@monoes/monomindcli 2.10.30 → 2.10.31

package/dist/src/commands/org-observe.js

@@ -26,6 +26,18 @@ export const printOrgJson = (payload) => {
     process.stdout.write(`${JSON.stringify(payload)}\n`);
     return { success: true, data: payload };
 };
+/** M5: `--by <resolver>` — who resolved a decision (default `human`). Returns
+ *  an error string for an invalid value. */
+const resolverFlag = async (ctx) => {
+    const raw = ctx.flags.by;
+    if (raw === undefined || raw === false)
+        return { ok: true, by: 'human' };
+    const { normalizeResolver } = await import('../orgrt/approvals.js');
+    const by = normalizeResolver(raw);
+    if (!by)
+        return { ok: false, message: '--by must be 1-128 printable characters' };
+    return { ok: true, by };
+};
 /** Validate org config(s) against OrgDefSchema — the exact parse `org run`/`org serve`
  * perform — plus the structural invariants the runtime assumes but the schema can't
  * express (single root role, resolvable reports_to, unique ids, parseable schedule). */
@@ -83,6 +95,19 @@ export const validateAction = async (ctx) => {
         ? { success: false, message: `${failed} of ${files.length} org config(s) failed validation` }
         : { success: true, message: `${files.length} org config(s) valid` };
 };
+/** M2: ids of the org's endpoint roles (automations, not agents) — excluded
+ *  from the costs/report/flow role tables. Unreadable config → none. */
+const endpointRoleIds = (cwd, name) => {
+    try {
+        const raw = JSON.parse(readFileSync(join(cwd, ORG_DIR, `${name}.json`), 'utf8'));
+        return new Set((Array.isArray(raw.roles) ? raw.roles : [])
+            .filter((r) => r?.kind === 'endpoint' && typeof r.id === 'string')
+            .map((r) => r.id));
+    }
+    catch {
+        return new Set();
+    }
+};
 // Run ids are joined into filesystem paths — enforce the daemon's own id shape
 // so a crafted --run can't traverse out of the org directory (same reason the
 // org-name guard exists).
@@ -295,6 +320,10 @@ export const reportAction = async (ctx, name) => {
     if (!events.length)
         return { success: false, message: `run ${run} has no recorded events` };
     const s = summarizeRun(events);
+    // M2: endpoint roles are automations — they have no row in the role tables.
+    const endpointIds = endpointRoleIds(ctx.cwd, name);
+    for (const id of endpointIds)
+        delete s.roles[id];
     // Protocol JSON mode (§7.2): the run summary as a bare object. Emitted
     // before the human-only flag modes (mermaid/audit/by-role) — those render
     // views of the same summary and have no JSON shape defined by the spec.
@@ -406,8 +435,9 @@ export const reportAction = async (ctx, name) => {
     const roleCeiling = new Map();
     try {
         const def = OrgDefSchema.parse(JSON.parse(readFileSync(join(ctx.cwd, ORG_DIR, `${name}.json`), 'utf8')));
-        perRoleBudget = Math.floor((def.run_config.budget_tokens ?? 1_000_000) / def.roles.length);
-        for (const r of def.roles) {
+        const sessionRoles = def.roles.filter((r) => r.kind !== 'endpoint');
+        perRoleBudget = Math.floor((def.run_config.budget_tokens ?? 1_000_000) / Math.max(1, sessionRoles.length));
+        for (const r of sessionRoles) {
             const max = r.policy?.maxTokens;
             roleCeiling.set(r.id, max ?? r.budget_tokens ?? perRoleBudget);
         }
@@ -545,7 +575,18 @@ export const approvalsAction = async (ctx, name) => {
     }
     const shown = ctx.flags.all === true ? all : all.filter((a) => a.approved === null);
     if (orgJson(ctx))
-        return printOrgJson({ v: 1, org: name, items: shown });
+        return printOrgJson({
+            v: 1,
+            org: name,
+            // M5: requestId / resolvedBy / input are always present (null for
+            // entries recorded before they existed).
