@tt-a1i/hive 1.5.0 → 1.6.0

package/dist/src/server/hive-team-guidance.js

@@ -1,3 +1,4 @@
+import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
 import { DEFAULT_WORKFLOW_CLI_POLICY } from './workflow-cli-policy.js';
 /**
  * Tail reminder appended to every message that flows INTO the orchestrator
@@ -16,7 +17,7 @@ import { DEFAULT_WORKFLOW_CLI_POLICY } from './workflow-cli-policy.js';
  * the workflow DSL live in `.hive/PROTOCOL.md`, which agents re-read on demand.
  * A long banner on every turn is itself the noise this envelope exists to beat.
  */
-export const buildOrchestratorReminderTail = (workflowsEnabled) => {
+export const buildOrchestratorReminderTail = ({ workflowsEnabled }) => {
     const body = 'You are the Hive Orchestrator. Reply with one of: ' +
         '(a) `team send "<worker-name>" "<task>"` to dispatch — run `team list` first if the roster may have changed since your last view (Hive does not push membership changes; stale names fail). ' +
         'If no worker fits or the roster is empty, `team spawn <role> [--cli claude|codex|opencode|gemini]` to create one (add `--ephemeral` for a one-shot), then dispatch; do not ask the user to add workers. ' +
@@ -85,7 +86,7 @@ const buildAutostaffRule = (workflowsEnabled) => 'You may size the team to the t
     (workflowsEnabled
         ? ' When the work is a one-shot fan-out across 3+ workers or a staged review→fix that runs to completion, prefer `team workflow run` (barrier, phase tree, stop button) over a batch of `team spawn`; reserve up-front staffing for a standing team you direct interactively across several turns.'
         : '');
-const orchestratorRules = (workflowsEnabled, autostaffEnabled) => [
+const orchestratorRules = ({ workflowsEnabled, autostaffEnabled, }) => [
     ...CORE_ORCHESTRATOR_RULES,
     ...(workflowsEnabled ? WORKFLOW_ORCHESTRATOR_RULES : []),
     ...(autostaffEnabled ? [buildAutostaffRule(workflowsEnabled)] : []),
@@ -98,9 +99,7 @@ const WORKER_RULES = [
     '`team --help` only prints command syntax — it is NOT a way to report; its output never reaches the Orchestrator. You still owe a real `team report` / `team status` afterward.',
     'If `team report` / `team status` errors, it also prints USAGE — fix the arguments per USAGE and retry; do not use `team --help` as a stand-in for reporting.',
 ];
-export const getHiveTeamRules = (agent, workflowsEnabled = false, autostaffEnabled = false) => agent.role === 'orchestrator'
-    ? orchestratorRules(workflowsEnabled, autostaffEnabled)
-    : WORKER_RULES;
+export const getHiveTeamRules = (agent, flags = FEATURE_FLAGS_ALL_OFF) => (agent.role === 'orchestrator' ? orchestratorRules(flags) : WORKER_RULES);
 const renderRules = (rules) => rules.map((line) => `- ${line}`).join('\n');
 /**
  * The workflow DSL teaching: agent()/parallel()/pipeline() semantics, the
@@ -122,7 +121,7 @@ Host functions injected into the script: \`agent(prompt, opts)\`,
 \`parallel(thunks)\`, \`pipeline(items, ...stages)\`, \`phase(title)\`,
 \`log(msg)\`, plus the \`args\` global.
 
-\`agent(prompt, opts)\` opts: \`{ agentType?: "coder"|"reviewer"|"tester"|"custom"|<custom-role-name>, cli?: "claude"|"codex"|"opencode"|"gemini", model?: string, label?: string, timeoutMs?: number }\` — other fields are silently ignored. \`agentType\` also accepts the name of a workspace custom role template (case-insensitive); a typo throws rather than silently falling back to coder. \`model\` is passed through to the worker launch config (\`--model <id>\`), so a 100-way fan-out can use a cheap model and the synthesizer a strong one. The worker auto-dismisses when its \`agent()\` call resolves — you never dismiss it.
+\`agent(prompt, opts)\` opts: \`{ agentType?: "coder"|"reviewer"|"tester"|"custom"|<custom-role-name>, cli?: "claude"|"codex"|"opencode"|"gemini", model?: string, outputSchema?: object, label?: string, timeoutMs?: number }\` — other fields are silently ignored. \`agentType\` also accepts the name of a workspace custom role template (case-insensitive); a typo throws rather than silently falling back to coder. \`model\` is passed through to the worker launch config (\`--model <id>\`), so a 100-way fan-out can use a cheap model and the synthesizer a strong one. \`outputSchema\` makes \`agent()\` resolve to a parsed object instead of a string: the worker is told to end its report with a fenced \`\`\`json block whose keys match the schema. On a parse miss it falls back to \`{ text: "<raw report>" }\`, so ALWAYS treat a missing field as the SAFE default (never assume success). The worker auto-dismisses when its \`agent()\` call resolves — you never dismiss it.
 
