@openparachute/agent 0.2.0 → 0.2.3-rc.2

package/src/transports/vault.test.ts

@@ -117,10 +117,10 @@ describe("VaultTransport — reply (outbound note write)", () => {
     // a child-only-tagged note is invisible to a `tag:#agent/message` query), and
     // the directional child `#agent/message/outbound` is the trigger discriminator.
     // We WRITE only the `#agent/message*` tags.
-    expect(sent.tags).toEqual(["#agent/message", "#agent/message/outbound"]);
+    expect(sent.tags).toEqual(["agent/message", "agent/message/outbound"]);
     // Regression guard: the queryable parent tag MUST be present literally.
-    expect(sent.tags).toContain("#agent/message");
-    expect(sent.tags).toContain("#agent/message/outbound");
+    expect(sent.tags).toContain("agent/message");
+    expect(sent.tags).toContain("agent/message/outbound");
     // Write-discipline: the interim/legacy tags are gone (CONTRACT dropped them).
     expect(sent.tags).not.toContain("#agent-message");
     expect(sent.tags).not.toContain("#agent-message/outbound");
@@ -246,8 +246,8 @@ describe("VaultTransport — writeThread (#agent/thread note, the unified model)
     // LOOP SAFETY (HARD CONSTRAINT 4): the thread note carries the thread tag EXACTLY —
     // NOT a message tag + NOT the inbound child — so it can never wake a session.
     expect(sent.tags).toEqual([AGENT_THREAD_TAG]);
-    expect(sent.tags).not.toContain("#agent/message");
-    expect(sent.tags).not.toContain("#agent/message/inbound");
+    expect(sent.tags).not.toContain("agent/message");
+    expect(sent.tags).not.toContain("agent/message/inbound");
     // Indexed/queryable fields.
     expect(sent.metadata.status).toBe("ok");
     expect(sent.metadata.definition).toBe("Agents/digest");
@@ -1007,7 +1007,7 @@ describe("VaultTransport — loadTranscript (read the durable store)", () => {
         getUrls.push(u);
         capturedAuth = (init?.headers as Record<string, string> | undefined)?.authorization ?? "";
         // CONTRACT: a SINGLE `#agent/message` query (no interim/legacy union).
-        if (u.includes("tag=%23agent%2Fmessage")) {
+        if (u.includes("tag=agent%2Fmessage")) {
           // Return notes OUT of ts order (prove the ascending sort) + a note from a
           // DIFFERENT channel (prove the client-side channel filter excludes it).
           return new Response(
@@ -1015,19 +1015,19 @@ describe("VaultTransport — loadTranscript (read the durable store)", () => {
               {
                 id: "n-out",
                 content: "session reply",
-                tags: ["#agent/message", "#agent/message/outbound"],
+                tags: ["agent/message", "agent/message/outbound"],
                 metadata: { agent: "eng", direction: "outbound", sender: "session", ts: "2026-06-08T00:00:02Z", in_reply_to: "n-in" },
               },
               {
                 id: "n-other",
                 content: "different channel — must be excluded",
-                tags: ["#agent/message", "#agent/message/inbound"],
+                tags: ["agent/message", "agent/message/inbound"],
                 metadata: { agent: "other", direction: "inbound", sender: "x", ts: "2026-06-08T00:00:03Z" },
               },
               {
                 id: "n-in",
                 content: "hi session",
-                tags: ["#agent/message", "#agent/message/inbound"],
+                tags: ["agent/message", "agent/message/inbound"],
                 metadata: { agent: "eng", direction: "inbound", sender: "aaron", ts: "2026-06-08T00:00:01Z" },
               },
             ]),
@@ -1049,7 +1049,7 @@ describe("VaultTransport — loadTranscript (read the durable store)", () => {
