@volter/supercode-orchestrator 0.4.125 → 0.4.127

package/board/cli.mjs

@@ -15,7 +15,7 @@ import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
 import { adoptSession, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, supercodeBin, tick } from './dispatch.mjs';
 import { watchBoard } from './wake.mjs';
-import { loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
+import { creatorOf, loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
 import { evaluate } from './expr.mjs';
 
 const HELP = `supercode workflow <verb> [--root <home>] [--board <slug>] [--json]
@@ -35,6 +35,7 @@ Hermes Kanban's verbs, with their flags:
   complete <id>... [--result] [--summary] [--metadata JSON]   edit <id> --result [--summary] [--metadata]
   block <id> [reason] (--on <card> | --waiting-on <message id>) [--ids ...]   schedule <id> [reason] [--ids ...]
   pause <id> --reason <why>   resume <id>   cancel <id>   set-every <id> <interval|none>
+  request-state <id> --state block|pause|done|cancelled --reason <why> [--on <card>|--waiting-on <message>] [--evidence <pointers>]
   unblock <id>... [--reason]   request-review <id> [--summary] [--reviewer] [--force]   request-changes <id> <reason>   reopen-review <id>...   reopen <id>... [--reason]
   promote <id> [reason] [--ids ...] [--force] [--dry-run]   archive <id>... [--rm <id>...]
   specify <id> [--title --body] [--all]   decompose <id> [--child "<title>[@<profile>]"]... [--all]
@@ -53,11 +54,13 @@ supercode's own:
   notify-subscribe <id> --address sc:<machine>:<harness>:<id> [--role creator|worker|dependency]
   Any verb … --at sc:<machine>:board:<home>: sent as mail to a board kept on another machine.
   <event> <id>... [reason] [--<field> value]: any other event the board's workflow declares, its flags the event's fields.
+  start <id>               release a --no-start hold and start through the declared workflow
+  create ... --adopt <session>  hold dispatch until that live session is attached
   goto <id> <status> [reason] [--<field> value]: the event the workflow says takes the card to that status, sent.
 
   specify/decompose with no spec start a session on the triage card to write it. A card's own session may comment on,
-  block (with --kind), heartbeat and request review of its card, specify or decompose it in triage, and file, complete,
-  block and comment on its subtasks; its arc is marked done by its reviewers, never by itself.
+  heartbeat and request review of its card, specify or decompose it in triage, and work its subtasks. The home's
+  workflow declares who may block, pause or finish a card; request-state mails its manager without changing state.
 `;
 
 const MULTI = new Set(['parent', 'skill', 'worker', 'child', 'ids', 'rm']);
@@ -239,6 +242,7 @@ export async function runWorkflow(argv) {
 
   // a caller that is a card's own session (its harness names it; the board recorded which session it launched)
   const listing = ['list','ls'].includes(verb);
+  await loadWorkflow(root).catch((error) => { if (verb !== 'init' && verb !== 'boards') throw error; });
   const sid = listing && !args.mine ? null : callerSession();
   // what this command records is the calling session's act (its address, as its subscriptions name it)
   if (sid) setActor(`sc:${localMachine()}:${sid === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code'}:${sid}`);
@@ -247,7 +251,6 @@ export async function runWorkflow(argv) {
   }
   // the board's workflow (the IR's): what each verb does, and who may send it, is its
   // every verb reads the board through its workflow (a list settles cards too), so every verb loads it
-  if (verb !== 'help' && !listing) await loadWorkflow(root).catch((error) => { if (verb !== 'init' && verb !== 'boards') throw error; });
   engine.setCaller((db, cardId) => rolesFor(db, cardId, sid, workflowFor(root).params));
   // a verb with no session behind it (a person at the CLI, the board file's sync) is the manager's, as its roles are
   if (!sid && verb !== 'help') { try { setActor([].concat(workflowFor(root).params?.managers ?? [])[0] ?? null); } catch { /* no workflow */ } }
@@ -293,11 +296,15 @@ export async function runWorkflow(argv) {
         workspace, branch: args.branch, parents: args.parent, priority: args.priority, tenant: args.tenant,
         triage: args.triage, idempotencyKey: args['idempotency-key'], maxRuntime: duration(args['max-runtime']),
         maxRetries, skills: args.skill, model: args.model, provider: args.provider, createdBy: args['created-by'] ?? callerName(),
+        noStart: Boolean(args['no-start']), adopt: args.adopt ?? null,
         every: args.every ?? null, sessionId: callerSession(), subtaskOf: args['subtask-of'] ?? null, initialStatus: args['initial-status'] ?? null,
         project: args.project ?? meta.project_id ?? null, goal: args.goal ? { maxTurns: args['goal-max-turns'] ? Number(args['goal-max-turns']) : null } : args['no-goal'] ? false : null,
       }), true);
       let answer = { id: created.id, existing: created.existing };
-      if (!args['no-start'] && !created.existing && !args['subtask-of']) {
+      if (args.adopt) {
+        const adopted = withBoard(b => adoptSession(b, created.id, args.adopt, { ttl: settings.ttl }));
+        answer = { ...answer, started: true, session: adopted.address, mode: adopted.mode };
+      } else if (!args['no-start'] && !created.existing && !args['subtask-of']) {
         const [report] = await tick({ root, lanes, settings, only: created.id, slugs: [slug] });
         const started = report.started.find(([t]) => t === created.id);
         const queued = report.queued.find(([t]) => t === created.id);
@@ -812,6 +819,12 @@ export async function runWorkflow(argv) {
       say(args, lifted.length ? `Resumed (removed ${lifted.join(', ')})` : 'Not paused', { ok: true, lifted });
       return 0;
     }
+    case 'start': {
+      need(1, 'a card id');
+      const { lanes, settings } = await laneState(root);
+      const session = await withBoardAsync(b => startCard(b, id, { lanes, settings, roles: rolesFor(b.db, id, sid, workflowFor(root).params) }));
+      say(args, `${id}: ${session?.address ?? 'started'}`, { ok: true, session }); return 0;
+    }
     case 'adopt': {
       need(2, 'a card id and a session');
       const { settings } = await laneState(root);
@@ -841,10 +854,10 @@ export async function runWorkflow(argv) {
       if (!declared) throw new Error(`no workflow verb ${verb}; \`supercode workflow help\` lists them`);
       need(1, 'a card id');
       const { _: _words, root: _r, board: _b, json: _j, at: _a, ids: _i, ...fields } = args;
-      const payload = { ...fields, reason: args.reason ?? (rest.slice(1).join(' ') || null) };
+      const payload = { ...fields, waiting_on: args['waiting-on'] ?? fields.waiting_on, reason: args.reason ?? (rest.slice(1).join(' ') || null) };
       const results = [];
       for (const t of [id, ...(args.ids ?? [])]) results.push([t, (await withBoardAsync((b) => engine.act(b, t, name, { payload }))).to]);
-      say(args, results.map(([t, s]) => `${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
+      say(args, results.map(([t, s]) => name === 'request_state' ? `${t}: ${payload.state} requested; state remains ${s}. Mail delivery is recorded on the card.` : `${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
     }
   }
 }
@@ -1061,16 +1074,10 @@ function ownCard(db, sessionId) {
 
 const READS = new Set(['list', 'ls', 'show', 'context', 'runs', 'log', 'tail', 'watch', 'stats', 'assignees', 'diagnostics', 'diag', 'attachments', 'notify-list', 'help', 'init']);
 
