@penclipai/server 2026.704.0 → 2026.714.0

package/dist/routes/issues.js

@@ -1,15 +1,15 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { Router } from "express";
 import multer from "multer";
 import { z } from "zod";
 import { and, asc, desc, eq, inArray, isNull, notInArray } from "drizzle-orm";
 import { activityLog, agents, documents, executionWorkspaces, heartbeatRuns, issueComments, issueDocuments, issueExecutionDecisions, issueRelations, issues as issueRows, issueWorkProducts, pipelineCaseIssueLinks, pipelineCases, pipelineStages, pipelines, projectWorkspaces, } from "@penclipai/db";
-import { addIssueCommentSchema, acceptIssueThreadInteractionSchema, attachmentArtifactWorkProductMetadataSchema, cancelIssueThreadInteractionSchema, companySearchQuerySchema, createIssueAttachmentMetadataSchema, createIssueThreadInteractionSchema, createIssueWorkProductSchema, createIssueLabelSchema, createAcceptedPlanDecompositionSchema, checkoutIssueSchema, createDocumentAnnotationCommentSchema, createDocumentAnnotationThreadSchema, createChildIssueSchema, createIssueSchema, resolveCreateIssueStatusDefault, resolveIssueRecoveryActionSchema, feedbackTargetTypeSchema, feedbackTraceStatusSchema, feedbackVoteValueSchema, upsertIssueFeedbackVoteSchema, upsertIssueWatchdogSchema, linkIssueApprovalSchema, issueDocumentKeySchema, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, ISSUE_WATCHDOG_DISCOVERY_KINDS, TASK_WATCHDOG_PRODUCT_BUG_ORIGIN_KIND, rejectIssueThreadInteractionSchema, restoreIssueDocumentRevisionSchema, respondIssueThreadInteractionSchema, updateIssueWorkProductSchema, updateDocumentAnnotationThreadSchema, upsertIssueDocumentSchema, updateIssueSchema, getClosedIsolatedExecutionWorkspaceMessage, isClosedIsolatedExecutionWorkspace, isUuidLike, normalizeIssueIdentifier as normalizeIssueReferenceIdentifier, } from "@penclipai/shared";
+import { addIssueCommentSchema, acceptIssueThreadInteractionSchema, attachmentArtifactWorkProductMetadataSchema, cancelIssueThreadInteractionSchema, companySearchQuerySchema, createIssueAttachmentMetadataSchema, createIssueThreadInteractionSchema, createIssueWorkProductSchema, createIssueLabelSchema, createAcceptedPlanDecompositionSchema, checkoutIssueSchema, createDocumentAnnotationCommentSchema, createDocumentAnnotationThreadSchema, createChildIssueSchema, createIssueSchema, resolveCreateIssueStatusDefault, resolveIssueRecoveryActionSchema, feedbackTargetTypeSchema, feedbackTraceStatusSchema, feedbackVoteValueSchema, upsertIssueFeedbackVoteSchema, upsertIssueWatchdogSchema, linkIssueApprovalSchema, issueDocumentKeySchema, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, ISSUE_WATCHDOG_DISCOVERY_KINDS, TASK_WATCHDOG_PRODUCT_BUG_ORIGIN_KIND, rejectIssueThreadInteractionSchema, restoreIssueDocumentRevisionSchema, respondIssueThreadInteractionSchema, submitIssueThreadInteractionVerdictsSchema, updateIssueWorkProductSchema, updateDocumentAnnotationThreadSchema, upsertIssueDocumentSchema, updateIssueSchema, getClosedIsolatedExecutionWorkspaceMessage, isClosedIsolatedExecutionWorkspace, isUuidLike, normalizeIssueIdentifier as normalizeIssueReferenceIdentifier, } from "@penclipai/shared";
 import { trackAgentTaskCompleted } from "@penclipai/shared/telemetry";
 import { getTelemetryClient } from "../telemetry.js";
 import { validate } from "../middleware/validate.js";
 import * as serviceIndex from "../services/index.js";
-import { accessService, agentService, companyService, companySearchService, goalService, heartbeatService, issueApprovalService, issueRecoveryActionService, issueThreadInteractionService, ISSUE_LIST_DEFAULT_LIMIT, ISSUE_LIST_MAX_LIMIT, issueReferenceService, issueService, clampIssueListLimit, documentService, documentAnnotationService, logActivity, projectService, routineService, workProductService, } from "../services/index.js";
+import { accessService, agentService, companySkillService, companyService, companySearchService, goalService, heartbeatService, issueApprovalService, issueRecoveryActionService, issueThreadInteractionService, ISSUE_LIST_DEFAULT_LIMIT, ISSUE_LIST_MAX_LIMIT, issueReferenceService, issueService, clampIssueListLimit, documentService, documentAnnotationService, logActivity, projectService, routineService, workProductService, } from "../services/index.js";
 import { buildPlanReviewContext } from "../services/plan-review-context.js";
 import { TASK_WATCHDOG_ORIGIN_KIND, resolveTaskWatchdogMutationScope, taskWatchdogScopeAllowsIssueMutation, } from "../services/task-watchdog-scope.js";
 import { logger } from "../middleware/logger.js";
@@ -24,7 +24,8 @@ import { assertEnvironmentSelectionForCompany } from "./environment-selection.js
 import { executionWorkspaceService as executionWorkspaceServiceDirect } from "../services/execution-workspaces.js";
 import { feedbackService } from "../services/feedback.js";
 import { instanceSettingsService } from "../services/instance-settings.js";
-import { readAcceptedPlanConfirmationTarget } from "../services/issues.js";
+import { ISSUE_BLOCKER_DIAGNOSTICS_MAX_BLOCKERS, ISSUE_WAKE_DIAGNOSTICS_LOOKBACK_DAYS, ISSUE_WAKE_DIAGNOSTICS_MAX_ACTIVITY_RECORDS, ISSUE_WAKE_DIAGNOSTICS_MAX_WAKE_REQUESTS, readAcceptedPlanConfirmationTarget, } from "../services/issues.js";
+import { authorizationDeniedDetails } from "../services/authorization.js";
 import { environmentService } from "../services/environments.js";
 import { environmentRuntimeService } from "../services/environment-runtime.js";
 import { redactSensitiveText } from "../redaction.js";
@@ -198,6 +199,67 @@ function readNonEmptyString(value) {
 function readObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
 }
+function hasOwn(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key);
+}
+async function auditAgentIssueCreateAttributionSpoof(input) {
+    const actor = getActorInfo(input.req);
+    await logActivity(input.db, {
+        companyId: input.companyId,
+        actorType: actor.actorType,
+        actorId: actor.actorId,
+        agentId: actor.agentId,
+        runId: actor.runId,
+        action: input.action === "rejected"
+            ? "issue.attribution_spoof_rejected"
+            : "issue.attribution_spoof_stripped",
+        entityType: input.entityId ? "issue" : "company",
+        entityId: input.entityId ?? input.companyId,
+        details: {
+            surface: input.surface,
+            field: input.field,
+            requestedValue: input.requestedValue,
+            derivedFrom: "authenticated_actor",
+        },
+    });
+}
+async function sanitizeIssueCreateAttribution(db, req, res, companyId, input, options) {
+    const sanitized = { ...input };
+    if (req.actor.type !== "agent")
+        return sanitized;
+    if (hasOwn(sanitized, "responsibleUserId") && sanitized.responsibleUserId != null) {
+        await auditAgentIssueCreateAttributionSpoof({
+            db,
+            req,
+            companyId,
+            entityId: options.entityId,
+            surface: options.surface,
+            field: "responsibleUserId",
+            action: "rejected",
+            requestedValue: readNonEmptyString(sanitized.responsibleUserId),
+        });
+        res.status(422).json({ error: "Agent-created issues cannot set responsibleUserId" });
+        return null;
+    }
+    if (hasOwn(sanitized, "createdByUserId") && sanitized.createdByUserId != null) {
+        await auditAgentIssueCreateAttributionSpoof({
+            db,
+            req,
+            companyId,
+            entityId: options.entityId,
+            surface: options.surface,
+            field: "createdByUserId",
+            action: "stripped",
+            requestedValue: readNonEmptyString(sanitized.createdByUserId),
+        });
+        delete sanitized.createdByUserId;
+    }
+    delete sanitized.responsibleUserId;
+    return sanitized;
+}
+function authenticatedActorResponsibleUserId(req) {
+    return req.actor.type === "agent" ? req.actor.onBehalfOfUserId ?? null : null;
+}
 function readPlanConfirmationTargetForIssue(payload, issueId) {
     const target = readObject(readObject(payload).target);
     if (target.type !== "issue_document" || target.key !== "plan")
@@ -250,7 +312,7 @@ function emptyWorkspaceNameMaps() {
     };
 }
 function summarizeIssueWorkspaceForActivity(issue, names) {
-    const settings = parseIssueExecutionWorkspaceSettings(issue.executionWorkspaceSettings);
+    const settings = parseIssueExecutionWorkspaceSettings(issue.executionWorkspaceSettings, { includeEnvironmentId: true });
     const mode = settings?.mode ?? issue.executionWorkspacePreference ?? null;
     const executionWorkspaceId = issue.executionWorkspaceId ?? null;
     const projectWorkspaceId = issue.projectWorkspaceId ?? null;
@@ -411,6 +473,469 @@ function withRecoveryActionsOnRelationSummaries(relations, recoveryActionByIssue
         blocks: relations.blocks.map(augment),
     };
 }
+function toIssueBlockerDiagnosticSummary(issue) {
+    return {
+        id: issue.id,
+        identifier: issue.identifier,