     // `metadata=` operator filter (the routing-key field isn't indexed on a bare
     // vault; we filter client-side). Overfetches the tag so other channels don't
     // crowd us out.
-    const agentGets = getUrls.filter((u) => u.includes("tag=%23agent%2Fmessage"));
+    const agentGets = getUrls.filter((u) => u.includes("tag=agent%2Fmessage"));
     expect(agentGets).toHaveLength(1);
     // No interim/legacy queries are issued.
     expect(getUrls.some((u) => u.includes("tag=%23agent-message"))).toBe(false);
@@ -1076,12 +1076,12 @@ describe("VaultTransport — loadTranscript (read the durable store)", () => {
     globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
       const u = String(url);
       if (u.includes("/api/notes") && (init?.method ?? "GET") === "GET") {
-        if (u.includes("tag=%23agent%2Fmessage")) {
+        if (u.includes("tag=agent%2Fmessage")) {
           return new Response(
             JSON.stringify([1, 2, 3, 4].map((i) => ({
               id: "n" + i,
               content: "m" + i,
-              tags: ["#agent/message", "#agent/message/inbound"],
+              tags: ["agent/message", "agent/message/inbound"],
               metadata: { agent: "eng", direction: "inbound", sender: "aaron", ts: "2026-06-08T00:00:0" + i + "Z" },
             }))),
             { status: 200 },
@@ -1102,13 +1102,13 @@ describe("VaultTransport — loadTranscript (read the durable store)", () => {
     globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
       const u = String(url);
       if (u.includes("/api/notes") && (init?.method ?? "GET") === "GET") {
-        if (u.includes("tag=%23agent%2Fmessage")) {
+        if (u.includes("tag=agent%2Fmessage")) {
           return new Response(
             JSON.stringify([
               // Outbound child → direction inferred "outbound".
-              { id: "a", content: "x", tags: ["#agent/message", "#agent/message/outbound"], metadata: { agent: "eng", ts: "2026-06-08T00:00:01Z" } },
+              { id: "a", content: "x", tags: ["agent/message", "agent/message/outbound"], metadata: { agent: "eng", ts: "2026-06-08T00:00:01Z" } },
               // No direction signal at all → defaults to "inbound".
-              { id: "b", content: "y", tags: ["#agent/message", "#agent/message/inbound"], metadata: { agent: "eng", ts: "2026-06-08T00:00:02Z" } },
+              { id: "b", content: "y", tags: ["agent/message", "agent/message/inbound"], metadata: { agent: "eng", ts: "2026-06-08T00:00:02Z" } },
             ]),
             { status: 200 },
           );
@@ -1168,11 +1168,11 @@ describe("VaultTransport — writeInbound (the chat's send → wakes the session
     };
     expect(sent.content).toBe("wake up");
     // The INBOUND tag pair — the child is the trigger discriminator that wakes the session.
-    expect(sent.tags).toEqual(["#agent/message", "#agent/message/inbound"]);
-    expect(sent.tags).toContain("#agent/message");
-    expect(sent.tags).toContain("#agent/message/inbound");
+    expect(sent.tags).toEqual(["agent/message", "agent/message/inbound"]);
+    expect(sent.tags).toContain("agent/message");
+    expect(sent.tags).toContain("agent/message/inbound");
     // It must NOT carry the outbound tag (that would be a reply, never wake).
-    expect(sent.tags).not.toContain("#agent/message/outbound");
+    expect(sent.tags).not.toContain("agent/message/outbound");
     // Write-discipline: the legacy tag family is gone (CONTRACT dropped it).
     expect(sent.tags).not.toContain("#channel-message");
     // CONTRACT: the routing key under `metadata.agent` ONLY — no `channel`. The vault
@@ -1244,8 +1244,8 @@ describe("VaultTransport — writeCallback (agent-to-agent reply_to substrate)",
 
