@humwick/server 0.130.2 → 0.130.3

package/src/services/provisioning-harness/prepare.ts

@@ -1,10 +1,9 @@
-import {
-  addProjectRoot,
-  ensureProject,
-  upsertOrchestrator,
-  writeProjectEntry,
-} from "../../db";
-import { setAgentProfile } from "../../config-store";
+import { setAgentProfileAsync } from "../../config-store-write";
+import { writeProjectEntryAsync } from "../../db/project-entries-async";
+import { ensureProjectAsync, addProjectRootAsync } from "../../db/projects-async";
+import { upsertOrchestratorAsync } from "../../db/orchestrators-async";
+
+
 import { upsertHostFromRegistrationInternal } from "../../db/hosts-registration";
 import { parseMemorySeam } from "../../memory-seam";
 import type { AgentProfile, Command } from "../../types";
@@ -17,8 +16,8 @@ import type { MemoryFixture, ProvisioningDriverRequest } from "./types";
 export const HARNESS_ORCHESTRATOR_ID = "provisioning-harness";
 export const HARNESS_HOST = "harness-host";
 
-export function seedHarnessHost(cwd: string): void {
-  upsertOrchestrator({ id: HARNESS_ORCHESTRATOR_ID, hostname: HARNESS_HOST, providers: ["claude", "codex"], baseDir: cwd });
+export async function seedHarnessHost(cwd: string): Promise<void> {
+  (await upsertOrchestratorAsync({ id: HARNESS_ORCHESTRATOR_ID, hostname: HARNESS_HOST, providers: ["claude", "codex"], baseDir: cwd }));
   upsertHostFromRegistrationInternal({ orchestratorId: HARNESS_ORCHESTRATOR_ID, hostname: HARNESS_HOST,
     hardware: { platform: "linux", arch: "x64", cpuThreads: 8, totalMemMb: 16384 } }, 1_700_000_000_000);
 }
@@ -33,13 +32,13 @@ function defaults(profile: string): MemoryFixture[] {
   ];
 }
 
-export function seedMemory(cwd: string, request: ProvisioningDriverRequest): void {
+export async function seedMemory(cwd: string, request: ProvisioningDriverRequest): Promise<void> {
   const { profile } = request.scenario;
-  const project = ensureProject({ slug: "provisioning-harness", title: "Provisioning harness" });
-  addProjectRoot(project.id, cwd);
+  const project = (await ensureProjectAsync({ slug: "provisioning-harness", title: "Provisioning harness" }));
+  (await addProjectRootAsync(project.id, cwd));
   for (const fixture of request.scenario.fixtures?.memory ?? defaults(profile)) {
     if (fixture.cell !== "project") throw new Error("Only project knowledge fixtures are supported");
-    writeProjectEntry({
+    (await writeProjectEntryAsync({
       projectId: project.id,
       kind: "rule",
       title: fixture.title,
@@ -49,7 +48,7 @@ export function seedMemory(cwd: string, request: ProvisioningDriverRequest): voi
       originRef: fixture.originRef ?? `harness:${fixture.id}`,
       audience: fixture.audience ?? "all",
       inject: fixture.inject ?? "pinned",
-    });
+    }));
   }
 }
 
@@ -69,10 +68,10 @@ export async function prepareProvisioningSpawn(request: ProvisioningDriverReques
     (error as Error & { code: string }).code = "PROVISIONING_SPAWN_INPUT_REJECTED";
     throw error;
   }
-  seedHarnessHost(scenario.cwd);
-  seedMemory(scenario.cwd, request);
+  (await seedHarnessHost(scenario.cwd));
+  (await seedMemory(scenario.cwd, request));
   if (scenario.profileOverride) {
-    setAgentProfile({ name: scenario.profile, ...scenario.profileOverride } as AgentProfile, "provisioning-harness", { overrideBuiltIn: true });
+    (await setAgentProfileAsync({ name: scenario.profile, ...scenario.profileOverride } as AgentProfile, "provisioning-harness", { overrideBuiltIn: true }));
   }
   const spawnRequestId = `sp_harness_${scenario.id.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 56)}`;
   const result = await spawnAgent({

package/src/services/rate-limit-resume.ts

@@ -1,6 +1,7 @@
+import { mergeAgentMetaAsync } from "../db/agents-async";
 import { relayEnv } from "@humwick/sdk/env";
 import { PROXY_AUTH_HOLD_KIND } from "@humwick/sdk";
-import { createActivityEventAsync, getAgent, mergeAgentMeta } from "../db";
+import { createActivityEventAsync, getAgent } from "../db";
 import { listRateLimitHoldCandidates } from "../db/agent-card-read";
 import { withBufferedPresence } from "../db/presence-buffer";
 import { rateLimitFallbackMs } from "../config";
@@ -72,10 +73,10 @@ function nextTransientState(state: ProviderState, now: number, attempts: number)
   };
 }
 