+            items: shown.map((a) => ({
+                ...a,
+                requestId: a.requestId ?? null,
+                resolvedBy: a.resolvedBy ?? null,
+                input: a.input ?? null,
+            })),
+        });
     if (!shown.length) {
         log(output.info(all.length
             ? `No pending approvals for org ${name} (${all.length} resolved — use --all).`
@@ -555,10 +596,12 @@ export const approvalsAction = async (ctx, name) => {
     for (const a of shown) {
         const when = new Date(a.ts).toISOString().replace('T', ' ').slice(0, 16);
         const mark = a.approved === null ? '❓' : a.approved ? '✓' : '✗';
-        log(output.info(`${mark} ${when}  ${a.roleId}: ${a.action}`));
+        const ref = a.requestId ? ` [${a.requestId}]` : '';
+        const by = a.resolvedBy ? ` (by ${a.resolvedBy})` : '';
+        log(output.info(`${mark} ${when}  ${a.roleId}: ${a.action}${ref}${by}`));
     }
     if (shown.some((a) => a.approved === null))
-        log(output.info(`\nApprove with: monomind org approve ${name} <role> <action>\nDeny with: monomind org deny ${name} <role> <action>`));
+        log(output.info(`\nApprove with: monomind org approve ${name} <role> <action> [--request <id>] [--by <resolver>]\nDeny with: monomind org deny ${name} <role> <action> [--request <id>] [--by <resolver>]`));
     return { success: true };
 };
 /** `org answer <name> <question-id> <answer...>` — answer a pending ask_human question.
@@ -587,6 +630,10 @@ export const answerAction = async (ctx, name) => {
     }
     if (q.answer !== null)
         return { success: false, message: `question "${questionId}" was already answered` };
+    const byFlag = await resolverFlag(ctx);
+    if (!byFlag.ok)
+        return { success: false, message: byFlag.message };
+    const resolvedBy = byFlag.by;
     // Live path: the hosting daemon updates questions.json and pushes into the role's mailbox.
     // SEC: answering a role's question is a human decision — authenticate with
     // the operator credential, not the agent-facing one in the broker entry.
@@ -601,7 +648,7 @@ export const answerAction = async (ctx, name) => {
                     'Content-Type': 'application/json',
                     ...(cred ? { 'x-monomind-cred': cred } : {}),
                 },
-                body: JSON.stringify({ org: name, role: q.role, questionId, answer }),
+                body: JSON.stringify({ org: name, role: q.role, questionId, answer, resolvedBy }),
                 signal: AbortSignal.timeout(10_000),
             });
             const data = (await res.json().catch(() => ({})));
@@ -614,6 +661,7 @@ export const answerAction = async (ctx, name) => {
                         role: q.role,
                         delivery: 'live',
                         answered: true,
+                        resolvedBy,
                     });
                 log(output.success(`Answer delivered to ${name}:${q.role} (live).`));
                 return { success: true };
@@ -666,8 +714,8 @@ export const answerAction = async (ctx, name) => {
         return { success: false, message: 'queueing failed — answer not recorded' };
     }
     const merged = fresh.some((x) => x.questionId === questionId)
-        ? fresh.map((x) => (x.questionId === questionId ? { ...x, answer, answeredAt: Date.now() } : x))
-        : [...fresh, { ...q, answer, answeredAt: Date.now() }];
+        ? fresh.map((x) => x.questionId === questionId ? { ...x, answer, answeredAt: Date.now(), resolvedBy } : x)
+        : [...fresh, { ...q, answer, answeredAt: Date.now(), resolvedBy }];
     const dest = join(ctx.cwd, ORG_DIR, name, 'questions.json');
     const tmp = `${dest}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify({ questions: merged }, null, 2));
@@ -681,18 +729,42 @@ export const answerAction = async (ctx, name) => {
             role: q.role,
             delivery: 'queued',
             answered: true,
+            resolvedBy,
         });
     log(output.success(`Answer recorded — ${name}:${q.role} receives it when the org next runs.`));
     return { success: true };
 };
 /** `org inbox <name> --json '{"from":"orgA:role","subject":"...","body":"..."}' [--to role]`
+ *  (or `--from/--subject/--body`) `[--format json]`.
  *  Inbound entrypoint for cross-org/remote delivery — orgrt/remote.ts's deliverRemote()
- *  shells out to exactly this command over SSH. Live path: POST to the hosting daemon's
- *  /api/xdeliver when the org is registered with the broker (mirrors cross-org.ts's
- *  deliverRemote). Offline path: spool into inbox.jsonl, which the daemon drains into
- *  the target role's mailbox on the org's next start (daemon.ts drainInbox) — the same
- *  semantics as a queued human answer. */
+ *  shells out to exactly this command over SSH, and mono-agent replies through it.