     expect(result.sent).toEqual(["callback-note-1"]);
     // The callback is an INBOUND note (so it wakes the sender via the normal vault trigger).
-    expect(sent!.tags).toEqual(["#agent/message", "#agent/message/inbound"]);
-    expect(sent!.tags).not.toContain("#agent/message/outbound");
+    expect(sent!.tags).toEqual(["agent/message", "agent/message/inbound"]);
+    expect(sent!.tags).not.toContain("agent/message/outbound");
     // The metadata contract — all present fields stamped.
     expect(sent!.metadata.callback).toBe("true");
     expect(sent!.metadata.status).toBe("ok");
@@ -1315,7 +1315,7 @@ describe("VaultTransport — ingestInbound", () => {
     void t.ingestInbound({
       id: "note-in-1",
       content: "hello session",
-      tags: ["#agent/message", "#agent/message/inbound"],
+      tags: ["agent/message", "agent/message/inbound"],
       metadata: { agent: "eng", direction: "inbound", sender: "aaron", ts: "2026-06-08T00:00:00Z" },
     });
     expect(ctx.emitted).toHaveLength(1);
@@ -1341,7 +1341,7 @@ describe("VaultTransport — ingestInbound", () => {
     void t.ingestInbound({
       id: "our-own-reply",
       content: "I am awake",
-      tags: ["#agent/message", "#agent/message/outbound"],
+      tags: ["agent/message", "agent/message/outbound"],
       metadata: { channel: "eng", direction: "outbound", sender: "session" },
     });
     expect(ctx.emitted).toHaveLength(0);
@@ -1382,7 +1382,7 @@ describe("VaultTransport — ingestInbound", () => {
     await t.ingestInbound({
       id: "note-att-1",
       content: "look at these",
-      tags: ["#agent/message", "#agent/message/inbound"],
+      tags: ["agent/message", "agent/message/inbound"],
       metadata: { agent: "eng", direction: "inbound", sender: "aaron" },
       // inline list from the trigger payload — the has-attachments SIGNAL.
       attachments: [{ id: "a1", path: "2026-06-24/pic.png", mimeType: "image/png" }],
@@ -1408,7 +1408,7 @@ describe("VaultTransport — ingestInbound", () => {
     await t.ingestInbound({
       id: "note-att-fail",
       content: "still delivered",
-      tags: ["#agent/message", "#agent/message/inbound"],
+      tags: ["agent/message", "agent/message/inbound"],
       metadata: { agent: "eng", direction: "inbound" },
       attachments: [{ id: "a1", path: "2026-06-24/pic.png", mimeType: "image/png" }],
     });
@@ -1429,7 +1429,7 @@ describe("VaultTransport — ingestInbound", () => {
     void t.ingestInbound({
       id: "note-plain",
       content: "no files",
-      tags: ["#agent/message", "#agent/message/inbound"],
+      tags: ["agent/message", "agent/message/inbound"],
       metadata: { agent: "eng", direction: "inbound" },
     });
     expect(ctx.emitted).toHaveLength(1);
@@ -1447,7 +1447,7 @@ describe("VaultTransport — ingestInbound", () => {
     void t.ingestInbound({
       id: "note-deleg-1",
       content: "do the sub-task",
-      tags: ["#agent/message", "#agent/message/inbound"],
+      tags: ["agent/message", "agent/message/inbound"],
       metadata: {
         channel: "worker",
         direction: "inbound",
@@ -1482,10 +1482,11 @@ describe("VaultTransport — ensureSchema (tag-schema declaration on connect)",
 