+        title: issue.title,
+        status: issue.status,
+        priority: issue.priority,
+        assigneeAgentId: issue.assigneeAgentId,
+        assigneeUserId: issue.assigneeUserId,
+    };
+}
+function blockerDiagnosticLabel(issue) {
+    return issue.identifier ?? issue.title;
+}
+function buildIssueBlockerDiagnosticsResponse(input) {
+    const issue = toIssueBlockerDiagnosticSummary(input.issue);
+    const visibleBlockerIds = new Set(input.visibleBlockers.map((blocker) => blocker.id));
+    const omittedUnauthorizedBlockerCount = input.blockers.filter((blocker) => !visibleBlockerIds.has(blocker.id)).length;
+    const completeVisibleSet = !input.truncated && omittedUnauthorizedBlockerCount === 0;
+    const unresolvedIds = new Set(input.readiness.unresolvedBlockerIssueIds);
+    const pendingFinalizeIds = new Set(input.readiness.pendingFinalizeBlockerIssueIds);
+    const blockers = input.visibleBlockers.map((blockerRow) => {
+        const blocker = toIssueBlockerDiagnosticSummary(blockerRow);
+        const isPendingFinalize = pendingFinalizeIds.has(blocker.id);
+        const isUnresolved = unresolvedIds.has(blocker.id);
+        const flags = [];
+        if (issue.status === "blocked" && blocker.status === "done")
+            flags.push("done_but_blocking");
+        if (blocker.status === "cancelled")
+            flags.push("cancelled_blocker_in_set");
+        if (isPendingFinalize)
+            flags.push("workspace_finalize_pending");
+        return {
+            ...blocker,
+            isUnresolved,
+            isPendingFinalize,
+            isDependencyReady: blocker.status === "done" && !isPendingFinalize,
+            flags,
+        };
+    });
+    const readiness = completeVisibleSet
+        ? {
+            allBlockersDone: input.readiness.allBlockersDone,
+            isDependencyReady: input.readiness.isDependencyReady,
+            unresolvedBlockerCount: input.readiness.unresolvedBlockerIssueIds.length,
+            pendingFinalizeBlockerCount: input.readiness.pendingFinalizeBlockerIssueIds.length,
+        }
+        : null;
+    const reportedOmittedUnauthorizedBlockerCount = input.truncated
+        ? null
+        : omittedUnauthorizedBlockerCount;
+    return {
+        issue,
+        diagnosis: buildIssueBlockerDiagnosis({
+            issue,
+            blockers,
+            readiness,
+            omittedUnauthorizedBlockerCount: reportedOmittedUnauthorizedBlockerCount,
+            truncated: input.truncated,
+            maxBlockers: input.maxBlockers ?? ISSUE_BLOCKER_DIAGNOSTICS_MAX_BLOCKERS,
+        }),
+        readiness,
+        blockers,
+        omittedUnauthorizedBlockerCount: reportedOmittedUnauthorizedBlockerCount,
+        truncated: input.truncated,
+        caps: {
+            maxBlockers: input.maxBlockers ?? ISSUE_BLOCKER_DIAGNOSTICS_MAX_BLOCKERS,
+        },
+    };
+}
+function buildIssueBlockerDiagnosis(input) {
+    if (input.truncated) {
+        return `Blocker diagnostics for ${blockerDiagnosticLabel(input.issue)} are truncated at ${input.maxBlockers} blockers, so readiness is not reported.`;
+    }
+    const omittedUnauthorizedBlockerCount = input.omittedUnauthorizedBlockerCount ?? 0;
+    if (omittedUnauthorizedBlockerCount > 0) {
+        return `One or more blockers for ${blockerDiagnosticLabel(input.issue)} are outside this actor's authorization boundary, so this diagnosis only covers visible blockers.`;
+    }
+    if (input.blockers.length === 0) {
+        return input.issue.status === "blocked"
+            ? `${blockerDiagnosticLabel(input.issue)} is blocked but has no first-class blocker relations.`
+            : null;
+    }
+    const pendingFinalize = input.blockers.find((blocker) => blocker.isPendingFinalize);
+    if (pendingFinalize) {
+        return `${blockerDiagnosticLabel(input.issue)} is waiting for ${blockerDiagnosticLabel(pendingFinalize)} to finish workspace finalization.`;
+    }
+    const cancelled = input.blockers.find((blocker) => blocker.status === "cancelled");
+    if (cancelled) {
+        return `${blockerDiagnosticLabel(input.issue)} is blocked by ${blockerDiagnosticLabel(cancelled)}, which is cancelled; cancelled blockers do not resolve until the blocker relation is removed or replaced.`;
+    }
+    const unresolved = input.blockers.find((blocker) => blocker.isUnresolved);
+    if (unresolved) {
+        return `${blockerDiagnosticLabel(input.issue)} is blocked by ${blockerDiagnosticLabel(unresolved)}, which is ${unresolved.status}.`;
+    }
+    if (input.readiness?.isDependencyReady && input.issue.status === "blocked") {
+        return `All blockers for ${blockerDiagnosticLabel(input.issue)} are resolved, but the issue is still blocked; this is likely a stale blocker hold.`;
+    }
+    if (input.readiness?.isDependencyReady) {
+        return `All blockers for ${blockerDiagnosticLabel(input.issue)} are resolved.`;
+    }
+    return null;
+}
+const ISSUE_WAKE_DIAGNOSTIC_KNOWN_SOURCES = new Set([
+    "timer",
+    "assignment",
+    "on_demand",
+    "automation",
+]);
+const ISSUE_WAKE_DIAGNOSTIC_KNOWN_REASONS = new Set([
+    "issue_assigned",
+    "issue_blockers_resolved",
+    "issue_commented",
+    "issue_comment_mentioned",
+    "issue_dependencies_blocked",
+    "issue_tree_hold_active",
+    "missing_issue_comment",
+    "process_lost_retry",
+    "run_liveness_continuation",
+    "heartbeat.disabled",
+    "heartbeat.timer.no_actionable_work",
+    "heartbeat.wakeOnDemand.disabled",
+]);
+const ISSUE_WAKE_DIAGNOSTIC_KNOWN_STATUSES = new Set([
+    "queued",
+    "claimed",
+    "coalesced",
+    "skipped",
+    "completed",
+    "failed",
+    "cancelled",
+    "deferred_issue_execution",
+]);
+function dateToIso(value) {
+    if (!value)
+        return null;
+    return value instanceof Date ? value.toISOString() : new Date(value).toISOString();
+}
+function projectWakeDiagnosticSource(value) {
+    if (!value)
+        return null;
+    return ISSUE_WAKE_DIAGNOSTIC_KNOWN_SOURCES.has(value) ? value : "other";
+}
+function projectWakeDiagnosticReason(value) {
+    if (!value)
+        return null;
+    return ISSUE_WAKE_DIAGNOSTIC_KNOWN_REASONS.has(value) ? value : "other";
+}
+function projectWakeDiagnosticStatus(value) {
+    return ISSUE_WAKE_DIAGNOSTIC_KNOWN_STATUSES.has(value) ? value : "other";
+}
+function wakeFailureClass(status, rawError) {
+    if (status === "failed" || rawError)
+        return "failed";
+    if (status === "cancelled")
+        return "cancelled";
+    if (status === "skipped")
+        return "skipped";
+    return null;
+}
+function projectIssueWakeRequest(row, options) {
+    const status = projectWakeDiagnosticStatus(row.status);
+    return {
+        kind: "wake_request",
+        agentId: options.includeInternalIds ? row.agentId : null,
+        source: projectWakeDiagnosticSource(row.source) ?? "other",
+        reason: projectWakeDiagnosticReason(row.reason),
+        status,
+        coalescedCount: row.coalescedCount,
+        runId: options.includeInternalIds ? row.runId : null,
+        requestedAt: dateToIso(row.requestedAt),
+        claimedAt: dateToIso(row.claimedAt),
+        finishedAt: dateToIso(row.finishedAt),
+        failureClass: wakeFailureClass(status, row.error),
+    };
+}
+function wakeDiagnosticActivityAction(action) {
+    return action === "issue.tree_hold_wakeup_deferred" ? action : "other";
+}
+function wakeDiagnosticActivityEntityType(entityType) {
+    return entityType === "issue" || entityType === "agent_wakeup_request" ? entityType : "other";
+}
+function projectIssueWakeActivityRecord(row, issueId, options) {
+    const details = row.details && typeof row.details === "object" ? row.details : {};
+    const action = wakeDiagnosticActivityAction(row.action);
+    const rootIssueId = readNonEmptyString(details["rootIssueId"]);
+    const detailIssueId = readNonEmptyString(details["issueId"]);
+    const projectedRootIssueId = rootIssueId === issueId || detailIssueId === issueId || (row.entityType === "issue" && row.entityId === issueId)
+        ? issueId
+        : null;
+    return {
+        kind: "activity",
+        action,
+        entityType: wakeDiagnosticActivityEntityType(row.entityType),
+        agentId: options.includeInternalIds ? row.agentId ?? readNonEmptyString(details["agentId"]) : null,
+        runId: options.includeInternalIds ? row.runId : null,
+        createdAt: dateToIso(row.createdAt),
+        source: projectWakeDiagnosticSource(readNonEmptyString(details["source"])),
+        requestedReason: projectWakeDiagnosticReason(readNonEmptyString(details["requestedReason"])),
+        previousReason: projectWakeDiagnosticReason(readNonEmptyString(details["previousReason"])),
+        rootIssueId: projectedRootIssueId,
+        holdId: options.includeInternalIds ? readNonEmptyString(details["holdId"]) : null,
+        summary: action === "issue.tree_hold_wakeup_deferred"
+            ? "Wake was deferred because an active issue-tree hold was present."
