityGateOpts {
   pinnedMcpCommit?: string;
 }
 
-export function projectCapabilityGate(
+export async function projectCapabilityGate(
   profile: AgentProfile,
   capability: ProjectCapability,
   cwd: string,
   registeredProject?: Project | null,
   opts?: ProjectCapabilityGateOpts,
-): ProfileProjectGate {
+): Promise<ProfileProjectGate> {
   const project = profile.sources?.project;
   const cell = capabilityCell(profile, capability);
   if (!project || !cell?.enabled) {
@@ -238,7 +239,7 @@ export function projectCapabilityGate(
       // approved instead of failing closed, so shipping G3 does not instantly regress every
       // already-trusted profile. Only a SUBSEQUENT change (a different observed value) fails
       // closed from here on.
-      upsertProjectTrustApproval({ profileName: profile.name, repoKey, capability, reviewMode: mode, approvedValue: observed, approvedBy: "system:grandfathered" });
+      (await upsertProjectTrustApprovalAsync({ profileName: profile.name, repoKey, capability, reviewMode: mode, approvedValue: observed, approvedBy: "system:grandfathered" }));
       return { allowed: true, reason: "allowed", detail: gateDetail(capability, `${scopeDetail} (grandfathered ${observed})`), observed, repoKey, reviewMode: mode };
     }
     // `commit` review has no grandfather: it is the stricter opt-in mode, so first encounter
@@ -254,9 +255,9 @@ export function projectCapabilityGate(
 /** Stamp the server's per-spawn decisions onto a cloned profile. The source cells
  * remain visible for truthful projection; the runner consumes only these decisions
  * for filesystem materialization. */
-export function applyProjectCapabilityGates(profile: AgentProfile, cwd: string, registeredProject?: Project | null, opts?: ProjectCapabilityGateOpts): AgentProfile {
+export async function applyProjectCapabilityGates(profile: AgentProfile, cwd: string, registeredProject?: Project | null, opts?: ProjectCapabilityGateOpts): Promise<AgentProfile> {
   if (!profile.sources?.project) return profile;
-  const hooks = projectCapabilityGate(profile, "hooks", cwd, registeredProject, opts);
-  const mcp = projectCapabilityGate(profile, "mcp", cwd, registeredProject, opts);
+  const hooks = (await projectCapabilityGate(profile, "hooks", cwd, registeredProject, opts));
+  const mcp = (await projectCapabilityGate(profile, "mcp", cwd, registeredProject, opts));
   return { ...profile, projectGates: { hooks, mcp } };
 }

package/src/prompt-resolver.ts

@@ -250,7 +250,7 @@ const DEFAULT_PROMPT_TEMPLATES = [
       "{{context}}",
       "Acceptance — done when:",
       "{{doneWhen}}",
-      "",
+      "{{afterLand}}",
       "Linked issue spec (resolved server-side once — do NOT re-read GitHub):",
       "{{issues}}",
       "",
@@ -275,7 +275,7 @@ const DEFAULT_PROMPT_TEMPLATES = [
       "{{context}}",
       "Acceptance — done when:",
       "{{doneWhen}}",
-      "",
+      "{{afterLand}}",
       "Linked issue spec (resolved server-side once — do NOT re-read GitHub):",
       "{{issues}}",
       "",
@@ -288,7 +288,7 @@ const DEFAULT_PROMPT_TEMPLATES = [
       "Latest steer (act on this now):",
       "{{steer}}",
     ),
-    variables: ["taskId", "title", "status", "stage", "owner", "intent", "context", "doneWhen", "issues", "decisions", "history", "memory", "steer"],
+    variables: ["taskId", "title", "status", "stage", "owner", "intent", "context", "doneWhen", "afterLand", "issues", "decisions", "history", "memory", "steer"],
   },
   {
     slug: "context.advisory.warn",