     expect(calls).toHaveLength(AGENT_VAULT_TAG_SCHEMA.length);
 
-    // Namespace ROOT `#agent` — no parent_names, just a description. Plain `#` → `%23`.
+    // Namespace ROOT `agent` — no parent_names, just a description. A single bare
+    // segment needs no percent-encoding.
     const root = calls[0]!;
     expect(root.url).toBe(
-      "http://127.0.0.1:1940/vault/default/api/tags/%23agent",
+      "http://127.0.0.1:1940/vault/default/api/tags/agent",
     );
     expect(root.init.method).toBe("PUT");
     expect((root.init.headers as Record<string, string>).authorization).toBe(
@@ -1497,19 +1498,19 @@ describe("VaultTransport — ensureSchema (tag-schema declaration on connect)",
     };
     expect("parent_names" in rootBody).toBe(false);
 
-    // Definition (NEW) — name carries `#` + `/`; rolls up to the namespace root.
+    // Definition (NEW) — name carries `/`; rolls up to the namespace root.
     const def = calls[1]!;
     expect(def.url).toBe(
-      "http://127.0.0.1:1940/vault/default/api/tags/%23agent%2Fdefinition",
+      "http://127.0.0.1:1940/vault/default/api/tags/agent%2Fdefinition",
     );
-    expect(decodeURIComponent(def.url.split("/api/tags/")[1]!)).toBe("#agent/definition");
+    expect(decodeURIComponent(def.url.split("/api/tags/")[1]!)).toBe("agent/definition");
     const defBody = JSON.parse(String(def.init.body)) as { parent_names?: string[] };
-    expect(defBody.parent_names).toEqual(["#agent"]);
+    expect(defBody.parent_names).toEqual(["agent"]);
 
     // Message parent (NEW) — rolls up to the namespace root.
     const parent = calls[2]!;
     expect(parent.url).toBe(
-      "http://127.0.0.1:1940/vault/default/api/tags/%23agent%2Fmessage",
+      "http://127.0.0.1:1940/vault/default/api/tags/agent%2Fmessage",
     );
     const parentBody = JSON.parse(String(parent.init.body)) as {
       description?: string;
@@ -1518,23 +1519,23 @@ describe("VaultTransport — ensureSchema (tag-schema declaration on connect)",
     expect(parentBody.description).toBe(
       "A message in a Parachute channel (parent of /inbound + /outbound).",
     );
-    expect(parentBody.parent_names).toEqual(["#agent"]);
+    expect(parentBody.parent_names).toEqual(["agent"]);
 
-    // Inbound child (NEW) — name carries BOTH `#` and `/`. The vault route matches a
+    // Inbound child (NEW) — name carries `/`. The vault route matches a
     // single path segment (`[^/]+`) then decodeURIComponent's it, so the `/` MUST
     // be encoded as `%2F` (a bare slash would fail the single-segment match → 404).
     const inbound = calls[3]!;
     expect(inbound.url).toBe(
-      "http://127.0.0.1:1940/vault/default/api/tags/%23agent%2Fmessage%2Finbound",
+      "http://127.0.0.1:1940/vault/default/api/tags/agent%2Fmessage%2Finbound",
     );
     // Confirm the encoding decodes back to the literal tag name the vault stores.
     const encodedSegment = inbound.url.split("/api/tags/")[1]!;
-    expect(decodeURIComponent(encodedSegment)).toBe("#agent/message/inbound");
+    expect(decodeURIComponent(encodedSegment)).toBe("agent/message/inbound");
     const inboundBody = JSON.parse(String(inbound.init.body)) as {
       description?: string;
       parent_names?: string[];
     };
-    expect(inboundBody.parent_names).toEqual(["#agent/message"]);
+    expect(inboundBody.parent_names).toEqual(["agent/message"]);
     expect(inboundBody.description).toBe(
       "Human→session message; the vault trigger fires on this.",
     );
@@ -1542,19 +1543,19 @@ describe("VaultTransport — ensureSchema (tag-schema declaration on connect)",
     // Outbound child (NEW) — same encoding, parent declared.
     const outbound = calls[4]!;
     expect(outbound.url).toBe(
-      "http://127.0.0.1:1940/vault/default/api/tags/%23agent%2Fmessage%2Foutbound",
+      "http://127.0.0.1:1940/vault/default/api/tags/agent%2Fmessage%2Foutbound",
     );
     expect(decodeURIComponent(outbound.url.split("/api/tags/")[1]!)).toBe(
-      "#agent/message/outbound",
+      "agent/message/outbound",
     );
     const outboundBody = JSON.parse(String(outbound.init.body)) as { parent_names?: string[] };
-    expect(outboundBody.parent_names).toEqual(["#agent/message"]);
+    expect(outboundBody.parent_names).toEqual(["agent/message"]);
 
