@humwick/server 0.130.2 → 0.130.4

package/src/services/red-main-auto-revert.ts

@@ -1,11 +1,13 @@
+import { upsertWorkspaceAsync } from "../db/runtime-admin-async";
 import { relayEnv } from "@humwick/sdk/env";
 import { createHash } from "node:crypto";
 import type { LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
 import { errMessage, isRecord, stringValue, type Command } from "@humwick/sdk";
-import { findCommandByCorrelationId, findLatestCommandByCorrelation } from "../commands-db";
+import { findCommandByCorrelationId } from "../commands-db";
+import { findLatestCommandByCorrelationAsync } from "../commands-write";
 import { getCommandAsync } from "../commands-write";
 import { isTerminalCommandStatus } from "../db/command-terminal-status";
-import { getWorkspace, upsertWorkspace } from "../db/workspaces";
+import { getWorkspace } from "../db/workspaces";
 import { landBoundaryById, landBoundaryForCommand, redMainIncidentById } from "../db/land-boundaries";
 import { readFailedTestFiles } from "../ci/failed-test-files";
 import type { GitHubApi } from "../issue-tracker/github";
@@ -70,13 +72,13 @@ async function advanceAutomaticRevert(incident: RedMainIncident, boundary: LandB
 /** One direct, pinned, gated land per prepared red-main workspace: the revert's or the quarantine's. */
 export async function landRedMainWorkspace(id: string, boundary: LandBoundary, prepared: Record<string, unknown>,
   metadata: Record<string, unknown>, recoveryTestFiles?: string[]): Promise<Command> {
-  const existing = findLatestCommandByCorrelation("workspace.merge", id);
+  const existing = await findLatestCommandByCorrelationAsync("workspace.merge", id);
   if (existing) return existing;
   const source = getWorkspace(boundary.workspaceId)!;
-  const workspace = getWorkspace(id) ?? upsertWorkspace({ id, repoRoot: source.repoRoot, sourceCwd: source.repoRoot,
+  const workspace = getWorkspace(id) ?? (await upsertWorkspaceAsync({ id, repoRoot: source.repoRoot, sourceCwd: source.repoRoot,
     worktreePath: String(prepared.worktreePath), branch: String(prepared.branch), baseRef: boundary.baseRef,
     baseSha: String(prepared.baseSha), mode: "isolated", status: "ready", orchestratorId: source.orchestratorId,
-    metadata: { ...metadata, landStrategy: "direct" } });
+    metadata: { ...metadata, landStrategy: "direct" } }));
   const requested = await requestWorkspaceMerge(workspace, { requestedBy: "red-main-controller", strategy: "direct",
     expectedHeadSha: String(prepared.headSha), deleteBranch: true, ...(recoveryTestFiles ? { recoveryTestFiles } : {}) });
   if (!requested.ok) throw new Error(requested.error);

package/src/services/red-main-controller-deps.ts

@@ -1,8 +1,8 @@
 // #3363 — the red-main controller's production deps: GitHub for CI verdicts and reruns, Tasks and
 // messages for escalation. Every CI observation uses the boundary's authoritative watch snapshot.
-import type { LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
+import { MAX_INCIDENT_FAILING_TESTS, type LandBoundary, type RedMainIncident } from "@humwick/kernel/landing-incident";
 import { cleanLandGatesConfigFull } from "@humwick/sdk/land-gates";
-import { isRecord } from "@humwick/sdk";
+import { ciRunUrl, errMessage, isRecord } from "@humwick/sdk";
 import { judgeExactSha, rerunBoundaryCi, type BoundaryCiObservation } from "../ci/land-boundary-ci.ts";
 import { type GitHubRepository } from "../ci/monitor.ts";
 import { getTaskDetailAsync } from "../db/task-entity-async.ts";
@@ -12,6 +12,8 @@ import { sendMessageServiceAsync } from "./send-message.ts";
 import { setTaskEntityStatusAsync } from "./task-entity.ts";
 import { automaticRedMainQuarantine } from "./red-main-quarantine";
 import { automaticRedMainRevert, automaticRevertOutcome } from "./red-main-auto-revert";
+import { readFailedTestCases } from "../ci/failed-test-files.ts";
+import { recordRedMainIncidentFailures } from "./red-main-incident.ts";
 
 /** Twice a typical main CI run: a run missing or cancelled past this leaves its boundary unverified. */
 export const RED_MAIN_GRACE_MS = 60 * 60_000;
@@ -31,6 +33,20 @@ function describe(incident: RedMainIncident, observation: BoundaryCiObservation)
   return `Red main confirmed on lane ${incident.laneKey} (incident ${incident.id}): the re-run did not produce a successful verdict.${jobs}${observation.runUrl ? ` Run: ${observation.runUrl}` : ""}`;
 }
 