package/src/provider-quota-async.ts

@@ -51,27 +51,25 @@ export async function upsertProviderQuotaAsync(
  * Synchronous in-process compatibility wrapper for direct callers and existing tests. Runs the writer
  * body directly (no gateway hop) and fires the returned effects synchronously.
  */
-export function upsertProviderQuota(input: ProviderQuotaUpdateInput, now = Date.now()): ProviderQuotaRecord {
-  const result = upsertProviderQuotaInTx(input, now);
-  invalidateProviderQuotaMatrixCache();
+export async function upsertProviderQuota(input: ProviderQuotaUpdateInput, now = Date.now()): Promise<ProviderQuotaRecord> {
+  const result = await upsertProviderQuotaAsync(input, { now });
   if (result.outcome.kind !== "stored") throw new Error("provider quota lease not held");
-  deliverProviderQuotaEffects(result, { isolate: false });
   return result.outcome.record;
 }
 
 /** Fire each event+notification pair in production order; `isolate` logs (not throws) per-pair faults. */
-function deliverProviderQuotaEffects(result: ProviderQuotaUpsertOpResult, options: { isolate: boolean }): void {
+async function deliverProviderQuotaEffects(result: ProviderQuotaUpsertOpResult, options: { isolate: boolean }): Promise<void> {
   for (const effect of result.advisory?.effects ?? []) {
     if (options.isolate) {
       try {
         emitRelayEvent(effect.event);
-        if (effect.notification) routeNotification(effect.notification);
+        if (effect.notification) await routeNotification(effect.notification);
       } catch (error) {
         console.error("provider quota post-commit effect failed", error);
       }
     } else {
       emitRelayEvent(effect.event);
-      if (effect.notification) routeNotification(effect.notification);
+      if (effect.notification) await routeNotification(effect.notification);
     }
   }
 }

package/src/provider-timeline-event.ts

@@ -1,5 +1,5 @@
 import { isRecord, stringValue } from "@humwick/sdk";
-import { createActivityEventWithResult } from "./db";
+import { createActivityEventByClientIdAsync } from "./db/activity-async";
 import { emitRelayEvent } from "./events";
 
 interface HasMeta {
@@ -28,7 +28,7 @@ function numberValue(value: unknown): number | undefined {
   return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
 
-export function auditRunnerTimelineEvent(agentId: string, timelineEvent: ProviderTimelineEvent | null): void {
+export async function auditRunnerTimelineEvent(agentId: string, timelineEvent: ProviderTimelineEvent | null): Promise<void> {
   if (!timelineEvent) return;
   const metadata = isRecord(timelineEvent.metadata) ? timelineEvent.metadata : {};
   if (metadata.source !== "runner") return;
@@ -41,10 +41,7 @@ export function auditRunnerTimelineEvent(agentId: string, timelineEvent: Provide
   const body = stringValue(timelineEvent.body);
   const icon = stringValue(timelineEvent.icon) ?? "ti-activity";
   try {
-    // #1912 §4 retained: this runs inside the synchronous bus status-frame callback. Turning this
-    // into an unawaited gateway write would reorder/drop the audit relative to the frame; moving
-    // the whole hot status ingress is the later owner.
-    const result = createActivityEventWithResult({
+    const result = (await createActivityEventByClientIdAsync({
       clientId: `runner-timeline-${agentId}-${id}`,
       kind: "state",
       title,
@@ -60,7 +57,7 @@ export function auditRunnerTimelineEvent(agentId: string, timelineEvent: Provide
         timelineId: id,
         timelineTimestamp: timestamp,
       },
-    });
+    }));
     // A repeated frame may still carry the same event during reconnect/retry. The durable activity
     // clientId dedup is authoritative; only a newly inserted row owns an activity.created edge.
     if (!result.created) return;

package/src/quota-band-delivery.ts

@@ -6,8 +6,8 @@ import { getSpawnCapableAgentIds } from "./routing-policy-push";
 import { renderBandTransition } from "./quota-band-transition";
 import type { ProviderBandWindow, QuotaBand } from "./quota-band-projection";
 