     // Job (NEW) — rolls up to the namespace root.
     const job = calls[5]!;
-    expect(decodeURIComponent(job.url.split("/api/tags/")[1]!)).toBe("#agent/job");
+    expect(decodeURIComponent(job.url.split("/api/tags/")[1]!)).toBe("agent/job");
     const jobBody = JSON.parse(String(job.init.body)) as { parent_names?: string[] };
-    expect(jobBody.parent_names).toEqual(["#agent"]);
+    expect(jobBody.parent_names).toEqual(["agent"]);
   });
 
   test("schema declares ONLY the #agent/* namespace rollup (CONTRACT dropped interim + legacy, 7 entries)", async () => {
@@ -1564,29 +1565,29 @@ describe("VaultTransport — ensureSchema (tag-schema declaration on connect)",
     // schema entries — exactly 7 entries, all under `#agent/*`.
     const names = AGENT_VAULT_TAG_SCHEMA.map((e) => e.name);
     expect(names).toEqual([
-      "#agent",
-      "#agent/definition",
-      "#agent/message",
-      "#agent/message/inbound",
-      "#agent/message/outbound",
-      "#agent/job",
-      "#agent/thread",
+      "agent",
+      "agent/definition",
+      "agent/message",
+      "agent/message/inbound",
+      "agent/message/outbound",
+      "agent/job",
+      "agent/thread",
     ]);
     // The interim/legacy families are gone entirely.
     expect(names).not.toContain("#agent-message");
     expect(names).not.toContain("#channel-message");
     // The namespace children all roll up to the `#agent` root (the human rollup).
     const byName = (n: string) => AGENT_VAULT_TAG_SCHEMA.find((e) => e.name === n)!;
-    expect(byName("#agent/definition").parent_names).toEqual(["#agent"]);
-    expect(byName("#agent/message").parent_names).toEqual(["#agent"]);
-    expect(byName("#agent/job").parent_names).toEqual(["#agent"]);
-    expect(byName("#agent/thread").parent_names).toEqual(["#agent"]);
-    expect(byName("#agent/message/inbound").parent_names).toEqual(["#agent/message"]);
-    expect(byName("#agent/message/outbound").parent_names).toEqual(["#agent/message"]);
+    expect(byName("agent/definition").parent_names).toEqual(["agent"]);
+    expect(byName("agent/message").parent_names).toEqual(["agent"]);
+    expect(byName("agent/job").parent_names).toEqual(["agent"]);
+    expect(byName("agent/thread").parent_names).toEqual(["agent"]);
+    expect(byName("agent/message/inbound").parent_names).toEqual(["agent/message"]);
+    expect(byName("agent/message/outbound").parent_names).toEqual(["agent/message"]);
     // `#agent/thread` declares INDEXED string fields so threads are operator-queryable —
     // "all failed threads" (status), "all threads of agent X" (definition), "all
     // multi-threaded threads" (mode). The three axes carry over from the run record VERBATIM.
-    expect(byName("#agent/thread").fields).toEqual({
+    expect(byName("agent/thread").fields).toEqual({
       // The canonical `agent` routing-key alias is declared indexed.
       agent: { type: "string", indexed: true },
       status: { type: "string", indexed: true },
@@ -1594,11 +1595,11 @@ describe("VaultTransport — ensureSchema (tag-schema declaration on connect)",
       mode: { type: "string", indexed: true },
     });
     // `#agent/message` declares the indexed `agent` routing key.
-    expect(byName("#agent/message").fields).toEqual({
+    expect(byName("agent/message").fields).toEqual({
       agent: { type: "string", indexed: true },
     });
     // CONTRACT: `#agent/job` indexes the routing key under `agent` ONLY — no `channel`.
-    expect(byName("#agent/job").fields).toEqual({
+    expect(byName("agent/job").fields).toEqual({
       agent: { type: "string", indexed: true },
       enabled: { type: "string", indexed: true },
       lastStatus: { type: "string", indexed: true },
@@ -1691,7 +1692,7 @@ describe("VaultTransport — ensureSchema (tag-schema declaration on connect)",
     void t.ingestInbound({
       id: "n1",
       content: "still works",
-      tags: ["#agent/message", "#agent/message/inbound"],
+      tags: ["agent/message", "agent/message/inbound"],
       metadata: { channel: "eng", direction: "inbound", sender: "aaron" },
     });
     expect(ctx.emitted).toHaveLength(1);
@@ -1741,7 +1742,7 @@ describe("VaultTransport — injectInbound (runner seam)", () => {
     expect(noteCalls).toHaveLength(1);
     const body = JSON.parse(String(noteCalls[0]!.init.body));
     // Inbound: BOTH the parent + the inbound child (the trigger discriminator).
-    expect(body.tags).toEqual(["#agent/message", "#agent/message/inbound"]);
+    expect(body.tags).toEqual(["agent/message", "agent/message/inbound"]);
     expect(body.content).toBe("Run the morning weave");
     expect(body.metadata.direction).toBe("inbound");
     expect(body.metadata.sender).toBe("runner:morning");
@@ -1789,7 +1790,7 @@ describe("VaultTransport — scheduled-job notes (vault-native store)", () => {
 
