@volter/supercode-orchestrator 0.5.204 → 0.5.206

package/README.md

@@ -4,6 +4,21 @@ This is currently a private workspace package. Examples assume the checkout's
 workspace dependencies and a built Volter Harness CLI; the package name is not a claim
 that an installable npm release exists.
 
+Verified worker binding replaces superseded worker notice subscriptions across
+an arc and its subtasks. Native notices wait with their event cursor intact when
+liveness is unread; agent and board mailboxes keep their independent routes.
+Read the [worker-notice contract](../../docs/reference/board-worker-notices.md)
+and [retained subscription evidence](../../docs/evidence/board-worker-notices-2026-10-09.md)
+for source behavior and the remaining native/publication qualification.
+
+`supercode workflow claim <card>` opens a manual run and commits the declared
+`running` workflow stage with its claim. Readiness is checked against the
+workflow stage; the home must declare `running`. Creating with
+`--initial-status running` uses the same path. Subsequent `block` follows that
+stage's own transition, which ends the run in the default workflow. See the
+[private manual reading](../../docs/evidence/board-manual-claim-2026-10-09.md)
+for scope and limits; existing inconsistent claims are not repaired automatically.
+
 The orchestrator's runtime over the ontology: one typed operational model
 (`OrchestratorState` = an orchestration value plus a runtime half) whose folder is its serialization.
 `docs/ORCHESTRATOR-IR.md` is normative. The orchestration value and every codec are the ontology's, in
@@ -42,6 +57,48 @@ Rules the codec keeps (enforced in Rust, observed here):
   since import (UNI-22); it copies the store byte for byte when they did not.
 - Files the IR does not model are never touched by `save` and are carried by path on a migration.
 
+## Board machine-call deadlines
+
+The board owner's machine calls share one timeout budget across channel admission,
+node or harness admission, and the method request. A call whose admission expires
+never sends the method after its caller has stopped waiting. It leaves the owner's
+shared channel and clients available to other callers. Once a method request has
+started, a timeout reports that whether it ran is unknown.
+
+Timing steps name each admission phase and the request. The SDK request receives
+the remaining budget and cancellation signal; node requests receive the remaining
+budget, with their existing request/reply cleanup. The workflow caller also records
+session lookup, request preparation and the wait for the owner's answer, including
+an owner call that ends by throwing. These steps contain durations, not request bodies.
+These bounds do not establish
+subsecond board verbs or identify the cause of a historical slow call. The retained
+readings and limits are in
+[board call admission evidence](../../docs/evidence/board-call-admission-2026-10-10.md).
+
+## Read a card's attachment
+
+List a card's recorded uploads, then download one onto the calling machine:
+
+```sh
+supercode workflow attachments <card> --at sc:<host>:board:<name> --json
+supercode workflow attachment-get <card> <attachment-id> --at sc:<host>:board:<name> --out ./artifact.png
+```
+
+The npm front door serves `attachment-get`. Without `--at`, use `--root <home>`
+and optionally `--board <slug>`. `--out` names a local file; its parent directory
+must exist. A completed download replaces that file. An interrupted download
+retains a separate partial file and reports its path; there is no automatic resume.
+The board host needs an orchestrator that serves `attachment-read` and its normal
+running board owner. Remote reads keep the board door's caller and grant checks.
+
+`workflow attachment-read <card> <attachment-id>` returns JSON with at most 1 MiB
+of `content_base64`, metadata, offsets, `eof` and a filesystem metadata `version`.
+Subsequent reads pass `--offset`, `--length` and the first response's `--version`.
+It accepts a recorded attachment id rather than an arbitrary host path. Version
+checking detects metadata changes; it is not a content digest or writer attestation.
+The worker's existing `kanban_attachments` MCP tool lists uploads as before;
+adding `attachment_id`, and optionally `offset`, `length` and `version`, reads a
+range under the same worker scope. The maximum `length` is 1,048,576 bytes.
 ## Board GitHub REST receipts
 
 `supercode workflow github-usage --since 1h --json` reads this user's local
@@ -140,7 +197,7 @@ Tiers on the way out:
   too, rather than written as its own reference.
 
 Secrets never enter the model: any string under a credential-shaped key — openclaw's own rule
-(`channels.rs::is_credential_key`: the lower-cased key ENDS WITH `token|key|secret|password|
+(`orchestration/codec/openclaw.rs::is_credential_key`: the lower-cased key ENDS WITH `token|key|secret|password|
 credential`), minus the names it spells that way for non-secrets (`sessionKey`, `store_key`, …) —
 moves to the vault as a `{dotenv}` ref and is re-inlined on export where openclaw reads it.
 
@@ -169,6 +226,12 @@ await orch.dispatch(events.tick(now));   // the clock is an event too
 adapters (`deliver`). A worker runs with the profile folder as cwd and the profile's harness home
 inside it (`activationEnv`), so its AGENTS.md is in context by the ordinary instruction-file walk.
 