 \`parallel()\` takes an array of THUNKS (\`() => agent(...)\`), NOT already-started promises: \`parallel([agent(...), agent(...)])\` degrades to unordered concurrency counted as a single step (a no-op grouping), because the promises already started at construction time. \`pipeline(items, ...stages)\` stages are also functions, shape \`(prev, item, i) => agent(...)\`.
 
@@ -176,15 +175,16 @@ while (dry < 2) {
 }
 return confirmed
 \`\`\`
-- **judge panel** — N independent verifiers per finding; majority confirms. Catches plausible-but-wrong findings:
+- **judge panel** — N independent verifiers per finding; majority confirms. \`outputSchema\` makes each vote a typed object instead of fragile yes/no string-matching. Note the safe default: a parse miss has no \`refuted\` key, so \`v.refuted === false\` is false → the finding stays refuted and a malformed reply can never flip it to "confirmed":
 \`\`\`
 phase('Verify')
 const votes = await parallel([
-  () => agent(\`Try to REFUTE: \${claim}. Default refuted=true if uncertain. Reply yes/no.\`),
-  () => agent(\`Independently judge: \${claim}. Reply yes/no.\`),
-  () => agent(\`Repro test: \${claim}. Did you confirm? yes/no.\`),
+  () => agent(\`Try to REFUTE: \${claim}. Default refuted=true if uncertain.\`, { outputSchema: { refuted: 'boolean' } }),
+  () => agent(\`Independently judge: \${claim}.\`, { outputSchema: { refuted: 'boolean' } }),
+  () => agent(\`Repro test: \${claim}. Did it reproduce?\`, { outputSchema: { refuted: 'boolean' } }),
 ])
-const real = votes.filter((v) => v?.toLowerCase().startsWith('y')).length >= 2
+// Only an explicit refuted:false counts as "survived"; missing/unparseable stays safely refuted.
+const real = votes.filter((v) => v && v.refuted === false).length >= 2
 \`\`\`
 - **pipeline** — multi-item, multi-stage, no barrier between stages (item A can be in stage 3 while item B is in stage 1); wall-clock = slowest single item, not sum-of-slowest-per-stage. Each stage gets \`(prevResult, originalItem, index)\`; a stage that throws drops that item to null and skips its remaining stages.
 
@@ -198,7 +198,8 @@ On completion Hive injects \`<hive-system-reminder>Hive workflow ... finished: s
  * syntax and the workflow DSL reference — the always-on injections only carry
  * the lean core rules and point here.
  */
-export const buildProtocolDoc = (cliPolicy = DEFAULT_WORKFLOW_CLI_POLICY, workflowsEnabled = false, autostaffEnabled = false) => {
+export const buildProtocolDoc = (cliPolicy = DEFAULT_WORKFLOW_CLI_POLICY, flags = FEATURE_FLAGS_ALL_OFF) => {
+    const { workflowsEnabled } = flags;
     // The `team workflow …` subcommands + the DSL reference + the per-workspace
     // CLI-policy section only appear when the experimental workflow feature is
     // ON. While off, the orchestrator's canonical reference never mentions
@@ -266,7 +267,7 @@ export const buildProtocolDoc = (cliPolicy = DEFAULT_WORKFLOW_CLI_POLICY, workfl
         '',
         '## Orchestrator rules',
         '',
-        renderRules(orchestratorRules(workflowsEnabled, autostaffEnabled)),
+        renderRules(orchestratorRules(flags)),
         '',
         '## Worker rules',
         '',

package/dist/src/server/recovery-summary.d.ts

@@ -1,15 +1,14 @@
 import type { AgentSummary, WorkspaceSummary } from '../shared/types.js';
+import { type FeatureFlags } from './feature-flags.js';
 import type { RecoveryMessage } from './message-log-store.js';
-export declare const buildRecoverySummary: ({ agent, allTaskMessages, messages, tasksContent, workers, workspace, workflowsEnabled, autostaffEnabled, }: {
+export declare const buildRecoverySummary: ({ agent, allTaskMessages, messages, tasksContent, workers, workspace, flags, }: {
     agent: AgentSummary;
     allTaskMessages?: RecoveryMessage[];
     messages: RecoveryMessage[];
     tasksContent: string;
     workers: AgentSummary[];
     workspace: WorkspaceSummary;
-    /** Experimental workflow gate — keeps the recovered handover prompt
-     *  consistent with the live flag (omits the workflow rule when off). */
-    workflowsEnabled?: boolean;
-    /** Experimental auto-staff gate (default on) — same, for the team-sizing rule. */
-    autostaffEnabled?: boolean;
+    /** Live experimental flags — keep the recovered handover prompt consistent
+     *  with what a fresh startup would inject (workflow + team-sizing rules). */
+    flags?: FeatureFlags;
 }) => string;

