@sleep2agi/commhub-server 0.9.0-preview.28 → 0.9.0-preview.29

package/src/tools.ts

@@ -1,7 +1,8 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod/v4";
-import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken } from "./db.js";
-import { pushEvent, pushNetworkObserverEvent } from "./push.js";
+import { createHash } from "node:crypto";
+import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken, syncScheduledRunForTask } from "./db.js";
+import { getSSEStats, pushEvent, pushNetworkObserverEvent } from "./push.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
 import { canRestWriteNetwork, getUserNetworkIds, singleNetworkId } from "./network-scope.js";
@@ -55,6 +56,8 @@ import {
   isAllowedToChangeFlag,
 } from "./config-apply-validate.js";
 import { sharedSendDedup, buildDuplicateSendPayload } from "./send_dedup.js";
+import { clientRequestIdFromMeta, idempotentTaskId, idempotentTaskMatches, type StoredIdempotentTask } from "./task-idempotency.js";
+import { stampTaskAuthOrigin, type TaskAuthOrigin } from "./task-auth-origin.js";
 
 function ts(): string {
   return new Date().toTimeString().slice(0, 8);
@@ -148,6 +151,163 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error, message }) }] };
   };
 
+  const skillHubReply = (value: Record<string, unknown>) => ({
+    content: [{ type: "text" as const, text: JSON.stringify(value) }],
+  });
+
+  // SkillHub is a network registry, not a public filesystem. Content is an
+  // immutable SKILL.md snapshot; identity comes only from the authenticated
+  // MCP principal (never from request fields).
+  server.tool(
+    "submit_skill",
+    "Submit an immutable SKILL.md version to the caller's network SkillHub. Node identity is token-bound. New submissions require review.",
+    {
+      slug: z.string().min(2).max(80).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+      name: z.string().min(1).max(120),
+      description: z.string().max(1000).optional(),
+      version: z.string().min(1).max(40).regex(/^[0-9A-Za-z]+(?:[._-][0-9A-Za-z]+)*$/),
+      content: z.string().min(1).max(128 * 1024).refine(value => !value.includes("\0"), "content must not contain NUL bytes"),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ slug, name, description, version, content, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "write");
+      const sourceType = callerTokenIsNetwork ? "node" : "user";
+      if (sourceType === "node" && !callerAlias) return skillHubReply({ ok: false, error: "node_identity_unbound" });
+      const contentHash = createHash("sha256").update(content, "utf8").digest("hex");
+      const existing = db.get<any>(
+        `SELECT skill_id, content_hash, status FROM skillhub_skills
+         WHERE network_id = ?1 AND slug = ?2 AND version = ?3`,
+        effectiveNetId, slug, version,
+      );
+      if (existing) {
+        if (existing.content_hash === contentHash) {
+          return skillHubReply({ ok: true, idempotent: true, skill_id: existing.skill_id, status: existing.status });
+        }
+        return skillHubReply({ ok: false, error: "skill_version_conflict", hint: "publish changed content under a new version" });
+      }
+      const skillId = `skill_${uuidv4()}`;
+      try {
+        db.run(
+          `INSERT INTO skillhub_skills
+           (skill_id, network_id, slug, name, description, version, content, content_hash, status, source_type, source_alias, created_by_user)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'pending', ?9, ?10, ?11)`,
+          [skillId, effectiveNetId, slug, name.trim(), description?.trim() || "", version, content, contentHash, sourceType, callerAlias, enforceUserId || null],
+        );
+      } catch (error: any) {
+        // Two submitters may pass the preflight SELECT together. Resolve the
+        // UNIQUE race into the same deterministic idempotent/conflict contract
+        // instead of leaking a storage exception as HTTP/MCP 500.
+        if (!/unique|duplicate key/i.test(error?.message || "")) throw error;
+        const winner = db.get<any>(
+          `SELECT skill_id, content_hash, status FROM skillhub_skills
+           WHERE network_id = ?1 AND slug = ?2 AND version = ?3`,
+          effectiveNetId, slug, version,
+        );
+        if (!winner) throw error;
+        if (winner.content_hash === contentHash) {
+          return skillHubReply({ ok: true, idempotent: true, skill_id: winner.skill_id, status: winner.status });
+        }
+        return skillHubReply({ ok: false, error: "skill_version_conflict", hint: "publish changed content under a new version" });
+      }
+      db.run(
+        `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+         VALUES (?1, ?2, 'skill_submit', 'skill', ?3, ?4, ?5)`,
+        [enforceUserId || null, callerAlias || null, skillId, JSON.stringify({ slug, version, source_type: sourceType }), effectiveNetId],
+      );
+      return skillHubReply({ ok: true, skill_id: skillId, status: "pending", source_type: sourceType, source_alias: callerAlias });
+    },
+  );
+
+  server.tool(
+    "list_skills",
+    "List published skills in a network. Owners/admins may include pending review items.",
+    {
+      network_id: z.string().max(200).optional(),
+      include_pending: z.boolean().optional(),
+      query: z.string().max(120).optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+    },
+    async ({ network_id: clientNetId, include_pending, query, limit }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "read");
+      const role = enforceUserId ? getUserNetworkRole(enforceUserId, effectiveNetId) : null;
+      if (enforceUserId && !role) return writeDeniedReply(effectiveNetId, "read");
+      // An ntok_ belongs to a node even when it was minted by the network
+      // owner. Never inherit the owner's review power through that token.
+      const reviewer = !callerTokenIsNetwork && (role === "owner" || role === "admin");
+      const showPending = !!include_pending && reviewer;
+      const params: unknown[] = [effectiveNetId];
+      let sql = `SELECT skill_id, slug, name, description, version, status, source_type, source_alias,
+                        created_at, updated_at, reviewed_at, review_note
+                   FROM skillhub_skills WHERE network_id = ?1`;
+      if (!showPending) sql += ` AND status = 'published'`;
+      if (query?.trim()) {
+        params.push(`%${query.trim()}%`);
+        sql += ` AND (slug LIKE ?${params.length} OR name LIKE ?${params.length} OR description LIKE ?${params.length})`;
+      }
+      sql += ` ORDER BY updated_at DESC LIMIT ${limit ?? 100}`;
+      return skillHubReply({ ok: true, reviewer, skills: db.all(sql, ...params) });
+    },
+  );
+
+  server.tool(
+    "get_skill",
+    "Read one SkillHub SKILL.md. Pending content is visible only to owners/admins.",
+    { skill_id: z.string().regex(/^skill_[A-Za-z0-9_-]+$/).max(200), network_id: z.string().max(200).optional() },
+    async ({ skill_id, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "read");
+      const role = enforceUserId ? getUserNetworkRole(enforceUserId, effectiveNetId) : null;
+      if (enforceUserId && !role) return writeDeniedReply(effectiveNetId, "read");
+      const row = db.get<any>(
+        `SELECT skill_id, slug, name, description, version, content, status,
+                source_type, source_alias, created_at, updated_at, reviewed_at, review_note
+           FROM skillhub_skills WHERE skill_id = ?1 AND network_id = ?2`,
+        skill_id, effectiveNetId,
+      );
+      if (!row) return skillHubReply({ ok: false, error: "skill_not_found" });
+      const reviewer = !callerTokenIsNetwork && (role === "owner" || role === "admin");
+      if (row.status !== "published" && !reviewer) {
+        return skillHubReply({ ok: false, error: "skill_not_found" });
+      }
+      return skillHubReply({ ok: true, skill: row });
+    },
+  );
+
+  server.tool(
+    "review_skill",
+    "Publish or reject a pending SkillHub submission. Network owner/admin only.",
+    {
+      skill_id: z.string().regex(/^skill_[A-Za-z0-9_-]+$/).max(200),
+      decision: z.enum(["published", "rejected"]),
+      note: z.string().max(1000).optional(),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ skill_id, decision, note, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "write");
+      const role = enforceUserId ? getUserNetworkRole(enforceUserId, effectiveNetId) : null;
+      if (callerTokenIsNetwork || (role !== "owner" && role !== "admin")) return skillHubReply({ ok: false, error: "skill_review_admin_required" });
+      const row = db.get<any>(`SELECT status FROM skillhub_skills WHERE skill_id = ?1 AND network_id = ?2`, skill_id, effectiveNetId);
+      if (!row) return skillHubReply({ ok: false, error: "skill_not_found" });
+      if (row.status !== "pending") return skillHubReply({ ok: false, error: "skill_not_pending", status: row.status });
+      const updated = db.run(
+        `UPDATE skillhub_skills SET status = ?1, review_note = ?2, reviewed_by_user = ?3,
+         reviewed_at = datetime('now'), updated_at = datetime('now') WHERE skill_id = ?4 AND network_id = ?5 AND status = 'pending'`,
+        [decision, note?.trim() || null, enforceUserId || null, skill_id, effectiveNetId],
+      );
+      if (updated.changes !== 1) return skillHubReply({ ok: false, error: "skill_not_pending" });
+      db.run(
+        `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+         VALUES (?1, ?2, 'skill_review', 'skill', ?3, ?4, ?5)`,
+        [enforceUserId || null, callerAlias || null, skill_id, JSON.stringify({ decision }), effectiveNetId],
+      );
+      return skillHubReply({ ok: true, skill_id, status: decision });
+    },
+  );
+
   const addScope = (sql: string, params: any[], networkId?: string | null, column = "network_id"): string => {
     if (!networkId) return sql;
     sql += ` AND ${column} = ?${params.length + 1}`;
@@ -323,6 +483,26 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         uptime_seconds: z.number().nullable().optional(),
         in_flight_count: z.number().nullable().optional(),
