@stigmer/runner 3.7.0 → 3.8.0

package/src/activities/execute-cursor/__tests__/build-prompt.test.ts

@@ -519,3 +519,82 @@ describe("formatImplementPlanSection", () => {
     expect(prompt).toBe(USER_MESSAGE);
   });
 });
+
+describe("conversation catchup (cloud DD-006, T03 Sitting 3)", () => {
+  const DIGEST =
+    "Customer: where is my order?\nTeammate: I've refunded you in full.";
+
+  it("prefixes the catchup on a RESUMED turn — handback lands mid-session, the case the metadata lane cannot reach", () => {
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "resumed_successfully"),
+        conversationCatchup: DIGEST,
+      }),
+    );
+
+    expect(prompt.startsWith("<conversation_catchup>")).toBe(true);
+    expect(prompt).toContain(DIGEST);
+    expect(prompt.endsWith(USER_MESSAGE)).toBe(true);
+  });
+
+  it("orders a resumed turn's prefixes directives-first, catchup last — context sits closest to the task", () => {
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "resumed_successfully"),
+        interactionMode: InteractionMode.PLAN,
+        conversationCatchup: DIGEST,
+      }),
+    );
+
+    expect(prompt.indexOf("<interaction_mode>"))
+      .toBeLessThan(prompt.indexOf("<conversation_catchup>"));
+    expect(prompt.indexOf("<conversation_catchup>"))
+      .toBeLessThan(prompt.indexOf(USER_MESSAGE));
+  });
+
+  it("carries the catchup on the first execution too, AFTER the bridge (DD-007 D-d: bridge first, catchup second)", () => {
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "created_first_execution"),
+        contextBridge: "User: hi\nAssistant: hello",
+        conversationCatchup: DIGEST,
+      }),
+    );
+
+    expect(prompt).toContain("<conversation_catchup>");
+    expect(prompt.indexOf("<previous_conversation_context>"))
+      .toBeLessThan(prompt.indexOf("<conversation_catchup>"));
+    // Still CONTEXT: the approval protocol keeps its pinned
+    // last-before-task slot.
+    expect(prompt.indexOf("<conversation_catchup>"))
+      .toBeLessThan(prompt.indexOf("<tool_approval_protocol>"));
+  });
+
+  it("never reaches a HITL reinvocation — the same turn's original prompt already carried it", () => {
+    const decisions = new Map([["call-1", ApprovalAction.APPROVE]]);
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "resumed_successfully"),
+        approvalDecisions: decisions,
+        pendingApprovals: [
+          create(PendingApprovalSchema, { toolCallId: "call-1", message: "Write file: a.txt" }),
+        ],
+        conversationCatchup: DIGEST,
+      }),
+    );
+
+    expect(prompt).not.toContain("<conversation_catchup>");
+    expect(prompt).not.toContain(DIGEST);
+  });
+
+  it("a resumed turn without a catchup stays the bare user message — most turns carry none", () => {
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "resumed_successfully"),
+        conversationCatchup: undefined,
+      }),
+    );
+
+    expect(prompt).toBe(USER_MESSAGE);
+  });
+});