package/dist/src/server/recovery-summary.js

@@ -1,3 +1,4 @@
+import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
 import { getHiveTeamRules } from './hive-team-guidance.js';
 import { wrapSystemMessage } from './system-message.js';
 import { TASKS_RELATIVE_PATH } from './tasks-file.js';
@@ -64,7 +65,7 @@ const formatWorkers = (workers) => {
     return workers.map((worker) => `- ${worker.name} (${worker.role}, ${worker.status}, pending_task_count: ${worker.pendingTaskCount})`);
 };
 const getTaskSectionTitle = (agent) => agent.role === 'orchestrator' ? '## Tasks you dispatched' : '## Tasks recently sent to you';
-export const buildRecoverySummary = ({ agent, allTaskMessages, messages, tasksContent, workers, workspace, workflowsEnabled = false, autostaffEnabled = false, }) => wrapSystemMessage([
+export const buildRecoverySummary = ({ agent, allTaskMessages, messages, tasksContent, workers, workspace, flags = FEATURE_FLAGS_ALL_OFF, }) => wrapSystemMessage([
     `You are ${agent.name} (${agent.role}) in workspace ${workspace.name}.`,
     'Hive just restarted you and could not recover via native session resume. Here is the handover context.',
     '',
@@ -84,7 +85,7 @@ export const buildRecoverySummary = ({ agent, allTaskMessages, messages, tasksCo
     ...formatWorkers(workers),
     '',
     agent.role === 'orchestrator' ? '## Hive worker dispatch rules' : '## Hive worker boundaries',
-    ...getHiveTeamRules(agent, workflowsEnabled, autostaffEnabled),
+    ...getHiveTeamRules(agent, flags),
     '',
     'Continue from here. If unsure, ask the user.',
 ].join('\n'));

package/dist/src/server/report-outbox-store.d.ts

@@ -0,0 +1,36 @@
+import type { Database } from 'better-sqlite3';
+/**
+ * Durable redelivery queue for worker reports the orchestrator could not
+ * receive. `team report` persists the dispatch as reported and forwards the
+ * report into the orchestrator's stdin best-effort; if that write fails (the
+ * PTY exited / is mid-restart, or the orchestrator was down at report time)
+ * the report would otherwise be lost — the ledger says "reported" yet the
+ * orchestrator waits forever, indistinguishable from a hang.
+ *
+ * Entries are keyed by dispatch id (UNIQUE) so a report enqueues at most once,
+ * and drain marks them delivered only after the orchestrator PTY write
+ * actually resolves, so a failed redelivery stays pending for the next drain.
+ */
+export interface ReportOutboxEntry {
+    id: number;
+    workspaceId: string;
+    targetAgentId: string;
+    dispatchId: string;
+    payload: string;
+    createdAt: number;
+    deliveredAt: number | null;
+}
+interface EnqueueInput {
+    workspaceId: string;
+    targetAgentId: string;
+    dispatchId: string;
+    payload: string;
+}
+export declare const createReportOutboxStore: (db: Database) => {
+    enqueue: (input: EnqueueInput) => void;
+    listPending: (workspaceId: string, targetAgentId: string) => ReportOutboxEntry[];
+    markDelivered: (id: number) => void;
+    pendingCount: (workspaceId: string, targetAgentId: string) => number;
+};
+export type ReportOutboxStore = ReturnType<typeof createReportOutboxStore>;
+export {};

package/dist/src/server/report-outbox-store.js

@@ -0,0 +1,33 @@
+const rowToEntry = (row) => ({
+    id: row.id,
+    workspaceId: row.workspace_id,
+    targetAgentId: row.target_agent_id,
+    dispatchId: row.dispatch_id,
+    payload: row.payload,
+    createdAt: row.created_at,
+    deliveredAt: row.delivered_at,
+});
+export const createReportOutboxStore = (db) => {
+    // INSERT OR IGNORE on the UNIQUE dispatch_id: a dispatch reports once, so a
+    // second enqueue for the same dispatch (e.g. a retry path) is a no-op rather
+    // than a duplicate the orchestrator would see twice.
+    const enqueue = (input) => {
+        db.prepare(`INSERT OR IGNORE INTO report_outbox
+        (workspace_id, target_agent_id, dispatch_id, payload, created_at)
+       VALUES (?, ?, ?, ?, ?)`).run(input.workspaceId, input.targetAgentId, input.dispatchId, input.payload, Date.now());
+    };
+    const listPending = (workspaceId, targetAgentId) => db
+        .prepare(`SELECT id, workspace_id, target_agent_id, dispatch_id, payload, created_at, delivered_at
+           FROM report_outbox
+           WHERE workspace_id = ? AND target_agent_id = ? AND delivered_at IS NULL
+           ORDER BY created_at ASC, id ASC`)
+        .all(workspaceId, targetAgentId).map(rowToEntry);
+    const markDelivered = (id) => {
+        db.prepare(`UPDATE report_outbox SET delivered_at = ? WHERE id = ? AND delivered_at IS NULL`).run(Date.now(), id);
+    };
+    const pendingCount = (workspaceId, targetAgentId) => db
+        .prepare(`SELECT COUNT(*) AS n FROM report_outbox
+           WHERE workspace_id = ? AND target_agent_id = ? AND delivered_at IS NULL`)
+        .get(workspaceId, targetAgentId).n;
+    return { enqueue, listPending, markDelivered, pendingCount };
+};