+/** #3362 §11: the confirmed attempt's failing cases; a rerun that never produced logs falls back to the first failure.
+ *  Best effort, read once: unreadable logs record nothing, so delivery gates hold nothing and every failure blocks. */
+export async function recordIncidentFailingTests(incident: RedMainIncident, boundary: LandBoundary, attempt: number, api: GitHubApi): Promise<void> {
+  let cases;
+  try {
+    cases = await readFailedTestCases(boundary, incident.ciRunId, attempt, api);
+    if (!cases.length && attempt > 1) cases = await readFailedTestCases(boundary, incident.ciRunId, attempt - 1, api);
+  } catch (error) {
+    console.warn(`[red-main] ${incident.id}: failing cases unreadable; none recorded: ${errMessage(error)}`);
+    return;
+  }
+  await recordRedMainIncidentFailures(incident.id, cases.slice(0, MAX_INCIDENT_FAILING_TESTS).map(({ file, name }) => ({ file, name })));
+}
+
 export function createRedMainControllerDeps(api: GitHubApi = ghApi, now: () => number = Date.now): RedMainControllerDeps {
   return {
     now,
@@ -62,10 +78,11 @@ export function createRedMainControllerDeps(api: GitHubApi = ghApi, now: () => n
       if (!incident) throw new Error(`Effect ${effect.key} needs its incident`);
       if (effect.kind === "auto-revert") return incident.mainFailurePolicy === "advisory" ? undefined : automaticRedMainRevert(incident, boundary, api);
       if (effect.kind === "quarantine") return automaticRedMainQuarantine(incident, boundary, effect, api);
+      if (effect.kind === "record-failures") return recordIncidentFailingTests(incident, boundary, effect.attempt, api);
       const task = await getTaskDetailAsync(effect.taskId);
       if (!task) throw new Error(`Effect ${effect.key}: T${effect.taskId} is missing`);
       const observation: BoundaryCiObservation = { status: "failure", runId: incident.ciRunId,
-        runUrl: `https://github.com/${boundary.remote}/actions/runs/${incident.ciRunId}/attempts/${incident.ciAttempt}` };
+        runUrl: ciRunUrl(boundary.remote, incident.ciRunId, incident.ciAttempt) };
       const advisory = incident.mainFailurePolicy === "advisory";
       const note = describe(incident, observation);
       if (effect.kind === "reopen-task") {

package/src/services/red-main-incident.ts

@@ -1,7 +1,7 @@
 // #3363 — server seam for the Kernel landing boundary and red-main incident ops
 // (kernel/landing-incident.ts). Every write goes through the singleton landing module host.
 import { landing } from "@humwick/kernel/landing";
-import type { IncidentEffect, IncidentState, LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
+import type { IncidentEffect, IncidentFailingTest, IncidentState, LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
 import { activeLandCommandIdForWorkspace } from "../db/land-incident-eligibility.ts";
 import { startKernelLandingIngress } from "./kernel-landing-ingress.ts";
 
@@ -26,6 +26,8 @@ export const transitionRedMainIncident = (input: { id: string; from: IncidentSta
 export const settleRedMainIncidentEffect = (id: string, key: string) =>
   invoke<RedMainIncident>("settleIncidentEffect", { id, key });
 export const ensureRedMainIncidentEffects = (id: string) => invoke<RedMainIncident>("ensureIncidentEffects", { id });
+export const recordRedMainIncidentFailures = (id: string, failingTests: IncidentFailingTest[]) =>
+  invoke<RedMainIncident>("recordIncidentFailures", { id, failingTests });
 export const failAutomaticRedMainRevert = (id: string, reason: string) => invoke<RedMainIncident>("failAutomaticRevert", { id, reason });
 export const queueBoundaryRerun = (id: string, effect: IncidentEffect) => invoke<LandBoundary>("queueBoundaryRerun", { id, effect });
 export const settleBoundaryEffect = (id: string, key: string) => invoke<LandBoundary>("settleBoundaryEffect", { id, key });

package/src/services/red-main-quarantine.ts

@@ -4,7 +4,7 @@
 // like any change, and the list's issue gets the audit record. Anything short of that becomes a Task.
 import { createHash } from "node:crypto";
 import type { IncidentEffect, LandBoundary, RedMainIncident } from "@humwick/kernel/landing-incident";
-import { isRecord, stringValue } from "@humwick/sdk";
+import { ciRunUrl, isRecord, stringValue } from "@humwick/sdk";
 import { readFailedTestCases } from "../ci/failed-test-files";
 import { findCommandByCorrelationId } from "../commands-db";
 import { isTerminalCommandStatus } from "../db/command-terminal-status";
@@ -19,8 +19,7 @@ type Case = { id?: string; file: string; name: string; why?: string };
 
 export const automaticQuarantineWorkspaceId = (id: string) => `red-main-q-${createHash("sha256").update(id).digest("hex").slice(0, 24)}`;
 const prepareKey = (id: string) => `kcmd:red-main:${id}:prepare-quarantine`;
-const runUrl = (boundary: LandBoundary, incident: RedMainIncident, attempt?: number) =>
-  `https://github.com/${boundary.remote}/actions/runs/${incident.ciRunId}${attempt ? `/attempts/${attempt}` : ""}`;
+const runUrl = (boundary: LandBoundary, incident: RedMainIncident, attempt?: number) => ciRunUrl(boundary.remote, incident.ciRunId, attempt);
 
 function evidence(incident: RedMainIncident, boundary: LandBoundary, attempt: number): string {
   const failed = `main ${boundary.landedTipSha.slice(0, 12)} run ${incident.ciRunId} attempt ${attempt} failed`;