+ *
+ *  Live path (M3): POST to the hosting daemon's /api/xdeliver with the OPERATOR
+ *  credential (readOperatorCredential), which lets the daemon trust `from` as
+ *  given — the sender org need not be registered (`workflow`, an automation
+ *  role). Without an operator credential it presents the sender org's own
+ *  broker credential, if that org is registered. Offline path: spool into
+ *  inbox.jsonl, drained into the role's mailbox on the org's next start.
+ *
+ *  `--format json` prints `{"v":1,"org","to","from","delivery":"live"|"queued",
+ *  "receipt","messageId"}`. Exit 0 for live and queued; non-zero only for
+ *  invalid input or an unknown org. */
 export const inboxAction = async (ctx, name) => {
+    const json = orgJson(ctx);
+    // JSON mode keeps stdout to the single payload — diagnostics go to stderr.
+    const note = (text) => {
+        if (json)
+            process.stderr.write(`${text}\n`);
+        else
+            log(text);
+    };
+    const fail = (message) => {
+        if (json)
+            process.stdout.write(`${JSON.stringify({ v: 1, org: name, error: message })}\n`);
+        else
+            log(output.error(message));
+        return { success: false, message };
+    };
     let payload = {};
     const rawJson = ctx.flags.json;
     if (typeof rawJson === 'string') {
@@ -700,7 +772,7 @@ export const inboxAction = async (ctx, name) => {
             payload = JSON.parse(rawJson);
         }
         catch {
-            return { success: false, message: 'org inbox: --json is not valid JSON' };
+            return fail('org inbox: --json is not valid JSON');
         }
     }
     else {
@@ -709,43 +781,50 @@ export const inboxAction = async (ctx, name) => {
     const from = typeof payload.from === 'string' ? payload.from.trim() : '';
     const subject = typeof payload.subject === 'string' ? payload.subject : '';
     const body = typeof payload.body === 'string' ? payload.body : '';
-    if (!from || !body) {
-        log(output.error('org inbox: payload requires "from" and "body" (via --json or --from/--body)'));
-        return { success: false, message: 'inbox payload requires from and body' };
-    }
+    if (!from || !body)
+        return fail('org inbox: payload requires "from" and "body" (via --json or --from/--body)');
+    if (!/^[^\s:]{1,128}(:[^\s:]{1,128})?$/.test(from))
+        return fail(`org inbox: invalid sender "${from}" — use "<org>:<role>" or "<role>"`);
+    const { lookupOrg, normalizeCredential, readOperatorCredential } = await import('../orgrt/broker.js');
+    const remote = lookupOrg(name);
+    const defPath = join(ctx.cwd, ORG_DIR, `${name}.json`);
+    if (!remote && !existsSync(defPath))
+        return fail(`Org not found: ${name}`);
     // Target role: explicit --to, else the org's coordinator (reports_to == null),
     // else the first role — matching where a role-less cross-org message should land.
     let toRole = typeof ctx.flags.to === 'string' ? ctx.flags.to : '';
-    if (toRole && !/^[a-z0-9][a-z0-9_-]*$/i.test(toRole)) {
-        log(output.error(`Invalid role id: ${toRole}`));
-        return { success: false, message: 'invalid role id' };
-    }
+    if (toRole && !/^[a-z0-9][a-z0-9_-]*$/i.test(toRole))
+        return fail(`Invalid role id: ${toRole}`);
     if (!toRole) {
-        const defPath = join(ctx.cwd, ORG_DIR, `${name}.json`);
-        if (!existsSync(defPath)) {
-            log(output.error(`Org not found: ${name}`));
-            return { success: false, message: 'org not found' };
-        }
+        if (!existsSync(defPath))
+            return fail(`Org "${name}" config is not in this project — pass --to <role>.`);
         try {
             const def = JSON.parse(readFileSync(defPath, 'utf8'));
             const roles = Array.isArray(def.roles) ? def.roles : [];
             toRole = roles.find((r) => r.reports_to == null)?.id ?? roles[0]?.id ?? '';
         }
         catch (err) {
-            log(output.error(`Could not read org config for ${name}: ${err instanceof Error ? err.message : String(err)}`));
-            return { success: false, message: 'org config unreadable' };
+            return fail(`Could not read org config for ${name}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        if (!toRole) {
-            log(output.error(`Org "${name}" has no roles to deliver to — pass --to <role>.`));
-            return { success: false, message: 'no deliverable role' };
-        }
-    }
+        if (!toRole)
+            return fail(`Org "${name}" has no roles to deliver to — pass --to <role>.`);
+    }
+    const { newMessageId, queueMessage } = await import('../orgrt/inbox.js');
+    const messageId = newMessageId();
+    const to = `${name}:${toRole}`;
+    const done = (delivery, receipt) => {
+        if (json)
+            return printOrgJson({ v: 1, org: name, to, from, delivery, receipt, messageId });
+        log(output.success(receipt));
+        return { success: true, message: receipt };
+    };
     // Live path: a hosting daemon registered this org with the broker.