-/**
- * What a card's own session may write (the owner's rule): on its card, comment, block with a typed reason, heartbeat,
- * request review, attach a file, specify or decompose it in triage; on its subtasks, file, complete, block, unblock,
- * comment and attach. Never its arc's completion, and never another arc's card: anything across arcs goes through the
- * fleet's manager.
- */
 /**
  * Who a caller is on card `cardId`, in the workflow's roles: a person or the fleet's manager at the CLI (no session)
  * is `manager`; the session of the card's current run has that run's role; the card's working session between runs
- * is its `implementer`; the session working a subtask's arc is `arc`; any other session is nobody on it.
+ * is its `implementer`; the session working a subtask's arc is `arc`; its recorded creator also has the creator role; any other session is nobody on it.
  */
 function rolesFor(db, cardId, sessionId, params = {}) {
   if (!sessionId) return ['manager', 'owner'];
@@ -1080,6 +1087,7 @@ function rolesFor(db, cardId, sessionId, params = {}) {
   const task = engine.getTask(db, cardId);
   if (!task) return [];
   const roles = [];
+  if (creatorOf(db, cardId)?.endsWith(`:${sessionId}`)) roles.push('creator');
   const current = task.current_run_id ? json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(task.current_run_id)?.metadata, {})?.supercode : null;
   if (current?.session_id === sessionId) roles.push(current.role ?? 'implementer');
   else if (engine.lastSession(db, cardId)?.session_id === sessionId) roles.push('implementer');
@@ -1100,6 +1108,7 @@ function authorize(db, verb, rest, args, own) {
   if (args.all) refuse(`does not ${verb} every card; only its own`);
   const card = engine.getTask(db, rest[0]);
   if (!card) return; // the verb itself answers "no card"
+  if (creatorOf(db, card.id)?.endsWith(`:${callerSession()}`)) return; // its declared creator doors still govern the act
   // a card's session writes its own card and its subtasks; what it may do with them is the workflow's (`by`)
   if (card.id !== own.id && card.subtask_of !== own.id) refuse(`writes only its own card and its subtasks, not ${card.id}`);
   for (const other of args.ids ?? []) if (other !== own.id && engine.getTask(db, other)?.subtask_of !== own.id) refuse(`writes only its own card and its subtasks, not ${other}`);

package/board/dispatch.mjs

@@ -136,7 +136,20 @@ const HARNESSES = {
 const addressOf = (s) => s?.address ?? (s?.session_id && s.machine ? `sc:${s.machine}:${s.harness ?? 'claude-code'}:${s.session_id}` : null);
 const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 
-const sessionAlive = (fleet, session) => Boolean(session?.session_id) && [...fleet.alive].some((a) => a.endsWith(`:${session.session_id}`));
+const sessionAlive = (fleet, session) => fleet.native?.has(addressOf(session)) ? fleet.native.get(addressOf(session)).alive : Boolean(session?.session_id) && fleet.alive.has(addressOf(session));
+
+/** Native activity comes from the machine's harness discovery, not catalogue age. */
+function nativeSessions(machine, harness) {
+  const result = sc(['discover', '--on', machine, '--harness', harness, '--limit', '2000'], { timeout: 120_000 });
+  const page = result.code === 0 ? lastJson(result.stdout) : null;
+  if (!Array.isArray(page?.sessions)) throw unavailable(`native liveness unavailable on ${machine}: ${(result.stderr || result.stdout).trim().slice(-300)}`);
+  return page.sessions;
+}
+function nativeReading(rows, session) {
+  const row = rows.find(r => r.locator?.session_id === session.session_id && r.locator?.harness === session.harness);
+  const presence = row?.activity?.presence;
+  return { row, alive: presence === 'running' ? true : presence === 'persisted' ? false : null };
+}
 