+The board's held profile view follows root/profile `AGENTS.md` changes, including
+linked targets, and reloads on its next call. The current call retains its basis.
+This file refresh does not replace instructions in a running native session;
+[c60's source record](../../docs/evidence/persona-file-invalidation-2026-10-10.md)
+keeps running-main delivery and readback open.
+
 ## Cron and webhooks (ORC-5)
 
 ```js
@@ -308,6 +371,29 @@ Tools, one per verb, names and argument shapes transcribed from Hermes's `tools/
 `supercode mcp serve` (the coding tools) is a different server for a different purpose and is
 untouched.
 
+## Board model selection and native refusals
+
+Board pane lanes take the card's model override, then `worker.model`, then the
+profile's `model.default` when the harness accepts a native model flag. With no
+declared model the harness retains its own default. For a fresh Claude launch,
+the dispatcher reads the native first assistant outcome through the session door:
+an API error fails the run even if the terminal is still alive. The workflow's
+existing incident policy decides the card state and recovery; a monitor board
+retains the failed run and holds dispatch without closing its pane. This requires
+the matching TypeScript session reader and is not resumed-turn or general
+completion monitoring. See the [owned Mac reading](../../docs/evidence/board-claude-model-first-response-2026-10-09.md).
+
+## Board reviewer selection
+
+The workflow can select a reviewer from the latest coding run's harness, while
+retaining a card's or request's explicit profile. Review-machine choices stay in
+workflow parameters. Default same-harness review retains the coding model; an
+explicit reviewer uses its profile's model. The review request records the
+implementer's machine and model/provider overrides for a return with changes.
+See [the configuration contract](../../docs/reference/board-reviewers.md) and
+[source qualification](../../docs/evidence/board-reviewer-selection-2026-10-09.md).
+A custom home needs its own workflow update; this source does not rewrite it.
+
 ## Acceptance (ORC-8)
 
 The bar of `docs/ORCHESTRATOR-IR.md` §8 — one scripted week of realistic use replayed against
@@ -358,11 +444,12 @@ it as unsupported. Native Hermes channel configuration remains the worker's conf
 
 A mail agent the RH2 organization declares is one participant there, as its own agent principal: an admin issues that
 agent a token at RH2's agent-token door, and the home keeps it for the agent's channel, which then joins its Room's
-conversation answering every line:
+conversation answering every line. The record names the one agent it is (`--agent`, its Teams id): it is mounted in
+that agent's own sessions as the `rh2-agent` MCP server, and never in another agent's that shares its name or profile:
 
 ```sh
 supercode orchestrator apps install rh2-agent --origin https://pilot.runhuman.com --organization volter \
-  --principal prn_… --token-file ./account-manager.token --profile account-manager
+  --principal prn_… --agent agent_… --token-file ./account-manager.token --profile account-manager
 supercode orchestrator apps remove rh2-agent.account-manager
 ```
 
@@ -490,6 +577,30 @@ mark without the notice — nobody is reading them.
 The repo's Hermes fixture home (`crates/harness/fixtures/hermes_home`) is a ready home to drive it
 against by hand; that needs `target/debug/supercode` built.
 
+## Board session cleanup
+
+A manager or creator changing a card's assignee can release its ended worker
+from a `needs_input` dialog. The board requires its retained reassignment and
+release, a fresh reading of the exact harness/session, and an unexpired close
+claim. It closes the pane through the owning board's door and retains the
+reading; it sends no dialog key or approval response. Working turns, adopted sessions and panes held by an active successor keep
+their existing protection. Unknown activity retains main’s native-record quiet
+watch; this exception requires a positive needs_input reading for the exact
+launched worker. The candidate's [source and package record](../../docs/evidence/board-reassignment-input-dialog-2026-10-10.md)
+leaves native closing and replacement-launch qualification open.
+
+## Remote card text
+
+The npm front door's `workflow … --at sc:<machine>:board:<name>` uses
+`prepareBoardText(argv)` from `@volter/supercode-orchestrator/board-input` before calling
+the machine's board door. It returns `{ argv, stdin }`: the board parser selects a
+comment's `--file` or a create/specify verb's `--body-file`, reads that file on the
+caller (`-` reads standard input), and appends the selected file flag with `-`.
+The last flag value wins, preserving the other arguments. Other verbs and help
+do not read a text file. The helper opens no transport and makes no card write;
+the daemon carries the input to the board owner under the caller's existing grants
+and card permissions. See the [Teams guide](../../docs/guides/teams.md#call-a-board-on-another-machine).
+
 ## The operator door (ORC-13)
 
 The orchestrator's WRITE door — what `supercode jobs|profiles|sessions <verb> --harness orchestrator`
@@ -510,7 +621,9 @@ out  {"ok":true,"result":{"ran":"created cron job job_… …","job_id":"…","j
 ```
 