package/dist/src/server/restart-policy-support.d.ts

@@ -1,5 +1,6 @@
 import type { AgentSummary, WorkspaceSummary } from '../shared/types.js';
 import type { PersistedAgentRun } from './agent-run-store.js';
+import type { FeatureFlags } from './feature-flags.js';
 import type { MessageLogHandle, MessageLogRecord, RecoveryMessage } from './message-log-store.js';
 export interface RestartPolicyInput {
     deleteMessage: (handle: MessageLogHandle) => void;
@@ -11,11 +12,9 @@ export interface RestartPolicyInput {
     listAgentRuns: (agentId: string) => PersistedAgentRun[];
     listMessagesForRecovery: (workspaceId: string, sinceMs: number) => RecoveryMessage[];
     readTasks: (workspacePath: string) => string;
-    /** Experimental workflow gate — threaded into the recovery handover prompt
-     *  so it matches the live flag. Optional; omitted → off. */
-    getWorkflowsEnabled?: () => boolean;
-    /** Experimental auto-staff gate (default on) — same. */
-    getAutostaffEnabled?: () => boolean;
+    /** Resolves the live experimental flags, threaded into the recovery handover
+     *  prompt so it matches a fresh startup. Optional; omitted → all off. */
+    getFlags?: () => FeatureFlags;
 }
 export declare const findPreviousRun: (runs: PersistedAgentRun[], currentRunId: string) => PersistedAgentRun | undefined;
 export declare const writeSystemMessage: ({ deleteMessage, insertMessage, record, runId, text, writeToRun, }: {

package/dist/src/server/restart-policy.d.ts

@@ -9,6 +9,10 @@ export interface RestartPolicy {
         workspace: WorkspaceSummary;
         writeToRun: (runId: string, text: string) => Promise<void>;
     }) => boolean;
+    /** Record that `runId` was killed at the user's request (Stop button), so a
+     *  subsequent restart does not inject the crash-recovery handover for a run
+     *  the user deliberately ended. */
+    markUserStopped: (runId: string) => void;
 }
 export declare const createNoopRestartPolicy: () => RestartPolicy;
-export declare const createRestartPolicy: ({ deleteMessage, getWorkspaceSnapshot, insertMessage, listAgentRuns, listMessagesForRecovery, readTasks, getWorkflowsEnabled, getAutostaffEnabled, }: RestartPolicyInput) => RestartPolicy;
+export declare const createRestartPolicy: ({ deleteMessage, getWorkspaceSnapshot, insertMessage, listAgentRuns, listMessagesForRecovery, readTasks, getFlags, }: RestartPolicyInput) => RestartPolicy;

package/dist/src/server/restart-policy.js

@@ -1,3 +1,4 @@
+import { FEATURE_FLAGS_ALL_OFF } from './feature-flags.js';
 import { buildRecoverySummary } from './recovery-summary.js';
 import { findPreviousRun, writeSystemMessage, } from './restart-policy-support.js';
 import { createSystemRecoverySummaryMessage } from './runtime-message-builders.js';
@@ -6,38 +7,55 @@ export const createNoopRestartPolicy = () => ({
     injectPostStartMessage() {
         return false;
     },
+    markUserStopped() { },
 });
-export const createRestartPolicy = ({ deleteMessage, getWorkspaceSnapshot, insertMessage, listAgentRuns, listMessagesForRecovery, readTasks, getWorkflowsEnabled, getAutostaffEnabled, }) => ({
-    injectPostStartMessage({ agentId, runId, startConfig, workspace, writeToRun }) {
-        const previousRun = findPreviousRun(listAgentRuns(agentId), runId);
-        if (!previousRun)
-            return false;
-        const snapshot = getWorkspaceSnapshot(workspace.id);
-        const agent = snapshot.agents.find((item) => item.id === agentId);
-        if (!agent)
-            return false;
-        const workers = snapshot.agents.filter((item) => item.role !== 'orchestrator' && item.id !== agentId);
-        const tasksContent = readTasks(snapshot.summary.path);
-        if (startConfig.resumedSessionId)
+export const createRestartPolicy = ({ deleteMessage, getWorkspaceSnapshot, insertMessage, listAgentRuns, listMessagesForRecovery, readTasks, getFlags, }) => {
+    // Runs the user killed via the Stop button. A deliberate stop is otherwise
+    // byte-identical to a crash (both end status 'error'), so without this a
+    // stop+Restart would inject the "could not recover" handover with stale open
+    // tasks the user may have meant to abandon. In-process only: after a runtime
+    // restart this is empty, which is correct — that case IS a recovery.
+    const userStoppedRuns = new Set();
+    return {
+        markUserStopped(runId) {
+            userStoppedRuns.add(runId);
+        },
+        injectPostStartMessage({ agentId, runId, startConfig, workspace, writeToRun }) {
+            const previousRun = findPreviousRun(listAgentRuns(agentId), runId);
+            if (!previousRun)
+                return false;
+            // Consume the marker whether or not we end up skipping, so it never
+            // lingers to suppress a later genuine crash on the same run id.
+            const wasUserStopped = userStoppedRuns.delete(previousRun.runId);
+            const snapshot = getWorkspaceSnapshot(workspace.id);
+            const agent = snapshot.agents.find((item) => item.id === agentId);
+            if (!agent)
+                return false;
+            const workers = snapshot.agents.filter((item) => item.role !== 'orchestrator' && item.id !== agentId);
+            const tasksContent = readTasks(snapshot.summary.path);
+            if (startConfig.resumedSessionId)
+                return true;
+            // Deliberate stop + restart: start fresh, no crash handover.
+            if (wasUserStopped)
+                return false;
+            const text = buildRecoverySummary({
+                agent,
+                allTaskMessages: listMessagesForRecovery(workspace.id, 0),
+                messages: listMessagesForRecovery(workspace.id, Date.now() - RECOVERY_WINDOW_MS),
+                tasksContent,
+                workers,
+                workspace,
+                flags: getFlags?.() ?? FEATURE_FLAGS_ALL_OFF,
+            });
+            writeSystemMessage({
+                deleteMessage,
+                insertMessage,
+                record: createSystemRecoverySummaryMessage(workspace.id, agentId, text),
+                runId,
+                text,
+                writeToRun,
+            });
             return true;
-        const text = buildRecoverySummary({
-            agent,
-            allTaskMessages: listMessagesForRecovery(workspace.id, 0),
-            messages: listMessagesForRecovery(workspace.id, Date.now() - RECOVERY_WINDOW_MS),
-            tasksContent,
-            workers,
-            workspace,
-            workflowsEnabled: getWorkflowsEnabled?.() ?? false,
-            autostaffEnabled: getAutostaffEnabled?.() ?? false,
-        });
-        writeSystemMessage({
-            deleteMessage,
-            insertMessage,
-            record: createSystemRecoverySummaryMessage(workspace.id, agentId, text),
-            runId,
-            text,
-            writeToRun,
-        });
-        return true;
-    },
-});
+        },
+    };
+};