-function notifyTransientExhausted(agent: { id: string; label?: string | null; spawnedBy?: string | null }, state: ProviderState, now: number): void {
-  mergeAgentMeta(agent.id, { providerState: { ...state, exhaustedAt: now, updatedAt: now } });
+async function notifyTransientExhausted(agent: { id: string; label?: string | null; spawnedBy?: string | null }, state: ProviderState, now: number): Promise<void> {
+  (await mergeAgentMetaAsync(agent.id, { providerState: { ...state, exhaustedAt: now, updatedAt: now } }));
   if (!agent.spawnedBy) return;
-  routeNotification({
+  await routeNotification({
     type: "agent.provider_blocked",
     scope: { agentId: agent.id, parent: agent.spawnedBy },
     recipients: [agent.spawnedBy],
@@ -126,7 +127,7 @@ export async function resumeRateLimitedAgents(context: { signal?: AbortSignal }
     const persistedExhaustedAt = typeof state.exhaustedAt === "number" && Number.isFinite(state.exhaustedAt) ? state.exhaustedAt : undefined;
     const justExhausted = exhausted && !tracked.exhaustedNotified && persistedExhaustedAt === undefined;
     if (justExhausted) {
-      notifyTransientExhausted(agent, state, now);
+      await notifyTransientExhausted(agent, state, now);
       resumeTracker.set(agent.id, { ...tracked, attempts, exhaustedNotified: true });
     }
     // #2619 — exhausting the fast backoff must never become a permanent, silent stop (an agent
@@ -141,7 +142,7 @@ export async function resumeRateLimitedAgents(context: { signal?: AbortSignal }
     try {
       // Short default TTL (per-type): a "limit reset, resume" push is pointless once stale — the
       // window has moved on. One recipient per iteration keeps the per-agent rollback below intact.
-      routeNotification({
+      await routeNotification({
         type: "agent.rate_limit_resume",
         scope: { agentId: agent.id },
         recipients: [agent.id],
@@ -166,17 +167,17 @@ export async function resumeRateLimitedAgents(context: { signal?: AbortSignal }
       continue;
     }
 
-    if (transient && !exhausted) mergeAgentMeta(agent.id, { providerState: nextTransientState(state, now, attempts) });
+    if (transient && !exhausted) (await mergeAgentMetaAsync(agent.id, { providerState: nextTransientState(state, now, attempts) }));
     // #2619 — persist every exhausted-mode probe, so a relay restart after probe N keeps the
     // clock (lastProbe reads state.lastResumeAt). Re-read: the exhaustion notice above may have
     // just persisted exhaustedAt, which must survive (never re-stamped).
     else if (exhausted) {
       const current = agentProviderState(getAgent(agent.id)) ?? state;
-      mergeAgentMeta(agent.id, { providerState: { ...current, lastResumeAt: now, updatedAt: now } });
+      (await mergeAgentMetaAsync(agent.id, { providerState: { ...current, lastResumeAt: now, updatedAt: now } }));
     }
 
     // #416 — flush messages queued while the agent was rate-limited.
-    flushQueuedDirectMessages(agent.id);
+    (await flushQueuedDirectMessages(agent.id));
     // The held-agent card and provider state above are the accepted resume snapshot. Persist its
     // audit before admitting the next agent, so concurrent provider updates cannot relabel it.
     await beforeRateLimitResumeAuditForTests?.(agent.id);

package/src/services/red-main-auto-revert.ts

@@ -1,11 +1,13 @@
+import { upsertWorkspaceAsync } from "../db/runtime-admin-async";
 import { relayEnv } from "@humwick/sdk/env";
 import { createHash } from "node:crypto";
 import type { LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
 import { errMessage, isRecord, stringValue, type Command } from "@humwick/sdk";
-import { findCommandByCorrelationId, findLatestCommandByCorrelation } from "../commands-db";
+import { findCommandByCorrelationId } from "../commands-db";
+import { findLatestCommandByCorrelationAsync } from "../commands-write";
 import { getCommandAsync } from "../commands-write";
 import { isTerminalCommandStatus } from "../db/command-terminal-status";
-import { getWorkspace, upsertWorkspace } from "../db/workspaces";
+import { getWorkspace } from "../db/workspaces";
 import { landBoundaryById, landBoundaryForCommand, redMainIncidentById } from "../db/land-boundaries";
 import { readFailedTestFiles } from "../ci/failed-test-files";
 import type { GitHubApi } from "../issue-tracker/github";
@@ -70,13 +72,13 @@ async function advanceAutomaticRevert(incident: RedMainIncident, boundary: LandB
 /** One direct, pinned, gated land per prepared red-main workspace: the revert's or the quarantine's. */
 export async function landRedMainWorkspace(id: string, boundary: LandBoundary, prepared: Record<string, unknown>,
   metadata: Record<string, unknown>, recoveryTestFiles?: string[]): Promise<Command> {
-  const existing = findLatestCommandByCorrelation("workspace.merge", id);
+  const existing = await findLatestCommandByCorrelationAsync("workspace.merge", id);
   if (existing) return existing;
   const source = getWorkspace(boundary.workspaceId)!;
-  const workspace = getWorkspace(id) ?? upsertWorkspace({ id, repoRoot: source.repoRoot, sourceCwd: source.repoRoot,
+  const workspace = getWorkspace(id) ?? (await upsertWorkspaceAsync({ id, repoRoot: source.repoRoot, sourceCwd: source.repoRoot,
     worktreePath: String(prepared.worktreePath), branch: String(prepared.branch), baseRef: boundary.baseRef,
     baseSha: String(prepared.baseSha), mode: "isolated", status: "ready", orchestratorId: source.orchestratorId,
-    metadata: { ...metadata, landStrategy: "direct" } });
+    metadata: { ...metadata, landStrategy: "direct" } }));
   const requested = await requestWorkspaceMerge(workspace, { requestedBy: "red-main-controller", strategy: "direct",
     expectedHeadSha: String(prepared.headSha), deleteBranch: true, ...(recoveryTestFiles ? { recoveryTestFiles } : {}) });
   if (!requested.ok) throw new Error(requested.error);

