@themoltnet/agent-daemon 0.3.1 → 0.5.0

package/dist/main.js

@@ -9,9 +9,9 @@ import { createHash as createHash$1 } from "node:crypto";
 import path, { dirname, isAbsolute, join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { execFile, execFileSync } from "node:child_process";
-import { DefaultResourceLoader, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createReadToolDefinition, createWriteToolDefinition, defineTool } from "@earendil-works/pi-coding-agent";
+import { DefaultResourceLoader, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createReadToolDefinition, createSyntheticSourceInfo, createWriteToolDefinition, defineTool, parseFrontmatter } from "@earendil-works/pi-coding-agent";
 import { Type, getModel } from "@earendil-works/pi-ai";
-import { RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, loadGuestAssets } from "@earendil-works/gondolin";
+import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, loadGuestAssets } from "@earendil-works/gondolin";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-proto";
 import { resourceFromAttributes } from "@opentelemetry/resources";
 import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
@@ -2886,6 +2886,55 @@ var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a
 if (!Has$1("uuid")) Set$1("uuid", (v) => UUID_RE.test(v));
 if (!Has$1("date-time")) Set$1("date-time", (v) => !Number.isNaN(Date.parse(v)));
 //#endregion
+//#region ../../libs/tasks/src/context.ts
+/**
+* How an executor delivers a context entry to its underlying LLM.
+* V1 bindings only; Tier-2 (reference_file, mcp_resource, imported_file,
+* tool_response_seed, additional_context_hook) ship in a later slice.
+*/
+var ContextBinding = Type$2.Union([
+	Type$2.Literal("skill"),
+	Type$2.Literal("prompt_prefix"),
+	Type$2.Literal("user_inline")
+], { $id: "ContextBinding" });
+/**
+* One context entry. Bytes are inlined: the imposer chose them, and the
+* task's `inputCid` already pins the entire input — including
+* `context[]` — so we don't need a separate per-entry hash, fetcher, or
+* flagged-content gate. Tasks reference rendered packs (or any other
+* external content) by copying their bytes into `content` at task
+* creation time.
+*
+* - `slug` — short identifier the daemon uses to disambiguate
+*            entries. For `skill` binding it becomes the directory
+*            name under the runtime's skill discovery path. Must be
+*            kebab-case-safe (alphanumeric + dashes/underscores).
+* - `binding` — how the bytes are delivered to the LLM (see above).
+* - `content` — the actual bytes (UTF-8 text). Capped at 32 KiB per
+*               entry; total per-task context bytes are bounded by the
+*               soft `maxItems` cap and per-binding daemon limits.
+*/
+var ContextRef = Type$2.Object({
+	slug: Type$2.String({
+		minLength: 1,
+		maxLength: 64,
+		pattern: "^[a-zA-Z0-9_-]+$"
+	}),
+	binding: ContextBinding,
+	content: Type$2.String({
+		minLength: 1,
+		maxLength: 32768
+	})
+}, {
+	$id: "ContextRef",
+	additionalProperties: false
+});
+/** Reusable input fragment for any task type. Soft cap at 5 items. */
+var TaskContext = Type$2.Array(ContextRef, {
+	$id: "TaskContext",
+	maxItems: 5
+});
+//#endregion
 //#region ../../libs/tasks/src/rubric.ts
 /**
 * Rubric — structured acceptance criteria used by judgment tasks.
@@ -4275,6 +4324,60 @@ var RenderPackOutput = Type$2.Object({
 	additionalProperties: false
 });
 //#endregion
+//#region ../../libs/tasks/src/task-types/run-eval.ts
+/**
+* `run_eval` — execute a scenario prompt under a named variant for
+* later cross-variant grading by `judge_eval_variant` (Slice 2).
+*
+* output_kind: artifact
+* criteria: optional (when set, output.verification is required —
+*   producer self-assessment; the judge is the binding evaluator)
+* references: not required (scenario lives entirely in input)
+*/
+var RUN_EVAL_TYPE = "run_eval";
+var RunEvalInput = Type$2.Object({
+	scenario: Type$2.Object({
+		prompt: Type$2.String({ minLength: 1 }),
+		inputFiles: Type$2.Optional(Type$2.Array(Type$2.String({ minLength: 1 })))
+	}, { additionalProperties: false }),
+	variantLabel: Type$2.String({
+		minLength: 1,
+		maxLength: 64
+	}),
+	context: TaskContext,
+	successCriteria: Type$2.Optional(SuccessCriteria)
+}, {
+	$id: "RunEvalInput",
+	additionalProperties: false
+});
+var RunEvalOutput = Type$2.Object({
+	response: Type$2.String({ minLength: 1 }),
+	artifacts: Type$2.Optional(Type$2.Array(Type$2.Object({
+		path: Type$2.String({ minLength: 1 }),
+		cid: Type$2.String({ minLength: 1 })
+	}, { additionalProperties: false }))),
+	totalTokens: Type$2.Integer({ minimum: 0 }),
+	durationMs: Type$2.Integer({ minimum: 0 }),
+	traceparent: Type$2.String({ minLength: 1 }),
+	verification: Type$2.Optional(VerificationRecord)
+}, {
+	$id: "RunEvalOutput",
+	additionalProperties: false
+});
+/**
+* Cross-field rule mirroring the `requireVerificationWhenCriteriaPresent`
+* rule used by the brief task types: when input declares
+* `successCriteria`, output MUST carry `verification`; when it doesn't,
+* output MUST NOT carry one.
+*/
+function validateRunEvalOutput(output, input) {
+	const hasCriteria = input !== null && input !== void 0 && input.successCriteria !== void 0;
+	const hasVerification = output !== null && output !== void 0 && output.verification !== void 0;
+	if (hasCriteria && !hasVerification) return "output.verification is required because input.successCriteria is set; the producer LLM must self-assess against the criteria";
+	if (!hasCriteria && hasVerification) return "output.verification was supplied but input.successCriteria is unset; omit verification when there are no criteria to assess against";
+	return null;
+}
+//#endregion
 //#region ../../libs/tasks/src/task-types/index.ts
 /**
 * Validate that a judgment-task input carries a rubric inside its
@@ -4353,6 +4456,14 @@ var BUILT_IN_TASK_TYPES = {
 		requiresReferences: true,
 		validateInput: validateJudgmentInput,
 		validateOutput: validateJudgePackOutput
+	},
+	[RUN_EVAL_TYPE]: {
+		name: RUN_EVAL_TYPE,
+		inputSchema: RunEvalInput,
+		outputSchema: RunEvalOutput,
+		outputKind: "artifact",
+		requiresReferences: false,
+		validateOutput: validateRunEvalOutput
 	}
 };
 //#endregion
@@ -5295,6 +5406,14 @@ var ExecutorTrustLevel = Type$2.Union([
 	Type$2.Literal("releaseVerifiedTool"),
 	Type$2.Literal("sandboxAttested")
 ], { $id: "ExecutorTrustLevel" });
+/** Identifies a (provider, model) daemon pair allowed to claim a task. */
+var ExecutorRef = Type$2.Object({
+	provider: Type$2.String({ minLength: 1 }),
+	model: Type$2.String({ minLength: 1 })
+}, {
+	$id: "ExecutorRef",
+	additionalProperties: false
+});
 var OutputKind = Type$2.Union([Type$2.Literal("artifact"), Type$2.Literal("judgment")], { $id: "OutputKind" });
 var TaskMessageKind = Type$2.Union([
 	Type$2.Literal("text_delta"),
@@ -5387,6 +5506,7 @@ Type$2.Object({
 	imposedByHumanId: Type$2.Union([Uuid, Type$2.Null()]),
 	acceptedAttemptN: Type$2.Union([Type$2.Number(), Type$2.Null()]),
 	requiredExecutorTrustLevel: ExecutorTrustLevel,
+	allowedExecutors: Type$2.Array(ExecutorRef, { maxItems: 16 }),
 	status: TaskStatus,
 	queuedAt: IsoTimestamp,
 	completedAt: Type$2.Union([IsoTimestamp, Type$2.Null()]),
@@ -5608,6 +5728,61 @@ function isHelpFlag(args) {
 	return args.includes("--help") || args.includes("-h");
 }
 //#endregion
+//#region ../../libs/agent-runtime/src/context-bindings.ts
+var PROMPT_SEPARATOR = "\n\n---\n\n";
+/**
+* Resolve `task.input.context[]` into delivered side-effects (skills
+* persisted via `deliver.skill`) and prompt fragments
+* (`systemPromptPrefix`, `userInlineSuffix`) the caller weaves into the
+* built prompt.