package/src/services/register-agent.ts

@@ -1,3 +1,4 @@
+import { stampSpawnPrincipalAsync, markSpawnRegistrationConfirmedAsync, seedSpawnPromptMirrorAsync } from "../db/lifecycle-tail-async";
 // Transport convergence (epic #342, slice #345) — the agent-registration service.
 //
 // ONE home for "an agent registered" — previously inlined in HTTP `postAgent` and
@@ -11,14 +12,13 @@
 // the first-registration audit row.
 import { errMessage, fireAndForget, isReservedAgentId } from "@humwick/sdk";
 import { normalizeAgentSystemTags } from "../agent-system-tags";
-import { ValidationError, agentPrincipalUserId, stampSpawnPrincipal, createActivityEvent, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, readSpawnRegistrationMeta, seedSpawnPromptMirror, seedSpawnReplyObligation, spawnRegistrationMeta, upsertAgent } from "../db";
+import { ValidationError, agentPrincipalUserId, createActivityEventAsync, deliverableTaskIdsBySpawnRequestId, getAgent, getTaskDetail, readSpawnRegistrationMeta, seedSpawnReplyObligation, spawnRegistrationMeta, upsertAgentAsync } from "../db";
 import { readSpawnSystemTags } from "../commands-db";
 import { channelProviderForInput, expectedChannelAgentId } from "../db/channel-identity";
 import { emitAgentStatus, emitNewMessage } from "../sse";
 import { noteAgentTimelineEvent } from "../compaction-watch";
 import { agentProviderTimelineEvent } from "../provider-timeline-event";
 import { notifyAgentReady, notifyAgentRegistered } from "../agent-lifecycle-events";
-import { markSpawnRegistrationConfirmed } from "../commands-db";
 import { resolveSpawnLineage, resolveTeamLineage } from "../security";
 import { flushQueuedDirectMessages, markManagedAgentRunning } from "./managed-running";
 import { acquireTeamOnReady } from "./team";
@@ -56,7 +56,7 @@ function taskIdsForReadyAgent(agent: AgentCard): number[] {
   return [...ids].sort((a, b) => a - b);
 }
 
-export function bindSpawnedTaskToReadyAgent(agentId: string, actor = "agent-relay"): void {
+export async function bindSpawnedTaskToReadyAgent(agentId: string, actor = "agent-relay"): Promise<void> {
   const agent = getAgent(agentId);
   if (!agent?.ready || isSpawnIntentCanceled(agent.meta?.spawnRequestId)) return;
   const taskIds = taskIdsForReadyAgent(agent);
@@ -67,9 +67,9 @@ export function bindSpawnedTaskToReadyAgent(agentId: string, actor = "agent-rela
       if (before.ownerAgentId && before.ownerAgentId !== agent.id && getAgent(before.ownerAgentId)?.status !== "offline") continue;
       const assigned = before.ownerAgentId === agent.id
         ? before
-        : assignTaskEntityAgent(taskId, agent.id, "worker", agent.spawnedBy ?? actor);
+        : (await assignTaskEntityAgent(taskId, agent.id, "worker", agent.spawnedBy ?? actor));
       if (assigned.status === "open" || assigned.status === "claimed" || assigned.status === "orphaned") {
-        setTaskEntityStatus(taskId, {
+        await setTaskEntityStatus(taskId, {
           status: "in_progress",
           note: `worker ${agent.id} ready`,
           actor: agent.spawnedBy ?? actor,
@@ -90,9 +90,9 @@ export function bindSpawnedTaskToReadyAgent(agentId: string, actor = "agent-rela
  * regardless of which transport carried it — a child readied only over the bus used to die
  * unstamped and get reaped as `agent.spawn_failed`.
  */
-export function announceSpawnedAgentReady(agentId: string, actor = "agent-relay"): void {
-  notifyAgentReady(agentId);
-  bindSpawnedTaskToReadyAgent(agentId, actor);
+export async function announceSpawnedAgentReady(agentId: string, actor = "agent-relay"): Promise<void> {
+  await notifyAgentReady(agentId);
+  await bindSpawnedTaskToReadyAgent(agentId, actor);
 }
 
 /** The PRIVILEGED principals that bypass the registration gates — an explicit allowlist, so a
@@ -238,7 +238,7 @@ function serverRecordedApprovalMode(agentId: string, ctx: AuthContext): SpawnApp
   return undefined;
 }
 
-export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, options: { emitStatus?: boolean } = {}): AgentCard {
+export async function registerAgent(input: RegisterAgentInput, ctx: AuthContext, options: { emitStatus?: boolean } = {}): Promise<AgentCard> {
   // Reserved built-in identities — the `system` lifecycle sender and the whole `user:` human
   // namespace (legacy bare `'user'`, `user:default`, every `user:<id>`) — are mechanical sinks,
   // never registrable agents. THIS is the one external-registration boundary (HTTP `postAgent`
@@ -358,7 +358,7 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, optio
   if (Object.keys(spawnMeta).length) registrationInput.meta = { ...registrationInput.meta, ...spawnMeta };
   const rawSpawnSystemTags = readSpawnSystemTags(registeringSpawnRequestId, registrationInput.id);
   const spawnSystemTags = rawSpawnSystemTags === undefined ? undefined : normalizeAgentSystemTags(rawSpawnSystemTags);
-  const agent = upsertAgent(registrationInput, {
+  const agent = await upsertAgentAsync(registrationInput, {
     verifiedSpawnRequestId: ctx.constraints?.spawnRequestIds?.length === 1 ? ctx.constraints.spawnRequestIds[0] : undefined,
     ...(verifiedKeepJti ? { verifiedKeepJtis: [verifiedKeepJti] } : {}),
     ...(spawnSystemTags !== undefined ? { systemTags: spawnSystemTags } : {}),
@@ -366,20 +366,20 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, optio
   // #3567 — a first registration or a new generation records its principal (a reconnect has
   // nothing new to stamp): the spawn's principal, else the registering caller's.
   if (!existing || metaStr(existing.meta, "spawnRequestId") !== registeringSpawnRequestId) {
-    stampSpawnPrincipal(agent.id, registeringSpawnRequestId, registeringPrincipal(ctx, agent.id));
+    await stampSpawnPrincipalAsync(agent.id, registeringSpawnRequestId, registeringPrincipal(ctx, agent.id));
   }
   // #3398 — a new instance under this id replaced the provider process: that is a context reset.
   if (existing?.instanceId && agent.instanceId && agent.instanceId !== existing.instanceId) {
-    recordContextReset({ agentId: agent.id, resetId: `restart:${agent.instanceId}`, kind: "restart", observedAt: Date.now(), evidence: { previousInstanceId: existing.instanceId } });
+    (await recordContextReset({ agentId: agent.id, resetId: `restart:${agent.instanceId}`, kind: "restart", observedAt: Date.now(), evidence: { previousInstanceId: existing.instanceId } }));
   }
   // A parked continuation is durable across runner process loss. Registration is the earliest
   // point a replacement can receive it, so replay here rather than waiting for maintenance.
-  if (agent.ready && agent.status !== "offline") replayParkedContinuationInjections(agent.id, `registration:${agent.epoch}`);
+  if (agent.ready && agent.status !== "offline") (await replayParkedContinuationInjections(agent.id, `registration:${agent.epoch}`));
 