     const t = new VaultTransport(baseConfig());
     const jobs = await t.listJobNotes();
-    expect(urls[0]).toContain("tag=%23agent%2Fjob");
+    expect(urls[0]).toContain("tag=agent%2Fjob");
     expect(urls[0]).toContain("include_content=true");
     expect(jobs).toHaveLength(2);
     // id = the slug from metadata.jobId; noteId = the vault note id.
@@ -1825,7 +1826,7 @@ describe("VaultTransport — scheduled-job notes (vault-native store)", () => {
     expect(r.id).toBe("Channels/eng/jobs/m");
     const body = JSON.parse(String(calls[0]!.init.body));
     expect(body.path).toBe("Channels/eng/jobs/m");
-    expect(body.tags).toEqual(["#agent/job"]);
+    expect(body.tags).toEqual(["agent/job"]);
     expect(body.metadata.enabled).toBe("true");
     expect(body.metadata.jobId).toBe("m"); // slug persisted for stable display
     // CONTRACT: routing key under `metadata.agent` ONLY — no `channel`.

package/src/transports/vault.ts

@@ -261,11 +261,11 @@ export class InboundClaimConflictError extends Error {
 /** Parent tag (NEW, namespaced) — carried LITERALLY on every note WE write; query
  *  this + metadata.channel to see BOTH directions of a channel (the slash children
  *  are namespace, not inheritance). */
-const AGENT_MESSAGE_TAG = "#agent/message";
+const AGENT_MESSAGE_TAG = "agent/message";
 /** Inbound child (NEW) — the vault trigger fires on this exact tag (never matches outbound → no loop). */
-const AGENT_MESSAGE_INBOUND_TAG = "#agent/message/inbound";
+const AGENT_MESSAGE_INBOUND_TAG = "agent/message/inbound";
 /** Outbound child (NEW) — replies carry this; the trigger's exact-match predicate excludes it. */
-const AGENT_MESSAGE_OUTBOUND_TAG = "#agent/message/outbound";
+const AGENT_MESSAGE_OUTBOUND_TAG = "agent/message/outbound";
 