+*
+* Per-binding semantics (V1):
+*   - `skill`         → `deliver.skill({ slug, content })` once per ref.
+*                       Slug collisions on distinct contents are
+*                       refused loudly.
+*   - `prompt_prefix` → content appended to `systemPromptPrefix` with
+*                       the canonical `\n\n---\n\n` separator (in
+*                       declared order).
+*   - `user_inline`   → content appended to `userInlineSuffix` in
+*                       declared order, same separator.
+*
+* No fetching, no hashing — bytes are inlined in `ContextRef.content`,
+* and the task's `inputCid` already pins the entire input. The imposer
+* chose these bytes; the resolver just dispatches them.
+*
+* The function is pure with respect to its arguments: file writes are
+* confined to the injected `deliver` callback, which makes the
+* resolver trivial to test.
+*/
+async function resolveTaskContext(args) {
+	const promptParts = [];
+	const userParts = [];
+	const injected = [];
+	const usedSlugs = /* @__PURE__ */ new Map();
+	for (const ref of args.context) {
+		if (ref.binding === "skill") {
+			const prior = usedSlugs.get(ref.slug);
+			if (prior !== void 0) {
+				if (prior !== ref.content) throw new Error(`slug collision on '${ref.slug}': two skill entries share the same slug but have different content`);
+				injected.push(ref);
+				continue;
+			}
+			usedSlugs.set(ref.slug, ref.content);
+			await args.deliver.skill({
+				slug: ref.slug,
+				content: ref.content
+			});
+		} else if (ref.binding === "prompt_prefix") promptParts.push(ref.content);
+		else userParts.push(ref.content);
+		injected.push(ref);
+	}
+	return {
+		injected,
+		systemPromptPrefix: promptParts.join(PROMPT_SEPARATOR),
+		userInlineSuffix: userParts.join(PROMPT_SEPARATOR)
+	};
+}
+//#endregion
 //#region ../../libs/agent-runtime/src/output-tools.ts
 /**
 * Submit-output tool contract.
@@ -5702,7 +5877,7 @@ function buildFinalOutputBlock(opts) {
 //#endregion
 //#region ../../libs/agent-runtime/src/prompts/assess-brief.ts
 /**
-* Build the system prompt for an `assess_brief` judge attempt.
+* Build the first user-message prompt for an `assess_brief` judge attempt.
 *
 * Design note — no pre-resolved `target` projection
 * --------------------------------------------------
@@ -5723,7 +5898,7 @@ function buildFinalOutputBlock(opts) {
 * future task types whose products are docs / configs / changes /
 * anything) work without any code path here.
 */
-function buildAssessBriefPrompt(input, ctx) {
+function buildAssessBriefUserPrompt(input, ctx) {
 	const rubric = input.successCriteria.rubric;
 	const criteriaList = rubric.criteria.map((c, i) => `${i + 1}. **${c.id}** (weight ${c.weight}, scoring: \`${c.scoring}\`) — ${c.description}`).join("\n");
 	const preambleSection = rubric.preamble ? [
@@ -5838,7 +6013,7 @@ function buildSelfVerificationBlock(taskId) {
 //#endregion
 //#region ../../libs/agent-runtime/src/prompts/curate-pack.ts
 /**
-* Build the system prompt for a `curate_pack` task.
+* Build the first user-message prompt for a `curate_pack` task.
 *
 * Design note: this prompt is deliberately NOT a numbered command
 * sequence. The curator's value comes from judgment — inferring scope
@@ -5859,7 +6034,7 @@ function buildSelfVerificationBlock(taskId) {
 * emits pruned state at phase boundaries so a follow-up session can
 * resume without replaying the tool history.
 */
-function buildCuratePackPrompt(input, ctx) {
+function buildCuratePackUserPrompt(input, ctx) {
 	const { diaryId, taskPrompt, entryTypes, tagFilters, tokenBudget, recipe } = input;
 	const entryTypesPinned = Boolean(entryTypes);
 	const resolvedRecipe = recipe ?? "topic-focused-v1";
@@ -5995,13 +6170,13 @@ function buildCuratePackPrompt(input, ctx) {
 //#endregion
 //#region ../../libs/agent-runtime/src/prompts/fulfill-brief.ts
 /**
-* Build the system prompt for a `fulfill_brief` task.
+* Build the first user-message prompt for a `fulfill_brief` task.
 *
 * Generalized from the original `resolve-issue` prompt. No longer
 * GitHub-specific; references live on `Task.references[]` and the agent
 * is told to inspect them itself.
 */
-function buildFulfillBriefPrompt(input, ctx) {
+function buildFulfillBriefUserPrompt(input, ctx) {
 	const { brief, title, acceptanceCriteria, seedFiles, scopeHint } = input;
 	const criteriaSection = acceptanceCriteria?.length ? [
 		"### Acceptance criteria",
@@ -6081,7 +6256,7 @@ function buildFulfillBriefPrompt(input, ctx) {
 }
 //#endregion
 //#region ../../libs/agent-runtime/src/prompts/judge-pack.ts
-function buildJudgePackPrompt(input, ctx) {
+function buildJudgePackUserPrompt(input, ctx) {
 	const { renderedPackId, sourcePackId, successCriteria } = input;
 	const rubric = successCriteria.rubric;
 	const criteriaList = rubric.criteria.map((c, i) => `${i + 1}. **${c.id}** (weight ${c.weight}, scoring: \`${c.scoring}\`) — ${c.description}`).join("\n");
@@ -6208,10 +6383,10 @@ function buildJudgePackPrompt(input, ctx) {
 //#endregion
 //#region ../../libs/agent-runtime/src/prompts/render-pack.ts
 /**
-* Build the system prompt for a `render_pack` task. Almost mechanical:
+* Build the first user-message prompt for a `render_pack` task. Almost mechanical:
 * wraps `moltnet_pack_render` and emits the receipt.
 */
-function buildRenderPackPrompt(input, ctx) {
+function buildRenderPackUserPrompt(input, ctx) {
 	const { packId, persist = true, pinned = false } = input;
 	return [
 		"# Render Pack Agent",
@@ -6265,19 +6440,87 @@ function buildRenderPackPrompt(input, ctx) {
 	].join("\n");
 }
 //#endregion
+//#region ../../libs/agent-runtime/src/prompts/run-eval.ts
+/**
+* Build the first user-message prompt for a `run_eval` task.