 `op` is one of `jobs.create|update|pause|resume|run|delete`, `profiles.create|delete`,
-`sessions.new|reset`, `access.pair_approve`. The verb dispatches its `events.operator(...)` on the
+`sessions.new|reset`, `sessions.launch|launch_status|launch_close` (live only: a concurrent session of the profile's
+agent started on request, under a launch key; `supercode agent launch` drives them; a launch's refusal is answered
+`{ok:false, error, code}` with `code` `conflict`, `budget` or `invalid_request`), `access.pair_approve`. The verb dispatches its `events.operator(...)` on the
 **loop's own queue**, so an operator write is ordered against inbound messages and ticks like
 anything else and the running loop's state and the folder can never disagree. `result` re-reads the
 affected record out of state after the reducer ran.
@@ -579,3 +692,24 @@ root/executor is refused; the lease is retained until shutdown completes. The
 helper does not clear a live lease or escalate to SIGKILL. Embedders can stop their
 owned clock before disabling the integration and start it again on the next boot.
 Hosted HTTP refusal messages preserve the executor's bounded JSON error reason.
+
+Review source metadata admits four active GitHub reads and 64 waiting owners,
+using four ordered source workers and a shared stored-token lookup. A source
+verification reuses its one PR observation, retaining head and authority
+checks; failed fetches retain their cause and available native code.
+[The source record](../../docs/evidence/board-review-metadata-admission-2026-10-12.md)
+states the current handoff and adoption limits.
+
+## Board session custody
+
+The candidate Node board CLI adds `supercode workflow detach <card> --to person:<id>`.
+It retains the native identity, records the person's custody and removes the
+dispatcher run, subscriptions and capacity counts without closing the session.
+Queued effects and later continuation cannot take it back; the existing `adopt`
+door must verify a live native session before the board owns it again.
+
+The [command contract](../../docs/reference/board-session-detach.md) describes
+authority, in-progress-operation refusals and already-issued-request boundaries.
+[Source observations](../../docs/evidence/board-session-detach-2026-10-09.md)
+cover actual help, compilation and read-only retained records. Live handback,
+return through adoption and released availability remain unqualified.

package/activation.mjs

@@ -2,9 +2,9 @@
 // The profile folder is a complete home; each harness's config home is a
 // subfolder named by its id, pointed at through the harness's own env var.
 
-import { join, relative, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { homedir } from 'node:os';
-import { mkdirSync, readFileSync, readdirSync, lstatSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import { mkdirSync, readFileSync, readdirSync, lstatSync, rmSync, writeFileSync, existsSync, statSync, realpathSync } from 'node:fs';
 import { CLAUDE_BRIDGE, linkTo, skillSources } from './hermes-home.mjs';
 import { ownLogin } from './worker-route.mjs';
 import { execFile } from 'node:child_process';
@@ -73,10 +73,101 @@ export function declareWorkerHome({ harness, env, cwd, log = () => {} }) {
   });
 }
 
+/**
+ * The folder a worker runs in, made one of this machine's Teams sync roots when none covers it, through the connector's
+ * own door: `supercode teams connect --context <context> --cwd <folder> --add-root --exact-folder`, the restricted rule a
+ * person's `--add-root` makes, on a root that covers that one folder and nothing under it (`exact_only`: the connector
+ * captures a session only when its recorded folder is that folder, after realpath). A worker's session is recorded in the
+ * folder it was started in, so the exact root captures it, and no subfolder is published by it. Whether a root covers
+ * the folder is the CLI's own rule (`teams roots --cwd`: rootCovers in roots.mjs, as `agent launch --status` reads it).
+ *
+ * A folder a root already covers (one a person connected by hand, wherever it is) is captured, and nothing more is done.
+ * Otherwise one folder is still every session recorded in it, so only a folder the orchestrator owns is connected: one
+ * strictly inside its home (`root`), after realpath, that is no profile's own folder. The home itself is refused
+ * (`default` with no `worker.cwd` runs there, and a person's own session started at the home's top level would be
+ * published with it), every folder outside the home (an absolute or `..` `worker.cwd`: a checkout or a parent a person
+ * works in), and every profile's folder (`profileDirs`: a profile with no `worker.cwd` runs there, where people edit
+ * the profile in sessions of their own). A refusal says which `worker.cwd` to set; a person may connect such a folder by
+ * hand.
+ *
+ * The context is the orchestrator's (`SUPERCODE_CONTEXT`), whose connector the root goes to. A launch into a folder
+ * outside every root ran, was never captured, and its launch read `starting` until the Workplace integration gave it up
+ * (volter-org/home/workspace, 2026-10-15). Once per folder per process, off the launch's path; a refusal (not the
+ * orchestrator's folder, no context, no installed connector) is said once and held REFUSAL_HOLD_MS before it is asked
+ * again.
+ */
+const coveredFolders = new Map();
+const REFUSAL_HOLD_MS = 5 * 60_000;
+export function declareWorkerFolder({ cwd, root, profile = null, profileDirs = [], context = process.env.SUPERCODE_CONTEXT, scope = null, log = () => {} }) {
+  let folder, home;
+  try { folder = realpathSync(cwd); home = realpathSync(root); } catch { return Promise.resolve(false); }
+  const held = coveredFolders.get(folder);
+  if (held && (held.until === undefined || Date.now() < held.until)) return held.answer;
+  const program = process.env.SUPERCODE_BIN || 'supercode';
+  const run = (args) => new Promise((done) => execFile(program, args, { timeout: 30_000 }, (error, stdout, stderr) => done({ error, stdout, stderr })));
+  const said = (answer) => String(answer.stderr ?? '').trim().split('\n')
+    .filter((line) => line && !/^\(node:\d+\) ExperimentalWarning: SQLite|^\(Use `node --trace-warnings/.test(line)).at(-1)
+    ?? (answer.error?.code != null ? `exited ${answer.error.code}` : 'failed');
+  const refused = (why) => { log('warn', `worker folder ${folder}: its sessions are not captured by Teams: ${why}`); return false; };
+  const entry = {};
+  entry.answer = (async () => {
+    if (!context) return refused('no Teams context names where to connect it (SUPERCODE_CONTEXT)');
+    if (scope?.offline) return refused(`context ${context} is not a Teams context`);
+    // a root that covers it already (one a person connected by hand, wherever the folder is) captures it: nothing to do
+    const roots = await run(['teams', 'roots', '--json', '--context', context, '--cwd', folder]);
+    let covering = null;
+    try { covering = JSON.parse(roots.stdout).data.covering; } catch { /* unread: the connect below says what holds it */ }
+    if (Array.isArray(covering) && covering.length) return true;
+    // connected on a person's behalf only when the folder is the orchestrator's own: strictly inside its home, and not
+    // a profile's own folder (where people edit the profile, its AGENTS.md, in sessions of their own)
+    const within = relative(home, folder);
+    const set = `set worker.cwd for ${profile ? `profile ${profile}` : 'its profile'} to a folder of its own (for example \`worker.cwd: workspace\`), or connect this folder yourself (\`supercode teams connect --cwd ${folder} --add-root --exact-folder\`)`;
+    if (within === '') return refused(`it is the orchestrator home itself, where people start their own sessions, and an exact root there would publish theirs too: ${set}`);
+    if (within === '..' || within.startsWith(`..${sep}`) || isAbsolute(within)) return refused(`it is outside the orchestrator home ${home}, a folder people may work in, and is never connected on their behalf: ${set}`);
+    const real = (dir) => { try { return realpathSync(dir); } catch { return null; } };
+    if (profileDirs.some((dir) => dir && real(dir) === folder)) return refused(`it is a profile's own folder, where people edit the profile in sessions of their own, and an exact root there would publish theirs too: ${set}`);
+    const connected = await run(['teams', 'connect', '--context', context, '--cwd', folder, '--add-root', '--exact-folder']);
+    if (connected.error) return refused(`it could not be connected: ${said(connected)}`);
+    log('info', `worker folder ${folder} connected to Teams as an exact-folder sync root (its sessions are captured from the connector's next heartbeat)`);
+    return true;
+  })();
+  coveredFolders.set(folder, entry);
+  // a refusal is held a few minutes, then asked again by the next start; a covered folder stays covered for the process
+  void entry.answer.then((covered) => { if (!covered) entry.until = Date.now() + REFUSAL_HOLD_MS; });
+  return entry.answer;
+}
+
 export function activationCwd(profile, workdir) {
   return resolve(profile.dir, workdir ?? profile.worker?.cwd ?? '.');
 }
 