package/dist/src/server/routes-settings.js

@@ -1,4 +1,5 @@
 import { resolveCommandPath } from './agent-command-resolver.js';
+import { readFeatureFlags } from './feature-flags.js';
 import { BadRequestError } from './http-errors.js';
 import { getRequiredParam, readJsonBody, route, sendJson } from './route-helpers.js';
 import { ensureProtocolFile } from './tasks-file.js';
@@ -49,11 +50,10 @@ const serializeRoleTemplate = (template) => ({
  */
 const refreshWorkflowProtocolDocs = (store) => {
     const policy = readWorkflowCliPolicy(store.settings.getAppState(WORKFLOW_CLI_POLICY_KEY)?.value ?? null);
-    const enabled = readWorkflowEnabled(store.settings.getAppState(WORKFLOW_ENABLED_KEY)?.value ?? null);
-    const autostaff = readAutostaffEnabled(store.settings.getAppState(AUTOSTAFF_ENABLED_KEY)?.value ?? null);
+    const flags = readFeatureFlags(store.settings);
     for (const workspace of store.listWorkspaces()) {
         try {
-            ensureProtocolFile(workspace.path, policy, enabled, autostaff);
+            ensureProtocolFile(workspace.path, policy, flags);
         }
         catch (error) {
             console.error('[hive] swallowed:settings.refreshProtocol', error);

package/dist/src/server/routes-tasks.js

@@ -1,6 +1,29 @@
 import { getRequiredParam, readJsonBody, route, sendJson } from './route-helpers.js';
+import { computeRunnableTasks } from './task-deps.js';
+import { authenticateCliAgent, requireCommandForRole } from './team-authz.js';
 import { requireUiTokenFromRequest } from './ui-auth-helpers.js';
 export const taskRoutes = [
+    route('GET', '/api/workspaces/:workspaceId/tasks/next', ({ params, request, response, store, tasksFileService }) => {
+        const workspaceId = getRequiredParam(response, params, 'workspaceId', 'Workspace id is required');
+        if (!workspaceId) {
+            return;
+        }
+        // CLI-agent auth (mirrors `team list`): `team next` is an orchestrator
+        // planning query, not a UI call.
+        const agentId = request.headers['x-hive-agent-id'];
+        const token = request.headers['x-hive-agent-token'];
+        const agent = authenticateCliAgent({
+            fromAgentId: typeof agentId === 'string' ? agentId : undefined,
+            getAgent: store.getAgent,
+            token: typeof token === 'string' ? token : undefined,
+            validateToken: store.validateAgentToken,
+            workspaceId,
+        });
+        requireCommandForRole(agent, 'next');
+        const workspace = store.getWorkspaceSnapshot(workspaceId);
+        const tasks = computeRunnableTasks(tasksFileService.readTasks(workspace.summary.path));
+        sendJson(response, 200, { tasks });
+    }),
     route('GET', '/api/workspaces/:workspaceId/tasks', ({ params, request, response, store, tasksFileService }) => {
         const workspaceId = getRequiredParam(response, params, 'workspaceId', 'Workspace id is required');
         if (!workspaceId) {