-    const { lookupOrg, normalizeCredential } = await import('../orgrt/broker.js');
-    const remote = lookupOrg(name);
     if (remote) {
         const [fromOrg, fromRole] = from.includes(':') ? from.split(':', 2) : ['external', from];
-        const cred = normalizeCredential(remote.credential);
+        const operatorCred = readOperatorCredential(name);
+        const agentCred = normalizeCredential(remote.credential);
+        const cred = operatorCred ?? agentCred;
+        const fromCredential = operatorCred ? undefined : lookupOrg(fromOrg)?.credential;
         try {
             const res = await fetch(`${remote.url}/api/xdeliver`, {
                 method: 'POST',
@@ -753,36 +832,48 @@ export const inboxAction = async (ctx, name) => {
                     'Content-Type': 'application/json',
                     ...(cred ? { 'x-monomind-cred': cred } : {}),
                 },
-                body: JSON.stringify({ fromOrg, fromRole, toOrg: name, toRole, subject, body }),
+                body: JSON.stringify({
+                    fromOrg,
+                    fromRole,
+                    ...(fromCredential ? { fromCredential } : {}),
+                    toOrg: name,
+                    toRole,
+                    subject,
+                    body,
+                    messageId,
+                }),
                 signal: AbortSignal.timeout(10_000),
             });
             const data = (await res.json().catch(() => ({})));
             if (res.ok && data.ok) {
-                log(output.success(data.receipt ?? `delivered to ${name}:${toRole}`));
-                return { success: true, message: data.receipt ?? 'delivered' };
+                const receipt = data.receipt ?? `delivered to ${to}`;
+                // The daemon itself may have queued it (role starting, org waking).
+                return done(/^queued/.test(receipt) ? 'queued' : 'live', receipt);
             }
-            log(output.warning(`Live delivery rejected (${data.error ?? res.status}) — falling back to offline queue.`));
+            note(output.warning(`Live delivery rejected (${data.error ?? res.status}) — falling back to offline queue.`));
         }
         catch (err) {
-            log(output.warning(`Hosting daemon unreachable (${err instanceof Error ? err.message : 'error'}) — falling back to offline queue.`));
+            note(output.warning(`Hosting daemon unreachable (${err instanceof Error ? err.message : 'error'}) — falling back to offline queue.`));
         }
     }
     // Offline path: spool; drained into the role's mailbox when the org next starts.
-    const { queueMessage } = await import('../orgrt/inbox.js');
     const queued = queueMessage(ctx.cwd, name, {
         fromQualified: from,
         toRole,
         subject,
         body,
         ts: Date.now(),
+        messageId,
     });
     if (!queued) {
-        log(output.error(`Could not queue the message for ${name}:${toRole} (disk full or permissions).`));
+        const message = `Could not queue the message for ${to} (disk full or permissions).`;
+        if (json)
+            process.stdout.write(`${JSON.stringify({ v: 1, org: name, error: message })}\n`);
+        else
+            log(output.error(message));
         return { success: false, message: 'queueing failed' };
     }
-    const receipt = `queued for ${name}:${toRole} (delivered when the org next runs)`;
-    log(output.success(receipt));
-    return { success: true, message: receipt };
+    return done('queued', `queued for ${to} (delivered when the org next runs)`);
 };
 /** `org create <name> --template <t> [--goal g] [--schedule s]` — scaffold a config from a template. */
 export const createAction = async (ctx, name) => {
@@ -875,9 +966,13 @@ export const costsAction = async (ctx, name) => {
         log(output.info(`Per-role cost breakdown for ${name} / ${run}:`));
     // Combine data from runtime.json (live metrics) and summary (historical)
     const roleData = new Map();
+    // M2: endpoint roles are automations — no row in the cost table.