+*
+* Free-form: no git workflow, no commit ceremony. The executor produces
+* a textual response (and optional file artifacts) that a later
+* `judge_eval_variant` task (Slice 2) grades against the rubric.
+*
+* Context delivery is handled by `resolveTaskContext` (see
+* libs/agent-runtime/src/context-bindings.ts) and runs BEFORE this
+* prompt is rendered: `prompt_prefix` items are concatenated ahead of
+* the body, `skill` items are persisted at the runtime's skill path,
+* and `user_inline` items are appended to the first user message. This
+* builder does NOT inline `input.context[]` itself.
+*/
+function buildRunEvalUserPrompt(input, ctx) {
+	const { scenario, variantLabel, successCriteria } = input;
+	const inputFilesSection = scenario.inputFiles?.length ? [
+		"### Input files",
+		"",
+		...scenario.inputFiles.map((f) => `- \`${f}\``),
+		""
+	].join("\n") : "";
+	const verificationSection = successCriteria ? buildSelfVerificationBlock(ctx.taskId) : "";
+	const correlationSection = ctx.correlationId ? [
+		"### Correlation",
+		"",
+		`This task carries correlationId \`${ctx.correlationId}\`. It joins`,
+		"this variant to its sibling `run_eval` tasks (other variants of the",
+		"same scenario) and to the eventual `judge_eval_variant` task that",
+		"will grade them together. You do not need to act on it directly —",
+		"it is recorded for cross-variant aggregation at query time.",
+		""
+	].join("\n") : "";
+	const finalOutputBlock = buildFinalOutputBlock({
+		taskType: "run_eval",
+		outputSchemaName: "RunEvalOutput",
+		shapeSketch: [
+			"{",
+			"  \"response\": \"<your free-form answer>\",",
+			"  \"artifacts\": [{ \"path\": \"...\", \"cid\": \"...\" }],  // optional",
+			"  \"totalTokens\": <int>,",
+			"  \"durationMs\": <int>,",
+			"  \"traceparent\": \"<from claim>\",",
+			"  \"verification\": <required iff input.successCriteria; see Self-verification>",
+			"}"
+		].join("\n")
+	});
+	return [
+		"# Run Eval Agent\n",
+		`You are running an evaluation scenario as variant \`${variantLabel}\`.\nTask id: \`${ctx.taskId}\`\n`,
+		correlationSection,
+		`### Scenario\n\n${scenario.prompt}\n`,
+		inputFilesSection,
+		verificationSection,
+		finalOutputBlock
+	].filter((s) => s !== "").join("\n");
+}
+//#endregion
 //#region ../../libs/agent-runtime/src/prompts/index.ts
 /**
-* Resolve the correct prompt builder for `task.taskType` and invoke it.
-* Throws if the type is unknown or the input fails TypeBox validation.
-*/
-function buildPromptForTask(task, ctx) {
+* Resolve the correct user-prompt builder for `task.taskType` and
+* invoke it. Throws if the type is unknown or the input fails TypeBox
+* validation.
+*
+* Role note: the returned string is delivered as the **first user
+* message** of the agent's session (pi-coding-agent's
+* `session.prompt(text)` puts text in the user role). The system
+* prompt is built separately by pi from `appendSystemPrompt` (the
+* runtime instructor lives there). Builders here are free-form Markdown
+* for the user turn; they don't replace or prepend to the system
+* prompt.
+*/
+function buildTaskUserPrompt(task, ctx) {
 	switch (task.taskType) {
 		case FULFILL_BRIEF_TYPE:
 			if (!Check(FulfillBriefInput, task.input)) {
 				const errors = [...Errors(FulfillBriefInput, task.input)];
 				throw new Error(`fulfill_brief input failed validation: ${JSON.stringify(errors.slice(0, 3))}`);
 			}
-			return buildFulfillBriefPrompt(task.input, {
+			return buildFulfillBriefUserPrompt(task.input, {
 				diaryId: ctx.diaryId,
 				taskId: ctx.taskId,
 				correlationId: task.correlationId
@@ -6287,7 +6530,7 @@ function buildPromptForTask(task, ctx) {
 				const errors = [...Errors(AssessBriefInput, task.input)];
 				throw new Error(`assess_brief input failed validation: ${JSON.stringify(errors.slice(0, 3))}`);
 			}
-			return buildAssessBriefPrompt(task.input, {
+			return buildAssessBriefUserPrompt(task.input, {
 				diaryId: ctx.diaryId,
 				taskId: ctx.taskId
 			});
@@ -6296,7 +6539,7 @@ function buildPromptForTask(task, ctx) {
 				const errors = [...Errors(CuratePackInput, task.input)];
 				throw new Error(`curate_pack input failed validation: ${JSON.stringify(errors.slice(0, 3))}`);
 			}
-			return buildCuratePackPrompt(task.input, {
+			return buildCuratePackUserPrompt(task.input, {
 				diaryId: ctx.diaryId,
 				taskId: ctx.taskId
 			});
@@ -6305,7 +6548,7 @@ function buildPromptForTask(task, ctx) {
 				const errors = [...Errors(RenderPackInput, task.input)];
 				throw new Error(`render_pack input failed validation: ${JSON.stringify(errors.slice(0, 3))}`);
 			}
-			return buildRenderPackPrompt(task.input, {
+			return buildRenderPackUserPrompt(task.input, {
 				diaryId: ctx.diaryId,
 				taskId: ctx.taskId
 			});
@@ -6314,16 +6557,45 @@ function buildPromptForTask(task, ctx) {
 				const errors = [...Errors(JudgePackInput, task.input)];
 				throw new Error(`judge_pack input failed validation: ${JSON.stringify(errors.slice(0, 3))}`);
 			}
-			return buildJudgePackPrompt(task.input, {
+			return buildJudgePackUserPrompt(task.input, {
 				diaryId: ctx.diaryId,
 				taskId: ctx.taskId
 			});
+		case RUN_EVAL_TYPE:
+			if (!Check(RunEvalInput, task.input)) {
+				const errors = [...Errors(RunEvalInput, task.input)];
+				throw new Error(`run_eval input failed validation: ${JSON.stringify(errors.slice(0, 3))}`);
+			}
+			return buildRunEvalUserPrompt(task.input, {
+				diaryId: ctx.diaryId,
+				taskId: ctx.taskId,
+				correlationId: task.correlationId
+			});
 		default: throw new Error(`No prompt builder registered for taskType="${task.taskType}"`);
 	}
 }
 //#endregion
 //#region ../../libs/agent-runtime/src/reporters/api.ts
 /**
+* True when an error looks like the Keto "tuple lagged the read API"
+* race: HTTP 403 plus a server message starting with "Not authorized".
+* Used to gate the first-append retry to the narrow recoverable case.
+*
+* The server's task.service.ts returns errors of the form
+*   `Not authorized to <verb> ...`
+* for every claimant-relation check (append messages, list messages,
+* heartbeat, complete, fail). Other Fastify 403s — auth-plugin
+* rejection, route-level guards — use different message shapes and
+* are not consistency-window flakes; retrying them just delays the
+* permanent failure surfacing.