   // Managed came-up-running reconcile — no-op for non-managed agents (the guard lives
   // in markManagedAgentRunning). Clears backoff, flushes the policy queue, transitions
   // managed state to running.
-  markManagedAgentRunning(
+  (await markManagedAgentRunning(
     {
       policyName: metaStr(agent.meta, "policyName"),
       spawnRequestId: metaStr(agent.meta, "spawnRequestId"),
@@ -387,7 +387,7 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, optio
       tmuxSession: metaStr(agent.meta, "tmuxSession"),
     },
     ctx,
-  );
+  ));
 
   // ONE status broadcast (branch-state-enriched, #236), ONE timeline note. A real
   // PreCompact/SessionStart hook arrives as a latched meta.timelineEvent — clears any
@@ -407,25 +407,25 @@ export function registerAgent(input: RegisterAgentInput, ctx: AuthContext, optio
   const generation = metaStr(agent.meta, "spawnRequestId");
   const newGeneration = generation !== undefined && generation !== metaStr(existing?.meta, "spawnRequestId");
   if (newGeneration) notifyAgentRegistered(agent);
-  if (agent.ready && (!existing?.ready || newGeneration)) announceSpawnedAgentReady(agent.id, ctx.actor.id);
+  if (agent.ready && (!existing?.ready || newGeneration)) await announceSpawnedAgentReady(agent.id, ctx.actor.id);
 
   // #416 — flush queued direct messages when a re-registering agent was previously unavailable
   // (offline, stale, compacting, blocked) or a new agent becomes ready. No-op for brand-new agents
   // (no queued messages yet) and when no queued messages exist.
-  if (agent.ready) acquireTeamOnReady(agent.id); // #3107 — a coordinator takes its project's seat before the flush
-  if (existing && (existing.status === "offline" || isAgentUnavailable(existing)) && agent.ready) flushQueuedDirectMessages(agent.id);
+  if (agent.ready) await acquireTeamOnReady(agent.id); // #3107 — a coordinator takes its project's seat before the flush
+  if (existing && (existing.status === "offline" || isAgentUnavailable(existing)) && agent.ready) (await flushQueuedDirectMessages(agent.id));
 
   if (!existing) {
     // #413 — a spawned worker with a report-back contract gets a pending reply obligation to its
     // spawner so it can't idle with its verdict undelivered (vent #121). First-registration only.
     const spawnRequestId = metaStr(agent.meta, "spawnRequestId");
-    if (spawnRequestId) markSpawnRegistrationConfirmed(spawnRequestId);
+    if (spawnRequestId) await markSpawnRegistrationConfirmedAsync(spawnRequestId);
     const provider = metaStr(agent.meta, "provider");
-    const promptMirror = seedSpawnPromptMirror(agent.id, spawnRequestId);
+    const promptMirror = await seedSpawnPromptMirrorAsync(agent.id, spawnRequestId);
     if (promptMirror?.created || promptMirror?.updated) emitNewMessage(promptMirror.message);
     seedSpawnReplyObligation(agent.id, agent.spawnedBy, spawnRequestId);
-    void fireAndForget(`[register] spawn prompt issue activity for ${agent.id}`, () => recordSpawnPromptIssueActivity(agent, spawnRequestId));
-    createActivityEvent({
+    void fireAndForget(`[register] spawn prompt issue activity for ${agent.id}`, async () => (await recordSpawnPromptIssueActivity(agent, spawnRequestId)));
+    await createActivityEventAsync({
       clientId: `server-agent-${agent.id}-registered`,
       kind: "state",
       title: "Agent registered",

package/src/services/restart-project-role.ts

@@ -54,7 +54,7 @@ export async function restartProjectRole(input: {
     if (!base) throw new Error(`it extends unknown profile "${role.extends}"`);
     resolveProjectRoleForProvider(role, input.provider, { providerArgs: input.providerArgs }, {});
     let profile = projectRoleProfile((await withResolvedProvisioningAsync(base, input.provider))!, role);
-    if (profile.sources?.project) profile = applyProjectCapabilityGates(profile, input.sourceCwd, undefined, { orchestratorLocal: isOrchestratorLocalToRelay(input.host), pinnedMcpCommit: role.source.sha });
+    if (profile.sources?.project) profile = (await applyProjectCapabilityGates(profile, input.sourceCwd, undefined, { orchestratorLocal: isOrchestratorLocalToRelay(input.host), pinnedMcpCommit: role.source.sha }));
     assertProjectRoleMcpTrusted(role, profile);
     assertProjectRoleMcpCwd(role, input.runtimeCwd);
     const defaults = projectRoleSpawnDefaults(builtInProfileSpawnDefaults(base.name), role);

