@staix/agent-hub 0.22.0 → 0.23.0

package/src/hub/daemon.ts

@@ -1,8 +1,9 @@
 import { RoomStoreError } from "../rooms/store.ts";
 import { RoomCommands, type RoomPreview } from "../rooms/commands.ts";
 import { queueBackpressurePolicy, type QueueBackpressurePolicy } from "./queue-backpressure.ts";
-import { RoomChat } from "../rooms/service.ts";
-import { parseRemotePeerId } from "../rooms/application.ts";
+import { RoomChat, type RoomInvocationIngress } from "../rooms/service.ts";
+import { RoomInvocations, roomInvocationHash } from "./room-invocations.ts";
+import { parseRemotePeerId, roomInvocationArgs, encodeRoomInvocationBody, type RoomReadInvocationRequest } from "../rooms/application.ts";
 import { assertNativeProofPorts } from "../adapters/native-proof-ports.ts";
 import { externalInstanceCatalog } from "../adapters/external-metadata.ts";
 import { externalInstanceBinding, sameExternalInstanceBinding, externalInstanceStateDir, readExternalInstanceRecord, writeExternalInstanceRecord, type ExternalInstanceBinding } from "./external-instance.ts";
@@ -81,6 +82,9 @@ import { childEnv } from "./child-process.ts";
 import { runCheck } from "./checks.ts";
 import { DEFAULT_TASK_SWEEP, taskSweepConfig, type TaskSweepConfig } from "./task-sweep.ts";
 import { CONTRADICTION_WINDOW_SETTING, DEMOTE_AT_SETTING, DEMOTION_HALF_LIFE_SETTING, GROOM_FYI_WINDOW_SETTING, RESCREEN_MAX_SETTING, SPLIT_FAILURE_SHARE_SETTING, SPLIT_MIN_SETTING, taskOperationalReaders } from "./operational-settings.ts";
+import { CONSOLE_POLL_SETTING, CONSOLE_NOTICE_SETTING, CONSOLE_HISTORY_SETTING, CONSOLE_PENDING_STREAM_SETTING, CONSOLE_ATTENTION_SETTING, type ConsoleOperationalConfig } from "./operational-settings.ts";
+import { MODEL_COOLDOWN_FAILURES_SETTING, MODEL_COOLDOWN_SETTING, MODEL_COOLDOWN_CAP_SETTING, MODEL_TERMINAL_HISTORY_SETTING, modelOperationalReaders, type ModelOperationalConfig } from "./operational-settings.ts";
+import { ACP_TOOL_CEILING_SETTING, ACP_ACTIVITY_BATCH_SETTING, JCODE_STEER_TIMEOUT_SETTING, adapterOperationalReaders, type AdapterTimingConfig } from "./operational-settings.ts";
 import { BUS_DIGEST_MAX_SETTING, BUS_MAX_ATTEMPTS_SETTING, BUS_NOTES_KEPT_SETTING, BUS_PULL_BUDGET_BYTES_SETTING, BUS_TERMINAL_HISTORY_LIMIT_SETTING, busOperationalReaders, RECOVERY_CONTROL_TIMEOUT_SETTING, RECOVERY_RECONNECT_WAIT_SETTING, RECOVERY_SHUTDOWN_WAIT_SETTING, RECOVERY_TERMINAL_IDLE_WAIT_SETTING, RECOVERY_UNMANAGED_RECONNECT_WAIT_SETTING } from "./operational-settings.ts";
 import { foldersConfig, scheduleViews, schedulesConfig, ScheduleStore, type FolderEntry, type ScheduleEntry } from "./schedules.ts";
 import { FolderStore, registerScanned, scanFolder, type FolderPolicy } from "./folder-trigger.ts";
@@ -139,7 +143,7 @@ import { Briefs, type BriefTask } from "../memory/brief.ts";
 import { Board, isClosedTaskState, taskProposalAt, taskHasStarted, CLASSES, type Task, type TaskClass } from "./board.ts";
 import { UsageRollup, USAGE_GROUPS, LIMITS_MAX, type UsageGroup } from "./usage-rollup.ts";
 import { Budget, readNativeQuota, DEFAULT_BUDGET, type BudgetConfig } from "./budget.ts";
-import { HUB } from "./envelope.ts";
+import { remoteEnvelope, HUB } from "./envelope.ts";
 import { recallMemoryLines, trimToTokens } from "../memory/recall.ts";
 import { closeSync, constants as fsConstants, openSync, lstatSync, readSync, statSync } from "node:fs";
 import { basename, isAbsolute } from "node:path";
@@ -147,7 +151,9 @@ import { fileURLToPath } from "node:url";
 import { realPath, hubHome } from "./project.ts";
 import { mainCheckoutBranch, mainCheckoutWarning } from "./main-checkout.ts";
 import type { BusEvent, PublishResult } from "./bus.ts";
-import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, IMPLEMENTER_HUB_TOOL_NAMES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS, BOUNDED_TASK_TOOLS, profileTaskTools } from "./hub-tools.ts";
+import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, IMPLEMENTER_HUB_TOOL_NAMES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS, BOUNDED_TASK_TOOLS, CAPABILITY_TOOLS, profileTaskTools } from "./hub-tools.ts";
+import { effectiveClass, listedCapabilities, PublishRefusal, readShare, shareView, validatePublished, type CapabilityManifest } from "./capabilities.ts";
+import { invocationApproval, checkArgs, DEFAULT_TIMEOUT_S, InvocationLedger, invocationRefusal, refusedBy, renderInvocationResult, requestText, type InvocationOutcome, type InvocationRow } from "./invocations.ts";
 import { Conductor, ConductorHolds, conductorPeer, requireConductor, conductorProgressSink, publicConductorTask, publicPeerBudget, taskShowAllowed, type ConductEvent } from "./conductor.ts";
 import { SupervisionFeed } from "./supervision.ts";
 import { drainCliAudits } from "../cli/identity-audit.ts";
@@ -223,6 +229,12 @@ export interface HubConfig {
   queue_cap: number;
   /** #489 H3: accepted delivery policy, read at the next delivery operation without rewriting queued work. */
   bus?: { max_attempts?: number; digest_max?: number; pull_budget_bytes?: number; notes_kept?: number; terminal_history_limit?: number };
+  /** #489 H5: accepted timing captured only when a new native adapter is constructed. */
+  adapter_timing?: AdapterTimingConfig["adapter_timing"];
+  /** #489 H6: relay policy is captured from restart-bound accepted configuration. */
+  model_relay?: ModelOperationalConfig["model_relay"];
+  /** #489 H7: accepted presentation preferences read by a new console through settings_get. */
+  console?: ConsoleOperationalConfig["console"];
   /** `native` (#258): the hub's own store in ~/.agenthub/memory, on with any project config; `short_ttl_days`: short-term lifetime after approval; `sync_interval_min`: machine sync while a remote is set (default 10, 0 off). */
   memory: { enabled: boolean; worker_url?: string; inject_tokens: number; brief_items: number; native?: boolean; short_ttl_days?: number; sync_interval_min?: number; suggest_edges?: boolean };
   roster: PeerRoster;
@@ -277,6 +289,8 @@ export interface HubConfig {
   recovery: { auto_resume_after_crash: boolean; reconnect_wait_s?: number; unmanaged_reconnect_wait_s?: number; control_timeout_s?: number; shutdown_wait_s?: number; terminal_idle_wait_s?: number };
   /** Per peer, the hub-tool capabilities it has (issue #39); a peer not listed has all of them. */
   capabilities: Record<string, string[]>;
+  /** #445 C1: machine-local invocation settings. `share` is the person's allowlist of native capabilities by peer id, each pinned by digest (`src/hub/capabilities.ts`). */
+  invocation?: { share?: Record<string, Record<string, { digest: string; class?: string }>>; /** Seconds a request may wait for its result, 10 to 86400, default 600 (#445 C2). */ timeout_s?: number };
   /**
    * How owners of overlapping tasks coordinate (issue #107): "advisory" lets them message each other; "turn-free" has
    * them work without messages while the hub derives what they need to know. Anything else is advisory.