-export function deliverBandTransition(input: { provider: string; window: ProviderBandWindow; previousBand: QuotaBand; recommendedAction: string; now: number }): void {
+export async function deliverBandTransition(input: { provider: string; window: ProviderBandWindow; previousBand: QuotaBand; recommendedAction: string; now: number }): Promise<void> {
   const effect = renderBandTransition(input, getSpawnCapableAgentIds());
   emitRelayEvent(effect.event);
-  if (effect.notification) routeNotification(effect.notification);
+  if (effect.notification) await routeNotification(effect.notification);
 }

package/src/recipe-runner.ts

@@ -1,6 +1,7 @@
+import { createCommandAsync } from "./commands-write";
 import { writeChildEnv } from "@humwick/sdk/env";
 import { randomUUID } from "node:crypto";
-import { createCommand, type CreateCommandWriteArgs } from "./commands-db";
+import { type CreateCommandWriteArgs } from "./commands-db";
 import { effectiveProviderCatalogListAsync, listOrchestrators } from "./db";
 import { resolveProviderSelection } from "@humwick/sdk/provider-catalog";
 import { getRecipeAsync } from "./recipe-loader";
@@ -148,13 +149,13 @@ export async function stopRecipe(instanceId: string, stoppedBy = "cli"): Promise
     // canceled by beginStop; a claimed one is already ordered before this stop and cannot be
     // targeted with an agent.shutdown command until its spawn result supplies a real agent id.
     if (agent.agentId.startsWith("pending:")) continue;
-    const command = createCommand({
+    const command = (await createCommandAsync({
       type: "agent.shutdown",
       source: stoppedBy,
       target: agent.agentId,
       params: { recipeInstanceId: instance.id, role: agent.role },
       ttlMs: 30_000,
-    });
+    }));
     commands.push(command);
     await updateRecipeAgentInstanceAsync(instance.id, agent.agentId, "stopping");
   }

package/src/retention-config-store.ts

@@ -1,4 +1,5 @@
-import { getConfig, setConfig } from "./config-store";
+import { setConfigAsync } from "./config-store-write";
+import { getConfig } from "./config-store";
 import {
   RETENTION_CONFIG_DEFAULTS,
   RETENTION_KEY,
@@ -27,6 +28,6 @@ export function getRetentionConfigEntry(): ConfigEntry<RetentionConfig> {
   };
 }
 
-export function setRetentionConfig(value: unknown, updatedBy?: string): ConfigEntry<RetentionConfig> {
-  return setConfig(RETENTION_NAMESPACE, RETENTION_KEY, value as RetentionConfig, updatedBy);
+export async function setRetentionConfig(value: unknown, updatedBy?: string): Promise<ConfigEntry<RetentionConfig>> {
+  return (await setConfigAsync(RETENTION_NAMESPACE, RETENTION_KEY, value as RetentionConfig, updatedBy));
 }

package/src/reviewer-pipeline.ts

@@ -1,6 +1,7 @@
+import { createCommandAsync } from "./commands-write";
 import { isRecord } from "@humwick/sdk";
 import { planSend } from "./agent-ref";
-import { createCommand } from "./commands-db";
+
 import { getSpawnPolicy } from "./config-store";
 import { deferLandSettleSideEffect } from "./land-settle-dispatch";
 import { getLifecycleManager } from "./lifecycle-manager";
@@ -68,7 +69,7 @@ export async function handleReviewerMergeResult(command: Command, result: Record
   // it must reach the reviewer even if they're offline a while — not a bystander notice. So, like the
   // landing receipt, it is written SYNCHRONOUSLY on the settle path; only the bystander announcement
   // ping and the eager spawn defer off the hot path below.
-  routeNotification({
+  await routeNotification({
     type: "workspace.review_request",
     scope: { workspaceId: workspace.id, repoRoot: workspace.repoRoot },
     recipients: [target],
@@ -102,8 +103,8 @@ export async function handleReviewerMergeResult(command: Command, result: Record
   // (`handleReviewerMergeResult` runs inside `settleWorkspaceMergeCommand`). They defer off the hot
   // path; the spawn self-heals via `reconcilePolicy` even if a deferred dispatch is missed, and the
   // review-request obligation it consumes is already durably queued synchronously above.
-  deferLandSettleSideEffect("reviewer-review-request", () => {
-    emitWorkspaceTaskSemanticNotifications({
+  deferLandSettleSideEffect("reviewer-review-request", async () => {
+    await emitWorkspaceTaskSemanticNotifications({
       workspace: reviewWorkspace,
       transition: "review-requested",
       actor: "reviewer-pipeline",
@@ -144,7 +145,7 @@ export async function handleReviewerPipelineScan(
 