 /** Metadata key carrying the channel-queue claim status (design 2026-06-18). */
 const STATUS_META_KEY = "status";
@@ -369,7 +369,7 @@ function buildThreadSummaryBody(t: {
  * (it always queries the exact leaf tag); it exists for the nice human rollup, per
  * the design's namespacing decision.
  */
-export const AGENT_ROOT_TAG = "#agent";
+export const AGENT_ROOT_TAG = "agent";
 
 /**
  * Agent-definition tag — a vault-native agent IS a `#agent/definition` note (design
@@ -377,7 +377,7 @@ export const AGENT_ROOT_TAG = "#agent";
  * METADATA is the config (name, backend, workspace, isolation, the def-vault binding).
  * The module reads these notes from a def-vault and instantiates each as a live agent.
  */
-export const AGENT_DEFINITION_TAG = "#agent/definition";
+export const AGENT_DEFINITION_TAG = "agent/definition";
 
 /**
  * Scheduled-job tag — the runner's vault-native job store (design
@@ -386,7 +386,7 @@ export const AGENT_DEFINITION_TAG = "#agent/definition";
  * `#agent/message`. Introduced in Phase 2 as the flat `#agent-job`; moved into the
  * `#agent/*` namespace (`#agent/job`) by the vault-native-agents work (Phase 4a).
  */
-export const AGENT_JOB_TAG = "#agent/job";
+export const AGENT_JOB_TAG = "agent/job";
 /** Default path prefix under which job notes are written: `Channels/<ch>/jobs/<id>`. */
 const JOB_PATH_PREFIX = "Channels";
 
@@ -413,7 +413,7 @@ const JOB_PATH_PREFIX = "Channels";
  * The note carries `['#agent/thread']` EXACTLY — NOT a message tag, NOT the inbound
  * child — so it can never wake a session (no loop).
  */
-export const AGENT_THREAD_TAG = "#agent/thread";
+export const AGENT_THREAD_TAG = "agent/thread";
 /** Default path prefix under which thread notes are written: `Threads/<ch>/<leaf>`. */
 const THREAD_PATH_PREFIX = "Threads";
 