+            : "Wake-related activity was recorded.",
+    };
+}
+function issueWakeDiagnosticEventTimestamp(event) {
+    const timestamp = event.kind === "wake_request" ? event.requestedAt : event.createdAt;
+    return new Date(timestamp).getTime();
+}
+function wakeDiagnosticReasonPhrase(reason) {
+    return reason ? ` for ${reason}` : "";
+}
+function buildIssueWakeDiagnosis(input) {
+    if (input.truncated) {
+        return `Wake diagnostics for ${blockerDiagnosticLabel(input.issue)} are truncated to ${input.maxWakeRequests} wake requests and ${input.maxActivityRecords} activity records over ${input.lookbackDays} days, so the diagnosis only covers returned records.`;
+    }
+    const latest = input.events[0];
+    if (latest?.kind === "activity" && latest.action === "issue.tree_hold_wakeup_deferred") {
+        return `The most recent wake-related activity for ${blockerDiagnosticLabel(input.issue)} was deferred by an active issue-tree hold.`;
+    }
+    if (latest?.kind === "wake_request") {
+        if (latest.status === "deferred_issue_execution") {
+            return `The most recent wake for ${blockerDiagnosticLabel(input.issue)} is deferred${wakeDiagnosticReasonPhrase(latest.reason)}.`;
+        }
+        if (latest.status === "failed") {
+            return `The most recent wake for ${blockerDiagnosticLabel(input.issue)} failed${wakeDiagnosticReasonPhrase(latest.reason)}; raw error text is withheld.`;
+        }
+        if (latest.status === "skipped" || latest.status === "cancelled" || latest.status === "coalesced") {
+            const coalesced = latest.coalescedCount > 0 ? ` and coalesced ${latest.coalescedCount} additional request(s)` : "";
+            return `The most recent wake for ${blockerDiagnosticLabel(input.issue)} was ${latest.status}${wakeDiagnosticReasonPhrase(latest.reason)}${coalesced}.`;
+        }
+        if (latest.status === "queued" || latest.status === "claimed") {
+            return `The most recent wake for ${blockerDiagnosticLabel(input.issue)} is currently ${latest.status}${wakeDiagnosticReasonPhrase(latest.reason)}.`;
+        }
+        if (latest.status === "completed") {
+            return `The most recent wake for ${blockerDiagnosticLabel(input.issue)} completed${wakeDiagnosticReasonPhrase(latest.reason)}.`;
+        }
+    }
+    if (input.events.length > 0)
+        return null;
+    const blockerDiagnostics = input.blockerDiagnostics;
+    if (blockerDiagnostics.truncated) {
+        return `No wake rows are visible for ${blockerDiagnosticLabel(input.issue)} in the bounded window, and blocker diagnostics are truncated, so no wake cause is inferred.`;
+    }
+    if ((blockerDiagnostics.omittedUnauthorizedBlockerCount ?? 0) > 0) {
+        return `No wake rows are visible for ${blockerDiagnosticLabel(input.issue)} in the bounded window, and one or more blockers are outside this actor's authorization boundary.`;
+    }
+    if (input.issue.status !== "blocked" || blockerDiagnostics.blockers.length === 0)
+        return null;
+    const pendingFinalize = blockerDiagnostics.blockers.find((blocker) => blocker.isPendingFinalize);
+    if (pendingFinalize) {
+        return `No wake row exists for ${blockerDiagnosticLabel(input.issue)} in the bounded window. ${blockerDiagnosticLabel(input.issue)} is waiting for ${blockerDiagnosticLabel(pendingFinalize)} to finish workspace finalization, so issue_blockers_resolved has not fired.`;
+    }
+    const cancelled = blockerDiagnostics.blockers.find((blocker) => blocker.status === "cancelled");
+    if (cancelled) {
+        return `No wake row exists for ${blockerDiagnosticLabel(input.issue)} in the bounded window. ${blockerDiagnosticLabel(input.issue)} is blocked by ${blockerDiagnosticLabel(cancelled)}, which is cancelled; cancelled blockers do not fire issue_blockers_resolved.`;
+    }
+    const unresolved = blockerDiagnostics.blockers.find((blocker) => blocker.isUnresolved);
+    if (unresolved) {
+        return `No wake row exists for ${blockerDiagnosticLabel(input.issue)} in the bounded window. ${blockerDiagnosticLabel(input.issue)} is blocked by ${blockerDiagnosticLabel(unresolved)}, which is ${unresolved.status}, so issue_blockers_resolved has not fired.`;
+    }
+    if (blockerDiagnostics.readiness?.isDependencyReady) {
+        return `No wake row exists for ${blockerDiagnosticLabel(input.issue)} in the bounded window. All visible blockers are resolved, but the issue is still blocked; this is likely a stale blocker hold or an older wake outside the lookback window.`;
+    }
+    return null;
+}
+function buildIssueWakeDiagnosticsResponse(input) {
+    const issue = toIssueBlockerDiagnosticSummary(input.issue);
+    const events = [
+        ...input.wakeRequests.map((record) => projectIssueWakeRequest(record, { includeInternalIds: input.includeInternalIds })),
+        ...input.activityRecords.map((record) => projectIssueWakeActivityRecord(record, issue.id, { includeInternalIds: input.includeInternalIds })),
+    ].sort((left, right) => issueWakeDiagnosticEventTimestamp(right) - issueWakeDiagnosticEventTimestamp(left));
+    const truncated = input.truncatedWakeRequests || input.truncatedActivityRecords;
+    const maxWakeRequests = input.maxWakeRequests ?? ISSUE_WAKE_DIAGNOSTICS_MAX_WAKE_REQUESTS;
+    const maxActivityRecords = input.maxActivityRecords ?? ISSUE_WAKE_DIAGNOSTICS_MAX_ACTIVITY_RECORDS;
+    const lookbackDays = input.lookbackDays ?? ISSUE_WAKE_DIAGNOSTICS_LOOKBACK_DAYS;
+    const diagnosis = buildIssueWakeDiagnosis({
+        issue,
+        events,
+        blockerDiagnostics: input.blockerDiagnostics,
+        truncated,
+        maxWakeRequests,
+        maxActivityRecords,
+        lookbackDays,
+    });
+    return {
+        issue,
+        diagnosis,
+        likelyReason: diagnosis,
+        events,
+        wakeRequestCount: input.wakeRequests.length,
+        activityRecordCount: input.activityRecords.length,
+        truncated,
+        truncatedSections: {
+            wakeRequests: input.truncatedWakeRequests,
+            activityRecords: input.truncatedActivityRecords,
+        },
+        caps: {
+            maxWakeRequests,
+            maxActivityRecords,
+            lookbackDays,
+        },
+    };
+}
+function groupByIssueId(rows) {
+    const map = new Map();
+    for (const row of rows) {
+        const issueRows = map.get(row.issueId) ?? [];
+        issueRows.push(row);
+        map.set(row.issueId, issueRows);
+    }
+    return map;
+}
+function groupBlockersByBlockedIssueId(rows) {
+    const map = new Map();
+    for (const row of rows) {
+        const issueRows = map.get(row.blockedIssueId) ?? [];
+        issueRows.push(row);
+        map.set(row.blockedIssueId, issueRows);
+    }
+    return map;
+}
+function issueSubtreeEdgeTimestamp(edge) {
+    return edge.timestamp ? new Date(edge.timestamp).getTime() : 0;
+}
+function buildIssueSubtreeDiagnosis(input) {
+    if (input.truncated) {
+        return `Subtree diagnostics for ${blockerDiagnosticLabel(input.issue)} are bounded to depth ${input.caps.maxDepth} and ${input.caps.maxNodes} nodes, so the diagnosis only covers returned visible nodes.`;
+    }
+    if ((input.omittedUnauthorizedNodeCount ?? 0) > 0) {
+        return `One or more subtree nodes under ${blockerDiagnosticLabel(input.issue)} are outside this actor's authorization boundary, so this diagnosis only covers visible nodes.`;
+    }
+    const blockedNodeWithDiagnosis = input.nodes.find((node) => node.issue.status === "blocked" && node.diagnosis);
+    const firstNodeWithDiagnosis = blockedNodeWithDiagnosis ?? input.nodes.find((node) => node.diagnosis);
+    if (!firstNodeWithDiagnosis?.diagnosis)
+        return null;
+    return `${blockerDiagnosticLabel(firstNodeWithDiagnosis.issue)} appears to be the subtree stall point: ${firstNodeWithDiagnosis.diagnosis}`;
+}
+function buildIssueSubtreeDiagnosticsResponse(input) {
+    const issue = toIssueBlockerDiagnosticSummary(input.issue);
+    const visibleNodeIds = new Set(input.visibleNodes.map((node) => node.id));
+    const visibleBlockerIdsByIssueId = groupBlockersByBlockedIssueId(input.visibleBlockers);
+    const omittedUnauthorizedNodeCount = input.truncatedNodes || input.truncatedDepth
+        ? null
+        : input.nodes.filter((node) => !visibleNodeIds.has(node.id)).length;
+    const nodeResponses = [];
+    const edges = [];
+    for (const node of input.visibleNodes) {
+        const rawBlockers = input.blockersByIssueId.get(node.id) ?? [];
+        const visibleBlockers = visibleBlockerIdsByIssueId.get(node.id) ?? [];
+        const blockerResponse = buildIssueBlockerDiagnosticsResponse({
+            issue: node,
+            blockers: rawBlockers,
+            visibleBlockers,
+            readiness: input.readinessByIssueId.get(node.id) ?? {
+                allBlockersDone: true,
+                isDependencyReady: true,
+                unresolvedBlockerIssueIds: [],
+                pendingFinalizeBlockerIssueIds: [],
+            },
+            truncated: input.truncatedBlockerIssueIds.has(node.id),
+            maxBlockers: input.caps.maxBlockersPerNode,
+        });
+        const wakeResponse = buildIssueWakeDiagnosticsResponse({
+            issue: node,
+            wakeRequests: input.wakeRequestsByIssueId.get(node.id) ?? [],
+            activityRecords: input.activityRecordsByIssueId.get(node.id) ?? [],
+            blockerDiagnostics: blockerResponse,
+            truncatedWakeRequests: input.truncatedWakeIssueIds.has(node.id),
+            truncatedActivityRecords: input.truncatedActivityIssueIds.has(node.id),
+            includeInternalIds: input.includeInternalIds,
+            maxWakeRequests: input.caps.maxWakeRequestsPerNode,
+            maxActivityRecords: input.caps.maxActivityRecordsPerNode,
+            lookbackDays: input.caps.lookbackDays,
+        });
+        const nodeDiagnosis = wakeResponse.diagnosis ?? blockerResponse.diagnosis;
+        if (node.parentId && visibleNodeIds.has(node.parentId)) {
+            edges.push({
+                kind: "parent",
+                fromIssueId: node.parentId,
+                toIssueId: node.id,
+                timestamp: dateToIso(node.createdAt),
+            });
+        }
+        for (const blocker of visibleBlockers) {
+            edges.push({
+                kind: "blocks",
+                fromIssueId: blocker.id,
+                toIssueId: node.id,
+                timestamp: dateToIso(blocker.relationCreatedAt),
+            });
+        }
+        for (const event of wakeResponse.events) {
+            if (event.kind === "wake_request") {
+                edges.push({
+                    kind: "wake_request",
+                    issueId: node.id,
+                    agentId: event.agentId,
+                    reason: event.reason,
+                    status: event.status,
+                    timestamp: event.requestedAt,
+                });
+            }
+            else {
+                edges.push({
+                    kind: "activity",
+                    issueId: node.id,
+                    action: event.action,
+                    timestamp: event.createdAt,
+                });
+            }
+        }
+        nodeResponses.push({
+            issue: toIssueBlockerDiagnosticSummary(node),
+            parentId: node.parentId && visibleNodeIds.has(node.parentId) ? node.parentId : null,
+            depth: node.depth,
+            diagnosis: nodeDiagnosis,
+            likelyReason: nodeDiagnosis,
+            blockers: blockerResponse.blockers,