   if (decision === "APPROVED") {
     if (!prNumber && !prUrl) return { skipped: "missing-pr" };
-    const command = createCommand({
+    const command = (await createCommandAsync({
       type: "workspace.pr-arm-auto-merge",
       source: "system",
       target: orchestratorAgentId,
@@ -161,7 +162,7 @@ export async function handleReviewerPipelineScan(
         requestedBy: "reviewer-pipeline",
         requestedAt: now,
       },
-    });
+    }));
     await patchWorkspaceMetadataAsync(workspace.id, {
       autoMergeArmed: true,
       autoMergeArmCommandId: command.id,
@@ -176,7 +177,7 @@ export async function handleReviewerPipelineScan(
     const last = text(workspace.metadata.lastReviewDecision);
     if (last === "CHANGES_REQUESTED") return { skipped: "changes-requested-already-notified" };
     const notifiedOwner = workspace.ownerAgentId
-      ? notifyReviewChangesRequested(workspace, preview, prUrl, prNumber)
+      ? await notifyReviewChangesRequested(workspace, preview, prUrl, prNumber)
       : undefined;
     await patchWorkspaceMetadataAsync(workspace.id, {
       lastReviewDecision: decision,
@@ -198,17 +199,17 @@ function workspaceActiveArm(workspace: WorkspaceRecord): boolean {
   return workspace.metadata.autoMergeArmed === true || typeof workspace.metadata.autoMergeArmCommandId === "string";
 }
 
-function notifyReviewChangesRequested(
+async function notifyReviewChangesRequested(
   workspace: WorkspaceRecord,
   preview: WorkspaceMergePreview,
   prUrl: string | undefined,
   prNumber: number | undefined,
-): string | undefined {
+): Promise<string | undefined> {
   const target = workspace.ownerAgentId;
   if (!target) return undefined;
   // Durable (ttl null): the owner must learn changes were requested on THEIR workspace even after
   // being offline — store-ahead, not a freshness-gated bystander notice.
-  routeNotification({
+  await routeNotification({
     type: "workspace.review_changes_requested",
     scope: { workspaceId: workspace.id, repoRoot: workspace.repoRoot, author: target },
     recipients: [target],

package/src/routes/_route.ts

@@ -1,7 +1,7 @@
 import { scopeResourceReads } from "./viewer-read";
-import { captureSyncFrame, runWithLoopCallsite } from "../loop-block-attribution";
+import { captureSyncFrame } from "../loop-block-attribution";
 import { withRelayEventDrain } from "../relay-event-drain";
-import { trackCaller } from "../hub-metrics";
+import { runInFrame } from "../hub-metrics";
 import { error, type Handler } from "./_shared";
 import type { LoopCallsiteContext } from "../loop-block-attribution";
 
@@ -42,8 +42,8 @@ export function runMatchedRoute(
   req: Request,
   finish: (response: Response) => Promise<Response>,
 ): Promise<Response> {
-  return runWithLoopCallsite(matched.loop.scope, () => trackCaller(matched.loop.scope.callsite, () => withRelayEventDrain(async () =>
-    finish(await captureSyncFrame(matched.loop.frame, () => matched.handler(req, matched.params))))));
+  return runInFrame(matched.loop.scope, () => withRelayEventDrain(async () =>
+    finish(await captureSyncFrame(matched.loop.frame, () => matched.handler(req, matched.params)))));
 }
 