+*/
+function isKetoConsistencyLag403(err) {
+	if (!err || typeof err !== "object") return false;
+	if (err.statusCode !== 403) return false;
+	const message = err.message ?? "";
+	return /Not authorized/i.test(message);
+}
+/**
 * TaskReporter backed by the Tasks API via the SDK's TasksNamespace.
 *
 * - `open()` fires an immediate heartbeat (satisfies DBOS recv('started', 300s))
@@ -6349,6 +6621,15 @@ var ApiTaskReporter = class {
 	* failures are never silently dropped by the batching layer.
 	*/
 	pendingError = null;
+	/**
+	* Flips to `true` after the first successful `appendMessages` call.
+	* Used to gate the 403-retry window in `flush` to the very first
+	* append (the only point where the Keto `Task:claimant#Agent` tuple
+	* can lag the read API). Once any append has succeeded, Keto is
+	* known consistent for this task and a 403 thereafter is a real
+	* authorization failure that should surface immediately.
+	*/
+	firstAppendSucceeded = false;
 	cancelController = new AbortController();
 	observedCancelReason = null;
 	maxBatchSize;
@@ -6376,6 +6657,7 @@ var ApiTaskReporter = class {
 		}
 		this.taskId = ctx.taskId;
 		this.attemptN = ctx.attemptN;
+		this.firstAppendSucceeded = false;
 		await this.sendInitialHeartbeat();
 		const intervalMs = this.opts.heartbeatIntervalMs ?? 6e4;
 		if (intervalMs > 0) this.heartbeatTimer = setInterval(() => {
@@ -6421,7 +6703,8 @@ var ApiTaskReporter = class {
 		const batch = this.buffer.splice(0, this.buffer.length);
 		this.inFlight = (async () => {
 			try {
-				await this.opts.tasks.appendMessages(this.taskId, this.attemptN, { messages: batch });
+				await this.appendWithFirstCallRetry(batch);
+				this.firstAppendSucceeded = true;
 			} catch (err) {
 				const overflowCap = this.maxBatchSize * 3;
 				const restoredCount = batch.length;
@@ -6498,18 +6781,53 @@ var ApiTaskReporter = class {
 	async sendInitialHeartbeat() {
 		const maxAttempts = 5;
 		const baseDelayMs = 100;
-		let lastErr;
 		for (let attempt = 1; attempt <= maxAttempts; attempt += 1) try {
 			await this.sendHeartbeat();
 			return;
 		} catch (err) {
-			lastErr = err;
 			if ((err && typeof err === "object" && "statusCode" in err ? err.statusCode : void 0) !== 403 || attempt === maxAttempts) throw err;
 			await new Promise((resolve) => {
 				setTimeout(resolve, baseDelayMs * attempt);
 			});
 		}
-		throw lastErr;
+	}
+	/**
+	* Wrap `tasks.appendMessages` with a bounded 403-retry on the first
+	* call only. Mirrors `sendInitialHeartbeat` — the same Keto
+	* `Task:claimant#Agent` tuple race covers both endpoints, and a
+	* batched-up first flush triggered immediately after `open()` (e.g.
+	* a fast executor that records a `task_started` info message before
+	* any heartbeat round-trip completes) can hit a 403 even though the
+	* heartbeat itself eventually succeeds.
+	*
+	* Once `firstAppendSucceeded` is set we know Keto is consistent for
+	* this task and any subsequent 403 is a real authorization failure
+	* (e.g. another agent stole the claim) that must surface immediately.
+	*
+	* Retry budget is intentionally tight: the documented Keto
+	* consistency window is "tens of milliseconds," so 100 ms + 200 ms
+	* (3 attempts total) covers the realistic window with margin without
+	* adding meaningful latency to the permanent-failure path (wrong
+	* task ID, claim revoked, etc.). We also string-match the server's
+	* `Not authorized` message to avoid retrying 403s that mean
+	* something else (Fastify routes can 403 for non-auth reasons too).
+	*/
+	async appendWithFirstCallRetry(batch) {
+		if (this.firstAppendSucceeded) {
+			await this.opts.tasks.appendMessages(this.taskId, this.attemptN, { messages: batch });
+			return;
+		}
+		const maxAttempts = 3;
+		const baseDelayMs = 100;
+		for (let attempt = 1; attempt <= maxAttempts; attempt += 1) try {
+			await this.opts.tasks.appendMessages(this.taskId, this.attemptN, { messages: batch });
+			return;
+		} catch (err) {
+			if (attempt === maxAttempts || !isKetoConsistencyLag403(err)) throw err;
+			await new Promise((resolve) => {
+				setTimeout(resolve, baseDelayMs * attempt);
+			});
+		}
 	}
 	async sendHeartbeat() {
 		const body = this.opts.leaseTtlSec ? { leaseTtlSec: this.opts.leaseTtlSec } : {};
@@ -9033,13 +9351,31 @@ function problemToError(problem, statusCode) {
 //#endregion
 //#region ../../libs/sdk/src/agent-context.ts
 function unwrapResult(result) {
-	if (result.error) {
+	if (result.error !== void 0 && result.error !== null) {
 		const error = result.error;
-		throw problemToError(error, error.status ?? 500);
+		if (isProblemDetails(error)) throw problemToError(error, error.status);
+		if (error instanceof Error && result.response === void 0) {
+			const networkError = new NetworkError(error.message, { detail: error.cause ? stringifyUnknown(error.cause) : void 0 });
+			networkError.stack = error.stack;
+			throw networkError;
+		}
+		throw new MoltNetError(`Unexpected error from MoltNet API: ${stringifyUnknown(error)}`, { code: "UNKNOWN" });
 	}
 	if (result.data === void 0) throw new MoltNetError("Unexpected empty response from MoltNet API", { code: "EMPTY_RESPONSE" });
 	return result.data;
 }
+function isProblemDetails(error) {
+	if (!error || typeof error !== "object") return false;
+	return typeof error.status === "number" && ("title" in error || "detail" in error);
+}
+function stringifyUnknown(value) {
+	if (value instanceof Error) return `${value.name}: ${value.message}`;
+	try {
+		return JSON.stringify(value) ?? String(value);
+	} catch {
+		return String(value);
+	}
+}
 function unwrapRequired(result, message, code) {
 	if (result.error || !result.data) throw new MoltNetError(message, { code });
 	return result.data;
@@ -12805,6 +13141,7 @@ var PollingApiTaskSource = class {
 		this.minBackoffMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
 		this.maxBackoffMs = opts.maxPollIntervalMs ?? DEFAULT_MAX_POLL_INTERVAL_MS;
 		if (this.maxBackoffMs < this.minBackoffMs) throw new Error(`PollingApiTaskSource: maxPollIntervalMs (${this.maxBackoffMs}) must be >= pollIntervalMs (${this.minBackoffMs})`);
+		if (Boolean(opts.provider) !== Boolean(opts.model)) throw new Error("PollingApiTaskSource: provider and model must be set together");
 		this.listLimit = opts.listLimit ?? DEFAULT_LIST_LIMIT;
 		this.currentBackoffMs = this.minBackoffMs;
 		this.logger = (opts.logger ?? pino({ name: "polling-api-source" })).child({ teamId: opts.teamId });
@@ -12838,6 +13175,10 @@ var PollingApiTaskSource = class {
 					teamId: this.opts.teamId,
 					status: "queued",
 					...taskType ? { taskType } : {},
+					...this.opts.provider && this.opts.model ? {
+						provider: this.opts.provider,
+						model: this.opts.model
+					} : {},
 					limit: this.listLimit
 				});
 				if (this.opts.debug) this.logger.debug({
@@ -12848,6 +13189,10 @@ var PollingApiTaskSource = class {
 				for (const item of result.items) {
 					if (seen.has(item.id)) continue;
 					if (this.opts.diaryIds && this.opts.diaryIds.length > 0 && (item.diaryId === null || !this.opts.diaryIds.includes(item.diaryId))) continue;
+					if (this.opts.provider && this.opts.model) {
+						const allowed = item.allowedExecutors ?? [];
+						if (allowed.length > 0 && !allowed.some((e) => e.provider === this.opts.provider && e.model === this.opts.model)) continue;
+					}
 					if (item.status !== "queued") continue;
 					seen.add(item.id);
 					out.push(item);
@@ -13841,138 +14186,29 @@ function pruneOldSnapshots(maxCached, currentDir) {
 	});
 }
 //#endregion
-//#region ../../libs/pi-extension/src/tool-operations.ts
-/**
-* Gondolin tool operations: redirect pi's built-in tool operations
-* (read, write, edit, bash) to execute inside the VM.