       }).optional().describe("Per-agent process telemetry reported by agent-node"),
+      external_schedules: z.object({
+        observed_at: z.string().datetime({ offset: true }).max(64),
+        schedules: z.array(z.object({
+          id: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
+          name: z.string().min(1).max(200),
+          kind: z.enum(["cron", "systemd", "tmux", "playwright", "custom"]),
+          frequency: z.string().min(1).max(120),
+          last_run_at: z.string().datetime({ offset: true }).max(64).nullable(),
+          last_status: z.enum(["success", "failed", "running", "unknown"]),
+          last_error: z.string().max(500).nullable(),
+          next_run_at: z.string().datetime({ offset: true }).max(64).nullable(),
+          log_ref: z.string().min(1).max(255).nullable(),
+          enabled: z.boolean(),
+          // RFC-036 — only agent-node managed cron markers advertise write
+          // capability. Legacy/other kinds omit these fields and stay read-only.
+          editable: z.boolean().optional(),
+          revision: z.number().int().min(0).optional(),
+        }).strict()).max(64),
+        error: z.enum(["invalid_manifest", "unsafe_manifest", "read_failed"]).optional(),
+      }).strict().optional().describe("Bounded node-reported external schedule snapshot; never includes host paths or commands"),
       // RFC-024 B6 — masked snapshot of the node's effective config
       // (model + 6 dashboard-editable flags). Secrets ARE NOT in this
       // shape (env._envRef stays on host); the dashboard reads this
@@ -336,6 +516,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         flags: z.record(z.unknown()).optional(),
         config_revision: z.number().int().min(0).optional(),
         config_update_capable: z.boolean().optional(),
+        peer_reply_inbox_capable: z.literal(true).optional(),
         // RFC-026 P2 / #338 — daemon role surfaced for hub /api/nodes
         // discovery (#337 extracts this field). "host_supervisor" =
         // anet daemon. Default-stripping zod would drop this otherwise.
@@ -353,7 +534,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         }).optional(),
       }).optional().describe("RFC-024 — masked node config snapshot"),
     },
-    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, config_snapshot: cfgSnap }) => {
+    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap }) => {
       const effectiveNetId = getNetworkId(netId);
       const sessionNetId = effectiveNetId ?? "default";
       if (!callerTokenIsNetwork || !enforceNetworkId) {
@@ -438,6 +619,15 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const processCpuPct = typeof proc?.cpu_pct === "number" ? proc.cpu_pct : null;
       const processUptimeSeconds = typeof proc?.uptime_seconds === "number" ? proc.uptime_seconds : null;
       const processInFlightCount = typeof proc?.in_flight_count === "number" ? proc.in_flight_count : null;
+      const externalSchedulesJson = externalSchedules === undefined ? null : JSON.stringify(externalSchedules);
+      const trustedCurrentSnapshot = node_id
+        ? trustedConfigSnapshotForNode(cfgSnap ?? null, callerTokenId ?? null, node_id)
+        : null;
+      const peerReplyInboxCapable = !!(
+        trustedCurrentSnapshot
+        && typeof trustedCurrentSnapshot === "object"
+        && (trustedCurrentSnapshot as Record<string, unknown>).peer_reply_inbox_capable === true
+      );
       const statusHostTelemetry = host ? {
         hostname: hostHostname,
         ip: hostIp,
@@ -462,8 +652,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         // Only delete same-alias sessions within the same network
         db.run("DELETE FROM sessions WHERE alias = ?1 AND resume_id != ?2 AND network_id = ?3", [effectiveAlias, resume_id, sessionNetId]);
         db.run(
-          `INSERT INTO sessions (resume_id, alias, tmux_name, server, ip, hostname, agent, project_dir, version, status, task, output, progress, score, node_id, session_id, config_path, channels, network_id, model, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, last_seen_at, updated_at)
-           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26, ?27, ?28, ?29, ?30, ?31, ?32, ?33, datetime('now'), datetime('now'))
+          `INSERT INTO sessions (resume_id, alias, tmux_name, server, ip, hostname, agent, project_dir, version, status, task, output, progress, score, node_id, session_id, config_path, channels, network_id, model, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, external_schedules, peer_reply_inbox_capable, last_seen_at, updated_at)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26, ?27, ?28, ?29, ?30, ?31, ?32, ?33, ?34, ?35, datetime('now'), datetime('now'))
            ON CONFLICT(resume_id) DO UPDATE SET
              alias = COALESCE(?2, sessions.alias), tmux_name = COALESCE(?3, sessions.tmux_name),
              server = COALESCE(?4, sessions.server), ip = COALESCE(?5, sessions.ip),
@@ -488,8 +678,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
              process_cpu_pct = COALESCE(?31, sessions.process_cpu_pct),
              process_uptime_seconds = COALESCE(?32, sessions.process_uptime_seconds),
              process_in_flight_count = COALESCE(?33, sessions.process_in_flight_count),
+             external_schedules = COALESCE(?34, sessions.external_schedules),
+             peer_reply_inbox_capable = ?35,
              last_seen_at = datetime('now'), updated_at = datetime('now')`,
-          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, status, task ?? null, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount]
+          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, status, task ?? null, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount, externalSchedulesJson, peerReplyInboxCapable ? 1 : 0]
         );
         if (host || proc) {
           db.run(
@@ -539,6 +731,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           upsertNodeWithSec1Guard({
             node_id,
             callerNetworkId: effectiveNetId ?? null,
+            callerUserId: enforceUserId ?? null,
+            callerTokenId: callerTokenId ?? null,
             node_name: nn || effectiveAlias,
             alias: effectiveAlias,
             runtime: nodeRuntime,
@@ -630,6 +824,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         } else {
           updatedTaskId = task;
         }
+        if (updatedTaskId) syncScheduledRunForTask(updatedTaskId, effectiveNetId);
       });
       // Log event after transaction
       if (updatedTaskId) logTaskEvent(updatedTaskId, null, "replied", alias, "report_completion");
@@ -690,7 +885,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const rows0 = db.get<{ cnt: number }>(countSql, ...countParams);
       console.log(`[${ts()}] ${alias} → get_inbox: ${rows0?.cnt ?? 0} pending messages`);
       const rowsParams: any[] = [alias];
-      let rowsSql = `SELECT id, type, priority, content, context, from_session, created_at, network_id, meta_json
+      let rowsSql = `SELECT id, type, priority, content, context, from_session, created_at, network_id, meta_json,
+         CASE WHEN type = 'task' THEN COALESCE(task_id, id) ELSE task_id END AS task_id
          FROM inbox WHERE session_name = ?1 AND acked = 0`;
       rowsSql = addReadScope(rowsSql, rowsParams, readScope);
       rowsSql += ` ORDER BY CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END, created_at
@@ -720,8 +916,26 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
       console.log(`[${ts()}] ${alias} → ack_inbox: ${message_id.slice(0, 8)}`);
-      const ackParams: any[] = [message_id, alias];
-      let ackSql = "UPDATE inbox SET acked = 1 WHERE id = ?1 AND session_name = ?2";
+      // New task consumers ACK by the logical tasks.task_id exposed by
+      // get_inbox. Keep exact inbox.id support for legacy consumers and for
+      // non-task messages. Restrict the lookup to pending rows: after a retry
+      // the original row can have id == task_id but is already ACKed, while
+      // the current row has a fresh transport id and the same logical task_id.
+      const inboxTaskParams: any[] = [message_id, alias];
+      let inboxTaskSql = `SELECT id, type, COALESCE(task_id, id) AS task_id
+         FROM inbox
+         WHERE session_name = ?2 AND acked = 0
+           AND (id = ?1 OR (type = 'task' AND task_id = ?1))`;
+      inboxTaskSql = addScope(inboxTaskSql, inboxTaskParams, effectiveNetId);
+      inboxTaskSql += " ORDER BY created_at DESC LIMIT 1";
+      const inboxTask = db.get<{ id: string; type: string; task_id: string }>(inboxTaskSql, ...inboxTaskParams);
+      if (!inboxTask) {
+        return {
+          content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "message not found or already acknowledged" }) }],
+        };
+      }
+      const ackParams: any[] = [inboxTask.id, alias];
+      let ackSql = "UPDATE inbox SET acked = 1 WHERE id = ?1 AND session_name = ?2 AND acked = 0";
       ackSql = addScope(ackSql, ackParams, effectiveNetId);
       const result = db.run(ackSql, ackParams);
       if (result.changes === 0) {
@@ -731,11 +945,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
       // V2: sync tasks table — ack_inbox means delivered→acked
       try {
-        const taskParams: any[] = [message_id];
+        if (inboxTask?.type !== "task") {
+          return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true }) }] };
+        }
+        const taskParams: any[] = [inboxTask.task_id];
         let taskSql = "UPDATE tasks SET status = 'acked' WHERE task_id = ?1 AND status = 'delivered'";
         taskSql = addScope(taskSql, taskParams, effectiveNetId);
         const ackResult = db.run(taskSql, taskParams);
-        if (ackResult.changes > 0) logTaskEvent(message_id, "delivered", "acked", alias);
+        if (ackResult.changes > 0) logTaskEvent(inboxTask.task_id, "delivered", "acked", alias);
       } catch {}
       return {
         content: [{ type: "text" as const, text: JSON.stringify({ ok: true }) }],
@@ -743,6 +960,144 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     }
   );
 