@@ -303,12 +317,15 @@ export const DEFAULT_CONFIG: HubConfig = {
   batch_ms: 15_000,
   queue_cap: 200,
   bus: { max_attempts: BUS_MAX_ATTEMPTS_SETTING.defaultValue, digest_max: BUS_DIGEST_MAX_SETTING.defaultValue, pull_budget_bytes: BUS_PULL_BUDGET_BYTES_SETTING.defaultValue, notes_kept: BUS_NOTES_KEPT_SETTING.defaultValue, terminal_history_limit: BUS_TERMINAL_HISTORY_LIMIT_SETTING.defaultValue },
+  adapter_timing: { acp_tool_ceiling_min: ACP_TOOL_CEILING_SETTING.defaultValue, acp_activity_batch_ms: ACP_ACTIVITY_BATCH_SETTING.defaultValue, jcode_steer_timeout_s: JCODE_STEER_TIMEOUT_SETTING.defaultValue },
   memory: { enabled: true, inject_tokens: 2000, brief_items: 8 },
   roster: {},
   roles: DEFAULT_ROLES,
   conductor: { feed: "own", approval_wait_s: 30 },
   budget: DEFAULT_BUDGET,
   context: DEFAULT_CONTEXT,
+  model_relay: { cooldown_failures: MODEL_COOLDOWN_FAILURES_SETTING.defaultValue, cooldown_s: MODEL_COOLDOWN_SETTING.defaultValue, cooldown_cap_s: MODEL_COOLDOWN_CAP_SETTING.defaultValue, terminal_history_limit: MODEL_TERMINAL_HISTORY_SETTING.defaultValue },
+  console: { poll_ms: CONSOLE_POLL_SETTING.defaultValue, notice_ms: CONSOLE_NOTICE_SETTING.defaultValue, history_limit: CONSOLE_HISTORY_SETTING.defaultValue, pending_stream_limit: CONSOLE_PENDING_STREAM_SETTING.defaultValue, attention_limit: CONSOLE_ATTENTION_SETTING.defaultValue },
   inference: DEFAULT_INFERENCE,
   omniroute: DEFAULT_OMNIROUTE,
   ...nativeDefaults.rpc,
@@ -338,14 +355,14 @@ export const DEFAULT_CONFIG: HubConfig = {
 export { stateDirFor };
 
 /** Ids an external process may not claim: the console user and the adapters the daemon runs itself. */
-const READ_ONLY_HUB_TOOLS = new Set(["hub_inbox", "hub_send", "hub_delivery_done", "hub_review", "hub_task_show", "hub_task_list", "hub_memory_search", "hub_memory_show", "hub_memory_graph", "hub_source_read", "hub_status"]);
+const READ_ONLY_HUB_TOOLS = new Set(["hub_capabilities", "hub_inbox", "hub_send", "hub_delivery_done", "hub_review", "hub_task_show", "hub_task_list", "hub_memory_search", "hub_memory_show", "hub_memory_graph", "hub_source_read", "hub_status"]);
 const BASE_RESERVED_IDS = new Set<string>([USER, ...SUPPORTED_PEERS.filter(peer => definitionOf(peer)?.attach?.externalHello !== true), HUB, DIGEST]);
 const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
 /** The shared project config, then the machine's own file, which overrides it block by block (issue #17). */
 const CONFIG_FILES = INSTANCE_CONFIG_FILES;
 export interface ConfigLayer { name: typeof CONFIG_FILES[number]; raw: Record<string, any> }
-const CONFIG_BLOCKS = ["action_policy", "memory", "roster", "roles", "catalog_roles", "pii", "data", "conductor", "budget", "context", "inference", "omniroute", ...NATIVE_CONFIG_BLOCKS, "approvals", "tasks", "task_sweep", "bus", "corpus", "checks", "snapshots", "research", "bench", "limits", "review", "recovery", "capabilities", "mlx", "permission_modes", "peers", "terminal", "pet"];
+const CONFIG_BLOCKS = ["action_policy", "memory", "roster", "roles", "catalog_roles", "pii", "data", "conductor", "budget", "context", "inference", "omniroute", ...NATIVE_CONFIG_BLOCKS, "approvals", "tasks", "task_sweep", "bus", "adapter_timing", "model_relay", "console", "corpus", "checks", "snapshots", "research", "bench", "limits", "review", "recovery", "capabilities", "mlx", "permission_modes", "peers", "terminal", "pet"];
 
 /** Connection-time policy refresh reads role/feed fields only, never launches or machine-local configuration. */
 export function loadConductorPolicy(cwd: string, layers?: readonly ConfigLayer[], scope: Pick<ReturnType<typeof readInstanceConfig>, "instances" | "catalog"> = readInstanceConfig(cwd, layers)): { roles: Record<string, string[]>; conductor: HubConfig["conductor"]; planner?: string | string[]; notices?: string[] } {
@@ -539,6 +556,9 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     },
     tasks: { ...DEFAULT_CONFIG.tasks, ...file.tasks, ...(file.tasks?.wip_limits !== undefined ? { wip_limits: planningWipLimits(file.tasks.wip_limits) } : {}) },
     bus: { ...DEFAULT_CONFIG.bus, ...file.bus },
+    adapter_timing: { ...DEFAULT_CONFIG.adapter_timing, ...file.adapter_timing },
+    model_relay: { ...DEFAULT_CONFIG.model_relay, ...file.model_relay },
+    console: { ...DEFAULT_CONFIG.console, ...file.console },
     task_sweep: taskSweepConfig(file.task_sweep),
     schedules: schedulesConfig(file.schedules),
     folder_triggers: foldersConfig(file.folder_triggers),
@@ -631,6 +651,8 @@ export interface DaemonOptions {
   agentDrift?: boolean | (() => Promise<readonly AgentVersionRow[]>);
   /** Test seam: the period of the agent drift sweep, default one day. */
   agentDriftEveryMs?: number;
+  /** Test seam: the period of the invocation deadline sweep (#445 C2), default 5 s. */
+  invocationSweepMs?: number;
   /** Test seam: an extra hold on the SDLC band evaluation, like a storage error. */
   bandsHeld?: () => boolean;
   /** Test seam: the schedules clock and the period of the due check (default Date.now and one minute). */
@@ -676,6 +698,8 @@ interface Client {
   watch?: () => void;
   /** The one-launch Kimi TUI admission this socket attached under; its close clears only that admission. */
   kimiAdmission?: string;
+  invocationRequests?: Map<number, AbortController>;
+  closed?: true;
 }
 type Sock = ServerWebSocket<Client>;
 
@@ -771,6 +795,7 @@ export async function startDaemon(opts: DaemonOptions) {
   const channelPeers = [...ADAPTERS.filter(definition => definition.transport === "claude-channel").map(definition => definition.kind),
     ...channelExtras.filter(id => adapterCatalog.definitionOf(id, declarations)?.transport === "claude-channel")];
   const executionRoots = new Map<string, string>();
+  const invocationRequestSignal = new AsyncLocalStorage<{ signal: AbortSignal; current: () => boolean }>();
   const childToolAuthority = new AsyncLocalStorage<{ by: string; current: () => boolean }>();
   const implementerTranscripts = new Map<string, string>();
   const executionOwners = new Map<string, { owner: PeerAdapter; cwd: string; socket?: Sock; launchId?: string; generation?: string | number }>();
@@ -1119,6 +1144,9 @@ export async function startDaemon(opts: DaemonOptions) {
         }
       },
       close(sock) {
+        sock.data.closed = true;
+        for (const request of sock.data.invocationRequests?.values() ?? []) request.abort();
+        sock.data.invocationRequests?.clear();
         nativeHookLaunches.endOwner(sock);
         consoles.delete(sock);
         operationalLogSubscribers.delete(sock);
@@ -1182,18 +1210,20 @@ export async function startDaemon(opts: DaemonOptions) {
   // The hub's own model calls (digest condensation, task triage) are wired below, once the gateway client exists.
   let inference: Inference | undefined;
   const { terminalHistoryLimit, ...busReaders } = busOperationalReaders(() => config);
+  const adapterTiming = adapterOperationalReaders(() => config);
+  const modelTiming = modelOperationalReaders(() => config);
   const journal = new DeliveryJournal({ file: join(opts.stateDir, "hub.db"), projectRoot: opts.cwd, projectId, instanceId, operationId: recoveryOperation, terminalHistoryLimit });
   // What the crash left in flight, per recipient: opening the journal just marked these needs_review.
   const lost = new Map<PeerId, JournalDelivery[]>();
   if (crashed) for (const d of journal.list()) if (d.state === "needs_review" && d.reason === "daemon stopped during delivery" && d.updatedAt >= startedAt) lost.set(d.peer, [...(lost.get(d.peer) ?? []), d]);
   // Capabilities (issue #39): enforced here and in taskOp, never by role text alone. Unlisted peers keep everything.
   // A listed peer whose value is not a list gets nothing: whoever listed it meant to narrow it.
