@volter/supercode-orchestrator 0.4.160 → 0.5.2

package/bin/runtime.mjs

@@ -52,6 +52,7 @@
 //
 // Everything it prints is one JSON object per line on stdout.
 
+import { SenderIdentityRecord } from '@volter/teams/sender-identity';
 import { existsSync, mkdirSync, rmdirSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
@@ -65,10 +66,11 @@ import { hermesAccess } from '../hermes-cli.mjs';
 
 import {
   load, save, refreshVault, step, importFrom, exportTo, closeWorld, Orchestrator, LoopbackAdapter,
-  ChatSdkAdapter, ApiServerAdapter,
+  ChatSdkAdapter, ApiServerAdapter, Rh2Adapter,
   TICK_MS, accessPolicy, applyOperator, performRemoveProfileDir, OPERATOR_OPS,
 } from '../index.mjs';
 import * as events from '../events.mjs';
+import { appView, installApp, installedApps, removeApp } from '../installed-apps.mjs';
 import { httpJobExecutor } from '../hosted.mjs';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 
@@ -326,7 +328,7 @@ async function runOperator(op, argv) {
  * block. A platform whose adapter does not exist yet is listed as
  * `unsupported`: the daemon never pretends a channel is connected.
  */
-function buildAdapters(state, vault = new Map(), log = () => {}) {
+function buildAdapters(state, vault = new Map(), log = () => {}, root = null) {
   const adapters = {};
   const report = [];
   for (const [profileName, profile] of Object.entries(state.profiles)) {
@@ -350,6 +352,15 @@ function buildAdapters(state, vault = new Map(), log = () => {}) {
       report.push({ platform, profile: profileName, adapter: selector, state: 'connecting' });
     }
   }
+  // Installed apps (ADR 0017): each attaches its channel with the installation's own token, under the profile it was
+  // installed for. Uninstalling on the other side revokes the token and the channel stops.
+  for (const app of root ? installedApps(root) : []) {
+    if (app.app !== 'room-chat') continue;
+    if (!state.profiles[app.profile]) { report.push({ platform: 'rh2', profile: app.profile, app: app.name, state: 'unsupported (its profile does not exist)' }); continue; }
+    if (adapters.rh2) { report.push({ platform: 'rh2', profile: app.profile, app: app.name, state: 'already owned by another profile' }); continue; }
+    adapters.rh2 = new Rh2Adapter({ platform: 'rh2', profile: app.profile, log, vault, channel: { enabled: true, extra: { api_url: app.origin, organization: app.organizationId, principal_id: app.principalId, token: app.token } } });
+    report.push({ platform: 'rh2', profile: app.profile, app: app.name, adapter: 'rh2', state: 'connecting' });
+  }
   return { adapters, report };
 }
 
@@ -396,6 +407,7 @@ function parseAccessArgs(argv) {
     else if (arg.startsWith('--root=')) args.root = arg.slice('--root='.length);
     else if (arg === '--profile') args.profile = argv[(i += 1)];
     else if (arg.startsWith('--profile=')) args.profile = arg.slice('--profile='.length);
+    else if (arg === '--principal') args.principal = argv[(i += 1)];
     else if (arg.startsWith('--')) throw new Error(`unknown argument \`${arg}\``);
     else args.rest.push(arg);
   }
@@ -433,6 +445,30 @@ const ACCESS_OPS = {
  * `access <verb> ...`: the COLD path. Access lives in Hermes's stores, so each verb is performed through
  * Hermes's own pairing store and writers, then the home is loaded again to report what stands.
  */
+/** `apps install NAME --origin URL --client-id ID --client-secret-file FILE --code CODE [--profile P]`, `apps list`, `apps remove NAME`. */
+async function appsMain(argv) {
+  const [verb, ...rest] = argv;
+  const flags = {}, positional = [];
+  for (let i = 0; i < rest.length; i += 1) {
+    if (rest[i].startsWith('--')) { flags[rest[i].slice(2)] = rest[i + 1]; i += 1; } else positional.push(rest[i]);
+  }
+  const root = resolve(flags.root ?? defaultRoot());
+  try {
+    if (verb === 'list') { say('apps', { root, apps: installedApps(root).map(appView) }); return; }
+    if (verb === 'remove') { say('apps', { root, removed: removeApp(root, positional[0] ?? '') }); return; }
+    if (verb === 'install') {
+      for (const name of ['origin', 'client-id', 'client-secret-file', 'code']) if (!flags[name]) throw new Error(`apps install needs --${name}`);
+      const clientSecret = readFileSync(flags['client-secret-file'], 'utf8').trim();
+      say('apps', { root, installed: appView(await installApp({ root, name: positional[0] ?? '', origin: flags.origin, clientId: flags['client-id'], clientSecret, code: flags.code, profile: flags.profile ?? 'default' })) });
+      return;
+    }
+    throw new Error('apps install|list|remove');
+  } catch (error) {
+    say('error', { root, message: String(error.message ?? error) });
+    process.exit(1);
+  }
+}
+
 async function accessMain(argv) {
   let parsed;
   try {
@@ -443,6 +479,16 @@ async function accessMain(argv) {
   }
   const [verb, ...rest] = parsed.rest;
   const root = resolve(parsed.root ?? defaultRoot());
+  // Hermes's gateway reads its pairing store on every message, so an approval admits the person at once. A live
+  // daemon holds the loaded access in memory: the approval goes over its socket (its grant reaches that allowlist).
+  const lease = verb === 'pair-approve' ? readLease(root) : null;
+  if (lease && leaseIsLive(lease)) {
+    const answer = await overSocket(socketPathFor(root), { op: 'access.pair_approve', args: { code: rest[0], principal: parsed.principal ?? null }, profile: parsed.profile });
+    const fresh = (await load(root)).state.profiles[parsed.profile];
+    say(answer.ok ? 'access' : 'error', answer.ok ? accessReport(root, parsed.profile, fresh, { verb, changed: true, door: 'live' }) : { root, profile: parsed.profile, verb, message: answer.error });
+    if (!answer.ok) process.exit(1);
+    return;
+  }
   let state;
   let vault;
   try {
@@ -481,8 +527,13 @@ async function accessMain(argv) {
     say('error', { root, profile: parsed.profile, verb, message: `pairing code ${args.code} is not pending in Hermes's pairing store (wrong, expired, or locked out)` });
     process.exit(1);
   }
+  let identity=null;
+  if(op==='approve') {
+    try {identity=await new SenderIdentityRecord().approvedPairing({...got,code:args.code,principal_id:parsed.principal??null,location:profile.dir});}
+    catch(error) {say('identity-warning',{root,profile:parsed.profile,message:error.message,pairing_approved:true});}
+  }
   const fresh = (await load(root)).state.profiles[parsed.profile];
-  say('access', accessReport(root, parsed.profile, fresh, { verb, changed: true, ...(op === 'approve' ? { approved: got } : {}) }));
+  say('access', accessReport(root, parsed.profile, fresh, { verb, changed: true, identity, ...(op === 'approve' ? { approved: got } : {}) }));
 }
 