+  // #520 — two monotonic runtime-evidence levels for exact tasks.
+  //
+  // runtime_submitted_at means agent-node handed the body to the vendor
+  // runtime. consumed_at is stronger: an attributable turn-start or first
+  // activity event came back. Merely fetching/acking an inbox row sets neither.
+  // Node identity comes exclusively from the ntok; callers cannot self-report
+  // an alias or node_id. A consumed mark also fills runtime_submitted_at because
+  // that stronger fact logically implies submission.
+  const markTaskRuntimeEvidence = (
+    taskIds: string[],
+    level: "submitted" | "consumed",
+  ) => {
+    const task_ids = taskIds;
+    if (!callerTokenIsNetwork || !callerAlias || !enforceNetworkId) {
+      return {
+        content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_token_required" }) }],
+      };
+    }
+    // PgAdapter.transaction currently opens a fresh subprocess/connection
+    // per statement. The all-or-nothing batch promise cannot be made there;
+    // refuse evidence rather than publish a partially stamped batch.
+    if (db.dialect !== "sqlite") {
+      return {
+        content: [{ type: "text" as const, text: JSON.stringify({
+          ok: false,
+          error: "task_runtime_evidence_backend_unsupported",
+        }) }],
+      };
+    }
+
+      const uniqueTaskIds = [...new Set(task_ids)];
+      if (uniqueTaskIds.length !== task_ids.length) {
+        return {
+          content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "duplicate_task_id" }) }],
+        };
+      }
+
+      const placeholders = uniqueTaskIds.map((_, i) => `?${i + 2}`).join(", ");
+
+      // Keep ownership preflight and every stamp in one SQLite transaction.
+      // This closes the cross-process preflight→UPDATE race: no other writer
+      // can reassign a task between the identity decision and the write.
+      const outcome = db.transaction(() => {
+        const canonicalCaller = resolveCanonicalAlias(enforceNetworkId, callerAlias).alias;
+        const callerSession = db.get<{ node_id: string | null }>(
+          `SELECT node_id FROM sessions
+           WHERE network_id = ?1 AND alias = ?2
+           ORDER BY updated_at DESC LIMIT 1`,
+          enforceNetworkId,
+          canonicalCaller,
+        );
+        const rows = db.all<{ task_id: string; to_node_id: string | null; to_name: string }>(
+          `SELECT task_id, to_node_id, to_name FROM tasks
+           WHERE network_id = ?1 AND task_id IN (${placeholders})`,
+          enforceNetworkId,
+          ...uniqueTaskIds,
+        );
+        const owned = new Map(rows.map((row) => [row.task_id, row]));
+        const rejectedTaskId = uniqueTaskIds.find((taskId) => {
+          const row = owned.get(taskId);
+          if (!row) return true;
+          // Prefer immutable node identity whenever the task has one.  Direct
+          // and legacy token-bound sessions legitimately have NULL node_id;
+          // only that shape may fall back to the canonical token alias.
+          if (row.to_node_id) return row.to_node_id !== callerSession?.node_id;
+          return resolveCanonicalAlias(enforceNetworkId, row.to_name).alias !== canonicalCaller;
+        });
+        if (rejectedTaskId) {
+          return { ok: false as const, error: "task_not_owned", task_id: rejectedTaskId };
+        }
+
+        for (const taskId of uniqueTaskIds) {
+          const row = owned.get(taskId)!;
+          const ownershipSql = row.to_node_id
+            ? "to_node_id = ?3"
+            : "to_node_id IS NULL AND to_name = ?3";
+          const ownerValue = row.to_node_id ?? row.to_name;
+          let updateResult;
+          if (level === "consumed") {
+            updateResult = db.run(
+              `UPDATE tasks SET
+                 runtime_submitted_at = COALESCE(runtime_submitted_at, datetime('now')),
+                 consumed_at = COALESCE(consumed_at, datetime('now'))
+               WHERE network_id = ?1 AND task_id = ?2 AND ${ownershipSql}`,
+              [enforceNetworkId, taskId, ownerValue],
+            );
+          } else {
+            updateResult = db.run(
+              `UPDATE tasks SET runtime_submitted_at = COALESCE(runtime_submitted_at, datetime('now'))
+               WHERE network_id = ?1 AND task_id = ?2 AND ${ownershipSql}`,
+              [enforceNetworkId, taskId, ownerValue],
+            );
+          }
+          if (updateResult.changes !== 1) {
+            // A zero-row write after a successful preflight is an invariant
+            // failure, never a successful evidence report.
+            throw new Error(`task_runtime_evidence_write_race:${taskId}`);
+          }
+        }
+        const evidenceRows = db.all<{
+          task_id: string;
+          runtime_submitted_at: string;
+          consumed_at: string | null;
+        }>(
+          `SELECT task_id, runtime_submitted_at, consumed_at FROM tasks
+           WHERE network_id = ?1 AND task_id IN (${placeholders})`,
+          enforceNetworkId,
+          ...uniqueTaskIds,
+        );
+        return { ok: true as const, tasks: evidenceRows };
+      });
+
+      return {
+        content: [{
+          type: "text" as const,
+          text: JSON.stringify(outcome),
+        }],
+      };
+  };
+
+  const taskRuntimeEvidenceSchema = {
+    task_ids: z.array(z.string().min(1).max(200)).min(1).max(100),
+  };
+
+  server.tool(
+    "mark_tasks_runtime_submitted",
+    "Internal agent-node signal: exact task bodies were submitted to this token-bound node's vendor runtime.",
+    taskRuntimeEvidenceSchema,
+    async ({ task_ids }) => markTaskRuntimeEvidence(task_ids, "submitted"),
+  );
+
+  server.tool(
+    "mark_tasks_consumed",
+    "Internal agent-node signal: exact tasks produced attributable turn-start/activity evidence in this token-bound node's runtime.",
+    taskRuntimeEvidenceSchema,
+    async ({ task_ids }) => markTaskRuntimeEvidence(task_ids, "consumed"),
+  );
+
   // ═══════════════════════════════════════════
   //  Hub Tools (5)
   // ═══════════════════════════════════════════
@@ -838,7 +1193,12 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
     async ({ alias, task, priority, context, from_session: _fromIn, ttl_seconds, network_id: netId, parent_task_id: parentIn, meta }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
       const effectiveNetId = getNetworkId(netId);
-      const metaJson = normalizeMetaJson(meta);
+      const authOrigin: TaskAuthOrigin = callerTokenIsNetwork
+        ? "node"
+        : enforceUserId
+          ? "user"
+          : "legacy";
+      const metaJson = normalizeMetaJson(stampTaskAuthOrigin(meta, authOrigin));
 