package/src/services/red-main-controller-deps.ts

@@ -1,8 +1,8 @@
 // #3363 — the red-main controller's production deps: GitHub for CI verdicts and reruns, Tasks and
 // messages for escalation. Every CI observation uses the boundary's authoritative watch snapshot.
-import type { LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
+import { MAX_INCIDENT_FAILING_TESTS, type LandBoundary, type RedMainIncident } from "@humwick/kernel/landing-incident";
 import { cleanLandGatesConfigFull } from "@humwick/sdk/land-gates";
-import { isRecord } from "@humwick/sdk";
+import { ciRunUrl, errMessage, isRecord } from "@humwick/sdk";
 import { judgeExactSha, rerunBoundaryCi, type BoundaryCiObservation } from "../ci/land-boundary-ci.ts";
 import { type GitHubRepository } from "../ci/monitor.ts";
 import { getTaskDetailAsync } from "../db/task-entity-async.ts";
@@ -12,6 +12,8 @@ import { sendMessageServiceAsync } from "./send-message.ts";
 import { setTaskEntityStatusAsync } from "./task-entity.ts";
 import { automaticRedMainQuarantine } from "./red-main-quarantine";
 import { automaticRedMainRevert, automaticRevertOutcome } from "./red-main-auto-revert";
+import { readFailedTestCases } from "../ci/failed-test-files.ts";
+import { recordRedMainIncidentFailures } from "./red-main-incident.ts";
 
 /** Twice a typical main CI run: a run missing or cancelled past this leaves its boundary unverified. */
 export const RED_MAIN_GRACE_MS = 60 * 60_000;
@@ -31,6 +33,20 @@ function describe(incident: RedMainIncident, observation: BoundaryCiObservation)
   return `Red main confirmed on lane ${incident.laneKey} (incident ${incident.id}): the re-run did not produce a successful verdict.${jobs}${observation.runUrl ? ` Run: ${observation.runUrl}` : ""}`;
 }
 
+/** #3362 §11: the confirmed attempt's failing cases; a rerun that never produced logs falls back to the first failure.
+ *  Best effort, read once: unreadable logs record nothing, so delivery gates hold nothing and every failure blocks. */
+export async function recordIncidentFailingTests(incident: RedMainIncident, boundary: LandBoundary, attempt: number, api: GitHubApi): Promise<void> {
+  let cases;
+  try {
+    cases = await readFailedTestCases(boundary, incident.ciRunId, attempt, api);
+    if (!cases.length && attempt > 1) cases = await readFailedTestCases(boundary, incident.ciRunId, attempt - 1, api);
+  } catch (error) {
+    console.warn(`[red-main] ${incident.id}: failing cases unreadable; none recorded: ${errMessage(error)}`);
+    return;
+  }
+  await recordRedMainIncidentFailures(incident.id, cases.slice(0, MAX_INCIDENT_FAILING_TESTS).map(({ file, name }) => ({ file, name })));
+}
+
 export function createRedMainControllerDeps(api: GitHubApi = ghApi, now: () => number = Date.now): RedMainControllerDeps {
   return {
     now,
@@ -62,10 +78,11 @@ export function createRedMainControllerDeps(api: GitHubApi = ghApi, now: () => n
       if (!incident) throw new Error(`Effect ${effect.key} needs its incident`);
       if (effect.kind === "auto-revert") return incident.mainFailurePolicy === "advisory" ? undefined : automaticRedMainRevert(incident, boundary, api);
       if (effect.kind === "quarantine") return automaticRedMainQuarantine(incident, boundary, effect, api);
+      if (effect.kind === "record-failures") return recordIncidentFailingTests(incident, boundary, effect.attempt, api);
       const task = await getTaskDetailAsync(effect.taskId);
       if (!task) throw new Error(`Effect ${effect.key}: T${effect.taskId} is missing`);
       const observation: BoundaryCiObservation = { status: "failure", runId: incident.ciRunId,
-        runUrl: `https://github.com/${boundary.remote}/actions/runs/${incident.ciRunId}/attempts/${incident.ciAttempt}` };
+        runUrl: ciRunUrl(boundary.remote, incident.ciRunId, incident.ciAttempt) };
       const advisory = incident.mainFailurePolicy === "advisory";
       const note = describe(incident, observation);
       if (effect.kind === "reopen-task") {

package/src/services/red-main-incident.ts

@@ -1,7 +1,7 @@
 // #3363 — server seam for the Kernel landing boundary and red-main incident ops
 // (kernel/landing-incident.ts). Every write goes through the singleton landing module host.
 import { landing } from "@humwick/kernel/landing";
-import type { IncidentEffect, IncidentState, LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
+import type { IncidentEffect, IncidentFailingTest, IncidentState, LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
 import { activeLandCommandIdForWorkspace } from "../db/land-incident-eligibility.ts";
 import { startKernelLandingIngress } from "./kernel-landing-ingress.ts";
 