 /**
@@ -571,6 +622,10 @@ async function main() {
     await accessMain(argv.slice(1));
     return;
   }
+  if (argv[0] === 'apps') {
+    await appsMain(argv.slice(1));
+    return;
+  }
   if (argv[0] === 'apply') {
     try {
       const code = await runApply(argv.slice(1));
@@ -669,7 +724,7 @@ async function main() {
     }
   }
 
-  const { adapters, report } = buildAdapters(state, vault, (level, message) => say('log', { level, message }));
+  const { adapters, report } = buildAdapters(state, vault, (level, message) => say('log', { level, message }), root);
   // `SUPERCODE_BIN` is set by `supercode orchestrator start` to the very
   // binary that spawned this daemon, so the worker doors it opens are that
   // build's, not whatever `supercode` a PATH lookup happens to find.

package/board/agent-declarations.mjs

@@ -0,0 +1,29 @@
+// Consume the card-creation intent after the board transaction; retries reuse the daemon-minted id.
+import { agentScope, teamsUnavailable, ensureCardAgent, localCardAgent, finishAgentAssignment } from '../agents.mjs';
+import { event, json, tx, view } from './store.mjs';
+import { workflowFor } from './workflow.mjs';
+
+export function declareCardAgentEffect(board,effect) {
+  const task=view(board,db=>db.prepare('SELECT t.*,c.subtask_of,c.archived,c.sponsor FROM tasks t JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(effect.id));
+  if(!task||task.subtask_of)return true;
+  const entry=workflowFor(board.root),profile=task.assignee??effect.profile??entry.params.default_assignee;
+  // The reasons already told since the card's last declaration: each is recorded once, so a retry that alternates
+  // between two refusals writes nothing (a write wakes the dispatcher, which would retry at once).
+  const told=view(board,db=>new Set(db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='agent_declaration_pending' AND id>COALESCE((SELECT max(id) FROM task_events WHERE task_id=? AND kind='agent_declared'),0)").all(effect.id,effect.id).map(row=>json(row.payload,{})?.reason)));
+  try {
+    if(!entry.profiles[profile])throw new Error('card agent declaration needs a named profile');
+    const context=effect.context??process.env.SUPERCODE_CONTEXT,scope=agentScope(context);
+    const options={root:board.root,org:scope.org,server:scope.server,profiles:entry.profiles,
+      profile,card:effect.id,role:effect.role,sponsor:task.sponsor??null,context,starterSession:effect.starter_session};
+    // Without a reachable Teams the role's identity is minted here; the board's reconcile declares it later.
+    let agent;
+    if(scope.offline)agent=localCardAgent(options);
+    else try{agent=ensureCardAgent(options);}catch(error){if(!teamsUnavailable(error))throw error;agent=localCardAgent(options);}
+    if(task.archived||['done','cancelled','archived'].includes(task.status))finishAgentAssignment(board.root,scope.org,agent.assignment,`card ${effect.id} ${task.status}`);
+    tx(board,db=>event(db,effect.id,'agent_declared',{agent:agent.identity.id,org:scope.org,role:effect.role,profile,assignment:agent.assignment,synced:agent.synced!==false}));
+    return true;
+  }catch(error) {
+    if(!told.has(error.message))tx(board,db=>event(db,effect.id,'agent_declaration_pending',{role:effect.role,profile,reason:error.message}));
+    return false;
+  }
+}

package/board/ci.mjs

@@ -218,6 +218,8 @@ function knownRepositories() {
 export function reviewDue(board, id, prs) {
   const unjudged = prs.filter((p) => !judgedHead(board, id, p.head));
   if (!unjudged.length) return false;
+  const voided = board.db.prepare("SELECT r.payload FROM task_events v JOIN task_events r ON r.id=json_extract(v.payload,'$.review_request') AND r.task_id=v.task_id WHERE v.task_id=? AND v.kind='review_voided' ORDER BY v.id DESC LIMIT 1").get(id);
+  if (candidatePullRequests(voided && JSON.parse(voided.payload)?.ci).some(j => unjudged.some(p => p.url === j.pr.url && p.head === j.commit))) return true;
   const last = board.db.prepare(`SELECT r.payload, (SELECT MIN(v.created_at) FROM task_events v WHERE v.task_id = r.task_id
       AND v.kind IN ('changes_requested', 'review_pass') AND v.id > r.id) AS verdict_at
     FROM task_events r WHERE r.task_id = ? AND r.kind = 'review_requested'
@@ -248,6 +250,7 @@ export function judgedHead(board, id, head) {
   return board.db.prepare(`SELECT v.id, v.kind FROM task_events r JOIN task_events v ON v.task_id = r.task_id
     AND v.kind IN ('changes_requested', 'review_pass') AND v.id > r.id
     AND v.id < COALESCE((SELECT MIN(n.id) FROM task_events n WHERE n.task_id = r.task_id AND n.kind = 'review_requested' AND n.id > r.id), 9223372036854775807)
+    AND NOT EXISTS (SELECT 1 FROM task_events x WHERE x.task_id=r.task_id AND x.kind='review_voided' AND x.id>v.id AND json_extract(x.payload,'$.review_request')=r.id)
     WHERE r.task_id = ? AND r.kind = 'review_requested' AND (json_extract(r.payload, '$.ci.commit') = ?
       OR EXISTS (SELECT 1 FROM json_each(r.payload, '$.ci.prs') p WHERE json_extract(p.value, '$.commit') = ?)) ORDER BY v.id LIMIT 1`).get(id, head, head) ?? null;
 }
@@ -264,7 +267,9 @@ export function inspectCompletionEvidence(board, id, entry, payload = {}, stage
       }
       const candidate = stage === 'acceptance' ? reviewCandidate(board, id) : null;
       if (candidate) {
-        const row = board.db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='review_pass' ORDER BY id DESC LIMIT 1").get(id);
+        const row = board.db.prepare("SELECT id,payload FROM task_events WHERE task_id=? AND kind='review_pass' ORDER BY id DESC LIMIT 1").get(id);
+        const voided = board.db.prepare("SELECT id FROM task_events WHERE task_id=? AND kind='review_voided' ORDER BY id DESC LIMIT 1").get(id);
+        if (voided && (!row || voided.id > row.id)) throw new Error('The manager voided this verdict; the board must obtain a new review before acceptance.');
         const passed = candidatePullRequests(row && JSON.parse(row.payload)?.ci);
         const wanted = candidatePullRequests(candidate);
         if (wanted.length !== passed.length || wanted.some((w) => !passed.some((p) => p.pr.url === w.pr.url && p.commit === w.commit))) throw new Error('The current PR heads need their independent verdict before acceptance.');

package/board/cli.mjs

@@ -4,19 +4,22 @@
 // `serve`, `--at`) are added beside them. The Rust CLI hands every verb but `load` to `bin/orchestrator.mjs workflow`,
 // which lands here. The home is `--root`, else `SUPERCODE_ORCHESTRATOR_HOME`, else `HERMES_HOME`; the board is
 // `--board <slug>`, else `HERMES_KANBAN_BOARD`, else the home's current board (`kanban/current`), else `default`.
+import { taskStatusOf } from './published.mjs';
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { basename, join, resolve } from 'node:path';
 import { tmpdir, userInfo } from 'node:os';
 import { read } from '../orchestration.mjs';
-import { actorOf, view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
+import { actorOf, view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, setPrincipal, principalOf, isCaller, tx } from './store.mjs';
 import { isLocalWorkspace } from './workspace.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
 import { requestAdoption, boardAddress, boardLabel, boardSettings, callerSession, commandEnv, reconcileCallerLaunch, closeRequested, lanesOf, localMachine, observeFleet, paused, plan, startCard, supercodeBin, tick } from './dispatch.mjs';
 import { watchBoard } from './wake.mjs';
+import { streamBoardPublications } from './event-stream.mjs';
 import { completionOwnerOf, isLatestReviewer, loadWorkflow, requestSessionClose, scopeOf, statusOf, useWorkflow, workflowEntry, workflowFor } from './workflow.mjs';
 import { evaluate } from './expr.mjs';
+import { agentDoor,agentScope,activeAgentAssignments,reassignAgent,agentUsage,localAgentRecord,agentRunForSession } from '../agents.mjs';
 
 const HELP = `supercode workflow <verb> [--root <home>] [--board <slug>] [--json]
 
@@ -30,6 +33,7 @@ Hermes Kanban's verbs, with their flags:
   swarm <goal> --worker PROFILE:TITLE[:SKILL,SKILL]... --verifier P --synthesizer P
   list [--mine] [--assignee] [--status] [--tenant] [--session] [--archived] [--sort]   show <id>   context <id>   runs <id>
   set <id> <assignee|machine|model|every> <value|none> [--provider] [--ids ...]   assign <id> <profile|none>   set-model <id> [model] [--provider]   set-goal <id>... [--goal-max-turns N] [--off]
+  reassign <id> --agent AGENT [--role implementer]   (moves a card role's assignment to another agent; sessions keep their identity)
   claim <id> [--ttl]   reclaim <id> [--reason]   heartbeat <id> [--note] [--until <time|30m>]   link|unlink <parent> <child>
   comment <id> <text> [--author] [--max-len]   attach <id> <path> [--name] [--content-type]   attachments <id>   attach-rm <n>
   complete <id>... [--result] [--summary] [--metadata JSON]   edit <id> --result [--summary] [--metadata]
@@ -47,8 +51,17 @@ Hermes Kanban's verbs, with their flags:
   pause [reason] · resume   (Hermes's emergency stop, the ESTOP file: new starts stop, running sessions go on)
 
 supercode's own:
-  init --backing sqlite|files · boards create <slug> --backing sqlite|files
-      Where the board is kept: sqlite is Hermes's kanban.db (the default); files is one JSON file per card.
+  events [--after <cursor>] [--once] --json
+      Native retained card snapshots, then committed changes; a changed source requests resynchronization.
+  usage [--agent AGENT] [--sponsor PERSON] [--json]
+      Tokens each agent's ended card sessions recorded (the harness's own records), per model, summed on its sponsor.
+  init --backing sqlite|files · boards create <slug>
+      Where the Org's one task store is kept: sqlite is Hermes's kanban.db (the default); files is one JSON file per
+      card. A board is a saved view over that store: the cards carrying its slug as a tag (create --tag, tag/untag).
+  create … --tag T… --sponsor PERSON | --requested-by <platform>:<user> [--request <message ref>]
+      Tags are ordered (Hermes's tenant is the first). A proven requester sponsors the card with the request as
+      evidence; an unproven one is recorded as requested by (unverified) and the sponsor stays inherited.
+  tag <id> <tag>…   untag <id> <tag>…
   create … --machine M --subtask-of ARC --notify ADDRESS|--no-notify --no-start
       With a pane lane and room, a card starts at once and answers "started" with its session; else it answers why it
       waits, and its creator is told when it starts. A subtask is worked by its arc's session and never starts alone.
@@ -72,9 +85,9 @@ supercode's own:
   workflow declares who may block, pause or finish a card; request-state mails its manager without changing state.
 `;
 
-const MULTI = new Set(['parent', 'skill', 'worker', 'child', 'ids', 'rm', 'pr', 'pr-head', 'reviewed-sha', 'finding']);
+const MULTI = new Set(['parent', 'skill', 'worker', 'child', 'ids', 'rm', 'tag', 'pr', 'pr-head', 'reviewed-sha', 'finding']);
 const FLAGS = new Set(['json', 'triage', 'no-notify', 'no-start', 'all', 'force', 'help', 'mine', 'archived', 'reclaim', 'dry-run',
-  'goal', 'no-goal', 'off', 'switch', 'delete', 'no-attachments', 'include-logs', 'verbose']);
+  'once', 'goal', 'no-goal', 'off', 'switch', 'delete', 'no-attachments', 'include-logs', 'verbose']);
 // flags that take every following word up to the next flag (Hermes's nargs='+')
 const GREEDY = new Set(['ids', 'rm']);
 
@@ -120,7 +133,7 @@ function boardOf(root, args) {
   for (const want of [args.board, process.env.HERMES_KANBAN_BOARD, existsSync(currentFile(root)) ? readFileSync(currentFile(root), 'utf8').trim() : null]) {
     if (!want) continue;
     const slug = normalSlug(want);
-    if (slug === DEFAULT_BOARD || boardExists(root, slug)) return slug;
+    if (slug === DEFAULT_BOARD || boardExists(root, slug) || existsSync(metaPath(root, slug))) return slug;
     if (want === args.board) return slug;
   }
   return DEFAULT_BOARD;
@@ -128,6 +141,8 @@ function boardOf(root, args) {
 
 const boardDir = (root, slug) => join(root, 'kanban', 'boards', slug);
 const metaPath = (root, slug) => join(boardDir(root, slug), 'board.json');
+/** A saved view: a named board with metadata and no store of its own (C4). */
+const isView = (root, slug) => slug !== DEFAULT_BOARD && !boardExists(root, slug) && existsSync(metaPath(root, slug));
 
 function boardMeta(root, slug) {
   const meta = { slug, name: slug === DEFAULT_BOARD ? 'Default' : slug, description: '', icon: '', color: '', default_workdir: null, project_id: null, created_at: null, archived: false };
@@ -161,10 +176,15 @@ function boardsOf(root, { includeArchived = true } = {}) {
 }
 
 function counts(root, slug) {
-  if (!boardExists(root, slug)) return {};
-  const b = openBoard(root, slug);
+  const view = isView(root, slug);
+  if (!view && !boardExists(root, slug)) return {};
+  if (view && !boardExists(root, DEFAULT_BOARD)) return {};
+  const b = openBoard(root, view ? DEFAULT_BOARD : slug);
   try {
-    return Object.fromEntries(b.db.prepare('SELECT status, COUNT(*) AS n FROM tasks GROUP BY status').all().map((r) => [r.status, Number(r.n)]));
+    const rows = b.db.prepare('SELECT t.status, t.tenant, c.tags FROM tasks t LEFT JOIN supercode_cards c ON c.task_id = t.id').all();
+    const out = {};
+    for (const r of rows) if (!view || tagsOf(r).includes(slug)) out[r.status] = (out[r.status] ?? 0) + 1;
+    return out;
   } finally { b.close(); }
 }
 
@@ -181,14 +201,54 @@ async function laneState(root) {
 
 /** The caller's own supercode address, when it is a session supercode can reach (for its card's notices). */
 // The calling session's own address, as its actor is named: no fleet scan (a `message list` costs seconds).
+// the address the board recorded for the calling session when it launched it (a verb mailed from another machine
+// runs on the board's machine as its sender, whose address names the sender's machine)
+let recordedCaller = null;
 function callerAddress() {
   const id = callerSession();
   if (!id) return null;
-  return `sc:${localMachine()}:${id === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code'}:${id}`;
+  return recordedCaller ?? `sc:${localMachine()}:${id === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code'}:${id}`;
 }
 
 const callerName = () => process.env.HERMES_PROFILE || process.env.USER || 'user';
 
+/**
+ * C4: who the caller is as a principal, as a card's `created_by` records it: its agent (a relaunch keeps it), the
+ * automation running it, its own plain session, or the person its Teams login names. Never the OS user; null when
+ * nothing names one.
+ */
+function callerPrincipal(root, sid, { teams = false } = {}) {
+  if (process.env.SUPERCODE_AGENT_ID) return `agent:${process.env.SUPERCODE_AGENT_ID}`;
+  if (process.env.SUPERCODE_AUTOMATION) return `automation:${process.env.SUPERCODE_AUTOMATION}`;
+  if (sid) {
+    const harness = sid === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code';
+    const owner = agentRunForSession(root, [`${harness}:${sid}`]);
+    if (owner) return `agent:${owner.agent_id}`;
+    // a session an agent declared elsewhere owns (a manager's main session) is that agent's, as Teams records it
+    let declared = null;
+    try { declared = agentDoor('session', [`${harness}:${sid}`], { context: process.env.SUPERCODE_CONTEXT }).data?.agent?.id ?? null; } catch { /* no Teams: the session */ }
+    return declared ? `agent:${declared}` : `session:${callerAddress()}`;
+  }
+  if (!teams) return null;
+  const scope = agentScope(process.env.SUPERCODE_CONTEXT);
+  return !scope.offline && scope.principal ? `person:${scope.principal}` : null;
+}
+
+/** C4: a requester named by an outside id; a proven link makes them the card's sponsor, anything less is recorded unverified. */
+function requestedSponsor(args) {
+  if (args.sponsor) return { sponsor: args.sponsor, sponsorEvidence: args.request ? { request: args.request, by: principalOf() } : null };
+  if (!args['requested-by']) return {};
+  let resolved = null;
+  try { resolved = agentDoor('resolveIdentity', [args['requested-by']], { context: process.env.SUPERCODE_CONTEXT }).data; } catch { /* no Teams: unverified */ }
+  if (resolved?.classification === 'proven' && resolved.principal?.kind === 'user') {
+    const link = resolved.links?.find((l) => l.classification === 'proven');
+    return { sponsor: resolved.principal.id, sponsorEvidence: { observation: args['requested-by'], link: link?.id ?? null, proof: link?.proof?.kind ?? null, request: args.request ?? null, by: principalOf() } };
+  }
+  return { requestedByUnverified: { observation: args['requested-by'], label: resolved?.label ?? 'unresolved', request: args.request ?? null } };
+}
+
+const tagsOf = (card) => { const tags = Array.isArray(card.tags) ? card.tags : json(card.tags, null); return Array.isArray(tags) ? tags : card.tenant ? [card.tenant] : []; };
+
 const say = (args, human, value) => { process.stdout.write(args.json ? `${JSON.stringify(value, null, 2)}\n` : `${human}\n`); };
 