package/src/services/restart-spawn.ts

@@ -1,3 +1,5 @@
+import { runnerRuntimeTokenEnvAsync, SUCCESSOR_LAUNCH, type RunnerRuntimeTokenInput } from "../runtime-tokens";
+import { updateManagedAgentStateAsync } from "../db/lifecycle-tail-async";
 import { createCommandAsync } from "../commands-write";
 import { restartHarnessSubagents } from "./harness-subagents";
 import { RELAY_TOKEN_HEADER, isRecord, isSpawnProvider, stringValue } from "@humwick/sdk";
@@ -5,7 +7,7 @@ import { recordedLaunchMode } from "../launch-mode";
 import type { ProviderEffort } from "@humwick/sdk/provider-catalog";
 import { listCommands } from "../commands-db";
 import { isTrustedOrchestratorApiUrl, relayToken } from "../config";
-import { getAgentProfile, getManagedAgentState, getSpawnPolicy, updateManagedAgentState } from "../config-store";
+import { getAgentProfile, getManagedAgentState, getSpawnPolicy } from "../config-store";
 import { getMergeLease, getOrchestrator, listWorkspaces, ownedIsolatedWorkspace, ValidationError, withResolvedProvisioning, withResolvedProvisioningAsync, workflowRunIdOf } from "../db";
 import { resolveProjectForCanonicalCwd } from "./project";
 import { isProvenStewardAgent, stewardWorktreeCwdPrefixes } from "../steward-spawn-guard";
@@ -16,7 +18,6 @@ import { resolveWhoamiRole } from "../mcp/identity-projection";
 import { listManagedOrchestratorsForAgent } from "../orchestrator-lookup";
 import { applyDefaultSharedMcp } from "../shared-mcp";
 import { buildSpawnCommand, generateSpawnRequestId, resolveSpawnModelParams, resolveSpawnModelParamsAsync } from "../spawn-command";
-import { SUCCESSOR_LAUNCH, runnerRuntimeTokenEnv, runnerRuntimeTokenEnvAsync, type RunnerRuntimeTokenInput } from "../runtime-tokens";
 import { restartEffortState } from "./self-effort";
 // #2033 — from isolated-workspace-placement.ts, NOT ./spawn-identity: that module also exports
 // buildProspectiveSpawnIdentity, which imports mcp/identity.ts → self-resume.ts → restart-spawn.ts,
@@ -65,13 +66,13 @@ function resumeWorkspaceForRestart(agent: AgentCard): { branch: string; mode: "a
  * self-restart. The token is minted here from the CURRENT profile, never cloned from the old
  * runtime token, so changed scopes/tool groups take effect on the successor.
  */
-function buildRestartSpawnParamsForAgent(
+async function buildRestartSpawnParamsForAgent(
   agent: AgentCard,
   orchestrator: Orchestrator | null,
   policyName?: string,
   predecessorSpawnRequestId?: string,
   opts: RestartOptions = {},
-): Record<string, unknown> | undefined {
+): Promise<Record<string, unknown> | undefined> {
   if (!orchestrator) return undefined;
   refuseSyncProjectRoleRestart(agent);
   const requestId = generateSpawnRequestId();
@@ -110,14 +111,14 @@ function buildRestartSpawnParamsForAgent(
       resumeWorktreePath: restartResumeWorkspace?.worktreePath,
     });
     const params = {
-      ...buildManagedSpawnParams(relaunchPolicy(policy.value, relaunch.effort), requestId, { createdBy: requestedBy, authority: SUCCESSOR_LAUNCH, identityAgentId: agent.id }),
+      ...(await buildManagedSpawnParams(relaunchPolicy(policy.value, relaunch.effort), requestId, { createdBy: requestedBy, authority: SUCCESSOR_LAUNCH, identityAgentId: agent.id })),
       ...relaunch.carried,
       agentId: agent.id,
       requestedBy,
       // Override the policy builder's normal mint so stable team/project bindings are also
       // carried by the fresh token, not merely preserved incidentally on the agent row.
-      env: runnerRuntimeTokenEnv(managedRestartTokenInput(agent, policy.value, requestId, requestedBy, projectId,
-        [...stewardExtraCwdPrefixes, ...isolatedExtraCwdPrefixes])),
+      env: (await runnerRuntimeTokenEnvAsync(managedRestartTokenInput(agent, policy.value, requestId, requestedBy, projectId,
+        [...stewardExtraCwdPrefixes, ...isolatedExtraCwdPrefixes]))),
       ...managedRestartOptions(opts, restartResumeWorkspace),
     };
     return opts.resumeId ? withResumeParams(params, opts.resumeId, agent.id) : params;
@@ -126,7 +127,7 @@ function buildRestartSpawnParamsForAgent(
   const provider = stringValue(agent.meta?.provider);
   if (!isSpawnProvider(provider)) return undefined;
   // #2033 review — fold in #2041: for an ISOLATED agent, `agent.meta.cwd` is caller-writable
-  // (not an AUTHZ_META_KEY) and this `cwd` feeds `runnerRuntimeTokenEnv({cwd})` below as the
+  // (not an AUTHZ_META_KEY) and this `cwd` feeds `runnerRuntimeTokenEnvAsync({cwd})` below as the
   // successor token's cwdPrefixes[0] — a forged value would mint a token authorizing an arbitrary
   // path. Prefer the same unforgeable orchestrator-written DB row (`ownedIsolatedWorkspace`) G1
   // sources the resume worktree from; it's undefined for a non-isolated (shared/coordinator) agent
@@ -167,7 +168,7 @@ function buildRestartSpawnParamsForAgent(
   };
   const tokenContext = { orchestratorId: orchestrator.id, projectId, extraCwdPrefixes: stewardExtraCwdPrefixes };
   return buildRestartSpawnCommand(agent, predecessorSpawnRequestId, agentProfile, projectedInstructions, opts, options, tokenContext,
-    runnerRuntimeTokenEnv(restartTokenInput(agent, options, tokenContext)));
+    (await runnerRuntimeTokenEnvAsync(restartTokenInput(agent, options, tokenContext))));
 }
 