+/**
+ * The folder a worker starts in, ready: `activationCwd`. A profile is a folder its worker runs in, or a subfolder of
+ * it (docs/architecture/orchestrator.md §0.3, `cwd: RelPath`, relative to the profile dir): a subfolder the profile names
+ * and lacks is the profile's own, and is made, empty. A folder outside the profile's (an absolute path, or one reached
+ * through `..`) is someone else's, and is never made here: a start refuses, naming it. Before this a missing cwd failed
+ * the start inside harness serve, and nothing kept why.
+ */
+export function workerCwd(profile, workdir) {
+  const cwd = activationCwd(profile, workdir);
+  if (existsSync(cwd)) {
+    if (!statSync(cwd).isDirectory()) throw new Error(`the worker's cwd ${cwd} (profile ${profile.name}) is not a folder`);
+    return cwd;
+  }
+  // Inside is judged where the folder would really be made: its deepest existing ancestor, symbolic links resolved,
+  // with the missing rest under it, against the profile's own folder resolved the same way. A link in the profile's
+  // folder to another (profile/repo -> a checkout) puts what is made under it in that other folder, never the profile's.
+  let ancestor = cwd;
+  while (!existsSync(ancestor) && dirname(ancestor) !== ancestor) ancestor = dirname(ancestor);
+  const target = join(realpathSync(ancestor), relative(ancestor, cwd));
+  const inside = relative(realpathSync(profile.dir), target);
+  if (!inside || inside === '..' || inside.startsWith(`..${sep}`) || isAbsolute(inside)) {
+    throw new Error(`the worker's cwd ${cwd} (worker.cwd ${JSON.stringify(workdir ?? profile.worker?.cwd ?? '.')} in profile ${profile.name}) does not exist; it is outside the profile's folder${target === cwd ? '' : ` (it would be made at ${target})`}, so it is not made here: create it, or name another`);
+  }
+  mkdirSync(target, { recursive: true });
+  return cwd;
+}
+
 /**
  * Where each harness reads a persona from any cwd, and in what form: its config home's own instruction
  * file. A worker often runs in a project checkout outside the home, where the project walk never reaches