-  const may = (peer: PeerId, cap: "propose" | "assign" | "remember" | "memory_correct" | "memory_read" | "important" | "spec_read" | "check_run"): boolean => {
+  const may = (peer: PeerId, cap: "propose" | "assign" | "remember" | "memory_correct" | "memory_read" | "important" | "spec_read" | "check_run" | "invoke"): boolean => {
     if (peer === USER || peer === HUB || !Object.hasOwn(config.capabilities, peer)) return true;
     const list = config.capabilities[peer];
     return Array.isArray(list) && list.includes(cap);
   };
-  const CAPABILITIES = ["propose", "assign", "remember", "memory_correct", "memory_read", "important", "spec_read", "check_run"];
+  const CAPABILITIES = ["propose", "assign", "remember", "memory_correct", "memory_read", "important", "spec_read", "check_run", "invoke"];
   for (const [peer, list] of Object.entries(config.capabilities)) {
     if (!PEER_ID.test(peer)) log(`capabilities.${peer} is not a peer id; ignored (capabilities is an object of lists, one per peer)`);
     else if (!Array.isArray(list)) log(`capabilities.${peer} is not a list: ${peer} gets no capabilities`);
@@ -1310,7 +1340,8 @@ export async function startDaemon(opts: DaemonOptions) {
         if (typeof task !== "string" || !/^[1-9][0-9]*$/.test(task) || !Number.isSafeInteger(Number(task))) return true;
         const row = board.get(Number(task)); if (!row || tasks.isPii(row)) return true;
       }
-      return env.from === USER ? false : !bus.peers.has(env.from) || !!turns.get(env.from)?.private || contextPii(env.from);
+      const sender = env.from === HUB ? roomInvocations.localActor(env) ?? HUB : env.from;
+      return sender === USER ? false : !bus.peers.has(sender) || !!turns.get(sender)?.private || contextPii(sender);
     },
     doing: (peer, kind, text) => observeDoing(peer, kind, text),
     onImportantQueued: (peer, counts) => { const p = bus.peers.get(peer); if (isWsPeer(p)) p.notifyQueued(counts); } });
@@ -1676,6 +1707,10 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const inboxPolling = new InboxPolling();
   const board = new Board(join(opts.stateDir, "hub.db"));
+  const invocations = new InvocationLedger(join(opts.stateDir, "hub.db"));
+  startupCleanup.push(() => invocations.close());
+  bus.canRetryInvocation = id => invocations.get(id)?.class === "read" && !invocations.relay(id);
+  bus.onInvocationUncertain = id => { const row = invocations.get(id); if (row && (row.class !== "read" || invocations.relay(id))) finishInvocation(row, "needs_review", { reason: "delivery outcome is uncertain; check it by hand" }); };
   const codeFacts = new CodeFacts();
   const reviewSymbols = new Map<string, CodeFactResult<CodeSymbol[]>>();
   const memorySymbols = new Map<string, MemorySymbolNodes>();
@@ -1745,6 +1780,105 @@ export async function startDaemon(opts: DaemonOptions) {
     if (hasGeneration && native === undefined) return undefined;
     return `${instanceId}:${token}:${String(native ?? "")}`;
   };
+  /**
+   * #445 C1: what a session published about itself, bound to the connection that published it. A reconnect, a restart or going offline drops it, so a list never
+   * outlives the session it described. A peer the hub reads natively (ACP, Codex) never publishes: its own source is the only one.
+   */
+  const publishedCaps = new Map<PeerId, { generation: string; manifest: CapabilityManifest }>();
+  const manifestOf = async (id: PeerId): Promise<CapabilityManifest | undefined> => {
+    const peer = bus.peers.get(id);
+    if (!peer || peer.state === "offline") return undefined;
+    if (peer.capabilityManifest) { try { return await peer.capabilityManifest(); } catch { return undefined; } } // an unanswered native list is no list, never a stale one
+    const held = publishedCaps.get(id);
+    return held && held.generation === connectionGeneration(id) ? held.manifest : undefined;
+  };
+  /**
+   * #445 C2: the one place an invocation ends. It settles the row once (a late answer after a timeout changes nothing), writes the ids-only event, and, when
+   * the caller is still attached, publishes ONE result from the hub to the caller only. The callee's text is sanitized and cut inside renderInvocationResult;
+   * it is never logged, never put in an event and never captured to memory.
+   */
+  const finishInvocation = (row: InvocationRow, outcome: InvocationOutcome, input: { body?: string; reason?: string; quarantine?: true } = {}): void => {
+    const rendered = renderInvocationResult({ target: row.target, capabilityId: row.capability, id: row.id, outcome, ...input });
+    const settled = invocations.settle(row.id, outcome, rendered.bytes);
+    if (!settled) return;
+    if (settled.task !== null) { try { tasks.recordInvocation(settled.task, settled); } catch { log(`invocation ${settled.id}: terminal audit unavailable; ledger retains outcome`); } }
+    if (invocations.relay(settled.id)?.direction === "outbound") invocations.updateRelay(settled.id, outcome === "needs_review" ? "needs_review" : "completed");
+    const relayed = !input.quarantine && roomInvocations.result(settled, outcome, input);
+    bus.releaseInvocation(settled.id);
+    event({ type: "invocation", id: settled.id, caller: settled.caller, target: settled.target, capability: settled.capability, class: settled.class, outcome, ...(settled.task === null ? {} : { task: settled.task }), ...(rendered.bytes ? { bytes: rendered.bytes } : {}) });
+    if (relayed || input.quarantine) return;
+    if (!bus.peers.has(settled.caller) || bus.peers.get(settled.caller)!.state === "offline") return; // nobody to read it; the row is the record
+    try { bus.publish(newEnvelope(HUB, rendered.body, { to: [settled.caller], kind: "invocation_result", priority: "status", refs: { invocation: settled.id, ...(invocations.relay(settled.id) ? { invocationRemote: true as const } : {}), ...(settled.task === null ? {} : { task: String(settled.task) }) }, ...(turns.get(settled.caller)?.private || contextPii(settled.caller) ? { private: true } : {}) })); }
+    catch { log(`invocation ${settled.id.slice(0, 8)}: the result could not be published to ${settled.caller}; the row keeps the outcome`); }
+  };
+  /** A request that was never handed over (withdrawn from the queue, or its delivery was refused) must leave no effect behind. */
+  const withdrawInvocation = (row: InvocationRow, outcome: InvocationOutcome, reason: string): void => {
+    bus.withdraw(row.id);
+    finishInvocation(row, outcome, { reason });
+  };
+  /**
+   * Whether this envelope is part of an invocation, and the settle step when it is the callee's answer: an envelope addressed to the hub whose parent is a
+   * request still open for that sender (the trace is the request's, hop + 1). Anything else returns false and flows on as before.
+   */
+  const handleInvocationEnvelope = (env: Envelope): boolean => {
+    if (env.kind === "invocation" || env.kind === "invocation_result") {
+      event({ type: "envelope", id: env.id, from: env.from, ...(env.to ? { to: env.to } : {}), priority: env.priority, hop: env.hop, kind: env.kind, ...(env.refs?.task ? { task: env.refs.task } : {}) });
+      return true;
+    }
+    return false;
+  };
+  /**
+   * #445 C2: a callee's answer, taken over BEFORE the bus builds anything from it (`Bus.onAnswer`). It is found by what the peer was handed, never by how the
+   * answer is addressed, so an agent whose final answer is normally shared with every peer cannot leak it. Nothing here publishes, logs, cites or stores the text:
+   * it goes to the screens below and then, if it passes, into the one result for the caller. Returns true whenever the answer belongs to an invocation, even a
+   * settled one (a late answer after a timeout is dropped, not broadcast).
+   */
+  bus.onAnswer = (peer, text, handed) => {
+    const request = handed.find(e => e.kind === "invocation" && e.from === HUB && e.refs?.invocation === e.id);
+    if (!request) return false;
+    const row = invocations.get(request.id);
+    if (!row || row.target !== peer) return true; // not ours to settle, and never a broadcast
+    if (row.outcome !== "queued" && row.outcome !== "delivered") return true;
+    void settleAnswer(row, text);
+    return true;
+  };
+  const settleAnswer = async (row: InvocationRow, text: string): Promise<void> => {
+    let refused: string | undefined;
+    const withhold = () => finishInvocation(row, refused === undefined ? "withheld" : "refused", refused === undefined ? {} : { reason: `${row.target} declined; the reason was withheld` });
+    try {
+      refused = refusedBy(text); // Classify only; no callee-authored reason is forwarded until the complete answer clears every screen.