 /** Match a manual continuation by the same harness identity and an actually live machine pane. */
 function continuationPane(fleet, session, panes) {
@@ -211,6 +224,17 @@ function supervise(board, fleet, settings, report, entry, effects) {
   // The catalog can lag a pane. Read the actual machines once, before any board mutation.
   const observed = new Map();
   const exits = new Map();
+  const native = new Map(); fleet.native = new Map();
+  for (const { id } of rows) {
+    const session = currentRun(board.db, id)?.metadata?.supercode;
+    if (!session?.session_id || session.pane || session.surface === 'headless') continue;
+    const key = `${session.machine}:${session.harness}`;
+    if (!native.has(key)) {
+      try { native.set(key, nativeSessions(session.machine, session.harness)); }
+      catch (error) { native.set(key, null); report.failed.push([id, error.message]); }
+    }
+    fleet.native.set(addressOf(session), native.get(key) ? nativeReading(native.get(key), session) : { alive: null });
+  }
   for (const { id } of rows) {
     const s = currentRun(board.db, id)?.metadata?.supercode;
     if (!s?.pane || observed.has(s.machine)) continue;
@@ -288,7 +312,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
       // Hermes's orphan reconciliation: a running card whose claim bookkeeping is broken, with nothing live behind it
       const paneReading = session?.pane ? observed.get(session.machine) : undefined;
       const paneLive = paneReading instanceof Set ? paneReading.has(session.pane) : null;
-      const live = session?.surface === 'headless' ? pidAlive(session.pid) : session?.pane ? paneLive !== false : session?.session_id ? (fleet.ok ? sessionAlive(fleet, session) : true) : false;
+      const live = session?.surface === 'headless' ? pidAlive(session.pid) : session?.pane ? paneLive !== false : session?.session_id ? (fleet.ok ? sessionAlive(fleet, session) !== false : true) : false;
       // (whether it is reconciled is the workflow's: its `orphaned` transitions and their guard)
       if ((!task.claim_lock || !task.claim_expires) && !live) {
         observe('orphaned', { reason: 'orphaned_running', claim_lock: task.claim_lock, claim_expires: task.claim_expires, error: 'orphaned running card (broken claim bookkeeping)' }, 'reclaimed');
@@ -325,6 +349,7 @@ function supervise(board, fleet, settings, report, entry, effects) {
         if (session.pane && paneLive === null) return; // no machine reading, no loss verdict
         if (!session.pane && !fleet.ok) return;
         const alive = session.pane ? paneLive : sessionAlive(fleet, session);
+        if (alive == null) return; // native discovery was inconclusive
         const machineUp = paneReading instanceof Set || fleet.online.has(session.machine);
         const young = t - Number(session.launched_at ?? 0) < Number(limits.grace ?? settings.grace);
         const missing = !alive && machineUp && !young;
@@ -374,6 +399,13 @@ function stopSession(board, session) {
     if (pidAlive(session.pid)) signal('SIGKILL');
     return;
   }
+  if (!session.pane && session.surface === 'native') {
+    const r = sc(['close', addressOf(session)], { timeout: 120_000, as: boardAddress(board.label) });
+    if (r.code !== 0) throw new Error(`closing native session ${addressOf(session)}: ${(r.stderr || r.stdout).trim().slice(-500)}`);
+    const reading = nativeReading(nativeSessions(session.machine, session.harness), session);
+    if (reading.alive !== false) throw new Error(`native close has no confirmed stopped receipt for ${addressOf(session)}`);
+    return;
+  }
   if (session.pane) {
     const r = sc(['teams', 'panes', 'close', session.pane, ...(session.machine ? ['--machine', session.machine] : [])], { timeout: 60_000, as: boardAddress(board.label) });
     if (r.code !== 0 || json(r.stdout.trim(), null)?.closed !== session.pane) throw new Error(`closing pane ${session.pane}: ${(r.stderr || r.stdout || `exit ${r.code}`).trim().slice(-500)}`);
@@ -421,6 +453,7 @@ function startCards(board, fleet, lanes, settings, report, entry, effects, { onl
   for (const task of everyCard) {
     if (only && task.id !== only) continue;
     const state = scopeFor(task).card;
+    if (state.dispatch_hold) continue;
     if (workflow.run && (task.subtask_of || state.paused || state.archived || state.blocked_by.length || task.current_run_id || (state.every && state.next_run_at > now()))) continue;
     if (!startable.has(statusOf(board.db, task))) continue;
     const plan = planOf(task, scopeFor(task));
@@ -565,6 +598,8 @@ export async function startCard(board, id, { roles = ['manager'], lanes, setting
   const moved = tx(board, (db) => {
     assertWorkspaceOwner(db, before, checked);
     if (checked) db.prepare('UPDATE supercode_cards SET workspace_root=? WHERE task_id=?').run(checked.mainRoot, id);
+    if (!roles.includes('manager')) throw new Error('Only the manager starts a held card; request its decision.');
+    event(db, id, 'dispatch_released', { reason: 'explicit start' });
     return fire(db, board, entry, id, entry.workflow.dispatch.start, { roles, payload: { lock: claimer() } });
   });
   const task = getTaskNow(board, id);
@@ -611,7 +646,7 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         report.undelivered.push([row.task_id, addressOf(session), error]);
       }
     }
-    if (!session?.pane || session.close_transferred_to || session.close_confirmed_at || (!row.ended_at && !session.close_requested)) continue;
+    if ((!session?.pane && session?.surface !== 'native') || session.close_transferred_to || session.close_confirmed_at || (!row.ended_at && !session.close_requested)) continue;
     if (caller && session.session_id === caller) continue; // let the command that ended its own run return
     const active = view(board, (db) => db.prepare(`SELECT r.id, r.metadata FROM task_runs r WHERE r.ended_at IS NULL OR EXISTS (SELECT 1 FROM tasks t WHERE t.current_run_id = r.id)`).all());
     // Persist retries even for historical ends that did not have a close_session action.
@@ -619,6 +654,16 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
     let error = null;
     try {
       const machine = session.machine ?? localMachine();
+      if (session.surface === 'native' && !session.pane) {
+        const reading = nativeReading(nativeSessions(machine, session.harness), session);
+        if (reading.alive == null) throw new Error(`close deferred: native liveness unknown for ${addressOf(session)}`);
+        if (reading.alive) {
+          const protectedNow = active.some(r => addressOf(json(r.metadata, {})?.supercode) === addressOf(session));
+          if (protectedNow) throw new Error('close deferred: native session is owned by an unended run');
+          if (session.lifecycle_notice_pending) throw new Error(`close deferred: lifecycle notice ${session.lifecycle_notice_pending} has not been delivered`);
+          stopSession(board, session);
+        }
+      } else {
       if (!panes.has(machine)) {
         const r = sc(['teams', 'panes', 'ls', ...onMachine(machine)], { timeout: 60_000, as: boardAddress(board.label) });
         const list = r.code === 0 ? json(r.stdout.trim(), null) : null;
@@ -634,10 +679,11 @@ export function closeRequested(board, report, { taskId = null, caller = null } =
         if (protectedNow) throw new Error(`close deferred: pane ${session.pane} is owned by an unended run`);
         stopSession(board, session); observed.live.delete(session.pane);
       }
+      }
     } catch (e) { error = String(e.message).slice(-500); }
     tx(board, (db) => {
       const current = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(row.id)?.metadata, {})?.supercode;
-      if (!current || current.pane !== session.pane) return;
+      if (!current || current.pane !== session.pane || current.session_id !== session.session_id) return;
       const at = now();
       if (error) {
         setRunSession(db, row.id, { ...current, close_attempted_at: at, close_attempts: Number(current.close_attempts ?? 0) + 1, close_error: error });
@@ -668,8 +714,9 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
       if (!(entry.workflow.statuses[status]?.on?.session_idle || entry.workflow.on?.session_idle || entry.workflow.run?.on?.session_idle)) return;
       const runRow = currentRun(db, id);
       const session = runRow?.metadata?.supercode;
-      if (!session?.session_id || session.surface !== 'pane' || session.offline_since != null) return;
-      const live = fleet.sessions.find((x) => x.address?.endsWith(`:${session.session_id}`));
+      if (!session?.session_id || !['pane', 'native'].includes(session.surface) || session.offline_since != null) return;
+      if (session.surface === 'native' && fleet.native?.get(addressOf(session))?.alive !== true) return;
+      const live = fleet.sessions.find((x) => x.address === addressOf(session));
       const observedAt = now();
       const lastAt = Math.floor(Number(live?.last_message_at_ms) / 1000);
       const reading = {
@@ -695,7 +742,7 @@ function observeIdle(board, fleet, settings, report, entry, effects) {
       try {
         const where = whereOf(board, task);
         // the ask names what the session may do, as its run's prompt did
-        const said = doors(entry.workflow, status, session.role ?? runSpec(entry, status)?.role ?? 'implementer', id, where, session.surface === 'pane' ? 'pane' : 'headless');
+        const said = doors(entry.workflow, status, session.role ?? runSpec(entry, status)?.role ?? 'implementer', id, where, session.surface !== 'headless' ? 'pane' : 'headless');
         const r = fire(db, board, entry, id, 'session_idle', { roles: ['platform'], payload: { ...reading, turns: reading.turns_before, worked }, extra: { where, doors: said } });
         effects.push(...r.effects);
         const after = currentRun(db, id);
@@ -948,7 +995,7 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   closeRequested(board, { undelivered: [] }, { taskId: task.id });
   const pending = view(board, (db) => db.prepare('SELECT id, ended_at, metadata FROM task_runs WHERE task_id = ? AND id != ?').all(task.id, runId))
     .map((r) => ({ ...r, session: json(r.metadata, {})?.supercode }))
-    .find((r) => (r.session?.pane || r.session?.launch_key) && !r.session.close_transferred_to && (r.session.slot ?? 'worker') === slot && (r.ended_at || r.session.close_requested) && !r.session.close_confirmed_at);
+    .find((r) => (r.session?.pane || r.session?.launch_key || r.session?.surface === 'native') && !r.session.close_transferred_to && (r.session.slot ?? 'worker') === slot && (r.ended_at || r.session.close_requested) && !r.session.close_confirmed_at);
   if (pending) throw unavailable(`slot ${slot} still owns pane ${pending.session.pane} from run ${pending.id}; closure must be confirmed before another session starts: ${pending.session.close_error ?? 'close pending'}`);
   let prev = view(board, (db) => lastSession(db, task.id, slot));
   if (prev?.session_id && !prev.forgotten && (prev.harness ?? 'claude-code') === harness && prev.machine === machine) {
@@ -997,6 +1044,12 @@ function launchPane(board, task, runId, lane, fleet, { input = null, slot = 'wor
   };
   let session = null;
   let replaced = null;
+  if (prev?.surface === 'native' && !prev.pane) {
+    const reading = nativeReading(nativeSessions(prev.machine, prev.harness), prev);
+    if (reading.alive == null) throw unavailable(`cannot establish native continuation liveness for ${addressOf(prev)}`);
+    fleet.native ??= new Map(); fleet.native.set(addressOf(prev), reading);
+    if (reading.alive && (prev.closed_at || prev.close_requested || prev.forgotten)) throw unavailable(`native session ${addressOf(prev)} is still live; its close must finish before replacement`);
+  }
   if (prev?.forgotten) {
     if (prev.pane && panePresent(prev.machine, prev.pane)) throw new Error(`forgotten session ${prev.session_id} still has live pane ${prev.pane}; close it before replacement`);
     replaced = { session_id: prev.session_id, why: 'the workflow let it go' };
@@ -1165,14 +1218,15 @@ export function adoptSession(board, id, who, { workspace = null, ttl, assignee =
   if (!found) throw new Error(`the fleet lists no live session ${who}`);
   const [, host, harness, sessionId] = found.address.split(':');
   if (!HARNESSES[harness]) throw new Error(`${found.address} is ${harness}; the board keeps and resumes ${Object.keys(HARNESSES).join(' and ')} sessions`);
-  if (!found.pane || !panePresent(host, found.pane)) throw new Error(`${found.address} has no verified live pane`);
+  const native = found.pane ? null : nativeReading(nativeSessions(host, harness), { session_id: sessionId, harness });
+  if (found.pane ? !panePresent(host, found.pane) : native.alive !== true) throw new Error(`${found.address} has no verified live native process or pane`);
   const beforeRun = view(board, (db) => currentRun(db, id));
   const beforeSession = beforeRun?.metadata?.supercode;
   if (beforeRun && beforeSession?.session_id !== sessionId) throw new Error(`${id} has another active run/session; end it before adopting a different identity`);
   if (beforeSession?.pane && beforeSession.pane !== found.pane && panePresent(beforeSession.machine, beforeSession.pane)) throw new Error(`${id} still has live pane ${beforeSession.pane}; close the extra pane before rebinding ${sessionId}`);
 