package/src/activities/execute-cursor/index.ts

@@ -48,6 +48,7 @@ import { MessageAccumulator, cancelInProgressSubAgentProtos, collapseRedundantTo
 import { utcTimestamp, persistStatus, reportSetupProgress, slimStatus } from "../../shared/status.js";
 import { TimingRecorder, emitTimingLog } from "../../shared/cold-start-timing.js";
 import { readContextBridge } from "../../shared/context-bridge.js";
+import { readConversationCatchup } from "../../shared/conversation-catchup.js";
 import { readSenderIdentity } from "../../shared/sender-identity.js";
 import {
   injectCallerIdentityEnv,
@@ -69,6 +70,10 @@ import {
   discoverChannelMessaging,
   synthesizeChannelAttachment,
 } from "../../shared/channel-attachment.js";
+import {
+  readChannelConversationId,
+  synthesizeConversationAttachment,
+} from "../../shared/conversation-attachment.js";
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { mergeApprovalPolicies } from "./approval-policy.js";
 import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
@@ -79,7 +84,7 @@ import { buildCursorSubAgentDefinitions } from "./subagent-config.js";
 import { resolveSkills } from "./skill-resolver.js";
 import { removeStigmerSymlink } from "../../shared/workspace/stigmer-link.js";
 import { resolveAttachments } from "./attachment-resolver.js";
-import { buildEnhancedPrompt, buildReinvocationPrompt, formatInteractionModePrefix, formatImplementPlanSection } from "./prompt-builder.js";
+import { buildEnhancedPrompt, buildReinvocationPrompt, formatConversationCatchupSection, formatInteractionModePrefix, formatImplementPlanSection } from "./prompt-builder.js";
 import { installHitlGate, removeHitlGate } from "./workspace-setup.js";
 import { ensureHitlDir } from "../../shared/workspace/platform-dir.js";
 import {
@@ -685,6 +690,31 @@ async function executeCursorInner(
         };
       }
     }
+
+    // Phase 4a4: Synthesize the conversation participation attachment
+    // (channel-conversations DD-008 D-c) — the third sibling. The
+    // channel-id session label IS the attachment decision (stamped
+    // server-side on every channel session; a free local read, unlike
+    // the channels discovery RPC above). HTTP-only: synthesize answers
+    // undefined with no bridge endpoint by design (see
+    // shared/conversation-attachment.ts).
+    const conversationAttachment = synthesizeConversationAttachment(
+      readChannelConversationId(session.metadata?.labels),
+      {
+        bridgeEndpoint: config.mcpBridgeEndpoint,
+        credential: attachmentCredential,
+        backendEndpoint: config.stigmerBackendEndpoint,
+      },
+    );
+    if (conversationAttachment) {
+      const resolvedServers = injectSynthesizedAttachment(
+        mcpResolution.resolvedServers, conversationAttachment, "conversation participation",
+      );
+      mcpResolution = {
+        resolvedServers,
+        cursorConfig: toCursorMcpConfig(resolvedServers),
+      };
+    }
     const mcpConfig = mcpResolution.cursorConfig;
 
     // Phase 4b: Merge approval policies from all layers.
@@ -1071,6 +1101,7 @@ async function executeCursorInner(
       contextBridge: readContextBridge(blueprint.sessionSpec.metadata),
       senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
       sessionContext: readSessionContext(blueprint.sessionSpec.metadata),
+      conversationCatchup: readConversationCatchup(spec.conversationCatchup),
     });
 
     // Phase 10a: Inject structured output instruction for Cursor harness
@@ -1706,9 +1737,15 @@ async function executeCursorInner(
             attachmentPaths,
             pendingApprovals: adjudicatedApprovals,
             interactionMode,
+            // buildFromPlan was silently dropped here until T03 Sitting 3 —
+            // a build turn that hit handle recovery lost its directive. The
+            // fresh prompt must carry every per-turn directive the original
+            // did.
+            buildFromPlan,
             contextBridge: readContextBridge(blueprint.sessionSpec.metadata),
             senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
             sessionContext: readSessionContext(blueprint.sessionSpec.metadata),
+            conversationCatchup: readConversationCatchup(spec.conversationCatchup),
           });
 
           console.log(
@@ -2305,6 +2342,18 @@ export interface BuildPromptInput {
    * turn.
    */
   sessionContext?: string;
+  /**
+   * Conversation catchup from the execution spec's `conversation_catchup`
+   * (cloud DD-006): what happened on the channel conversation that the
+   * agent has not seen. PER-TURN, so unlike the three standing values
+   * above it rides BOTH prompt paths — the enhanced prompt and a resumed
+   * turn's prefix (the `interaction_mode` shape). Handback lands
+   * mid-session on a resumed agent: the resumed path is the one that
+   * matters. Once delivered, the digest persists in the agent's own
+   * conversation store; the next turn's field is composed fresh and is
+   * usually blank.
+   */
+  conversationCatchup?: string;
 }
 
 /**
@@ -2336,6 +2385,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     attachmentPaths,
     interactionMode,
     buildFromPlan,
+    conversationCatchup,
   } = input;
 
   const isHitlReinvocation = approvalDecisions !== undefined && approvalDecisions.size > 0;
@@ -2353,15 +2403,22 @@ export function buildPrompt(input: BuildPromptInput): string {
 