 /** Worker-safe restart command construction used by HTTP/orchestrator/self-restart flows. */
@@ -457,11 +458,11 @@ export async function createSelfRestartCommandAsync(
   const predecessorSpawnRequestId = stringValue(agent.meta?.spawnRequestId);
   const restartSpawn = await restartSpawnParamsForAgentAsync(agent, orchestrator, policyName, predecessorSpawnRequestId, { continuation, generation, reason });
   if (!restartSpawn) throw new ValidationError("self-restart could not build a fresh successor spawn");
-  return createCommandAsync(selfRestartInput(agent, orchestrator, restartSpawn, generation, continuation, fullContextMessageId, reason, now));
+  return (await createCommandAsync(selfRestartInput(agent, orchestrator, restartSpawn, generation, continuation, fullContextMessageId, reason, now)));
 }
 
 /** Settle managed runtime correlation only after the transactional orchestrator swap succeeds. */
-export function settleSelfRestartManagedState(command: Command): void {
+export async function settleSelfRestartManagedState(command: Command): Promise<void> {
   if (command.type !== "agent.restart" || !isRecord(command.params.selfRestart)) return;
   const policyName = stringValue(command.params.policyName);
   if (!policyName || command.status !== "succeeded") return;
@@ -472,7 +473,7 @@ export function settleSelfRestartManagedState(command: Command): void {
   const spawnRequestId = stringValue(restartSpawn?.spawnRequestId) ?? state?.spawnRequestId;
   const tmuxSession = stringValue(report?.tmuxSession) ?? stringValue(report?.sessionName) ?? state?.tmuxSession;
   if (!agentId || !spawnRequestId) return;
-  updateManagedAgentState(policyName, {
+  (await updateManagedAgentStateAsync(policyName, {
     status: "starting",
     agentId,
     spawnRequestId,
@@ -480,12 +481,12 @@ export function settleSelfRestartManagedState(command: Command): void {
     lastSpawnAt: command.updatedAt,
     lastStopAt: command.updatedAt,
     restartCount: (state?.restartCount ?? 0) + 1,
-  });
-  markManagedAgentRunning({ policyName, spawnRequestId, agentId, tmuxSession }, authContextFromSystem(), { now: () => command.updatedAt });
+  }));
+  (await markManagedAgentRunning({ policyName, spawnRequestId, agentId, tmuxSession }, authContextFromSystem(), { now: () => command.updatedAt }));
 }
 
-export function restartSpawnParamsForAgent(...args: Parameters<typeof buildRestartSpawnParamsForAgent>) {
-  return buildRestartSpawnParamsForAgent(...args);
+export async function restartSpawnParamsForAgent(...args: Parameters<typeof buildRestartSpawnParamsForAgent>) {
+  return (await buildRestartSpawnParamsForAgent(...args));
 }
 export async function restartSpawnParamsForAgentAsync(...args: Parameters<typeof buildRestartSpawnParamsForAgentAsync>) {
   return buildRestartSpawnParamsForAgentAsync(...args);

package/src/services/review-publish.ts

@@ -17,10 +17,10 @@ export interface ReviewPublishDispatch {
   error?: string;
 }
 
-export function dispatchReviewPublish(
+export async function dispatchReviewPublish(
   workspace: WorkspaceRecord | undefined,
   opts: { requestedBy: string; taskId: number; sha?: string; emit: (command: Command) => void },
-): ReviewPublishDispatch | undefined {
+): Promise<ReviewPublishDispatch | undefined> {
   if (!workspace || workspace.mode !== "isolated" || !workspace.worktreePath) return undefined;
   // #1452 round-6 H2b / round-7 H3 — publishing REQUIRES an immutable delivered COMMIT OID (the host
   // must pin exactly it, and settlement matches result.sha === requested sha). It must be a concrete
@@ -46,28 +46,11 @@ export function dispatchReviewPublish(
     // failing ledger insert was swallowed, leaving a POLLABLE publish command with NO cleanup ledger
     // (a crash/insert-failure orphan). The transaction makes them all-or-nothing: a ledger failure
     // rolls back the command row too, so a reviewer never sees a command with no durable cleanup path.
-    let command: Command | undefined;
-    let buildError: string | undefined;
-    writeTransaction(() => {
-      const built = buildWorkspacePublishReviewCommand(workspace, opts.requestedBy, { taskId: opts.taskId, sha, reviewRef });
-      if (!built.ok) { buildError = built.error; return; } // nothing was persisted (owner/worktree check)
-      // Round-9: PIN the exact ref (relay-derived, host-asserted-equal before push) so cleanup can
-      // delete it even if the host's success-result is lost. The row also holds the branch/host/
-      // requested-sha so cleanup survives a purge/recycle. On settlement the reconciler re-writes the
-      // host-confirmed ref (identical to this one, since the host refuses to push a divergent ref).
-      upsertReviewRefCleanup({
-        id: built.command.id,
-        ref: reviewRef,
-        workspaceId: workspace.id,
-        repoRoot: workspace.repoRoot,
-        worktreePath: workspace.worktreePath,
-        branch: workspace.branch,
-        orchestratorId: workspace.orchestratorId,
-        requestedSha: sha,
-      });
-      command = built.command;
-    });
-    if (!command) return { workspaceId: workspace.id, dispatched: false, error: buildError ?? "review publish not dispatched" };
+    const built = await buildWorkspacePublishReviewCommand(workspace, opts.requestedBy, { taskId: opts.taskId, sha, reviewRef,
+      cleanup: { ref: reviewRef, workspaceId: workspace.id, repoRoot: workspace.repoRoot, worktreePath: workspace.worktreePath,
+        branch: workspace.branch, orchestratorId: workspace.orchestratorId, requestedSha: sha } });
+    if (!built.ok) return { workspaceId: workspace.id, dispatched: false, error: built.error };
+    const command = built.command;
     opts.emit(command); // durable state (command + ledger) is committed before anyone is notified
     return { workspaceId: workspace.id, commandId: command.id, dispatched: true };
   } catch (err) {

