@staix/agent-hub 0.8.1 → 0.10.0

package/src/hub/tasks.ts

@@ -1,6 +1,6 @@
 import type { Briefs } from "../memory/brief.ts";
 import type { MemoryClient } from "../memory/client.ts";
-import { CLASSES, PLAN_KEYS, type Board, type Task, type TaskClass, type TaskPlan, type TaskRefs } from "./board.ts";
+import { CLASSES, OUTCOMES_KEPT_MS, PLAN_KEYS, type Board, type Task, type TaskClass, type TaskPlan, type TaskRefs } from "./board.ts";
 import type { Bus } from "./bus.ts";
 import { HUB, newEnvelope, NOTE_KINDS, noteLine, USER, type Envelope, type PeerId, type PeerState } from "./envelope.ts";
 import { assign, detectSignals, LOCAL, PI, type Assignment, type Routing } from "./routing.ts";
@@ -25,17 +25,28 @@ export interface TasksDeps {
   tell?: (peer: PeerId, line: string) => void;
   /** Structured overlap records for telemetry (issue #40); the notice line stays for the human. */
   recordOverlap?: (task: number, owner: PeerId, others: { task: number; owner: PeerId; paths: string[]; symbols?: string[] }[]) => void;
+  /** Quota per peer from fresh readings (issue #36): routing drains the windows that reset soonest first. */
+  quota?: () => Record<PeerId, { headroom: number; resetsAt?: number }>;
+  /** Reviewer choice from recorded review outcomes (issue #35); off unless the project config turns it on. */
+  review?: { adaptive: boolean; min_reviews: number };
   /** Optional: name a class for a task proposed without one. `onCampus` says whether the model call stays on campus. */
   triage?: { classify: (title: string, detail: string) => Promise<TaskClass | undefined>; onCampus: () => Promise<boolean> };
 }
 
 const ESCALATE_AFTER = 2;
+// Demotion (issue #36): a failure counts half after a day. A peer is demoted for a class once its decayed failures
+// reach 1.5 (two within about half a day, three within two days) and outweigh its decayed successes there.
+// ponytail: fixed constants; make them config when someone needs to tune them.
+const DEMOTION_HALF_LIFE_MS = 24 * 3_600_000;
+const DEMOTE_AT = 1.5;
+/** An approval counts as contradicted when work on the same places fails within this window (issue #35). */
+const CONTRADICTION_WINDOW_MS = 7 * 86_400_000;
 const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
 /** Board events that leave a task where its completion check found it; any other event means it moved on meanwhile. */
 const QUIET_EVENTS = new Set(["answer", "reviewer changed"]);
 
 /** Same path, or one is a directory of the other; the project root (`.`) holds everything. */
-const samePlace = (a: string, b: string) => {
+export const samePlace = (a: string, b: string) => {
   const norm = (p: string) => p.replace(/^\.\//, "").replace(/\/+$/, "") || ".";
   const [x, y] = [norm(a), norm(b)];
   return x === "." || y === "." || x === y || x.startsWith(`${y}/`) || y.startsWith(`${x}/`);
@@ -99,16 +110,102 @@ export class Tasks {
     return Object.fromEntries([...this.d.bus.peers.keys()].map((id) => [id, this.d.bus.stateOf(id)]));
   }
 