-*
-* Follows the same pattern as upstream pi-gondolin.ts — pi's tool factories
-* accept an `operations` object that provides the underlying I/O.
-*/
+//#region ../../libs/pi-extension/src/vm-manager.ts
 var GUEST_WORKSPACE$1 = "/workspace";
-function shQuote(s) {
-	return "'" + s.replace(/'/g, "'\\''") + "'";
-}
 /**
-* Map a host-side absolute path to a guest-side /workspace path.
-* Throws if the path escapes the workspace.
-*/
-function toGuestPath(localCwd, localPath) {
-	if (localPath === GUEST_WORKSPACE$1 || localPath.startsWith(`${GUEST_WORKSPACE$1}/`)) return localPath;
-	const rel = path.relative(localCwd, localPath);
-	if (rel === "") return GUEST_WORKSPACE$1;
-	if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`path escapes workspace: ${localPath}`);
-	const posixRel = rel.split(path.sep).join(path.posix.sep);
-	return path.posix.join(GUEST_WORKSPACE$1, posixRel);
-}
-function createGondolinReadOps(vm, localCwd) {
-	return {
-		readFile: async (p) => {
-			const r = await vm.exec(["/bin/cat", toGuestPath(localCwd, p)]);
-			if (!r.ok) throw new Error(`cat failed (${r.exitCode}): ${r.stderr}`);
-			return r.stdoutBuffer;
-		},
-		access: async (p) => {
-			if (!(await vm.exec([
-				"/bin/sh",
-				"-lc",
-				`test -r ${shQuote(toGuestPath(localCwd, p))}`
-			])).ok) throw new Error(`not readable: ${p}`);
-		},
-		detectImageMimeType: async (p) => {
-			try {
-				const r = await vm.exec([
-					"/bin/sh",
-					"-lc",
-					`file --mime-type -b ${shQuote(toGuestPath(localCwd, p))}`
-				]);
-				if (!r.ok) return null;
-				const m = r.stdout.trim();
-				return [
-					"image/jpeg",
-					"image/png",
-					"image/gif",
-					"image/webp"
-				].includes(m) ? m : null;
-			} catch {
-				return null;
-			}
-		}
-	};
-}
-function createGondolinWriteOps(vm, localCwd) {
-	return {
-		writeFile: async (p, content) => {
-			const guestPath = toGuestPath(localCwd, p);
-			const dir = path.posix.dirname(guestPath);
-			const b64 = Buffer.from(content, "utf8").toString("base64");
-			const r = await vm.exec([
-				"/bin/sh",
-				"-lc",
-				[
-					"set -eu",
-					`mkdir -p ${shQuote(dir)}`,
-					`echo ${shQuote(b64)} | base64 -d > ${shQuote(guestPath)}`
-				].join("\n")
-			]);
-			if (!r.ok) throw new Error(`write failed (${r.exitCode}): ${r.stderr}`);
-		},
-		mkdir: async (dir) => {
-			const r = await vm.exec([
-				"/bin/mkdir",
-				"-p",
-				toGuestPath(localCwd, dir)
-			]);
-			if (!r.ok) throw new Error(`mkdir failed (${r.exitCode}): ${r.stderr}`);
-		}
-	};
-}
-function createGondolinEditOps(vm, localCwd) {
-	const r = createGondolinReadOps(vm, localCwd);
-	const w = createGondolinWriteOps(vm, localCwd);
-	return {
-		readFile: r.readFile,
-		access: r.access,
-		writeFile: w.writeFile
-	};
-}
-function createGondolinBashOps(vm, localCwd) {
-	return { exec: async (command, cwd, { onData, signal, timeout, env }) => {
-		const guestCwd = toGuestPath(localCwd, cwd);
-		const ac = new AbortController();
-		const onAbort = () => ac.abort();
-		signal?.addEventListener("abort", onAbort, { once: true });
-		let timedOut = false;
-		const timer = timeout && timeout > 0 ? setTimeout(() => {
-			timedOut = true;
-			ac.abort();
-		}, timeout * 1e3) : void 0;
-		try {
-			const proc = vm.exec([
-				"/bin/sh",
-				"-lc",
-				command
-			], {
-				cwd: guestCwd,
-				signal: ac.signal,
-				stdout: "pipe",
-				stderr: "pipe"
-			});
-			for await (const chunk of proc.output()) onData(typeof chunk.data === "string" ? Buffer.from(chunk.data, "utf8") : chunk.data);
-			return { exitCode: (await proc).exitCode };
-		} catch (err) {
-			if (signal?.aborted) throw new Error("aborted");
-			if (timedOut) throw new Error(`timeout:${timeout}`);
-			throw err;
-		} finally {
-			if (timer) clearTimeout(timer);
-			signal?.removeEventListener("abort", onAbort);
-		}
-	} };
-}
-//#endregion
-//#region ../../libs/pi-extension/src/vm-manager.ts
-var GUEST_WORKSPACE = "/workspace";
+* Memory-backed VFS mount used by the daemon to inject task-context
+* skills (#943 slice 1.5). Sibling of /workspace, NOT a sub-path —
+* Gondolin mounts can't nest. The agent's Gondolin-bound Read tool
+* accepts paths under this prefix (see toGuestPath in tool-operations.ts).
+*
+* Why MemoryProvider rather than a path under /workspace:
+*   - Injected skills are ephemeral by intent: per-task-attempt input
+*     scoped to the VM lifetime. MemoryProvider models that exactly —
+*     in-memory, per-VM-instance, zero host artefacts, automatic
+*     cleanup on VM close.
+*   - Writing under /workspace fails in worktrees because we symlink
+*     `.moltnet/` to the main repo (so credentials are reachable from
+*     worktrees), and Gondolin's RealFSProvider correctly refuses to
+*     create paths whose ancestors' realpath escapes the mount root.
+*     That refusal is a deliberate sandbox-escape protection, not a
+*     bug. See diary semantic entry cd27d9d3-efdc-4aec-ac0d-5fd8ce258d1f
+*     and episodic 7affbfeb-18a2-4963-aeac-c177eb2afa2d for the full
+*     investigation and the alternatives we rejected.