   // the session's own working directory, as discovery records it (where `--resume` finds it), else its pane's
-  let dir = workspace;
+  let dir = workspace ?? native?.row?.cwd;
   if (!dir) {
     const r = sc(['discover', '--on', host, '--harness', harness, '--limit', '2000'], { timeout: 120_000 });
     dir = (json(r.stdout.trim(), {})?.sessions ?? []).find((x) => x.locator?.session_id === sessionId)?.cwd ?? null;
@@ -1203,10 +1257,11 @@ export function adoptSession(board, id, who, { workspace = null, ttl, assignee =
       const implementer = lastSession(db, id, 'worker');
       if (implementer?.session_id === sessionId) throw new Error('a reviewer must be independent of the implementer session');
     }
+    event(db, id, 'dispatch_released', { reason: 'verified adoption', session: found.address });
     if (!beforeRun) fire(db, board, entry, id, entry.workflow.run ? entry.workflow.dispatch.start : 'adopt', { roles: ['manager'], payload: { lock: claimer() } });
     const runId = getTask(db, id).current_run_id;
     if (!runId) throw new Error(`${id} waits on parents that are not done`);
-    const session = { surface: 'pane', session_id: sessionId, harness, machine: host, pane: found.pane ?? null, address: found.address, mode: 'adopt', launched_at: now(), seen_at: now() };
+    const session = { surface: found.pane ? 'pane' : 'native', session_id: sessionId, harness, machine: host, pane: found.pane ?? null, address: found.address, mode: 'adopt', launched_at: now(), seen_at: now() };
     setRunSession(db, runId, { ...(currentRun(db, id)?.metadata?.supercode ?? {}), ...session, slot: currentRun(db, id)?.metadata?.supercode?.slot ?? beforeSession?.slot ?? expected?.session ?? 'worker', close_requested: null, closed_at: null, close_confirmed_at: null, close_error: null, missing_since: null });
     event(db, id, 'session_adopted', { session_id: sessionId, machine: host, pane: session.pane, address: found.address, mode: 'adopt', role: currentRun(db, id)?.metadata?.supercode?.role }, runId);
     subscribeIn(db, id, found.address, 'worker');
@@ -1245,16 +1300,23 @@ async function send(from, label, to, body, key, { queue = false, ask = false } =
  * and marked board_message_sent. A question goes under the id its card waits on; a resend of a sent one is a no-op
  * (the id is the send's idempotency key). One that fails is tried again next tick.
  */
-async function sendBoardMessages(board, report) {
+export async function sendBoardMessages(board, report, taskId = null) {
   const rows = view(board, (db) => db.prepare(`SELECT id, task_id, payload FROM task_events e WHERE kind = 'board_message' AND NOT EXISTS
     (SELECT 1 FROM task_events s WHERE s.kind = 'board_message_sent' AND s.task_id = e.task_id AND json_extract(s.payload, '$.event') = e.id) ORDER BY id`).all());
   for (const row of rows) {
+    if (taskId && row.task_id !== taskId) continue;
     const m = json(row.payload, {}) ?? {};
     try {
       await send(boardAddress(board.label), board.label, m.to, m.text, m.message_id ?? `board-message-${row.id}`, { ask: Boolean(m.message_id) });
       tx(board, (db) => event(db, row.task_id, 'board_message_sent', { event: row.id, to: m.to, ...(m.message_id ? { message_id: m.message_id } : {}) }));
     } catch (error) {
-      report.undelivered.push([row.task_id, m.to, String(error.message).slice(-200)]);
+      const reason = String(error.message).slice(-200);
+      report.undelivered.push([row.task_id, m.to, reason]);
+      tx(board, db => {
+        const previous = db.prepare("SELECT payload,created_at FROM task_events WHERE task_id=? AND kind='board_message_failed' AND json_extract(payload,'$.event')=? ORDER BY id DESC LIMIT 1").get(row.task_id, row.id);
+        if (json(previous?.payload, {})?.reason !== reason || now() - (previous?.created_at ?? 0) >= 60)
+          event(db, row.task_id, 'board_message_failed', { event: row.id, to: m.to, message_id: m.message_id, reason });
+      });
     }
   }
 }