package/adapters/rh2.mjs

@@ -49,7 +49,8 @@ export class Rh2Adapter {
     this.running = false;
     /** conversation id -> { roomId, after } */
     this.cursors = new Map();
-    /** room id -> { name, names: Map<principalId, displayName>, conversations: Map<id, name> } */
+    /** room id -> { name, names: Map<principalId, displayName>, conversations: Map<id, name>, seated: whether the Workplace
+     * delivers this Room's lines to this principal's own session } */
     this.rooms = new Map();
     /** message id -> the root of the thread it is in (its own id for a root). */
     this.threadOf = new Map();
@@ -158,6 +159,9 @@ export class Rh2Adapter {
       const room = view.room ?? {};
       if (room.state && room.state !== 'active') continue;
       const names = new Map((view.members ?? []).filter((m) => m.principalId).map((m) => [String(m.principalId), String(m.displayName ?? m.principalId)]));
+      // Where this principal's own seat carries a session, the Workplace delivers the Room's lines to that session itself
+      // (runhuman-2 ADR 0046 decision 4); this adapter then hands none of them on, so no line reaches it twice.
+      const seated = (view.members ?? []).some((m) => String(m.principalId) === this.principalId() && m.sessionBinding);
       const conversations = new Map();
       for (const conversation of view.conversations ?? []) {
         if (!conversation.conversationId || !(conversation.permissions ?? []).includes('conversation.read')) continue;
@@ -174,7 +178,7 @@ export class Rh2Adapter {
             : { roomId, after: 0, since: previous - CLOCK_SKEW_MS });
         }
       }
-      this.rooms.set(roomId, { name: String(room.name ?? roomId), names, conversations });
+      this.rooms.set(roomId, { name: String(room.name ?? roomId), names, conversations, seated });
     }
     for (const id of [...this.cursors.keys()]) if (!live.has(id)) this.cursors.delete(id);
   }
@@ -242,6 +246,7 @@ export class Rh2Adapter {
       if (this.threadOf.size > THREAD_MEMORY) this.threadOf.delete(this.threadOf.keys().next().value);
     }
     if (!isMe && conversation?.answers !== 'all' && !mentioned) return;
+    if (!isMe && room?.seated) return;
     const chatId = `${roomId}/${conversationId}`;
     // A person's line opens a turn: show typing here until the reply lands (the loop has no
     // typing effect by design — the adapter, which knows both ends of the turn, carries it).