@@ -26,6 +26,8 @@ export const transitionRedMainIncident = (input: { id: string; from: IncidentSta
 export const settleRedMainIncidentEffect = (id: string, key: string) =>
   invoke<RedMainIncident>("settleIncidentEffect", { id, key });
 export const ensureRedMainIncidentEffects = (id: string) => invoke<RedMainIncident>("ensureIncidentEffects", { id });
+export const recordRedMainIncidentFailures = (id: string, failingTests: IncidentFailingTest[]) =>
+  invoke<RedMainIncident>("recordIncidentFailures", { id, failingTests });
 export const failAutomaticRedMainRevert = (id: string, reason: string) => invoke<RedMainIncident>("failAutomaticRevert", { id, reason });
 export const queueBoundaryRerun = (id: string, effect: IncidentEffect) => invoke<LandBoundary>("queueBoundaryRerun", { id, effect });
 export const settleBoundaryEffect = (id: string, key: string) => invoke<LandBoundary>("settleBoundaryEffect", { id, key });

package/src/services/red-main-quarantine.ts

@@ -4,7 +4,7 @@
 // like any change, and the list's issue gets the audit record. Anything short of that becomes a Task.
 import { createHash } from "node:crypto";
 import type { IncidentEffect, LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
-import { isRecord, stringValue } from "@humwick/sdk";
+import { ciRunUrl, isRecord, stringValue } from "@humwick/sdk";
 import { readFailedTestCases } from "../ci/failed-test-files";
 import { findCommandByCorrelationId } from "../commands-db";
 import { isTerminalCommandStatus } from "../db/command-terminal-status";
@@ -19,8 +19,7 @@ type Case = { id?: string; file: string; name: string; why?: string };
 
 export const automaticQuarantineWorkspaceId = (id: string) => `red-main-q-${createHash("sha256").update(id).digest("hex").slice(0, 24)}`;
 const prepareKey = (id: string) => `kcmd:red-main:${id}:prepare-quarantine`;
-const runUrl = (boundary: LandBoundary, incident: RedMainIncident, attempt?: number) =>
-  `https://github.com/${boundary.remote}/actions/runs/${incident.ciRunId}${attempt ? `/attempts/${attempt}` : ""}`;
+const runUrl = (boundary: LandBoundary, incident: RedMainIncident, attempt?: number) => ciRunUrl(boundary.remote, incident.ciRunId, attempt);
 
 function evidence(incident: RedMainIncident, boundary: LandBoundary, attempt: number): string {
   const failed = `main ${boundary.landedTipSha.slice(0, 12)} run ${incident.ciRunId} attempt ${attempt} failed`;

package/src/services/register-agent.ts

@@ -1,3 +1,4 @@
+import { stampSpawnPrincipalAsync, markSpawnRegistrationConfirmedAsync, seedSpawnPromptMirrorAsync } from "../db/lifecycle-tail-async";
 // Transport convergence (epic #342, slice #345) — the agent-registration service.
 //
 // ONE home for "an agent registered" — previously inlined in HTTP `postAgent` and
@@ -11,14 +12,13 @@
 // the first-registration audit row.
 import { errMessage, fireAndForget, isReservedAgentId } from "@humwick/sdk";
 import { normalizeAgentSystemTags } from "../agent-system-tags";
-import { ValidationError, agentPrincipalUserId, stampSpawnPrincipal, createActivityEvent, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, readSpawnRegistrationMeta, seedSpawnPromptMirror, seedSpawnReplyObligation, spawnRegistrationMeta, upsertAgent } from "../db";
+import { ValidationError, agentPrincipalUserId, createActivityEventAsync, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, readSpawnRegistrationMeta, seedSpawnReplyObligation, spawnRegistrationMeta, upsertAgentAsync } from "../db";
 import { readSpawnSystemTags } from "../commands-db";
 import { channelProviderForInput, expectedChannelAgentId } from "../db/channel-identity";
 import { emitAgentStatus, emitNewMessage } from "../sse";
 import { noteAgentTimelineEvent } from "../compaction-watch";
 import { agentProviderTimelineEvent } from "../provider-timeline-event";
 import { notifyAgentReady, notifyAgentRegistered } from "../agent-lifecycle-events";
-import { markSpawnRegistrationConfirmed } from "../commands-db";
 import { resolveSpawnLineage, resolveTeamLineage } from "../security";
 import { flushQueuedDirectMessages, markManagedAgentRunning } from "./managed-running";
 import { acquireTeamOnReady } from "./team";
@@ -56,7 +56,7 @@ function taskIdsForReadyAgent(agent: AgentCard): number[] {
   return [...ids].sort((a, b) => a - b);
 }
 