package/board/engine.mjs

@@ -12,7 +12,7 @@ import { existsSync, rmSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { checkWorkspace, assertWorkspaceOwner, declareWorkspace, isLocalWorkspace, isWorkspacePath } from './workspace.mjs';
 import { DatabaseSync } from 'node:sqlite';
-import { view, claimer, event, json, newTaskId, now, tx } from './store.mjs';
+import { view, actorOf, claimer, event, json, newTaskId, now, tx } from './store.mjs';
 import { addDependency, retireSupersededRuns, refreshCardInputs, requestSessionClose, eventTo, fire, loadWorkflow, setStatus, settle, startNew, statusOf, runEvent, workflowFor } from './workflow.mjs';
 
 export const STATUSES = ['triage', 'todo', 'scheduled', 'ready', 'running', 'blocked', 'review', 'done', 'archived'];
@@ -184,6 +184,10 @@ export function createCard(board, spec) {
     if (arc?.subtask_of) throw new Error(`${arc.id} is itself a subtask of ${arc.subtask_of}; a subtask belongs to an arc`);
     let id = newTaskId();
     while (one(db, 'SELECT 1 FROM tasks WHERE id = ?', id)) id = newTaskId();
+    const creationRoles = workflowFor(board.root).params.create_dependencies_by;
+    if ((parents.length || initial === 'blocked') && creationRoles && !callerRoles(db, arc?.id ?? id).some(role => creationRoles.includes(role))) {
+      throw new Error('Creating a dependency or initially blocked card requires a permitted manager role; file the task without a blocker and use request-state.');
+    }
     assertWorkspaceOwner(db, workspaceTask, checked);
     // The repository declaration stays separate from the resolved worktree path.
     if (project) {
@@ -211,7 +215,8 @@ export function createCard(board, spec) {
     // the create's own words: whether it asked to be a goal card (null: the workflow decides), triage, its arc
     const status = startNew(db, board, entry, getTask(db, id), { triage: Boolean(spec.triage), initial_status: initial,
       every: spec.every ?? null, goal: spec.goal === undefined || spec.goal === null ? null : spec.goal !== false, subtask_of: arc?.id ?? null });
-    event(db, id, 'created', { assignee: spec.assignee || null, status, parents, tenant: spec.tenant ?? null, ...(machine ? { machine } : {}), ...(arc ? { subtask_of: arc.id } : {}) });
+    event(db, id, 'created', { creator: actorOf(), assignee: spec.assignee || null, status, parents, tenant: spec.tenant ?? null, ...(machine ? { machine } : {}), ...(arc ? { subtask_of: arc.id } : {}) });
+    if ((spec.noStart || spec.adopt) && !arc) event(db, id, 'dispatch_held', { session: spec.adopt ?? null, reason: spec.adopt ? 'awaiting adoption' : 'created with --no-start' });
     if (parents.length) inheritSubscriptions(db, id, parents);
     if (arc) {
       // the arc's subscribers hear its subtasks, and the arc's session works them
@@ -382,6 +387,10 @@ export async function runEffects(board, effects = [], { retryNotices = false } =
       if (!await sessionNotice(board, e)) continue;
     }
     else if (e.kind === 'cleanup_workspace') cleanupWorkspace(board, e.id);
+    else if (e.kind === 'board_message') {
+      const { sendBoardMessages } = await import('./dispatch.mjs');
+      await sendBoardMessages(board, { undelivered: [] }, e.id);
+    }
     else if (e.kind === 'invalidate_descendants') tx(board, (db) => invalidateDescendants(db, board, e.id));
     else if (e.kind === 'stop_run') stopWorker(board, e.runId);
     else if (e.kind === 'close_session' || e.kind === 'send_to_actor' || e.kind === 'run_ended') {
@@ -685,7 +694,7 @@ export function runs(db, id, { stateType = null, stateName = null } = {}) {
 
