@staix/agent-hub 0.23.1 → 0.25.0

package/src/hub/daemon.ts

@@ -21,8 +21,9 @@ import { createClaudeFailureTrace, type ClaudeFailureTrace } from "./claude-fail
 import { buildNativePermissionProbe, NATIVE_PERMISSION_PROBE_MAX_PER_LAUNCH, validateNativePermissionRequest } from "./native-permission-request.ts";
 import { createClaudeLaunchProof, readClaudeLaunchProof } from "./claude-launch-proof.ts";
 import { InboxPolling } from "./inbox-polling.ts";
-import { ActionBudgets, actionPolicyConfig, type ActionPolicyConfig } from "./action-policy.ts";
+import { ActionBudgets, actionPolicyConfig, floorEnforcement, floorReads, type ActionPolicyConfig } from "./action-policy.ts";
 import { actionGate, claudeActionClasses } from "./action-enforce.ts";
+import type { FloorFacts } from "./action-class.ts";
 import { ReleaseAuthorizations, releaseAuthorizationError } from "./sdlc-release-authorization.ts";
 import { parseReleaseGuardArgv, parseReleasePushUpdates } from "../cli/sdlc-release-guard.ts";
 import type { DocEvidence } from "./sdlc-release.ts";
@@ -90,7 +91,7 @@ import { foldersConfig, scheduleViews, schedulesConfig, ScheduleStore, type Fold
 import { FolderStore, registerScanned, scanFolder, type FolderPolicy } from "./folder-trigger.ts";
 import type { ScannedFile } from "./schedules.ts";
 import { corpusConfig } from "./corpus-config.ts";
-import { ALL_MACHINE_LOCAL, configRepositoryPresent, configTracked, stripUntrusted } from "./config-trust.ts";
+import { ALL_MACHINE_LOCAL, configRefusal, configRepositoryPresent, configTracked, stripUntrusted } from "./config-trust.ts";
 import { authorizeConfigLeaf, configApply, configIdentityScope, configChanges, validateEffectiveConfig, validateOperationalConfig, validatePetConfig } from "./config-apply.ts";
 import { resolveSettledRoles } from "./settled-roles.ts";
 import { CONFIG_SOURCE_FILES, configFingerprint, configSourceTexts, parseConfigSources, type ConfigSourceTexts, type ConfigSources } from "./config-reload.ts";
@@ -148,7 +149,8 @@ import { recallMemoryLines, trimToTokens } from "../memory/recall.ts";
 import { closeSync, constants as fsConstants, openSync, lstatSync, readSync, statSync } from "node:fs";
 import { basename, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
-import { realPath, hubHome } from "./project.ts";
+import { canonicalPath, realPath, hubHome } from "./project.ts";
+import { HandoffRefusal, checkTarget, parseHandoff, resolveTarget, handoffEventFor, type HandoffEvent } from "./handoff.ts";
 import { mainCheckoutBranch, mainCheckoutWarning } from "./main-checkout.ts";
 import type { BusEvent, PublishResult } from "./bus.ts";
 import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, IMPLEMENTER_HUB_TOOL_NAMES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS, BOUNDED_TASK_TOOLS, CAPABILITY_TOOLS, profileTaskTools } from "./hub-tools.ts";
@@ -163,14 +165,20 @@ import { DEFAULT_INFERENCE, DIGEST, Inference, screenPii, type InferenceConfig,
 import { taskEvidencePrivacy, type TaskEvidencePrivacy, ask, ASK_NOTE_TITLE, RUN_START } from "./ask.ts";
 import { currentRouting, loadRouting, detectSignals, OVERLAY_FILE, overlayToml, parseRouting, routingText, type Routing } from "./routing.ts";
 import { withChecklistLine } from "./learning.ts";
-import { LEARN_CHECKLIST, NEVER_EDITABLE, projectSettings, checkSettingValue, ignoredLine, pendingUndo, pendingUndoIdentity, readOverlay, restoredValue, routingCandidate, storedLocally, sharedValue, settingDef as instanceSettingDef, settingRefusal, settingRows, settingText, undoSetting, valueAt, writeConfigSetting, writeRoutingSetting, type SettingAuthority, type SettingSource, type SettingDef, type SettingRow, type SettingValue, type UndoIdentity } from "./settings.ts";
-import { githubOriginRepository } from "./task-repository.ts";
+import { autonomyConsentStateDir, createAutonomyConsent, type AutonomyConsentValues } from "./autonomy-consent.ts";
+import { insideRoot } from "./path-policy.ts";
+import { autonomyPreset, autonomyEnvironment, planAutonomy, autonomyRemovalKeys, autonomyStatus, type AutonomyEnvironment, type AutonomyPeer } from "./autonomy.ts";
+import { readAutonomyDefaults } from "./autonomy-defaults.ts";
+import { AUTONOMY_UNDO, autonomyOwnershipDigest, autonomyUndoKeys, writeAutonomyPreset, LEARN_CHECKLIST, NEVER_EDITABLE, projectSettings, checkSettingValue, ignoredLine, pendingUndo, pendingUndoIdentity, readOverlay, restoredValue, routingCandidate, storedLocally, sharedValue, settingDef as instanceSettingDef, settingRefusal, settingRows, settingText, undoSetting, valueAt, writeConfigSetting, writeRoutingSetting, type SettingAuthority, type SettingSource, type SettingDef, type SettingRow, type SettingValue, type UndoIdentity } from "./settings.ts";
+import { githubOriginRepository, githubRemoteRepository } from "./task-repository.ts";
 import { Bus } from "./bus.ts";
 import { attribute, deliveryTask, type TaskAttribution } from "./attribution.ts";
 import { DeliveryJournal } from "./delivery-journal.ts";
 import { startDashboard, dashboardView, type DashboardSession } from "./ui.ts";
 import { codeGroup } from "./task-code-group.ts";
-import { DAEMON_FEATURES, PROTOCOL, readControl, stateDirFor } from "./control-client.ts";
+import { ControlClient, DAEMON_FEATURES, PROTOCOL, readControl, stateDirFor } from "./control-client.ts";
+import { attachEvent, originOf, type Origin } from "./provenance.ts";
+import { mintSessionId, sessionGate } from "./session-identity.ts";
 import { MAX_HOP, newEnvelope, parseMarker, replyParent, sanitize, USER, type Envelope, type PeerId, type Priority } from "./envelope.ts";
 import { BasePeer, DEFAULT_WATCHDOG_MS, type FrontendProxyPort, type PeerAdapter } from "./peers.ts";
 import { ClaudeTodoSource, DoingTracker, readAiTitle, type DoingKind, type PeerDoing, type TitleCursor } from "./peer-doing.ts";
@@ -355,7 +363,7 @@ export const DEFAULT_CONFIG: HubConfig = {
 export { stateDirFor };
 
 /** Ids an external process may not claim: the console user and the adapters the daemon runs itself. */
-const READ_ONLY_HUB_TOOLS = new Set(["hub_capabilities", "hub_inbox", "hub_send", "hub_delivery_done", "hub_review", "hub_task_show", "hub_task_list", "hub_memory_search", "hub_memory_show", "hub_memory_graph", "hub_source_read", "hub_status"]);
+const READ_ONLY_HUB_TOOLS = new Set(["hub_capabilities", "hub_inbox", "hub_send", "hub_delivery_done", "hub_review", "hub_task_show", "hub_task_list", "hub_study_show", "hub_memory_search", "hub_memory_show", "hub_memory_graph", "hub_source_read", "hub_status"]);
 const BASE_RESERVED_IDS = new Set<string>([USER, ...SUPPORTED_PEERS.filter(peer => definitionOf(peer)?.attach?.externalHello !== true), HUB, DIGEST]);
 const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
@@ -474,6 +482,7 @@ export function loadConfig(cwd: string, layers?: readonly ConfigLayer[], routing
     if (file.pet && typeof file.pet === "object" && !Object.keys(file.pet).length) delete file.pet;
     delete file.declaredExternalInstances; // host-derived refusal rows, never a file claim
     delete file.permission_default_sources; // provenance is loader-owned, never a file claim
+    delete file._autonomy; // Inert restoration metadata, never policy or approval provenance.
     if (file.checks?.runner === "remote" || file.checks?.remote !== undefined) {
       if (name !== "config.local.json" || configTracked(cwd, name) !== false) throw new Error("remote checks require untracked config.local.json");
       if (file.checks.remote !== undefined) remoteRunnerConfig(file.checks.remote);
@@ -691,6 +700,8 @@ interface Client {
   authed: boolean;
   role?: "peer" | "console" | "tools";
   peer?: PeerId;
+  /** agent-hub#1036: this connection is a distinct session; `peer` is the id the daemon minted for it (`<peer>~<origin>`), never a bus peer. */
+  session?: true;
   launchId?: string;
   externalOwner?: { owner: PeerAdapter; launchId: string; generation?: string };
   toolsOwner?: { owner: PeerAdapter; launchId: string; generation: string; cwd: string };
@@ -799,6 +810,27 @@ export async function startDaemon(opts: DaemonOptions) {
   const childToolAuthority = new AsyncLocalStorage<{ by: string; current: () => boolean }>();
   const implementerTranscripts = new Map<string, string>();
   const executionOwners = new Map<string, { owner: PeerAdapter; cwd: string; socket?: Sock; launchId?: string; generation?: string | number }>();
+  /** #604 PR B: envelope id to the connection that sent it, written where a connection builds an envelope and read once when the envelope event is logged. Bounded: an entry whose event never comes ages out. */
+  const envelopeOrigins = new Map<string, Origin>();
+  /** agent-hub#1036: the ids this daemon minted for live distinct sessions. Only the daemon makes them, so `PEER_ID` is not widened and no `@` reaches the remote-room paths. */
+  const sessionIds = new Set<string>();
+  const rememberOrigin = (id: string, origin: Origin): void => { envelopeOrigins.set(id, origin); if (envelopeOrigins.size > 1024) envelopeOrigins.delete(envelopeOrigins.keys().next().value as string); };
+  const takeOrigin = (id: string): Origin | undefined => { const origin = envelopeOrigins.get(id); envelopeOrigins.delete(id); return origin; };
+  /**
+   * agent-hub#1036: the origin of an envelope that no control connection sent, one an adapter published itself (a native peer's final answer goes through `peer.onMessage`, not the `send` case).
+   * It names the sending peer and, where the adapter knows one, the launch it runs under: a channel session's `managedLaunchId`, an owned Jcode's launch id. The hub's own writers (`hub`, `user`,
+   * `digest`) and remote room ids have none, as before. Evidence for the log, never a path or text.
+   */
+  const adapterOrigin = (env: Envelope): Origin | undefined => {
+    if (env.from === "hub" || env.from === USER || env.from === "digest" || env.from.includes("@")) return undefined;
+    const peer = bus.peers.get(env.from);
+    if (!peer) return undefined;
+    // Read by shape, not by a native-branch predicate: a channel session reports `managedLaunchId`, an owned Jcode `ownedLaunchId`, and the value only labels the log. Nothing here decides
+    // authority or ownership, so it is not an `isWsPeer` host branch (the #625 ratchet lists those, and this is not one).