@@ -557,7 +557,7 @@ export const AGENT_VAULT_TRIGGER_TEMPLATE = {
   name: "channel_inbound_<channel>", // hub substitutes the channel name
   events: ["created"],
   when: {
-    tags: ["#agent/message/inbound"],
+    tags: ["agent/message/inbound"],
     has_metadata: ["agent"],
     missing_metadata: ["channel_inbound_rendered_at"],
   },
@@ -581,7 +581,7 @@ export const AGENT_DEF_VAULT_TRIGGER_TEMPLATE = {
   name: "agent_def_reload",
   events: ["created", "updated", "deleted"],
   when: {
-    tags: ["#agent/definition"],
+    tags: ["agent/definition"],
   },
   action: {
     webhook: "<hub-origin>/agent/api/vault/agent-def", // hub fills origin + the auth.bearer
@@ -657,11 +657,11 @@ export class VaultTransport implements Transport {
    * `decodeURIComponent`'d (parachute-vault `src/routes.ts` handleTags, the
    * "Routes with tag name" block + `routing.ts` `apiPath.startsWith("/tags")`).
    * Because the route matches a SINGLE path segment (`[^/]+`, no literal slash)
-   * and decodes it, the tag name — which contains BOTH `#` and `/`
-   * (`#agent/message/inbound`) — must be `encodeURIComponent`'d so the `#`
-   * becomes `%23` and the `/` becomes `%2F`; the route then decodes that back to
-   * the literal name. A bare `/` in the URL would fail the `[^/]+` match → 404,
-   * silently dropping the declaration. The PUT body is `{ description?, parent_names? }`.
+   * and decodes it, the tag name — which contains a `/`
+   * (`agent/message/inbound`) — must be `encodeURIComponent`'d so the `/` becomes
+   * `%2F`; the route then decodes that back to the literal name. A bare `/` in the
+   * URL would fail the `[^/]+` match → 404, silently dropping the declaration. The
+   * PUT body is `{ description?, parent_names? }`.
    *
    * Best-effort + non-fatal by contract: every failure is caught and `console.warn`'d,
    * never thrown — the tag-both write floor is the fallback.
@@ -669,8 +669,8 @@ export class VaultTransport implements Transport {
   async ensureSchema(): Promise<void> {
     for (const entry of AGENT_VAULT_TAG_SCHEMA) {
       try {
-        // Single-segment, percent-encoded name: `#agent/message/inbound` →
-        // `%23agent%2Fmessage%2Finbound`. The vault decodes it back to the literal.
+        // Single-segment, percent-encoded name: `agent/message/inbound` →
+        // `agent%2Fmessage%2Finbound`. The vault decodes it back to the literal.
         const url = `${this.vaultUrl}/vault/${this.vault}/api/tags/${encodeURIComponent(entry.name)}`;
         const body: {
           description?: string;
@@ -1099,7 +1099,7 @@ export class VaultTransport implements Transport {
    * namespace, not query inheritance, so we never key off them here.
    *
    *   GET <vaultUrl>/vault/<vault>/api/notes
-   *       ?tag=%23agent%2Fmessage             (the `#` + `/` MUST be percent-encoded)
+   *       ?tag=agent%2Fmessage             (the `/` MUST be percent-encoded)
    *       &include_content=true               (we need the bodies)
    *       &limit=<n>                          (default 200)
    *
@@ -1138,7 +1138,7 @@ export class VaultTransport implements Transport {
     // empty transcript).
     const fetchByTag = async (tag: string): Promise<RawNote[]> => {
       const params = new URLSearchParams();
-      params.set("tag", tag); // URLSearchParams encodes `#` → `%23`
+      params.set("tag", tag); // URLSearchParams encodes `/` → `%2F`
       params.set("include_content", "true");
       params.set("limit", String(fetchLimit));
       const url = `${this.vaultUrl}/vault/${this.vault}/api/notes?${params.toString()}`;
@@ -1380,7 +1380,7 @@ export class VaultTransport implements Transport {
     // Overfetch (the tag query spans all channels) then keep this channel's items.
     const fetchLimit = Math.min(Math.max(limit * 4, 500), 2000);
     const params = new URLSearchParams();
-    params.set("tag", AGENT_MESSAGE_INBOUND_TAG); // → %23agent%2Fmessage%2Finbound
+    params.set("tag", AGENT_MESSAGE_INBOUND_TAG); // → agent%2Fmessage%2Finbound
     params.set("include_content", "true");
     params.set("limit", String(fetchLimit));
     // NEWEST-first at the vault (default order_by is `updated_at`) so a hard cap drops
@@ -1508,7 +1508,7 @@ export class VaultTransport implements Transport {
 
   /**
    * List the scheduled-job notes in THIS channel's vault. Queries by the parent
-   * `#agent/job` tag (URLSearchParams encodes `#`→`%23`, `/`→`%2F`) and returns ALL job
+   * `#agent/job` tag (URLSearchParams encodes `/`→`%2F`) and returns ALL job
    * notes in the vault — the CALLER filters by `metadata.channel` (same index-free
    * pattern as loadTranscript; we don't assume a `channel` index exists). Throws
    * on a non-ok vault response so the API surfaces a clear error rather than a
@@ -1517,7 +1517,7 @@ export class VaultTransport implements Transport {
   async listJobNotes(opts?: { limit?: number }): Promise<JobNote[]> {
     const limit = opts?.limit ?? 500;
     const params = new URLSearchParams();
-    params.set("tag", AGENT_JOB_TAG); // → %23agent%2Fjob
+    params.set("tag", AGENT_JOB_TAG); // → agent%2Fjob
     params.set("include_content", "true");
     params.set("limit", String(limit));
     const url = `${this.vaultUrl}/vault/${this.vault}/api/notes?${params.toString()}`;