package/agents.mjs

@@ -26,6 +26,9 @@ function store(root){
   CREATE TABLE IF NOT EXISTS agent_runtime_sessions(org TEXT NOT NULL,runtime_ref TEXT NOT NULL,session_ref TEXT NOT NULL,PRIMARY KEY(org,runtime_ref));
   CREATE TABLE IF NOT EXISTS agent_runs(org TEXT NOT NULL,agent_id TEXT NOT NULL,session_ref TEXT NOT NULL,machine TEXT,run_id TEXT,profile_json TEXT,ended_at INTEGER,end_reason TEXT,main INTEGER NOT NULL DEFAULT 1,starter_session TEXT,usage_json TEXT,PRIMARY KEY(org,session_ref));
   CREATE TABLE IF NOT EXISTS agent_usage_unread(org TEXT NOT NULL,session_ref TEXT NOT NULL,stamp TEXT NOT NULL,PRIMARY KEY(org,session_ref));`);
+  const columns=new Set(db.prepare('PRAGMA table_info(agent_runs)').all().map(row=>row.name));
+  if(!columns.has('conversation'))db.exec('ALTER TABLE agent_runs ADD COLUMN conversation INTEGER NOT NULL DEFAULT 0');
+  if(!columns.has('started_at'))db.exec('ALTER TABLE agent_runs ADD COLUMN started_at INTEGER NOT NULL DEFAULT 0');
   db.prepare('DELETE FROM agent_card_assignment_changes WHERE recorded=1').run();
   return db;
 }
@@ -222,6 +225,19 @@ export function localAgentRecord(root,org,id){
     sponsor:declaration.sponsor??null,profile:intent.profile_ref,state:'active',synced:!!intent.declared,main_session:null,revision:0},
     intended:intent.profile,assignments:intent.assignments,org,synced:!!intent.declared};
 }
+/** The id a home's mail agent runs as, read and never minted: its own declared identity (`agent/<name>`) where the home
+ * holds one, else its profile's (`profile/<profile>`), as localProfileAgent keys them, each at its current generation.
+ * Null when the home holds neither, or has no agent store. A channel names its agent by this id (agent-channel). */
+export function homeAgentId(root,{org,server,name,profile=name}){
+  if(!existsSync(join(root,'agent-state.sqlite')))return null;
+  const db=store(root);
+  try{
+    const at=(key)=>{const stable=`${server}/${org}/${key}`;
+      return db.prepare('SELECT agent_id FROM agent_declaration_heads WHERE org=? AND key=?').get(org,stable)?.agent_id
+        ??db.prepare('SELECT id FROM agent_intents WHERE org=? AND key=?').get(org,stable)?.id??null;};
+    return (name!==profile?at(`agent/${name}`):null)??at(`profile/${profile}`);
+  }finally{db.close();}
+}
 /** Earlier sessions this home ran for an agent, for a relaunch's pointers when Teams cannot list them. */
 export function localAgentSessions(root,org,id){
   const db=store(root);try{return db.prepare('SELECT session_ref AS session,machine,ended_at,end_reason FROM agent_runs WHERE org=? AND agent_id=? ORDER BY rowid DESC LIMIT 200').all(org,id);}finally{db.close();}
@@ -377,7 +393,7 @@ export function recordNativeAgentSession(root,runtimeRef,session) {
   const owner=agentRunForSession(root,[runtimeRef]);
   if(!owner||owner.session_ref===session)return owner;
   recordAgentRun(root,owner.org,owner.agent_id,{session,machine:owner.machine,run:owner.run_id,
-    profile:owner.profile_json?JSON.parse(owner.profile_json):null,main:owner.main===1,starterSession:owner.starter_session});
+    profile:owner.profile_json?JSON.parse(owner.profile_json):null,main:owner.main===1,starterSession:owner.starter_session,conversation:owner.conversation===1});
   const db=store(root);try{
     db.exec('BEGIN IMMEDIATE');
     db.prepare('INSERT INTO agent_runtime_sessions(org,runtime_ref,session_ref) VALUES (?,?,?) ON CONFLICT(org,runtime_ref) DO UPDATE SET session_ref=excluded.session_ref').run(owner.org,runtimeRef,session);
@@ -387,12 +403,13 @@ export function recordNativeAgentSession(root,runtimeRef,session) {
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
   return agentRunForSession(root,[runtimeRef]);
 }
-export function recordAgentRun(root,org,id,{session,machine=null,run,profile=null,main=true,starterSession=null}){
+export function recordAgentRun(root,org,id,{session,machine=null,run,profile=null,main=true,starterSession=null,conversation=false}){
   const db=store(root);try{
     db.exec('BEGIN IMMEDIATE');
     const old=db.prepare('SELECT agent_id FROM agent_runs WHERE org=? AND session_ref=?').get(org,session);
     if(old&&old.agent_id!==id)throw new Error('local session ownership cannot change agent identity');
     db.prepare('INSERT INTO agent_runs(org,agent_id,session_ref,machine,run_id,profile_json,main,starter_session) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(org,session_ref) DO UPDATE SET machine=excluded.machine,run_id=excluded.run_id,profile_json=COALESCE(excluded.profile_json,agent_runs.profile_json),main=excluded.main,starter_session=COALESCE(agent_runs.starter_session,excluded.starter_session) WHERE agent_runs.machine IS NOT excluded.machine OR agent_runs.run_id IS NOT excluded.run_id OR (excluded.profile_json IS NOT NULL AND agent_runs.profile_json IS NOT excluded.profile_json) OR agent_runs.main IS NOT excluded.main OR (agent_runs.starter_session IS NULL AND excluded.starter_session IS NOT NULL)').run(org,id,session,machine,String(run),profile?JSON.stringify(profile):null,main?1:0,starterSession);
+    db.prepare('UPDATE agent_runs SET conversation=?,started_at=CASE WHEN started_at=0 THEN ? ELSE started_at END WHERE org=? AND session_ref=?').run(conversation?1:0,Date.now(),org,session);
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
 }
@@ -470,3 +487,8 @@ export function agentEnvironment(agent,{root,context,session=null,main=true}={})
     SUPERCODE_AGENT_MAIN:main?'1':'0',SUPERCODE_AGENT_SYNCED:a.synced===false?'0':'1',SUPERCODE_AGENT_ASSIGNMENTS:JSON.stringify(agent.assignments??[]),
     ...(session?{SUPERCODE_AGENT_SESSION:session}:{})};
 }
+
+/** A standing profile's conversation runtime; scheduled/card runs never select its conversation. */
+export function localAgentConversation(root,org,id){
+  const db=store(root);try{return db.prepare('SELECT session_ref session,started_at,ended_at FROM agent_runs WHERE org=? AND agent_id=? AND conversation=1 ORDER BY (ended_at IS NULL) DESC,started_at DESC,rowid DESC LIMIT 1').get(org,id)??null;}finally{db.close();}
+}

package/apply/doors.mjs

@@ -18,11 +18,14 @@ import { existsSync, readFileSync } from 'node:fs';
 import { createConnection } from 'node:net';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { redactText } from '@volter/teams/redact';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const MARK = '@@supercode-apply@@';
 /** A door call's ceiling: Hermes's own functions answer in well under this. */
 const DOOR_TIMEOUT_MS = 60_000;
+// Redact the complete text before truncation: a length bound must not split a token before its detector sees it.
+const diagnostic = text => redactText(String(text ?? '')).slice(0, 2000);
 
 /** Hermes's schedule string for a declared schedule. */
 export function hermesSchedule(schedule) {
@@ -223,8 +226,28 @@ export async function orchestratorDoor({ root, profile = 'default', load, socket
   const op = async (name, args) => {
     const live = await viaSocket(socket ?? join(root, 'orchestrator.sock'), { op: name, args, profile });
     const answer = live ?? (() => {
-      const run = spawnSync(process.execPath, [bin, name, '--root', root, '--profile', profile, '--json', JSON.stringify(args)], { encoding: 'utf8', timeout: DOOR_TIMEOUT_MS });
-      return JSON.parse((run.stdout ?? '').trim().split('\n').pop() || '{"ok":false,"error":"the orchestrator answered nothing"}');
+      // The applier may be imported by Bun (the install's keeper). The operator CLI needs Node's runtime,
+      // including node:sqlite; a caller's executable is not necessarily the CLI's interpreter.
+      const node = process.env.SUPERCODE_NODE_BIN?.trim()
+        || (process.versions.bun || process.versions.deno ? 'node' : process.execPath);
+      const run = spawnSync(node, [bin, name, '--root', root, '--profile', profile, '--json', JSON.stringify(args)], { encoding: 'utf8', timeout: DOOR_TIMEOUT_MS });
+      let parsed;
+      try { parsed = JSON.parse((run.stdout ?? '').trim().split('\n').pop()); } catch { /* retained below */ }
+      if (run.error || run.signal || run.status !== 0 || typeof parsed?.ok !== 'boolean' || !parsed.ok) {
+        const details = [
+          run.error?.message && `spawn: ${diagnostic(run.error.message)}`,
+          run.signal && `signal ${run.signal}`,
+          parsed?.error && `refusal: ${diagnostic(typeof parsed.error === 'string' ? parsed.error : JSON.stringify(parsed.error))}`,
+          typeof parsed?.ok !== 'boolean' && 'no readable operator response',
+          typeof parsed?.ok !== 'boolean' && run.stdout?.trim() && `stdout: ${diagnostic(run.stdout)}`,
+          run.stderr?.trim() && `stderr: ${diagnostic(run.stderr)}`,
+        ].filter(Boolean).join('; ');
+        throw Object.assign(new Error(`${name} via cold Node ${diagnostic(node)} failed (exit ${run.status ?? 'unknown'}): ${details}`), {
+          code: run.error?.code ?? (run.status || (parsed?.ok === false ? 'OPERATOR_REFUSED' : 'BAD_OPERATOR_RESPONSE')),
+          exitCode: run.status, signal: run.signal,
+        });
+      }
+      return parsed;
     })();
     if (!answer.ok) throw new Error(answer.error);
     return answer.result;

package/bin/agent-channel.mjs

@@ -17,17 +17,20 @@
 // instead and opens nothing.
 //
 // RH2 is reached as the agent's own principal where the organization declares the agent (docs/adr/0017: `supercode
-// orchestrator apps install rh2-agent … --profile <agent>` in the home, `--root` or HERMES_HOME), so its threads, its DM
-// and its call are one participant; otherwise through the Room-chat app's installation for this agent (`apps install
-// room-chat … --profile <agent>`). The record's origin, organization, principal and token are the agent's identity in
-// the Room. The bridge's thread anchors are kept in `--state`.
+// orchestrator apps install rh2-agent … --agent <its Teams id>` in the home, `--root` or HERMES_HOME), the record bound to
+// the agent this channel names with `--agent-id`, else to the id the home holds for that agent (homeAgentId: its declared
+// identity, else its profile's by the home's agent layer `agents.json`), so its threads and its call are one participant
+// and no other agent's record is taken; otherwise through the Room-chat app's installation for this agent (`apps install
+// room-chat … --profile <agent>`). The record's origin, organization, principal and token are the agent's identity in the
+// Room. The bridge's thread anchors are kept in `--state`.
 //
-// The agent's DM in its Room is its main session (RFC 0020 decision 26): where this machine is in a Teams team, the
-// participant's seat is bound to the main session (`supercode sessions bind`, the session owner's view binding for the
-// Room's DM with that participant), and rebound to each new main session, as the Agents → Room agents app binds an
-// arc's agent. Until the main session is in the team's catalog the binding is retried.
+// The agent's seat in its Room carries its main session (RFC 0020 decision 26): where this machine is in a Teams team,
+// the seat is bound to the main session (`supercode sessions bind`, the session owner's view binding for the seat), and
+// rebound to each new main session, as the Agents → Room agents app binds an arc's agent. Until the main session is in
+// the team's catalog the binding is retried.
 import { parseArgs } from 'node:util';
 import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
@@ -35,14 +38,15 @@ import { Rh2Adapter } from '../adapters/rh2.mjs';
 import { AgentMailboxBridge } from '../adapters/agent-mailbox.mjs';
 import { JiraCommentsAdapter } from '../adapters/jira-comments.mjs';
 import { ChatSdkAdapter } from '../adapters/chat-sdk.mjs';
-import { installedApps } from '../installed-apps.mjs';
+import { installedAgentRecord, installedApps } from '../installed-apps.mjs';
+import { agentScope, homeAgentId } from '../agents.mjs';
 