       // Role check FIRST — round5 follow-up (通信牛 oracle catch):
       // the explicit-parent verification below distinguishes
@@ -913,6 +1273,37 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const target = resolveDeliveryTarget(targetAlias, effectiveNetId);
       if (target.state === "not_found") return deliveryTargetReply(target)!;
 
+      // Dashboard sends carry a random client_request_id inside meta. Derive
+      // the task primary key from authenticated scope + that request id so a
+      // lost HTTP response can be retried safely, even after a hub restart.
+      // The existing row must match the full request; key reuse with changed
+      // content/target fails closed instead of silently returning another task.
+      const clientRequestId = clientRequestIdFromMeta(meta);
+      const id = clientRequestId
+        ? idempotentTaskId(effectiveNetId ?? null, from_session, clientRequestId)
+        : uuidv4();
+      if (clientRequestId) {
+        const existing = db.get<StoredIdempotentTask>(
+          "SELECT task_id, from_name, to_name, priority, content, network_id, meta_json, status FROM tasks WHERE task_id = ?1",
+          [id],
+        );
+        if (existing) {
+          if (!idempotentTaskMatches(existing, {
+            fromName: from_session, toName: targetAlias, priority, content: task,
+            networkId: effectiveNetId ?? null, metaJson,
+          })) {
+            return { content: [{ type: "text" as const, text: JSON.stringify({
+              ok: false, error: "idempotency_conflict",
+              message: "client_request_id was already used with a different task payload",
+            }) }] };
+          }
+          return { content: [{ type: "text" as const, text: JSON.stringify({
+            ok: true, message_id: existing.task_id, task_id: existing.task_id,
+            task_status: existing.status, idempotent_replay: true,
+          }) }] };
+        }
+      }
+
       // #212 dedup guardrail. If this exact (from, to, content) has already
       // been delivered within COMMHUB_SEND_DEDUP_WINDOW_MS (default 5 min)
       // we refuse the call and surface a structured `duplicate_send`
@@ -940,7 +1331,6 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
 
       console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: ${task.slice(0, 60)}${priority === "high" ? " [HIGH]" : ""}${canonical.renamed ? ` [renamed from ${alias}]` : ""}`);
-      const id = uuidv4();
       const fromNodeId = resolveNodeIdForAlias(from_session, effectiveNetId);
       const targetNodeId = target.session?.node_id ?? null;
       // 事务：inbox + tasks 双写 + 触碰目标 session 的 task/updated_at（让
@@ -949,8 +1339,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // 报告冲突）。
       db.transaction(() => {
         db.run(
-          `INSERT INTO inbox (id, session_name, node_id, type, priority, content, context, from_session, requires_response, network_id, meta_json)
-           VALUES (?1, ?2, ?3, 'task', ?4, ?5, ?6, ?7, 'reply', ?8, ?9)`,
+          `INSERT INTO inbox (id, task_id, session_name, node_id, type, priority, content, context, from_session, requires_response, network_id, meta_json)
+           VALUES (?1, ?1, ?2, ?3, 'task', ?4, ?5, ?6, ?7, 'reply', ?8, ?9)`,
           [id, targetAlias, targetNodeId, priority, task, context ?? null, from_session, effectiveNetId ?? null, metaJson]
         );
         db.run(
@@ -1081,11 +1471,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     }
   );
 