+      // The callee's turn may have turned private while it worked, and its words may carry PII: withhold all its text while preserving an explicit refusal outcome.
+      const privateNow = () => !!turns.get(row.target)?.private || contextPii(row.target) || (row.task !== null && (() => { const t = board.get(row.task!); return !!t && tasks.isPii(t); })());
+      let clear = !privateNow() && boundedSafe(text); // boundedSafe is the PII-pattern, secret and private-path screen the bounded tools use
+      if (clear && tasks.screenOn()) {
+        const verdict = await (opts.piiScreen ?? ((value: string) => screenPii(value, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })))(text.slice(0, 20_000)).catch(() => undefined);
+        clear = verdict?.label === "clear" && !privateNow() && boundedSafe(text); // unknown is PII; recheck current privacy after the await
+      }
+      if (!clear) return void withhold();
+      if (refused !== undefined) return void finishInvocation(row, "refused", { reason: `${row.target} declined: ${refused}` });
+      finishInvocation(row, "completed", { body: text });
+    } catch { withhold(); } // A failure to decide never releases callee text, including a refusal reason.
+  };
+  /** A target that is paused by the person, the conductor or the budget, or whose quota window is exhausted, is refused at call time (D5, quota). A pause that starts later leaves a queued request queued under its deadline. */
+  const invocationPaused = (target: PeerId): boolean => bus.isPaused(target) || manualPaused.has(target) || conductorHolds.has(target) || !!budget.record(definitionOf(target)?.budget?.account ?? target);
+  const invocationTimeoutMs = () => (typeof config.invocation?.timeout_s === "number" && config.invocation.timeout_s >= 10 ? config.invocation.timeout_s : DEFAULT_TIMEOUT_S) * 1000;
+  /** The deadline pass: a request still queued is withdrawn (`expired`, no effect); one delivered with no result is a `timeout` (reads only in C2). */
+  const sweepInvocations = (): void => {
+    for (const row of invocations.pending()) if ((row.class !== "read" || !!invocations.relay(row.id)) && bus.invocationUncertain(row.id)) {
+      bus.holdInvocation(row.id, "restored invocation delivery outcome is uncertain", row.target);
+      finishInvocation(row, "needs_review", { reason: "delivery outcome is uncertain; check it by hand" });
+    }
+    for (const row of invocations.due()) {
+      // A row is `queued` until the adapter reports it accepted, which an ACP agent does only at its first activity: a request already handed to the target (it left the queue, and a
+      // delivery that failed safely puts it back) may be running, so it times out like a delivered one. Only a request still waiting, or not yet handed over, expires with no effect.
+      const handedOver = row.outcome === "queued" && !bus.queueIds(row.target).includes(row.id);
+      if (row.outcome === "queued" && !handedOver) withdrawInvocation(row, "expired", "the target did not receive it before the deadline; nothing ran");
+      else {
+        if (row.class !== "read" || invocations.relay(row.id)) bus.holdInvocation(row.id, "invocation result deadline passed; outcome is uncertain", row.target);
+        finishInvocation(row, row.class === "read" && !invocations.relay(row.id) ? "timeout" : "needs_review", { reason: row.class === "read" && !invocations.relay(row.id) ? "the target received it but gave no result before the deadline; it may still run" : "the target received it but gave no result before the deadline; check it by hand" });
+      }
+    }
+  };
   const currentCheck = (receipt: { task: number; owner: string; updated: number | string; generation: number | string; revision?: number }) => {
     const task = board.get(receipt.task);
     return !!task && task.owner === receipt.owner && task.state === "in_progress" && task.updated === receipt.updated && task.history.length === receipt.revision
@@ -2481,6 +2615,7 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   bus.onDelivered = (peer, originals) => {
     if (peer.includes("@")) return;
+    for (const env of originals) if (env.kind === "invocation" && env.from === HUB && env.refs?.invocation === env.id) invocations.markDelivered(env.id); // #445 C2: the target accepted the request
     pendingDeliveryTask.delete(peer);
     if (!originals.some(env => env.from === HUB && env.refs?.supervision) || supervisionTurns.has(peer)) return;
     const turn = turns.get(peer);
@@ -2511,9 +2646,9 @@ export async function startDaemon(opts: DaemonOptions) {
     if (row && tasks.isPii(row)) return;
     return { ...(row ? { task: taskKey(memoryProject, row) } : {}), turn: turns.get(peer)?.id ?? null, session: contextSession(peer) ?? null };
   }) : undefined;
-  bus.onMemoryDelivery = (peer, id, out, field) => { if (!peer.includes("@") && !out.some(env => env.from.includes("@") || env.to?.some(id => id.includes("@")) || env.refs?.boundedCheck)) memoryObservations?.delivery(peer, id, out, field); };
+  bus.onMemoryDelivery = (peer, id, out, field) => { if (!peer.includes("@") && !out.some(env => remoteEnvelope(env) || env.to?.some(id => id.includes("@")) || env.refs?.boundedCheck)) memoryObservations?.delivery(peer, id, out, field); };
   const citeMemory = (peer: PeerId, text: string, id: string, envs: readonly Envelope[] = []) => {
-    if (peer.includes("@") || envs.some(env => env.from.includes("@") || env.to?.some(id => id.includes("@")))) return;
+    if (peer.includes("@") || envs.some(env => remoteEnvelope(env) || env.to?.some(id => id.includes("@")))) return;
     if (!tasks.nameable(text) || looksSecret(text) || !screenMemory([{ title: null, text }]).length) return;
     memoryObservations?.cite(peer, text, id, envs);
   };
@@ -2859,6 +2994,7 @@ export async function startDaemon(opts: DaemonOptions) {
     } catch { log("agent CLI drift sweep failed; run ahub agents"); } finally { agentDriftRunning = false; }
   };
   const intervals = [
+    setInterval(() => { try { sweepInvocations(); } catch { log("invocation deadline sweep failed; the rows keep their state"); } }, opts.invocationSweepMs ?? 5_000),
     setInterval(() => { void sweepAgentDrift(); }, opts.agentDriftEveryMs ?? 86_400_000),
     setInterval(() => {
       void refreshRunner().catch(() => {});
@@ -3086,6 +3222,138 @@ export async function startDaemon(opts: DaemonOptions) {
       && policyKey === JSON.stringify({ signals: activeRouting().signals, constraints: activeRouting().constraints, paths: config.pii?.paths ?? [], mlx: config.mlx, model: activeRouting().local.fixed_model });
   }
   const sourceRegistry = new SourceRegistry(opts.stateDir);
+  const answeringInvocation = (peer: PeerId): boolean => {
+    if (invocations.answering(peer)) return true;
+    if (!bus.hasInvocationTurn(peer)) return false;
+    const request = bus.lastDeliveredTo(peer).find(env => env.kind === "invocation" && env.refs?.invocation === env.id);
+    const row = request && invocations.get(request.id);
+    return !!row && ["queued", "delivered", "timeout", "needs_review"].includes(row.outcome);
+  };
+  async function invokeCapability(by: PeerId, a: Record<string, any>, piiTurn: boolean, requireInvoke: () => void, room?: RoomInvocationIngress & { request: RoomReadInvocationRequest }): Promise<string> {
+        const invocationRequest = invocationRequestSignal.getStore(), invocationSignal = invocationRequest?.signal;
+        if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => !["peer", "capability", "args", "task"].includes(key))) throw new PreEffectToolRefusal("hub_invoke takes peer, capability, optional args and optional task");
+        requireInvoke();
+        const remoteTarget = parseRemotePeerId(a.peer);
+        if (remoteTarget && room) throw new PreEffectToolRefusal("remote invocations cannot relay another invocation");
+        const target = remoteTarget ? a.peer as string : peerArg(a.peer, "peer");
+        if (!target) throw new PreEffectToolRefusal("peer is required");
+        if (typeof a.capability !== "string" || !/^(command|skill|mcp_tool):[A-Za-z0-9_.:-]{1,64}$/.test(a.capability)) throw new PreEffectToolRefusal("capability must be an id from hub_capabilities, like command:skill:review");