-export function bindSpawnedTaskToReadyAgent(agentId: string, actor = "agent-relay"): void {
+export async function bindSpawnedTaskToReadyAgent(agentId: string, actor = "agent-relay"): Promise<void> {
   const agent = getAgent(agentId);
   if (!agent?.ready || isSpawnIntentCanceled(agent.meta?.spawnRequestId)) return;
   const taskIds = taskIdsForReadyAgent(agent);
@@ -67,9 +67,9 @@ export function bindSpawnedTaskToReadyAgent(agentId: string, actor = "agent-rela
       if (before.ownerAgentId && before.ownerAgentId !== agent.id && getAgent(before.ownerAgentId)?.status !== "offline") continue;
       const assigned = before.ownerAgentId === agent.id
         ? before
-        : assignTaskEntityAgent(taskId, agent.id, "worker", agent.spawnedBy ?? actor);
+        : (await assignTaskEntityAgent(taskId, agent.id, "worker", agent.spawnedBy ?? actor));
       if (assigned.status === "open" || assigned.status === "claimed" || assigned.status === "orphaned") {
-        setTaskEntityStatus(taskId, {
+        await setTaskEntityStatus(taskId, {
           status: "in_progress",
           note: `worker ${agent.id} ready`,
           actor: agent.spawnedBy ?? actor,
@@ -90,9 +90,9 @@ export function bindSpawnedTaskToReadyAgent(agentId: string, actor = "agent-rela
  * regardless of which transport carried it — a child readied only over the bus used to die
  * unstamped and get reaped as `agent.spawn_failed`.
  */
-export function announceSpawnedAgentReady(agentId: string, actor = "agent-relay"): void {
-  notifyAgentReady(agentId);
-  bindSpawnedTaskToReadyAgent(agentId, actor);
+export async function announceSpawnedAgentReady(agentId: string, actor = "agent-relay"): Promise<void> {
+  await notifyAgentReady(agentId);
+  await bindSpawnedTaskToReadyAgent(agentId, actor);
 }
 
 /** The PRIVILEGED principals that bypass the registration gates — an explicit allowlist, so a
@@ -238,7 +238,7 @@ function serverRecordedApprovalMode(agentId: string, ctx: AuthContext): SpawnApp
   return undefined;
 }
 
-export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, options: { emitStatus?: boolean } = {}): AgentCard {
+export async function registerAgent(input: RegisterAgentInput, ctx: AuthContext, options: { emitStatus?: boolean } = {}): Promise<AgentCard> {
   // Reserved built-in identities — the `system` lifecycle sender and the whole `user:` human
   // namespace (legacy bare `'user'`, `user:default`, every `user:<id>`) — are mechanical sinks,
   // never registrable agents. THIS is the one external-registration boundary (HTTP `postAgent`
@@ -358,7 +358,7 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, optio
   if (Object.keys(spawnMeta).length) registrationInput.meta = { ...registrationInput.meta, ...spawnMeta };
   const rawSpawnSystemTags = readSpawnSystemTags(registeringSpawnRequestId, registrationInput.id);
   const spawnSystemTags = rawSpawnSystemTags === undefined ? undefined : normalizeAgentSystemTags(rawSpawnSystemTags);
-  const agent = upsertAgent(registrationInput, {
+  const agent = await upsertAgentAsync(registrationInput, {
     verifiedSpawnRequestId: ctx.constraints?.spawnRequestIds?.length === 1 ? ctx.constraints.spawnRequestIds[0] : undefined,
     ...(verifiedKeepJti ? { verifiedKeepJtis: [verifiedKeepJti] } : {}),
     ...(spawnSystemTags !== undefined ? { systemTags: spawnSystemTags } : {}),
@@ -366,20 +366,20 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, optio
   // #3567 — a first registration or a new generation records its principal (a reconnect has
   // nothing new to stamp): the spawn's principal, else the registering caller's.
   if (!existing || metaStr(existing.meta, "spawnRequestId") !== registeringSpawnRequestId) {
-    stampSpawnPrincipal(agent.id, registeringSpawnRequestId, registeringPrincipal(ctx, agent.id));
+    await stampSpawnPrincipalAsync(agent.id, registeringSpawnRequestId, registeringPrincipal(ctx, agent.id));
   }
   // #3398 — a new instance under this id replaced the provider process: that is a context reset.
   if (existing?.instanceId && agent.instanceId && agent.instanceId !== existing.instanceId) {
-    recordContextReset({ agentId: agent.id, resetId: `restart:${agent.instanceId}`, kind: "restart", observedAt: Date.now(), evidence: { previousInstanceId: existing.instanceId } });
+    (await recordContextReset({ agentId: agent.id, resetId: `restart:${agent.instanceId}`, kind: "restart", observedAt: Date.now(), evidence: { previousInstanceId: existing.instanceId } }));
   }
   // A parked continuation is durable across runner process loss. Registration is the earliest
   // point a replacement can receive it, so replay here rather than waiting for maintenance.
-  if (agent.ready && agent.status !== "offline") replayParkedContinuationInjections(agent.id, `registration:${agent.epoch}`);
+  if (agent.ready && agent.status !== "offline") (await replayParkedContinuationInjections(agent.id, `registration:${agent.epoch}`));
 
   // Managed came-up-running reconcile — no-op for non-managed agents (the guard lives
   // in markManagedAgentRunning). Clears backoff, flushes the policy queue, transitions
   // managed state to running.
-  markManagedAgentRunning(
+  (await markManagedAgentRunning(
     {
       policyName: metaStr(agent.meta, "policyName"),
       spawnRequestId: metaStr(agent.meta, "spawnRequestId"),
@@ -387,7 +387,7 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, optio
       tmuxSession: metaStr(agent.meta, "tmuxSession"),
     },
     ctx,
-  );
+  ));
 