-  // ── V2: send_reply (关联 task_id，不触发 think) ──
-  server.tool(
-    "send_reply",
-    "Send a reply to a Dashboard/UI-originated task (updates task row, emits new_reply SSE — Dashboard reads it). ⚠ NOT for agent-to-agent replies: agent nodes only log new_reply and do not processInbox on it, so the peer will not see the reply in real time. Use send_task for peer-to-peer replies (RFC-030, Vincent 2026-07-28 全网规则). If the target alias resolves to a live agent node, the response includes a `warning` field pointing to send_task.",
-    {
+  // ── V2/V3 reply primitives ──
+  const replyToolSchema = {
       alias: z.string().min(1).max(200).describe("Target session alias"),
       text: z.string().min(1).max(10000).describe("Reply content"),
       in_reply_to: z.string().max(200).optional().describe("Original task/message ID"),
@@ -1102,10 +1489,15 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // both `attachments` (top-level) and `meta.attachments` are supplied,
       // top-level wins (same rule as REST /api/task L2101).
       meta: z.any().optional().describe("Optional structured reply metadata, e.g. { attachments: [...] }."),
-    },
-    async ({ alias, text, in_reply_to, status: replyStatus, from_session: _fromIn, network_id: netId, attachments, meta }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
+    };
+  const handleReply = async (args: any, peerCapabilityRequired: boolean) => {
+      const { alias, text, in_reply_to, status: replyStatus = "replied", from_session: _fromIn, network_id: netId, attachments, meta } = args;
+      const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
       const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
+      if (peerCapabilityRequired && !in_reply_to) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "peer_reply_task_required" }) }] };
+      }
 
       // #507 — validate attachments BEFORE any DB write. Rejects malformed
       // input (bad file_id, >20 items, size > cap, non-object item, wrong
@@ -1132,51 +1524,99 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         : meta;
       const metaJson = normalizeMetaJson(mergedMeta);
 
-      console.log(`[${ts()}] ${from_session} → send_reply (${replyStatus}) → ${alias}: ${text.slice(0, 60)}${attachmentsResult.attachments.length ? ` [+${attachmentsResult.attachments.length} attachments]` : ""}`);
+      const canonicalReplyTarget = resolveCanonicalAlias(effectiveNetId, alias);
+      const replyTargetAlias = canonicalReplyTarget.alias;
+      console.log(`[${ts()}] ${from_session} → send_reply (${replyStatus}) → ${replyTargetAlias}: ${text.slice(0, 60)}${attachmentsResult.attachments.length ? ` [+${attachmentsResult.attachments.length} attachments]` : ""}${canonicalReplyTarget.renamed ? ` [renamed from ${alias}]` : ""}`);
       const id = uuidv4();
-      let taskBefore: { status: string } | null = null;
-      if (in_reply_to) {
-        const taskParams: any[] = [in_reply_to];
-        let taskSql = "SELECT status FROM tasks WHERE task_id = ?1";
-        taskSql = addScope(taskSql, taskParams, effectiveNetId);
-        taskBefore = db.get<{ status: string }>(taskSql, ...taskParams) ?? null;
-        if (!taskBefore) {
-          return {
-            content: [{
-              type: "text" as const,
-              text: JSON.stringify({
-                ok: false,
-                error: "reply_task_not_found",
-                message: `cannot apply reply: task not found (${in_reply_to})`,
-                in_reply_to,
-                reply_queued: false,
-              }),
-            }],
-          };
-        }
-        if (!["created", "delivered", "acked", "running"].includes(taskBefore.status)) {
-          return {
-            content: [{
-              type: "text" as const,
-              text: JSON.stringify({
-                ok: false,
-                error: "reply_task_terminal",
-                message: `cannot apply reply: task is already terminal (${taskBefore.status})`,
-                in_reply_to,
-                task_status: taskBefore.status,
-                reply_queued: false,
-              }),
-            }],
-          };
-        }
-      }
-      const replyTargetNodeId = resolveNodeIdForAlias(alias, effectiveNetId);
+      const replyTargetNodeId = resolveNodeIdForAlias(replyTargetAlias, effectiveNetId);
       // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.1 site 3/6).
       {
-        const lc = assertNodeActive(alias, effectiveNetId ?? null);
+        const lc = assertNodeActive(replyTargetAlias, effectiveNetId ?? null);
         if (!lc.ok) return { content: [{ type: "text" as const, text: JSON.stringify(lc) }] };
       }
-      const replyLogged = db.transaction(() => {
+      const replyOutcome = db.transaction(() => {
+        type ReplyTask = {
+          status: string;
+          from_node_id: string | null;
+          from_name: string;
+          to_name: string;
+          to_node_id: string | null;
+        };
+        let taskBefore: ReplyTask | null = null;
+        let callerNodeId: string | null = null;
+        if (in_reply_to) {
+          const taskParams: any[] = [in_reply_to];
+          let taskSql = "SELECT status, from_node_id, from_name, to_name, to_node_id FROM tasks WHERE task_id = ?1";
+          taskSql = addScope(taskSql, taskParams, effectiveNetId);
+          taskBefore = db.get<ReplyTask>(taskSql, ...taskParams) ?? null;
+          if (!taskBefore) return { ok: false as const, error: "reply_task_not_found" as const };
+          if (!["created", "delivered", "acked", "running"].includes(taskBefore.status)) {
+            return { ok: false as const, error: "reply_task_terminal" as const, taskStatus: taskBefore.status };
+          }
+
+          // V3 atomic peer replies are capability-negotiated. Both identity
+          // bindings and the recipient capability are re-read inside this
+          // transaction before any inbox/task/run write. Legacy/unbound rows
+          // fail toward compatibility send_reply, which terminalizes the
+          // original task instead of creating a second response-requiring row.
+          if (peerCapabilityRequired) {
+            if (!taskBefore.from_node_id) {
+              // Origin type is an intrinsic property of the task and must be
+              // decided before caller capability. A Dashboard/human task still
+              // needs the established send_reply terminalization path when the
+              // replying node uses a legacy/unbound token.
+              return { ok: false as const, error: "peer_reply_origin_not_node" as const };
+            }
+            if (!callerTokenIsNetwork || !callerTokenId || !enforceNetworkId) {
+              return { ok: false as const, error: "peer_reply_node_token_required" as const };
+            }
+            const token = db.get<{ bound_node_id: string | null }>(
+              "SELECT bound_node_id FROM api_tokens WHERE token_id = ?1 AND network_id = ?2",
+              callerTokenId,
+              enforceNetworkId,
+            );
+            if (!token?.bound_node_id || !taskBefore.to_node_id) {
+              return { ok: false as const, error: "peer_reply_unsupported" as const };
+            }
+            if (token.bound_node_id !== taskBefore.to_node_id) {
+              return { ok: false as const, error: "reply_task_not_owned" as const };
+            }
+            callerNodeId = token.bound_node_id;
+            const canonicalTarget = replyTargetAlias;
+            const canonicalOrigin = resolveCanonicalAlias(enforceNetworkId, taskBefore.from_name).alias;
+            if (canonicalTarget !== canonicalOrigin) {
+              return { ok: false as const, error: "reply_target_mismatch" as const };
+            }
+            const recipient = db.get<{ peer_reply_inbox_capable: number }>(
+              `SELECT peer_reply_inbox_capable FROM sessions
+               WHERE node_id = ?1 AND network_id = ?2 AND alias = ?3
+               ORDER BY updated_at DESC LIMIT 1`,
+              taskBefore.from_node_id,
+              enforceNetworkId,
+              canonicalOrigin,
+            );
+            if (recipient?.peer_reply_inbox_capable !== 1) {
+              return { ok: false as const, error: "peer_reply_unsupported" as const };
+            }
+          } else if (callerTokenIsNetwork && enforceNetworkId) {
+            // Compatibility send_reply is still an exact task transition for
+            // node callers. Bind it to the token-authenticated assignee alias
+            // and immutable original sender. Alias binding survives a
+            // legitimate node-id rotation without letting another node close
+            // the task.
+            const canonicalCaller = resolveCanonicalAlias(enforceNetworkId, from_session).alias;
+            const canonicalAssignee = resolveCanonicalAlias(enforceNetworkId, taskBefore.to_name).alias;
+            if (canonicalCaller !== canonicalAssignee) {
+              return { ok: false as const, error: "reply_task_not_owned" as const };
+            }
+            const canonicalOrigin = resolveCanonicalAlias(enforceNetworkId, taskBefore.from_name).alias;
+            if (replyTargetAlias !== canonicalOrigin) {
+              return { ok: false as const, error: "reply_target_mismatch" as const };
+            }
+          }
+
+        }
+
         // #507 — write meta_json on inbox insert (parity with send_task L952).
         // Prior to this the attachments field on a send_reply call was
         // silently stripped by MCP Zod, leaving `ok:true` with no persisted
@@ -1184,7 +1624,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         db.run(
           `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id, meta_json)
            VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, ?5, ?6, 'none', ?7, ?8)`,
-          [id, alias, replyTargetNodeId, text, from_session, in_reply_to ?? null, effectiveNetId ?? null, metaJson]
+          [id, replyTargetAlias, replyTargetNodeId, text, from_session, in_reply_to ?? null, effectiveNetId ?? null, metaJson]
         );
 