-  async propose(by: PeerId, input: { title?: string; detail?: string; class?: string; refs?: TaskRefs; plan?: TaskPlan; owner?: PeerId }): Promise<Task> {
+  /** Dependencies of a task that are not approved yet: while there are any, it is offered to nobody (issue #34). */
+  waitsFor = (task: Pick<Task, "deps">): number[] => (task.deps ?? []).filter((id) => this.d.board.get(id)?.state !== "approved");
+
+  /** Decayed failure weights of the peers demoted for a class: failures count half after a day (issue #36). */
+  demoted(cls: TaskClass, now = Date.now()): Record<PeerId, number> {
+    const sums = new Map<PeerId, { bad: number; good: number }>();
+    for (const o of this.d.board.outcomes(cls, now - OUTCOMES_KEPT_MS)) {
+      const w = 0.5 ** ((now - o.at) / DEMOTION_HALF_LIFE_MS);
+      const s = sums.get(o.peer) ?? { bad: 0, good: 0 };
+      if (o.ok) s.good += w;
+      else s.bad += w;
+      sums.set(o.peer, s);
+    }
+    return Object.fromEntries([...sums].filter(([, s]) => s.bad >= DEMOTE_AT && s.bad > s.good).map(([p, s]) => [p, s.bad]));
+  }
+
+  /** How each reviewer's reviews of each implementer's work in a class held up (issue #35). */
+  reviewRecord(cls: TaskClass): Record<PeerId, Record<PeerId, { score: number; n: number }>> {
+    // Counted per task: a review that asked for changes and then approved is one review, not two.
+    const c = new Map<string, { reviewed: Set<number>; contradicted: Set<number> }>();
+    for (const r of this.d.board.reviews({ class: cls })) {
+      const key = `${r.implementer}\0${r.reviewer}`;
+      const s = c.get(key) ?? { reviewed: new Set<number>(), contradicted: new Set<number>() };
+      (r.kind === "contradicted" ? s.contradicted : s.reviewed).add(r.task);
+      c.set(key, s);
+    }
+    const out: Record<PeerId, Record<PeerId, { score: number; n: number }>> = {};
+    for (const [key, s] of c) {
+      const [implementer, reviewer] = key.split("\0") as [PeerId, PeerId];
+      const n = s.reviewed.size;
+      if (n) (out[implementer] ??= {})[reviewer] = { score: (n - [...s.contradicted].filter((t) => s.reviewed.has(t)).length) / n, n };
+    }
+    return out;
+  }
+
+  /** Who asked for changes on the current owner's work: requests made before the task changed hands were about someone else's. */
+  private requestedChanges(task: Task): Set<PeerId> {
+    const since = task.history.findLastIndex((h) => ["assigned", "escalated", "reassigned", "unassigned"].includes(h.event));
+    return new Set(task.history.slice(since + 1).filter((h) => h.event === "changes_requested").map((h) => h.by));
+  }
+
+  /** What assignment weighs besides states and policy: quota, demotion and the review record. */
+  private weights(cls: TaskClass) {
+    const now = Date.now();
+    const quota = this.d.quota?.();
+    return { now, demoted: this.demoted(cls, now), reviews: this.reviewRecord(cls), ...(quota ? { quota } : {}), ...(this.d.review?.adaptive ? { adaptive: { min: this.d.review.min_reviews } } : {}) };
+  }
+
+  /**
+   * Work on these places failed (a check failure, or changes requested): approvals of other tasks on the same places
+   * within the window were contradicted. Each approval counts once.
+   */
+  private contradict(failed: Task): void {
+    if (this.isPii(failed)) return; // its places are left out everywhere else too
+    const now = Date.now();
+    const mine = this.places(failed);
+    for (const t of this.d.board.list("approved")) {
+      if (t.id === failed.id || !t.owner || this.isPii(t)) continue;
+      const approval = [...t.history].reverse().find((h) => h.event === "approved");
+      if (!approval || now - approval.at > CONTRADICTION_WINDOW_MS || approval.by === USER) continue;
+      const theirs = this.places(t);
+      // Blame needs the same file or symbol: a directory or `.` would contradict every approval under it.
+      const same = mine.paths.some((p) => theirs.paths.includes(p)) || mine.symbols.some((x) => theirs.symbols.includes(x));
+      if (!same || this.d.board.reviews({ task: t.id }).some((r) => r.kind === "contradicted")) continue;
+      this.d.board.recordReview({ implementer: t.owner, reviewer: approval.by, class: t.class, kind: "contradicted", task: t.id });
+    }
+  }
+
+  async propose(by: PeerId, input: { title?: string; detail?: string; class?: string; refs?: TaskRefs; plan?: TaskPlan; owner?: PeerId; after?: unknown; urgent?: unknown }): Promise<Task> {
     // Callers are models: a title is one line (it is part of console and hub.log lines), not a document.
     const title = String(input.title ?? "").replace(/\s+/g, " ").trim().slice(0, 300);
     if (!title) throw new Error("title is required");
+    // Dependencies can only name tasks that exist, so the new task closes no cycle: nothing can depend on it yet.
+    // Callers are models: a missing or null `after` is no dependency, and an id is an integer or a digit string.
+    let afterIds: unknown[] = [];
+    if (Array.isArray(input.after)) afterIds = input.after;
+    else if (input.after != null) afterIds = [input.after];
+    const deps: number[] = [];
+    for (const v of afterIds) {
+      const id = typeof v === "number" || (typeof v === "string" && /^\s*\d+\s*$/.test(v)) ? Number(v) : NaN;
+      if (!Number.isInteger(id)) throw new Error(`after: ${JSON.stringify(v)} is not a task id`);
+      if (!this.d.board.get(id)) throw new Error(`after: no task #${id}`);
+      if (!deps.includes(id)) deps.push(id);
+    }
+    const waits = this.waitsFor({ deps });
+    if (waits.length && input.owner) {
+      throw new Error(`this task would wait for ${waits.map((id) => `#${id}`).join(", ")}, not approved yet: ${input.owner === by ? "claim it once they are" : "propose it without an owner; routing offers it when they are approved"}`);
+    }
     const given = input.class === undefined || input.class === "" ? undefined : input.class;
     if (given !== undefined && !CLASSES.includes(given as TaskClass)) throw new Error(`class must be one of ${CLASSES.join(", ")}`);
     const text = { title, detail: String(input.detail ?? "").slice(0, 8000), refs: cleanRefs(input.refs) };
     const plan = cleanPlan(input.plan);
     // The plan reaches other owners, so a PII pattern in it makes the task a PII task like one in the detail would.
     const signals = detectSignals({ ...text, detail: [text.detail, planText(plan)].join("\n") }, this.d.routing(), this.d.cwd);
+    // Urgent work is handed over even when its paused owner's window resets soon (issue #36).
+    if (input.urgent === true && !signals.includes("urgent")) signals.push("urgent");
     let cls = given as TaskClass | undefined;
     let triaged = false;
     if (!cls && this.d.triage) {
@@ -122,10 +219,16 @@ export class Tasks {
     if (defaulted) cls = "implement";
     if (!cls) throw new Error(`class is required (one of ${CLASSES.join(", ")}); the hub could not name one for you`);
     const draft = { ...text, class: cls };
-    let task = this.d.board.propose(by, { ...draft, plan, signals });
+    let task = this.d.board.propose(by, { ...draft, plan, ...(deps.length ? { deps } : {}), signals });
     if (triaged) task = this.d.board.update(task.id, "hub", "triaged", {}, `class ${cls} named by the hub's model`);
     if (defaulted) task = this.d.board.update(task.id, "hub", "class defaulted", {}, "class implement for a claim without one");
     this.d.notify(`task ${this.publicTitle(task)} proposed by ${by} [${task.class}]${task.signals.length ? ` signals: ${task.signals.join(", ")}` : ""}`);
+    // Re-read: a dependency approved while triage was awaited looked for its dependents before this row existed.
+    const still = this.waitsFor(task);
+    if (still.length) {
+      this.d.notify(`task ${this.publicTitle(task)} waits for ${still.map((id) => `#${id}`).join(", ")}; it is offered once they are approved`);
+      return this.d.board.update(task.id, HUB, "blocked", {}, `waits for ${still.map((id) => `#${id}`).join(", ")}`);
+    }
     // Naming yourself is a claim: the work is already yours, so no offer comes back to you (paper: Agensh CLAIM, #68).
     return this.assignOwner(task, by, input.owner ? { candidates: [input.owner], claim: input.owner === by } : {});
   }
@@ -146,7 +249,7 @@ export class Tasks {
   private releasing: PeerId | undefined;
 