   // A successfully resumed agent carries its own conversation context via the
   // SDK's native store — send the raw user message with no preamble. The
-  // exceptions are the per-EXECUTION directives, which never inherit from the
+  // exceptions are the per-EXECUTION values, which never inherit from the
   // session's first turn: the interaction-mode prefix (a follow-up can switch
   // Agent→Plan mid-session, and for Cursor the prompt is the only plan-mode
-  // enforcement) and the implement-plan directive (the build turn is usually
-  // a follow-up on a resumed agent).
+  // enforcement), the implement-plan directive (the build turn is usually a
+  // follow-up on a resumed agent), and the conversation catchup (handback
+  // ALWAYS lands mid-session on a resumed agent — this prefix is the property
+  // the metadata lane structurally cannot deliver, cloud DD-006). Catchup
+  // last: it is context, and context sits closest to the task (the enhanced
+  // prompt's own ordering doctrine).
   if (resolution.reason === "resumed_successfully") {
     const prefixes = [
       formatInteractionModePrefix(interactionMode),
       formatImplementPlanSection(buildFromPlan, attachmentPaths),
+      conversationCatchup !== undefined
+        ? formatConversationCatchupSection(conversationCatchup)
+        : undefined,
     ].filter((p): p is string => p !== undefined);
     return prefixes.length > 0
       ? [...prefixes, userMessage].join("\n\n")
@@ -2386,6 +2443,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     contextBridge: input.contextBridge,
     senderIdentity: input.senderIdentity,
     sessionContext: input.sessionContext,
+    conversationCatchup,
   });
 }
 

package/src/activities/execute-cursor/prompt-builder.ts

@@ -21,6 +21,7 @@ import type { DatastoreUsage, SubAgent } from "@stigmer/protos/ai/stigmer/agenti
 import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
 import { ApprovalAction, InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { formatContextBridgeText } from "../../shared/context-bridge.js";
+import { formatConversationCatchupText } from "../../shared/conversation-catchup.js";
 import { formatDatastoresSection } from "../../shared/datastore-attachment.js";
 import {
   formatChannelTemplatesSection,
@@ -107,6 +108,16 @@ export interface EnhancedPromptOptions {
    * store — the context is constant for the session's lifetime.
    */
   sessionContext?: string;
+  /**
+   * Conversation catchup (cloud DD-006): what happened on the channel
+   * conversation that the agent has not seen, read from the execution
+   * spec's `conversation_catchup`. PER-TURN, unlike the three standing
+   * siblings above: it rides BOTH prompt paths — this enhanced prompt and
+   * a resumed turn's prefix (the `interaction_mode` shape) — because
+   * handback lands mid-session on a resumed agent, the exact case the
+   * metadata lane cannot reach.
+   */
+  conversationCatchup?: string;
 }
 
 /**
@@ -200,6 +211,14 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(formatContextBridgeSection(options.contextBridge));
   }
 
+  // Catchup after the bridge (DD-007 D-d: bridge first, catchup second) —
+  // the bridge carries the pre-takeover conversation, the catchup the human
+  // episode, strictly newer by construction; recency puts it closer to the
+  // task.
+  if (options.conversationCatchup) {
+    sections.push(formatConversationCatchupSection(options.conversationCatchup));
+  }
+
   // Always last before the task: the platform's tool-approval protocol. Placed
   // here for recency so it outweighs any "ask the user first" guidance Cursor
   // surfaces from a connected MCP server (see formatToolApprovalProtocol).
@@ -345,6 +364,10 @@ export function formatSessionContextSection(context: string): string {
   return `<session_context>\n${formatSessionContextText(context)}\n</session_context>`;
 }
 