 export function matchRoutes(

package/src/routes/_shared.ts

@@ -1,9 +1,10 @@
+import { sendMessageWithResultAsync } from "../db/message-send";
 import { hasPresentedCredential, relayHeader, canonicalHumanAgentId, DEFAULT_USER_ID, errMessage, fireAndForget, isHumanAgentId, isRecord, userIdFromAddress, userSinkId } from "@humwick/sdk";
 import { authorityDenied } from "../authority-audit";
 // Auto-split from routes.ts (#299). Domain: _shared.
 import { agentVisibleTo, visibleAgentIds, viewerScope, type ViewerScope } from "../db/viewer-scope";
 import { MAX_BODY_BYTES, getIntegrationTokens } from "../config";
-import { ValidationError, createActivityEventAsync, createCallbackDeliveryAsync, finishCallbackDeliveryAsync, getAgent, getTaskAsync, normalizeReactionEmoji, sendMessageWithResult } from "../db";
+import { ValidationError, createActivityEventAsync, createCallbackDeliveryAsync, finishCallbackDeliveryAsync, getAgent, getTaskAsync, normalizeReactionEmoji } from "../db";
 import { cleanEpoch, cleanString, optionalEnum } from "../validation";
 import { emitActivityEvent, emitMessageQueued, emitNewMessage } from "../sse";
 import { authorizeAgentForUser, type AgentAction } from "../agent-authz";
@@ -25,19 +26,19 @@ export const json = (data: unknown, status = 200) =>
 export const error = (msg: string, status = 400) =>
   json({ error: msg }, status);
 
-export function authorizeRoute(req: Request, check: Parameters<typeof isRequestAuthorizedFor>[1]): Response | null {
+export async function authorizeRoute(req: Request, check: Parameters<typeof isRequestAuthorizedFor>[1]): Promise<Response | null> {
   if (!hasPresentedCredential(req)) return null;
-  return isRequestAuthorizedFor(req, check) ? null : authorityDenied(req, "forbidden");
+  return isRequestAuthorizedFor(req, check) ? null : (await authorityDenied(req, "forbidden"));
 }
 
 /** A write about agent `agentId` by that agent's own credential: the agent, its agent:write check and the parsed body. */
 export async function agentWriteRequest(req: Request, agentId: string): Promise<{ agent: NonNullable<ReturnType<typeof getAgent>>; body: Record<string, unknown> } | Response> {
   const agent = getAgent(agentId);
   if (!agent) return error("agent not found", 404);
-  const denied = authorizeRoute(req, {
+  const denied = (await authorizeRoute(req, {
     scope: "agent:write",
     resource: { agentId: agent.id, policyName: metaString(agent.meta, "policyName"), spawnRequestId: metaString(agent.meta, "spawnRequestId") },
-  });
+  }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -49,9 +50,9 @@ export async function agentWriteRequest(req: Request, agentId: string): Promise<
 // `command:fleet`-scoped token is authorized here without the sandbox constraint; every other
 // caller falls back to the normal constrained `command:write` check. Use ONLY at those three call
 // sites — everywhere else must keep going through `authorizeRoute`.
-export function authorizeFleetRoute(req: Request, resource?: Parameters<typeof isFleetActionAuthorized>[1]): Response | null {
+export async function authorizeFleetRoute(req: Request, resource?: Parameters<typeof isFleetActionAuthorized>[1]): Promise<Response | null> {
   if (!hasPresentedCredential(req)) return null;
-  return isFleetActionAuthorized(req, resource) ? null : authorityDenied(req, "forbidden");
+  return isFleetActionAuthorized(req, resource) ? null : (await authorityDenied(req, "forbidden"));
 }
 
 export function authAuditMetadata(req: Request): Record<string, unknown> {
@@ -181,8 +182,8 @@ export function requestUserAddress(req: Request): string {
  * Single-user worlds fail-open inside {@link authorizeAgentForUser}, so existing routes are
  * unchanged until #389 upgrades {@link requestUserId} to the real session user.
  */
-export function authorizeAgentRoute(req: Request, agentId: string, action: AgentAction, auditAction: string = action): Response | null {
-  return authorizeAgentForUser(requestUserId(req), agentId, action) ? null : authorityDenied(req, "agent visibility or role", 403, agentId, auditAction);
+export async function authorizeAgentRoute(req: Request, agentId: string, action: AgentAction, auditAction: string = action): Promise<Response | null> {
+  return authorizeAgentForUser(requestUserId(req), agentId, action) ? null : (await authorityDenied(req, "agent visibility or role", 403, agentId, auditAction));
 }
 