 // Hermes's own output lines, so a reader of `hermes kanban list` reads this one
@@ -241,7 +301,12 @@ export async function runWorkflow(argv) {
   const [verb, ...rest] = args._;
   if (!verb || verb === 'help' || args.help) { process.stdout.write(HELP); return 0; }
   const root = homeOf(args);
-  const slug = boardOf(root, args);
+  if (verb === 'events') return streamBoardPublications({root,after:args.after,once:args.once});
+  // C4: one task store per Org. A named board without a store of its own is a saved view over it: its tag selects
+  // the cards it shows, and a card filed through it carries that tag.
+  const named = boardOf(root, args);
+  const viewTag = isView(root, named) ? named : null;
+  const slug = viewTag ? DEFAULT_BOARD : named;
   const open = (create = false) => { const b = openBoard(root, slug, { create, document: args.document ?? null, backing: create ? args.backing ?? null : null }); b.label = boardLabel(root, slug); return b; };
   const withBoard = (fn, create = false) => { const b = open(create); try { return fn(b); } finally { b.close(); } };
   const withBoardAsync = async (fn) => { const b = open(); try { return await fn(b); } finally { b.close(); } };
@@ -254,7 +319,9 @@ export async function runWorkflow(argv) {
   await loadWorkflow(root).catch((error) => { if (verb !== 'init' && verb !== 'boards') throw error; });
   const sid = listing && !args.mine ? null : callerSession();
   // what this command records is the calling session's act (its address, as its subscriptions name it)
-  if (sid) setActor(`sc:${localMachine()}:${sid === process.env.CODEX_THREAD_ID ? 'codex' : 'claude-code'}:${sid}`);
+  recordedCaller = sid && boardExists(root, slug) ? withBoard((b) => b.db.prepare("SELECT json_extract(metadata, '$.supercode.address') AS address FROM task_runs WHERE json_extract(metadata, '$.supercode.session_id') = ? ORDER BY id DESC LIMIT 1").get(sid)?.address) ?? null : null;
+  if (sid) setActor(callerAddress());
+  setPrincipal(callerPrincipal(root, sid, { teams: !sid && !READS.has(verb) }));
   if (sid && !READS.has(verb) && boardExists(root, slug)) {
     withBoard((b) => { reconcileCallerLaunch(b, sid); const own = ownCard(b.db, sid); if (own) authorize(b.db, verb, rest, args, own); });
   }
@@ -265,8 +332,8 @@ export async function runWorkflow(argv) {
     if (verb === 'comment' && isLatestReviewer(db, cardId, actorOf()) && !roles.includes('reviewer')) roles.push('reviewer');
     return roles;
   });
-  // a verb with no session behind it is recorded as the OS user's; it holds no role on any card
-  if (!sid && verb !== 'help') setActor(`user:${userInfo().username}`);
+  // A plain terminal acts as its signed-in person; an offline OS label grants no creator authority.
+  if (!sid && verb !== 'help') setActor(principalOf() ?? `user:${userInfo().username}`);
 
   switch (verb) {
     case 'migrate': {
@@ -307,11 +374,15 @@ export async function runWorkflow(argv) {
         title: rest.join(' '), body: args.body, assignee: args.assignee === 'none' ? null : args.assignee, machine: args.machine,
         workspace, branch: args.branch, parents: args.parent, priority: args.priority, tenant: args.tenant,
         triage: args.triage, idempotencyKey: args['idempotency-key'], maxRuntime: duration(args['max-runtime']),
-        maxRetries, skills: args.skill, model: args.model, provider: args.provider, createdBy: args['created-by'] ?? callerName(),
+        maxRetries, skills: args.skill, model: args.model, provider: args.provider, createdBy: args['created-by'] ?? null,
         noStart: Boolean(args['no-start']), adopt: args.adopt ?? null,
         every: args.every ?? null, sessionId: callerSession(), subtaskOf: args['subtask-of'] ?? null, initialStatus: args['initial-status'] ?? null,
         project: args.project ?? meta.project_id ?? null, goal: args.goal ? { maxTurns: args['goal-max-turns'] ? Number(args['goal-max-turns']) : null } : args['no-goal'] ? false : null,
+        tags: [...(viewTag ? [viewTag] : []), ...(args.tag ?? [])],
+        // a person filing for themselves sponsors it; an agent filing a person's request names them (proven) or records them unverified
+        ...(args.sponsor || args['requested-by'] ? requestedSponsor(args) : principalOf()?.startsWith('person:') ? { sponsor: principalOf().slice('person:'.length) } : {}),
       }), true);
+      await withBoardAsync(b=>engine.runEffects(b,created.effects??[]));
       let answer = { id: created.id, existing: created.existing };
       if (args.adopt) {
         withBoard(b => { if (!rolesFor(b.db, created.id, sid, workflowFor(root).params).includes('manager')) throw new Error('Only the manager adopts an existing session.'); });
@@ -339,7 +410,7 @@ export async function runWorkflow(argv) {
         return { profile, title, skills: skills ? skills.split(',').map((x) => x.trim()).filter(Boolean) : [] };
       });
       if (!args.verifier || !args.synthesizer) throw new Error('a swarm names its --verifier and --synthesizer');
-      const made = withBoard((b) => engine.swarm(b, { goal: rest.join(' '), workers, verifier: args.verifier, synthesizer: args.synthesizer, tenant: args.tenant ?? null, createdBy: args['created-by'] ?? callerName(), priority: Number(args.priority) || 0, idempotencyKey: args['idempotency-key'] ?? null }), true);
+      const made = withBoard((b) => engine.swarm(b, { goal: rest.join(' '), workers, verifier: args.verifier, synthesizer: args.synthesizer, tenant: args.tenant ?? null, createdBy: args['created-by'] ?? null, priority: Number(args.priority) || 0, idempotencyKey: args['idempotency-key'] ?? null }), true);
       say(args, `Swarm root: ${made.root_id}\nWorkers: ${(made.worker_ids ?? []).join(', ')}\nVerifier: ${made.verifier_id}\nSynthesizer: ${made.synthesizer_id}`, made);
       return 0;
     }
@@ -349,6 +420,8 @@ export async function runWorkflow(argv) {
       const cards = withBoard((b) => {
         let rows = engine.listCards(b.db, { status: args.status, assignee, machine: args.machine, includeArchived: args.archived || args.all });
         if (args.tenant) rows = rows.filter((t) => t.tenant === args.tenant);
+        // a saved view (C4) is the Org's cards that carry its tag
+        for (const tag of [...(viewTag ? [viewTag] : []), ...(args.tag ?? [])]) rows = rows.filter((t) => tagsOf(t).includes(tag));
         if (args.session) rows = rows.filter((t) => t.session_id === args.session);
         if (args['workflow-template-id']) rows = rows.filter((t) => t.workflow_template_id === args['workflow-template-id']);
         if (args['step-key']) rows = rows.filter((t) => t.current_step_key === args['step-key']);
@@ -404,7 +477,7 @@ export async function runWorkflow(argv) {
         say(args, '', { task: cardDict(t), latest_summary: latest, parents: card.parents.map((p) => p.id), children: card.children, subtasks: card.subtasks, comments: card.comments, events: card.events, runs: card.runs, time: card.time, subscriptions: card.subscriptions, diagnostics: card.diagnostics });
         return 0;
       }
-      const out = [`Task ${t.id}: ${t.title}`, `  status:    ${card.stage}${card.stage !== t.status ? ` (${t.status} in kanban.db)` : ''}`, `  assignee:  ${t.assignee || '-'}`];
+      const out = [`Task ${t.id}: ${t.title}`, `  status:    ${taskStatusOf(card.stage, t.completed_at)} (lane ${card.stage}${card.stage !== t.status ? `, ${t.status} in kanban.db` : ''})`, `  assignee:  ${t.assignee || '-'}`];
       if (t.machine) out.push(`  machine:   ${t.machine}`);
       // where the card's time went: each role's runs, and the rest waiting
       const mins = (sec) => `${Math.round(sec / 60)}m`;
@@ -418,6 +491,10 @@ export async function runWorkflow(argv) {
       if (t.model_override) out.push(`  model:     ${t.model_override}${t.provider_override ? ` (provider: ${t.provider_override})` : ''}`);
       out.push(`  max-retries: ${t.max_retries ?? settings.failureLimit} (${t.max_retries !== null ? 'task' : 'board'})`);
       out.push(`  created:   ${ts(t.created_at)} by ${t.created_by || '-'}`);
+      const own = withBoard((b) => engine.getTask(b.db, t.id));
+      if (own?.tags?.length) out.push(`  tags:      ${own.tags.join(', ')}`);
+      if (own?.sponsor) out.push(`  sponsor:   ${own.sponsor}${own.sponsor_evidence?.observation ? ` (requested by ${own.sponsor_evidence.observation}, proven)` : ''}`);
+      if (own?.requested_by_unverified) out.push(`  requested by (unverified): ${own.requested_by_unverified.label ?? own.requested_by_unverified.observation}`);
       if (card.diagnostics.length) {
         out.push('', `  Diagnostics (${card.diagnostics.length}):`);
         for (const d of card.diagnostics) { out.push(`    ${{ warning: '⚠', error: '!!', critical: '!!!' }[d.severity]} [${d.severity}] ${d.title}`); for (const a of d.actions.slice(0, 1)) out.push(`       → ${a}`); }
@@ -456,13 +533,30 @@ export async function runWorkflow(argv) {
       return 0;
     }
 