   // ONE status broadcast (branch-state-enriched, #236), ONE timeline note. A real
   // PreCompact/SessionStart hook arrives as a latched meta.timelineEvent — clears any
@@ -407,25 +407,25 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, optio
   const generation = metaStr(agent.meta, "spawnRequestId");
   const newGeneration = generation !== undefined && generation !== metaStr(existing?.meta, "spawnRequestId");
   if (newGeneration) notifyAgentRegistered(agent);
-  if (agent.ready && (!existing?.ready || newGeneration)) announceSpawnedAgentReady(agent.id, ctx.actor.id);
+  if (agent.ready && (!existing?.ready || newGeneration)) await announceSpawnedAgentReady(agent.id, ctx.actor.id);
 
   // #416 — flush queued direct messages when a re-registering agent was previously unavailable
   // (offline, stale, compacting, blocked) or a new agent becomes ready. No-op for brand-new agents
   // (no queued messages yet) and when no queued messages exist.
-  if (agent.ready) acquireTeamOnReady(agent.id); // #3107 — a coordinator takes its project's seat before the flush
-  if (existing && (existing.status === "offline" || isAgentUnavailable(existing)) && agent.ready) flushQueuedDirectMessages(agent.id);
+  if (agent.ready) await acquireTeamOnReady(agent.id); // #3107 — a coordinator takes its project's seat before the flush
+  if (existing && (existing.status === "offline" || isAgentUnavailable(existing)) && agent.ready) (await flushQueuedDirectMessages(agent.id));
 
   if (!existing) {
     // #413 — a spawned worker with a report-back contract gets a pending reply obligation to its
     // spawner so it can't idle with its verdict undelivered (vent #121). First-registration only.
     const spawnRequestId = metaStr(agent.meta, "spawnRequestId");
-    if (spawnRequestId) markSpawnRegistrationConfirmed(spawnRequestId);
+    if (spawnRequestId) await markSpawnRegistrationConfirmedAsync(spawnRequestId);
     const provider = metaStr(agent.meta, "provider");
-    const promptMirror = seedSpawnPromptMirror(agent.id, spawnRequestId);
+    const promptMirror = await seedSpawnPromptMirrorAsync(agent.id, spawnRequestId);
     if (promptMirror?.created || promptMirror?.updated) emitNewMessage(promptMirror.message);
     seedSpawnReplyObligation(agent.id, agent.spawnedBy, spawnRequestId);
-    void fireAndForget(`[register] spawn prompt issue activity for ${agent.id}`, () => recordSpawnPromptIssueActivity(agent, spawnRequestId));
-    createActivityEvent({
+    void fireAndForget(`[register] spawn prompt issue activity for ${agent.id}`, async () => (await recordSpawnPromptIssueActivity(agent, spawnRequestId)));
+    await createActivityEventAsync({
       clientId: `server-agent-${agent.id}-registered`,
       kind: "state",
       title: "Agent registered",

package/src/services/restart-project-role.ts

@@ -54,7 +54,7 @@ export async function restartProjectRole(input: {
     if (!base) throw new Error(`it extends unknown profile "${role.extends}"`);
     resolveProjectRoleForProvider(role, input.provider, { providerArgs: input.providerArgs }, {});
     let profile = projectRoleProfile((await withResolvedProvisioningAsync(base, input.provider))!, role);
-    if (profile.sources?.project) profile = applyProjectCapabilityGates(profile, input.sourceCwd, undefined, { orchestratorLocal: isOrchestratorLocalToRelay(input.host), pinnedMcpCommit: role.source.sha });
+    if (profile.sources?.project) profile = (await applyProjectCapabilityGates(profile, input.sourceCwd, undefined, { orchestratorLocal: isOrchestratorLocalToRelay(input.host), pinnedMcpCommit: role.source.sha }));
     assertProjectRoleMcpTrusted(role, profile);
     assertProjectRoleMcpCwd(role, input.runtimeCwd);
     const defaults = projectRoleSpawnDefaults(builtInProfileSpawnDefaults(base.name), role);