 /** Machine callers retain their existing reach; user sessions share one read scope. */
@@ -468,7 +469,7 @@ function reactionNotificationSender(parent: Message, actorId: string): string {
   return parent.channel && getAgent(parent.channel) ? parent.channel : "user";
 }
 
-export function sendReactionNotificationToAuthor(parent: Message, actorId: string, emoji: string, action: "add" | "remove"): void {
+export async function sendReactionNotificationToAuthor(parent: Message, actorId: string, emoji: string, action: "add" | "remove"): Promise<void> {
   if (isHumanAgentId(parent.from) || parent.from === "system") return;
   const targetAgent = getAgent(parent.from);
   if (!targetAgent || targetAgent.kind === "channel") return;
@@ -477,7 +478,7 @@ export function sendReactionNotificationToAuthor(parent: Message, actorId: strin
   const now = Date.now();
   const actor = reactionActorView(actorId);
   const verb = action === "remove" ? "removed reaction" : "reacted";
-  const result = sendMessageWithResult({
+  const result = (await sendMessageWithResultAsync({
     from,
     to: parent.from,
     kind: "system",
@@ -505,7 +506,7 @@ export function sendReactionNotificationToAuthor(parent: Message, actorId: strin
         },
       },
     },
-  });
+  }));
   if (result.created) {
     if (result.message.deliveryStatus === "queued") emitMessageQueued(result.message);
     else emitNewMessage(result.message);

package/src/routes/agent-effort.ts

@@ -13,12 +13,12 @@ import { agentWriteRequest, authAuditMetadata, authorizeAgentRoute, authorizeRou
 export async function postAgentEffortAction(req: Request, agentId: string, body: Record<string, unknown>): Promise<Response> {
   const agent = getAgent(agentId);
   if (!agent) return error("agent not found", 404);
-  const driveDenied = authorizeAgentRoute(req, agent.id, "drive", "effort");
+  const driveDenied = (await authorizeAgentRoute(req, agent.id, "drive", "effort"));
   if (driveDenied) return driveDenied;
-  const denied = authorizeRoute(req, {
+  const denied = (await authorizeRoute(req, {
     scope: "agent:write",
     resource: { agentId: agent.id, policyName: metaString(agent.meta, "policyName"), spawnRequestId: metaString(agent.meta, "spawnRequestId") },
-  });
+  }));
   if (denied) return denied;
   try {
     const result = await dispatchAgentAction({
@@ -54,12 +54,12 @@ export const postAgentEffortObservedRoute: Handler = async (req, params) => {
   try {
     const version = body.version;
     if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) throw new ValidationError("version must be a positive integer");
-    const observed = reportEffortObserved(agent.id, {
+    const observed = (await reportEffortObserved(agent.id, {
       instanceId: cleanString(body.instanceId, "instanceId", { required: true, max: 200 })!,
       version,
       effort: cleanString(body.effort, "effort", { required: true, max: 32 })!,
       previousEffort: cleanString(body.previousEffort, "previousEffort", { max: 32 }) ?? null,
-    });
+    }));
     return json(observed);
   } catch (e) {
     if (e instanceof ValidationError || e instanceof EffortReportRejected) return error(e.message, 400);