   /** Whether a model-written name may be shown to other peers and in the log: one matching a PII pattern may be PII. */
-  private nameable = (t: string): boolean => !this.isPii({ signals: detectSignals({ title: "", detail: t, refs: {} }, this.d.routing(), this.d.cwd) });
+  nameable = (t: string): boolean => !this.isPii({ signals: detectSignals({ title: "", detail: t, refs: {} }, this.d.routing(), this.d.cwd) });
 
   /** Where two tasks meet: shared paths, then shared symbols, leaving out any name that matches a PII pattern. */
   private where(hit: { paths: string[]; symbols: string[] }): string {
@@ -227,16 +330,21 @@ export class Tasks {
     if (typeof target === "number") {
       const task = this.d.board.get(target);
       if (!task) throw new Error(`no task #${target}`);
-      return [`task ${this.publicTitle(task)} (${task.state}, owner ${task.owner ?? "none"})`, "if it were assigned now:", ...assign(task, this.states(), routing, { exclude: this.declined(task) }).trace];
+      return [`task ${this.publicTitle(task)} (${task.state}, owner ${task.owner ?? "none"})`, "if it were assigned now:", ...assign(task, this.states(), routing, { exclude: this.declined(task), waitsFor: this.waitsFor(task), ...this.weights(task.class) }).trace];
     }
     const draft = { title: target.title, detail: target.detail ?? "", refs: target.refs ?? {} };
-    return assign({ class: target.class, signals: detectSignals(draft, routing, this.d.cwd) }, this.states(), routing).trace;
+    return assign({ class: target.class, signals: detectSignals(draft, routing, this.d.cwd) }, this.states(), routing, this.weights(target.class)).trace;
   }
 
   private declined = (task: Task) => task.history.filter((h) => h.event === "declined").map((h) => h.by);
 