         // 更新 tasks 表
@@ -1203,31 +1643,53 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
                  completed_at = datetime('now'),
                  meta_json = COALESCE(?3, meta_json)
              WHERE task_id = ?4 AND status IN ('created', 'delivered', 'acked', 'running')`;
+          if (peerCapabilityRequired && callerTokenIsNetwork && taskBefore) {
+            if (taskBefore.to_node_id) {
+              updateParams.push(callerNodeId);
+              updateSql += ` AND to_node_id = ?${updateParams.length}`;
+            } else {
+              updateParams.push(taskBefore.to_name);
+              updateSql += ` AND to_node_id IS NULL AND to_name = ?${updateParams.length}`;
+            }
+          }
           updateSql = addScope(updateSql, updateParams, effectiveNetId);
           const result = db.run(updateSql, updateParams);
           if (result.changes === 0) {
-            console.log(`[${ts()}] ⚠ send_reply: task ${in_reply_to?.slice(0, 8)} not found or already terminal`);
-            return false;
+            throw new Error(`reply_atomic_cas_failed:${in_reply_to}`);
           }
-          return true;
+          syncScheduledRunForTask(in_reply_to, effectiveNetId);
+          return { ok: true as const, replyLogged: true };
         }
-        return false;
+        return { ok: true as const, replyLogged: false };
       });
 
-      if (in_reply_to && !replyLogged) {
+      if (!replyOutcome.ok) {
+        const taskStatus = "taskStatus" in replyOutcome ? replyOutcome.taskStatus : undefined;
+        const messages: Record<string, string> = {
+          reply_task_not_found: `cannot apply reply: task not found (${in_reply_to})`,
+          reply_task_terminal: `cannot apply reply: task is already terminal (${taskStatus})`,
+          peer_reply_node_token_required: "atomic peer reply requires a node token",
+          peer_reply_unsupported: "recipient or caller does not support atomic peer replies",
+          peer_reply_origin_not_node: "original task sender is not a node; use send_reply",
+          reply_node_identity_unbound: "cannot apply reply: node identity is not token-bound",
+          reply_task_not_owned: "cannot apply reply: task is not owned by this node",
+          reply_target_mismatch: "cannot apply reply: target is not the original task sender",
+        };
         return {
           content: [{
             type: "text" as const,
             text: JSON.stringify({
               ok: false,
-              error: "reply_not_applied",
-              message: "reply was not applied to task",
+              error: replyOutcome.error,
+              message: messages[replyOutcome.error],
               in_reply_to,
+              ...(taskStatus ? { task_status: taskStatus } : {}),
               reply_queued: false,
             }),
           }],
         };
       }
+      const replyLogged = replyOutcome.replyLogged;
 
       // Log event after commit (outside transaction)
       if (replyLogged && in_reply_to) logTaskEvent(in_reply_to, null, replyStatus, from_session, text.slice(0, 200));
@@ -1264,20 +1726,21 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         }
       }
 