 /** Delete the thread events of done and archived cards older than `seconds` (Hermes's `gc` of events). */
 export function gcEvents(board, seconds) {
-  return tx(board, (db) => Number(run(db, "DELETE FROM task_events WHERE created_at < ? AND task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'archived'))", now() - seconds).changes));
+  return tx(board, (db) => Number(run(db, "DELETE FROM task_events WHERE kind != 'created' AND created_at < ? AND task_id IN (SELECT id FROM tasks WHERE status IN ('done', 'archived'))", now() - seconds).changes));
 }
 
 // ------------------------------------------------------------------ diagnostics

package/board/tools.mjs

@@ -5,9 +5,9 @@
 // unblocking tools are the orchestrator's, not a worker's. Answers are JSON text: `{ ok: true, … }` or `{ error }`.
 import { mkdirSync, statSync, writeFileSync } from 'node:fs';
 import { basename, join } from 'node:path';
-import { DEFAULT_BOARD, event, json, openBoard, tx } from './store.mjs';
+import { DEFAULT_BOARD, actorOf, event, json, openBoard, setActor, tx } from './store.mjs';
 import * as engine from './engine.mjs';
-import { loadWorkflow } from './workflow.mjs';
+import { creatorOf, loadWorkflow } from './workflow.mjs';
 
 const ok = (fields = {}) => JSON.stringify({ ok: true, ...fields });
 const error = (message) => JSON.stringify({ error: message });
@@ -25,7 +25,7 @@ export function redact(value) {
   return value;
 }
 
-const LIFECYCLE = new Set(['kanban_complete', 'kanban_block', 'kanban_request_review', 'kanban_request_changes', 'kanban_heartbeat', 'kanban_attach', 'kanban_attach_url', 'kanban_unblock']);
+const LIFECYCLE = new Set(['kanban_complete', 'kanban_block', 'kanban_request_state', 'kanban_request_review', 'kanban_request_changes', 'kanban_heartbeat', 'kanban_attach', 'kanban_attach_url', 'kanban_unblock']);
 const ORCHESTRATOR_ONLY = new Set(['kanban_list', 'kanban_unblock']);
 
 /** One board tool call. `root` is the home; `env` the worker's task environment (`HERMES_KANBAN_*`). */
@@ -33,30 +33,39 @@ export async function boardTool(root, name, args = {}, env = {}) {
   const own = env.HERMES_KANBAN_TASK || null;
   const runId = env.HERMES_KANBAN_RUN_ID ? Number(env.HERMES_KANBAN_RUN_ID) : null;
   const author = env.HERMES_PROFILE || 'worker';
-  if (own && ORCHESTRATOR_ONLY.has(name)) return error(`${name} is the orchestrator's; a dispatched worker uses kanban_complete, kanban_block, kanban_heartbeat or kanban_comment for its own task`);
+  if (own && ORCHESTRATOR_ONLY.has(name)) return error(`${name} is the orchestrator's; read kanban_show for your task's declared doors, or use kanban_request_state, kanban_heartbeat or kanban_comment`);
   const tid = args.task_id || own;
   if (!['kanban_list', 'kanban_create', 'kanban_link'].includes(name) && !tid) return error('task_id is required (or HERMES_KANBAN_TASK in the environment)');
-  if (own && LIFECYCLE.has(name) && tid !== own) return error(`worker is scoped to task ${own}; refusing to change ${tid}. Use kanban_comment to hand off to other tasks, or kanban_create for follow-up work.`);
   const slug = args.board || env.HERMES_KANBAN_BOARD || DEFAULT_BOARD;
   // the board's workflow decides what each tool's event does; the worker is its run's role on its own task, and
   // nobody on another (Hermes's worker scoping)
   try { await loadWorkflow(root); } catch (e) { return error(e.message); }
   engine.setCaller((db, cardId) => {
-    if (!own || cardId !== own || !runId) return own ? [] : ['manager'];
+    if (!own || !runId) return own ? [] : ['manager'];
     const meta = json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(runId)?.metadata, {})?.supercode ?? {};
-    return [meta.role ?? 'implementer'];
+    const roles = cardId === own ? [meta.role ?? 'implementer'] : [];
+    if (actorOf() && creatorOf(db, cardId) === actorOf()) roles.push('creator');
+    return roles;
   });
   let board;
   try { board = openBoard(root, slug); } catch (e) { return error(e.message); }
   board.label = slug;
+  const callingRun = runId ? json(board.db.prepare('SELECT metadata FROM task_runs WHERE id=?').get(runId)?.metadata, {})?.supercode : null;
+  setActor(own && runId ? callingRun?.address ?? `hermes-run:${slug}:${runId}` : null);
+  if (own && LIFECYCLE.has(name) && tid !== own && creatorOf(board.db, tid) !== actorOf()) {
+    board.close(); return error(`worker is scoped to task ${own}; refusing to change ${tid}. Use kanban_comment to hand off to other tasks.`);
+  }
   const current = () => tx(board, (db) => engine.getTask(db, tid));
   // a worker whose run was superseded (reclaimed, re-dispatched) no longer speaks for the card
   const ownRun = () => {
-    if (!own || tid !== own || !runId) return null;
-    const t = current();
-    return t && Number(t.current_run_id) !== runId ? `run ${runId} of ${tid} is no longer its current run; nothing was changed` : null;
+    if (!own) return null;
+    const t = engine.getTask(board.db, own);
+    const r = runId && board.db.prepare('SELECT task_id, ended_at FROM task_runs WHERE id=?').get(runId);
+    return !r || r.task_id !== own || r.ended_at != null || Number(t?.current_run_id) !== runId
+      ? `run ${runId ?? '(missing)'} of ${own} is no longer its current run; nothing was changed` : null;
   };
   try {
+    if (name !== 'kanban_show' && name !== 'kanban_list') { const stale = ownRun(); if (stale) return error(stale); }
     switch (name) {
       case 'kanban_show': {
         const card = tx(board, (db) => { const c = engine.showCard(db, tid); c.context = engine.cardContext(db, tid); return c; });
@@ -104,6 +113,11 @@ export async function boardTool(root, name, args = {}, env = {}) {
         const { to: status } = await engine.block(board, tid, { reason: args.reason ? redact(String(args.reason)) : null, on: args.on ?? null, waitingOn: args.waiting_on ?? null });
         return ok({ task_id: tid, status });
       }
+      case 'kanban_request_state': {
+        const stale = ownRun(); if (stale) return error(stale);
+        await engine.act(board, tid, 'request_state', { payload: { state: args.state, reason: args.reason, on: args.on ?? null, waiting_on: args.waiting_on ?? null, evidence: args.evidence ?? null } });
+        return ok({ task_id: tid, requested: args.state, changed: false });
+      }
       case 'kanban_request_review': {
         const stale = ownRun(); if (stale) return error(stale);
         await engine.requestReview(board, tid, { summary: args.summary ? redact(String(args.summary)) : null, metadata: args.metadata ? redact(args.metadata) : null, reviewer: args.reviewer ?? null, expectedRunId: own === tid && runId ? runId : null });