package/src/routes/agent-heartbeat-quota.ts

@@ -0,0 +1,23 @@
+import type { HeartbeatResult, ProviderQuotaUpdateInput } from "@humwick/sdk";
+import { acquireProviderQuotaLeaseAsync } from "../db";
+import { getProviderQuotaConfig } from "../provider-quota-config-store";
+import { upsertProviderQuotaAsync } from "../provider-quota-async";
+import { emitRelayEvent } from "../events";
+
+/** Same lease and writer as standalone quota reports, with config resolved on the hub (#3608). */
+export async function publishHeartbeatQuota(input: ProviderQuotaUpdateInput, leaseToken?: string): Promise<NonNullable<HeartbeatResult["providerQuota"]>> {
+  const config = getProviderQuotaConfig(input.provider);
+  if (!config.enabled) return { reported: false, retryAfterMs: 60_000 };
+  const holder = `runner:${input.sourceAgentId}`;
+  const lease = await acquireProviderQuotaLeaseAsync({
+    provider: input.provider, accountKey: input.accountKey, orchestratorId: holder, leaseToken,
+    ttlMs: Math.min(10 * 60_000, config.pollIntervalMs + 60_000),
+  });
+  if (!lease.acquired || !lease.lease) return { reported: false, retryAfterMs: Math.min(lease.retryAfterMs ?? config.pollIntervalMs, config.pollIntervalMs) };
+  const result = await upsertProviderQuotaAsync(input, { requiredLeaseHolder: holder });
+  if (result.outcome.kind === "stored") {
+    const record = result.outcome.record;
+    emitRelayEvent({ type: "provider-quota.updated", source: "server", subject: `${record.provider}:${record.accountKey}`, data: {} });
+  }
+  return { reported: result.outcome.kind === "stored", retryAfterMs: config.pollIntervalMs, leaseToken: lease.lease.leaseToken };
+}

package/src/routes/agent-keep.ts

@@ -9,7 +9,7 @@ export const putAgentKeep: Handler = async (req, params) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   if (!isRecord(parsed.body)) return error("keep required");
-  const denied = authorizeRoute(req, { scope: "agent:write" });
+  const denied = (await authorizeRoute(req, { scope: "agent:write" }));
   if (denied) return denied;
   try {
     const result = await setAgentKeep({

package/src/routes/agent-reporting.ts

@@ -6,7 +6,7 @@ import { cleanString } from "../validation";
 import { authorizeAgentRoute, authorizeRoute, error, json } from "./_shared";
 
 export async function postAgentReportingAction(req: Request, agentId: string, body: Record<string, unknown>): Promise<Response> {
-  const denied = authorizeAgentRoute(req, agentId, "drive") ?? authorizeRoute(req, { scope: "agent:write", resource: { agentId } });
+  const denied = (await authorizeAgentRoute(req, agentId, "drive")) ?? (await authorizeRoute(req, { scope: "agent:write", resource: { agentId } }));
   if (denied) return denied;
   try {
     return json({ ok: true, ...await setAgentReportVerbosity({ agentId, reportVerbosity: body.reportVerbosity, reason: cleanString(body.reason, "reason", { max: 500 }), requestedVia: "http" }, authContextFromRequest(req)) });

package/src/routes/agent-self-effort.ts

@@ -9,10 +9,10 @@ import { ShutdownAuthError, ShutdownTargetError } from "../services/shutdown-age
 import { authAuditMetadata, authorizeAgentRoute, authorizeRoute, dashboardAttribution, error, json, metaString, parseBody, requestUserAddress, type Handler } from "./_shared";
 import { isRecord } from "../types";
 
-export const getAgentSelfEffort: Handler = (req, params) => {
+export const getAgentSelfEffort: Handler = async (req, params) => {
   const agent = getAgent(params.id!);
   if (!agent) return error("agent not found", 404);
-  const denied = authorizeAgentRoute(req, agent.id, "view");
+  const denied = (await authorizeAgentRoute(req, agent.id, "view"));
   if (denied) return denied;
   return json({ agentId: agent.id, selfEffort: spawnSelfEffortPolicy(agent) ?? null });
 };
@@ -24,12 +24,12 @@ export const putAgentSelfEffort: Handler = async (req, params) => {
   const body = parsed.body;
   const agent = getAgent(params.id!);
   if (!agent) return error("agent not found", 404);
-  const driveDenied = authorizeAgentRoute(req, agent.id, "drive");
+  const driveDenied = (await authorizeAgentRoute(req, agent.id, "drive"));
   if (driveDenied) return driveDenied;
-  const denied = authorizeRoute(req, {
+  const denied = (await authorizeRoute(req, {
     scope: "agent:write",
     resource: { agentId: agent.id, policyName: metaString(agent.meta, "policyName"), spawnRequestId: metaString(agent.meta, "spawnRequestId") },
-  });
+  }));
   if (denied) return denied;
   try {
     const result = await grantSelfEffort({