-      const session = scopedSessionStatus(alias, effectiveNetId);
-      pushEvent(alias, { type: "new_reply", from: from_session, message_id: id, in_reply_to, status: replyStatus }, effectiveNetId);
+      const session = scopedSessionStatus(replyTargetAlias, effectiveNetId);
+      pushEvent(replyTargetAlias, { type: "new_reply", from: from_session, message_id: id, in_reply_to, status: replyStatus }, effectiveNetId);
       // #461 network observer summary — ids + routing only, no reply text.
-      pushNetworkObserverEvent(effectiveNetId, { type: "new_reply", task_id: in_reply_to ?? null, message_id: id, from: from_session, to: alias, status: replyStatus });
-
-      // #498 — When the reply target is a live agent node (not Dashboard/UI),
-      // warn the caller that agent peers only log new_reply and do not
-      // processInbox on it. Points at the correct next action (send_task)
-      // so a follow-up turn corrects course rather than "why didn't they
-      // respond" spelunking. Absent field when target is Dashboard/hub/api
-      // (the correct path for commhub_reply) — silence is affirmation.
-      const targetIsAgent = replyTargetNodeId !== null && alias !== "hub" && alias !== "api";
-      const warning = targetIsAgent
-        ? `Target "${alias}" is an agent node. commhub_reply/send_reply does NOT wake agent peers (they only log new_reply, they do not processInbox on it) — the peer will not see this reply in real time. For agent-to-agent replies, use commhub_send_task(alias="${alias}", task="<your reply>") so the peer wakes via new_task SSE and processes it. (RFC-030, Vincent 2026-07-28 全网规则.)`
+      pushNetworkObserverEvent(effectiveNetId, { type: "new_reply", task_id: in_reply_to ?? null, message_id: id, from: from_session, to: replyTargetAlias, status: replyStatus });
+
+      // #498 compatibility tripwire. Legacy send_reply is intentionally kept
+      // for old agents and Dashboard callers during rollout, but it is not the
+      // capability-negotiated atomic peer primitive. Warn only for an actual
+      // agent target; Dashboard hub/api replies remain quiet. New agents call
+      // send_peer_reply and never see this warning.
+      const targetIsAgent = replyTargetNodeId !== null
+        && replyTargetAlias !== "hub"
+        && replyTargetAlias !== "api";
+      const warning = !peerCapabilityRequired && targetIsAgent
+        ? `Target "${replyTargetAlias}" is an agent node. Legacy commhub_reply/send_reply terminalized the original task; upgraded peers should prefer commhub_send_peer_reply for capability-negotiated delivery. (RFC-030 mixed-version rollout.)`
         : undefined;
 
       // #507 — echo attachments READ BACK FROM DB (lead 2b5f6634): the point
@@ -1315,7 +1778,19 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           }),
         }],
       };
-    }
+    };
+
+  server.tool(
+    "send_reply",
+    "Reply to a Dashboard/UI-originated task. Also serves as the terminal legacy fallback when atomic peer reply capability is unavailable.",
+    replyToolSchema,
+    (args) => handleReply(args, false),
+  );
+  server.tool(
+    "send_peer_reply",
+    "Atomically finalize one node-owned task and enqueue one no-response result when the exact recipient advertises peer_reply_inbox_capable. Stored capability survives transient SSE disconnects; legacy peers return peer_reply_unsupported with zero writes.",
+    replyToolSchema,
+    (args) => handleReply(args, true),
   );
 
   // ── V2: send_ack (不入 inbox，仅更新状态) ──
@@ -1381,12 +1856,13 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
            WHERE task_id = ?1`;
         updateSql = addScope(updateSql, updateParams, effectiveNetId);
         db.run(updateSql, updateParams);
+        syncScheduledRunForTask(task_id, effectiveNetId ?? task.network_id ?? null);
         // Re-queue in inbox with new ID (original ID may already exist)
         const retryInboxId = uuidv4();
         db.run(
-          `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, requires_response, network_id)
-           VALUES (?1, ?2, ?3, 'task', ?4, ?5, ?6, 'reply', ?7)`,
-          [retryInboxId, task.to_name, task.to_node_id ?? resolveNodeIdForAlias(task.to_name, effectiveNetId ?? task.network_id ?? null), task.priority, task.content, from_session, effectiveNetId ?? task.network_id ?? null]
+          `INSERT INTO inbox (id, task_id, session_name, node_id, type, priority, content, from_session, requires_response, network_id)
+           VALUES (?1, ?2, ?3, ?4, 'task', ?5, ?6, ?7, 'reply', ?8)`,
+          [retryInboxId, task_id, task.to_name, task.to_node_id ?? resolveNodeIdForAlias(task.to_name, effectiveNetId ?? task.network_id ?? null), task.priority, task.content, from_session, effectiveNetId ?? task.network_id ?? null]
         );
       });
       logTaskEvent(task_id, task.status, "delivered", from_session, "retry");
@@ -1437,7 +1913,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     async ({ alias, status, from_name, from_node_id, network_id: netId, limit }) => {
       const readScope = resolveReadScope(netId);
       if (readScope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: readScope.denied }) }] };
-      let sql = "SELECT task_id, from_node_id, from_name, to_node_id, to_name, priority, status, content, result, created_at, completed_at FROM tasks WHERE 1=1";
+      let sql = "SELECT task_id, from_node_id, from_name, to_node_id, to_name, priority, status, content, result, created_at, runtime_submitted_at, consumed_at, completed_at FROM tasks WHERE 1=1";
       const params: any[] = [];
       sql = addReadScope(sql, params, readScope);
       if (alias) { sql += ` AND to_name = ?${params.length + 1}`; params.push(alias); }
@@ -1482,15 +1958,19 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       let updateSql = `UPDATE tasks SET status = 'cancelled', result = ?1, completed_at = datetime('now')
          WHERE task_id = ?2 AND status IN ('created', 'delivered', 'acked', 'running')`;
       updateSql = addScope(updateSql, updateParams, effectiveNetId);
-      const result = db.run(updateSql, updateParams);
-      // Also ack the inbox entry to prevent agent from picking it up
-      if (result.changes > 0) {
-        const inboxParams: any[] = [task_id];
-        let inboxSql = "UPDATE inbox SET acked = 1 WHERE id = ?1 AND acked = 0";
-        inboxSql = addScope(inboxSql, inboxParams, effectiveNetId);
-        db.run(inboxSql, inboxParams);
-        logTaskEvent(task_id, null, "cancelled", from_session, reason || undefined);
-      }
+      const result = db.transaction(() => {
+        const updated = db.run(updateSql, updateParams);
+        // Also ack the inbox entry to prevent agent from picking it up.
+        if (updated.changes > 0) {
+          const inboxParams: any[] = [task_id];
+          let inboxSql = "UPDATE inbox SET acked = 1 WHERE COALESCE(task_id, id) = ?1 AND acked = 0";
+          inboxSql = addScope(inboxSql, inboxParams, effectiveNetId);
+          db.run(inboxSql, inboxParams);
+          syncScheduledRunForTask(task_id, effectiveNetId);
+        }
+        return updated;
+      });
+      if (result.changes > 0) logTaskEvent(task_id, null, "cancelled", from_session, reason || undefined);
       return {
         content: [{ type: "text" as const, text: JSON.stringify({ ok: result.changes > 0, task_id, cancelled: result.changes > 0 }) }],
       };
@@ -1532,7 +2012,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       db.transaction(() => {
         // Ack old inbox to prevent original agent from picking it up
         const inboxParams: any[] = [task_id];
-        let inboxSql = "UPDATE inbox SET acked = 1 WHERE id = ?1 AND acked = 0";
+        let inboxSql = "UPDATE inbox SET acked = 1 WHERE COALESCE(task_id, id) = ?1 AND acked = 0";
         inboxSql = addScope(inboxSql, inboxParams, effectiveNetId);
         db.run(inboxSql, inboxParams);
 