+export function formatConversationCatchupSection(digest: string): string {
+  return `<conversation_catchup>\n${formatConversationCatchupText(digest)}\n</conversation_catchup>`;
+}
+
 export function formatSkillsSection(skills: SkillMetadata[]): string {
   const entries = skills.map(
     (s) => `- **${s.name}**: ${s.description}\n  Path: \`${s.path}\``,

package/src/activities/execute-deep-agent/__tests__/mcp-gate.test.ts

@@ -0,0 +1,42 @@
+/**
+ * The deep-agent MCP gate, arm by arm. A missing arm here means a tool
+ * source silently dropped for exactly the agents whose only source it
+ * is — the failure DD-006 D7 documented for channel messaging and the
+ * reason the predicate lives in its own testable module instead of
+ * inline in setup.ts (whose import graph forbids a setup.test.ts).
+ */
+
+import { describe, expect, it } from "vitest";
+
+import { shouldConnectMcp } from "../mcp-gate.js";
+
+const nothing = {
+  mcpServerUsageCount: 0,
+  datastoreUsageCount: 0,
+  channelMessagingCount: 0,
+  conversationChannelId: undefined,
+};
+
+describe("shouldConnectMcp", () => {
+  it("skips the MCP block when no tool source exists", () => {
+    expect(shouldConnectMcp(nothing)).toBe(false);
+  });
+
+  it("enters on declared MCP server usages alone", () => {
+    expect(shouldConnectMcp({ ...nothing, mcpServerUsageCount: 1 })).toBe(true);
+  });
+
+  it("enters on datastore usages alone (the records attachment)", () => {
+    expect(shouldConnectMcp({ ...nothing, datastoreUsageCount: 1 })).toBe(true);
+  });
+
+  it("enters on a serving proactive channel alone (the channels attachment)", () => {
+    expect(shouldConnectMcp({ ...nothing, channelMessagingCount: 1 })).toBe(true);
+  });
+
+  it("enters on a channel conversation alone (the conversation attachment)", () => {
+    // The reply-only pilot shape: no declared servers, no datastores,
+    // no proactive channel — the escalation tool is the ONLY source.
+    expect(shouldConnectMcp({ ...nothing, conversationChannelId: "agch_1" })).toBe(true);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/prompt-builder.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from "vitest";
 import { InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { buildEnhancedSystemPrompt } from "../prompt-builder.js";
+import { buildEnhancedSystemPrompt, composeUserMessage } from "../prompt-builder.js";
 import { PLAN_MODE_DIRECTIVE } from "../../../shared/plan-mode-prompt.js";
 import { SourceType } from "../../../shared/workspace/types.js";
 import type { ProvisionResult } from "../../../shared/workspace/types.js";
@@ -408,3 +408,41 @@ describe("buildEnhancedSystemPrompt", () => {
     });
   });
 });
+
+describe("composeUserMessage (conversation catchup, cloud DD-006 / A27)", () => {
+  const MESSAGE = "where is my order?";
+  const DIGEST =
+    "Customer: I want a refund\nTeammate: I've refunded you in full.";
+
+  it("prepends the framed catchup to the turn's user message — history durability rides the checkpointer, not the rebuilt system prompt", () => {
+    const composed = composeUserMessage(MESSAGE, DIGEST);
+
+    expect(composed.endsWith(MESSAGE)).toBe(true);
+    expect(composed).toContain(DIGEST);
+    expect(composed).toContain("you have not seen");
+    expect(composed.indexOf(DIGEST)).toBeLessThan(composed.indexOf(MESSAGE));
+  });
+
+  it("separates the catchup from the customer's message with a horizontal rule", () => {
+    expect(composeUserMessage(MESSAGE, DIGEST)).toContain("\n\n---\n\n");
+  });
+
+  it("leaves the message untouched when there is no catchup — most turns carry none", () => {
+    expect(composeUserMessage(MESSAGE, undefined)).toBe(MESSAGE);
+  });
+
+  it("never renders in the system prompt — the rebuilt-per-invocation lane would forget the digest one turn later", () => {
+    const prompt = buildEnhancedSystemPrompt({
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "/workspace",
+      injectedFiles: [],
+    });
+
+    expect(prompt).not.toContain("Conversation catchup");
+    expect(prompt).not.toContain("you have not seen");
+  });
+});