+    const endpointIds = endpointRoleIds(ctx.cwd, name);
     // Add live metrics from runtime.json
     if (rt?.roleMetrics) {
         for (const [roleId, metrics] of Object.entries(rt.roleMetrics)) {
+            if (endpointIds.has(roleId))
+                continue;
             roleData.set(roleId, {
                 tokens: metrics.tokens,
                 costUsd: metrics.costUsd,
@@ -888,6 +983,8 @@ export const costsAction = async (ctx, name) => {
     // Add historical data from summary if available
     if (summary?.roles) {
         for (const [roleId, roleStats] of Object.entries(summary.roles)) {
+            if (endpointIds.has(roleId))
+                continue;
             const existing = roleData.get(roleId) ?? { tokens: 0, costUsd: 0, messages: 0 };
             roleData.set(roleId, {
                 tokens: existing.tokens || roleStats.tokens,
@@ -963,7 +1060,11 @@ export const flowAction = async (ctx, name) => {
             }
         }
     }
-    const roles = Array.from(roleSet).sort();
+    // M2: endpoint roles are automations — not listed as role nodes.
+    const endpointIds = endpointRoleIds(ctx.cwd, name);
+    const roles = Array.from(roleSet)
+        .filter((r) => !endpointIds.has(r))
+        .sort();
     // Protocol JSON mode (§7.2): structured roles + edges instead of Mermaid.
     if (orgJson(ctx))
         return printOrgJson({ v: 1, org: name, run, roles, edges: edgeObjects });
@@ -992,6 +1093,14 @@ export const flowAction = async (ctx, name) => {
  *  the daemon is unreachable — mirrors answerAction's live-then-offline shape. */
 async function resolveApproval(ctx, name, role, action, approved) {
     const verb = approved ? 'approved' : 'denied';
+    // M5: attribution and request scoping.
+    const byFlag = await resolverFlag(ctx);
+    if (!byFlag.ok)
+        return { success: false, message: byFlag.message };
+    const resolvedBy = byFlag.by;
+    const requestId = typeof ctx.flags.request === 'string' && ctx.flags.request ? ctx.flags.request : undefined;
+    if (ctx.flags.request !== undefined && !requestId)
+        return { success: false, message: '--request needs an approval request id (apr-…)' };
     // SEC: approvals carry human authority — the operator credential, never the
     // broker entry's agent credential (which any agent subprocess can read).
     const { lookupOrg, readOperatorCredential } = await import('../orgrt/broker.js');
@@ -1005,7 +1114,14 @@ async function resolveApproval(ctx, name, role, action, approved) {
                     'Content-Type': 'application/json',
                     ...(cred ? { 'x-monomind-cred': cred } : {}),
                 },
-                body: JSON.stringify({ org: name, role, action, approved }),
+                body: JSON.stringify({
+                    org: name,
+                    role,
+                    action,
+                    approved,
+                    resolvedBy,
+                    ...(requestId ? { requestId } : {}),
+                }),
                 signal: AbortSignal.timeout(10_000),
             });
             const data = (await res.json().catch(() => ({})));
@@ -1018,10 +1134,12 @@ async function resolveApproval(ctx, name, role, action, approved) {
                         action,
                         approved,
                         delivery: 'live',
+                        resolvedBy,
+                        requestId: requestId ?? null,
                     });
                 log(approved
-                    ? output.success(`Approved: ${role} may execute ${action} (live).`)
-                    : output.info(`Denied: ${role} may NOT execute ${action} (live).`));
+                    ? output.success(`Approved: ${role} may execute ${action} (live, by ${resolvedBy}).`)
+                    : output.info(`Denied: ${role} may NOT execute ${action} (live, by ${resolvedBy}).`));
                 return { success: true, message: `${verb} ${action} for ${role}` };
             }
             log(output.warning(`Live delivery rejected (${data.error ?? res.status}) — falling back to offline queue.`));
@@ -1037,24 +1155,45 @@ async function resolveApproval(ctx, name, role, action, approved) {
     }
     const data = JSON.parse(readFileSync(approvalsPath, 'utf8'));
     const pending = data.approvals ?? [];
-    const item = pending.find((a) => a.roleId === role && a.action === action);
-    if (!item) {
+    // Same selection as the daemon's setApproval: the one request named by
+    // --request, else every still-pending entry for the (role, action) pair.