@@ -1542,8 +2022,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         db.run(updateSql, updateParams);
 
         const newInboxId = uuidv4();
-        db.run("INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, requires_response, network_id) VALUES (?1, ?2, ?3, 'task', ?4, ?5, ?6, 'reply', ?7)",
-          [newInboxId, reassignedAlias, newNodeId, task.priority, task.content, from_session, effectiveNetId ?? task.network_id ?? null]);
+        db.run("INSERT INTO inbox (id, task_id, session_name, node_id, type, priority, content, from_session, requires_response, network_id) VALUES (?1, ?2, ?3, ?4, 'task', ?5, ?6, ?7, 'reply', ?8)",
+          [newInboxId, task_id, reassignedAlias, newNodeId, task.priority, task.content, from_session, effectiveNetId ?? task.network_id ?? null]);
       });
       logTaskEvent(task_id, task.status, "delivered", from_session, `reassign: ${oldAlias} → ${reassignedAlias}`);
       pushEvent(reassignedAlias, { type: "new_task", inbox_count: 1, priority: task.priority, from: from_session, ...(canonical.renamed ? { renamed_from: new_alias } : {}) }, effectiveNetId ?? task.network_id ?? null);
@@ -3583,6 +4063,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 export interface UpsertNodeWithSec1GuardInput {
   node_id: string;
   callerNetworkId: string | null;
+  callerUserId?: string | null;
+  callerTokenId?: string | null;
   node_name?: string | null;
   alias?: string | null;
   runtime?: string | null;
@@ -3595,19 +4077,60 @@ export interface UpsertNodeWithSec1GuardInput {
 }
 export type UpsertNodeOutcome =
   | { result: "inserted" | "updated"; node_id: string }
-  | { result: "refused"; reason: "cross_network"; existingNet: string | null; callerNet: string | null }
+  | { result: "refused"; reason: "cross_network" | "token_node_mismatch" | "owner_mismatch"; existingNet: string | null; callerNet: string | null }
   | { result: "skipped"; reason: "missing_node_id" };
 
 const _norm = (x: string | null | undefined) => (x === null || x === undefined ? "default" : x);
 
+/**
+ * A capability that changes peer delivery semantics is trusted only when the
+ * authenticating ntok is immutably bound to the exact reported node. Legacy
+ * alias-only tokens may still heartbeat, but cannot opt a node into #698.
+ */
+export function trustedConfigSnapshotForNode(
+  snapshot: unknown | null | undefined,
+  callerTokenId: string | null | undefined,
+  nodeId: string,
+): unknown | null | undefined {
+  if (!snapshot || typeof snapshot !== "object") return snapshot;
+  const copy = { ...(snapshot as Record<string, unknown>) };
+  const token = callerTokenId
+    ? db.get<{ bound_node_id: string | null }>(
+      "SELECT bound_node_id FROM api_tokens WHERE token_id = ?1",
+      callerTokenId,
+    )
+    : null;
+  if (token?.bound_node_id !== nodeId) delete copy.peer_reply_inbox_capable;
+  return copy;
+}
+
 export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): UpsertNodeOutcome {
   if (!input.node_id) return { result: "skipped", reason: "missing_node_id" };
-  const existing = db.get<{ network_id: string | null }>(
-    "SELECT network_id FROM nodes WHERE node_id = ?1",
+  const existing = db.get<{ network_id: string | null; owner_user_id: string | null }>(
+    "SELECT network_id, owner_user_id FROM nodes WHERE node_id = ?1",
     input.node_id,
   );
   const callerNet = input.callerNetworkId;
 
+  // RFC-036 — when a token was minted with a node_id binding, a heartbeat may
+  // report only that exact node. Legacy unbound ntok rows remain compatible,
+  // but they can never consume owner-gated schedule intents.
+  if (input.callerTokenId) {
+    const token = db.get<{ bound_node_id: string | null; user_id: string; network_id: string | null }>(
+      "SELECT bound_node_id, user_id, network_id FROM api_tokens WHERE token_id = ?1",
+      input.callerTokenId,
+    );
+    if (token?.bound_node_id && token.bound_node_id !== input.node_id) {
+      return { result: "refused", reason: "token_node_mismatch", existingNet: existing?.network_id ?? null, callerNet };
+    }
+    if (token?.network_id && _norm(token.network_id) !== _norm(callerNet)) {
+      return { result: "refused", reason: "cross_network", existingNet: existing?.network_id ?? null, callerNet };
+    }
+  }
+  if (existing?.owner_user_id && input.callerUserId !== existing.owner_user_id) {
+    return { result: "refused", reason: "owner_mismatch", existingNet: existing.network_id, callerNet };
+  }
+
   // Legacy / first-write paths: row missing OR network_id NULL → claim.
   const isLegacy = !existing
     || existing.network_id === null
@@ -3653,7 +4176,12 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
       callerNet ?? null,
     ],
   );
-  if (input.config_snapshot) {
+  const trustedSnapshot = trustedConfigSnapshotForNode(
+    input.config_snapshot,
+    input.callerTokenId,
+    input.node_id,
+  );
+  if (trustedSnapshot) {
     // RFC-026 §9.3 / #338 PR2+PR3 — promote daemon self-declare fields
     // to first-class indexable columns alongside the snapshot blob.
     // The snapshot stays the source of truth for non-list reads; the
@@ -3667,7 +4195,7 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
     // tools.ts:2010/2075). PR2 ate from top-level keys, which the
     // hub create_node path never read → max_concurrent_children
     // backpressure was dead config + allowlist enforcement bypassed.
-    const snap = input.config_snapshot as Record<string, unknown> | null;
+    const snap = trustedSnapshot as Record<string, unknown> | null;
     const caps = (snap?.daemon_capabilities ?? null) as Record<string, unknown> | null;
     const runtimesRaw = caps?.runtimes_supported;
     const allowedRaw = caps?.allowed_secret_keys;
@@ -3679,7 +4207,7 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
       : null;
     db.run(
       `UPDATE nodes SET config_snapshot = ?1, runtimes_supported = ?2, allowed_secret_keys = ?3 WHERE node_id = ?4`,
-      [JSON.stringify(input.config_snapshot), runtimesJson, allowedJson, input.node_id],
+      [JSON.stringify(trustedSnapshot), runtimesJson, allowedJson, input.node_id],
     );
     // RFC-024 — finalize any pending/restarting update whose target
     // patch is now reflected in the snapshot. Closes the
@@ -3689,7 +4217,7 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
     // update_id to call ack_config_update(applied) itself. Hub does
     // it on the new child's behalf by content-matching the patch
     // against the reported snapshot.
-    finalizePendingMatchingUpdates(input.node_id, input.config_snapshot);
+    finalizePendingMatchingUpdates(input.node_id, trustedSnapshot);
   }
   // RFC-026 §2.5 step 4 — on every register/report_status, opportunistically
   // close out any pending create_node request whose child_name matches