+*/
+var GUEST_TASK_SKILLS_MOUNT = "/moltnet-task-skills";
 /**
 * Resolve the main worktree root (where .moltnet/ lives — it's untracked,
 * only exists in the main worktree, not in git worktrees).
@@ -14101,7 +14337,10 @@ async function resumeVm(config) {
 		env: vmEnv,
 		...resources?.memory && { memory: resources.memory },
 		...resources?.cpus && { cpus: resources.cpus },
-		vfs: { mounts: { [GUEST_WORKSPACE]: workspaceProvider } }
+		vfs: { mounts: {
+			[GUEST_WORKSPACE$1]: workspaceProvider,
+			[GUEST_TASK_SKILLS_MOUNT]: new MemoryProvider()
+		} }
 	});
 	await vm.exec(`sh -c '
     cp /etc/gondolin/mitm/ca.crt /usr/local/share/ca-certificates/gondolin-mitm.crt
@@ -14131,7 +14370,7 @@ nameserver 1.1.1.1" > /etc/resolv.conf'`);
 		vm,
 		credentials: creds,
 		mountPath: config.mountPath,
-		guestWorkspace: GUEST_WORKSPACE,
+		guestWorkspace: GUEST_WORKSPACE$1,
 		agentDir
 	};
 }
@@ -14184,6 +14423,137 @@ function ensureRelativeWorktreePaths(gitconfig) {
 	return `${gitconfig}${gitconfig.endsWith("\n") ? "" : "\n"}[worktree]\n\tuseRelativePaths = true\n`;
 }
 //#endregion
+//#region ../../libs/pi-extension/src/tool-operations.ts
+/**
+* Gondolin tool operations: redirect pi's built-in tool operations
+* (read, write, edit, bash) to execute inside the VM.
+*
+* Follows the same pattern as upstream pi-gondolin.ts — pi's tool factories
+* accept an `operations` object that provides the underlying I/O.
+*/
+var GUEST_WORKSPACE = "/workspace";
+function shQuote(s) {
+	return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+/**
+* Map a host-side absolute path to a guest-side /workspace path.
+* Throws if the path escapes the workspace.
+*/
+function toGuestPath(localCwd, localPath) {
+	if (localPath === GUEST_WORKSPACE || localPath.startsWith(`${GUEST_WORKSPACE}/`)) return localPath;
+	if (localPath === "/moltnet-task-skills" || localPath.startsWith(`/moltnet-task-skills/`)) return localPath;
+	const rel = path.relative(localCwd, localPath);
+	if (rel === "") return GUEST_WORKSPACE;
+	if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`path escapes workspace: ${localPath}`);
+	const posixRel = rel.split(path.sep).join(path.posix.sep);
+	return path.posix.join(GUEST_WORKSPACE, posixRel);
+}
+function createGondolinReadOps(vm, localCwd) {
+	return {
+		readFile: async (p) => {
+			const r = await vm.exec(["/bin/cat", toGuestPath(localCwd, p)]);
+			if (!r.ok) throw new Error(`cat failed (${r.exitCode}): ${r.stderr}`);
+			return r.stdoutBuffer;
+		},
+		access: async (p) => {
+			if (!(await vm.exec([
+				"/bin/sh",
+				"-lc",
+				`test -r ${shQuote(toGuestPath(localCwd, p))}`
+			])).ok) throw new Error(`not readable: ${p}`);
+		},
+		detectImageMimeType: async (p) => {
+			try {
+				const r = await vm.exec([
+					"/bin/sh",
+					"-lc",
+					`file --mime-type -b ${shQuote(toGuestPath(localCwd, p))}`
+				]);
+				if (!r.ok) return null;
+				const m = r.stdout.trim();
+				return [
+					"image/jpeg",
+					"image/png",
+					"image/gif",
+					"image/webp"
+				].includes(m) ? m : null;
+			} catch {
+				return null;
+			}
+		}
+	};
+}
+function createGondolinWriteOps(vm, localCwd) {
+	return {
+		writeFile: async (p, content) => {
+			const guestPath = toGuestPath(localCwd, p);
+			const dir = path.posix.dirname(guestPath);
+			const b64 = Buffer.from(content, "utf8").toString("base64");
+			const r = await vm.exec([
+				"/bin/sh",
+				"-lc",
+				[
+					"set -eu",
+					`mkdir -p ${shQuote(dir)}`,
+					`echo ${shQuote(b64)} | base64 -d > ${shQuote(guestPath)}`
+				].join("\n")
+			]);
+			if (!r.ok) throw new Error(`write failed (${r.exitCode}): ${r.stderr}`);
+		},
+		mkdir: async (dir) => {
+			const r = await vm.exec([
+				"/bin/mkdir",
+				"-p",
+				toGuestPath(localCwd, dir)
+			]);
+			if (!r.ok) throw new Error(`mkdir failed (${r.exitCode}): ${r.stderr}`);
+		}
+	};
+}
+function createGondolinEditOps(vm, localCwd) {
+	const r = createGondolinReadOps(vm, localCwd);
+	const w = createGondolinWriteOps(vm, localCwd);
+	return {
+		readFile: r.readFile,
+		access: r.access,
+		writeFile: w.writeFile
+	};
+}
+function createGondolinBashOps(vm, localCwd) {
+	return { exec: async (command, cwd, { onData, signal, timeout, env }) => {
+		const guestCwd = toGuestPath(localCwd, cwd);
+		const ac = new AbortController();
+		const onAbort = () => ac.abort();
+		signal?.addEventListener("abort", onAbort, { once: true });
+		let timedOut = false;
+		const timer = timeout && timeout > 0 ? setTimeout(() => {
+			timedOut = true;
+			ac.abort();
+		}, timeout * 1e3) : void 0;
+		try {
+			const proc = vm.exec([
+				"/bin/sh",
+				"-lc",
+				command
+			], {
+				cwd: guestCwd,
+				signal: ac.signal,
+				stdout: "pipe",
+				stderr: "pipe"
+			});
+			for await (const chunk of proc.output()) onData(typeof chunk.data === "string" ? Buffer.from(chunk.data, "utf8") : chunk.data);
+			return { exitCode: (await proc).exitCode };
+		} catch (err) {
+			if (signal?.aborted) throw new Error("aborted");
+			if (timedOut) throw new Error(`timeout:${timeout}`);
+			throw err;
+		} finally {
+			if (timer) clearTimeout(timer);
+			signal?.removeEventListener("abort", onAbort);
+		}
+	} };
+}
+//#endregion
 //#region ../../libs/pi-extension/src/otel/index.ts
 var TRACER_NAME = "@themoltnet/pi-extension/otel";
 function stripReservedAttrs(attrs) {
@@ -14321,6 +14691,114 @@ function extractUsage(message) {
 	};
 }
 //#endregion
+//#region ../../libs/pi-extension/src/runtime/inject-task-context.ts
+/**
+* Slice 1.5 of #943 — wire the agent-runtime resolver into the
+* pi-extension execution path.
+*
+* `resolveTaskContext` is a pure dispatcher; this module provides the
+* Gondolin-aware deliverer and the post-resolution shape the
+* `execute-pi-task` caller needs to splice into pi's setup:
+*
+*   - `systemPromptPrefix` → fed into `appendSystemPrompt` alongside
+*      the runtime instructor (it IS a system-prompt fragment).
+*   - `userInlineSuffix`   → appended to the `buildTaskUserPrompt`
+*      output BEFORE `session.prompt(text)`.