package/board/worker-prompt.mjs

@@ -12,12 +12,12 @@ export function taskProtocol(taskId) {
     `You were started for board task ${taskId} (it is also in HERMES_KANBAN_TASK). The board's tools are yours:`,
     '- `kanban_show` reads your task: its body, its parents\' handoffs, earlier attempts and its thread. Read it first.',
     '- `kanban_heartbeat` says you are still working on a long step; `kanban_comment` leaves a note on any task.',
-    '- `kanban_create` files follow-up work (with `parents` to make it wait on another task); `kanban_link` adds a dependency.',
-    '- When the work is done, `kanban_complete` with a `summary` a person can read (and `metadata`, `artifacts`, `created_cards` where they apply).',
-    '- If the work needs review, `kanban_request_review` instead. If you cannot go on, `kanban_block` with a `reason` and the one',
-    '  thing that ends the wait: `on` (the task it waits on) or `waiting_on` (the id of the message whose answer it waits for).',
-    'End every run with exactly one of complete, request_review or block: a run that ends without one is counted as a failure.',
-    'You may change only your own task\'s lifecycle; other tasks hear from you through comments.',
+    '- `kanban_create` files follow-up work; dependency creation follows the declared permissions.',
+    '- Follow the workflow doors below: each home declares who may block, pause or finish a card.',
+    '- When the home requires a manager decision, `kanban_request_state` names block, pause, done or cancelled, a reason,',
+    '  its dependency (`on` or `waiting_on`) or its evidence. It mails the manager and leaves your card and run active.',
+    '- `kanban_request_review` hands completed coding to the independent reviewer when the workflow permits it.',
+    'A role does not grant terminal authority by itself. The recorded creator and the home\'s rules decide it.',
   ].join('\n');
 }
 

package/board/workflow.mjs

@@ -58,6 +58,13 @@ export function statusOf(db, task) {
   return one(db, 'SELECT stage FROM supercode_cards WHERE task_id = ?', task.id)?.stage ?? task.status;
 }
 
+/** Creation history, not an editable display name or notification subscriber. */
+export function creatorOf(db, id) {
+  const payload = json(one(db, "SELECT payload FROM task_events WHERE task_id=? AND kind='created' ORDER BY id LIMIT 1", id)?.payload, {}) ?? {};
+  const address = payload.creator ?? payload.by;
+  return payload.source !== 'document' && /^(?:sc:[^:]+:[^:]+:|hermes-run:)/.test(address ?? '') ? address : null;
+}
+
 /** What kanban.db stores for `status`. */
 export function storedAs(workflow, status) {
   return workflow.statuses[status]?.stored_as ?? status;
@@ -214,6 +221,8 @@ export function scopeOf(db, board, task, { params, event = {}, extra = {} } = {}
   const blocks = json(state.blocked_by, []) ?? [];
   const card = {
     ...task,
+    creator_address: creatorOf(db, task.id),
+    dispatch_hold: one(db, "SELECT kind FROM task_events WHERE task_id=? AND kind IN ('dispatch_held','dispatch_released','session_adopted') ORDER BY id DESC LIMIT 1", task.id)?.kind === 'dispatch_held',
     status,
     blocked_by: blocks,
     paused: json(state.paused, null),
@@ -275,6 +284,7 @@ export function scopeOf(db, board, task, { params, event = {}, extra = {} } = {}
   for (const [key, expr] of Object.entries(loaded.get(board.root)?.workflow?.derived ?? {})) card[key] = evaluate(expr, { card, event, params, now: now() });
   return {
     card,
+    requester: actorOf(),
     event,
     params,
     now: now(),
@@ -751,6 +761,7 @@ const ACTIONS = {
     const id = `m-${randomBytes(12).toString('hex')}`;
     ctx.scope.asked = id;
     record(ctx.db, ctx.id, 'board_message', { to: String(to), text: `${String(text ?? '')}\n\nAnswer with reply_to ${id}.`, message_id: id }, null);
+    ctx.effects.push({ kind: 'board_message', id: ctx.id });
   },
   send_to_actor(ctx, text) { ctx.effects.push({ kind: 'send_to_actor', id: ctx.id, text }); },
 };
@@ -808,7 +819,7 @@ function runSession(ctx, change) {
  * the board: `--root …` or `--at …`) and its transition's description: what a started session is told it can do.
  */
 // the board tool a one-shot worker sends an event with (Hermes's kanban_* tools)
-const TOOL_OF = { complete: 'kanban_complete', block: 'kanban_block', request_review: 'kanban_request_review', request_changes: 'kanban_request_changes', heartbeat: 'kanban_heartbeat', comment: 'kanban_comment' };
+const TOOL_OF = { complete: 'kanban_complete', block: 'kanban_block', request_state: 'kanban_request_state', request_review: 'kanban_request_review', request_changes: 'kanban_request_changes', heartbeat: 'kanban_heartbeat', comment: 'kanban_comment' };
 
 export function doors(workflow, status, role, id, where, surface = 'pane') {
   const events = new Map();