+    // G3: usage from each run's own harness records, summed on agents and on their sponsors
+    case 'usage': {
+      const byAgent = agentUsage(root), context = process.env.SUPERCODE_CONTEXT;
+      const sponsorOf = (agent) => { try { return agentDoor('get', [agent], { context }).data.sponsor ?? null; } catch { for (const row of activeAgentAssignments(root).filter((a) => a.agent_id === agent)) { const local = localAgentRecord(root, row.org, agent); if (local) return local.identity.sponsor ?? null; } return null; } };
+      const sum = (records) => { const out = {}; for (const u of records) { const m = out[u.model] ??= { input_tokens: 0, output_tokens: 0, cache_read_tokens: 0, cache_write_tokens: 0, cost: 0 }; m.input_tokens += u.input_tokens ?? 0; m.output_tokens += u.output_tokens ?? 0; m.cache_read_tokens += u.cache_read_tokens ?? 0; m.cache_write_tokens += u.cache_write_tokens ?? 0; m.cost += u.cost?.amount ?? 0; if (u.cost?.amount != null) { m.cost_recorded = true; m.currency = u.cost.currency ?? m.currency ?? null; } else m.cost_unrecorded = true; } return out; };
+      // a harness that keeps no price records tokens only: its cost reads as unrecorded, never as zero
+      const line = (byModel) => Object.entries(byModel).map(([m, t]) => `${m} in ${t.input_tokens} out ${t.output_tokens} cache read ${t.cache_read_tokens} write ${t.cache_write_tokens} cost ${t.cost_recorded ? `${t.cost.toFixed(4)} ${t.currency ?? ''}${t.cost_unrecorded ? ' (some sessions unrecorded)' : ''}`.trim() : 'unrecorded'}`).join('; ');
+      const agents = [...byAgent.keys()].filter((a) => !args.agent || a === args.agent);
+      const rows = agents.map((agent) => ({ agent, sponsor: args.sponsor || !args.agent ? sponsorOf(agent) : undefined, sessions: new Set(byAgent.get(agent).map((u) => u.session)).size, by_model: sum(byAgent.get(agent)) }))
+        .filter((row) => !args.sponsor || row.sponsor === args.sponsor);
+      const total = sum(rows.flatMap((row) => byAgent.get(row.agent)));
+      const sponsors = [...new Set(rows.map((row) => row.sponsor).filter(Boolean))].map((sponsor) => ({ sponsor, agents: rows.filter((row) => row.sponsor === sponsor).length, by_model: sum(rows.filter((row) => row.sponsor === sponsor).flatMap((row) => byAgent.get(row.agent))) }));
+      say(args, rows.length ? [...rows.map((r) => `${r.agent}${r.sponsor ? ` (sponsor ${r.sponsor})` : ''}: ${r.sessions} session(s) ${line(r.by_model)}`),
+        ...sponsors.map((s) => `sponsor ${s.sponsor}: ${s.agents} agent(s) ${line(s.by_model)}`), `total: ${line(total)}`].join('\n') : '(no recorded usage)', { agents: rows, sponsors, total, ...(args.sponsor ? { sponsor: args.sponsor } : {}) });
+      return 0;
+    }
+
     case 'context': need(1, 'a card id'); process.stdout.write(`${withBoard((b) => view(b, (db) => engine.cardContext(db, id)))}\n`); return 0;
 
     case 'runs': {
       need(1, 'a card id');
       const got = withBoard((b) => engine.runs(b.db, id, { stateType: args['state-type'] ?? null, stateName: args['state-name'] ?? null }));
       if (args.json) { say(args, '', got); return 0; }
-      process.stdout.write(got.length ? `${got.map((r) => `#${r.id}  ${(r.outcome || r.status).padEnd(14)} @${r.profile || '-'}  ${ts(r.started_at)}${r.ended_at ? ` → ${ts(r.ended_at)}` : ' (active)'}${r.metadata?.supercode?.address ? `  ${r.metadata.supercode.address}` : ''}${r.summary ? `\n     → ${r.summary.split('\n')[0].slice(0, 160)}` : ''}`).join('\n')}\n` : `(no runs for ${id})\n`);
+      process.stdout.write(got.length ? `${got.map((r) => `#${r.id}  ${(r.outcome || r.status).padEnd(14)} @${r.profile || '-'}  ${ts(r.started_at)}${r.ended_at ? ` → ${ts(r.ended_at)}` : ' (active)'}${r.metadata?.supercode?.address ? `  ${r.metadata.supercode.address}` : ''}${r.metadata?.supercode?.counted === false ? `  not counted: profile differs (${r.metadata.supercode.agent_profile_mismatch.differences.map((d) => d.field).join(', ')})` : ''}${r.summary ? `\n     → ${r.summary.split('\n')[0].slice(0, 160)}` : ''}`).join('\n')}\n` : `(no runs for ${id})\n`);
       return 0;
     }
 
@@ -477,7 +571,20 @@ export async function runWorkflow(argv) {
       say(args, cards.map((t) => `${t}: ${rest[1]} ${value ?? '(none)'}`).join('\n'), { ok: true }); return 0;
     }
     case 'set-model': need(1, 'a card id'); await withBoardAsync((b) => engine.set(b, id, 'model', rest[1] ?? null, { provider: args.provider ?? null })); say(args, rest[1] ? `${id} runs on model ${rest[1]}${args.provider ? ` (${args.provider})` : ''} from its next start` : `${id} uses its profile's model`, { ok: true }); return 0;
-    case 'assign': case 'reassign': need(2, 'a card id and a profile (or none)'); await withBoardAsync((b) => engine.set(b, id, 'assignee', rest[1] === 'none' ? null : rest[1])); say(args, `Assigned ${id} to ${rest[1] === 'none' ? '(nobody)' : rest[1]}`, { ok: true }); return 0;
+    case 'assign': case 'reassign': if (args.agent) {
+      // C7: a card role's assignment moves to another agent; the sessions it ran keep their identity
+      need(1, 'a card id');
+      const context=process.env.SUPERCODE_CONTEXT,scope=agentDoor('scope',[],{context});
+      const task=withBoard(b=>engine.getTask(b.db,id));
+      if(!task)throw new Error(`no card ${id}`);
+      withBoard(b=>{if(!rolesFor(b.db,id,sid,workflowFor(root).params).includes('manager'))throw new Error('Only the manager moves a card assignment between agents.');});
+      const role=args.role??'implementer';
+      const assignment=activeAgentAssignments(root).find(item=>item.org===scope.org&&item.kind==='card'&&item.target===id&&item.role===role);
+      if(!assignment)throw new Error('declare the card role before reassigning its assignment');
+      const changed=reassignAgent(root,scope.org,assignment.id,args.agent,{context});
+      withBoard(b=>tx(b,db=>event(db,id,'agent_assignment_reassigned',{assignment:assignment.id,role,from:assignment.agent_id,to:changed.agent_id})));
+      say(args,`Reassigned ${id}/${role} to agent ${changed.agent_id}; sessions keep their identity`,{ok:true,assignment:changed});return 0;
+    } need(2, 'a card id and a profile (or none)'); await withBoardAsync((b) => engine.set(b, id, 'assignee', rest[1] === 'none' ? null : rest[1])); say(args, `Assigned ${id} to ${rest[1] === 'none' ? '(nobody)' : rest[1]}`, { ok: true }); return 0;
     case 'set-goal': {
       // a card into goal mode (or out of it with --off) from its next idle turn: the heartbeat keeps its session going
       need(1, 'a card id');
@@ -509,6 +616,23 @@ export async function runWorkflow(argv) {
     case 'link': need(2, 'a parent and a child'); await withBoardAsync((b) => engine.link(b, rest[0], rest[1])); say(args, `Linked ${rest[0]} -> ${rest[1]}`, { ok: true }); return 0;
     case 'unlink': { need(2, 'a parent and a child'); const gone = await withBoardAsync((b) => engine.unlink(b, rest[0], rest[1])); say(args, gone ? `Unlinked ${rest[0]} -> ${rest[1]}` : `no link ${rest[0]} -> ${rest[1]}`, { ok: gone }); return gone ? 0 : 1; }
 
+    // C4: a card's ordered tags; Hermes's tenant follows the first, and a board view selects by tag
+    case 'tag': case 'untag': {
+      need(2, 'a card id and a tag');
+      const tags = withBoard((b) => tx(b, (db) => {
+        const card = engine.getTask(db, id);
+        if (!card) throw new Error(`no card ${id}`);
+        const given = rest.slice(1).map((t) => t.trim()).filter(Boolean);
+        const next = verb === 'tag' ? [...new Set([...tagsOf(card), ...given])] : tagsOf(card).filter((t) => !given.includes(t));
+        db.prepare('INSERT INTO supercode_cards (task_id, tags) VALUES (?, ?) ON CONFLICT(task_id) DO UPDATE SET tags = excluded.tags').run(id, JSON.stringify(next));
+        db.prepare('UPDATE tasks SET tenant = ? WHERE id = ?').run(next[0] ?? null, id);
+        event(db, id, verb === 'tag' ? 'tagged' : 'untagged', { tags: given, now: next });
+        return next;
+      }));
+      say(args, `${id} tags: ${tags.join(', ') || '(none)'}`, { id, tags });
+      return 0;
+    }
+
     case 'comment': {
       need(2, 'a card id and the text');
       let text = rest.slice(1).join(' ');
@@ -596,7 +720,7 @@ export async function runWorkflow(argv) {
     case 'reopen-review': {
       need(1, 'a card id');
       const results = [];
-      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.reopenReview(b, t))).to]);
+      for (const t of ids()) results.push([t, (await withBoardAsync((b) => engine.reopenReview(b, t, { reason: args.reason ?? null }))).to]);
       say(args, results.map(([t, s]) => `Reopened ${t} → ${s}`).join('\n'), { ok: true, results }); return 0;
     }
     case 'promote': {
@@ -656,7 +780,7 @@ export async function runWorkflow(argv) {
 
     case 'diagnostics': case 'diag': {
       const { settings } = await laneState(root).catch(() => ({ settings: boardSettings({}) }));
-      const fleet = observeFleet();
+      const fleet = observeFleet(root);
       const order = ['warning', 'error', 'critical'];
       const found = withBoard((b) => {
         const cards = args.task ? [engine.getTask(b.db, args.task)].filter(Boolean) : engine.listCards(b.db, {});
@@ -917,11 +1041,13 @@ async function boardsVerb(root, rest, args) {
       return 0;
     }
     case 'create': case 'new': {
+      // C4: a new board is a saved view over the Org's one store, selecting the cards tagged with its slug
       const slug = normalSlug(target);
-      const meta = writeMeta(root, slug, { name: args.name, description: args.description, icon: args.icon, color: args.color, default_workdir: args['default-workdir'] });
-      openBoard(root, slug, { create: true, document: args.document ?? null, backing: args.backing ?? null }).close();
+      if (slug === DEFAULT_BOARD) throw new Error("'default' is the Org's store itself");
+      if (args.backing || args.document) throw new Error('a board is a saved view over the Org\'s one task store; its backing is the store\'s (`init --backing`)');
+      const meta = writeMeta(root, slug, { name: args.name, description: args.description, icon: args.icon, color: args.color, default_workdir: args['default-workdir'], view: { tags: [slug] } });
       if (args.switch) { mkdirSync(join(root, 'kanban'), { recursive: true }); writeFileSync(currentFile(root), `${slug}\n`); }
-      say(args, `Board '${slug}' ready.\n  Display name: ${meta.name}\n  DB path:      ${meta.db_path}${args.switch ? `\n  Switched to '${slug}'.` : ''}`, meta);
+      say(args, `Board '${slug}' ready: a view of the Org's cards tagged ${slug}.\n  Display name: ${meta.name}${args.switch ? `\n  Switched to '${slug}'.` : ''}`, meta);
       return 0;
     }
     case 'rm': case 'remove': case 'delete': {
@@ -940,7 +1066,7 @@ async function boardsVerb(root, rest, args) {
     }
     case 'switch': case 'use': {
       const slug = normalSlug(target);
-      if (slug !== DEFAULT_BOARD && !boardExists(root, slug)) throw new Error(`board '${slug}' does not exist; \`supercode workflow boards create ${slug}\``);
+      if (slug !== DEFAULT_BOARD && !boardExists(root, slug) && !isView(root, slug)) throw new Error(`board '${slug}' does not exist; \`supercode workflow boards create ${slug}\``);
       mkdirSync(join(root, 'kanban'), { recursive: true });
       writeFileSync(currentFile(root), `${slug}\n`);
       say(args, `Active board is now '${slug}'.`, { ok: true, board: slug });
@@ -1117,12 +1243,11 @@ function ownCard(db, sessionId) {
 const READS = new Set(['list', 'ls', 'show', 'context', 'runs', 'log', 'tail', 'watch', 'stats', 'assignees', 'diagnostics', 'diag', 'attachments', 'notify-list', 'capacity', 'help', 'init']);
 
 /**
- * Who a caller is on card `cardId`, in the workflow's roles: a caller with no session behind it has no role (the
- * manager acts from its own session, named in params.managers); the session of the card's current run has that run's role; the card's working session between runs
+ * Who a caller is on card `cardId`, in the workflow's roles: a signed-in terminal person retains their creator role;
+ * the manager acts from its named session; the session of the card's current run has that run's role; the card's working session between runs
  * is its `implementer`; the session working a subtask's arc is `arc`; its recorded creator also has the creator role; any other session is nobody on it.
  */
 function rolesFor(db, cardId, sessionId, params = {}) {
-  if (!sessionId) return [];
   // a session the workflow names as the board's manager (params.managers: its addresses) is the manager on every card
   const managers = Array.isArray(params.managers) ? params.managers.map(String) : [];
   if (managers.some((m) => m === sessionId || m.endsWith(`:${sessionId}`))) return ['manager'];
@@ -1130,7 +1255,8 @@ function rolesFor(db, cardId, sessionId, params = {}) {
   if (!task) return [];
   const roles = [];
   const creator = completionOwnerOf(db, cardId);
-  if (creator && creator === actorOf()) roles.push('creator');
+  if (creator && isCaller(creator)) roles.push('creator');
+  if (!sessionId) return roles;
   const current = task.current_run_id ? json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(task.current_run_id)?.metadata, {})?.supercode : null;
   if (current?.session_id === sessionId) roles.push(current.role ?? 'implementer');
   else if (engine.lastSession(db, cardId)?.session_id === sessionId) roles.push('implementer');
@@ -1151,7 +1277,8 @@ function authorize(db, verb, rest, args, own) {
   if (verb === 'boards') { if (!['list', 'ls', 'show', 'current', undefined].includes(rest[0])) refuse('does not change the home\'s boards'); return; }
   // verbs that act on the board rather than on a card are the manager's and the board's, never a card's session's
   // (what a session may do to a card is its workflow's: each transition's `by`)
-  if ((['pause', 'resume'].includes(verb) && !rest[0]) || ['swarm', 'dispatch', 'daemon', 'serve', 'gc', 'repair', 'adopt', 'close', 'set', 'claim', 'attach-rm', 'migrate'].includes(verb)) refuse(`does not ${verb}; the fleet's manager does`);
+  if ((['pause', 'resume'].includes(verb) && !rest[0]) || ['swarm', 'dispatch', 'daemon', 'serve', 'gc', 'repair', 'adopt', 'close', 'claim', 'attach-rm', 'migrate'].includes(verb)) refuse(`does not ${verb}; the fleet's manager does`);
+  if (verb === 'set' && !(rest[0] === own.id && rest[1] === 'every')) refuse("sets only Every on its own auditor card; other properties are the manager's");
   if (args.all) refuse(`does not ${verb} every card; only its own`);
   if (['notify-subscribe', 'notify-unsubscribe'].includes(verb) && args['for-card']) {
     if (args['for-card'] !== own.id) refuse(`subscribes only its own arc (--for-card ${own.id})`);
@@ -1161,7 +1288,7 @@ function authorize(db, verb, rest, args, own) {
   for (const target of targets) {
     const card = engine.getTask(db, target);
     if (!card) continue;
-    if (completionOwnerOf(db, card.id) === actorOf()) continue;
+    if (isCaller(completionOwnerOf(db, card.id))) continue;
     if (verb === 'comment' && isLatestReviewer(db, card.id, actorOf())) continue;
     if (card.id !== own.id && card.subtask_of !== own.id) refuse(`writes only its own card and its subtasks, not ${card.id}`);
   }