package/dist/src/server/routes-workspaces.js

@@ -78,6 +78,11 @@ export const workspaceRoutes = [
             workspaceId,
         });
         requireCommandForRole(agent, 'list');
+        // The orchestrator polling `team list` is its natural post-restart wakeup:
+        // flush any reports a prior outage stranded back into its stdin now that
+        // it is reachable again. Cheap (indexed, usually empty) and a safe no-op
+        // for non-orchestrator callers.
+        store.drainReportOutbox(workspaceId);
         sendJson(response, 200, enrichTeamList(workspaceId, store, store.listWorkers(workspaceId)).map(serializeTeamListItem));
     }),
     route('POST', '/api/workspaces/:workspaceId/workers', async ({ params, request, response, store }) => {

package/dist/src/server/runtime-restart-policy.d.ts

@@ -1,8 +1,9 @@
 import type { AgentRunStorePort } from './agent-runtime-ports.js';
+import type { FeatureFlags } from './feature-flags.js';
 import type { MessageLogHandle, MessageLogRecord, RecoveryMessage } from './message-log-store.js';
 import type { TasksFileService } from './tasks-file.js';
 import type { WorkspaceStore } from './workspace-store.js';
-export declare const buildRuntimeRestartPolicy: ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getWorkflowsEnabled, getAutostaffEnabled, }: {
+export declare const buildRuntimeRestartPolicy: ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getFlags, }: {
     agentRunStore: Pick<AgentRunStorePort, "listAgentRuns">;
     messageLogStore: {
         deleteMessage: (handle: MessageLogHandle) => void;
@@ -11,6 +12,5 @@ export declare const buildRuntimeRestartPolicy: ({ agentRunStore, messageLogStor
     };
     tasksFileService: Pick<TasksFileService, "readTasks">;
     workspaceStore: Pick<WorkspaceStore, "getWorkspaceSnapshot">;
-    getWorkflowsEnabled?: () => boolean;
-    getAutostaffEnabled?: () => boolean;
+    getFlags?: () => FeatureFlags;
 }) => import("./restart-policy.js").RestartPolicy;

package/dist/src/server/runtime-restart-policy.js

@@ -1,12 +1,11 @@
 import { createRestartPolicy } from './restart-policy.js';
 // Narrow helper keeps runtime-store under the hard line cap.
-export const buildRuntimeRestartPolicy = ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getWorkflowsEnabled, getAutostaffEnabled, }) => createRestartPolicy({
+export const buildRuntimeRestartPolicy = ({ agentRunStore, messageLogStore, tasksFileService, workspaceStore, getFlags, }) => createRestartPolicy({
     deleteMessage: messageLogStore.deleteMessage,
     getWorkspaceSnapshot: workspaceStore.getWorkspaceSnapshot,
     insertMessage: messageLogStore.insertMessage,
     listAgentRuns: agentRunStore.listAgentRuns,
     listMessagesForRecovery: messageLogStore.listMessagesForRecovery,
     readTasks: tasksFileService.readTasks,
-    ...(getWorkflowsEnabled ? { getWorkflowsEnabled } : {}),
-    ...(getAutostaffEnabled ? { getAutostaffEnabled } : {}),
+    ...(getFlags ? { getFlags } : {}),
 });

package/dist/src/server/runtime-store-contract.d.ts

@@ -28,6 +28,9 @@ export interface RuntimeStore {
         restartedWorker: boolean;
     }>;
     reportTask: (workspaceId: string, workerId: string, input?: ReportTaskInput) => ReportTaskResult;
+    /** Flush any reports stranded by a prior orchestrator outage. Safe no-op
+     *  when the orchestrator is down or the outbox is empty. */
+    drainReportOutbox: (workspaceId: string) => void;
     statusTask: (workspaceId: string, workerId: string, input?: StatusTaskInput) => ReportTaskResult;
     cancelTask: (workspaceId: string, dispatchId: string, input: CancelTaskInput) => ReportTaskResult;
     listDispatches: (workspaceId: string, options?: ListDispatchesOptions) => DispatchRecord[];

package/dist/src/server/runtime-store-helpers.d.ts

@@ -11,6 +11,7 @@ import { createTasksFileService } from './tasks-file.js';
 import { createTasksFileWatcher } from './tasks-file-watcher.js';
 import { createTeamOperations } from './team-operations.js';
 import { createUiAuth } from './ui-auth.js';
+import { createWebhookNotifier } from './webhook-notifier.js';
 import { type WorkerOutputTracker } from './worker-output-tracker.js';
 import { type WorkflowDispatchAwaiter } from './workflow-dispatch-awaiter.js';
 import { createWorkflowRunLogStore } from './workflow-run-log-store.js';
@@ -31,6 +32,7 @@ export interface RuntimeStoreServices {
     tasksFileService: ReturnType<typeof createTasksFileService>;
     teamOps: ReturnType<typeof createTeamOperations>;
     uiAuth: ReturnType<typeof createUiAuth>;
+    webhookNotifier: ReturnType<typeof createWebhookNotifier>;
     workerOutputTracker: WorkerOutputTracker | null;
     workflowDispatchAwaiter: WorkflowDispatchAwaiter;
     workflowRunLogStore: ReturnType<typeof createWorkflowRunLogStore>;