package/src/services/restart-spawn.ts

@@ -1,3 +1,5 @@
+import { runnerRuntimeTokenEnvAsync, SUCCESSOR_LAUNCH, type RunnerRuntimeTokenInput } from "../runtime-tokens";
+import { updateManagedAgentStateAsync } from "../db/lifecycle-tail-async";
 import { createCommandAsync } from "../commands-write";
 import { restartHarnessSubagents } from "./harness-subagents";
 import { RELAY_TOKEN_HEADER, isRecord, isSpawnProvider, stringValue } from "@humwick/sdk";
@@ -5,7 +7,7 @@ import { recordedLaunchMode } from "../launch-mode";
 import type { ProviderEffort } from "@humwick/sdk/provider-catalog";
 import { listCommands } from "../commands-db";
 import { isTrustedOrchestratorApiUrl, relayToken } from "../config";
-import { getAgentProfile, getManagedAgentState, getSpawnPolicy, updateManagedAgentState } from "../config-store";
+import { getAgentProfile, getManagedAgentState, getSpawnPolicy } from "../config-store";
 import { getMergeLease, getOrchestrator, listWorkspaces, ownedIsolatedWorkspace, ValidationError, withResolvedProvisioning, withResolvedProvisioningAsync, workflowRunIdOf } from "../db";
 import { resolveProjectForCanonicalCwd } from "./project";
 import { isProvenStewardAgent, stewardWorktreeCwdPrefixes } from "../steward-spawn-guard";
@@ -16,7 +18,6 @@ import { resolveWhoamiRole } from "../mcp/identity-projection";
 import { listManagedOrchestratorsForAgent } from "../orchestrator-lookup";
 import { applyDefaultSharedMcp } from "../shared-mcp";
 import { buildSpawnCommand, generateSpawnRequestId, resolveSpawnModelParams, resolveSpawnModelParamsAsync } from "../spawn-command";
-import { SUCCESSOR_LAUNCH, runnerRuntimeTokenEnv, runnerRuntimeTokenEnvAsync, type RunnerRuntimeTokenInput } from "../runtime-tokens";
 import { restartEffortState } from "./self-effort";
 // #2033 — from isolated-workspace-placement.ts, NOT ./spawn-identity: that module also exports
 // buildProspectiveSpawnIdentity, which imports mcp/identity.ts → self-resume.ts → restart-spawn.ts,
@@ -65,13 +66,13 @@ function resumeWorkspaceForRestart(agent: AgentCard): { branch: string; mode: "a
  * self-restart. The token is minted here from the CURRENT profile, never cloned from the old
  * runtime token, so changed scopes/tool groups take effect on the successor.
  */
-function buildRestartSpawnParamsForAgent(
+async function buildRestartSpawnParamsForAgent(
   agent: AgentCard,
   orchestrator: Orchestrator | null,
   policyName?: string,
   predecessorSpawnRequestId?: string,
   opts: RestartOptions = {},
-): Record<string, unknown> | undefined {
+): Promise<Record<string, unknown> | undefined> {
   if (!orchestrator) return undefined;
   refuseSyncProjectRoleRestart(agent);
   const requestId = generateSpawnRequestId();
@@ -110,14 +111,14 @@ function buildRestartSpawnParamsForAgent(
       resumeWorktreePath: restartResumeWorkspace?.worktreePath,
     });
     const params = {
-      ...buildManagedSpawnParams(relaunchPolicy(policy.value, relaunch.effort), requestId, { createdBy: requestedBy, authority: SUCCESSOR_LAUNCH, identityAgentId: agent.id }),
+      ...(await buildManagedSpawnParams(relaunchPolicy(policy.value, relaunch.effort), requestId, { createdBy: requestedBy, authority: SUCCESSOR_LAUNCH, identityAgentId: agent.id })),
       ...relaunch.carried,
       agentId: agent.id,
       requestedBy,
       // Override the policy builder's normal mint so stable team/project bindings are also
       // carried by the fresh token, not merely preserved incidentally on the agent row.
-      env: runnerRuntimeTokenEnv(managedRestartTokenInput(agent, policy.value, requestId, requestedBy, projectId,
-        [...stewardExtraCwdPrefixes, ...isolatedExtraCwdPrefixes])),
+      env: (await runnerRuntimeTokenEnvAsync(managedRestartTokenInput(agent, policy.value, requestId, requestedBy, projectId,
+        [...stewardExtraCwdPrefixes, ...isolatedExtraCwdPrefixes]))),
       ...managedRestartOptions(opts, restartResumeWorkspace),
     };
     return opts.resumeId ? withResumeParams(params, opts.resumeId, agent.id) : params;
@@ -126,7 +127,7 @@ function buildRestartSpawnParamsForAgent(
   const provider = stringValue(agent.meta?.provider);
   if (!isSpawnProvider(provider)) return undefined;
   // #2033 review — fold in #2041: for an ISOLATED agent, `agent.meta.cwd` is caller-writable
-  // (not an AUTHZ_META_KEY) and this `cwd` feeds `runnerRuntimeTokenEnv({cwd})` below as the
+  // (not an AUTHZ_META_KEY) and this `cwd` feeds `runnerRuntimeTokenEnvAsync({cwd})` below as the
   // successor token's cwdPrefixes[0] — a forged value would mint a token authorizing an arbitrary
   // path. Prefer the same unforgeable orchestrator-written DB row (`ownedIsolatedWorkspace`) G1
   // sources the resume worktree from; it's undefined for a non-isolated (shared/coordinator) agent
@@ -167,7 +168,7 @@ function buildRestartSpawnParamsForAgent(
   };
   const tokenContext = { orchestratorId: orchestrator.id, projectId, extraCwdPrefixes: stewardExtraCwdPrefixes };
   return buildRestartSpawnCommand(agent, predecessorSpawnRequestId, agentProfile, projectedInstructions, opts, options, tokenContext,
-    runnerRuntimeTokenEnv(restartTokenInput(agent, options, tokenContext)));
+    (await runnerRuntimeTokenEnvAsync(restartTokenInput(agent, options, tokenContext))));
 }
 
 /** Worker-safe restart command construction used by HTTP/orchestrator/self-restart flows. */
@@ -457,11 +458,11 @@ export async function createSelfRestartCommandAsync(
   const predecessorSpawnRequestId = stringValue(agent.meta?.spawnRequestId);
   const restartSpawn = await restartSpawnParamsForAgentAsync(agent, orchestrator, policyName, predecessorSpawnRequestId, { continuation, generation, reason });
   if (!restartSpawn) throw new ValidationError("self-restart could not build a fresh successor spawn");
-  return createCommandAsync(selfRestartInput(agent, orchestrator, restartSpawn, generation, continuation, fullContextMessageId, reason, now));
+  return (await createCommandAsync(selfRestartInput(agent, orchestrator, restartSpawn, generation, continuation, fullContextMessageId, reason, now)));
 }
 