+            blockerReadiness: blockerResponse.readiness,
+            omittedUnauthorizedBlockerCount: blockerResponse.omittedUnauthorizedBlockerCount,
+            wakeEvents: wakeResponse.events,
+            wakeRequestCount: wakeResponse.wakeRequestCount,
+            activityRecordCount: wakeResponse.activityRecordCount,
+            truncated: blockerResponse.truncated || wakeResponse.truncated,
+            truncatedSections: {
+                blockers: blockerResponse.truncated,
+                wakeRequests: wakeResponse.truncatedSections.wakeRequests,
+                activityRecords: wakeResponse.truncatedSections.activityRecords,
+            },
+        });
+    }
+    edges.sort((left, right) => issueSubtreeEdgeTimestamp(right) - issueSubtreeEdgeTimestamp(left));
+    const truncatedSections = {
+        nodes: input.truncatedNodes,
+        depth: input.truncatedDepth,
+        blockers: input.truncatedBlockerIssueIds.size > 0,
+        wakeRequests: input.truncatedWakeIssueIds.size > 0,
+        activityRecords: input.truncatedActivityIssueIds.size > 0,
+    };
+    const truncated = Object.values(truncatedSections).some(Boolean);
+    const diagnosis = buildIssueSubtreeDiagnosis({
+        issue,
+        nodes: nodeResponses,
+        omittedUnauthorizedNodeCount,
+        truncated,
+        caps: input.caps,
+    });
+    return {
+        issue,
+        diagnosis,
+        likelyReason: diagnosis,
+        nodes: nodeResponses,
+        edges,
+        nodeCount: nodeResponses.length,
+        omittedUnauthorizedNodeCount,
+        truncated,
+        truncatedSections,
+        caps: input.caps,
+    };
+}
 const ACTIVE_REVIEW_APPROVAL_STATUSES = new Set(["pending", "revision_requested"]);
 const INVALID_AGENT_IN_REVIEW_DISPOSITION_MESSAGE = "invalid_issue_disposition: Agent-authored updates that move an issue to in_review must include a real review path. " +
     "This request would leave the issue in_review without anyone or anything owning the next action. " +
@@ -513,7 +1038,7 @@ async function assertCanManageIssueMonitor(accessSvc, req, companyId, assigneeAg
         resource: { type: "company", companyId },
     });
     if (!runtimeDecision.allowed) {
-        throw forbidden(runtimeDecision.explanation);
+        throw forbidden(runtimeDecision.explanation, authorizationDeniedDetails(runtimeDecision));
     }
     if (req.actor.type === "agent" && req.actor.agentId && req.actor.agentId === assigneeAgentId)
         return;
@@ -601,6 +1126,12 @@ function isAssigneeSelfCommentOnTerminalIssue(input) {
         return false;
     return input.actorId === input.assigneeAgentId;
 }
+const REQUEST_ITEM_VERDICTS_WAKE_COALESCE_WINDOW_MS = 2_000;
+function buildRequestItemVerdictsWakeIdempotencyKey(args) {
+    const now = args.at ?? new Date();
+    const bucket = Math.floor(now.getTime() / REQUEST_ITEM_VERDICTS_WAKE_COALESCE_WINDOW_MS);
+    return `request_item_verdicts:${args.issueId}:${args.interactionId}:${bucket}`;
+}
 function queueResolvedInteractionContinuationWakeup(input) {
     if (input.interaction.continuationPolicy !== "wake_assignee"
         && input.interaction.continuationPolicy !== "wake_assignee_on_accept")
@@ -617,6 +1148,13 @@ function queueResolvedInteractionContinuationWakeup(input) {
     const planTarget = readPlanConfirmationTargetForIssue(input.interaction.payload, input.issue.id);
     const interactionResult = readConfirmationResultForWake(input.interaction.result);
     const checkboxSelection = readCheckboxSelectionForWake(input.interaction);
+    const newlyResolvedItemIds = input.newlyResolvedItemIds?.filter((value) => value.length > 0) ?? [];
+    const itemVerdicts = newlyResolvedItemIds.length > 0
+        ? {
+            newlyResolvedItemIds,
+            coalesceWindowMs: REQUEST_ITEM_VERDICTS_WAKE_COALESCE_WINDOW_MS,
+        }
+        : null;
     const planReviewInteraction = planTarget && input.interaction.kind === "request_confirmation"
         ? {
             id: input.interaction.id,
@@ -640,8 +1178,10 @@ function queueResolvedInteractionContinuationWakeup(input) {
             sourceRunId: input.interaction.sourceRunId ?? null,
             ...(planReviewInteraction ? { planReviewInteraction } : {}),
             ...(checkboxSelection ? { checkboxSelection } : {}),
+            ...(itemVerdicts ? { itemVerdicts, newlyResolvedItemIds } : {}),
             mutation: "interaction",
         },
+        idempotencyKey: input.idempotencyKey ?? null,
         requestedByActorType: input.actor.actorType,
         requestedByActorId: input.actor.actorId,
         contextSnapshot: {
@@ -654,6 +1194,7 @@ function queueResolvedInteractionContinuationWakeup(input) {
             sourceRunId: input.interaction.sourceRunId ?? null,
             ...(planReviewInteraction ? { planReviewInteraction } : {}),
             ...(checkboxSelection ? { checkboxSelection } : {}),
+            ...(itemVerdicts ? { itemVerdicts, newlyResolvedItemIds } : {}),
             wakeReason: "issue_commented",
             source: input.source,
             ...(forceFreshSession ? { forceFreshSession: true } : {}),
@@ -802,6 +1343,329 @@ class AutoApprovalIssueMissingError extends Error {
         this.name = "AutoApprovalIssueMissingError";
     }
 }
+function toCompactIssue(issue) {
+    return {
+        id: issue.id,
+        companyId: issue.companyId,
+        projectId: issue.projectId,
+        projectWorkspaceId: issue.projectWorkspaceId,
+        goalId: issue.goalId,
+        parentId: issue.parentId,
+        title: issue.title,
+        description: issue.description,
+        status: issue.status,
+        workMode: issue.workMode,
+        priority: issue.priority,
+        assigneeAgentId: issue.assigneeAgentId,
+        assigneeUserId: issue.assigneeUserId,
+        checkoutRunId: issue.checkoutRunId,
+        executionRunId: issue.executionRunId,
+        executionAgentNameKey: issue.executionAgentNameKey,
+        executionLockedAt: issue.executionLockedAt,
+        createdByAgentId: issue.createdByAgentId,
+        createdByUserId: issue.createdByUserId,
+        issueNumber: issue.issueNumber,
+        identifier: issue.identifier,
+        originKind: issue.originKind,
+        originId: issue.originId,
+        originRunId: issue.originRunId,
+        requestDepth: issue.requestDepth,
+        billingCode: issue.billingCode,
+        executionWorkspaceId: issue.executionWorkspaceId,
+        startedAt: issue.startedAt,
+        completedAt: issue.completedAt,
+        cancelledAt: issue.cancelledAt,
+        createdAt: issue.createdAt,
+        updatedAt: issue.updatedAt,
+        ...(issue.labelIds ? { labelIds: issue.labelIds } : {}),
+        ...(issue.labels ? { labels: issue.labels } : {}),
+        ...(issue.blockedBy ? { blockedBy: issue.blockedBy } : {}),
+        ...(issue.blockerAttention ? { blockerAttention: issue.blockerAttention } : {}),
+        ...(issue.blockedInboxAttention !== undefined ? { blockedInboxAttention: issue.blockedInboxAttention } : {}),
+        ...(issue.productivityReview ? { productivityReview: issue.productivityReview } : {}),
+        ...(issue.scheduledRetry ? { scheduledRetry: issue.scheduledRetry } : {}),
+        ...(issue.liveDescendantCount !== undefined ? { liveDescendantCount: issue.liveDescendantCount } : {}),
+        ...(issue.myLastTouchAt !== undefined ? { myLastTouchAt: issue.myLastTouchAt } : {}),
+        ...(issue.lastExternalCommentAt !== undefined ? { lastExternalCommentAt: issue.lastExternalCommentAt } : {}),
+        ...(issue.lastActivityAt !== undefined ? { lastActivityAt: issue.lastActivityAt } : {}),
+        ...(issue.isUnreadForMe !== undefined ? { isUnreadForMe: issue.isUnreadForMe } : {}),
+        activeRecoveryAction: issue.activeRecoveryAction ?? null,
+        successfulRunHandoff: issue.successfulRunHandoff ?? null,
+    };
+}
+function compactIssueListEtag(issues) {
+    const hash = createHash("sha256")
+        .update(JSON.stringify(issues))
+        .digest("base64url");
+    return `"compact-issues:${hash}"`;
+}
+function requestMatchesEtag(ifNoneMatchHeader, etag) {
+    if (!ifNoneMatchHeader)
+        return false;
+    return ifNoneMatchHeader
+        .split(",")
+        .map((value) => value.trim())
+        .some((value) => value === "*" || value === etag || value === `W/${etag}`);
+}
+const ISSUE_LIST_SERVER_CACHE_TTL_MS = 2_000;
+const ISSUE_LIST_SERVER_CACHE_STALE_MS = 5_000;
+export const ISSUE_LIST_SERVER_CACHE_MAX_ENTRIES = 256;
+const ISSUE_LIST_STORM_WINDOW_MS = 500;
+const ISSUE_LIST_STORM_THRESHOLD = 4;
+const ISSUE_LIST_MAX_ACTOR_CLIENT_INFLIGHT = 8;
+const issueListResponseCache = new Map();
+const issueListInflight = new Map();
+const issueListActorClientInflight = new Map();
+export function __getIssueListResponseCacheSizeForTests() {
+    return issueListResponseCache.size;
+}
+export function __clearIssueListResponseCacheForTests() {
+    issueListResponseCache.clear();
+}
+function shortHash(value) {
+    return createHash("sha256").update(value).digest("base64url").slice(0, 16);
+}
+function stableJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .filter((key) => record[key] !== undefined)
+        .map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`)
+        .join(",")}}`;
+}
+function normalizeIssueListCacheValue(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null)
+        return null;
+    if (Array.isArray(value)) {
+        return value.map(normalizeIssueListCacheValue).sort((a, b) => stableJson(a).localeCompare(stableJson(b)));
+    }
+    if (typeof value === "object") {
+        const normalized = {};
+        for (const [key, nestedValue] of Object.entries(value)) {
+            const next = normalizeIssueListCacheValue(nestedValue);
+            if (next !== undefined)
+                normalized[key] = next;
+        }
+        return normalized;
+    }
+    return value;
+}
+function issueListActorIdentity(req, companyId) {
+    if (req.actor.type === "agent") {
+        const onBehalfMembership = req.actor.onBehalfOfUserId
+            ? req.actor.onBehalfOfMemberships?.find((membership) => membership.companyId === companyId) ?? null
+            : null;
+        const key = [
+            "agent",
+            companyId,
+            req.actor.agentId ?? "unknown-agent",
+            req.actor.keyId ?? req.actor.source ?? "agent-auth",
+            req.actor.onBehalfOfUserId ?? "no-responsible-user",
+            onBehalfMembership?.status ?? "no-responsible-user-status",
+            onBehalfMembership?.membershipRole ?? "no-responsible-user-role",
+        ].join(":");
+        return { actorType: "agent", key, hash: shortHash(key) };
+    }
+    if (req.actor.type === "board") {
+        const sessionPart = req.actor.source === "session"
+            ? `cookie:${shortHash(String(req.headers.cookie ?? "no-cookie"))}`
+            : req.actor.keyId ?? req.actor.source ?? "board";
+        const key = [
+            "board",
+            companyId,
+            req.actor.source ?? "board",
+            req.actor.userId ?? "unknown-user",
+            sessionPart,
+        ].join(":");
+        return { actorType: "board", key, hash: shortHash(key) };
+    }
+    const key = ["none", companyId, req.actor.source ?? "none"].join(":");
+    return { actorType: "none", key, hash: shortHash(key) };
+}
+function issueListClientIdentity(req) {
+    const forwardedFor = Array.isArray(req.headers["x-forwarded-for"])
+        ? req.headers["x-forwarded-for"][0]
+        : req.headers["x-forwarded-for"];
+    const client = [
+        String(forwardedFor ?? req.ip ?? "unknown-ip").split(",")[0]?.trim() ?? "unknown-ip",
+        req.header("user-agent") ?? "unknown-agent",
+    ].join(":");
+    return { key: client, hash: shortHash(client) };
+}
+function safeRefererPath(req) {
+    const referer = req.header("referer");
+    if (!referer)
+        return null;
+    try {
+        return new URL(referer).pathname;
+    }
+    catch {
+        return referer.split("?")[0]?.slice(0, 160) ?? null;
+    }
+}
+function issueListRequestKey(input) {
+    const route = "GET /api/companies/:companyId/issues";
+    const actor = issueListActorIdentity(input.req, input.companyId);
+    const client = issueListClientIdentity(input.req);
+    const normalizedQuery = normalizeIssueListCacheValue(input.normalizedQuery);
+    const queryKeys = Object.keys(normalizedQuery).sort();
+    const key = stableJson({
+        actor: actor.key,
+        companyId: input.companyId,
+        query: normalizedQuery,
+        route,
+    });
+    return {
+        actor,
+        client,
+        key,
+        keyHash: shortHash(key),
+        queryKeys,
+        route,
+    };
+}
+function pruneIssueListResponseCache(now) {
+    for (const [key, entry] of issueListResponseCache) {
+        if (entry.staleUntil <= now)
+            issueListResponseCache.delete(key);
+    }
+}
+function touchIssueListResponseCacheEntry(key, entry) {
+    issueListResponseCache.delete(key);
+    issueListResponseCache.set(key, entry);
+}
+function trimIssueListResponseCache() {
+    while (issueListResponseCache.size > ISSUE_LIST_SERVER_CACHE_MAX_ENTRIES) {
+        const oldestKey = issueListResponseCache.keys().next().value;
+        if (oldestKey === undefined)
+            return;
+        issueListResponseCache.delete(oldestKey);
+    }
+}
+function setIssueListResponseCacheEntry(key, entry) {
+    touchIssueListResponseCacheEntry(key, entry);
+    trimIssueListResponseCache();
+}
+function decrementIssueListActorClientInflight(actorClientKey) {
+    const next = (issueListActorClientInflight.get(actorClientKey) ?? 1) - 1;
+    if (next <= 0)
+        issueListActorClientInflight.delete(actorClientKey);
+    else
+        issueListActorClientInflight.set(actorClientKey, next);
+}
+async function coordinateIssueListGet(input) {
+    const now = Date.now();
+    pruneIssueListResponseCache(now);
+    const cached = input.allowTtlCache ? issueListResponseCache.get(input.requestKey.key) : undefined;
+    if (cached && cached.expiresAt > now) {
+        touchIssueListResponseCacheEntry(input.requestKey.key, cached);
+        return { response: cached.response, cacheStatus: "hit", identicalInFlightCount: 0 };
+    }
+    const existing = issueListInflight.get(input.requestKey.key);
+    if (existing) {
+        existing.waiterCount += 1;
+        const identicalInFlightCount = existing.waiterCount + 1;
+        if (!existing.stormLogged &&
+            identicalInFlightCount >= ISSUE_LIST_STORM_THRESHOLD &&
+            now - existing.startedAt <= ISSUE_LIST_STORM_WINDOW_MS) {
+            existing.stormLogged = true;
+            const event = {
+                event: "request_storm_detected",
+                route: input.requestKey.route,
+                companyId: input.companyId,
+                actorType: input.requestKey.actor.actorType,
+                actorIdentityHash: input.requestKey.actor.hash,
+                clientHash: input.requestKey.client.hash,
+                cacheKeyHash: input.requestKey.keyHash,
+                queryKeys: input.requestKey.queryKeys,
+                identicalInFlightCount,
+                windowMs: now - existing.startedAt,
+                referer: safeRefererPath(input.req),
+                visibilityHint: input.req.header("x-paperclip-tab-visible") ?? null,
+            };
+            logger.warn(event, "request_storm_detected");
+            input.diagnostics?.onStormDetected?.(event);
+        }
+        const response = await existing.promise;
+        return { response, cacheStatus: "coalesced", identicalInFlightCount };
+    }
+    const actorClientKey = `${input.requestKey.actor.key}:${input.requestKey.client.key}`;
+    const actorClientInflight = issueListActorClientInflight.get(actorClientKey) ?? 0;
+    if (actorClientInflight >= ISSUE_LIST_MAX_ACTOR_CLIENT_INFLIGHT) {
+        if (cached && cached.staleUntil > now) {
+            touchIssueListResponseCacheEntry(input.requestKey.key, cached);
+            return { response: cached.response, cacheStatus: "stale", identicalInFlightCount: 0 };
+        }
+        return { response: null, cacheStatus: "retry", identicalInFlightCount: 0, retryAfterSeconds: 1 };
+    }
+    issueListActorClientInflight.set(actorClientKey, actorClientInflight + 1);
+    const promise = (async () => {
+        await input.diagnostics?.onComputeStart?.({
+            companyId: input.companyId,
+            cacheKeyHash: input.requestKey.keyHash,
+        });
+        return input.compute();
+    })();
+    const inflightEntry = {
+        promise,
+        startedAt: now,
+        waiterCount: 0,
+        stormLogged: false,
+    };
+    issueListInflight.set(input.requestKey.key, inflightEntry);
+    try {
+        const response = await promise;
+        if (input.allowTtlCache) {
+            setIssueListResponseCacheEntry(input.requestKey.key, {
+                response,
+                expiresAt: Date.now() + ISSUE_LIST_SERVER_CACHE_TTL_MS,
+                staleUntil: Date.now() + ISSUE_LIST_SERVER_CACHE_STALE_MS,
+            });
+        }
+        return { response, cacheStatus: "miss", identicalInFlightCount: 1 };
+    }
+    finally {
+        if (issueListInflight.get(input.requestKey.key) === inflightEntry) {
+            issueListInflight.delete(input.requestKey.key);
+        }
+        decrementIssueListActorClientInflight(actorClientKey);
+    }
+}
+function estimatedJsonBytes(value) {
+    return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function logIssueListRequest(input) {
+    input.res.once("finish", () => {
+        const contentEncoding = input.res.getHeader("content-encoding");
+        const contentLength = Number(input.res.getHeader("content-length"));
+        logger.debug({
+            event: "safe_get_request_observed",
+            route: input.requestKey.route,
+            companyId: input.companyId,
+            actorType: input.requestKey.actor.actorType,
+            actorIdentityHash: input.requestKey.actor.hash,
+            clientHash: input.requestKey.client.hash,
+            cacheKeyHash: input.requestKey.keyHash,
+            queryKeys: input.requestKey.queryKeys,
+            requestCount: input.identicalInFlightCount,
+            durationMs: Date.now() - input.startedAt,
+            statusCode: input.res.statusCode,
+            responseBytes: input.bodyBytes,
+            compressedBytes: contentEncoding && Number.isFinite(contentLength) ? contentLength : null,
+            contentEncoding: contentEncoding ? String(contentEncoding) : null,
+            cacheStatus: input.cacheStatus,
+            etagOutcome: input.etagOutcome,
+            referer: safeRefererPath(input.req),
+            visibilityHint: input.req.header("x-paperclip-tab-visible") ?? null,
+        }, "safe authenticated GET observed");
+    });
+}
 export function issueRoutes(db, storage, opts = {}) {
     const router = Router();
     const svc = issueService(db);
@@ -826,6 +1690,7 @@ export function issueRoutes(db, storage, opts = {}) {
     const executionWorkspacesSvc = executionWorkspaceServiceDirect(db);
     const workProductsSvc = workProductService(db);
     const documentsSvc = documentService(db);
+    const companySkillsSvc = companySkillService(db);
     const documentAnnotationsSvc = documentAnnotationService(db);
     const issueReferencesSvc = issueReferenceService(db);
     const issueThreadInteractionsSvc = issueThreadInteractionService(db);
@@ -1430,11 +2295,14 @@ export function issueRoutes(db, storage, opts = {}) {
         });
         if (decision.allowed)
             return;
-        throw forbidden(decision.explanation);
+        throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
     }
     function isTaskBridgeKeyActor(req) {
         return req.actor.type === "agent" && req.actor.source === "agent_key" && req.actor.keyScope?.kind === "task_bridge";
     }
+    function isSkillTestScopedActor(req) {
+        return req.actor.type === "agent" && req.actor.keyScope?.kind === "skill_test";
+    }
     function taskBridgeOriginForActor(req) {
         return isTaskBridgeKeyActor(req) && req.actor.keyId
             ? { originKind: "task_bridge", originId: req.actor.keyId }
@@ -2268,6 +3136,136 @@ export function issueRoutes(db, storage, opts = {}) {
         }
         return { project, goal: null };
     }
+    function compactIssueProjectWorkspace(workspace) {
+        if (!workspace)
+            return null;
+        return {
+            id: workspace.id,
+            companyId: workspace.companyId,
+            projectId: workspace.projectId,
+            name: workspace.name,
+            sourceType: workspace.sourceType,
+            cwd: workspace.cwd,
+            repoUrl: workspace.repoUrl,
+            repoRef: workspace.repoRef,
+            defaultRef: workspace.defaultRef,
+            visibility: workspace.visibility,
+            setupCommand: workspace.setupCommand,
+            cleanupCommand: workspace.cleanupCommand,
+            remoteProvider: workspace.remoteProvider,
+            remoteWorkspaceRef: workspace.remoteWorkspaceRef,
+            sharedWorkspaceKey: workspace.sharedWorkspaceKey,
+            runtimeConfig: workspace.runtimeConfig,
+            isPrimary: workspace.isPrimary,
+            createdAt: workspace.createdAt,
+            updatedAt: workspace.updatedAt,
+        };
+    }
+    function compactIssueProject(project) {
+        if (!project)
+            return null;
+        return {
+            id: project.id,
+            companyId: project.companyId,
+            urlKey: project.urlKey,
+            goalId: project.goalId,
+            goalIds: project.goalIds,
+            goals: project.goals,
+            name: project.name,
+            description: project.description,
+            status: project.status,
+            leadAgentId: project.leadAgentId,
+            targetDate: project.targetDate,
+            color: project.color,
+            icon: project.icon,
+            env: null,
+            pauseReason: project.pauseReason,
+            pausedAt: project.pausedAt,
+            executionWorkspacePolicy: project.executionWorkspacePolicy,
+            codebase: project.codebase,
+            workspaces: (project.workspaces ?? []).map(compactIssueProjectWorkspace),
+            primaryWorkspace: compactIssueProjectWorkspace(project.primaryWorkspace),
+            managedByPlugin: project.managedByPlugin ?? null,
+            taskCount: project.taskCount,
+            budget: project.budget,
+            archivedAt: project.archivedAt,
+            createdAt: project.createdAt,
+            updatedAt: project.updatedAt,
+        };
+    }
+    function compactIssueRuntimeService(service) {
+        return {
+            id: service.id,
+            companyId: service.companyId,
+            projectId: service.projectId,
+            projectWorkspaceId: service.projectWorkspaceId,
+            executionWorkspaceId: service.executionWorkspaceId,
+            issueId: service.issueId,
+            scopeType: service.scopeType,
+            scopeId: service.scopeId,
+            serviceName: service.serviceName,
+            status: service.status,
+            lifecycle: service.lifecycle,
+            reuseKey: service.reuseKey,
+            command: service.command,
+            cwd: service.cwd,
+            port: service.port,
+            url: service.url,
+            provider: service.provider,
+            providerRef: service.providerRef,
+            ownerAgentId: service.ownerAgentId,
+            startedByRunId: service.startedByRunId,
+            lastUsedAt: service.lastUsedAt,
+            startedAt: service.startedAt,
+            stoppedAt: service.stoppedAt,
+            healthStatus: service.healthStatus,
+            configIndex: service.configIndex ?? null,
+        };
+    }
+    function compactIssueExecutionWorkspace(workspace) {
+        if (!workspace)
+            return null;
+        return {
+            id: workspace.id,
+            companyId: workspace.companyId,
+            projectId: workspace.projectId,
+            projectWorkspaceId: workspace.projectWorkspaceId,
+            sourceIssueId: workspace.sourceIssueId,
+            mode: workspace.mode,
+            strategyType: workspace.strategyType,
+            name: workspace.name,
+            status: workspace.status,
+            cwd: workspace.cwd,
+            repoUrl: workspace.repoUrl,
+            baseRef: workspace.baseRef,
+            branchName: workspace.branchName,
+            providerType: workspace.providerType,
+            providerRef: workspace.providerRef,
+            derivedFromExecutionWorkspaceId: workspace.derivedFromExecutionWorkspaceId,
+            lastUsedAt: workspace.lastUsedAt,
+            openedAt: workspace.openedAt,
+            closedAt: workspace.closedAt,
+            cleanupEligibleAt: workspace.cleanupEligibleAt,
+            cleanupReason: workspace.cleanupReason,
+            config: workspace.config
+                ? {
+                    environmentId: workspace.config.environmentId,
+                    provisionCommand: workspace.config.provisionCommand,
+                    teardownCommand: workspace.config.teardownCommand,
+                    cleanupCommand: workspace.config.cleanupCommand,
+                    workspaceRuntime: workspace.config.workspaceRuntime,
+                    desiredState: workspace.config.desiredState,
+                    serviceStates: workspace.config.serviceStates,
+                }
+                : null,
+            metadata: null,
+            runtimeServices: (workspace.runtimeServices ?? [])
+                .filter((service) => service.status === "starting" || service.status === "running")
+                .map(compactIssueRuntimeService),
+            createdAt: workspace.createdAt,
+            updatedAt: workspace.updatedAt,
+        };
+    }
     // Resolve issue identifiers (e.g. "PAP-39") to UUIDs for all /issues/:id routes
     router.param("id", async (req, res, next, rawId) => {
         try {
@@ -2306,7 +3304,21 @@ export function issueRoutes(db, storage, opts = {}) {
             res.status(403).json({ error: "Company search is outside this actor's authorization boundary" });
             return;
         }
-        const query = companySearchQuerySchema.parse(req.query);
+        const parsedQuery = companySearchQuerySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            res.status(400).json({
+                error: parsedQuery.error.issues[0]?.message ?? "Invalid search query",
+            });
+            return;
+        }
+        let query = parsedQuery.data;
+        if (query.assigneeUserId === "me") {
+            if (req.actor.type !== "board" || !req.actor.userId) {
+                res.status(403).json({ error: "assigneeUserId=me requires board authentication" });
+                return;
+            }
+            query = { ...query, assigneeUserId: req.actor.userId };
+        }
         const rateLimit = searchRateLimiter.consume(companySearchRateLimitActor(req, companyId));
         res.setHeader("X-RateLimit-Limit", String(rateLimit.limit));
         res.setHeader("X-RateLimit-Remaining", String(rateLimit.remaining));
@@ -2322,6 +3334,7 @@ export function issueRoutes(db, storage, opts = {}) {
         res.json(result);
     });
     router.get("/companies/:companyId/issues", async (req, res) => {
+        const startedAt = Date.now();
         const companyId = req.params.companyId;
         assertCompanyAccess(req, companyId);
         if (isTaskBridgeKeyActor(req)) {
@@ -2356,6 +3369,8 @@ export function issueRoutes(db, storage, opts = {}) {
         const attention = req.query.attention;
         const sortField = req.query.sortField;
         const sortDir = req.query.sortDir;
+        const view = req.query.view;
+        const compactView = view === "compact";
         const hasPlanDocument = parseOptionalBooleanQuery(req.query.hasPlanDocument);
         const includeLiveDescendantSummary = parseOptionalBooleanQuery(req.query.includeLiveDescendantSummary);
         const assigneeAgentFilterRaw = req.query.assigneeAgentId;
@@ -2380,6 +3395,10 @@ export function issueRoutes(db, storage, opts = {}) {
             res.status(400).json({ error: "attention must be 'blocked' when provided" });
             return;
         }
+        if (view !== undefined && view !== "compact") {
+            res.status(400).json({ error: "view must be 'compact' when provided" });
+            return;
+        }
         if (rawLimit !== undefined && (parsedLimit === null || !Number.isInteger(parsedLimit) || parsedLimit <= 0)) {
             res.status(400).json({ error: `limit must be a positive integer up to ${ISSUE_LIST_MAX_LIMIT}` });
             return;
@@ -2425,7 +3444,7 @@ export function issueRoutes(db, storage, opts = {}) {
             }
         }
         const offset = parsedOffset ?? 0;
-        const rawResult = await svc.list(companyId, {
+        const listFilters = {
             attention: attention === "blocked" ? "blocked" : undefined,
             status: req.query.status,
             assigneeAgentId,
@@ -2455,36 +3474,145 @@ export function issueRoutes(db, storage, opts = {}) {
             offset,
             sortField: sortField === "updated" ? "updated" : undefined,
             sortDir: sortDir === "asc" || sortDir === "desc" ? sortDir : undefined,
+        };
+        const requestKey = issueListRequestKey({
+            req,
+            companyId,
+            normalizedQuery: {
+                ...listFilters,
+                view: compactView ? "compact" : undefined,
+            },
         });
-        const result = await actorCanReadCompanyScope(req, companyId)
-            ? rawResult
-            : await filterIssuesForActor(req, rawResult);
-        const issueIds = result.map((issue) => issue.id);
-        const [handoffStates, recoveryActionByIssue] = await Promise.all([
-            listSuccessfulRunHandoffStates(db, companyId, issueIds),
-            recoveryActionsSvc.listActiveForIssues(companyId, issueIds),
-        ]);
-        const actor = getActorInfo(req);
-        await Promise.all(result.map(async (issue) => {
-            const activeRecoveryAction = recoveryActionByIssue.get(issue.id) ?? null;
-            if (!activeRecoveryAction)
-                return;
-            const revalidated = await revalidateActiveSourceRecoveryForRead({
-                issue,
-                trigger: "read_projection",
-                actor,
-                activeRecoveryAction,
+        const coordinated = await coordinateIssueListGet({
+            req,
+            companyId,
+            requestKey,
+            allowTtlCache: compactView,
+            diagnostics: opts.issueListDiagnostics,
+            compute: async () => {
+                const rawResult = await svc.list(companyId, listFilters);
+                const result = await actorCanReadCompanyScope(req, companyId)
+                    ? rawResult
+                    : await filterIssuesForActor(req, rawResult);
+                const issueIds = result.map((issue) => issue.id);
+                if (compactView) {
+                    const [handoffStates, recoveryActionByIssue] = await Promise.all([
+                        listSuccessfulRunHandoffStates(db, companyId, issueIds),
+                        recoveryActionsSvc.listActiveForIssues(companyId, issueIds),
+                    ]);
+                    const actor = getActorInfo(req);
+                    await Promise.all(result.map(async (issue) => {
+                        const activeRecoveryAction = recoveryActionByIssue.get(issue.id) ?? null;
+                        if (!activeRecoveryAction)
+                            return;
+                        const revalidated = await revalidateActiveSourceRecoveryForRead({
+                            issue,
+                            trigger: "read_projection",
+                            actor,
+                            activeRecoveryAction,
+                        });
+                        if (revalidated)
+                            recoveryActionByIssue.set(issue.id, revalidated);
+                        else
+                            recoveryActionByIssue.delete(issue.id);
+                    }));
+                    const compactResult = result.map((issue) => toCompactIssue({
+                        ...issue,
+                        activeRecoveryAction: recoveryActionByIssue.get(issue.id) ?? null,
+                        successfulRunHandoff: handoffStates.get(issue.id) ?? null,
+                    }));
+                    return {
+                        kind: "compact",
+                        body: compactResult,
+                        etag: compactIssueListEtag(compactResult),
+                        cacheControl: "private, must-revalidate",
+                    };
+                }
+                const [handoffStates, recoveryActionByIssue] = await Promise.all([
+                    listSuccessfulRunHandoffStates(db, companyId, issueIds),
+                    recoveryActionsSvc.listActiveForIssues(companyId, issueIds),
+                ]);
+                const actor = getActorInfo(req);
+                await Promise.all(result.map(async (issue) => {
+                    const activeRecoveryAction = recoveryActionByIssue.get(issue.id) ?? null;
+                    if (!activeRecoveryAction)
+                        return;
+                    const revalidated = await revalidateActiveSourceRecoveryForRead({
+                        issue,
+                        trigger: "read_projection",
+                        actor,
+                        activeRecoveryAction,
+                    });
+                    if (revalidated)
+                        recoveryActionByIssue.set(issue.id, revalidated);
+                    else
+                        recoveryActionByIssue.delete(issue.id);
+                }));
+                return {
+                    kind: "full",
+                    body: result.map((issue) => ({
+                        ...issue,
+                        successfulRunHandoff: handoffStates.get(issue.id) ?? null,
+                        activeRecoveryAction: recoveryActionByIssue.get(issue.id) ?? null,
+                    })),
+                };
+            },
+        });
+        res.setHeader("X-Paperclip-Request-Cache", coordinated.cacheStatus);
+        if (!coordinated.response) {
+            const body = {
+                error: "Too many concurrent issue-list requests for this actor/client",
+                retryAfterSeconds: coordinated.retryAfterSeconds ?? 1,
+            };
+            res.setHeader("Retry-After", String(body.retryAfterSeconds));
+            logIssueListRequest({
+                req,
+                res,
+                companyId,
+                requestKey,
+                startedAt,
+                cacheStatus: "retry",
+                bodyBytes: estimatedJsonBytes(body),
+                etagOutcome: "none",
+                identicalInFlightCount: coordinated.identicalInFlightCount,
             });
-            if (revalidated)
-                recoveryActionByIssue.set(issue.id, revalidated);
-            else
-                recoveryActionByIssue.delete(issue.id);
-        }));
-        res.json(result.map((issue) => ({
-            ...issue,
-            successfulRunHandoff: handoffStates.get(issue.id) ?? null,
-            activeRecoveryAction: recoveryActionByIssue.get(issue.id) ?? null,
-        })));
+            res.status(429).json(body);
+            return;
+        }
+        if (coordinated.response.kind === "compact") {
+            res.setHeader("Cache-Control", coordinated.response.cacheControl);
+            res.setHeader("ETag", coordinated.response.etag);
+            const etagMatched = requestMatchesEtag(req.header("if-none-match"), coordinated.response.etag);
+            logIssueListRequest({
+                req,
+                res,
+                companyId,
+                requestKey,
+                startedAt,
+                cacheStatus: coordinated.cacheStatus,
+                bodyBytes: etagMatched ? 0 : estimatedJsonBytes(coordinated.response.body),
+                etagOutcome: etagMatched ? "not_modified" : "fresh",
+                identicalInFlightCount: coordinated.identicalInFlightCount,
+            });
+            if (etagMatched) {
+                res.status(304).end();
+                return;
+            }
+            res.json(coordinated.response.body);
+            return;
+        }
+        logIssueListRequest({
+            req,
+            res,
+            companyId,
+            requestKey,
+            startedAt,
+            cacheStatus: coordinated.cacheStatus,
+            bodyBytes: estimatedJsonBytes(coordinated.response.body),
+            etagOutcome: "none",
+            identicalInFlightCount: coordinated.identicalInFlightCount,
+        });
+        res.json(coordinated.response.body);
     });
     router.get("/companies/:companyId/issues/count", async (req, res) => {
         const companyId = req.params.companyId;
@@ -2745,6 +3873,126 @@ export function issueRoutes(db, storage, opts = {}) {
             currentExecutionWorkspace,
         });
     });
+    router.get("/issues/:id/diagnostics/blockers", async (req, res) => {
+        const id = req.params.id;
+        const issue = await svc.getById(id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
+        const diagnostic = await svc.getBlockerDiagnostics(issue.id);
+        const visibleBlockers = await filterIssuesForActor(req, diagnostic.blockers);
+        const response = buildIssueBlockerDiagnosticsResponse({
+            issue,
+            blockers: diagnostic.blockers,
+            visibleBlockers,
+            readiness: diagnostic.readiness,
+            truncated: diagnostic.truncated,
+        });
+        logger.info({
+            companyId: issue.companyId,
+            issueId: issue.id,
+            actorType: req.actor.type,
+            visibleBlockerCount: response.blockers.length,
+            omittedUnauthorizedBlockerCount: response.omittedUnauthorizedBlockerCount,
+            truncated: response.truncated,
+        }, "issue blocker diagnostics read");
+        res.json(response);
+    });
+    router.get("/issues/:id/diagnostics/wakes", async (req, res) => {
+        const id = req.params.id;
+        const issue = await svc.getById(id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
+        const [wakeDiagnostic, blockerDiagnostic, includeInternalIds] = await Promise.all([
+            svc.getWakeDiagnostics(issue.id),
+            svc.getBlockerDiagnostics(issue.id),
+            actorCanReadCompanyScope(req, issue.companyId),
+        ]);
+        const visibleBlockers = await filterIssuesForActor(req, blockerDiagnostic.blockers);
+        const blockerResponse = buildIssueBlockerDiagnosticsResponse({
+            issue,
+            blockers: blockerDiagnostic.blockers,
+            visibleBlockers,
+            readiness: blockerDiagnostic.readiness,
+            truncated: blockerDiagnostic.truncated,
+        });
+        const response = buildIssueWakeDiagnosticsResponse({
+            issue,
+            wakeRequests: wakeDiagnostic.wakeRequests,
+            activityRecords: wakeDiagnostic.activityRecords,
+            blockerDiagnostics: blockerResponse,
+            truncatedWakeRequests: wakeDiagnostic.truncatedWakeRequests,
+            truncatedActivityRecords: wakeDiagnostic.truncatedActivityRecords,
+            includeInternalIds,
+        });
+        logger.info({
+            companyId: issue.companyId,
+            issueId: issue.id,
+            actorType: req.actor.type,
+            wakeRequestCount: response.wakeRequestCount,
+            activityRecordCount: response.activityRecordCount,
+            internalIdsIncluded: includeInternalIds,
+            truncated: response.truncated,
+        }, "issue wake diagnostics read");
+        res.json(response);
+    });
+    router.get("/issues/:id/diagnostics/subtree", async (req, res) => {
+        const id = req.params.id;
+        const issue = await svc.getById(id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
+        const [diagnostic, includeInternalIds] = await Promise.all([
+            svc.getSubtreeDiagnostics(issue.id),
+            actorCanReadCompanyScope(req, issue.companyId),
+        ]);
+        const allBlockers = [...diagnostic.blockersByIssueId.values()].flat();
+        const [visibleNodes, visibleBlockers] = await Promise.all([
+            filterIssuesForActor(req, diagnostic.nodes),
+            filterIssuesForActor(req, allBlockers),
+        ]);
+        const response = buildIssueSubtreeDiagnosticsResponse({
+            issue,
+            nodes: diagnostic.nodes,
+            visibleNodes,
+            blockersByIssueId: diagnostic.blockersByIssueId,
+            visibleBlockers,
+            readinessByIssueId: diagnostic.readinessByIssueId,
+            wakeRequestsByIssueId: diagnostic.wakeRequestsByIssueId,
+            activityRecordsByIssueId: diagnostic.activityRecordsByIssueId,
+            truncatedNodes: diagnostic.truncatedNodes,
+            truncatedDepth: diagnostic.truncatedDepth,
+            truncatedBlockerIssueIds: diagnostic.truncatedBlockerIssueIds,
+            truncatedWakeIssueIds: diagnostic.truncatedWakeIssueIds,
+            truncatedActivityIssueIds: diagnostic.truncatedActivityIssueIds,
+            includeInternalIds,
+            caps: diagnostic.caps,
+        });
+        logger.info({
+            companyId: issue.companyId,
+            issueId: issue.id,
+            actorType: req.actor.type,
+            nodeCount: response.nodeCount,
+            omittedUnauthorizedNodeCount: response.omittedUnauthorizedNodeCount,
+            edgeCount: response.edges.length,
+            internalIdsIncluded: includeInternalIds,
+            truncated: response.truncated,
+        }, "issue subtree diagnostics read");
+        res.json(response);
+    });
     router.get("/issues/:id", async (req, res) => {
         const id = req.params.id;
         const issue = await svc.getById(id);
@@ -2798,10 +4046,10 @@ export function issueRoutes(db, storage, opts = {}) {
             relatedWork: referenceSummary,
             referencedIssueIdentifiers: referenceSummary.outbound.map((item) => item.issue.identifier ?? item.issue.id),
             ...documentPayload,
-            project: project ?? null,
+            project: compactIssueProject(project),
             goal: goal ?? null,
             mentionedProjects,
-            currentExecutionWorkspace,
+            currentExecutionWorkspace: compactIssueExecutionWorkspace(currentExecutionWorkspace),
             workProducts,
             linkedCases,
         });
@@ -2914,6 +4162,8 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const active = await revalidateActiveSourceRecoveryForRead({
             issue,
             trigger: "read_projection",
@@ -3077,6 +4327,8 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const objects = await externalObjectsSvc.listForIssue(issue.id);
         res.json(objects);
     });
@@ -3088,13 +4340,31 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const summary = await externalObjectsSvc.getIssueSummary(issue.id);
         res.json(summary);
     });
     router.post("/companies/:companyId/issues/external-object-summaries", validate(externalObjectSummariesSchema), async (req, res) => {
         const companyId = req.params.companyId;
         assertCompanyAccess(req, companyId);
-        const summaries = await externalObjectsSvc.getIssueSummaries(companyId, req.body.issueIds);
+        const requestedIssueIds = [...new Set(req.body.issueIds)];
+        const candidateIssues = requestedIssueIds.length > 0
+            ? await db
+                .select({
+                id: issueRows.id,
+                companyId: issueRows.companyId,
+                projectId: issueRows.projectId,
+                parentId: issueRows.parentId,
+                assigneeAgentId: issueRows.assigneeAgentId,
+                assigneeUserId: issueRows.assigneeUserId,
+                status: issueRows.status,
+            })
+                .from(issueRows)
+                .where(and(eq(issueRows.companyId, companyId), inArray(issueRows.id, requestedIssueIds)))
+            : [];
+        const readableIssueIds = (await filterIssuesForActor(req, candidateIssues)).map((issue) => issue.id);
+        const summaries = await externalObjectsSvc.getIssueSummaries(companyId, readableIssueIds);
         res.json({ summaries: Object.fromEntries(summaries) });
     });
     router.post("/issues/:id/external-objects/refresh", validate(refreshExternalObjectsSchema), async (req, res) => {
@@ -3182,6 +4452,8 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const keyParsed = issueDocumentKeySchema.safeParse(String(req.params.key ?? "").trim().toLowerCase());
         if (!keyParsed.success) {
             res.status(400).json({ error: "Invalid document key", details: keyParsed.error.issues });
@@ -3251,6 +4523,8 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const keyParsed = issueDocumentKeySchema.safeParse(String(req.params.key ?? "").trim().toLowerCase());
         if (!keyParsed.success) {
             res.status(400).json({ error: "Invalid document key", details: keyParsed.error.issues });
@@ -3555,6 +4829,8 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const keyParsed = issueDocumentKeySchema.safeParse(String(req.params.key ?? "").trim().toLowerCase());
         if (!keyParsed.success) {
             res.status(400).json({ error: "Invalid document key", details: keyParsed.error.issues });
@@ -4164,6 +5440,8 @@ export function issueRoutes(db, storage, opts = {}) {
         assertCompanyAccess(req, issue.companyId);
         if (await assertLowTrustControlPlaneDenied(req, res, issue.companyId, issue))
             return;
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const approvals = await issueApprovalsSvc.listApprovalsForIssue(id);
         res.json(approvals);
     });
@@ -4233,10 +5511,25 @@ export function issueRoutes(db, storage, opts = {}) {
     router.post("/companies/:companyId/issues", applyCreateIssueStatusDefault, validate(createIssueSchema), async (req, res) => {
         const companyId = req.params.companyId;
         assertCompanyAccess(req, companyId);
+        if (isSkillTestScopedActor(req)) {
+            res.status(403).json({
+                error: "Skill-test run tokens cannot create issues.",
+                details: {
+                    scopedIssueId: req.actor.keyScope?.kind === "skill_test" ? req.actor.keyScope.issueId : null,
+                    securityPrinciples: ["Least Privilege", "Complete Mediation", "Fail Securely"],
+                },
+            });
+            return;
+        }
         if (await assertLowTrustControlPlaneDenied(req, res, companyId, null))
             return;
         assertNoAgentHostWorkspaceCommandMutation(req, collectIssueWorkspaceCommandPaths(req.body));
-        const { watchdogDiscovery: rawWatchdogDiscovery, ...rawCreateBody } = req.body;
+        const sanitizedBody = await sanitizeIssueCreateAttribution(db, req, res, companyId, req.body, {
+            surface: "issues.create",
+        });
+        if (!sanitizedBody)
+            return;
+        const { watchdogDiscovery: rawWatchdogDiscovery, ...rawCreateBody } = sanitizedBody;
         const watchdogDiscovery = normalizeWatchdogDiscovery(rawWatchdogDiscovery);
         const watchdogProductBugFollowUp = await resolveTaskWatchdogProductBugFollowUp(req, res, companyId, watchdogDiscovery);
         if (watchdogProductBugFollowUp === false)
@@ -4336,6 +5629,9 @@ export function issueRoutes(db, storage, opts = {}) {
             ...(sourceTrust ? { sourceTrust } : {}),
             createdByAgentId: actor.agentId,
             createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+            actorRunId: actor.runId,
+            actorResponsibleUserId: authenticatedActorResponsibleUserId(req),
+            trustExplicitResponsibleUserId: actor.actorType === "user",
             watchdogActorRunId: actor.runId,
         });
         await issueReferencesSvc.syncIssue(issue.id);
@@ -4447,9 +5743,15 @@ export function issueRoutes(db, storage, opts = {}) {
         if (await assertLowTrustControlPlaneDenied(req, res, parent.companyId, parent))
             return;
         assertNoAgentHostWorkspaceCommandMutation(req, collectIssueWorkspaceCommandPaths(req.body));
-        const normalizedAssigneeAgentId = await normalizeIssueAssigneeAgentReference(parent.companyId, req.body.assigneeAgentId);
+        const sanitizedBody = await sanitizeIssueCreateAttribution(db, req, res, parent.companyId, req.body, {
+            surface: "issues.children.create",
+            entityId: parent.id,
+        });
+        if (!sanitizedBody)
+            return;
+        const normalizedAssigneeAgentId = await normalizeIssueAssigneeAgentReference(parent.companyId, sanitizedBody.assigneeAgentId);
         const createBody = {
-            ...req.body,
+            ...sanitizedBody,
             ...(normalizedAssigneeAgentId !== undefined ? { assigneeAgentId: normalizedAssigneeAgentId } : {}),
         };
         if (!(await assertCheapRecoveryIssueAssigneeProfileAllowed(req, res, parent, createBody)))
@@ -4461,7 +5763,7 @@ export function issueRoutes(db, storage, opts = {}) {
             assigneeUserId: createBody.assigneeUserId ?? null,
         };
         await assertTaskBridgeCreateAllowed(req, parent.companyId, childAssignmentScope);
-        if (req.body.assigneeAgentId || req.body.assigneeUserId) {
+        if (sanitizedBody.assigneeAgentId || sanitizedBody.assigneeUserId) {
             await assertCanAssignTasks(req, parent.companyId, childAssignmentScope);
         }
         await assertIssueEnvironmentSelection(parent.companyId, createBody.executionWorkspaceSettings?.environmentId);
@@ -4493,6 +5795,9 @@ export function issueRoutes(db, storage, opts = {}) {
             ...(sourceTrust ? { sourceTrust } : {}),
             createdByAgentId: actor.agentId,
             createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+            actorRunId: actor.runId,
+            actorResponsibleUserId: authenticatedActorResponsibleUserId(req),
+            trustExplicitResponsibleUserId: actor.actorType === "user",
             actorAgentId: actor.agentId,
             actorUserId: actor.actorType === "user" ? actor.actorId : null,
             watchdogActorRunId: actor.runId,
@@ -4608,9 +5913,15 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         const requestedChildren = [];
         for (const child of req.body.children) {
-            const normalizedAssigneeAgentId = await normalizeIssueAssigneeAgentReference(sourceIssue.companyId, child.assigneeAgentId);
+            const sanitizedChild = await sanitizeIssueCreateAttribution(db, req, res, sourceIssue.companyId, child, {
+                surface: "issues.accepted_plan_decomposition",
+                entityId: sourceIssue.id,
+            });
+            if (!sanitizedChild)
+                return;
+            const normalizedAssigneeAgentId = await normalizeIssueAssigneeAgentReference(sourceIssue.companyId, sanitizedChild.assigneeAgentId);
             const childBody = {
-                ...child,
+                ...sanitizedChild,
                 ...(normalizedAssigneeAgentId !== undefined ? { assigneeAgentId: normalizedAssigneeAgentId } : {}),
             };
             requestedChildren.push(childBody);
@@ -4646,6 +5957,9 @@ export function issueRoutes(db, storage, opts = {}) {
                 ...(sourceTrust ? { sourceTrust } : {}),
                 createdByAgentId: actor.agentId,
                 createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+                actorRunId: actor.runId,
+                actorResponsibleUserId: authenticatedActorResponsibleUserId(req),
+                trustExplicitResponsibleUserId: actor.actorType === "user",
                 actorAgentId: actor.agentId,
                 actorUserId: actor.actorType === "user" ? actor.actorId : null,
             });
@@ -5449,6 +6763,33 @@ export function issueRoutes(db, storage, opts = {}) {
                 }
             }
         }
+        if (issue.harnessKind === "skill_test" &&
+            existing.status !== issue.status &&
+            (issue.status === "done" || issue.status === "cancelled")) {
+            const completedRun = await companySkillsSvc.completeTestRunForIssue({
+                companyId: issue.companyId,
+                issueId: issue.id,
+                outcome: issue.status === "done" ? "succeeded" : "cancelled",
+                error: issue.status === "cancelled" ? "Harness issue was cancelled" : null,
+            });
+            if (completedRun) {
+                await logActivity(db, {
+                    companyId: issue.companyId,
+                    actorType: actor.actorType,
+                    actorId: actor.actorId,
+                    agentId: actor.agentId,
+                    runId: actor.runId,
+                    action: "company.skill_test_run_completed",
+                    entityType: "company_skill_test_run",
+                    entityId: completedRun.id,
+                    details: {
+                        issueId: issue.id,
+                        status: completedRun.status,
+                        outputDocumentKey: completedRun.outputDocumentKey,
+                    },
+                });
+            }
+        }
         let comment = null;
         if (commentBody) {
             const commentReferenceSummaryBefore = updateReferenceSummaryAfter
@@ -5883,6 +7224,9 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         const updated = await svc.checkout(id, req.body.agentId, req.body.expectedStatuses, checkoutRunId);
         const actor = getActorInfo(req);
+        if (updated?.harnessKind === "skill_test") {
+            await companySkillsSvc.markTestRunRunning(updated.companyId, updated.id);
+        }
         await logActivity(db, {
             companyId: issue.companyId,
             actorType: actor.actorType,
@@ -6273,6 +7617,62 @@ export function issueRoutes(db, storage, opts = {}) {
         });
         res.json(interaction);
     });
+    router.post("/issues/:id/interactions/:interactionId/verdicts", validate(submitIssueThreadInteractionVerdictsSchema), async (req, res) => {
+        const id = req.params.id;
+        const interactionId = req.params.interactionId;
+        const issue = await svc.getById(id);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        assertCompanyAccess(req, issue.companyId);
+        if (await rejectAgentIssueThreadInteractionResolution(req, res, issue))
+            return;
+        assertBoard(req);
+        const actor = getActorInfo(req);
+        const { interaction, newlyResolvedItemIds } = await issueThreadInteractionService(db).submitItemVerdicts(issue, interactionId, req.body, {
+            agentId: actor.agentId,
+            userId: actor.actorType === "user" ? actor.actorId : null,
+        });
+        await logActivity(db, {
+            companyId: issue.companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: interaction.status === "expired"
+                ? "issue.thread_interaction_expired"
+                : "issue.thread_interaction_item_verdicts_submitted",
+            entityType: "issue",
+            entityId: issue.id,
+            details: {
+                interactionId: interaction.id,
+                interactionKind: interaction.kind,
+                interactionStatus: interaction.status,
+                submittedVerdictCount: Array.isArray(req.body?.verdicts) ? req.body.verdicts.length : 0,
+                newlyResolvedItemCount: newlyResolvedItemIds.length,
+                newlyResolvedItemIds,
+                complete: interaction.kind === "request_item_verdicts"
+                    ? (interaction.result?.complete ?? false)
+                    : false,
+            },
+        });
+        if (newlyResolvedItemIds.length > 0) {
+            queueResolvedInteractionContinuationWakeup({
+                heartbeat,
+                issue,
+                interaction,
+                actor,
+                source: "issue.interaction.verdicts",
+                newlyResolvedItemIds,
+                idempotencyKey: buildRequestItemVerdictsWakeIdempotencyKey({
+                    issueId: issue.id,
+                    interactionId: interaction.id,
+                }),
+            });
+        }
+        res.json(interaction);
+    });
     router.post("/issues/:id/interactions/:interactionId/cancel", validate(cancelIssueThreadInteractionSchema), async (req, res) => {
         const id = req.params.id;
         const interactionId = req.params.interactionId;
@@ -7205,6 +8605,8 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, issue.companyId);
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const attachments = await svc.listAttachments(issueId);
         res.json(attachments.map(withContentPath));
     });
@@ -7302,6 +8704,13 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, attachment.companyId);
+        const issue = await svc.getById(attachment.issueId);
+        if (!issue) {
+            res.status(404).json({ error: "Issue not found" });
+            return;
+        }
+        if (!(await assertIssueReadAllowed(req, res, issue)))
+            return;
         const contentLength = attachment.byteSize;
         const range = parseAttachmentRangeHeader(typeof req.headers.range === "string" ? req.headers.range : undefined, contentLength);
         res.setHeader("Accept-Ranges", "bytes");