package/dist/src/server/runtime-store-helpers.js

@@ -2,21 +2,22 @@ import { createAgentRunStore } from './agent-run-store.js';
 import { createAgentRuntime } from './agent-runtime.js';
 import { createAgentSessionStore } from './agent-session-store.js';
 import { createDispatchLedgerStore } from './dispatch-ledger-store.js';
+import { readFeatureFlags } from './feature-flags.js';
 import { createMessageLogStore } from './message-log-store.js';
 import { seedOrchestratorLaunchConfig } from './orchestrator-launch.js';
+import { createReportOutboxStore } from './report-outbox-store.js';
 import { openRuntimeDatabase } from './runtime-database.js';
 import { buildRuntimeRestartPolicy } from './runtime-restart-policy.js';
 import { createSettingsStore } from './settings-store.js';
 import { createTasksFileService } from './tasks-file.js';
 import { createTasksFileWatcher } from './tasks-file-watcher.js';
-import { AUTOSTAFF_ENABLED_KEY, readAutostaffEnabled } from './team-autostaff.js';
 import { createTeamOperations } from './team-operations.js';
 import { resolveTerminalInputProfile } from './terminal-input-profile.js';
 import { createUiAuth } from './ui-auth.js';
+import { createWebhookNotifier, WEBHOOK_URL_KEY } from './webhook-notifier.js';
 import { createWorkerOutputTracker } from './worker-output-tracker.js';
 import { readWorkflowCliPolicy, WORKFLOW_CLI_POLICY_KEY } from './workflow-cli-policy.js';
 import { createWorkflowDispatchAwaiter, } from './workflow-dispatch-awaiter.js';
-import { readWorkflowEnabled, WORKFLOW_ENABLED_KEY } from './workflow-feature.js';
 import { createWorkflowRunLogStore } from './workflow-run-log-store.js';
 import { createWorkflowRunStore } from './workflow-run-store.js';
 import { createWorkflowScheduleStore } from './workflow-schedule-store.js';
@@ -35,6 +36,7 @@ export const createRuntimeStoreServices = (options = {}) => {
     const db = openRuntimeDatabase(options.dataDir);
     const messageLogStore = createMessageLogStore(db);
     const dispatchLedgerStore = createDispatchLedgerStore(db);
+    const reportOutbox = createReportOutboxStore(db);
     const workflowDispatchAwaiter = createWorkflowDispatchAwaiter();
     const workflowRunStore = createWorkflowRunStore(db);
     const workflowRunLogStore = createWorkflowRunLogStore(db);
@@ -42,8 +44,10 @@ export const createRuntimeStoreServices = (options = {}) => {
     const agentRunStore = createAgentRunStore(db);
     const agentSessionStore = createAgentSessionStore(db);
     const settings = createSettingsStore(db);
-    const getWorkflowsEnabled = () => readWorkflowEnabled(settings.getAppState(WORKFLOW_ENABLED_KEY)?.value ?? null);
-    const getAutostaffEnabled = () => readAutostaffEnabled(settings.getAppState(AUTOSTAFF_ENABLED_KEY)?.value ?? null);
+    const getFlags = () => readFeatureFlags(settings);
+    const webhookNotifier = createWebhookNotifier({
+        getUrl: () => settings.getAppState(WEBHOOK_URL_KEY)?.value ?? null,
+    });
     const tasksFileService = createTasksFileService();
     const tasksFileWatchCallbacks = new Set();
     const tasksFileWatcher = createTasksFileWatcher({
@@ -51,8 +55,7 @@ export const createRuntimeStoreServices = (options = {}) => {
             notifyTasksUpdated(tasksFileWatchCallbacks, workspaceId, content);
         },
         getWorkflowCliPolicy: () => readWorkflowCliPolicy(settings.getAppState(WORKFLOW_CLI_POLICY_KEY)?.value ?? null),
-        getWorkflowsEnabled,
-        getAutostaffEnabled,
+        getFlags,
     });
     const uiAuth = createUiAuth();
     const shellRuntime = createWorkspaceShellRuntime(options.agentManager);
@@ -71,8 +74,7 @@ export const createRuntimeStoreServices = (options = {}) => {
         messageLogStore,
         tasksFileService,
         workspaceStore,
-        getWorkflowsEnabled,
-        getAutostaffEnabled,
+        getFlags,
     });
     const workerOutputTracker = options.agentManager
         ? createWorkerOutputTracker(options.agentManager.getOutputBus())
@@ -119,7 +121,7 @@ export const createRuntimeStoreServices = (options = {}) => {
             for (const child of children)
                 removeWorkerCompletely(workspaceId, child.id);
         }
-    }, restartPolicy, (workspaceId, agentId) => workspaceStore.getAgent(workspaceId, agentId), getWorkflowsEnabled, getAutostaffEnabled);
+    }, restartPolicy, (workspaceId, agentId) => workspaceStore.getAgent(workspaceId, agentId), getFlags);
     // Mirrors runtime-store.deleteWorker (stop run → drop launch config → drop
     // dispatches → drop worker row, transactionally). Hoisted `function` so the
     // onAgentExit closure above can reference it; only invoked at runtime, after
@@ -157,6 +159,8 @@ export const createRuntimeStoreServices = (options = {}) => {
         markDispatchCancelled: dispatchLedgerStore.markCancelled,
         markDispatchReportedByWorker: dispatchLedgerStore.markReportedByWorker,
         markDispatchSubmitted: dispatchLedgerStore.markSubmitted,
+        reportOutbox,
+        notifyWebhook: webhookNotifier.notify,
         workflowDispatchAwaiter,
         workspaceStore,
         dismissEphemeralWorker: (workspaceId, workerId) => removeWorkerCompletely(workspaceId, workerId),
@@ -176,6 +180,7 @@ export const createRuntimeStoreServices = (options = {}) => {
         tasksFileService,
         teamOps,
         uiAuth,
+        webhookNotifier,
         workerOutputTracker,
         workflowDispatchAwaiter,
         workflowRunLogStore,

package/dist/src/server/runtime-store-workflows.js

@@ -78,6 +78,14 @@ export const createRuntimeStoreWorkflowRuntime = (services, store) => {
             catch (error) {
                 console.error('[hive] workflow.notifyTrigger failed', error);
             }
+            // Outbound completion webhook (best-effort) so the user is pinged when a
+            // long fan-out finishes without watching the drawer.
+            services.webhookNotifier.notify({
+                type: 'workflow_finished',
+                workspaceId,
+                summary: `${finalRecord.name}: ${finalRecord.status}${finalRecord.error ? ` — ${finalRecord.error}` : ''}`,
+                at: Date.now(),
+            });
         },
         store: {
             addWorkerWithLaunch: (ws, input, launch) => store.addWorkerWithLaunch(ws, input, launch),

package/dist/src/server/runtime-store.js

@@ -93,6 +93,7 @@ export const createRuntimeStore = (options = {}) => {
         dispatchTask: services.teamOps.dispatchTask,
         dispatchTaskByWorkerName: services.teamOps.dispatchTaskByWorkerName,
         reportTask: services.teamOps.reportTask,
+        drainReportOutbox: services.teamOps.drainReportOutbox,
         statusTask: services.teamOps.statusTask,
         listDispatches: services.dispatchLedgerStore.listWorkspaceDispatches,
         listWorkers: (workspaceId) => services.workspaceStore.listWorkers(workspaceId),

package/dist/src/server/sqlite-schema.js

@@ -118,6 +118,19 @@ export const initializeRuntimeDatabase = (db) => {
     CREATE INDEX IF NOT EXISTS idx_dispatches_open_by_worker
       ON dispatches (workspace_id, to_agent_id, status, sequence);
 
+    CREATE TABLE IF NOT EXISTS report_outbox (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      workspace_id TEXT NOT NULL,
+      target_agent_id TEXT NOT NULL,
+      dispatch_id TEXT NOT NULL UNIQUE,
+      payload TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      delivered_at INTEGER
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_report_outbox_pending
+      ON report_outbox (workspace_id, target_agent_id, delivered_at, created_at);
+
     CREATE TABLE IF NOT EXISTS workflow_runs (
       id TEXT PRIMARY KEY,
       workspace_id TEXT NOT NULL,

package/dist/src/server/task-deps.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Optional, read-only task-dependency support for `.hive/tasks.md`.
+ *
+ * A task line may carry a trailing `[needs: #2, #5]` annotation declaring that
+ * it depends on other tasks (referenced by their 1-based position among the
+ * GFM task-list items). `team next` uses this to surface the tasks that are
+ * currently runnable — not done, and with every dependency already checked off.
+ *
+ * Deliberately scoped: parsing happens here on the server only and is purely a
+ * READ — Hive never auto-dispatches a runnable task and never writes the
+ * annotation back into tasks.md (that file stays a human/orchestrator-edited,
+ * git-mergeable artifact). The web task renderer is intentionally left
+ * untouched, so the annotation just shows as literal text in the UI.
+ */
+export interface ParsedTaskLine {
+    /** 1-based position among task-list items — the `#n` that `[needs:]` uses. */
+    index: number;
+    done: boolean;
+    text: string;
+    needs: number[];
+}
+export interface RunnableTask {
+    index: number;
+    text: string;
+}
+export declare const parseTasksWithDeps: (markdown: string) => ParsedTaskLine[];
+/**
+ * Tasks that can be worked right now: not yet done, and every `[needs:]`
+ * dependency is a task that exists AND is checked off. A dependency on a
+ * non-existent `#n`, or on a task that isn't done, withholds the task.
+ */
+export declare const computeRunnableTasks: (markdown: string) => RunnableTask[];