   private async assignOwner(task: Task, by: PeerId, opts: { candidates?: PeerId[]; event?: string; note?: string; clearOnFail?: boolean; exclude?: PeerId[]; context?: string; claim?: boolean } = {}): Promise<Task> {
-    const a = assign(task, this.states(), this.d.routing(), { exclude: [...this.declined(task), ...(opts.exclude ?? []), ...(opts.event === "escalated" && task.owner ? [task.owner] : [])], ...(opts.candidates ? { candidates: opts.candidates } : {}) });
+    const waits = this.waitsFor(task);
+    const a = assign(task, this.states(), this.d.routing(), { exclude: [...this.declined(task), ...(opts.exclude ?? []), ...(opts.event === "escalated" && task.owner ? [task.owner] : [])], ...(opts.candidates ? { candidates: opts.candidates } : {}), waitsFor: waits, ...this.weights(task.class) });
+    if (waits.length) {
+      this.d.notify(`task ${this.publicTitle(task)} waits for ${waits.map((id) => `#${id}`).join(", ")}; it is offered once they are approved`);
+      return task;
+    }
     if (!a.owner) {
       this.d.notify(`task ${this.publicTitle(task)}: no peer can take it (${a.trace.filter((l) => l.includes("skipped")).length} skipped); assign with: ahub task assign ${task.id} <peer>`);
       // Only a decline takes the task away from its owner; a failed console assign or escalation leaves it where it was.
@@ -278,6 +386,46 @@ export class Tasks {
     this.d.bus.publish(newEnvelope(HUB, body, { to: [task.owner!], kind: "task", priority: "important", refs: { ...task.refs, task: String(task.id) }, ...(pii ? { private: true } : {}) }));
   }
 
+  /** Nobody, the console user included, works on a task before what it waits for is approved. */
+  private ready(task: Task): void {
+    const waits = this.waitsFor(task);
+    if (waits.length) throw new Error(`task #${task.id} waits for ${waits.map((id) => `#${id}`).join(", ")}, not approved yet`);
+  }
+
+  /** An approved task may be the last thing others waited for: those go through assignment now (issue #34). */
+  private async releaseDependents(approved: Task): Promise<void> {
+    for (const t of this.d.board.list("proposed")) {
+      if (!t.deps?.includes(approved.id) || t.owner || this.waitsFor(t).length) continue;
+      await this.offerReady(t, `#${approved.id} approved`);
+    }
+  }
+
+  private readonly offered = new Set<number>(); // ready tasks offered in this hub run
+
+  /**
+   * A stop between an approval and the assignment of its dependents (both are saved on their own) leaves them ownerless
+   * with nothing left to wait for, and no later approval to offer them. The daemon calls this on its release timer:
+   * each such task is offered once per hub run, once an attached peer can take it (peers attach one by one).
+   */
+  async releaseReady(): Promise<void> {
+    for (const t of this.d.board.list("proposed")) {
+      const last = t.history.at(-1)?.event;
+      if (!t.deps?.length || t.owner || this.offered.has(t.id) || (last !== "blocked" && last !== "ready") || this.waitsFor(t).length) continue;
+      if (!assign(t, this.states(), this.d.routing(), { exclude: this.declined(t) }).owner) continue; // nobody attached can take it yet
+      await this.offerReady(t, "nothing left to wait for");
+    }
+  }
+
+  /** Callers hold a list read before an await: re-read, or a task the other caller offered meanwhile is offered twice. */
+  private async offerReady(stale: Task, why: string): Promise<void> {
+    const t = this.d.board.get(stale.id);
+    if (!t || t.state !== "proposed" || t.owner || this.offered.has(t.id)) return;
+    this.offered.add(t.id);
+    const ready = t.history.at(-1)?.event === "ready" ? t : this.d.board.update(t.id, HUB, "ready", {}, why);
+    this.d.notify(`task ${this.publicTitle(ready)} is ready: what it waited for is approved`);
+    await this.assignOwner(ready, HUB).catch((e: Error) => this.d.notify(`task ${this.publicTitle(ready)}: could not be assigned: ${e.message}`));
+  }
+
   private mine(task: Task, by: PeerId, role: "owner" | "reviewer"): void {
     if (by !== USER && task[role] !== by) throw new Error(`task #${task.id}: only its ${role} (${task[role] ?? "none"}) or the console user can do that`);
   }
@@ -297,6 +445,7 @@ export class Tasks {
   accept(by: PeerId, id: unknown, plan?: unknown): Task {
     const task = this.need(id);
     this.mine(task, by, "owner");
+    this.ready(task);
     // Models send null or {} for an optional field they leave empty: neither replaces a plan.
     const given = plan == null ? undefined : cleanPlan(plan);
     const cleaned = given && Object.keys(given).length ? given : undefined;
@@ -327,6 +476,9 @@ export class Tasks {
   /** Tasks whose check is queued or running, and the owner it was started for. */
   private readonly checking = new Map<number, PeerId | null>();
   private checkQueue: Promise<void> = Promise.resolve();
+  private pendingChecks = 0;
+  /** Checks queued or running, until their result is on the board: a recovery commit waits for them. */
+  checksPending = () => this.pendingChecks;
 