 /** Settle managed runtime correlation only after the transactional orchestrator swap succeeds. */
-export function settleSelfRestartManagedState(command: Command): void {
+export async function settleSelfRestartManagedState(command: Command): Promise<void> {
   if (command.type !== "agent.restart" || !isRecord(command.params.selfRestart)) return;
   const policyName = stringValue(command.params.policyName);
   if (!policyName || command.status !== "succeeded") return;
@@ -472,7 +473,7 @@ export function settleSelfRestartManagedState(command: Command): void {
   const spawnRequestId = stringValue(restartSpawn?.spawnRequestId) ?? state?.spawnRequestId;
   const tmuxSession = stringValue(report?.tmuxSession) ?? stringValue(report?.sessionName) ?? state?.tmuxSession;
   if (!agentId || !spawnRequestId) return;
-  updateManagedAgentState(policyName, {
+  (await updateManagedAgentStateAsync(policyName, {
     status: "starting",
     agentId,
     spawnRequestId,
@@ -480,12 +481,12 @@ export function settleSelfRestartManagedState(command: Command): void {
     lastSpawnAt: command.updatedAt,
     lastStopAt: command.updatedAt,
     restartCount: (state?.restartCount ?? 0) + 1,
-  });
-  markManagedAgentRunning({ policyName, spawnRequestId, agentId, tmuxSession }, authContextFromSystem(), { now: () => command.updatedAt });
+  }));
+  (await markManagedAgentRunning({ policyName, spawnRequestId, agentId, tmuxSession }, authContextFromSystem(), { now: () => command.updatedAt }));
 }
 
-export function restartSpawnParamsForAgent(...args: Parameters<typeof buildRestartSpawnParamsForAgent>) {
-  return buildRestartSpawnParamsForAgent(...args);
+export async function restartSpawnParamsForAgent(...args: Parameters<typeof buildRestartSpawnParamsForAgent>) {
+  return (await buildRestartSpawnParamsForAgent(...args));
 }
 export async function restartSpawnParamsForAgentAsync(...args: Parameters<typeof buildRestartSpawnParamsForAgentAsync>) {
   return buildRestartSpawnParamsForAgentAsync(...args);

package/src/services/review-publish.ts

@@ -17,10 +17,10 @@ export interface ReviewPublishDispatch {
   error?: string;
 }
 
-export function dispatchReviewPublish(
+export async function dispatchReviewPublish(
   workspace: WorkspaceRecord | undefined,
   opts: { requestedBy: string; taskId: number; sha?: string; emit: (command: Command) => void },
-): ReviewPublishDispatch | undefined {
+): Promise<ReviewPublishDispatch | undefined> {
   if (!workspace || workspace.mode !== "isolated" || !workspace.worktreePath) return undefined;
   // #1452 round-6 H2b / round-7 H3 — publishing REQUIRES an immutable delivered COMMIT OID (the host
   // must pin exactly it, and settlement matches result.sha === requested sha). It must be a concrete
@@ -46,28 +46,11 @@ export function dispatchReviewPublish(
     // failing ledger insert was swallowed, leaving a POLLABLE publish command with NO cleanup ledger
     // (a crash/insert-failure orphan). The transaction makes them all-or-nothing: a ledger failure
     // rolls back the command row too, so a reviewer never sees a command with no durable cleanup path.
-    let command: Command | undefined;
-    let buildError: string | undefined;
-    writeTransaction(() => {
-      const built = buildWorkspacePublishReviewCommand(workspace, opts.requestedBy, { taskId: opts.taskId, sha, reviewRef });
-      if (!built.ok) { buildError = built.error; return; } // nothing was persisted (owner/worktree check)
-      // Round-9: PIN the exact ref (relay-derived, host-asserted-equal before push) so cleanup can
-      // delete it even if the host's success-result is lost. The row also holds the branch/host/
-      // requested-sha so cleanup survives a purge/recycle. On settlement the reconciler re-writes the
-      // host-confirmed ref (identical to this one, since the host refuses to push a divergent ref).
-      upsertReviewRefCleanup({
-        id: built.command.id,
-        ref: reviewRef,
-        workspaceId: workspace.id,
-        repoRoot: workspace.repoRoot,
-        worktreePath: workspace.worktreePath,
-        branch: workspace.branch,
-        orchestratorId: workspace.orchestratorId,
-        requestedSha: sha,
-      });
-      command = built.command;
-    });
-    if (!command) return { workspaceId: workspace.id, dispatched: false, error: buildError ?? "review publish not dispatched" };
+    const built = await buildWorkspacePublishReviewCommand(workspace, opts.requestedBy, { taskId: opts.taskId, sha, reviewRef,
+      cleanup: { ref: reviewRef, workspaceId: workspace.id, repoRoot: workspace.repoRoot, worktreePath: workspace.worktreePath,
+        branch: workspace.branch, orchestratorId: workspace.orchestratorId, requestedSha: sha } });
+    if (!built.ok) return { workspaceId: workspace.id, dispatched: false, error: built.error };
+    const command = built.command;
     opts.emit(command); // durable state (command + ledger) is committed before anyone is notified
     return { workspaceId: workspace.id, commandId: command.id, dispatched: true };
   } catch (err) {