+    const items = pending.filter((a) => a.roleId === role &&
+        a.action === action &&
+        a.approved === null &&
+        (requestId === undefined || a.requestId === requestId));
+    if (items.length === 0) {
         return {
             success: false,
-            message: `no pending approval found for role ${role} action ${action}`,
+            message: requestId
+                ? `no pending approval ${requestId} found for role ${role} action ${action}`
+                : `no pending approval found for role ${role} action ${action}`,
         };
     }
-    item.approved = approved;
-    item.ts = Date.now();
+    const now = Date.now();
+    for (const item of items) {
+        item.approved = approved;
+        item.ts = now;
+        item.resolvedBy = resolvedBy;
+        item.resolvedAt = now;
+    }
     writeFileSync(approvalsPath, JSON.stringify({ approvals: pending }, null, 2));
     if (orgJson(ctx))
-        return printOrgJson({ v: 1, org: name, role, action, approved, delivery: 'recorded' });
+        return printOrgJson({
+            v: 1,
+            org: name,
+            role,
+            action,
+            approved,
+            delivery: 'recorded',
+            resolvedBy,
+            requestId: requestId ?? null,
+        });
     log(approved
-        ? output.success(`Approved: ${role} may execute ${action}`)
-        : output.info(`Denied: ${role} may NOT execute ${action}`));
+        ? output.success(`Approved: ${role} may execute ${action} (by ${resolvedBy})`)
+        : output.info(`Denied: ${role} may NOT execute ${action} (by ${resolvedBy})`));
     return { success: true, message: `${verb} ${action} for ${role}` };
 }
-/** `org approve <org> <role> <action>` — approve a pending tool/action approval */
+/** `org approve <org> <role> <action> [--request <id>] [--by <resolver>]` — approve a pending tool/action approval */
 export const approveAction = async (ctx, name) => {
     const role = ctx.args[1];
     const action = ctx.args[2];
@@ -1063,7 +1202,7 @@ export const approveAction = async (ctx, name) => {
     }
     return resolveApproval(ctx, name, role, action, true);
 };
-/** `org deny <org> <role> <action>` — deny a pending tool/action approval */
+/** `org deny <org> <role> <action> [--request <id>] [--by <resolver>]` — deny a pending tool/action approval */
 export const denyAction = async (ctx, name) => {
     const role = ctx.args[1];
     const action = ctx.args[2];
@@ -1315,6 +1454,10 @@ export const gateResolveAction = async (ctx, name, approved) => {
         return { success: false, message: `gate "${gateId}" not found for org "${name}"` };
     if (gate.status !== 'pending')
         return { success: false, message: `gate "${gateId}" already resolved (${gate.status})` };
+    const byFlag = await resolverFlag(ctx);
+    if (!byFlag.ok)
+        return { success: false, message: byFlag.message };
+    const resolvedBy = byFlag.by;
     // SEC: gate resolution is a human decision — operator credential only.
     const { lookupOrg, readOperatorCredential } = await import('../orgrt/broker.js');
     const remote = lookupOrg(name);
@@ -1327,7 +1470,7 @@ export const gateResolveAction = async (ctx, name, approved) => {
                     'Content-Type': 'application/json',
                     ...(cred ? { 'x-monomind-cred': cred } : {}),
                 },
-                body: JSON.stringify({ org: name, gateId, approved, resolution }),
+                body: JSON.stringify({ org: name, gateId, approved, resolution, resolvedBy }),
                 signal: AbortSignal.timeout(10_000),
             });
             const d = (await res.json().catch(() => ({})));
@@ -1339,6 +1482,7 @@ export const gateResolveAction = async (ctx, name, approved) => {
                         gate_id: gateId,
                         status: approved ? 'approved' : 'rejected',
                         delivery: 'live',
+                        resolvedBy,
                     });
                 log(output.success(`Gate ${gateId} ${approved ? 'approved' : 'rejected'} (live).`));
                 return { success: true, message: `gate ${approved ? 'approved' : 'rejected'}` };
@@ -1377,7 +1521,7 @@ export const gateResolveAction = async (ctx, name, approved) => {
         ...fresh.gates[idx],
         status: approved ? 'approved' : 'rejected',
         resolvedAt: Date.now(),
-        resolvedBy: 'human',
+        resolvedBy,
         resolution,
     };
     writeGates(ctx.cwd, name, fresh);
@@ -1388,6 +1532,7 @@ export const gateResolveAction = async (ctx, name, approved) => {
             gate_id: gateId,
             status: approved ? 'approved' : 'rejected',
             delivery: 'recorded',
+            resolvedBy,
         });
     log(output.success(`Gate ${gateId} ${approved ? 'approved' : 'rejected'} — ${name} picks it up on its next cycle.`));
     return { success: true, message: `gate ${approved ? 'approved' : 'rejected'} (queued)` };