   /** Whether a completion check is still running for this task. */
   isChecking = (id: number) => this.checking.has(id);
@@ -335,6 +487,7 @@ export class Tasks {
     let task = this.need(id);
     this.mine(task, by, "owner");
     if (task.state === "in_review" || task.state === "approved") throw new Error(`task #${task.id} is already ${task.state}`);
+    this.ready(task);
     if (this.checking.has(task.id)) {
       // The result goes only to the owner the check was started for: anyone who took the task since hears nothing.
       throw new Error(this.checking.get(task.id) === task.owner ? `task #${task.id}: its check is still running; its result comes as a task message` : `task #${task.id}: a check from before it changed hands is still running; call hub_task_done again in a few minutes`);
@@ -347,9 +500,11 @@ export class Tasks {
     const pending = this.d.board.update(task.id, by, "done (checking)", { refs: cleanRefs(refs) }, summary);
     this.d.notify(`task ${this.publicTitle(pending)} done by ${by}; its check is queued or running: ${command}`);
     const seen = { events: pending.history.length, owner: pending.owner };
+    this.pendingChecks++;
     this.checkQueue = this.checkQueue
       .then(() => this.finishChecked(pending.id, by, summary, command, seen))
-      .catch((e: Error) => this.d.notify(`task #${pending.id}: its check result could not be recorded: ${e.message}`));
+      .catch((e: Error) => this.d.notify(`task #${pending.id}: its check result could not be recorded: ${e.message}`))
+      .finally(() => this.pendingChecks--);
     return pending;
   }
 
@@ -375,6 +530,8 @@ export class Tasks {
       return;
     }
     this.d.board.update(id, HUB, "check failed", {}, `${outcome}\n${result.tail}`.trim());
+    if (task.owner) this.d.board.recordOutcome(task.owner, task.class, false);
+    this.contradict(task);
     this.d.notify(`task ${this.publicTitle(task)}: its check failed (${outcome}); it stays with ${task.owner ?? by}`);
     this.tell(task, `Task #${id}: its check failed.\n$ ${outcome}${result.tail ? `\n${result.tail}` : ""}\nFix it and call hub_task_done again.`, pii);
   }
@@ -384,7 +541,11 @@ export class Tasks {
     const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", refs: cleanRefs(refs) }, checkOutput ? `${summary ?? ""}\n${checkOutput}`.trim() : summary);
     this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\n${summary ?? ""}`);
     this.tellCompleted(next, summary);
-    if (!reviewer) this.d.notify(`task ${this.publicTitle(next)} done by ${by}, no reviewer: approved`);
+    if (!reviewer) {
+      if (next.owner) this.d.board.recordOutcome(next.owner, next.class, true); // approved without a review is a success too
+      this.d.notify(`task ${this.publicTitle(next)} done by ${by}, no reviewer: approved`);
+      await this.releaseDependents(next);
+    }
     else if (reviewer === USER) this.d.notify(`task ${this.publicTitle(next)} done by ${by}: review it with ahub task show ${next.id}, then ahub review ${next.id} approved|changes_requested [note]`);
     else this.sendReview(next, reviewer);
     return next;
@@ -420,23 +581,45 @@ export class Tasks {
     const r = task.refs;
     const last = [...task.history].reverse().find((h) => h.event === "done");
     const where = [r.branch ? `branch ${r.branch}` : "", r.commit ? `commit ${r.commit}` : "", r.paths?.length ? `paths ${r.paths.join(", ")}` : ""].filter(Boolean).join("; ");
-    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${last?.note ?? "(no summary)"}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}Give your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note}.`;
+    // A checklist that maps the change to its contract (issue #35): reviewers who check against the written plan catch more.
+    const plan = planText(task.plan);
+    const check = [...task.history].reverse().find((h) => h.event === "check passed");
+    const checklist = [
+      "Checklist:",
+      `- Map the changed signatures and call sites to ${plan ? `the plan (${plan})` : task.detail ? "the task detail above" : "the task title"}, and name each one that does not match.`,
+      `- ${check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : "No check ran for this class: run the affected tests yourself."}`,
+      `- List what is unmet in hub_review's unmet, one item each.`,
+    ].join("\n");
+    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${last?.note ?? "(no summary)"}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
     this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, task: String(task.id) }, ...(this.isPii(task) ? { private: true } : {}) }));
   }
 