package/board/ztrack.mjs

@@ -360,6 +360,7 @@ class ZtrackBoard {
       this.mem.prepare('UPDATE supercode_cards SET blocked_by = ? WHERE task_id = ?').run(JSON.stringify(blocks), row.task_id);
       for (const b of blocks.filter((b) => b.kind === 'card')) this.insert('task_links', { parent_id: b.id, child_id: row.task_id });
     }
+    this.checkDocumentControls();
     if (observe) this.documentEvents();
   }
   taskCards(id, card) {
@@ -379,6 +380,41 @@ class ZtrackBoard {
     const rows = this.cardRows(id, card, parent);
     this.insert('tasks', rows.task); this.insert('supercode_cards', rows.state);
   }
+  checkDocumentControls() {
+    // A raw edit cannot authenticate its author. Trusted engine writes already
+    // have matching publication hashes; check only external edits, after local
+    // subtask references have been resolved to canonical card identities.
+    if (this.seed || (this.saved.documentHashes?.open === hash(this.text) && this.saved.documentHashes?.archived === hash(this.archiveText))) return;
+    let fields = [];
+    try { fields = workflowFor(this.root).params.document_control_fields ?? []; } catch { /* no home policy */ }
+    if (!fields.length) return;
+    const tasks = new Map(this.mem.prepare('SELECT * FROM tasks').all().map(t => [t.id, t]));
+    const states = new Map(this.mem.prepare('SELECT * FROM supercode_cards').all().map(c => [c.task_id, c]));
+    const value = (task, state, field) => field === 'status' ? state?.stage ?? task?.status ?? 'todo'
+      : field === 'blocked_by' ? json(state?.blocked_by, []).map(b => [b.kind, b.id]).sort()
+      : field === 'paused' ? json(state?.paused, null)
+      : field === 'archived' ? Boolean(state?.archived) : task?.[field] ?? null;
+    for (const id of new Set([...tasks.keys(), ...Object.keys(this.rows.cachedTasks)])) {
+      if (this.errors.has(id)) continue;
+      const oldTask = this.rows.cachedTasks[id], oldState = this.rows.cachedCards[id];
+      const task = tasks.get(id), state = states.get(id);
+      const forbidden = !task ? ['card removal'] : fields.filter(field =>
+        // A new display author is not an authenticated creator.
+        (oldTask || field !== 'created_by') && JSON.stringify(value(task, state, field)) !== JSON.stringify(value(oldTask, oldState, field)));
+      if (!forbidden.length) continue;
+      this.errors.set(id, `Document edit cannot change ${forbidden.join(', ')}; use this card's role-checked workflow verbs or request-state.`);
+      const source = this.documentRecords.get(state?.subtask_of ?? oldState?.subtask_of ?? id);
+      if (source) this.preserve.get(source.path)?.add(source.record.id);
+      this.mem.prepare('DELETE FROM tasks WHERE id=?').run(id);
+      this.mem.prepare('DELETE FROM supercode_cards WHERE task_id=?').run(id);
+      this.mem.prepare('DELETE FROM task_links WHERE child_id=?').run(id);
+      if (oldTask) this.insert('tasks', oldTask);
+      if (oldState) {
+        this.insert('supercode_cards', oldState);
+        for (const b of json(oldState.blocked_by, []).filter(b => b.kind === 'card')) this.insert('task_links', { parent_id: b.id, child_id: id });
+      }
+    }
+  }
   cardRows(id, card, parent = null) {
     const meta = card.metadata ?? {};
     const stored = this.preset.serializeKanbanCard({ ...card, acceptanceCriteria: [], relations: [], metadata: undefined, paused: undefined, every: undefined, workspace: undefined, branch: undefined, machine: undefined, priority: undefined });

package/mcp/hermes-kanban-tools.json

@@ -62,7 +62,7 @@
   },
   {
     "name": "kanban_complete",
-    "description": "Mark your current task done with a structured handoff for downstream workers and humans. Prefer ``summary`` for a human-readable 1-3 sentence description of what you did; put machine-readable facts in ``metadata`` (changed_files, tests_run, decisions, findings, etc). At least one of ``summary`` or ``result`` is required. If you created new tasks via ``kanban_create`` during this run, list their ids in ``created_cards`` — the kernel verifies them so phantom references are caught before they leak into downstream automation. If you produced deliverable files (charts, PDFs, spreadsheets, generated images), list their absolute paths in ``artifacts`` — the gateway notifier will upload them as native attachments to the human who subscribed to the task, so the deliverable lands in their chat alongside the summary instead of being a path they have to fetch by hand.",
+    "description": "Complete through the home's declared workflow permissions with a structured handoff. Homes may reserve terminal closure to the recorded creator or manager; use kanban_request_state when you need their decision. Prefer ``summary`` for a human-readable 1-3 sentence description of what you did; put machine-readable facts in ``metadata`` (changed_files, tests_run, decisions, findings, etc). At least one of ``summary`` or ``result`` is required. If you created new tasks via ``kanban_create`` during this run, list their ids in ``created_cards`` — the kernel verifies them so phantom references are caught before they leak into downstream automation. If you produced deliverable files (charts, PDFs, spreadsheets, generated images), list their absolute paths in ``artifacts`` — the gateway notifier will upload them as native attachments to the human who subscribed to the task, so the deliverable lands in their chat alongside the summary instead of being a path they have to fetch by hand.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -106,7 +106,7 @@
   },
   {
     "name": "kanban_block",
-    "description": "Stop work on this task until one thing ends the wait, and name it: `on`, the task it waits on (it goes to todo and resumes when that task closes), or `waiting_on`, the id of the message you sent whose answer it waits for (it resumes when an answer to that message lands in your mailbox). An outside event is a task on the card of whoever makes it happen or watches for it. `reason` is shown on the board. The same block twice goes to triage.",
+    "description": "Add a typed dependency only if the home permits your role to block. Otherwise use kanban_request_state with state block, the reason and on or waiting_on; that request leaves the card active. Stop work on this task until one thing ends the wait, and name it: `on`, the task it waits on (it goes to todo and resumes when that task closes), or `waiting_on`, the id of the message you sent whose answer it waits for (it resumes when an answer to that message lands in your mailbox). An outside event is a task on the card of whoever makes it happen or watches for it. `reason` is shown on the board. The same block twice goes to triage.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -171,7 +171,7 @@
   },
   {
     "name": "kanban_request_changes",
-    "description": "Reviewer verdict: return the current review run to the original implementer with concrete required changes. This closes the review run, reapplies parent dependency gating, and requeues the task without using block-loop accounting. Only use from a task claimed from the review column; use kanban_block only for a genuine external blocker.",
+    "description": "Reviewer verdict: return the current review run to the original implementer with concrete required changes. This closes the review run, reapplies parent dependency gating, and requeues the task without using block-loop accounting. Only use from a task claimed from the review column; use kanban_request_state when a manager must decide an external blocker.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -471,5 +471,42 @@
         "child_id"
       ]
     }
+  },
+  {
+    "name": "kanban_request_state",
+    "description": "Request a manager decision on block, pause, done or cancelled through the home workflow. Includes its rules in manager mail and leaves card/run state unchanged.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "task_id": {
+          "type": "string"
+        },
+        "state": {
+          "type": "string",
+          "enum": [
+            "block",
+            "pause",
+            "done",
+            "cancelled"
+          ]
+        },
+        "reason": {
+          "type": "string"
+        },
+        "on": {
+          "type": "string"
+        },
+        "waiting_on": {
+          "type": "string"
+        },
+        "evidence": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "state",
+        "reason"
+      ]
+    }
   }
 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.4.125",
+  "version": "0.4.127",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {