@runuai/host 0.9.167 → 0.9.169

package/lib/orchestrator.ts

@@ -1,3 +1,11 @@
+import { randomUUID } from "node:crypto";
+import { AssignmentEvidenceJournal } from "./assignment-evidence";
+import { durableAgentSessionId } from "./agents/transport";
+import { agentOutputSource } from "./agents/output-source";
+import { taskDir } from "./env";
+import { readTaskRunEpochState } from "./runtime-state";
+import type { AssignmentDelivery, AssignmentTurnEvidence } from "../src/protocol";
+
 /**
  * Orchestrator — the chat channel runtime.
  *
@@ -292,6 +300,7 @@ interface Channel {
   /** ADR-083: host-derived role assignment for execution-profile enforcement. */
   mode: "open" | "secretary";
   secretaryAgentId?: string;
+  leadRunId?: string | null;
   sessions: Map<string, AgentSession>;
   /** Session-spawn inputs, kept so sessions can be started lazily. */
   containerName: string;
@@ -386,10 +395,10 @@ interface Channel {
    *  boundary. Adapters do not share one mid-turn input contract, so only this
    *  cross-lane role is serialized at the host boundary; open mode keeps its
    *  legacy immediate-concurrent delivery behavior. */
-  pendingPrompts: Map<string, string[]>;
+  pendingPrompts: Map<string, AcceptedPrompt[]>;
   /** Prompts accepted by channelDeliver whose final session boundary rejected
    * specifically because the container runtime became unavailable. */
-  runtimeDeferredPrompts: Map<string, string[]>;
+  runtimeDeferredPrompts: Map<string, AcceptedPrompt[]>;
   /** Missing/blocked sessions to reconcile exactly once after runtime ready. */
   runtimeDeferredAgents: Set<string>;
   /** Agents whose current turn was interrupted (ESC) — their next
@@ -471,7 +480,7 @@ interface Channel {
   accountByAgent: Map<string, string>;
   /** ADR-076: the last prompt delivered to each agent, re-sent after an
    *  account rotation so the interrupted turn resumes on the new account. */
-  lastPrompt: Map<string, string>;
+  lastPrompt: Map<string, AcceptedPrompt>;
   /** ADR-076: per-agent account-rotation budget (reset on a successful turn) —
    *  bounds a rate-limit storm across accounts, mirroring the respawn budget. */
   rotations: Map<string, number>;
@@ -537,8 +546,27 @@ function mcpAgentMembershipFingerprint(
   );
 }
 
+const evidenceSessionIds = new WeakMap<AgentSession, string>();
+function evidenceSessionId(taskId: string, agentId: string, session: AgentSession): string {
+  let id = evidenceSessionIds.get(session);
+  if (!id) {
+    // Pin to this session object, including its final/aborted boundary. The
+    // registry may already contain its replacement by the time output ends.
+    id = durableAgentSessionId(taskId, agentId) ?? randomUUID();
+    evidenceSessionIds.set(session, id);
+  }
+  return id;
+}
+const evidenceRuntimeVersion: string | null = (() => {
+  try { return (JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as { version: string }).version; }
+  catch { return null; }
+})();
+
 interface AcceptedPrompt {
   text: string;
+  /** Frozen at acceptance. Null means unallocated, not inherit the latest. */
+  assignment: AssignmentDelivery | null;
+  leadRunId?: string | null;
 }
 
 interface RosterSessionChange {
@@ -927,6 +955,16 @@ export class Orchestrator {
   }
 
   private emitHost(event: HostEvent): void {
+    if (event.kind === "agent.message_complete" || event.kind === "agent.turn_complete") {
+      const session = this.channels.get(event.taskId)?.sessions.get(event.agentId);
+      const path = join(taskDir(event.taskId), ".uai", "assignment-evidence", `${event.agentId}.json`);
+      if (session && existsSync(path)) {
+        const evidence = new AssignmentEvidenceJournal(path).observe(
+          evidenceSessionId(event.taskId, event.agentId, session), agentOutputSource.getStore() ? agentOutputSource.getStore() + ":" + event.kind : undefined, event.kind === "agent.turn_complete",
+        );
+        if (evidence) event = { ...event, evidence };
+      }
+    }
     for (const fn of this.hostSubscribers) {
       try {
         fn(event);
@@ -1090,6 +1128,7 @@ export class Orchestrator {
     channel.humans = spec.humans ?? [];
     channel.mode = spec.mode === "secretary" ? "secretary" : "open";
     channel.secretaryAgentId = spec.secretaryAgentId;
+    channel.leadRunId = spec.leadRunId ?? null;
     channel.browserTesting = spec.browserTesting === true;
     if (channel.browserTesting) {
       const affectedKinds = browserWasEnabled
@@ -1390,6 +1429,7 @@ export class Orchestrator {
         HOST_ACCOUNT_SCOPE,
       mode: spec.mode === "secretary" ? "secretary" : "open",
       secretaryAgentId: spec.secretaryAgentId,
+      leadRunId: spec.leadRunId ?? null,
       sessions: new Map(),
       containerName: `task-${taskId.toLowerCase()}-app-1`,
       agentEnvironment: null,
@@ -2667,6 +2707,7 @@ export class Orchestrator {
                   task.ownerUserId,
                   apiUrl,
                   cliSecret,
+                this.isSecretary(channel, agent.id) ? channel.leadRunId : null,
                 ),
                 task,
               ),
@@ -4450,6 +4491,7 @@ export class Orchestrator {
                 task.ownerUserId,
                 apiUrl,
                 cliSecret,
+                this.isSecretary(channel, agent.id) ? channel.leadRunId : null,
               ),
               task,
             ),
@@ -4686,28 +4728,48 @@ export class Orchestrator {
     channel: Channel,
     agentId: string,
     session: AgentSession,
-    prompt: string,
+    prompt: string | AcceptedPrompt,
+    assignment?: AssignmentDelivery,
   ): void {
+    const replay = typeof prompt !== "string";
+    const text = typeof prompt === "string" ? prompt : prompt.text;
+    const leadRunId = replay ? (prompt as AcceptedPrompt).leadRunId ?? null : this.isSecretary(channel, agentId) ? channel.leadRunId ?? null : null;
+    const originalAssignment = typeof prompt === "string" ? (this.isSecretary(channel, agentId) ? null : assignment) : prompt.assignment;
+    let retainedAssignment = originalAssignment ?? null;
+    const journalPath = join(taskDir(channel.taskId), ".uai", "assignment-evidence", `${agentId}.json`);
+    let turn: AssignmentTurnEvidence | undefined;
+    const journal = assignment || leadRunId || existsSync(journalPath) ? new AssignmentEvidenceJournal(journalPath) : null;
+    const sessionId = evidenceSessionId(channel.taskId, agentId, session);
+    if (journal) {
+      const begun = journal.begin({ sessionId, engine: session.kind,
+        runEpoch: readTaskRunEpochState(channel.taskId)?.highestRunEpoch ?? 0,
+        recipientGeneration: channel.roster.find(a => a.id === agentId)?.tokenGeneration ?? null,
+        runtimeVersion: evidenceRuntimeVersion, assignment: originalAssignment, replay, leadRunId });
+      if (!begun) return; // stable assignment replay, already accepted
+      turn = begun;
+      retainedAssignment = begun.assignment;
+    }
     // ADR-076: this is the prompt actually in flight. A queued follow-up must
     // not replace it or account rotation would replay the wrong turn.
-    channel.lastPrompt.set(agentId, prompt);
-    const accepted = { text: prompt };
+    const accepted: AcceptedPrompt = { text, assignment: retainedAssignment, leadRunId };
+    channel.lastPrompt.set(agentId, accepted);
     const acceptedForAgent = channel.acceptedPrompts.get(agentId) ?? [];
     acceptedForAgent.push(accepted);
     channel.acceptedPrompts.set(agentId, acceptedForAgent);
     this.incrementActiveTurns(channel, agentId);
-    void session.send(prompt).catch((err: unknown) => {
+    void session.send(text).catch((err: unknown) => {
+      if (turn) journal?.failed(sessionId, turn.turnId);
       if (channel.sessions.get(agentId) === session) {
         this.removeAcceptedPrompt(channel, agentId, accepted);
         const remaining = this.decrementActiveTurns(channel, agentId);
         if (
           remaining === 0 &&
-          channel.lastPrompt.get(agentId) === prompt
+          channel.lastPrompt.get(agentId) === accepted
         ) {
           channel.lastPrompt.delete(agentId);
         }
         if (err instanceof ContainerRuntimeUnavailableError) {
-          this.deferPromptUntilRuntimeReady(channel, agentId, prompt);
+          this.deferPromptUntilRuntimeReady(channel, agentId, accepted);
         } else {
           this.startNextPendingPrompt(channel, agentId);
         }
@@ -4745,7 +4807,7 @@ export class Orchestrator {
   private deferPromptUntilRuntimeReady(
     channel: Channel,
     agentId: string,
-    prompt: string,
+    prompt: AcceptedPrompt,
   ): void {
     channel.runtimeDeferredAgents.add(agentId);
     if (this.isSecretary(channel, agentId)) {
@@ -4810,6 +4872,7 @@ export class Orchestrator {
     /** ADR-141 rung 1: only a human turn is shadow-routed. An older cloud
      *  sends nothing, which reads as "not human" and keeps the pass off. */
     origin?: DeliveryOrigin,
+    assignment?: AssignmentDelivery,
   ): Promise<{ ok: true } | { ok: false; error: string }> {
     // Slash command: re-run GitHub auth setup for this task (ADR-027). Handled
     // before sessions so it works even when an agent isn't ready.
@@ -4829,11 +4892,15 @@ export class Orchestrator {
     const session = channel.sessions.get(agentId);
     if (!session) return { ok: false, error: `no such agent: ${agentId}` };
 
+    if (assignment && (assignment.runEpoch !== (readTaskRunEpochState(taskId)?.highestRunEpoch ?? 0) ||
+      assignment.recipientGeneration !== (channel.roster.find(a => a.id === agentId)?.tokenGeneration ?? null))) {
+      return { ok: false, error: "assignment belongs to another run or agent generation" };
+    }
     const prompt = rewriteAttachmentRefs(text);
     if (this.isSecretary(channel, agentId)) {
       const queue = channel.pendingPrompts.get(agentId) ?? [];
       if ((channel.activeTurns.get(agentId) ?? 0) > 0 || queue.length > 0) {
-        queue.push(prompt);
+        queue.push({ text: prompt, assignment: assignment ?? null, leadRunId: channel.leadRunId ?? null });
         channel.pendingPrompts.set(agentId, queue);
         // A replacement session may have bound after the queue was observed
         // but before this delivery. Preserve FIFO by starting the oldest item.
@@ -4845,7 +4912,7 @@ export class Orchestrator {
       // Preserve the legacy open-room contract: adapters receive concurrent
       // deliveries immediately. Only the designated Secretary needs the hard
       // turn boundary because crew replies can arrive during its dispatch turn.
-      this.startPrompt(channel, agentId, session, prompt);
+      this.startPrompt(channel, agentId, session, prompt, assignment);
     }
     // ADR-141 rung 1: after the turn is on its way, ask what Auto would have
     // done and report it. Fire-and-forget by design — it must never delay or
@@ -5561,7 +5628,7 @@ export class Orchestrator {
     channel.lastPrompt.delete(agentId);
     if (accepted.length > 0 && !interrupted) {
       for (const prompt of accepted) {
-        this.deferPromptUntilRuntimeReady(channel, agentId, prompt.text);
+        this.deferPromptUntilRuntimeReady(channel, agentId, prompt);
       }
     } else {
       // Recreate even an idle session after readiness, without fabricating a
@@ -5695,6 +5762,7 @@ export class Orchestrator {
         task.ownerUserId,
         apiUrl,
         cliSecret,
+        this.isSecretary(channel, agent.id) ? channel.leadRunId : null,
       );
       const boundAccountId = channel.accountByAgent.get(agentId);
       const boundAccount = boundAccountId
@@ -5909,6 +5977,7 @@ export class Orchestrator {
         task.ownerUserId,
         apiUrl,
         cliSecret,
+        this.isSecretary(channel, agent.id) ? channel.leadRunId : null,
       );
       channel.accountByAgent.set(agentId, next.id);
       noteEngineAccountUsed(next.id);
@@ -6118,6 +6187,7 @@ export class Orchestrator {
         task.ownerUserId,
         apiUrl,
         cliSecret,
+        this.isSecretary(channel, agent.id) ? channel.leadRunId : null,
       );
       channel.accountByAgent.set(agentId, account.id);
       noteEngineAccountUsed(account.id);
@@ -7484,7 +7554,13 @@ export function buildSystemPreamble(
           `\`${(agent.permissions ?? []).join(", ")}\`. Commands: \`projects list\`,`,
           "`people list`, `task list`" +
             (agent.permissions?.includes("tasks.create")
-              ? ", `task create --name <n> --prompt <p> [--projects id,id] [--team id] [--agents handle,handle]`"
+              ? ", `task create --name <n> --prompt <p> [--projects id,id] [--team id] [--agents handle,handle] [--astronaut engine/model/effort] [--start --request-id <logical-run-id>]`"
+              : "") +
+            (agent.permissions?.includes("tasks.read")
+              ? ", `task watch <childId> [--after <cursor>]`, `task usage <childId>`"
+              : "") +
+            (agent.permissions?.includes("tasks.chat")
+              ? ", `task send <childId> <text>`, `task answer <childId> <cardId> <option>`"
               : "") +
             (agent.permissions?.includes("tasks.close")
               ? ", `task close --status finished|canceled [--reason \"final report\"]`"
@@ -7520,8 +7596,13 @@ export function buildSystemPreamble(
                 `shell command \`node ${CONTAINER_CLI_PATH} task create …\`. Do NOT`,
                 "use your built-in TaskCreate / task tools for this — those are just",
                 "your own private to-do notes and are invisible to the human in Uai.",
-                "Uai tasks you create are DRAFTS — a human reviews and starts them;",
-                "nothing runs (or spends) until then. Discover options first with",
+                "Tasks you create are your own direct children, DRAFTS by default.",
+                "Only an explicit tasks.start grant lets --start launch them,",
+                "under the owner's limits and this task's account lane.",
+                "Only children you started are delegated to you; a live chat-capable Secretary receives coalesced events. Otherwise the child addresses the person.",
+                "Closing the parent leaves running children alive. Child permissions never exceed your live creation ceiling.",
+                "Send/answer are visibly delegated agent inputs, never human approval.",
+                "Discover options first with",
                 "`projects list` / `people list`.",
               ]
             : []),

package/lib/project-env-loader.ts

@@ -181,6 +181,7 @@ export function taskProjectEnvResolver(
     readonly placeholders: Readonly<Record<string, string>>;
   } = () => ({ withheld: [], placeholders: {} }),
   taskSource: () => TaskEnvSource = () => STORED,
+  taskSecrets: () => { revision: string; withheld: readonly string[]; values: Readonly<Record<string, string>> } = () => ({ revision: "", withheld: [], values: {} }),
 ): TaskGatewayEnvResolver {
   const projectIds = [...new Set(spec.projects.map((project) => project.projectId))];
   let revisions: number[] | undefined;
@@ -192,7 +193,9 @@ export function taskProjectEnvResolver(
     const currentUai = uaiEnv();
     const currentProxied = proxiedEnv();
     const currentSource = taskSource();
+    const secrets = taskSecrets();
     const currentRunnerKey = JSON.stringify([
+      secrets.revision,
       Object.entries(currentUai).sort(([a], [b]) => compareAscii(a, b)),
       [...currentProxied.withheld].sort(compareAscii),
       Object.entries(currentProxied.placeholders).sort(([a], [b]) => compareAscii(a, b)),
@@ -214,6 +217,7 @@ export function taskProjectEnvResolver(
     Object.assign(values, resolved.values);
     const withheld = new Set([
       ...currentProxied.withheld,
+      ...secrets.withheld,
       ...(currentSource.kind === "view" ? currentSource.view.notDelivered : []),
     ]);
     for (const name of withheld) delete values[name];
@@ -225,6 +229,7 @@ export function taskProjectEnvResolver(
         values[name] = placeholder;
       }
     }
+    Object.assign(values, secrets.values);
     for (const [name, value] of Object.entries(currentUai)) {
       // Only reserved names: Uai's own variables, never a project's.
       if (ENV_NAME.test(name) && isReservedTaskEnvName(name) && !value.includes("\0")) values[name] = value;