-  async review(by: PeerId, id: unknown, verdict: unknown, note?: string): Promise<Task> {
+  async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown): Promise<Task> {
     const task = this.need(id);
     this.mine(task, by, "reviewer");
     if (verdict !== "approved" && verdict !== "changes_requested") throw new Error('verdict must be "approved" or "changes_requested"');
     if (task.state !== "in_review") throw new Error(`task #${task.id} is ${task.state}: cannot move to ${verdict} before its owner calls hub_task_done`);
     const pii = this.isPii(task);
+    const items = textList(unmet);
+    if (items.length) note = `${note ?? ""}\nUnmet: ${items.join("; ")}`.trim();
     if (verdict === "approved") {
       const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0 }, note);
+      if (next.owner) {
+        this.d.board.recordOutcome(next.owner, next.class, true);
+        this.d.board.recordReview({ implementer: next.owner, reviewer: by, class: next.class, kind: "approved", task: next.id });
+        // Changes requested on this owner's work and the redo passed: those reviews caught something.
+        for (const r of this.requestedChanges(task)) {
+          this.d.board.recordReview({ implementer: next.owner, reviewer: r, class: next.class, kind: "caught", task: next.id });
+        }
+      }
       this.note(next, by, "decision", `Task #${next.id} approved by ${by}: ${next.title}\n${note ?? ""}`);
       this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${note}` : ""}`, pii);
+      await this.releaseDependents(next);
       return next;
     }
     const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: task.rejections + 1 }, note);
+    if (rejected.owner) this.d.board.recordOutcome(rejected.owner, rejected.class, false);
+    this.contradict(rejected);
     this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`);
     if (rejected.rejections >= ESCALATE_AFTER) {
       const moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`);
@@ -456,6 +639,11 @@ export class Tasks {
     const list = this.d.routing().classes[task.class]?.escalate_to ?? [];
     if (task.state === "changes_requested") task = this.d.board.update(task.id, HUB, "reopened", { state: "in_progress" });
     const from = task.owner;
+    // The hub's own escalations are not counted: after repeated changes_requested each one already was, and after a
+    // Pi inference failure the backend failed, not the work. An escalation by hand counts on its own.
+    if (from && by !== HUB) this.d.board.recordOutcome(from, task.class, false);
+    // Only a reviewer that asked for changes on this work saw it fail: not an escalation of unreviewed work (a Pi failure).
+    if (from && task.reviewer && task.reviewer !== USER && this.requestedChanges(task).has(task.reviewer)) this.d.board.recordReview({ implementer: from, reviewer: task.reviewer, class: task.class, kind: "escalated", task: task.id });
     const next = await this.assignOwner(task, by, { candidates: list, event: "escalated", note: `${why}; from ${from ?? "none"}`, context: why });
     if (next.owner && next.owner !== from) {
       this.d.notify(`task ${this.publicTitle(next)} escalated from ${from} to ${next.owner} (${why})`);
@@ -474,10 +662,12 @@ export class Tasks {
    * Budget relay: a paused peer's open work moves on. `local` first (it has no quota), then the class list, all through
    * the usual constraints. Tasks it was reviewing get another reviewer. Moves are reported, never taken back automatically.
    */
-  async reassignForPause(peer: PeerId, context: string | undefined): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
+  async reassignForPause(peer: PeerId, context: string | undefined, urgentOnly = false): Promise<{ id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[]> {
     const moved: { id: number; title: string; to: PeerId | null; role: "owner" | "reviewer" }[] = [];
     const routing = this.d.routing();
     for (const task of this.d.board.list()) {
+      // Waiting out a window that resets soon (issue #36): only urgent work moves.
+      if (urgentOnly && !task.signals.includes("urgent")) continue;
       if (task.owner === peer && OPEN.includes(task.state)) {
         const pii = this.isPii(task);
         const candidates = [pii ? LOCAL : PI, pii ? undefined : LOCAL, ...(routing.classes[task.class]?.peers ?? []).filter((p) => p !== LOCAL && p !== PI)].filter((p): p is PeerId => !!p);
@@ -486,7 +676,7 @@ export class Tasks {
         moved.push({ id: task.id, title: this.publicTitle(task), to: next.owner, role: "owner" });
       } else if (task.reviewer === peer && task.state !== "approved") {
         // No owner candidates: only the reviewer is wanted, and it must be neither the paused peer nor the task's owner.
-        const a = assign(task, this.states(), routing, { exclude: [peer], candidates: [], ...(task.owner ? { notReviewer: task.owner } : {}) });
+        const a = assign(task, this.states(), routing, { exclude: [peer], candidates: [], ...(task.owner ? { notReviewer: task.owner } : {}), ...this.weights(task.class) });
         const reviewer = a.reviewer && a.reviewer !== peer && a.reviewer !== task.owner ? a.reviewer : null;
         const next = this.d.board.update(task.id, HUB, "reviewer changed", { reviewer }, `budget pause of ${peer}`);
         moved.push({ id: task.id, title: this.publicTitle(task), to: reviewer, role: "reviewer" });

package/src/local/sandbox.ts

@@ -18,7 +18,19 @@ const q = sbplString;
  * no network unless asked. In SBPL the last matching rule wins, so the denies come last.
  */
 /** Toolchains and git identity: the only parts of the home directory a sandboxed command may read besides the project. */
-const HOME_READABLE = [".bun", ".cargo", ".rustup", ".local", ".npm", ".cache", ".pyenv", ".nvm", ".deno", "go", ".gitconfig", ".config/git", "Library/Caches"];
+const HOME_READABLE = [".bun", ".cargo", ".rustup", ".local", ".npm", ".cache", ".pyenv", ".nvm", ".deno", "go", ".gitconfig", ".config/git", "Library/Caches", ".volta", ".asdf", ".nodenv", ".rbenv", ".sdkman", "Library/Application Support/fnm", "Library/pnpm"];
+
+/**
+ * Public CA bundles: the name denies (`*.pem` for keys) also match these, and TLS needs them once network is on.
+ * Allowed after the denies, by exact path.
+ */
+const CA_BUNDLES = ["/private/etc/ssl/cert.pem", "/opt/homebrew/etc/ca-certificates/cert.pem", "/opt/homebrew/etc/openssl@3/cert.pem", "/usr/local/etc/ca-certificates/cert.pem", "/usr/local/etc/openssl@3/cert.pem"];
+
+/** The selected Xcode or Command Line Tools dir: the `/usr/bin` shims (git, clang, make, python3) run what is in it. */
+function developerDir(): string | undefined {
+  const out = spawnSync("xcode-select", ["-p"], { encoding: "utf8" });
+  return out.status === 0 && out.stdout.trim() ? out.stdout.trim() : undefined;
+}
 
 /** A submodule or worktree keeps its git dir outside the project; git needs it, minus the parts that execute or reconfigure. */
 function externalGitDirs(root: string): string[] {
@@ -28,28 +40,67 @@ function externalGitDirs(root: string): string[] {
   return [...new Set(dirs)].filter((d) => !d.startsWith(`${root}/`));
 }
 