package/src/activities/execute-deep-agent/mcp-gate.ts

@@ -0,0 +1,37 @@
+/**
+ * The deep-agent harness's MCP gate: whether this execution enters MCP
+ * resolution at all (resolve, backfill, synthesized-attachment
+ * injection, connect). Unlike the Cursor harness — which resolves MCP
+ * unconditionally — deep-agent skips the whole block when no tool
+ * source exists, so EVERY tool source must appear here or its tools are
+ * silently dropped for exactly the agents whose only source it is
+ * (proactive-messaging DD-006 D7 learned this for channel messaging).
+ *
+ * Extracted from setup.ts as a pure function because setup.ts is
+ * untestable at file load (its import graph is why no setup.test.ts
+ * exists); the gate is the one piece whose regression is silent, so it
+ * gets its own module and an arm-by-arm test.
+ */
+
+/** One flag per tool source. Adding a source? It gates here or it is dropped. */
+export interface McpToolSources {
+  /** Declared MCP server usages (agent spec + session spec). */
+  readonly mcpServerUsageCount: number;
+  /** Declared datastore usages (the records attachment, T05). */
+  readonly datastoreUsageCount: number;
+  /** Serving proactive-messaging channels (the channels attachment, DD-006). */
+  readonly channelMessagingCount: number;
+  /** The serving channel id when this session IS a live channel
+   *  conversation (the conversation attachment, DD-008). */
+  readonly conversationChannelId: string | undefined;
+}
+
+/** True when any tool source demands MCP resolution and connect. */
+export function shouldConnectMcp(sources: McpToolSources): boolean {
+  return (
+    sources.mcpServerUsageCount > 0 ||
+    sources.datastoreUsageCount > 0 ||
+    sources.channelMessagingCount > 0 ||
+    sources.conversationChannelId !== undefined
+  );
+}

package/src/activities/execute-deep-agent/prompt-builder.ts

@@ -11,6 +11,7 @@ import { InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecuti
 import type { ProvisionResult, GitMetadata } from "../../shared/workspace/types.js";
 import { SourceType } from "../../shared/workspace/types.js";
 import { formatContextBridgeText } from "../../shared/context-bridge.js";
+import { formatConversationCatchupText } from "../../shared/conversation-catchup.js";
 import {
   formatSenderIdentityText,
   type SenderIdentity,
@@ -241,9 +242,28 @@ export function buildEnhancedSystemPrompt(input: PromptBuilderInput): string {
   return prompt;
 }
 
+/**
+ * Compose the turn's USER MESSAGE for the graph invocation: the framed
+ * conversation catchup (cloud DD-006), when present, prepended to the
+ * customer's message. In the user message and never the system prompt (A27):
+ * the system prompt is rebuilt per invocation and would forget the digest one
+ * turn later, while a message enters the checkpointer with the turn and
+ * persists in history — the same durability the cursor harness gets from its
+ * prompt prefix. The caller's `spec.message` is never mutated; the prepend
+ * exists only in the graph input.
+ */
+export function composeUserMessage(
+  message: string,
+  conversationCatchup: string | undefined,
+): string {
+  return conversationCatchup
+    ? `${formatConversationCatchupText(conversationCatchup)}\n\n---\n\n${message}`
+    : message;
+}
+
 function buildWorkspacePromptSection(
-  provisionResults: ProvisionResult[],
-  containerRoot: string,
+    provisionResults: ProvisionResult[],
+    containerRoot: string,
 ): string {
   if (provisionResults.length === 0) return "";
 

package/src/activities/execute-deep-agent/setup.ts

@@ -25,6 +25,7 @@ import type { StigmerClient } from "../../client/stigmer-client.js";
 import { TimingRecorder, emitTimingLog } from "../../shared/cold-start-timing.js";
 import { createCheckpointer } from "../../shared/checkpointer/factory.js";
 import { readContextBridge } from "../../shared/context-bridge.js";
+import { readConversationCatchup } from "../../shared/conversation-catchup.js";
 import { readSenderIdentity } from "../../shared/sender-identity.js";
 import {
   injectCallerIdentityEnv,
@@ -44,7 +45,12 @@ import {
   formatChannelTemplatesSection,
   synthesizeChannelAttachment,
 } from "../../shared/channel-attachment.js";
+import {
+  readChannelConversationId,
+  synthesizeConversationAttachment,
+} from "../../shared/conversation-attachment.js";
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
+import { shouldConnectMcp } from "./mcp-gate.js";
 import { WorkspaceProvisioner } from "../../shared/workspace/provisioner.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
 import type { WorkspaceBackend, ProvisionResult } from "../../shared/workspace/types.js";
@@ -59,7 +65,7 @@ import { resolveSessionWorkspaceRoot } from "../../shared/workspace/session-root
 import { buildWorkspaceFileTree } from "../../shared/workspace/file-tree.js";
 import { reportSetupProgress } from "../../shared/status.js";
 import { resolveEnvironment, type EnvironmentResult } from "./environment.js";
-import { buildEnhancedSystemPrompt } from "./prompt-builder.js";
+import { buildEnhancedSystemPrompt, composeUserMessage } from "./prompt-builder.js";
 import { buildMiddlewareStack } from "../../middleware/index.js";
 import type { GracefulStopMiddleware } from "../../middleware/index.js";
 import { createThinkTool, createWebFetchTool, resolveGuardPosture } from "../../tools/index.js";
@@ -361,8 +367,18 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     // answer — no tool, no section, execution unharmed.
     const channelMessaging = await discoverChannelMessaging(client, exchangedRunnerToken);
 