package/src/services/review-ref-reconcile.ts

@@ -1,3 +1,4 @@
+import { cancelPendingCommandAsync, recordReviewRefCleanupDispatchAsync, markReviewRefPublishedAsync, markReviewRefFailedAsync, markReviewRefClosedAsync, markReviewRefAnnouncedAsync, deleteReviewRefCleanupAsync } from "../db/runtime-tail-async";
 // #1452 round-4 — the durable, OFF-critical-path engine that settles the review-ref (refs/review/*)
 // lifecycle and cleans up leaked refs. It reads the review_ref_cleanups ledger (one row per EXACT
 // server-derived ref) — NOT a per-workspace marker — so it fixes every round-4 finding at once:
@@ -23,18 +24,8 @@
 // was never enabled, since rows are only written when a publish is dispatched.
 
 import { getWorkspace } from "../db";
-import {
-  deleteReviewRefCleanup,
-  getReviewRefFenceToken,
-  listReviewRefCleanups,
-  markReviewRefAnnounced,
-  markReviewRefClosed,
-  markReviewRefFailed,
-  markReviewRefPublished,
-  recordReviewRefCleanupDispatch,
-  type ReviewRefCleanup,
-} from "../db/review-ref-cleanups";
-import { cancelPendingCommand, getCommand } from "../commands-db";
+import { getReviewRefFenceToken, listReviewRefCleanups, type ReviewRefCleanup } from "../db/review-ref-cleanups";
+import { getCommand } from "../commands-db";
 import { emitCommand } from "../maintenance/events";
 import { emitRelayEvent } from "../events";
 import { buildReviewRefUnpublishCommandFromFields } from "../workspace-actions";
@@ -81,16 +72,16 @@ interface ReconcileDeps {
    *  pending publish can still be externally spoofed to succeeded{pushed:true}. Requiring the token here
    *  refuses that phantom before it can announce a ref that was never pushed. Returns null when absent. */
   getFenceToken: (id: string) => string | null;
-  markPublished: typeof markReviewRefPublished;
-  markFailed: typeof markReviewRefFailed;
-  markAnnounced: typeof markReviewRefAnnounced;
-  markClosed: typeof markReviewRefClosed;
-  recordDispatch: typeof recordReviewRefCleanupDispatch;
-  deleteCleanup: typeof deleteReviewRefCleanup;
+  markPublished: typeof markReviewRefPublishedAsync;
+  markFailed: typeof markReviewRefFailedAsync;
+  markAnnounced: typeof markReviewRefAnnouncedAsync;
+  markClosed: typeof markReviewRefClosedAsync;
+  recordDispatch: typeof recordReviewRefCleanupDispatchAsync;
+  deleteCleanup: typeof deleteReviewRefCleanupAsync;
   buildUnpublish: typeof buildReviewRefUnpublishCommandFromFields;
   /** #1452 round-10 HIGH #1 — atomically cancel the publish command IFF still pending; true means it
    *  was never dispatched (proven no push can occur), so a closed round can retire it without racing. */
-  cancelPublish: (id: string) => boolean;
+  cancelPublish: (id: string) => boolean | Promise<boolean>;
   emit: (command: Command) => void;
   /** Durable publish-settled announcement: emitted for a published-but-unannounced row, then marked
    *  announced only on success — so a crash/outbox failure re-emits next pass (round-6 H-atomicity). */
@@ -164,21 +155,21 @@ const realDeps: ReconcileDeps = {
   },
   getCommand,
   getFenceToken: getReviewRefFenceToken,
-  markPublished: markReviewRefPublished,
-  markFailed: markReviewRefFailed,
-  markAnnounced: markReviewRefAnnounced,
-  markClosed: markReviewRefClosed,
-  recordDispatch: recordReviewRefCleanupDispatch,
-  deleteCleanup: deleteReviewRefCleanup,
+  markPublished: markReviewRefPublishedAsync,
+  markFailed: markReviewRefFailedAsync,
+  markAnnounced: markReviewRefAnnouncedAsync,
+  markClosed: markReviewRefClosedAsync,
+  recordDispatch: recordReviewRefCleanupDispatchAsync,
+  deleteCleanup: deleteReviewRefCleanupAsync,
   buildUnpublish: buildReviewRefUnpublishCommandFromFields,
-  cancelPublish: (id) => cancelPendingCommand(id, "workspace.publish-review", "review publish canceled: round closed before dispatch"),
+  cancelPublish: async (id) => (await cancelPendingCommandAsync(id, "workspace.publish-review", "review publish canceled: round closed before dispatch")),
   emit: emitCommand,
   emitPublished: emitPublishedEvent,
   now: () => Date.now(),
 };
 
 /** One reconcile pass over the durable ledger. Pure over its (injectable) deps for testing. */
-export function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: AbortSignal): ReviewRefReconcileResult {
+export async function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: AbortSignal): Promise<ReviewRefReconcileResult> {
   const rows = deps.listCleanups();
   const published: string[] = [];
   const failed: string[] = [];
@@ -208,7 +199,7 @@ export function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: Abo
       const roundClosed = !ws
         || TERMINAL_WORKSPACE_STATUSES.has(ws.status as any)
         || Boolean(ws.branch && row.branch && ws.branch !== row.branch);
-      if (roundClosed) { deps.markClosed(row.id, now); closed = true; }
+      if (roundClosed) { await deps.markClosed(row.id, now); closed = true; }
     }
 