-export function profile(cwd: string, network: boolean, readAllow: string[] = [], deny: string[] = []): string {
+/** The system directories a deny-default profile lets commands read and run from: dyld, frameworks, toolchains. */
+const SYSTEM_READABLE = ["/usr", "/bin", "/sbin", "/System", "/Library", "/opt", "/private/etc", "/private/var/db/timezone", "/private/var/db/dyld"];
+/**
+ * Directory lookups (users, groups), logging and notifications; plus name resolution and TLS trust when network is on.
+ * No brokers that act outside the sandbox: LaunchServices would let `open` start a browser with network, and
+ * SecurityServer would answer Keychain queries the credential-path denies are there to stop.
+ */
+const MACH_SERVICES = ["com.apple.system.opendirectoryd.libinfo", "com.apple.system.DirectoryService.libinfo_v1", "com.apple.system.logger", "com.apple.system.notification_center"];
+const NETWORK_MACH_SERVICES = ["com.apple.dnssd.service", "com.apple.trustd", "com.apple.trustd.agent", "com.apple.networkd"];
+
+/**
+ * `base` "deny" (issue #39) starts from `(deny default)` and allows only what commands need: running and reading the
+ * system, toolchain and project directories, writing the project and temp. "allow" is the profile of 0.9 and earlier,
+ * kept for one release behind `local.sandbox: "allow-default"`. The denies at the end apply to both.
+ */
+export function profile(cwd: string, network: boolean, readAllow: string[] = [], deny: string[] = [], base: "deny" | "allow" = "deny"): string {
   const home = homedir();
   const inHome = (p: string) => (p.startsWith("~/") ? join(home, p.slice(2)) : p);
   const root = realPath(cwd);
   const tmp = realPath(tmpdir());
   const gitDirs = externalGitDirs(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
+  const dev = developerDir();
+  const readable = [root, ...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs, ...(dev ? [dev] : [])];
+  const subpaths = (paths: string[]) => paths.map((p) => `(subpath ${q(p)})`).join(" ");
+  const globals = (names: string[]) => names.map((n) => `(global-name ${q(n)})`).join(" ");
+  const start = base === "deny"
+    ? [
+        "(deny default)",
+        "(allow process-fork)",
+        // Runs from the system, toolchain and project directories only; a script runs through an allowed interpreter.
+        `(allow process-exec ${subpaths([...SYSTEM_READABLE, ...readable, tmp, "/private/tmp"])})`,
+        "(allow signal (target same-sandbox))",
+        "(allow process-info* (target same-sandbox))",
+        "(allow sysctl-read)",
+        `(allow mach-lookup ${globals([...MACH_SERVICES, ...(network ? NETWORK_MACH_SERVICES : [])])})`,
+        '(allow ipc-posix-shm-read-data ipc-posix-shm-read-metadata (ipc-posix-name "apple.shm.notification_center"))',
+        "(allow file-read-metadata)",
+        `(allow file-read* (literal "/") ${subpaths([...SYSTEM_READABLE, tmp, "/private/tmp", "/dev"])} ${subpaths(readable)})`,
+        '(allow file-ioctl (regex #"^/dev/"))',
+        ...(network ? ["(allow network*)"] : []),
+      ]
+    : [
+        "(allow default)",
+        ...(network ? [] : ["(deny network*)"]),
+        // Home is default-deny for reads: whatever a command reads can end up in the model's answer, and that answer
+        // is shared with agents that run on cloud subscriptions (~/.claude.json, app tokens, browser profiles ...).
+        `(deny file-read* (subpath ${q(home)}))`,
+        `(allow file-read-metadata (subpath ${q(home)}))`,
+        `(allow file-read* ${subpaths(readable)})`,
+      ];
   return [
     "(version 1)",
-    "(allow default)",
-    ...(network ? [] : ["(deny network*)"]),
-    // Home is default-deny for reads: whatever a command reads can end up in the model's answer, and that answer
-    // is shared with agents that run on cloud subscriptions (~/.claude.json, app tokens, browser profiles ...).
-    `(deny file-read* (subpath ${q(home)}))`,
-    `(allow file-read-metadata (subpath ${q(home)}))`,
-    `(allow file-read* (subpath ${q(root)}) ${[...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs].map((p) => `(subpath ${q(p)})`).join(" ")})`,
+    ...start,
     "(deny file-write*)",
     `(allow file-write* (subpath ${q(root)}) (subpath ${q(tmp)}) (subpath "/private/tmp") (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
     // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub.
     `(deny file-write* (subpath ${q(join(root, ".agenthub"))}) ${[join(root, ".git"), ...gitDirs].map((d) => `(subpath ${q(join(d, "hooks"))}) (literal ${q(join(d, "config"))})`).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
+    ...(network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")})`] : []),
   ].join("\n");
 }
 

package/templates/claude-hooks.json

@@ -0,0 +1,10 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
+        "hooks": [{ "type": "command", "command": "ahub check-path --hook", "timeout": 10 }]
+      }
+    ]
+  }
+}

package/templates/config.json

@@ -14,7 +14,7 @@
     "local": ["implementer", "verifier"],
     "pi": ["implementer", "verifier"]
   },
-  "budget": { "gate": 0.9, "stale_min": 30, "poll_min": 10, "checkpoint_timeout_s": 90, "kimi_tokens_5h": 0 },
+  "budget": { "gate": 0.9, "stale_min": 30, "poll_min": 10, "checkpoint_timeout_s": 90, "kimi_tokens_5h": 0, "wait_max_min": 30 },
   "inference": { "enabled": true, "digest_min_items": 5, "digest_min_chars": 8000, "triage": true },
   "omniroute": {
     "urls": [],
@@ -23,9 +23,13 @@
     "cf_client_id_file": "",
     "cf_client_secret_file": ""
   },
-  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [] },
+  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [], "sandbox": "deny-default" },
   "approvals": { "timeout_s": 120 },
   "tasks": { "release_after_min": 30 },
   "checks": { "timeout_s": 600 },
-  "snapshots": { "enabled": true, "keep": 20 }
+  "snapshots": { "enabled": true, "keep": 20 },
+  "review": { "adaptive": false, "min_reviews": 5 },
+  "recovery": { "auto_resume_after_crash": false },
+  "capabilities": {},
+  "limits": { "sender_per_min": 12, "pair_per_min": 6, "important_per_hour": 6, "repeat_window_s": 120 }
 }