+*   - `skills`             → spliced into the `skillsOverride` callback's
+*      return value. pi includes them in `<available_skills>` in the
+*      system prompt; the agent fetches the body on demand via the
+*      Read tool.
+*
+* Skill files are written into the VM at
+* `/workspace/.moltnet/skills/<slug>/SKILL.md`. The agent's
+* Gondolin-bound Read tool is scoped to `/workspace`, so that path is
+* the only location the agent can actually read at runtime. pi only
+* reads `<available_skills>` metadata (name, description, location),
+* never the file body, so we construct synthetic `Skill` objects
+* pointing at the in-VM path without ever materialising the file on
+* the host.
+*/
+/**
+* Where in the VM we write skill bodies — the memory-backed mount
+* declared in `vm-manager.ts`. See the comment on
+* `GUEST_TASK_SKILLS_MOUNT` there for the full rationale (ephemeral
+* by intent + the worktree symlink interaction with Gondolin's
+* sandbox-escape protection). The agent's Gondolin Read tool accepts
+* paths under this mount via `toGuestPath` in `tool-operations.ts`.
+*/
+var SKILL_ROOT_IN_VM = GUEST_TASK_SKILLS_MOUNT;
+/** Bounds borrowed from pi's skill validation; conservative caps so a
+*  malformed SKILL.md doesn't bloat the system prompt. */
+var MAX_SKILL_NAME = 64;
+var MAX_SKILL_DESCRIPTION = 1024;
+/**
+* Resolve a task's `input.context[]` and inject the side effects pi
+* needs. Safe to call with an empty array — returns an inert result.
+*/
+async function injectTaskContext(args) {
+	const skills = [];
+	const resolved = await resolveTaskContext({
+		context: args.context,
+		deliver: { skill: async ({ slug, content }) => {
+			const dir = `${SKILL_ROOT_IN_VM}/${slug}`;
+			const filePath = `${dir}/SKILL.md`;
+			await args.fs.mkdir(dir, { recursive: true });
+			await args.fs.writeFile(filePath, content, { mode: 420 });
+			skills.push(buildSyntheticSkill({
+				slug,
+				content,
+				filePath,
+				dir
+			}));
+		} }
+	});
+	return {
+		injected: resolved.injected,
+		skills,
+		systemPromptPrefix: resolved.systemPromptPrefix,
+		userInlineSuffix: resolved.userInlineSuffix
+	};
+}
+/**
+* Build a `Skill` object pi will faithfully render in
+* `<available_skills>`. We extract `name` and `description` from the
+* skill content's YAML frontmatter using pi's own `parseFrontmatter`
+* helper (proper YAML, not a regex hack) and fall back to the slug +
+* a generic description so a SKILL.md without frontmatter still
+* renders something meaningful.
+*
+* Frontmatter parsing is best-effort: a malformed YAML block is
+* optional metadata, not a reason to fail the task. We swallow parser
+* errors and fall back to the slug-derived metadata; the skill body
+* is unaffected.
+*
+* pi's `formatSkillsForPrompt` only reads `name`, `description`, and
+* `filePath` — `sourceInfo`/`baseDir` exist on the type but never
+* surface in the prompt, so a synthetic `SourceInfo` is enough.
+*/
+function buildSyntheticSkill(args) {
+	let fm = {};
+	try {
+		fm = parseFrontmatter(args.content).frontmatter;
+	} catch {}
+	return {
+		name: clip(typeof fm.name === "string" && fm.name.trim().length > 0 ? fm.name.trim() : args.slug, MAX_SKILL_NAME),
+		description: clip(typeof fm.description === "string" && fm.description.trim().length > 0 ? fm.description.trim() : `Task-injected context skill (${args.slug})`, MAX_SKILL_DESCRIPTION),
+		filePath: args.filePath,
+		baseDir: args.dir,
+		sourceInfo: createSyntheticSourceInfo(args.filePath, {
+			source: "moltnet:task-context",
+			scope: "temporary",
+			origin: "top-level",
+			baseDir: args.dir
+		}),
+		disableModelInvocation: fm["disable-model-invocation"] === true
+	};
+}
+function clip(s, max) {
+	return s.length > max ? s.slice(0, max) : s;
+}
+//#endregion
 //#region ../../libs/pi-extension/src/runtime/runtime-instructor.ts
 /**
 * Build the daemon-controlled invariant prose injected into the system prompt
@@ -14644,6 +15122,7 @@ function resolveSubmitTools(taskType, opts = {}) {
 * Anthropic-SDK one) plug in via the `executeTask` function injected into
 * `AgentRuntime`.
 */
+var noopTurnEventHandler = () => {};
 /**
 * Factory that builds a pi-specific `executeTask` function suitable for
 * injection into `AgentRuntime`. The returned function caches the resolved
@@ -14740,10 +15219,25 @@ async function executePiTask(claimedTask, reporter, opts) {
 			attemptN
 		});
 		reporterOpen = true;
-		const emit = (kind, payload) => reporter.record({
-			kind,
-			payload
-		});
+		let onTurnEvent;
+		if (opts.makeOnTurnEvent) try {
+			onTurnEvent = opts.makeOnTurnEvent(claimedTask);
+		} catch (err) {
+			process.stderr.write(`[emit] makeOnTurnEvent threw: ${err instanceof Error ? err.message : String(err)}\n`);
+			onTurnEvent = noopTurnEventHandler;
+		}
+		else onTurnEvent = opts.onTurnEvent ?? noopTurnEventHandler;
+		const emit = (kind, payload) => {
+			try {
+				onTurnEvent(kind, summarizePayloadForLog(kind, payload));
+			} catch (err) {
+				process.stderr.write(`[emit] onTurnEvent threw for kind="${kind}": ${err instanceof Error ? err.message : String(err)}\n`);
+			}
+			return reporter.record({
+				kind,
+				payload
+			});
+		};
 		await emit("info", {
 			event: "execute_start",
 			taskType: task.taskType,
@@ -14753,7 +15247,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		});
 		let taskPrompt;
 		try {
-			taskPrompt = buildPromptForTask(task, {
+			taskPrompt = buildTaskUserPrompt(task, {
 				diaryId,
 				taskId: task.id,
 				extras: opts.promptExtras
@@ -14766,6 +15260,30 @@ async function executePiTask(claimedTask, reporter, opts) {
 			});
 			return makeFailedOutput("prompt_build_failed", message);
 		}
+		const rawContext = task.input.context;
+		let injectedContext;
+		try {
+			const contextArray = rawContext === void 0 ? [] : rawContext;
+			if (!Check(TaskContext, contextArray)) throw new Error(`task.input.context failed TaskContext validation: ${JSON.stringify([...Errors(TaskContext, contextArray)].slice(0, 3))}`);
+			injectedContext = await injectTaskContext({
+				context: contextArray,
+				fs: managed.vm.fs
+			});
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			await emit("error", {
+				message,
+				phase: "context_resolution"
+			});
+			return makeFailedOutput("context_resolution_failed", message);
+		}
+		if (injectedContext.injected.length > 0) await emit("info", {
+			event: "context_injected",
+			count: injectedContext.injected.length,
+			bindings: injectedContext.injected.map((r) => r.binding),
+			slugs: injectedContext.injected.map((r) => r.slug)
+		});
+		if (injectedContext.userInlineSuffix) taskPrompt = `${taskPrompt}\n\n---\n\n${injectedContext.userInlineSuffix}`;
 		const gondolinCustomTools = [
 			createReadToolDefinition(mountPath, { operations: createGondolinReadOps(managed.vm, mountPath) }),
 			createWriteToolDefinition(mountPath, { operations: createGondolinWriteOps(managed.vm, mountPath) }),
@@ -14802,21 +15320,23 @@ async function executePiTask(claimedTask, reporter, opts) {
 					"moltnet.task.type": task.taskType
 				}
 			});
-			const runtimeInstructor = buildRuntimeInstructor({
+			const appendSystemPrompt = [buildRuntimeInstructor({
 				taskId: task.id,
 				taskType: task.taskType,
 				attemptN,
 				diaryId,
 				agentName: opts.agentName,
 				correlationId: task.correlationId ?? null
-			});
+			})];
+			if (injectedContext.systemPromptPrefix) appendSystemPrompt.push(injectedContext.systemPromptPrefix);
+			const injectedSkills = injectedContext.skills;
 			const resourceLoader = new DefaultResourceLoader({
 				cwd: mountPath,
 				agentDir: piAuthDir,
 				extensionFactories: [piOtelExtension],
-				appendSystemPrompt: [runtimeInstructor],
+				appendSystemPrompt,
 				skillsOverride: () => ({
-					skills: [],
+					skills: injectedSkills,
 					diagnostics: []
 				})
 			});
@@ -15041,6 +15561,27 @@ function wireSessionAbort(cancelSignal, session) {
 * `task_messages.payload` row. Bodies above 4 KiB are replaced with a
 * `{ truncated, original_size }` marker so the JSONL/DB size stays bounded.
 */
+function summarizePayloadForLog(kind, payload) {
+	switch (kind) {
+		case "text_delta": {
+			const delta = payload.delta;
+			return { chars: typeof delta === "string" ? delta.length : 0 };
+		}
+		case "tool_call_start": return { tool: payload.tool_name };
+		case "tool_call_end": return {
+			tool: payload.tool_name,
+			is_error: payload.is_error === true,
+			...payload.is_error === true && payload.result !== void 0 ? { result: payload.result } : {}
+		};
+		case "turn_end": return { stop_reason: payload.stop_reason };
+		case "error": return {
+			phase: payload.phase,
+			message: typeof payload.message === "string" ? payload.message.slice(0, TRUNCATE_LIMIT) : payload.message
+		};
+		case "info": return Object.fromEntries(Object.entries(payload).map(([k, v]) => [k, typeof v === "string" ? v.slice(0, TRUNCATE_LIMIT) : v]));
+		default: return payload;
+	}
+}
 var TRUNCATE_LIMIT = 4 * 1024;
 function truncateForWire(value) {
 	if (value === null || value === void 0) return value;
@@ -15340,6 +15881,27 @@ function findUp(startDir, filename) {
 	}
 }
 //#endregion
+//#region src/lib/turn-event-logger.ts
+function makeTurnEventHandler(base, context = {}) {
+	const log = base.child({
+		name: "agent-daemon.turn",
+		...context
+	});
+	return (event, summary) => {
+		if (event === "text_delta") return;
+		log[event === "error" ? "warn" : event === "turn_end" ? "info" : "debug"]({
+			event,
+			...summary
+		}, `turn.${event}`);
+	};
+}
+function makeTurnEventHandlerFactory(base) {
+	return (claimedTask) => makeTurnEventHandler(base, {
+		taskId: claimedTask.task.id,
+		attemptN: claimedTask.attemptN
+	});
+}
+//#endregion
 //#region src/cli/poll-shared.ts
 async function runPolling(opts) {
 	if (isHelpFlag(opts.argv)) {
@@ -15442,7 +16004,8 @@ async function runPolling(opts) {
 			mountPath: sandbox.rootDir,
 			provider: common.provider,
 			model: common.model,
-			sandboxConfig: sandbox.config
+			sandboxConfig: sandbox.config,
+			makeOnTurnEvent: makeTurnEventHandlerFactory(rootLogger)
 		});
 		runtime = new AgentRuntime({
 			logger: rootLogger,
@@ -15450,6 +16013,8 @@ async function runPolling(opts) {
 				agent: ctx.agent,
 				teamId,
 				taskTypes: taskTypes.length > 0 ? taskTypes : void 0,
+				provider: common.provider.toLowerCase(),
+				model: common.model.toLowerCase(),
 				diaryIds: diaryIds.length > 0 ? diaryIds : void 0,
 				leaseTtlSec: common.leaseTtlSec,
 				listLimit,
@@ -15607,19 +16172,40 @@ async function runOnce(argv) {
 		sandbox: sandbox.path,
 		taskId
 	}, "agent-daemon.starting");
+	let runtime = null;
+	const onSignal = (sig) => {
+		rootLogger.warn({
+			signal: sig,
+			taskId
+		}, "agent-daemon.draining");
+		runtime?.stop();
+		ctx.agent.tasks.cancel(taskId, { reason: `runner_${sig.toLowerCase()}` }).catch((err) => {
+			rootLogger.warn({
+				err: err instanceof Error ? err.message : String(err),
+				taskId
+			}, "agent-daemon.cancel_on_signal_failed");
+		});
+	};
+	process.on("SIGINT", () => {
+		onSignal("SIGINT");
+	});
+	process.on("SIGTERM", () => {
+		onSignal("SIGTERM");
+	});
 	try {
 		const executeTask = createPiTaskExecutor({
 			agentName: opts.agent,
 			mountPath: sandbox.rootDir,
 			provider: opts.provider,
 			model: opts.model,
-			sandboxConfig: sandbox.config
+			sandboxConfig: sandbox.config,
+			onTurnEvent: makeTurnEventHandler(rootLogger, { taskId })
 		});
 		const writeCorrelationAnchors = makePrBodyAnchorWriter({
 			gh: createGhCliClient(),
 			logger: rootLogger
 		});
-		const [output] = await new AgentRuntime({
+		runtime = new AgentRuntime({
 			logger: rootLogger,
 			source: new ApiTaskSource({
 				agent: ctx.agent,
@@ -15639,7 +16225,8 @@ async function runOnce(argv) {
 				log: (msg, err) => rootLogger.warn({ err }, msg)
 			}),
 			executeTask
-		}).start();
+		});
+		const [output] = await runtime.start();
 		if (!output) {
 			rootLogger.error({}, "agent-daemon.no_output");
 			return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "MoltNet agent daemon — claims and executes tasks (fulfill_brief, assess_brief) from the MoltNet task-service via Pi-headless. CLI: moltnet-agent.",
@@ -33,19 +33,19 @@
     "@opentelemetry/semantic-conventions": "^1.39.0",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "@themoltnet/pi-extension": "0.13.4",
-    "@themoltnet/agent-runtime": "0.10.0",
-    "@themoltnet/sdk": "0.99.0"
+    "@themoltnet/agent-runtime": "0.12.0",
+    "@themoltnet/pi-extension": "0.14.0",
+    "@themoltnet/sdk": "0.100.0"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
     "vite": "^8.0.0",
     "vitest": "^3.0.0",
+    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/database": "0.1.0",
     "@moltnet/tasks": "0.1.0",
-    "@moltnet/bootstrap": "0.1.0"
+    "@moltnet/database": "0.1.0"
   },
   "nx": {
     "tags": [