+    // The conversation-attachment decision (DD-008 D-c): the channel-id
+    // session label, stamped server-side on every channel session — a
+    // free, synchronous read, so no hoisted discovery needed.
+    const conversationChannelId = readChannelConversationId(session.metadata?.labels);
+
     let resolvedMcpServers: Awaited<ReturnType<typeof resolveMcpServers>> | null = null;
-    if (mcpServerUsages.length > 0 || datastoreUsages.length > 0 || channelMessaging.length > 0) {
+    if (shouldConnectMcp({
+      mcpServerUsageCount: mcpServerUsages.length,
+      datastoreUsageCount: datastoreUsages.length,
+      channelMessagingCount: channelMessaging.length,
+      conversationChannelId,
+    })) {
       await reportSetupProgress(client, executionId, "Connecting tools…");
       const transportPosture = resolveMcpTransportPosture(config.mode);
       // The MCP-bound env map (and ONLY it) carries the reserved
@@ -424,6 +440,21 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
           );
         }
       }
+
+      // The conversation participation attachment (DD-008 D-c) — the
+      // third sibling, same after-backfill rule. HTTP-only: synthesize
+      // answers undefined with no bridge endpoint by design (see
+      // shared/conversation-attachment.ts).
+      const conversationAttachment = synthesizeConversationAttachment(conversationChannelId, {
+        bridgeEndpoint: config.mcpBridgeEndpoint,
+        credential: attachmentCredential,
+        backendEndpoint: config.stigmerBackendEndpoint,
+      });
+      if (conversationAttachment) {
+        backfilledServers = injectSynthesizedAttachment(
+          backfilledServers, conversationAttachment, "conversation participation",
+        );
+      }
       resolvedMcpServers = { resolvedServers: backfilledServers };
       timing.mark("backfill_mcp");
 
@@ -743,8 +774,13 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       ...(isPlanMode ? { permissions: planModePermissions } : {}),
     } as Parameters<typeof createDeepAgent>[0]);
 
-    // Step 11: Prepare invocation input and config
-    let userMessage = execution.spec!.message;
+    // Step 11: Prepare invocation input and config. The conversation catchup
+    // (cloud DD-006) rides the USER MESSAGE, not the system prompt — see
+    // composeUserMessage for the durability rationale (A27).
+    let userMessage = composeUserMessage(
+      execution.spec!.message,
+      readConversationCatchup(execution.spec!.conversationCatchup),
+    );
     if (outputSchema) {
       userMessage += `\n\n---\nIMPORTANT: When your analysis is complete, provide your findings as structured output matching the required schema. The system will capture your structured response automatically.`;
     }

package/src/shared/__tests__/channel-attachment.test.ts

@@ -3,9 +3,9 @@
  * discovery with the never-throw failure posture, both connection
  * shapes, the structural approval-freedom the datastore attachment
  * pinned before it, and the prompt section's filter/order/cap rules
- * (DD-006 D6). The cross-repo pinned strings (slug, route, roster) are
- * guarded here and in the mcp-server integration test — the
- * TOOL_CALL_LIMIT precedent.
+ * (DD-006 D6). The route is the cross-repo string, guarded here and in
+ * the mcp-server integration test (the TOOL_CALL_LIMIT precedent); the
+ * slug and roster are runner-internal and guarded here alone.
  */
 
 import { describe, expect, it, vi } from "vitest";