package/lib/secrets-proxy/policy.ts

@@ -1,3 +1,4 @@
+import { taskSecretsView } from "../credential-consumers/task-secrets";
 /**
  * Which keys each task has in proxy mode (ADR-153's effective policy: the
  * owner's binding ∩ the task's schema observation), and what of that the
@@ -36,21 +37,29 @@ export function createTaskProxyPolicySource(
   return {
     proxiedKeys: (taskId) => {
       if (!isServed(taskId)) return null;
-      return (viewOf(taskId)?.proxied ?? []).map(({ projectId, key, domains, placeholder, head }) => ({
+      const secrets = taskSecretsView(taskId);
+      const taskKeys = secrets.filter(s => s.manifest.mode === "proxied").map(s => ({ projectId: `task-secret:${taskId}`, key: s.manifest.name, domains: s.manifest.domains, placeholder: s.manifest.placeholder, head: { revision: s.manifest.generation, generation: s.manifest.generation, tombstone: false as const, valueRef: { kind: "staged" as const, stagingId: s.manifest.stagingId } } }));
+      return [...taskKeys, ...(viewOf(taskId)?.proxied ?? []).filter(e => !secrets.some(s => s.manifest.name === e.key)).map(({ projectId, key, domains, placeholder, head }) => ({
         projectId,
         key,
         domains,
         placeholder,
         head,
-      }));
+      }))];
     },
     realValue: (taskId, ref) => {
+      if (!isServed(taskId)) return null;
+      if (ref.projectId === `task-secret:${taskId}`) {
+        const secret = taskSecretsView(taskId).find(s => s.manifest.name === ref.key && s.manifest.mode === "proxied");
+        return secret && ref.head?.generation === secret.manifest.generation && ref.head.valueRef?.kind === "staged" && ref.head.valueRef.stagingId === secret.manifest.stagingId ? secret.material?.value ?? null : null;
+      }
+      if (taskSecretsView(taskId).some(s => s.manifest.name === ref.key)) return null;
       const { head } = ref;
       if (head === undefined) return null;
       const proxied = viewOf(taskId)?.proxied.find((entry) => entry.projectId === ref.projectId && entry.key === ref.key);
       return proxied !== undefined && sameTaskEnvHead(proxied.head, head) ? proxied.value : null;
     },
-    notDelivered: (taskId) => viewOf(taskId)?.notDelivered ?? null,
+    notDelivered: (taskId) => [...(viewOf(taskId)?.notDelivered ?? []), ...taskSecretsView(taskId).map(s => s.manifest.name)],
   };
 }
 

package/lib/standard-image-cleanup.ts

@@ -0,0 +1,117 @@
+import { randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, mkdirSync, openSync, readSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { CONTEXT_HASH_LABEL } from "./standard-image-pin";
+
+type Result = { code: number | null; stdout: string; stderr: string };
+export type DockerCommand = (command: string, args: string[], timeoutMs?: number) => Promise<Result>;
+const IMAGE_ID = /^sha256:[a-f0-9]{64}$/;
+const SWEEP_LIMIT = 16;
+const HISTORY_LIMIT = 128;
+const HISTORY_BYTES = 16 * 1024;
+
+/** Context labels are inherited by task images. Authority to delete comes
+ * from observing this exact id under the standard tag, never from a scan. */
+export class StandardImageCleanup {
+  private readonly observed = new Set<string>();
+  private loading: Promise<void> | undefined;
+  private statePath: string | undefined;
+
+  constructor(private readonly stateFile?: () => Promise<string>) {}
+
+  private async load(): Promise<void> {
+    if (!this.stateFile) return;
+    try {
+      this.statePath = await this.stateFile();
+      const fd = openSync(this.statePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > HISTORY_BYTES) return;
+        const bytes = Buffer.alloc(HISTORY_BYTES + 1);
+        const length = readSync(fd, bytes, 0, bytes.length, 0);
+        if (length > HISTORY_BYTES) return;
+        const value = JSON.parse(bytes.subarray(0, length).toString("utf8")) as { version?: unknown; ids?: unknown };
+        if (value?.version !== 1 || !Array.isArray(value.ids) || value.ids.length > HISTORY_LIMIT || !value.ids.every(id => typeof id === "string" && IMAGE_ID.test(id))) return;
+        for (const id of value.ids) this.observed.add(id as string);
+      } finally { closeSync(fd); }
+    } catch { /* Missing, corrupt or unreadable history authorizes nothing. */ }
+  }
+
+  private save(): void {
+    if (!this.statePath) return;
+    const temporary = `${this.statePath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      mkdirSync(dirname(this.statePath), { recursive: true, mode: 0o700 });
+      writeFileSync(temporary, JSON.stringify({ version: 1, ids: [...this.observed] }), { flag: "wx", mode: 0o600 });
+      renameSync(temporary, this.statePath);
+    } catch {
+      // ENOSPC must not block a build or safe cleanup using in-memory proof.
+      console.warn("[host-agent] could not persist standard-image history");
+    } finally {
+      try { unlinkSync(temporary); } catch { /* Renamed or never created. */ }
+    }
+  }
+
+  async observe(run: DockerCommand, ref = "uai-standard:dev"): Promise<string | null> {
+    await (this.loading ??= this.load());
+    const result = await run("docker", ["image", "inspect", "--format", "{{json .}}", ref]);
+    if (result.code !== 0) return null;
+    try {
+      const image = JSON.parse(result.stdout) as { Id?: string; Config?: { Labels?: Record<string, string> } };
+      if (!IMAGE_ID.test(image.Id ?? "") || !/^[a-f0-9]{32}$/.test(image.Config?.Labels?.[CONTEXT_HASH_LABEL] ?? "")) return null;
+      if (ref === "uai-standard:dev") {
+        this.observed.delete(image.Id!);
+        this.observed.add(image.Id!);
+        if (this.observed.size > HISTORY_LIMIT) this.observed.delete(this.observed.values().next().value!);
+        this.save();
+      }
+      return image.Id!;
+    } catch { return null; }
+  }
+
+  async sweep(run: DockerCommand, previousId: string | null): Promise<void> {
+    const deadline = Date.now() + 30_000;
+    const boundedRun: DockerCommand = (command, args) => run(command, args, 5_000);
+    const currentId = await this.observe(boundedRun);
+    if (!currentId) return;
+    const history = await boundedRun("docker", ["image", "history", "--quiet", "--no-trunc", currentId]);
+    if (history.code !== 0) return;
+    const currentChain = new Set([currentId, ...history.stdout.trim().split(/\s+/)]);
+    const candidates = new Set([...(previousId ? [previousId] : []), ...this.observed]);
+    for (const id of [...candidates].filter(id => this.observed.has(id) && !currentChain.has(id)).slice(0, SWEEP_LIMIT)) {
+      if (Date.now() >= deadline) break;
+      // Round-robin retained/in-use ids so a busy prefix cannot starve later ids.
+      this.observed.delete(id);
+      this.observed.add(id);
+      const tags = await boundedRun("docker", ["image", "inspect", "--format", "{{json .RepoTags}}", id]);
+      if (tags.code !== 0) continue;
+      try { const parsed: unknown = JSON.parse(tags.stdout); if (parsed !== null && (!Array.isArray(parsed) || parsed.length !== 0)) continue; } catch { continue; }
+      const containers = await boundedRun("docker", ["ps", "--all", "--quiet", "--filter", `ancestor=${id}`]);
+      if (containers.code !== 0 || containers.stdout.trim()) continue;
+      // Normal Docker removal reclaims otherwise-unused untagged parents.
+      // Shared ancestors of the current image (or any other child/container)
+      // remain protected by the daemon. Never force or target a parent id.
+      const removed = await boundedRun("docker", ["image", "rm", id]);
+      if (removed.code === 0) {
+        this.observed.delete(id);
+        console.log("[host-agent] removed unused previous standard image", id);
+      }
+    }
+    this.save();
+  }
+}
+
+/** Per-process exponential retry, keyed by the desired content/configuration.
+ * A new host payload/engine configuration retries immediately. A restart also
+ * retries once; repeated failures back off 2h, 4h, …, 24h instead of hourly. */
+export class StandardImageBuildBackoff {
+  private state: { key: string; failures: number; retryAt: number; error: string } | null = null;
+  remaining(key: string, now = Date.now()): { delay: number; retryAt: number; error: string } | null {
+    return this.state?.key === key && this.state.retryAt > now ? { delay: this.state.retryAt - now, retryAt: this.state.retryAt, error: this.state.error } : null;
+  }
+  failed(key: string, error: string, now = Date.now()): void {
+    const failures = this.state?.key === key ? this.state.failures + 1 : 1;
+    this.state = { key, failures, retryAt: now + Math.min(24, 2 ** Math.min(failures, 5)) * 3_600_000, error };
+  }
+  clear(): void { this.state = null; }
+}

package/lib/standard-image.ts

@@ -2,7 +2,8 @@
  * Standard-image build pipeline (ADR-022 / docs/runtime.md).
  *
  * Every host builds exactly one standard image (`uai-standard:dev`) and
- * caches it. `ensureStandardImage()` is called once at host startup:
+ * caches it. `ensureStandardImage()` runs at startup and on the owned-host
+ * hourly maintenance schedule (local build failures back off):
  *
  *   1. `docker volume create uai-asdf-data` — the host-wide asdf data volume
  *      that caches lazily-installed runtime versions across tasks (idempotent;
@@ -52,6 +53,7 @@ import {
   standardImagePullDigest,
 } from "./standard-image-pin";
 import { sidecarMode } from "./sidecar";
+import { StandardImageCleanup, StandardImageBuildBackoff } from "./standard-image-cleanup";
 
 /** Pinned, host-wide constants (must match task-up.sh and the compose gen). */
 export const STANDARD_IMAGE_TAG = "uai-standard:dev";
@@ -1296,8 +1298,15 @@ export type ActivationIsCurrent = () => boolean;
 /** Tests: forget every remembered pass. */
 export function resetStandardImageMemo(): void {
   lastOkByKey.clear();
+  buildBackoff.clear();
 }
 
+const buildBackoff = new StandardImageBuildBackoff();
+const imageCleanup = new StandardImageCleanup(async () => {
+  const { env } = await import("./env");
+  return resolve(env.dataDir, "standard-image-seen.json");
+});
+
 /** The owned-host schedule (docs/agent-notes.md, "image maintenance"). */
 export const MAINTENANCE_INTERVAL_MS = 60 * 60_000;
 
@@ -1418,6 +1427,7 @@ async function ensureStandardImageInner(
   // hash, not this host's per-config hash, which would disagree by design
   // and rebuild forever). Any pull-path failure falls through to the local
   // build below, so offline and registry-down hosts behave exactly as today.
+  const previousImageId = engine.apple ? null : await imageCleanup.observe(run);
   const pin = await readStandardImagePin();
   if (pin !== null) {
     if (inspect.code === 0 && labeledHash === pin.contextHash) {
@@ -1473,13 +1483,18 @@ async function ensureStandardImageInner(
     imageReady = true;
   } else {
     const context = standardImageDir();
-    console.log(
-      inspect.code === 0
-        ? `[host-agent] standard image ${STANDARD_IMAGE_TAG} stale (context changed) — rebuilding from ${context}`
-        : `[host-agent] building standard image ${STANDARD_IMAGE_TAG} from ${context}`,
-    );
-    const build = await run(engine.command, [
+    const buildKey = `${contextHash ?? "unavailable"}:${JSON.stringify(engines)}:${pin?.contextHash ?? "local"}`;
+    const deferred = engine.apple || labeledHash === null ? null : buildBackoff.remaining(buildKey);
+    if (!deferred) {
+      console.log(
+        inspect.code === 0
+          ? `[host-agent] standard image ${STANDARD_IMAGE_TAG} stale (context changed) — rebuilding from ${context}`
+          : `[host-agent] building standard image ${STANDARD_IMAGE_TAG} from ${context}`,
+      );
+    }
+    const build = deferred ? { code: 1, stdout: "", stderr: `${deferred.error}\nStandard image build deferred until ${new Date(deferred.retryAt).toISOString()}.` } : await run(engine.command, [
       "build",
+      ...(engine.apple ? [] : ["--force-rm"]),
       "-t",
       STANDARD_IMAGE_TAG,
       ...engineArgs,
@@ -1491,11 +1506,14 @@ async function ensureStandardImageInner(
     if (build.code === 0) {
       console.log(`[host-agent] built standard image ${STANDARD_IMAGE_TAG}`);
       imageReady = true;
+      buildBackoff.clear();
     } else {
       buildError =
         build.stderr.trim() ||
         `docker build exited ${build.code ?? "spawn error"}`;
+      if (!deferred && !engine.apple) buildBackoff.failed(buildKey, buildError);
       console.warn(
+        deferred ? `[host-agent] ${buildError}` :
         `[host-agent] standard image build failed (exit ${build.code ?? "spawn"}); ` +
           "continuing. Tasks needing the image will surface this error.\n" +
           buildError,
@@ -1505,6 +1523,10 @@ async function ensureStandardImageInner(
     }
   }
 
+  // Revisit ids durably observed under the standard tag across restarts.
+  // Inherited labels never authorize sweeping task/compose images.
+  if (imageReady && !engine.apple) await imageCleanup.sweep(run, previousImageId);
+
   // 3. Reconcile every Uai-owned writer under the volume-global flock. Lock
   //    bootstrap/permission repair precedes the single upgrade→repair→proof
   //    transaction so node-run task materializers can acquire legacy volumes.
@@ -1648,7 +1670,7 @@ async function ensureStandardImageInner(
       }
       return {
         ok: false,
-        error: `Could not prepare shared runtime maintenance lock ${ASDF_MAINTENANCE_LOCK_PATH}.`,
+        error: `${buildError ? `${buildError} ` : ""}Could not prepare shared runtime maintenance lock ${ASDF_MAINTENANCE_LOCK_PATH}.`,
       };
     }
     if (!(await reconcileVolumeAgentClis(activation))) {
@@ -1661,7 +1683,7 @@ async function ensureStandardImageInner(
       return {
         ok: false,
         error:
-          "Shared runtime maintenance failed; agent CLIs or Corepack did not pass execution proof.",
+          `${buildError ? `${buildError} ` : ""}Shared runtime maintenance failed; agent CLIs or Corepack did not pass execution proof.`,
       };
     }
     return { ok: true };

package/lib/task-env-source.ts

@@ -1,3 +1,4 @@
+import { deliveredTaskSecrets } from "./credential-consumers/task-secrets";
 /**
  * ADR-153 §4 and §6: where a task's project env comes from, for its /env and
  * its proxy alike, on an owned runner and on a task machine's sidecar.
@@ -233,6 +234,7 @@ export function taskEnvResolver(taskId: string, spec: TaskProjectEnvSpec, runEpo
     () => taskTrustEnv(taskId),
     () => taskProxiedEnv(taskId),
     () => taskEnvSource(taskId, spec, runEpoch),
+    () => deliveredTaskSecrets(taskId, runEpoch),
   );
 }