+        if (a.task !== undefined && (!Number.isSafeInteger(a.task) || (a.task as number) < 1)) throw new PreEffectToolRefusal("task must be a task id");
+        const callerPeer = bus.peers.get(by), callerGeneration = connectionGeneration(by);
+        const targetPeer = bus.peers.get(target), targetGeneration = connectionGeneration(target);
+        const remoteIdentity = remoteTarget ? roomChat.invocationIdentity(target, by) : undefined;
+        if (!room && (!callerPeer || !callerGeneration)) throw new PreEffectToolRefusal("only an attached peer invokes capabilities");
+        const boundTask = a.task === undefined ? undefined : board.get(a.task as number);
+        const taskBinding = (task: typeof boundTask) => task ? JSON.stringify([task.owner, task.reviewer, task.state, tasks.isPii(task)]) : "";
+        const initialTask = taskBinding(boundTask);
+        const initialPolicy = JSON.stringify([config.pii, config.local.deny, tasks.screenOn()]);
+        const readFacts = (view: { id: string; state: "listed" | "unshared" | "digest-changed"; class: import("./capabilities.ts").SideEffect } | undefined) => {
+          const peer = bus.peers.get(target), task = a.task === undefined ? undefined : board.get(a.task as number);
+          return {
+            caller: by, target, capabilityId: a.capability as string, unattended: !!opts.unattended,
+            piiContext: piiTurn || !!turns.get(by)?.private || contextPii(by),
+            attached: !!peer && peer.state !== "offline", onRoster: !!peer && membershipAllowed(target), paused: invocationPaused(target), held: bus.isHeld(target), pullOnly: peer?.pullOnly === true,
+            capability: view ? { id: view.id, state: view.state, class: view.class } : undefined,
+            depth: answeringInvocation(by), openByCaller: invocations.countOpenBy("caller", by), openByTarget: invocations.countOpenBy("target", target),
+            ...(a.task === undefined ? {} : { task: { id: a.task as number, ok: !!task && (task.owner === by || task.reviewer === by) && !isClosedTaskState(task.state) && task.state !== "backlog", pii: !!task && tasks.isPii(task), reason: `task #${a.task} is not open work of yours` } }),
+          };
+        };
+        const current = () => {
+          requireInvoke();
+          if (invocationSignal?.aborted || invocationRequest && !invocationRequest.current()) throw new PreEffectToolRefusal("invocation request was abandoned; nothing ran");
+          if (room && !room.current()) throw new PreEffectToolRefusal("remote invocation authority changed");
+          if (remoteTarget && (!remoteIdentity || !remoteIdentity.current())) throw new PreEffectToolRefusal("remote invocation route changed");
+          if (stopping) throw new PreEffectToolRefusal("the hub is stopping; ask again afterwards");
+          if (JSON.stringify([config.pii, config.local.deny, tasks.screenOn()]) !== initialPolicy) throw new PreEffectToolRefusal("invocation privacy policy changed while the call was checked; ask again");
+          if ((!room && (bus.peers.get(by) !== callerPeer || connectionGeneration(by) !== callerGeneration)) || bus.peers.get(target) !== targetPeer || connectionGeneration(target) !== targetGeneration || taskBinding(a.task === undefined ? undefined : board.get(a.task as number)) !== initialTask) throw new PreEffectToolRefusal("your session, the target session or task scope changed while the call was checked; ask again");
+        };
+        const lookup = async () => {
+          if (!remoteTarget) return (await manifestOf(target))?.capabilities.find(c => c.id === a.capability);
+          const pin = readShare(config.invocation?.share)[target]?.[a.capability as string];
+          return pin?.class === "read" ? { id: a.capability as string, digest: pin.digest, name: (a.capability as string).slice((a.capability as string).indexOf(":") + 1),
+            kind: (a.capability as string).split(":")[0] as "command" | "skill" | "mcp_tool", invoke: "prompt" as const, source: "manual" as const, inputSchema: undefined } : undefined;
+        };
+        const found = await lookup();
+        current();
+        const shared = (capability: Awaited<ReturnType<typeof lookup>>) => {
+          if (!capability) return undefined;
+          if (capability.source !== "manual") return shareView(target, { capabilities: [capability], observedAt: 0 }, readShare(config.invocation?.share))[0];
+          const pin = readShare(config.invocation?.share)[target]?.[capability.id];
+          return { id: capability.id, state: !pin ? "unshared" as const : pin.digest === capability.digest ? "listed" as const : "digest-changed" as const, class: pin?.class ?? "destructive" as const };
+        };
+        const view = shared(found);
+        const refusal = invocationRefusal(readFacts(view));
+        if (refusal) throw new PreEffectToolRefusal(refusal);
+        const pinnedDigest = found!.digest, pinnedClass = view!.class;
+        if (room && (pinnedClass !== "read" || pinnedDigest !== room.request.digest)) throw new PreEffectToolRefusal("target read capability pin does not match");
+        let checked: ReturnType<typeof checkArgs>;
+        try { checked = remoteTarget ? { ok: true, args: roomInvocationArgs(a.args ?? {}) } : checkArgs(found!.inputSchema, a.args, found!.invoke === "native"); }
+        catch { throw new PreEffectToolRefusal("remote invocation arguments must be bounded flat scalar values"); }
+        if (!checked.ok) throw new PreEffectToolRefusal(checked.reason);
+        const argText = Object.values(checked.args).filter((v): v is string => typeof v === "string").join("\n");
+        const revalidate = async () => {
+          current();
+          const capability = await lookup();
+          current();
+          const live = shared(capability), rejected = invocationRefusal(readFacts(live));
+          if (rejected) throw new PreEffectToolRefusal(rejected);
+          if (!capability || capability.digest !== pinnedDigest || live?.class !== pinnedClass) throw new PreEffectToolRefusal("the capability digest or class changed while the call was checked; ask again");
+          if (argText && !boundedSafe(argText)) throw new PreEffectToolRefusal("the arguments match a PII or secret pattern, so they are not sent to another peer");
+        };
+        if (argText) {
+          if (!boundedSafe(argText)) throw new PreEffectToolRefusal("the arguments match a PII or secret pattern, so they are not sent to another peer");
+          if (tasks.screenOn()) {
+            const verdict = await (opts.piiScreen ?? ((value: string) => screenPii(value, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })))(argText).catch(() => undefined);
+            if (verdict?.label !== "clear") throw new PreEffectToolRefusal("the PII screen did not clear the arguments, so they are not sent to another peer");
+          }
+        }
+        await revalidate();
+        current();
+        const finalRefusal = () => invocationRefusal(readFacts(shared(found)));
+        if (finalRefusal()) throw new PreEffectToolRefusal(finalRefusal()!);
+        let approval: string | undefined;
+        if (pinnedClass !== "read") {
+          const picked = await requestPermission({ peer: by, personOnly: true, tool: "hub_invoke", title: invocationApproval({ caller: by, target, capability: found!.id, digest: pinnedDigest, class: pinnedClass, task: a.task as number, args: checked.args }), options: [{ optionId: "allow", name: "Allow once", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }, invocationSignal);
+          await revalidate();
+          current();
+          if (finalRefusal()) throw new PreEffectToolRefusal(finalRefusal()!);
+          if (shared(found)?.class !== pinnedClass) throw new PreEffectToolRefusal("the capability class changed during approval; ask again");
+          if (picked.outcome !== "answered" || picked.optionId !== "allow" || !picked.approvalId) throw new PreEffectToolRefusal(`invocation approval ${picked.outcome === "expired" ? "expired" : "was denied or cancelled"}; nothing ran`);
+          approval = picked.approvalId;
+        }
+        // The request is sent by the hub, which no limit applies to, so the CALLER is charged: the same per-sender and per-pair limits as a message from it to the target (priority status, never important).
+        const limited = room ? undefined : admit(newEnvelope(by, `invoke ${found!.id} ${JSON.stringify(checked.args)}`, { to: [target], kind: "invocation", priority: "status" }));
+        if (limited) throw new PreEffectToolRefusal(limited);
+        if (room) {
+          const prior = invocations.relayByRemote(room.room, room.member, room.request.invocation, "inbound");
+          if (prior) {
+            if (prior.hash !== room.hash || prior.epoch !== room.epoch || prior.remotePeer !== room.remotePeer || prior.target !== target || prior.capability !== found!.id || prior.digest !== pinnedDigest) throw new PreEffectToolRefusal("remote invocation identity conflicts with its retained binding");
+            if (!room.claim()) throw new Error("room: invocation claim unavailable");
+            return JSON.stringify({ invocation: prior.local, state: "queued" });
+          }
+          if (!room.claim()) throw new Error("room: invocation claim unavailable");
+        }
+        const request = newEnvelope(HUB, "", { to: [target], kind: "invocation", priority: "status" });
+        if (room) { request.trace = room.envelope.trace; request.hop = room.envelope.hop; }
+        request.body = remoteTarget ? encodeRoomInvocationBody("invocation", { invocation: request.id, capability: found!.id, digest: pinnedDigest, class: "read", depth: 1, args: checked.args })
+          : requestText({ caller: by, capabilityId: found!.id, name: found!.name, kind: found!.kind, args: checked.args, id: request.id });
+        request.refs = { invocation: request.id, ...(room || remoteTarget ? { invocationRemote: true as const } : {}), ...(a.task === undefined ? {} : { task: String(a.task) }) };
+        const input = { id: request.id, trace: request.trace, caller: by, target, capability: found!.id, digest: found!.digest, class: pinnedClass, ...(a.task === undefined ? {} : { task: a.task as number }), args: checked.args, timeoutMs: invocationTimeoutMs(), ...(approval ? { approval } : {}) };
+        const row = room ? invocations.openRelay(input, { request: room.request.invocation, direction: "inbound", room: room.room, member: room.member, epoch: room.epoch,
+          remotePeer: room.remotePeer, caller: room.envelope.from, target, capability: found!.id, digest: pinnedDigest, hash: room.hash, hop: room.envelope.hop, state: "admitted" })
+          : remoteTarget && remoteIdentity ? invocations.openRelay(input, { request: request.id, direction: "outbound", room: remoteIdentity.room, member: remoteIdentity.member, epoch: remoteIdentity.epoch,
+            remotePeer: target, caller: by, target: remoteTarget.peer, capability: found!.id, digest: pinnedDigest,
+            hash: roomInvocationHash({ id: request.id, trace: request.trace, hop: request.hop, from: by, to: remoteTarget.peer, kind: request.kind, priority: request.priority, body: request.body, ts: request.ts }), hop: request.hop, state: "prepared" })
+          : invocations.open(input);
+        if (row.task !== null) {
+          try { tasks.recordInvocation(row.task, row); }
+          catch { invocations.settle(row.id, "refused"); throw new PreEffectToolRefusal("invocation audit unavailable; nothing ran"); }
+        }
+        event({ type: "invocation", id: row.id, caller: by, target, capability: row.capability, class: row.class, outcome: "queued", ...(row.task === null ? {} : { task: row.task }) });
+        try { bus.publish(request); }
+        catch (error) { finishInvocation(row, "refused", { reason: "the hub could not queue the request; nothing ran" }); throw new PreEffectToolRefusal(error instanceof Error ? error.message : "the request could not be queued"); }
+        return JSON.stringify({ invocation: row.id, state: "queued", note: "the result arrives later as one message from the hub, addressed to you only; do not wait for it in this turn" });
+  }
   async function taskOpBody(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
     if (BOUNDED_TASK_TOOLS.has(op)) {
       const keys = op === "hub_task_spec" ? ["id"] : op === "hub_check_start" ? ["id", "check", "files"] : ["run"];
@@ -3115,7 +3383,7 @@ export async function startDaemon(opts: DaemonOptions) {
     // console reads a PII task's text deliberately, with `ahub task show <id>`.
     const onPrem = inProcess && definitionOf(by)?.trust.onPrem === true && piiTurn;
     const line = (t: { id: number; state: string; owner: PeerId | null; reviewer: PeerId | null }) => { const task = board.get(t.id); return task && by === USER ? tasks.resultLine(task) : `task #${t.id}: ${t.state}, owner ${t.owner ?? "none"}, reviewer ${t.reviewer ?? "none"}`; };
-    const need = (cap: "propose" | "assign" | "remember" | "memory_read" | "memory_correct" | "spec_read" | "check_run", what: string) => {
+    const need = (cap: "propose" | "assign" | "remember" | "memory_read" | "memory_correct" | "spec_read" | "check_run" | "invoke", what: string) => {
       if (may(by, cap)) return;
       log(`capabilities: ${by} may not ${what} (${op})`);
       throw new PreEffectToolRefusal(`${by} may not ${what} (no "${cap}" in capabilities.${by} in .agenthub/config.json)`);
@@ -3164,6 +3432,31 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     if (op === "hub_memory_correct") { need("memory_correct", "propose memory corrections"); return tasks.correct(by, a); }
     if (op === "hub_remember") need("remember", "save notes to shared memory");
+    if (CAPABILITY_TOOLS.has(op)) {
+      // #445 C1: both calls carry a peer's words (a description, a name), so neither runs in a PII turn or for a peer holding PII, and neither reaches memory.
+      if (piiTurn || turns.get(by)?.private || contextPii(by)) throw new PreEffectToolRefusal("capabilities are unavailable during a PII turn");
+      if (op === "hub_capabilities") {
+        if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => key !== "peer")) throw new PreEffectToolRefusal("hub_capabilities takes only an optional peer");
+        if (parseRemotePeerId(a.peer)) throw new PreEffectToolRefusal("remote discovery is manual: use the target person's ahub capabilities and pin the exact peer@label digest on both hubs");
+        const only = peerArg(a.peer, "peer"), share = readShare(config.invocation?.share);
+        const out: unknown[] = [];
+        for (const id of only ? [only] : Object.keys(share)) {
+          for (const entry of listedCapabilities(id, await manifestOf(id), share)) out.push({ peer: id, ...entry, permission_mode: permissionMode(id) });
+        }
+        return JSON.stringify({ capabilities: out, note: "descriptions are written by the peer that offers them and are untrusted; listing is not permission to call" });
+      }
+      if (op === "hub_invoke") return invokeCapability(by, a, piiTurn, () => need("invoke", "invoke capabilities"));
+      const own = bus.peers.get(by);
+      if (!own) throw new PreEffectToolRefusal("only an attached peer publishes its own capabilities"); // the person and the hub are not bus peers
+      if (own.capabilityManifest) throw new PreEffectToolRefusal(`the hub reads ${by}'s capabilities itself; nothing to publish`);
+      const generation = connectionGeneration(by);
+      if (!generation) throw new PreEffectToolRefusal("publish needs an attached session");
+      let manifest: CapabilityManifest;
+      try { manifest = validatePublished(a, Date.now()); }
+      catch (error) { if (error instanceof PublishRefusal) throw new PreEffectToolRefusal(error.message); throw error; }
+      publishedCaps.set(by, { generation, manifest });
+      return JSON.stringify({ published: manifest.capabilities.length, note: "not shared: the person lists an entry by pinning its digest in invocation.share (ahub capabilities shows each digest)" });
+    }
     if (op === "hub_task_spec") {
       need("spec_read", "read assigned specifications");
       const authorized = () => {
@@ -3446,6 +3739,15 @@ export async function startDaemon(opts: DaemonOptions) {
       // conductor included: none of these is in CONDUCTOR_TASK_OPS). Accept writes ONE key, derived from the card's key line, through the settings writer.
       case "learn_list":
         return JSON.stringify(tasks.learnCandidates(by, { all: a.all === true }));
+      // #445 C1: the person's view of every peer's capabilities, shared or not. Person only (not in CONDUCTOR_TASK_OPS); it shows what a peer offers, never calls it.
+      case "capabilities_list": {
+        const share = readShare(config.invocation?.share), peers: unknown[] = [];
+        for (const id of [...bus.peers.keys()].sort()) {
+          const manifest = await manifestOf(id);
+          if (manifest?.capabilities.length) peers.push({ peer: id, observedAt: manifest.observedAt, permission_mode: permissionMode(id), entries: shareView(id, manifest, share) });
+        }
+        return JSON.stringify({ peers });
+      }
       case "learn_reject":
         return JSON.stringify(tasks.publicView(await tasks.learnClose(by, a.id, "rejected")));
       case "learn_accept": {
@@ -3616,7 +3918,20 @@ export async function startDaemon(opts: DaemonOptions) {
   const nativeUnattended = (peer: string): boolean => startingUnattended.get(peer) ?? unattendedPeers.has(peer);
   const permissions = new Map<string, { push: string; peer: string; tool?: string; createdAt: number; expiresAt: number; done: (optionId: string | undefined, surface?: "console" | "dashboard" | "terminal", reason?: "expired" | "cancelled") => boolean }>();
   let stopping = false;
-  const roomChat = new RoomChat({ bus, cwd: opts.cwd, routing: activeRouting, piiPaths: () => config.pii?.paths ?? [],
+  const roomInvocations: RoomInvocations = new RoomInvocations({ bus, ledger: invocations, shares: () => readShare(config.invocation?.share), identity: (peer, sender) => roomChat.invocationIdentity(peer, sender),
+    target: async (input, request) => { await invokeCapability(input.remotePeer, { peer: input.envelope.to, capability: request.capability, args: request.args }, false, () => { if (!input.current()) throw new PreEffectToolRefusal("remote invocation authority changed"); }, { ...input, request }); },
+    safeResult: async (body, current) => {
+      const policy = JSON.stringify([config.pii, config.local.deny, tasks.screenOn()]);
+      if (!current() || !boundedSafe(body)) return false;
+      if (body && tasks.screenOn()) {
+        const verdict = await (opts.piiScreen ?? ((text: string) => screenPii(text, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })))(body).catch(() => undefined);
+        if (verdict?.label !== "clear") return false;
+      }
+      return current() && boundedSafe(body) && policy === JSON.stringify([config.pii, config.local.deny, tasks.screenOn()]);
+    }, quarantine: row => finishInvocation(row, "needs_review", { reason: "remote invocation handoff is unconfirmed after restart", quarantine: true }), finish: finishInvocation });
+  bus.onInvocationReceipt = (id, state) => roomInvocations.receipt(id, state);
+  roomInvocations.reconcile();
+  const roomChat: RoomChat = new RoomChat({ bus, cwd: opts.cwd, routing: activeRouting, piiPaths: () => config.pii?.paths ?? [],
     senderPrivate: peer => peer === USER ? false : bus.peers.has(peer) && !peer.includes("@") ? !!turns.get(peer)?.private || contextPii(peer) : undefined,
     taskPrivate: id => { const task = board.get(id); return task ? tasks.isPii(task) : undefined; },
     modelScreenOn: () => tasks.screenOn(),
@@ -3624,6 +3939,7 @@ export async function startDaemon(opts: DaemonOptions) {
     policyVersion: () => configRevision,
     limits: () => config.limits,
     notice: value => notify(value.code === "application_capacity" ? `room ${value.room}: application capacity reached (${value.count}); resolve incoming uncertainty with ahub room resolve` : `room ${value.room}: signed frame sequence gap ${value.count} from ${value.sender}`),
+    invocationAuthorization: (env, identity) => roomInvocations.authorization(env, identity), invocation: input => roomInvocations.receive(input),
     roster: ids => { remoteRoster.clear(); for (const id of ids) remoteRoster.add(id); },
     changed: () => { if (ready && !stopping) writeStatus(); },
   });
@@ -4312,6 +4628,14 @@ export async function startDaemon(opts: DaemonOptions) {
   const detecting = new Set<Promise<void>>();
   let attachments = 0;
   bus.tap((e) => {
+    // #445 C2: the bus gave up on a request (poison retries exhausted): nothing ran, the caller is told once.
+    if (e.t === "undeliverable" && e.env.kind === "invocation" && e.env.from === HUB) {
+      const row = invocations.get(e.env.id);
+      if (row) finishInvocation(row, "failed", { reason: invocations.relay(row.id) ? "the target read request was refused safely before execution" : "the request could not be delivered to the target after retries; nothing ran" });
+      return;
+    }
+    // #445 C2: an invocation's request and result, and a callee's answer to one, are handled here and end here: no log line carries a body, no citation reaches memory.
+    if (e.t === "envelope" && handleInvocationEnvelope(e.env)) return;
     if (e.t === "envelope" && e.env.from !== HUB && e.env.from !== USER && bus.peers.has(e.env.from) && !e.env.private) citeMemory(e.env.from, e.env.body, `message:${e.env.id}`, [e.env]);
     e = redact(e);
     uiEvents.push({ seq: ++uiSequence, event: e });
@@ -4325,7 +4649,7 @@ export async function startDaemon(opts: DaemonOptions) {
       // #248: the add-ons it works with, once per attach (names and versions only).
       // A result is written unless a later attachment began meanwhile: a peer that detached before its probe settled
       // still did its work under that attachment.
-      if (e.state === "offline") { attachedNow.delete(e.peer); applyPendingPermissionDefault(e.peer); }
+      if (e.state === "offline") { attachedNow.delete(e.peer); publishedCaps.delete(e.peer); applyPendingPermissionDefault(e.peer); }
       else if (!attachedNow.has(e.peer)) {
         attachedNow.add(e.peer);
         const peer = e.peer, attachment = ++attachments;
@@ -4530,7 +4854,7 @@ export async function startDaemon(opts: DaemonOptions) {
 
   const permissionAnswerEpochs = new Map<string, number>();
   const permissionAnswerEpoch = (peer: string) => permissionAnswerEpochs.get(peer) ?? 0;
-  type PermissionResult = { outcome: "answered" | "expired" | "cancelled"; optionId?: string };
+  type PermissionResult = { outcome: "answered" | "expired" | "cancelled"; optionId?: string; approvalId?: string };
   async function onPermission(req: PermissionRequest, signal?: AbortSignal): Promise<string | undefined> {
     const external = isExternalInstance(req.peer) ? currentExecutionOwner(req.peer, true) : undefined;
     if (isExternalInstance(req.peer) && !external) return undefined;
@@ -4560,15 +4884,16 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     return !gate.denyOnly && picked.optionId === "allow";
   }
-  async function requestPermission(req: PermissionRequest, signal?: AbortSignal, observe?: ApprovalObserver, requirePerson = false, lifecycle?: { registered(id: string): void; expired(id: string): void }): Promise<PermissionResult> {
+  async function requestPermission(req: PermissionRequest & { personOnly?: boolean }, signal?: AbortSignal, observe?: ApprovalObserver, requirePerson = false, lifecycle?: { registered(id: string): void; expired(id: string): void }): Promise<PermissionResult> {
     const requestEpoch = permissionAnswerEpoch(req.peer);
     const observed = (source: "person" | "automatic" | "expired" | "aborted") => {
       try { observe?.({ source, answerEpoch: permissionAnswerEpoch(req.peer), ...(source === "expired" ? { eligibleExpiry: requestEpoch === permissionAnswerEpoch(req.peer) } : {}) }); }
       catch { try { log(`permission observer failed for ${req.peer}`); } catch { /* settlement is authoritative */ } }
     };
     if (stopping || signal?.aborted) { observed("aborted"); return { outcome: "cancelled" }; }
+    if (req.personOnly && opts.unattended) { observed("aborted"); return { outcome: "cancelled" }; }
     // Always-ask (#636): a classed call is never answered for the person, `--unattended` included; it waits for a person and expires as a denial.
-    if (opts.unattended && !req.classed && !requirePerson) { observed("automatic"); return { outcome: "answered", optionId: req.options.find((o) => o.kind === "allow_once")?.optionId }; }
+    if (opts.unattended && !req.classed && !requirePerson && !req.personOnly) { observed("automatic"); return { outcome: "answered", optionId: req.options.find((o) => o.kind === "allow_once")?.optionId }; }
     const id = randomUUID().slice(0, 8);
     // The title is written by an agent and read by the person approving it: escape sequences and carriage returns
     // could repaint the terminal line, so everything but newline and tab is made visible.
@@ -4608,7 +4933,7 @@ export async function startDaemon(opts: DaemonOptions) {
         try { event({ type: "permission", id, peer: req.peer, event: outcome, latencyMs, ...(surface ? { surface } : {}), ...(optionKind ? { option: optionKind } : {}) }); } catch { try { log(`permission event recording failed at settlement for ${req.peer}`); } catch { /* settlement remains authoritative */ } }
         try { notify(`permission ${id} from ${req.peer} ${outcome} option ${optionKind ?? "none"} by ${surface ?? "hub"} (${latencyMs}ms)`); } catch { /* no reporting failure strands the caller */ }
         for (const c of consoles) if (c.data.tail) { try { c.send(JSON.stringify({ t: "permission_closed", id, peer: req.peer, outcome: outcome === "expired" ? "cancelled" : outcome, ...(outcome === "expired" ? { reason: "expired" } : {}), latencyMs })); } catch { /* another surface can still observe the closure */ } }
-        resolve({ outcome, ...(option ? { optionId: option.optionId } : {}) });
+        resolve({ outcome, ...(option ? { optionId: option.optionId, ...(surface ? { approvalId: id } : {}) } : {}) });
         return true;
       };
       permissions.set(id, { push, done, peer: req.peer, ...(publicTool ? { tool: publicTool } : {}), createdAt, expiresAt });
@@ -5021,6 +5346,7 @@ export async function startDaemon(opts: DaemonOptions) {
         providerProfile: (args.providerProfile ?? instance?.provider_profile ?? config.jcode_provider_profile) || undefined,
         ...(instance?.provider ? { provider: instance.provider } : {}),
         ...(args.model ?? instance?.model ? { launchModel: (args.model ?? instance?.model)! } : {}), ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}), cwd: executionCwd, watchdogMs: config.watchdog_ms,
+        toolCeilingMs: adapterTiming.acpToolCeilingMs(), activityBatchMs: adapterTiming.acpActivityBatchMs(), steerTimeoutMs: adapterTiming.jcodeSteerTimeoutMs(),
         preamble: sessionRoleContract(peer), log: () => log("Jcode native diagnostic: details withheld"),
         // #801: Jcode 0.99.1's usage_update is `{ used, size }`, the live session's context occupancy: a context reading bound to the adapter's own session id, never a tokens event
         // or a quota window. An invalid shape reports a null reading (unknown, not the previous value).
@@ -5051,6 +5377,7 @@ export async function startDaemon(opts: DaemonOptions) {
         isPrivateTurn: () => !!turns.get(peer)?.private || contextPii(peer),
         actionGate: acpActionGate(peer),
         cmd, kind: adapter.kind,
+        toolCeilingMs: adapterTiming.acpToolCeilingMs(), activityBatchMs: adapterTiming.acpActivityBatchMs(),
         permissionMode: permissionMode(peer),
         ...(args.model ? { launchModel: args.model } : {}),
         ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}),
@@ -5106,6 +5433,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const externalLaunchId = externalBinding ? randomUUID() : undefined;
       if (externalLaunchId) for (const server of mcpServers) server.env.push({ name: "AGENTHUB_LAUNCH_ID", value: externalLaunchId });
       const acpOptions: AcpOptions = {
+        toolCeilingMs: adapterTiming.acpToolCeilingMs(), activityBatchMs: adapterTiming.acpActivityBatchMs(),
         onActivity: item => activityRings[peer]?.append(item),
         isPrivateTurn: () => !!turns.get(peer)?.private || contextPii(peer),
         actionGate: acpActionGate(peer),
@@ -5253,6 +5581,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const problem = mlxLaunchProblem(config, { backend, model: args.model });
       if (problem) return { ok: false, error: problem };
       const modelRelay = modelRelays.get(peer) ?? await startModelRelay({ omni, admitRequest: () => admitPiRequest(peer), dgxMaxInputTokens: activeRouting().pi.dgx_max_context_tokens, allowedDGXmodels: { "dgx/coding": config.pi.dgx_coding, "dgx/fast": config.pi.dgx_fast }, mlx: config.mlx.enabled === false ? undefined : config.mlx, mlxAlias: "mlx/fast", fallbackDGXAlias: "dgx/fast", enableHubAuto: true,
+        cooldownFailures: modelTiming.cooldownFailures(), cooldownMs: modelTiming.cooldownMs(), cooldownCapMs: modelTiming.cooldownCapMs(), terminalHistoryLimit: modelTiming.terminalHistoryLimit(),
         routeSessionKey: () => { const session = bus.peers.get(peer)?.recoveryMetadata?.().sessionId; return typeof session === "string" ? session : undefined; },
         staySwitch: () => activeRouting(),
         onRoute: record => event({ type: "route", peer, ...record }),
@@ -6833,6 +7162,7 @@ export async function startDaemon(opts: DaemonOptions) {
       if (!(msg.op === "inspect" && recoveryPhase === "restored")) for (const id of allExternalInstanceIds()) if (!retainedExternalBinding(id, true)) return "external instance retained binding changed or unavailable";
       const cancelled = incompatibleCancellationTarget();
       if (cancelled) return cancelled;
+      if (invocations.countOpen() && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("invocation"))) return `target lacks invocation; open invocations: ${invocations.countOpen()}`;
       if (externalIds.size && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("external_adapter_modules"))) return "target lacks external_adapter_modules; verified external definitions cannot be preserved by that daemon";
       if (configuredIds.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("configured_acp"))) return "target lacks configured_acp; project adapter definitions cannot be preserved by that daemon";
       if (extraIds.length && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("peer_instances"))) return "target lacks peer_instances; declared instance identities cannot be restored by that daemon";
@@ -7204,6 +7534,12 @@ export async function startDaemon(opts: DaemonOptions) {
     if (c.externalOwner && !currentExternalTools(c)) return void reply({ ok: false, error: "external instance launch or execution root changed" });
     if (c.toolsOwner && !currentImplementerTools(c)) return void reply({ ok: false, error: "Claude child generation or execution root changed" });
     switch (msg.t) {
+      case "request_cancel": {
+        if (!Number.isSafeInteger(msg.request) || msg.request < 1) return void reply({ t: "request_cancel", ok: false, error: "invalid request id" });
+        const request = c.invocationRequests?.get(msg.request);
+        request?.abort();
+        return void reply({ t: "request_cancel", ok: true, cancelled: !!request });
+      }
       case "permission_failure_probe": {
         const launch = currentImplementerTools(c), entry = currentImplementerFailure(c, launch);
         if (!entry || ++entry.probeCount > NATIVE_PERMISSION_PROBE_MAX_PER_LAUNCH) return void reply({ ok: false, error: "permission diagnostic unavailable" });
@@ -7561,6 +7897,12 @@ export async function startDaemon(opts: DaemonOptions) {
         const unknown = to?.filter((id) => !bus.knownPeers().includes(id) && membershipAllowed(id)) ?? [];
         if (unknown.length) return void reply({ t: "sent", ok: false, error: `unknown peer: ${unknown.join(", ")}` });
         const inReplyTo = msg.reply_to ? bus.get(String(msg.reply_to)) : undefined;
+        // #445 C2: an explicit hub_send that answers an invocation request is the answer, not a message: it is settled like any other answer and published nowhere.
+        if (c.peer && inReplyTo?.kind === "invocation" && inReplyTo.from === HUB) {
+          bus.onAnswer?.(c.peer, body, [inReplyTo]);
+          bus.completeReply(c.peer, inReplyTo.id);
+          return void reply({ t: "sent", ok: true, targets: [], recorded: false });
+        }
         // Built first: limits count the audience it really has (a reply goes to the parent's sender).
         let env = newEnvelope(c.peer ?? USER, body, { priority, ...(to ? { to } : {}), ...(inReplyTo ? { inReplyTo } : {}) });
         try { bus.checkRemotePublication(env); }
@@ -8189,10 +8531,24 @@ export async function startDaemon(opts: DaemonOptions) {
           );
           return;
         }
-        (c.externalOwner ? childToolAuthority.run({ by: c.peer!, current: () => currentExternalTools(c, true) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : c.toolsOwner ? childToolAuthority.run({ by: c.peer!, current: captureImplementerTools(c) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : taskOp(c.peer ?? USER, String(msg.op), msg.args ?? {})).then(
+        let invocation: AbortController | undefined;
+        if (msg.op === "hub_invoke") {
+          if (!Number.isSafeInteger(msg.rid) || msg.rid < 1) return void reply({ t: "task", ok: false, error: "invocation requires a request id" });
+          c.invocationRequests ??= new Map();
+          const previous = c.invocationRequests.get(msg.rid);
+          if (previous) { previous.abort(); return void reply({ t: "task", ok: false, error: "duplicate invocation request id" }); }
+          if (c.closed || sock.readyState !== WebSocket.OPEN || c.invocationRequests.size >= 64) return void reply({ t: "task", ok: false, error: "invocation request connection unavailable" });
+          invocation = new AbortController(); c.invocationRequests.set(msg.rid, invocation);
+        }
+        const run = async () => c.externalOwner ? childToolAuthority.run({ by: c.peer!, current: () => currentExternalTools(c, true) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : c.toolsOwner ? childToolAuthority.run({ by: c.peer!, current: captureImplementerTools(c) }, () => taskOp(c.peer!, String(msg.op), msg.args ?? {})) : taskOp(c.peer ?? USER, String(msg.op), msg.args ?? {});
+        (invocation ? invocationRequestSignal.run({ signal: invocation.signal, current: () => {
+          const live = !c.closed && sock.readyState === WebSocket.OPEN && c.invocationRequests?.get(msg.rid) === invocation;
+          if (!live) invocation?.abort();
+          return live;
+        } }, run) : run()).then(
           (text) => reply({ t: "task", ok: true, text }),
           (e: Error) => reply({ t: "task", ok: false, error: e.message }),
-        );
+        ).finally(() => { if (invocation && c.invocationRequests?.get(msg.rid) === invocation) c.invocationRequests.delete(msg.rid); });
         return;
       case "pause":
       case "resume": {