+    const evidence = peer as { managedLaunchId?: unknown; ownedLaunchId?: unknown };
+    const launchId = [evidence.managedLaunchId, evidence.ownedLaunchId].find((value): value is string => typeof value === "string" && value.length > 0);
+    return originOf({ role: "peer", peer: env.from, ...(launchId ? { launchId } : {}) });
+  };
   const externalLaunches = new Map<string, { owner: PeerAdapter; options: AcpOptions; launchId: string; binding: ExternalInstanceBinding; workspace: string; generation?: string }>();
   const externalBindings = new Map<string, ExternalInstanceBinding>();
   const externalSessions = new Map<string, string>();
@@ -944,7 +976,7 @@ export async function startDaemon(opts: DaemonOptions) {
     return typeof found === "string" && stale ? { key: `roster.${stale}`, group: "Roster", label: `${stale}: stale roster key (instance no longer declared)`, type: "boolean", store: "config", applies: "live", risk: "raises", floor: false, path: ["roster", stale] } : found;
   };
   // #514b: undo resolves the managed checklist key, which is not a settings row, and every other key through the project-scoped lookup above (declared instances, the adapter catalog, a stale roster key).
-  const undoableDef = (key: unknown): SettingDef | string => key === LEARN_CHECKLIST.key ? LEARN_CHECKLIST : settingDef(key);
+  const undoableDef = (key: unknown): SettingDef | string => key === AUTONOMY_UNDO.key ? AUTONOMY_UNDO : key === LEARN_CHECKLIST.key ? LEARN_CHECKLIST : settingDef(key);
   const accountOf = (peer: string) => definitionOf(peer)?.budget?.account ?? peer;
   const accountMembers = (account: string) => SUPPORTED_PEERS.filter(peer => accountOf(peer) === account);
   let rosterChanging: string | undefined;
@@ -1148,6 +1180,7 @@ export async function startDaemon(opts: DaemonOptions) {
         for (const request of sock.data.invocationRequests?.values() ?? []) request.abort();
         sock.data.invocationRequests?.clear();
         nativeHookLaunches.endOwner(sock);
+        if (sock.data.session && sock.data.peer) sessionIds.delete(sock.data.peer);
         consoles.delete(sock);
         operationalLogSubscribers.delete(sock);
         sock.data.tail?.();
@@ -1347,6 +1380,18 @@ export async function startDaemon(opts: DaemonOptions) {
     onImportantQueued: (peer, counts) => { const p = bus.peers.get(peer); if (isWsPeer(p)) p.notifyQueued(counts); } });
   startupCleanup.push(() => bus.closeJournal());
   const claudeLaunchProof = createClaudeLaunchProof({ stateDir: opts.stateDir, cwd: opts.cwd, instanceId, definitionOf, peer: peer => bus.peers.get(peer) });
+  /**
+   * agent-hub#1036: whether a tools hello is a distinct session instead of the peer it names. True when the plugin asked for it (`session`: it has no project of its own and inherited this hub's
+   * state), or when the name is a Claude channel peer and the hello PRESENTS a launch id that is not the current launch record's. An ABSENT id is never enough: the facts hook, a native
+   * helper or a person's own shell connects as the peer with none, and it must keep working (agent-hub#1036 AC4). Everything else keeps its admission as before: codex, kimi, qwen, agent
+   * shells without an inherited id, owned ACP peers and the Claude implementer child are not affected.
+   */
+  const sessionHello = (msg: Record<string, any>): boolean => {
+    if (typeof msg.session === "string") return true;
+    const peer = String(msg.peer ?? "");
+    if (definitionOf(peer)?.transport !== "claude-channel" || definitionOf(peer)?.start.daemonPort === "claude-implementer") return false;
+    try { const launch = readClaudeLaunchProof(opts.stateDir, peer, instanceId); return !!launch && typeof msg.launchId === "string" && msg.launchId !== launch.launchId; } catch { return false; }
+  };
   function frontendProxyState(peer: string, owner: PeerAdapter | undefined): { present: boolean; port: FrontendProxyPort | undefined } {
     if (!owner || !isFixedBuiltinDefinition(definitionOf(peer)) || !("frontendProxy" in owner)) return { present: false, port: undefined };
     return { present: true, port: owner.frontendProxy };
@@ -2134,6 +2179,8 @@ export async function startDaemon(opts: DaemonOptions) {
     // #334: the hub model's split, validated against the same `hub_backlog_split` parts schema a planner's call is, and the source registry for `--source`.
     intake: { split: (system, user, opts) => inference?.split(system, user, opts) ?? Promise.resolve(undefined), sourceKnown: id => sourceRegistry.get(id) !== undefined,
       partsSchema: () => profileTaskTools(resolvedProfile, lifecycleConfig.stages, lifecycleConfig.mode !== "off").find(tool => tool.name === "hub_backlog_split")?.inputSchema.properties.parts },
+    studySource: id => sourceRegistry.get(id),
+    experimentCheck: run => checkRunner.result(run),
     // The PII screen (issue #198): the model on this machine when MLX/Ollama is enabled, else the gateway on campus only.
     piiScreen: opts.piiScreen ?? ((text) => screenPii(text, { ...(config.mlx.enabled === false ? {} : { device: () => ensureMlx(config.mlx) }), onCampus, omni, fixedModel: () => activeRouting().local.fixed_model })),
     recordScreen: (record) => event({ type: "pii_screen", ...record }),
@@ -3160,6 +3207,71 @@ export async function startDaemon(opts: DaemonOptions) {
   // commit waits for those in flight, or its integrity digest misses their later writes. Completion checks outlive
   // their op, so recoveryReady() also waits for `tasks.checksPending()`: a check the commit's stop kills would write.
   let taskOpsInFlight = 0;
+  /**
+   * #604 ORIGIN side. Order matters: the caller's authority and the PII gates run first (nothing has left this project), then the target is resolved from the machine registry and its own
+   * status descriptor is read, and only then is the request sent. The target answers with the task id it created, which is recorded here. A refusal at any step leaves no row in either board.
+   */
+  async function handoffOut(by: PeerId, input: unknown): Promise<{ project: string; task: number; state: string; note?: string }> {
+    const request = parseHandoff(input);
+    const own = request.task === undefined ? undefined : board.get(request.task);
+    if (request.task !== undefined && !own) throw new HandoffRefusal("invalid", `no task #${request.task} in this project to hand off from`);
+    tasks.handoffOutAuthority(by, own);
+    const self = { id: projectId, root: opts.cwd };
+    const target = resolveTarget(request.project, registeredProjects(hubHome()).map(project => ({ id: project.id, root: project.root, stateDir: project.stateDir })), self, canonicalPath);
+    const descriptor = readControl(target.stateDir);
+    checkTarget(target, descriptor && { ...(descriptor.features ? { features: descriptor.features } : {}), ...(descriptor.projectId ? { projectId: descriptor.projectId } : {}) });
+    let client: ControlClient;
+    try { client = await ControlClient.connect(target.stateDir, { role: "console", projectRoot: descriptor!.cwd ?? target.root }, 5000); }
+    catch { throw new HandoffRefusal("not_running", `the hub of ${target.id} did not answer; run \`ahub up\` in ${target.root}, then hand the task off again (handoffs are not queued)`); }
+    try {
+      const { project: _project, task: originTask, ...body } = request;
+      const reply = await client.request({ t: "task_handoff", origin: { projectId, peer: by, ...(originTask === undefined ? {} : { taskId: originTask }) }, request: body }, 30_000);
+      if (!reply.ok) throw new HandoffRefusal("invalid", sanitize(String(reply.error ?? "the target refused the handoff")).slice(0, 300));
+      const remote = Number(reply.task);
+      if (!Number.isSafeInteger(remote) || remote < 1) throw new HandoffRefusal("invalid", "the target answered without a task id");
+      tasks.handoffSent(by, { projectId: target.id }, remote, request.title, request.task);
+      return { project: target.id, task: remote, state: String(reply.state ?? "proposed"), ...(typeof reply.note === "string" && reply.note ? { note: sanitize(reply.note).slice(0, 300) } : {}) };
+    } finally { client.close(); }
+  }
+  /** The head a handoff reports: the owner's `refs.commit`, else the receipt's verified head. Only a full 40-hex SHA crosses; anything else is dropped. */
+  const handoffHead = (task: Task): string | undefined => { const head = task.refs.commit ?? task.sdlc?.head ?? task.sdlc?.localHead; return typeof head === "string" && /^[0-9a-f]{40}$/.test(head) ? head : undefined; };
+  /** #604 TARGET side: tell the origin project's daemon about a state change of a task it handed us. Best effort and never blocking a board write: an origin that is down reads the state later. */
+  const handoffNotifyOrigin = (task: Task, entry: { event: string }): void => {
+    const event: HandoffEvent | undefined = handoffEventFor(entry.event, task.state);
+    const origin = event ? board.handoffOrigin(task.id) : undefined;
+    if (!event || !origin) return;
+    void (async () => {
+      try {
+        const project = registeredProjects(hubHome()).find(candidate => candidate.id === origin.projectId);
+        const descriptor = project && readControl(project.stateDir);
+        if (!project || !descriptor || !descriptor.features?.includes("task_handoff")) return;
+        const client = await ControlClient.connect(project.stateDir, { role: "console", projectRoot: descriptor.cwd ?? project.root }, 3000);
+        try { await client.request({ t: "task_handoff_event", event: { projectId, remoteTask: task.id, state: event, ...(typeof task.sdlc?.pr === "number" ? { pr: task.sdlc.pr } : {}), ...(handoffHead(task) ? { head: handoffHead(task) } : {}) } }, 5000); }
+        finally { client.close(); }
+      } catch { /* the origin is down or refused: it reads the target's state on its next start */ }
+    })();
+  };
+  /**
+   * #604 ORIGIN side, on start: for every handoff this project made that has not reached a final state, ask the target (if it is running) where the task stands now, and record the answer.
+   * A target that is down is skipped: it is asked again on the next start. Best effort, in the background, never delaying readiness.
+   */
+  const handoffCatchUp = (): void => {
+    void (async () => {
+      const open = board.handoffOutbound().filter(row => !["approved", "cancelled"].includes(row.state));
+      const byProject = new Map<string, number[]>();
+      for (const row of open) byProject.set(row.remoteProject, [...(byProject.get(row.remoteProject) ?? []), row.remoteTask]);
+      for (const [remote, ids] of byProject) {
+        try {
+          const project = registeredProjects(hubHome()).find(candidate => candidate.id === remote);
+          const descriptor = project && readControl(project.stateDir);
+          if (!project || !descriptor?.features?.includes("task_handoff")) continue;
+          const client = await ControlClient.connect(project.stateDir, { role: "console", projectRoot: descriptor.cwd ?? project.root }, 3000);
+          try { const reply = await client.request({ t: "task_handoff_states", projectId, tasks: ids.slice(0, 200) }, 5000); if (reply.ok && Array.isArray(reply.states)) tasks.handoffCaughtUp(remote, reply.states); }
+          finally { client.close(); }
+        } catch { /* that target is down or refused: it is asked again on the next start */ }
+      }
+    })();
+  };
   const conductedMutations = new Set(["hub_task_propose", "hub_task_accept", "hub_task_decline", "hub_task_done", "hub_review", "hub_checkpoint", "hub_remember"]);
   const taskOp = async (...args: Parameters<typeof taskOpBody>): Promise<string> => {
     const [by, op, input] = args;
@@ -3371,7 +3483,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     // Inside a PII turn the worker's words may carry the PII whatever they are attached to: a note would go to
     // shared memory and a new task could be routed to a cloud peer without matching any pattern.
-    if (piiTurn && (MEMORY_READ_TOOLS.has(op) || op === "hub_memory_correct" || op === "hub_remember" || op === "hub_task_propose" || op === "hub_sdlc_record" || op === "hub_plan_review" || op === "hub_sdlc_costs" || op === "hub_sdlc_metrics" || op.startsWith("hub_release_") || op === "hub_backlog_return_untouched" || op === "hub_backlog_plan" || op === "hub_backlog_undo" || op === "hub_backlog_pull" || op === "hub_backlog_split" || op === "release_new")) throw new PreEffectToolRefusal(`${op} is not available while working on a PII task: its text must not leave this machine`);
+    if (piiTurn && (MEMORY_READ_TOOLS.has(op) || op === "hub_memory_correct" || op === "hub_remember" || op === "hub_task_propose" || op === "hub_sdlc_record" || op === "hub_plan_review" || op === "hub_sdlc_costs" || op === "hub_sdlc_metrics" || op.startsWith("hub_release_") || op === "hub_backlog_return_untouched" || op === "hub_backlog_plan" || op === "hub_backlog_undo" || op === "hub_backlog_pull" || op === "hub_backlog_split" || op === "release_new" || op === "hub_study_draft" || op === "hub_study_revise")) throw new PreEffectToolRefusal(`${op} is not available while working on a PII task: its text must not leave this machine`);
     // The same words attached to an ordinary task would reach its reviewer, its owner, overlapping owners (a plan, the
     // completed-change notice) and shared memory. A turn that holds a PII task acts on ordinary tasks in a turn of its own.
     if (piiTurn && (op === "hub_task_done" || op === "hub_review" || (op === "hub_task_accept" && (a.plan != null || a.refs != null)))) {
@@ -3577,6 +3689,34 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       case "hub_backlog_undo":
         return JSON.stringify(tasks.publicView(await tasks.undoPlanning(by, a.id, a.revision)));
+      // #601: the study tools only call Tasks. Draft and revise are the configured planner's (Tasks checks planningAuthority and the private turn); none of them approves.
+      // The arguments go to Tasks whole, never re-picked field by field: an unknown field is refused there (`studyFields`), not silently dropped here, and MCP schemas are not enforced on the way in.
+      case "hub_study_draft":
+        return JSON.stringify(await tasks.studyDraft(by, a));
+      case "hub_study_revise":
+        return JSON.stringify(await tasks.studyRevise(by, a));
+      case "hub_study_show":
+        return JSON.stringify(a.id === undefined ? tasks.studyList(by, a) : tasks.studyShow(by, a));
+      case "hub_study_handoff":
+        if (!a || typeof a !== "object" || Array.isArray(a) || Object.keys(a).some(key => key !== "handoff")) throw new PreEffectToolRefusal("study handoff takes only a handoff object");
+        return JSON.stringify(await tasks.studyHandoff(by, a.handoff));
+      // #604 (agent-hub#1030): a handoff to another project. Tasks checks who may send it and the PII gates; `handoffOut` resolves the target, asks its daemon and records the answer.
+      case "hub_task_handoff":
+        return JSON.stringify(await handoffOut(by, a));
+      case "hub_task_handoffs":
+        return JSON.stringify({ handoffs: tasks.handoffList() });
+      // #601: the person's own forms (a read is hub_study_show, which every connection may use). `by` is USER only on the console path; approval and close are never a tool.
+      case "study_draft":
+        return JSON.stringify(await tasks.studyDraft(by, a));
+      case "study_revise":
+        return JSON.stringify(await tasks.studyRevise(by, a));
+      case "study_approve":
+        return JSON.stringify(await tasks.studyApprove(by, a));
+      case "study_approve_protocol":
+        return JSON.stringify(await tasks.experimentApproveProtocol(by, a));
+      case "study_close":
+        return JSON.stringify(await tasks.studyClose(by, a));
+
       case "hub_task_propose": {
         const t = await tasks.propose(by, a);
         const repoHint = tasks.refsRepoHint(t); // #723: advice only; never part of the write
@@ -3784,7 +3924,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const related = tasks.isPii(task) ? undefined : await taskMemoryResult(task, true).catch(() => ({ items: [], state: "unknown" as const }));
         const fresh = board.get(task.id);
         const relatedMemory = related && fresh?.updated === task.updated && !tasks.isPii(fresh) ? { state: related.state, count: related.items.length, ...("head" in related ? { head: related.head } : {}) } : { state: "unknown" };
-        return JSON.stringify({ ...detail, ...holderReasons(publicTask), relatedMemory, ...(codeSymbols ? { codeSymbols } : {}), ...(consoleDeliverables ? { deliverables: consoleDeliverables } : {}), symbolOverlaps: tasks.symbolOverlaps(task), flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) }, null, 2);
+        return JSON.stringify({ ...detail, ...holderReasons(publicTask), relatedMemory, ...(publicTask.handoffOrigin ? { handoffOrigin: publicTask.handoffOrigin } : {}), ...(codeSymbols ? { codeSymbols } : {}), ...(consoleDeliverables ? { deliverables: consoleDeliverables } : {}), symbolOverlaps: tasks.symbolOverlaps(task), flowRevision: task.history.length, reviews: board.reviews({ task: task.id }) }, null, 2);
       }
       case "deliverables": {
         // #317 (`ahub deliverables`): the board's deliverable records, person only. `check` measures the files now; without it nothing is opened.
@@ -3855,20 +3995,71 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   // Runtime choices stay in this daemon only; recovery reads project defaults anew.
   const defaultSources = config.permission_default_sources ?? Object.fromEntries(Object.entries(config.permission_modes).map(([peer, mode]) => [peer, { mode, source: "embedded configuration" }]));
-  const pendingPermissionDefaults = new Map(Object.entries(defaultSources).filter(([, value]) => value.mode === "never-ask").map(([peer, value]) => [peer, value.source]));
+  const autonomyConsentDir = autonomyConsentStateDir(hubHome(), projectId);
+  const autonomyConsent = createAutonomyConsent(autonomyConsentDir, projectId);
+  const autonomyOwnershipWitness = createAutonomyConsent(join(autonomyConsentDir, "ownership"), projectId, "ownership");
+  const autonomyUndoWitness = createAutonomyConsent(join(autonomyConsentDir, "undo"), projectId, "undo");
+  const autonomyWitnessValues = (peer: "ownership" | "undo", digest: string): AutonomyConsentValues => ({ [peer]: { digest } });
+  const ownAutonomyMetadata = (metadata: unknown) => {
+    const digest = autonomyOwnershipDigest(metadata);
+    if (digest) autonomyOwnershipWitness.confirm(autonomyWitnessValues("ownership", digest));
+    else autonomyOwnershipWitness.clear();
+  };
+  const autonomyConsentLocationSafe = () => {
+    try { const held = canonicalPath(autonomyConsentDir); const roots = [opts.cwd, ...executionRoots.values(), ...Object.values(config.instances ?? {}).flatMap(instance => instance.worktree ? [resolve(opts.cwd, instance.worktree)] : [])]; return !roots.some(root => insideRoot(relative(canonicalPath(root), held))); }
+    catch { return false; }
+  };
+  const autonomyConsentTrusted = () => autonomyConsentLocationSafe() && configRefusal(opts.cwd, "config.local.json") === undefined;
+  function autonomyConsentValues(candidate: HubConfig = config): AutonomyConsentValues {
+    return Object.fromEntries(Object.entries(candidate.permission_modes).filter(([peer, mode]) => mode === "never-ask" && candidate.permission_default_sources?.[peer]?.source === ".agenthub/config.local.json")
+      .map(([peer, mode]) => [peer, { [`permission_modes.${peer}`]: mode }]));
+  }
+  // Machine opt-in is a second host-owned approval trigger. Offline CLI writes never issue consent.
+  const machineAutonomy = readAutonomyDefaults(hubHome(), [opts.cwd, ...executionRoots.values(), ...Object.values(config.instances ?? {}).flatMap(instance => instance.worktree ? [resolve(opts.cwd, instance.worktree)] : [])]);
+  if (machineAutonomy.notice) log(machineAutonomy.notice);
+  if (machineAutonomy.enabled && autonomyConsentTrusted()) {
+    try {
+      const peers: AutonomyPeer[] = SUPPORTED_PEERS.map(id => ({ id, kind: definitionOf(id)?.kind ?? id, unmanaged: !!definitionOf(id)?.permission.unmanaged,
+        ...(declarations[id]?.start_mode ? { form: declarations[id]!.start_mode } : {}) }));
+      // The daemon is detached even for a terminal project; explicit Orca/CI evidence selects those rows.
+      const operations = planAutonomy(autonomyEnvironment(process.env, true), key => {
+        const def = settingDef(key);
+        return typeof def === "string" || def.store !== "config" ? undefined : { store: def.store, values: def.values, locked: def.locked };
+      }, peers);
+      const current = autonomyConsentValues(), observed = autonomyConsentValues(loadConfig(opts.cwd, undefined, undefined, externalDefinitions));
+      const retained = autonomyConsent.confirmed(current, true);
+      const approved: AutonomyConsentValues = Object.fromEntries([...retained].map(peer => [peer, current[peer]!]));
+      for (const operation of operations) if (operation.key.startsWith("permission_modes.") && operation.value === "never-ask") {
+        const peer = operation.key.slice("permission_modes.".length);
+        if (current[peer]?.[operation.key] === operation.value && observed[peer]?.[operation.key] === operation.value) approved[peer] = current[peer]!;
+      }
+      if (Object.keys(approved).some(peer => !retained.has(peer))) {
+        if (!autonomyConsentTrusted() || readAutonomyDefaults(hubHome(), [opts.cwd, ...executionRoots.values()]).fingerprint !== machineAutonomy.fingerprint) throw new Error("machine autonomy evidence changed during startup");
+        autonomyConsent.confirm(approved);
+      }
+    } catch { log("Machine autonomy consent was not issued: preset, project configuration or private state could not be verified."); }
+  }
+  let autonomyConfirmed = autonomyConsentLocationSafe() ? autonomyConsent.confirmed(autonomyConsentValues(), autonomyConsentTrusted()) : new Set<string>();
+  const pendingPermissionDefaults = new Map(Object.entries(defaultSources).filter(([peer, value]) => value.mode === "never-ask" && !autonomyConfirmed.has(peer)).map(([peer, value]) => [peer, value.source]));
   const permissionChanges = new Map<string, Promise<void>>();
-  const permissionModes = new Map<string, PermissionMode>(Object.entries(config.permission_modes).map(([peer, mode]) => [peer, mode === "never-ask" ? "ask" : mode]));
+  const permissionModes = new Map<string, PermissionMode>(Object.entries(config.permission_modes).map(([peer, mode]) => [peer, mode === "never-ask" && !autonomyConfirmed.has(peer) ? "ask" : mode]));
   for (const peer of pendingPermissionDefaults.keys()) permissionModes.set(peer, "ask");
   const changedPermissionDefaults = new Set<string>();
+  function refreshAutonomyConsent(candidate: HubConfig = config): void {
+    const next = autonomyConsentLocationSafe() ? autonomyConsent.confirmed(autonomyConsentValues(candidate), autonomyConsentTrusted()) : new Set<string>();
+    for (const peer of new Set([...next, ...autonomyConfirmed])) if (next.has(peer) !== autonomyConfirmed.has(peer)) changedPermissionDefaults.add(peer);
+    autonomyConfirmed = next;
+  }
   const applyPendingPermissionDefault = (peer: string): void => {
+    refreshAutonomyConsent();
     if (changedPermissionDefaults.has(peer) && (!bus.peers.has(peer) || bus.peers.get(peer)!.state === "offline")) {
       changedPermissionDefaults.delete(peer);
       const mode = config.permission_modes[peer] ?? "ask";
       const source = config.permission_default_sources?.[peer]?.source ?? "configuration default";
-      permissionModes.set(peer, mode === "never-ask" ? "ask" : mode);
+      permissionModes.set(peer, mode === "never-ask" && !autonomyConfirmed.has(peer) ? "ask" : mode);
       permissionModeSources.set(peer, source);
       pendingPermissionDefaults.delete(peer);
-      if (mode === "never-ask") pendingPermissionDefaults.set(peer, source);
+      if (mode === "never-ask" && !autonomyConfirmed.has(peer)) pendingPermissionDefaults.set(peer, source);
       if (config.permission_default_sources?.[peer]) defaultSources[peer] = config.permission_default_sources[peer]!;
       else delete defaultSources[peer];
     }
@@ -3881,7 +4072,62 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const actionBudgets = new ActionBudgets(() => config.action_policy, actionSession);
   // #636 slice 2: the always-ask gate of an ACP peer, built per peer from the host's own ports (root, task, PII screen); never from the agent.
-  const acpActionGate = (peer: PeerId) => actionGate({ budgets: actionBudgets, policy: () => config.action_policy, root: executionRoot,
+  // #999 T3, the floor: its facts are read where the classifier runs, per peer, and an unknown one keeps the class asking. The default branch comes from the same
+  // authoritative remote read the task shell uses (never a local origin/HEAD), cached because the gate is synchronous; before the read answers, or when it fails, every push asks.
+  let floorDefaultBranch: string | undefined, floorGeneration = 0;
+  const floorGitRaw = (cwd: string, args: string[]) => { try { return hubGitSync(["-C", cwd, ...args], { encoding: "utf8", timeout: 1000, maxBuffer: 4096 }); } catch { return undefined; } };
+  const floorFacts = (peer: PeerId): FloorFacts | undefined => {
+    if (!actionBudgets.floorOn()) return undefined;
+    let root: string;
+    try { root = realPath(executionRoot(peer)); } catch { return undefined; }
+    // One classification gets a bounded amount of synchronous work (`floorReads`): every authority read goes through it, the project origin included, so one shared cap, memo and deadline
+    // cover all of them. Past the bound a fact is unknown, and an unknown fact keeps the call asking.
+    const FLOOR_GIT_CALLS = 16, FLOOR_GIT_MS = 2500;
+    const reads = floorReads(FLOOR_GIT_CALLS, FLOOR_GIT_MS);
+    const floorGit = (cwd: string, args: string[]): ReturnType<typeof floorGitRaw> => reads.read(`git\0${cwd}\0${args.join("\0")}`, () => floorGitRaw(cwd, args));
+    const floorOrigin = (): string | undefined => reads.read(`origin\0${root}`, () => githubOriginRepository(root));
+    return {
+      ...(floorDefaultBranch ? { defaultBranch: floorDefaultBranch } : {}),
+      ...(shellProjectRepository ? { repository: shellProjectRepository } : {}),
+      // Proven only: the directory's own top level is the peer's execution root and that checkout's origin is the project's repository.
+      inOwnRepository: cwd => {
+        try {
+          const top = floorGit(cwd, ["rev-parse", "--show-toplevel"]);
+          if (!top || top.status !== 0 || typeof top.stdout !== "string" || realPath(top.stdout.trim()) !== root) return undefined;
+          return !!shellProjectRepository && floorOrigin() === shellProjectRepository;
+        } catch { return undefined; }
+      },
+      refIsTag: (name, cwd) => { const found = floorGit(cwd, ["rev-parse", "-q", "--verify", `refs/tags/${name}`]); return found === undefined || found.status === null ? undefined : found.status === 0 ? true : found.status === 1 ? false : undefined; },
+      // The effective push destinations, not the fetch URL: pushurl and url.<base>.pushInsteadOf can send `git push origin` to another repository, and push.followTags,
+      // push.pushOption, push.recurseSubmodules and a remote.origin.push or mirror setting add refs, tags or submodule pushes to a plain branch push. `--all` because a remote can have several push
+      // URLs and git pushes to every one of them: each must name the project's own repository. Any of those settings present, or any read that fails, is not proof.
+      pushIsOwn: cwd => {
+        const added = floorGit(cwd, ["config", "--get-regexp", "^(push\\.(followtags|pushoption|recursesubmodules)|remote\\.origin\\.(push|mirror|pushurl))$"]);
+        if (added === undefined || added.status !== 1) return added?.status === 0 ? false : undefined;
+        const urls = floorGit(cwd, ["remote", "get-url", "--push", "--all", "origin"]);
+        if (urls === undefined || urls.status !== 0 || typeof urls.stdout !== "string") return undefined;
+        const lines = urls.stdout.split("\n").map(line => line.trim()).filter(Boolean);
+        return !!shellProjectRepository && lines.length > 0 && lines.every(line => githubRemoteRepository(line) === shellProjectRepository);
+      },
+      // gh's default repository. A peer whose commands the hub builds the environment for (Pi and the local worker: `trust.hubSandboxed`) is judged on the facts the hub can read: only origin, no
+      // `gh repo set-default` marker naming another repository, no GH_REPO, GH_HOST or GH_ENTERPRISE_TOKEN in the hub's own environment. For every other peer (Claude, Codex, Kimi, Qwen, Jcode, agy)
+      // the hub cannot see the environment its shell runs in, and a GH_REPO exported there would redirect an unqualified call: such a call is never proven own, so it asks (foreign-repo-write)
+      // and only an explicit own `--repo`, `-R` or pull request URL runs.
+      ghDefaultIsOwn: cwd => {
+        if (definitionOf(peer)?.trust.hubSandboxed !== true) return false;
+        if (process.env.GH_REPO || process.env.GH_HOST || process.env.GH_ENTERPRISE_TOKEN) return false;
+        const remotes = floorGit(cwd, ["remote"]);
+        if (remotes === undefined || remotes.status !== 0 || typeof remotes.stdout !== "string" || remotes.stdout.trim() !== "origin") return remotes?.status === 0 ? false : undefined;
+        const resolved = floorGit(cwd, ["config", "--get-regexp", "^remote\\..*\\.gh-resolved$"]);
+        if (resolved === undefined) return undefined;
+        if (resolved.status === 1) return true;
+        if (resolved.status !== 0 || typeof resolved.stdout !== "string") return undefined;
+        return resolved.stdout.trim().split("\n").every(line => line.trim().split(/\s+/)[1] === "base");
+      },
+      currentBranch: cwd => { const found = floorGit(cwd, ["symbolic-ref", "-q", "--short", "HEAD"]); return found?.status === 0 && typeof found.stdout === "string" && found.stdout.trim() ? found.stdout.trim() : undefined; },
+    };
+  };
+  const acpActionGate = (peer: PeerId) => actionGate({ budgets: actionBudgets, policy: () => config.action_policy, root: executionRoot, floor: floorFacts,
     task: p => board.list("in_progress").find(t => t.owner === p), publicView: task => tasks.publicView(task), isPrivate: p => !!turns.get(p)?.private || contextPii(p),
     nameable: text => tasks.nameable(text) }, peer);
   // A peer is enforceable only where the hub sees the call before it runs, in the mode it runs in now; anything else says why, never a silent claim.
@@ -3918,6 +4164,14 @@ export async function startDaemon(opts: DaemonOptions) {
   const nativeUnattended = (peer: string): boolean => startingUnattended.get(peer) ?? unattendedPeers.has(peer);
   const permissions = new Map<string, { push: string; peer: string; tool?: string; createdAt: number; expiresAt: number; done: (optionId: string | undefined, surface?: "console" | "dashboard" | "terminal", reason?: "expired" | "cancelled") => boolean }>();
   let stopping = false;
+  /** Read the default branch for the floor. A newer policy or a stop makes an older read's answer void, and a failed read leaves the branch unknown (every push asks). */
+  const refreshFloorFacts = async (): Promise<void> => {
+    const generation = ++floorGeneration;
+    if (config.action_policy?.floor !== true || !shellProjectRepository) { floorDefaultBranch = undefined; return; }
+    const found = await (opts.shellDefaultBranchProbe ?? readTaskShellDefaultBranch)(opts.cwd, hostShellEnvironment({ PATH: hostShellPath(opts.cwd, opts.cwd) ?? "" }), () => !stopping && generation === floorGeneration, opts.cwd, shellProjectRepository).catch(() => undefined);
+    if (generation === floorGeneration) floorDefaultBranch = found;
+  };
+  void refreshFloorFacts();
   const roomInvocations: RoomInvocations = new RoomInvocations({ bus, ledger: invocations, shares: () => readShare(config.invocation?.share), identity: (peer, sender) => roomChat.invocationIdentity(peer, sender),
     target: async (input, request) => { await invokeCapability(input.remotePeer, { peer: input.envelope.to, capability: request.capability, args: request.args }, false, () => { if (!input.current()) throw new PreEffectToolRefusal("remote invocation authority changed"); }, { ...input, request }); },
     safeResult: async (body, current) => {
@@ -4014,6 +4268,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (tasks.autoPullsPending() !== 0) return false; // #785 P1c: an automatic backlog pull mid-admission would write after the commit's digest; its own line keeps the line above exact for scripts/seeds.json
     if (tasks.queuePressureRechecksPending() !== 0) return false;
     if (tasks.schedulesPending() !== 0) return false; // #512a: a scheduled run mid-admission (its PII screen is awaited) would write after the commit's digest; the hold fence refuses its write, and this waits for it to end
+    if (tasks.studiesPending() !== 0) return false;
     if (!recoveryPeerSnapshot) return true;
     const current = recoveryPeers();
     return recoveryPeerSnapshot.every((saved) => {
@@ -4163,7 +4418,11 @@ export async function startDaemon(opts: DaemonOptions) {
       return row;
     });
     const budgetState = budget.persistedPauseDigestRows().sort((a, b) => a.peer.localeCompare(b.peer));
-    return { queues, manualPaused: [...manualPaused].sort(), boardDigest: digest(boardState), budgetDigest: digest(budgetState), ...(allExternalInstanceIds().length ? { externalBindingsDigest: digest(allExternalInstanceIds().sort().map(id => [id, (externalRefusedRows.has(id) ? externalBindings.get(id) : retainedExternalBinding(id)) ?? null])) } : {}) };
+    const research = board.researchIntegrity();
+    const researchDispatch = board.researchDispatchIntegrity();
+    const researchExperiments = board.researchExperimentsIntegrity();
+    const researchComparisons = board.researchComparisonIntegrity();
+    return { queues, manualPaused: [...manualPaused].sort(), boardDigest: digest(boardState), budgetDigest: digest(budgetState), ...(research.campaigns || research.units ? { research } : {}), ...(researchDispatch.activations || researchDispatch.handoffs ? { researchDispatch } : {}), ...(researchExperiments.protocols || researchExperiments.attempts || researchExperiments.events || researchExperiments.observations ? { researchExperiments } : {}), ...(researchComparisons.plans || researchComparisons.approvals || researchComparisons.contexts ? { researchComparisons } : {}), ...(allExternalInstanceIds().length ? { externalBindingsDigest: digest(allExternalInstanceIds().sort().map(id => [id, (externalRefusedRows.has(id) ? externalBindings.get(id) : retainedExternalBinding(id)) ?? null])) } : {}) };
   };
   /** The integrity in the shape `expected` was recorded in: the current one unless only an older shape matches. */
   const integrityAs = (expected: unknown) => {
@@ -4331,6 +4590,7 @@ export async function startDaemon(opts: DaemonOptions) {
   board.onChange = (task, entry) => {
     try { taskChanged?.(task, entry); }
     finally {
+      try { handoffNotifyOrigin(task, entry); } catch { /* never throw after a board write */ }
       try { settleSupersededDeliveries(); }
       finally { writeStatus(); } // committed task transitions refresh token-free attention even without bus activity
     }
@@ -4826,7 +5086,8 @@ export async function startDaemon(opts: DaemonOptions) {
     } else {
       log(`msg ${e.env.from} -> ${e.env.to?.join(",") ?? "*"} ${e.env.priority} hop=${e.env.hop}${e.dropped ? ` NOT DELIVERED(${e.dropped})` : ""}: ${e.env.body.slice(0, 200)}`);
       const env = e.env;
-      event({ type: "envelope", id: env.id, from: env.from, ...(env.to ? { to: env.to } : {}), priority: env.priority, hop: env.hop, ...(env.kind ? { kind: env.kind } : {}), ...(env.refs?.task ? { task: env.refs.task } : {}), ...(env.private ? {} : { bytes: Buffer.byteLength(env.body) }), ...(env.private ? { private: true } : {}), ...(e.dropped ? { dropped: e.dropped } : {}) });
+      const origin = takeOrigin(env.id) ?? adapterOrigin(env);
+      event({ type: "envelope", id: env.id, from: env.from, ...(origin ? { origin } : {}), ...(env.to ? { to: env.to } : {}), priority: env.priority, hop: env.hop, ...(env.kind ? { kind: env.kind } : {}), ...(env.refs?.task ? { task: env.refs.task } : {}), ...(env.private ? {} : { bytes: Buffer.byteLength(env.body) }), ...(env.private ? { private: true } : {}), ...(e.dropped ? { dropped: e.dropped } : {}) });
     }
     if (!stopping) writeStatus();
   });
@@ -6443,6 +6704,7 @@ export async function startDaemon(opts: DaemonOptions) {
     return JSON.stringify(before) === JSON.stringify(after) ? [] : [prefix];
   }
   function declaredPaths(value: unknown, prefix = ""): string[] {
+    if (prefix === "_autonomy" || prefix.startsWith("_autonomy.")) return [];
     // Retired dictionaries never enter active publication; hub ids remain opaque keys.
     if (prefix === "routing.targets" || prefix === "routing.routes") return [];
     if (prefix === "routing.hub_routes") return [prefix];
@@ -6627,7 +6889,7 @@ export async function startDaemon(opts: DaemonOptions) {
         if (change.applies === "restart" || change.key === "roles" || change.key.startsWith("roles.")) continue;
         putConfig(config, change.key, change.after);
       }
-      if (changes.some(change => change.key === "action_policy" || change.key.startsWith("action_policy."))) actionBudgets.policyChanged();
+      if (changes.some(change => change.key === "action_policy" || change.key.startsWith("action_policy."))) { actionBudgets.policyChanged(); void refreshFloorFacts(); }
       if (rolesChanged) { policyRoles = structuredClone(prepared.running.roles); settlePlanner(); }
       for (const change of changes.filter(change => change.key === "permission_modes" || change.key.startsWith("permission_modes."))) {
         for (const peer of change.key === "permission_modes" ? SUPPORTED_PEERS : [change.key.split(".")[1]!]) changedPermissionDefaults.add(peer);
@@ -6636,6 +6898,7 @@ export async function startDaemon(opts: DaemonOptions) {
       config.retired = prepared.running.retired;
       for (const line of config.retired ?? []) if (!priorRetired.has(line)) log(`config: ${line}`);
       config.permission_default_sources = candidate.permission_default_sources;
+      refreshAutonomyConsent(prepared.fileConfig);
       for (const peer of changedPermissionDefaults) applyPendingPermissionDefault(peer);
       if (changes.some(change => change.key === "task_sweep" || change.key.startsWith("task_sweep."))) rescheduleSweep();
       if (changes.some(change => change.key === "schedules" || change.key.startsWith("schedules.") || change.key === "folder_triggers" || change.key.startsWith("folder_triggers."))) rescheduleSchedules();
@@ -6774,7 +7037,10 @@ export async function startDaemon(opts: DaemonOptions) {
       if (stopping || recoveryActive()) return { ok: false, error: "recovery or shutdown is holding roster changes" };
       rosterChanging = peer;
       if (undo) undoSetting(opts.cwd, opts.stateDir, scratch => configWriteCheck(scratch, authority, `roster.${peer}`), (_routing, overlay) => routingWriteCheck(authority, overlay), undoIdentity);
-      else writeConfigSetting(opts.cwd, opts.stateDir, def, value, scratch => configWriteCheck(scratch, authority, `roster.${peer}`), {preserveUndo:authority==="conductor"});
+      else {
+        const written = writeConfigSetting(opts.cwd, opts.stateDir, def, value, scratch => configWriteCheck(scratch, authority, `roster.${peer}`), {preserveUndo:authority==="conductor"});
+        if (written && authority !== "conductor") autonomyUndoWitness.clear();
+      }
       // Apply exactly the authorized key. Other file edits stay pending until the next hub start.
       config.roster = next;
       settlePlanner(); // #455: an automatic planner follows the roster
@@ -6795,9 +7061,10 @@ export async function startDaemon(opts: DaemonOptions) {
         checkOperational(authority);
         const mode = config.permission_modes[peer] ?? "ask";
         permissionModes.set(peer, mode === "never-ask" ? "ask" : mode);
+        if (mode === "never-ask" && autonomyConfirmed.has(peer)) permissionModes.set(peer, mode);
         permissionModeSources.set(peer, defaultSources[peer]?.source ?? "embedded configuration");
         pendingPermissionDefaults.delete(peer);
-        if (mode === "never-ask") pendingPermissionDefaults.set(peer, defaultSources[peer]?.source ?? "embedded configuration");
+        if (mode === "never-ask" && !autonomyConfirmed.has(peer)) pendingPermissionDefaults.set(peer, defaultSources[peer]?.source ?? "embedded configuration");
         const handoffCurrent = authority === "conductor" ? operationalContext.getStore()!.current : undefined;
         handoff = await tasks.reassignForRoster(peer, handoffCurrent);
       } else {
@@ -6878,6 +7145,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const next = writeRoutingSetting(opts.cwd, opts.stateDir, def, value, (_routing, overlay) => routingWriteCheck(authority, overlay, def.key));
         if (!next) return { ok: true, text: `${def.key}: ${OVERLAY_FILE} already ${value === null ? "leaves it unset" : `holds ${settingText(value)}`}; nothing was written` };
         saved = true;
+        if (authority !== "conductor") autonomyUndoWitness.clear();
         const result = await reloadConfig(authority, def.key);
         if (result.ok !== true) return { ...result, saved: true };
         recordSetting(def.key, from, routingValue(activeRouting(), def), source, false, reason);
@@ -6887,6 +7155,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const from = settingScalar(valueAt(storedConfig(), def.path));
       if (!writeConfigSetting(opts.cwd, opts.stateDir, def, value, scratch => configWriteCheck(scratch, authority, def.path.join(".")), {preserveUndo:authority==="conductor"})) return { ok: true, text: `${def.key}: config.local.json already ${value === null ? "leaves it unset" : `holds ${settingText(value)}`}; nothing was written` };
       saved = true;
+      if (authority !== "conductor") autonomyUndoWitness.clear();
       const result = await reloadConfig(authority, def.path.join("."));
       if (result.ok !== true) return { ...result, saved: true };
       const to = settingScalar(valueAt(storedConfig(), def.path));
@@ -6902,6 +7171,132 @@ export async function startDaemon(opts: DaemonOptions) {
     }
   }
 
+  function autonomyPeers(): AutonomyPeer[] {
+    return SUPPORTED_PEERS.map(id => {
+      const setting = settingDef(`permission_modes.${id}`), definition = definitionOf(id), owner = bus.peers.get(id);
+      const lockedMode = typeof setting !== "string" && setting.locked ? setting.values?.[0] : undefined;
+      const form = owner?.form ?? startMode(id);
+      const unmanaged = definition?.permission.unmanaged || definition?.permission.unmanagedForms?.includes(owner ? owner.form ?? "tui" : form);
+      return { id, kind: definition?.kind ?? id, unmanaged: !!definition?.permission.unmanaged, ...(lockedMode ? { lockedMode } : {}), form,
+        permissionMode: unmanaged && !lockedMode ? "unmanaged" : permissionDisplay(id, owner), actionEnforcement: actionEnforcement(id) };
+    });
+  }
+  function autonomyOperations(environment: AutonomyEnvironment) {
+    return planAutonomy(environment, key => {
+      const def = settingDef(key);
+      return typeof def === "string" || def.store !== "config" ? undefined : { store: def.store, values: def.values, locked: def.locked };
+    }, autonomyPeers()).map(operation => {
+      const def = settingDef(operation.key);
+      if (typeof def !== "string") checkSettingValue(def, operation.value);
+      return operation;
+    });
+  }
+  async function autonomyPublish(keys: string[]): Promise<Record<string, unknown>> {
+    for (const key of keys) {
+      const result = await reloadConfig("terminal", key);
+      if (result.ok !== true) return { ...result, saved: true };
+    }
+    return { ok: true };
+  }
+  async function autonomyUndo(authority: SettingAuthority, confirm: unknown, identity: UndoIdentity): Promise<Record<string, unknown>> {
+    if (authority !== "terminal" || confirm !== "autonomy") return { ok: false, error: "undoing project autonomy needs the person's terminal and the autonomy confirmation" };
+    let saved = false;
+    try {
+      if (!autonomyConsentLocationSafe() || !autonomyUndoWitness.confirmed(autonomyWitnessValues("undo", identity.undoDigest), true).has("undo")) {
+        const removed = await autonomyCommand("off", Object.keys(autonomyPreset().environments)[0], true);
+        return removed.ok === true ? { ...removed, text: "Preset undo witness did not verify; fell back to removing the preset keys and clearing retained consent." } : removed;
+      }
+      const keys = autonomyUndoKeys(opts.stateDir);
+      const restored = undoSetting(opts.cwd, opts.stateDir, scratch => { configWriteCheck(scratch, "terminal", AUTONOMY_UNDO.key); for (const key of keys) configWriteCheck(scratch, "terminal", key); }, undefined, identity);
+      saved = true;
+      try { if (autonomyConsentLocationSafe()) autonomyConsent.clear(); } finally { refreshAutonomyConsent(); }
+      ownAutonomyMetadata(restored.ownership); autonomyUndoWitness.clear();
+      const result = await autonomyPublish(keys);
+      if (result.ok !== true) return result;
+      recordSetting(AUTONOMY_UNDO.key, "preset change", "previous configuration", "terminal", true);
+      return { ok: true, text: "Project autonomy change undone; live keys apply now, permission and start defaults at the next peer start." };
+    } catch (error) {
+      for (const peer of changedPermissionDefaults) applyPendingPermissionDefault(peer);
+      return { ok: false, error: sanitize((error as Error).message), ...(saved ? { saved: true } : {}) };
+    }
+  }
+  let autonomyPreview: { token: string; environment: string; fingerprint: string; revision: number; operations: string } | undefined;
+  async function autonomyCommand(action: unknown, environment: unknown, confirmed: unknown, confirmation?: unknown): Promise<Record<string, unknown>> {
+    if (stopping || recoveryActive() || rosterChanging) return { ok: false, error: "recovery, shutdown or roster change is holding autonomy" };
+    if (typeof action !== "string" || typeof environment !== "string" || !Object.entries(autonomyPreset().environments).some(([name, row]) => name === environment || row.aliases.includes(environment)) || !["preview", "on", "off", "status"].includes(action)) return { ok: false, error: "invalid autonomy command or environment" };
+    let saved = false;
+    try {
+      const env = environment as AutonomyEnvironment;
+      const timing = (key: string) => { const def = settingDef(key); return typeof def !== "string" && def.applies === "next use" ? "next peer start" : typeof def !== "string" && def.applies === "restart" ? "next hub start" : "live"; };
+      if (action === "status") {
+        refreshAutonomyConsent();
+        for (const peer of changedPermissionDefaults) applyPendingPermissionDefault(peer);
+        const terminal = opener.available();
+        const peers = autonomyPeers();
+        const rows = autonomyStatus({ environment: env, peers, terminalOpener: terminal.ok ? { available: true, via: terminal.via } : { available: false, reason: terminal.why },
+          floorEnforcement: Object.fromEntries(peers.map(peer => [peer.id, floorEnforcement(config.action_policy, peer.actionEnforcement ?? { enforced: false })])) });
+        for (const row of rows) if (pendingPermissionDefaults.has(row.id)) row.missing.push("This never-ask default has no matching retained consent; confirm it in ahub console or run ahub autonomy on again.");
+        return { ok: true, status: { environment: env, consentedPeers: [...autonomyConfirmed], peers: rows }, lines: [`Project autonomy, environment: ${env}`, ...rows.flatMap(row => [`${row.id}: ${row.effectiveMode}; preset ${row.nextMode ?? "unmanaged"} at ${row.applies}`, ...row.floor.map(floor => `  ${floor.class}: ${floor.status}; ${floor.reason}`), ...row.missing.map(reason => `  missing: ${reason}`)])] };
+      }
+      const operations = action === "off" ? autonomyRemovalKeys(autonomyPeers()).map(key => ({ key, value: null, store: "config" as const })) : autonomyOperations(env);
+      if (action === "preview") {
+        autonomyPreview = { token: randomUUID(), environment: env, fingerprint: configFingerprint(configSourceTexts(opts.cwd)), revision: configRevision, operations: JSON.stringify(operations) };
+        return { ok: true, confirmation: autonomyPreview.token, lines: ["Project autonomy: approval prompts change; sandbox, deny, PII and trust rules remain. Check autonomy status for the current floor enforcement and missing guards.", autonomyPreset().about, ...operations.map(operation => `${operation.key}: ${settingText(operation.value)} (${timing(operation.key)})`), "Unmanaged native clients and missing structural guards are reported by autonomy status; the preset cannot enforce those paths."] };
+      }
+      if (action === "on" && confirmed !== true) return { ok: false, error: "project autonomy needs one person confirmation; use ahub autonomy on [--yes]" };
+      if (action === "on") {
+        if (!autonomyPreview || confirmation !== autonomyPreview.token || env !== autonomyPreview.environment || autonomyPreview.revision !== configRevision || autonomyPreview.operations !== JSON.stringify(operations) || autonomyPreview.fingerprint !== configFingerprint(configSourceTexts(opts.cwd))) return { ok: false, error: "autonomy preview is stale or missing; run ahub autonomy on again to review the current values" };
+        autonomyPreview = undefined;
+      }
+      // Off has a fixed shipped removal scope, independent of environment and untrusted ownership metadata.
+      const allowed = operations;
+      if (action === "on" && !autonomyConsentLocationSafe()) return { ok: false, error: "retained autonomy consent requires private hub state outside the project and execution roots" };
+      if (action === "off") { try { if (autonomyConsentLocationSafe()) autonomyConsent.clear(); } finally { refreshAutonomyConsent(); } }
+      refreshAutonomyConsent();
+      const renewConsentUndo = action === "on" && operations.some(operation => operation.key.startsWith("permission_modes.") && operation.value === "never-ask" && !autonomyConfirmed.has(operation.key.slice("permission_modes.".length)));
+      const result = writeAutonomyPreset(opts.cwd, opts.stateDir, action === "on", allowed, (scratch, keys) => { configWriteCheck(scratch, "terminal", AUTONOMY_UNDO.key); for (const key of keys) configWriteCheck(scratch, "terminal", key); }, metadata => {
+        try {
+          const digest = autonomyOwnershipDigest(metadata);
+          return !!digest && autonomyConsentLocationSafe() && autonomyOwnershipWitness.confirmed(autonomyWitnessValues("ownership", digest), true).has("ownership");
+        } catch { return false; }
+      }, renewConsentUndo);
+      saved = result.changed;
+      if (result.changed) {
+        if (action === "on") {
+          ownAutonomyMetadata(result.ownership);
+          if (result.undo) autonomyUndoWitness.confirm(autonomyWitnessValues("undo", result.undo.undoDigest));
+          else autonomyUndoWitness.clear();
+        } else {
+          // Private restoration metadata cannot veto the person's off switch either.
+          try { ownAutonomyMetadata(null); } catch { /* Invalid state is never restoration authority. */ }
+          try { if (result.undo) autonomyUndoWitness.confirm(autonomyWitnessValues("undo", result.undo.undoDigest)); else autonomyUndoWitness.clear(); } catch { /* Undo will use the safe removal fallback. */ }
+        }
+        const published = await autonomyPublish(result.keys);
+        if (published.ok !== true) return published;
+        recordSetting(AUTONOMY_UNDO.key, action === "on" ? "off" : "on", action, "terminal", false);
+      }
+      if (action === "off" && autonomyConsentLocationSafe()) { try { autonomyOwnershipWitness.clear(); } catch { /* Off does not depend on restoration metadata. */ } }
+      if (action === "on") {
+        if (!autonomyConsentTrusted()) throw new Error("config.local.json trust changed; retained consent was not issued");
+        const fileConfig = loadConfig(opts.cwd, undefined, undefined, externalDefinitions);
+        validateEffectiveConfig(fileConfig, adapterCatalog);
+        const current = autonomyConsentValues(fileConfig);
+        const retained = autonomyConsent.confirmed(current, true);
+        const approved: AutonomyConsentValues = Object.fromEntries([...retained].map(peer => [peer, current[peer]!]));
+        for (const operation of operations) if (operation.key.startsWith("permission_modes.") && operation.value === "never-ask") {
+          const peer = operation.key.slice("permission_modes.".length);
+          if (current[peer]) approved[peer] = current[peer]!;
+        }
+        try { autonomyConsent.confirm(approved); } finally { refreshAutonomyConsent(); }
+      }
+      for (const peer of changedPermissionDefaults) applyPendingPermissionDefault(peer);
+      return { ok: true, lines: [`Project autonomy ${action}: ${result.changed ? "saved" : "unchanged"}. ahub settings undo restores the complete last write.`, ...result.keys.map(key => `${key}: ${timing(key)}`), ...result.preserved.map(key => `${key}: kept the later manual edit`)] };
+    } catch (error) {
+      if (action === "off") for (const peer of changedPermissionDefaults) applyPendingPermissionDefault(peer);
+      return { ok: false, error: sanitize((error as Error).message), ...(saved ? { saved: true } : {}) };
+    }
+  }
+
   async function settingsUndo(authority: SettingAuthority, confirm?: unknown, now?: unknown, rawReason?: unknown, expectedKey?: unknown, expectedDigest?: unknown): Promise<Record<string, unknown>> {
     if (stopping || recoveryActive()) return { ok: false, error: "recovery or shutdown is holding settings" };
     let reason: string | undefined;
@@ -6915,6 +7310,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
     const def = undoableDef(identity?.key);
     if (typeof def === "string" || !identity) return { ok: false, error: "nothing to undo" };
+    if (def === AUTONOMY_UNDO) return autonomyUndo(authority, confirm, identity);
     if (def.managed && authority !== "terminal") return { ok: false, error: `${def.key} was written by ahub learn accept: put it back with ahub settings undo in a terminal` };
     if (def.group === "Roster") return changeRosterSetting(def, null, settingSource(authority), confirm, now === true, true, authority, reason, identity);
     if (rosterChanging) return { ok: false, error: `roster change for ${rosterChanging} is in progress` };
@@ -6971,6 +7367,7 @@ export async function startDaemon(opts: DaemonOptions) {
   function settingsUndoPreview(): Record<string, unknown> {
     const identity = pendingUndoIdentity(opts.stateDir), def = undoableDef(identity?.key);
     if (typeof def === "string" || !identity) return { ok: false, error: "nothing to undo" };
+    if (def === AUTONOMY_UNDO) return { ok: true, ...identity, lines: ["Undo the complete project autonomy change when its private witness verifies; otherwise remove the fixed preset keys and clear consent. Type autonomy to confirm; modes at peer start and existing live keys keep their apply timing."] };
     if (def.managed) return { ok: true, ...identity, lines: [`Undo ${def.key}: put back the previous machine-local file (the review checklist ahub learn accept changed; its lines are not shown here)`, "The saved previous machine-local file is revalidated before writing."] };
     const value = restoredValue(opts.cwd, opts.stateDir, def), preview = settingsPreview(def.key, value ?? null);
     if (pendingUndoIdentity(opts.stateDir)?.undoDigest !== identity.undoDigest) return { ok: false, error: "undo record changed during preview; preview again" };
@@ -7130,6 +7527,7 @@ export async function startDaemon(opts: DaemonOptions) {
       ...(tasks.autoPullsPending() !== 0 ? ["an automatic backlog pull in flight"] : []),
       ...(tasks.queuePressureRechecksPending() !== 0 ? ["a queue-pressure assignment recheck in flight"] : []),
       ...(tasks.schedulesPending() !== 0 ? ["a scheduled task proposal in flight"] : []),
+      ...(tasks.studiesPending() !== 0 ? ["a research campaign admission in flight"] : []),
       ...(checkPending.size !== 0 ? ["isolated checks queued or running"] : []),
       ...(piCallsInFlight() !== 0 ? ["Pi tool calls in flight"] : []),
       ...(releasing ? ["ready tasks being released"] : []),
@@ -7171,6 +7569,74 @@ export async function startDaemon(opts: DaemonOptions) {
         && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("task_planners"))) return "target lacks task_planners; configured or persisted planner authority cannot be restored by that daemon";
       if (board.releases().some(release => release.train && ["active", "frozen"].includes(release.state)) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("release_trains"))) return "target lacks release_trains; active or frozen train safeguards cannot be preserved";
       if ((extraIds.some(id => !!definitionOf(id)?.reviewer) || config.review.pool !== undefined) && (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("reviewer_pool"))) return "target lacks reviewer_pool; fresh review-only variants and pool policy cannot be preserved";
+      if (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("research_records")) {
+        if (board.hasResearchState()) return "target lacks research_records; persisted research campaign records require a supporting daemon";
+        let namesRunners = false;
+        try {
+          const texts = configSourceTexts(opts.cwd);
+          for (const name of CONFIG_FILES) {
+            if (texts[name] === null) continue;
+            const raw: unknown = JSON.parse(texts[name]!);
+            if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("invalid configuration");
+            const research = (raw as Record<string, unknown>).research;
+            if (research !== undefined && (!research || typeof research !== "object" || Array.isArray(research))) throw new Error("invalid research configuration");
+            namesRunners ||= research !== undefined && Object.hasOwn(research, "runners");
+          }
+        } catch { return "research_records compatibility is unknown; configuration could not be read"; }
+        // Raw presence matters even for a disabled or ignored shared declaration: an older target parses the unknown key first.
+        if (namesRunners) return "target lacks research_records; the project's research.runners cannot be loaded by that daemon";
+      }
+      if ((!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("research_dispatch")) && board.hasResearchDispatchState())
+        return "target lacks research_dispatch; persisted campaign stop policies and handoffs require a supporting daemon";
+      if ((!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("research_dropped_offers")) && board.hasResearchDroppedOffers())
+        return "target lacks research_dropped_offers; persisted study re-offers require a supporting daemon";
+      // agent-hub#1036: an unsettled delivery that holds a distinct session's message is an envelope with `session: true` and a minted `<peer>~<id>` sender. A target without the feature
+      // would read that sender as a peer it does not know and queue a reply to it; this is its own label, so a daemon that has the older floors but not this one is still refused.
+      if ((!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("session_identity")) && bus.queueList(undefined, true).some(row => (row.originals as Envelope[]).some(env => env.session === true)))
+        return "target lacks session_identity; unsettled deliveries hold messages from distinct sessions that require a supporting daemon";
+      // #604: a handoff row in either direction (a task another project handed us, or one we handed over) needs a target that knows `task_handoff`; without it the origin is silently lost.
+      if ((!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("task_handoff")) && board.hasHandoffState())
+        return "target lacks task_handoff; stored handoffs require a supporting daemon";
+      if ((!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("research_experiments")) && board.hasResearchExperimentState())
+        return "target lacks research_experiments; persisted experiment records require a supporting daemon";
+      if ((!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("research_comparisons")) && board.hasResearchComparisonState())
+        return "target lacks research_comparisons; persisted comparison plans, approvals or protocol context require a supporting daemon";
+      if (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("project_autonomy")) {
+        let needsAutonomy = autonomyConfirmed.size > 0;
+        try {
+          const texts = configSourceTexts(opts.cwd);
+          needsAutonomy ||= CONFIG_FILES.some(name => texts[name] !== null && Object.hasOwn(JSON.parse(texts[name]!), "_autonomy"));
+        } catch { return "project autonomy compatibility is unknown; configuration could not be read"; }
+        if (needsAutonomy) return "target lacks project_autonomy; project preset metadata and retained mode consent require a supporting daemon";
+      }
+      // #999 T3: a target without the floor key rejects `action_policy.floor` as an unknown key, so the project would fail to load there. The check is the key's presence in the project's file, true or false:
+      // `floor: false` is just as unknown to an older target, and a disabled policy still names it.
+      // The raw files decide, not the effective config: a shared `config.json` that names `action_policy.floor` is ignored (the key is machine-local) but an older target's parser rejects it
+      // before that rule runs, and a `floor: false` is normalized away. Unreadable files are unknown, never absent.
+      if (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("action_policy_floor")) {
+        let namesFloor = config.action_policy?.floor !== undefined;
+        try {
+          const texts = configSourceTexts(opts.cwd);
+          namesFloor ||= CONFIG_FILES.some(name => {
+            const policy = texts[name] === null ? undefined : (JSON.parse(texts[name]!) as Record<string, unknown>).action_policy;
+            return !!policy && typeof policy === "object" && Object.hasOwn(policy, "floor");
+          });
+        } catch { return "action_policy_floor compatibility is unknown; configuration could not be read"; }
+        if (namesFloor) return "target lacks action_policy_floor; the project's action_policy.floor cannot be loaded by that daemon";
+      }
+      // #1017: an older target refuses a `cron` or `tz` key in a `schedules` entry ("cron not supported yet"), so the project would not load there. The raw files decide, as for the floor: a calendar
+      // entry in either file, even one an ordinary reload would reject, names the key; unreadable files are unknown, never absent.
+      if (!Array.isArray(msg.targetFeatures) || !msg.targetFeatures.includes("calendar_schedules")) {
+        let namesCalendar = config.schedules.some(entry => entry.cron !== undefined || entry.tz !== undefined);
+        try {
+          const texts = configSourceTexts(opts.cwd);
+          namesCalendar ||= CONFIG_FILES.some(name => {
+            const list = texts[name] === null ? undefined : (JSON.parse(texts[name]!) as Record<string, unknown>).schedules;
+            return Array.isArray(list) && list.some(entry => !!entry && typeof entry === "object" && (Object.hasOwn(entry, "cron") || Object.hasOwn(entry, "tz")));
+          });
+        } catch { return "calendar_schedules compatibility is unknown; configuration could not be read"; }
+        if (namesCalendar) return "target lacks calendar_schedules; the project's schedules use cron or tz, which that daemon cannot load";
+      }
       return undefined;
     };
     const checkTarget = msg.op === "prepare" || msg.op === "commit" || msg.op === "inspect" && msg.targetFeatures !== undefined;
@@ -7453,12 +7919,22 @@ export async function startDaemon(opts: DaemonOptions) {
       c.authed = true;
       c.role = msg.role;
       if (c.role === "console") consoles.add(sock);
+      else if (c.role === "tools" && sessionHello(msg)) {
+        // agent-hub#1036: a connection that names a peer id but is not that peer's current session gets an id of its own instead of becoming the peer. It can send and read; it holds none of the
+        // peer's board roles, is never a bus peer (no delivery, no push) and replaces nobody. Nothing is refused: a hello that worked before still works, as a session.
+        const named = String(msg.peer ?? "");
+        if (!PEER_ID.test(named) || named === USER || named === "hub") return sock.close(4403, "peer id is reserved or malformed");
+        c.peer = mintSessionId(named, msg.session, id => sessionIds.has(id) || bus.peers.has(id), () => crypto.randomUUID().slice(0, 6));
+        c.session = true; sessionIds.add(c.peer);
+        if (typeof msg.launchId === "string" && msg.launchId.length <= 128) c.launchId = msg.launchId;
+      }
       else if (c.role === "tools") {
         // Acts for a peer the hub manages itself (kimi, codex): may send and use the board as that peer, is never a delivery target.
         c.peer = String(msg.peer ?? "");
         if (!PEER_ID.test(c.peer) || c.peer === USER || c.peer === "hub") return sock.close(4403, "peer id is reserved or malformed");
         if (externalRefusedRows.has(c.peer)) return sock.close(4403, "instance kind is unavailable in the startup catalog");
         if (!membershipAllowed(c.peer)) return sock.close(4000, "peer is off roster; retry when a person adds it");
+        if (typeof msg.launchId === "string" && msg.launchId.length <= 128) c.launchId = msg.launchId;
         if (definitionOf(c.peer)?.start.daemonPort === "claude-implementer") {
           const owner = bus.peers.get(c.peer), launch = owner?.ownedTools?.(msg.launchId), root = ownerWriteRoot(c.peer);
           if (!owner || !launch || launch.signal.aborted || !root || root === opts.cwd || typeof msg.launchId !== "string") return sock.close(4403, "this process is not the current Claude child");
@@ -7525,7 +8001,9 @@ export async function startDaemon(opts: DaemonOptions) {
           if (important) ws.notifyQueued({ queued: bus.queued(c.peer!), important });
         });
       }
-      return void reply({ t: "welcome", projectId, instanceId, cwd: opts.cwd, protocol: PROTOCOL, features: DAEMON_FEATURES });
+      // #604 PR B: one attach event per admitted peer or tools hello, with the same fields an envelope's `origin` carries. A refused hello returned above and writes none.
+      if (c.role === "peer" || c.role === "tools") event(attachEvent({ role: c.role, peer: c.peer, launchId: c.launchId, ...(c.session ? { session: true } : {}) }));
+      return void reply({ t: "welcome", projectId, instanceId, cwd: opts.cwd, protocol: PROTOCOL, features: DAEMON_FEATURES, ...(c.session ? { session: c.peer } : {}) });
     }
     const committedSourceProof = c.role === "tools" && msg.t === "recovery_authority" && msg.op === "verify" && recoveryCommitted
       && msg.binding?.operationId === recoveryOperationId && msg.binding?.sourceInstanceId === instanceId;
@@ -7533,6 +8011,11 @@ export async function startDaemon(opts: DaemonOptions) {
     if (c.role !== "console" && c.peer && !membershipAllowed(c.peer)) return void reply({ ok: false, error: `${c.peer} is off roster` });
     if (c.externalOwner && !currentExternalTools(c)) return void reply({ ok: false, error: "external instance launch or execution root changed" });
     if (c.toolsOwner && !currentImplementerTools(c)) return void reply({ ok: false, error: "Claude child generation or execution root changed" });
+    if (c.session) {
+      // agent-hub#1036: a distinct session sends and reads, and nothing else. The gate runs before any case, so a new control message is refused to a session unless it is added to the list.
+      const refusal = sessionGate(c.peer!, msg);
+      if (refusal) return void reply({ t: msg.t, ok: false, error: refusal });
+    }
     switch (msg.t) {
       case "request_cancel": {
         if (!Number.isSafeInteger(msg.request) || msg.request < 1) return void reply({ t: "request_cancel", ok: false, error: "invalid request id" });
@@ -7905,6 +8388,8 @@ export async function startDaemon(opts: DaemonOptions) {
         }
         // Built first: limits count the audience it really has (a reply goes to the parent's sender).
         let env = newEnvelope(c.peer ?? USER, body, { priority, ...(to ? { to } : {}), ...(inReplyTo ? { inReplyTo } : {}) });
+        if (c.session) env = { ...env, session: true };   // agent-hub#1036: sent by a distinct session; `from` is its minted id, and the header a recipient reads shows it as is
+        rememberOrigin(env.id, originOf({ role: c.role, peer: c.peer, launchId: c.launchId, ...(c.session ? { session: true } : {}) })); // the connection that sent it, for events.jsonl (never a path or text)
         try { bus.checkRemotePublication(env); }
         catch (error) { return void reply({ t: "sent", ok: false, error: error instanceof Error && /^(?:room|remote) /.test(error.message) ? sanitize(error.message).slice(0, 8192) : "message admission unavailable" }); }
         const offRoster = bus.offRosterRecipients(env);
@@ -8029,7 +8514,7 @@ export async function startDaemon(opts: DaemonOptions) {
             const mode = permissionMode(peer);
             if (mode !== "ask" && mode !== "ask-when-needed") return void reply({ t: "facts", ok: false });
             const blocked = scopedWriteBlocked(phase, mode, msg.tool, () => projectFileTool(msg.tool, msg.input, root, config.protect_instruction_files, config.data?.readonly));
-            const actionClasses = phase === "pre" && typeof msg.tool === "string" ? claudeActionClasses(actionBudgets, msg.tool, msg.input, root) : [];
+            const actionClasses = phase === "pre" && typeof msg.tool === "string" ? claudeActionClasses(actionBudgets, msg.tool, msg.input, root, floorFacts(peer)) : [];
             return void reply({ t: "facts", ok: true, ...(phase === "pre" ? { permission: mode === "ask-when-needed" && blocked ? "ask" : mode, projectRoot: root, protectInstructionFiles: config.protect_instruction_files, ...(actionClasses.length ? { actionClasses } : {}) } : {}) });
           }
           let nativeClaude = false, nativeTranscript: string | undefined;
@@ -8059,7 +8544,7 @@ export async function startDaemon(opts: DaemonOptions) {
           if (permission !== undefined && nativePeer) claudeLaunchProof.bindGeneration(peer, nativePeer.sessionGeneration);
           const protectedWrite = scopedWriteBlocked(phase, permission, msg.tool, () => projectFileTool(msg.tool, msg.input, writeRoot ?? opts.cwd, config.protect_instruction_files, config.data?.readonly));
           // Always-ask (#636): a classed call is asked about in every permission mode. The hub names only the classes, under the same verified root as the file policy above; the hook turns them into `ask`.
-          const actionClasses = phase === "pre" && permission !== undefined && typeof msg.tool === "string" ? claudeActionClasses(actionBudgets, msg.tool, msg.input, writeRoot ?? opts.cwd) : [];
+          const actionClasses = phase === "pre" && permission !== undefined && typeof msg.tool === "string" ? claudeActionClasses(actionBudgets, msg.tool, msg.input, writeRoot ?? opts.cwd, floorFacts(peer)) : [];
           const plannerOnly = !!declarations[peer] && definitionOf(peer)?.transport === "claude-channel" && isPlannerOnly(config.roles[peer] ?? []);
           // Older hooks do not know mutationGrants; the existing permission field must also withhold their mutation grant.
           const plannerMutation = plannerOnly && !["Read", "LS", "Glob", "Grep"].includes(tool);
@@ -8424,6 +8909,10 @@ export async function startDaemon(opts: DaemonOptions) {
         if (recoveryActive() || stopping) return void reply({ ok: false, error: "recovery or shutdown is holding task role changes" });
         try { const task = tasks.setRole(c.role === "console" ? USER : c.peer!, msg.id, msg.role); return void reply({ ok: true, text: `task #${task.id}: catalog role ${task.role ?? "none"}` }); }
         catch (error) { return void reply({ ok: false, error: (error as Error).message }); }
+      case "autonomy":
+        if (c.role !== "console") return void reply({ ok: false, error: "autonomy is a person-only command; run ahub autonomy in a person's terminal" });
+        void autonomyCommand(msg.action, msg.environment, msg.confirmed, msg.confirmation).then(reply, () => reply({ ok: false, error: "project autonomy could not be changed" }));
+        return;
       case "settings_get":
         if (c.role !== "console") {
           try { const current = publicReadCurrent(sock); current(); const view = publicSettingsView(); current(); return void reply({ ok: true, ...view }); }
@@ -8519,6 +9008,8 @@ export async function startDaemon(opts: DaemonOptions) {
           try { const current = publicReadCurrent(sock); current(); const release = publicReleaseShow(msg.args ?? {}); current(); return void reply({ t: "task", ok: true, text: JSON.stringify(release) }); }
           catch { return void reply({ t: "task", ok: false, error: "public release read unavailable" }); }
         }
+        // #601: ahub study is the person's. A tools connection (any agent) may use the hub_study_* tools, never these op names, whatever Tasks would answer.
+        if (String(msg.op).startsWith("study_") && c.role !== "console") return void reply({ t: "task", ok: false, error: "ahub study draft, revise, approve and close are console commands; agents use the hub_study_* tools" });
         if (c.toolsOwner && !IMPLEMENTER_HUB_TOOL_NAMES.includes(String(msg.op))) return void reply({ t: "task", ok: false, error: "tool is not available to this Claude implementer child" });
         if (recoveryActive() && recoveryPhase !== "preparing" && String(msg.op) !== "hub_checkpoint") return void reply({ t: "task", ok: false, error: "recovery is holding mutations" });
         if (c.role === "tools" && c.peer && Object.hasOwn(CONDUCTOR_TASK_OPS, String(msg.op))) {
@@ -8690,6 +9181,32 @@ export async function startDaemon(opts: DaemonOptions) {
         // Let the acknowledgement flush before closing the control listener.
         setTimeout(() => void stop().catch((error) => log(`shutdown incomplete: ${(error as Error).message}`)), 0);
         return;
+      // #604 (agent-hub#1030): another project's daemon hands us a task, or reports a state change of one we handed it. Console role only (the same token and the same machine user as every
+      // control message): an agent connection never reaches these. The origin peer named in the request is a record, never an identity here, and nothing in it grants a role.
+      case "task_handoff": {
+        if (c.role !== "console") return void reply({ t: "task_handoff", ok: false, error: "a handoff comes from another project's hub, not from an agent connection" });
+        if (recoveryActive()) return void reply({ t: "task_handoff", ok: false, error: "recovery is holding mutations; hand the task off again after it ends" });
+        // Counted like a task op: a recovery commit waits for it (`recoveryReady` reads `taskOpsInFlight`), and the fence is asked again right before the board write, after the PII screen.
+        taskOpsInFlight++;
+        const recoveryFence = (): string | undefined => recoveryActive() || stopping ? "recovery or shutdown is holding mutations; hand the task off again after it ends" : undefined;
+        void tasks.handoffIn(msg.origin ?? {}, msg.request, recoveryFence).then(
+          result => reply({ t: "task_handoff", ok: true, ...result }),
+          error => reply({ t: "task_handoff", ok: false, error: error instanceof HandoffRefusal ? error.message : "the handoff was refused" })).finally(() => { taskOpsInFlight--; });
+        return;
+      }
+      case "task_handoff_event": {
+        if (c.role !== "console") return void reply({ t: "task_handoff_event", ok: false, error: "a handoff event comes from another project's hub, not from an agent connection" });
+        try { reply({ t: "task_handoff_event", ok: true, ...tasks.handoffEvent(msg.event) }); }
+        catch (error) { reply({ t: "task_handoff_event", ok: false, error: error instanceof HandoffRefusal ? error.message : "the handoff event was refused" }); }
+        return;
+      }
+      case "task_handoff_states": {
+        // #604: the origin asks, after a restart, where the tasks it handed us stand now. Console role only, and only for tasks whose recorded origin is the asking project.
+        if (c.role !== "console") return void reply({ t: "task_handoff_states", ok: false, error: "a handoff state request comes from another project's hub, not from an agent connection" });
+        try { reply({ t: "task_handoff_states", ok: true, states: tasks.handoffStatesFor(msg.projectId, msg.tasks) }); }
+        catch (error) { reply({ t: "task_handoff_states", ok: false, error: error instanceof HandoffRefusal ? error.message : "the handoff state request was refused" }); }
+        return;
+      }
       default:
         // A newer CLI talking to an older hub must get an answer, not wait forever.
         if (msg.rid !== undefined) reply({ t: String(msg.t), ok: false, error: `this hub does not know "${msg.t}" (restart it: ahub kill && ahub up)` });
@@ -8708,6 +9225,7 @@ export async function startDaemon(opts: DaemonOptions) {
     stopping = true;
     roomCommands.stop();
     tasks.stopQueuePressureRechecks();
+    const studiesStopped = tasks.stopStudies();
     let implementerShellCleanupFailed = false;
     const implementerShellStopped = implementerShellStart?.then(wrapper => wrapper.close()).catch(() => { implementerShellCleanupFailed = true; log("host shell cleanup failed during shutdown"); });
     terminalLaunches.clear();
@@ -8730,11 +9248,11 @@ export async function startDaemon(opts: DaemonOptions) {
     for (const pending of checkpointWaits.values()) pending.done(undefined);
     for (const p of permissions.values()) p.done(undefined);
     try {
-      // A schedules pass may be inside its PII screen: `stopping` is set, so its fence refuses the write when the screen returns. Wait for it (bounded, the screen has
-      // its own timeout) before the peers stop, the board closes and the store closes, so no pass runs against a closed database.
-      if (schedulesPass || manualSchedulePasses.size) {
+      // A schedule or study admission may be inside its PII screen: `stopping` is set, so its fence refuses the write when the screen returns. Wait for it (bounded, the screen has
+      // its own timeout) before the peers stop, the board closes and the store closes, so no admission runs against a closed database.
+      if (schedulesPass || manualSchedulePasses.size || tasks.studiesPending() !== 0) {
         let timer: ReturnType<typeof setTimeout> | undefined;
-        await Promise.race([Promise.all([schedulesPass?.catch(() => undefined), ...manualSchedulePasses]), new Promise<void>(resolve => { timer = setTimeout(resolve, 5_000); timer.unref?.(); })]);
+        await Promise.race([Promise.all([schedulesPass?.catch(() => undefined), ...manualSchedulePasses, studiesStopped]), new Promise<void>(resolve => { timer = setTimeout(resolve, 5_000); timer.unref?.(); })]);
         clearTimeout(timer);
       }
       await Promise.all([terminalReadsStopped, codeFactsStopped, implementerShellStopped]);
@@ -8804,6 +9322,7 @@ export async function startDaemon(opts: DaemonOptions) {
   bus.onQueues(); // initial restored holds are reported only after the listener is bound; writes status.json too
   log(`${RUN_START}${process.pid} control=127.0.0.1:${server.port} cwd=${opts.cwd}`);
   ready = true;
+  handoffCatchUp();
   tasks.scheduleQueuePressureRecheck();
   for (const name of opts.configWatch === false ? [] : CONFIG_SOURCE_FILES) {
     const path = join(opts.cwd, ".agenthub", name);