     // 1) Settle the publish outcome (H2). A ref is only real once its push command TERMINALLY
@@ -229,8 +220,8 @@ export function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: Abo
         // push can occur) → retire with nothing on origin. If it was already claimed (accepted/running),
         // the host may push, so WAIT for its terminal settlement — cleanup then runs safely AFTER it.
         if (!closed) { inFlight.push(label()); continue; }
-        if (!deps.cancelPublish(row.id)) { inFlight.push(label()); continue; } // already claimed → wait
-        deps.markFailed(row.id, now, false); // canceled before dispatch → nothing on origin, drop the ref
+        if (!await deps.cancelPublish(row.id)) { inFlight.push(label()); continue; } // already claimed → wait
+        await deps.markFailed(row.id, now, false); // canceled before dispatch → nothing on origin, drop the ref
         confirmedRef = undefined;
         publishState = "failed";
         failed.push(label());
@@ -242,7 +233,7 @@ export function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: Abo
         // never-claimed pending publish spoofed to succeeded has none, so it never advances to published.
         const ref = confirmedPublishRef(cmd, row.requestedSha, row.ref, deps.getFenceToken(row.id));
         if (ref) {
-          deps.markPublished(row.id, ref, now); // sets announced=0 → announced below (H-atomicity)
+          await deps.markPublished(row.id, ref, now); // sets announced=0 → announced below (H-atomicity)
           confirmedRef = ref;
           publishState = "published";
           announced = false;
@@ -253,7 +244,7 @@ export function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: Abo
           // timed-out/canceled, a missing/pruned result, or a malformed success) may have pushed before
           // its result was lost ⇒ RETAIN the pinned ref as a tombstone and unpublish before deletion.
           const notPushed = definitivelyNotPushed(cmd);
-          deps.markFailed(row.id, now, !notPushed);
+          await deps.markFailed(row.id, now, !notPushed);
           if (notPushed) confirmedRef = undefined;
           publishState = "failed";
           failed.push(label());
@@ -267,7 +258,7 @@ export function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: Abo
     if (publishState === "published" && !announced && confirmedRef) {
       try {
         deps.emitPublished({ workspaceId: row.workspaceId, ref: confirmedRef, ...(row.requestedSha ? { sha: row.requestedSha } : {}), ...(row.branch ? { branch: row.branch } : {}) });
-        deps.markAnnounced(row.id, now);
+        await deps.markAnnounced(row.id, now);
         announced = true;
       } catch { /* emit failed → leave announced=0 so the next pass re-emits (at-least-once) */ }
     }
@@ -285,7 +276,7 @@ export function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: Abo
 
     // A closed round with NOTHING on origin — a DEFINITIVELY-not-pushed outcome, or a legacy row that
     // never pinned a ref — has nothing to delete. Retire it directly, no host round-trip, no leak.
-    if (!confirmedRef) { deps.deleteCleanup(row.id); cleared.push(label()); continue; }
+    if (!confirmedRef) { await deps.deleteCleanup(row.id); cleared.push(label()); continue; }
 
     // 3) Drive deletion (H4/M7) of the EXACT host-confirmed ref. CONFIRM a prior attempt first — a
     //    succeeded delete clears the row regardless of the backoff window; the backoff gates only a
@@ -294,20 +285,20 @@ export function reconcileReviewRefs(deps: ReconcileDeps = realDeps, signal?: Abo
       const cmd = deps.getCommand(row.cleanupCommandId);
       if (cmd && !COMMAND_TERMINAL.has(cmd.status)) { inFlight.push(confirmedRef); continue; }
       if (cmd && cmd.status === "succeeded" && !cmd.error) {
-        deps.deleteCleanup(row.id); // origin confirmed the ref is gone (deleted or already absent)
+        await deps.deleteCleanup(row.id); // origin confirmed the ref is gone (deleted or already absent)
         cleared.push(confirmedRef);
         continue;
       }
       // failed / timed_out / missing → re-dispatch below, subject to backoff.
     }
     if (row.nextAttemptAt != null && row.nextAttemptAt > now) { waiting.push(confirmedRef); continue; }
-    const built = deps.buildUnpublish(
+    const built = await deps.buildUnpublish(
       { workspaceId: row.workspaceId, repoRoot: row.repoRoot, worktreePath: row.worktreePath, branch: row.branch, orchestratorId: row.orchestratorId, ref: confirmedRef },
       "review-ref-reconciler",
     );
     if (!built.ok) continue; // no owning host reachable yet — retry next tick (no backoff burned)
     deps.emit(built.command);
-    deps.recordDispatch(row.id, built.command.id, now + cleanupBackoffMs(row.cleanupAttempts), now);
+    await deps.recordDispatch(row.id, built.command.id, now + cleanupBackoffMs(row.cleanupAttempts), now);
     dispatched.push(confirmedRef);
   }
 
@@ -326,7 +317,7 @@ export const REVIEW_REF_RECONCILE_JOB = {
   intervalMs: WORKSPACE_ORPHAN_REAPER_INTERVAL_MS,
   runOnStart: false,
   deadlineMs: 60 * 1000,
-  handler: (context: { signal?: AbortSignal }) => reconcileReviewRefs(undefined, context.signal) as unknown as Record<string, unknown>,
+  handler: async (context: { signal?: AbortSignal }) => (await reconcileReviewRefs(undefined, context.signal)) as unknown as Record<string, unknown>,
 };
 
 // Test seam: backoff parameters so tests assert scheduling without duplicating literals.