 const { values } = parseArgs({
   args: process.argv.slice(3),
-  options: { agent: { type: 'string' }, root: { type: 'string' }, room: { type: 'string' }, 'room-key': { type: 'string' }, 'room-name': { type: 'string' }, principal: { type: 'string' }, preset: { type: 'string' }, role: { type: 'string' }, state: { type: 'string' }, platform: { type: 'string' }, site: { type: 'string' }, jql: { type: 'string' }, 'slack-channel': { type: 'string' }, help: { type: 'boolean' } },
+  options: { agent: { type: 'string' }, 'agent-id': { type: 'string' }, root: { type: 'string' }, room: { type: 'string' }, 'room-key': { type: 'string' }, 'room-name': { type: 'string' }, principal: { type: 'string' }, preset: { type: 'string' }, role: { type: 'string' }, state: { type: 'string' }, platform: { type: 'string' }, site: { type: 'string' }, jql: { type: 'string' }, 'slack-channel': { type: 'string' }, help: { type: 'boolean' } },
 });
 if (values.help || !values.agent) {
-  console.log('supercode-orchestrator agent-channel --agent <name> [--root <home>] [--room <id> | --room-key <key> [--principal <rh2 principal id> --preset <preset id> --role <role key> [--room-name <name>]]] [--state <file>]\n       supercode-orchestrator agent-channel --agent <name> --platform slack --slack-channel <id>[,<id>] [--state <file>]\n       supercode-orchestrator agent-channel --agent <name> --platform jira --site <url> --jql <jql> [--state <file>]');
+  console.log('supercode-orchestrator agent-channel --agent <name> [--agent-id <its Teams id>] [--root <home>] [--room <id> | --room-key <key> [--principal <rh2 principal id> --preset <preset id> --role <role key> [--room-name <name>]]] [--state <file>]\n       supercode-orchestrator agent-channel --agent <name> --platform slack --slack-channel <id>[,<id>] [--state <file>]\n       supercode-orchestrator agent-channel --agent <name> --platform jira --site <url> --jql <jql> [--state <file>]');
   process.exit(values.help ? 0 : 2);
 }
 const log = (level, line) => (level === 'debug' ? undefined : console.error(`${new Date().toISOString()} ${level} ${line}`));
@@ -78,10 +82,21 @@ if (values.platform && values.platform !== 'rh2') {
   process.on('SIGINT', stop);
 } else {
 const root = values.root ?? process.env.HERMES_HOME;
-const apps = root ? installedApps(root).filter((app) => app.profile === values.agent) : [];
-const installation = apps.find((app) => app.app === 'rh2-agent') ?? apps.find((app) => app.app === 'room-chat');
+// The agent's own record only when it is this agent's (bound to its Teams id, as an agent's sessions are mounted with it):
+// the id named, else the one this home holds for the agent, read and never minted.
+const agentId = values['agent-id'] ?? (root ? (() => {
+  try {
+    // a named profile implies its own agent: a home with no agent layer runs the agent on the profile of its name
+    let layer = {};
+    try { layer = JSON.parse(readFileSync(join(root, 'agents.json'), 'utf8')); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    const { org, server } = agentScope(process.env.SUPERCODE_CONTEXT);
+    return homeAgentId(root, { org, server, name: values.agent, profile: layer.agents?.[values.agent]?.profile ?? values.agent });
+  } catch (error) { log('warn', `${values.agent}: its id in ${root} was not read (${error.message})`); return null; }
+})() : null);
+const own = root && agentId ? installedAgentRecord(root, agentId) : null;
+const installation = own ?? (root ? installedApps(root).find((app) => app.app === 'room-chat' && app.profile === values.agent) : undefined);
 if (!installation) {
-  console.error(`agent-channel: ${values.agent} has no RH2 identity in ${root ?? '(no home: --root or HERMES_HOME)'}; install its agent (supercode orchestrator apps install rh2-agent … --profile ${values.agent}) or Room chat for it (apps install room-chat … --profile ${values.agent})`);
+  console.error(`agent-channel: ${values.agent} has no RH2 identity in ${root ?? '(no home: --root or HERMES_HOME)'}; install its agent (supercode orchestrator apps install rh2-agent … --agent ${agentId ?? '<its Teams id>, and run this with --agent-id <its Teams id>'}) or Room chat for it (apps install room-chat … --profile ${values.agent})`);
   process.exit(1);
 }
 const identity = { api_url: installation.origin, organization: installation.organizationId, principal_id: installation.principalId, token: installation.token };
@@ -157,23 +172,27 @@ async function seatSession(session) {
  *  is read again on every tick, so a re-declared main is bound at the next one. A bind that fails is said once per main
  *  and reason (a main that is not in the team's catalog, or one no session ever ran as), never only at debug level,
  *  which this process does not print. */
-async function bindDm() {
+async function bindMainSession() {
   let main;
   try { main = [sc(['agent', 'show', values.agent, '--json'])].flat().find((a) => a.name === values.agent)?.main_session; }
-  catch (error) { warnOnce(`agent show: ${lastLine(error)}`, `${values.agent}: its agent record was not read (${lastLine(error)}); its DM stays bound to ${boundTo ?? 'nothing'}`); return; }
+  catch (error) { warnOnce(`agent show: ${lastLine(error)}`, `${values.agent}: its agent record was not read (${lastLine(error)}); its seat stays bound to ${boundTo ?? 'nothing'}`); return; }
   const session = typeof main === 'string' ? main.split(':').pop() : null;
-  if (!session) { warnOnce('no main', `${values.agent}: its agent record names no main session; its DM stays bound to ${boundTo ?? 'nothing'}`); return; }
+  if (!session) { warnOnce('no main', `${values.agent}: its agent record names no main session; its seat stays bound to ${boundTo ?? 'nothing'}`); return; }
   if (session === boundTo) return;
   let bound;
   try { bound = sc(['sessions', 'bind', session, '--room', roomId, '--agent', adapter.principalId(), '--rh2', adapter.apiUrl(), '--json']).data; }
-  catch (error) { warnOnce(`${session}: ${lastLine(error)}`, `${values.agent}: its DM is not bound to its main session ${main} (exit ${error.status ?? '?'}: ${lastLine(error)}); retried every 15 s with the record read again`); return; }
+  catch (error) { warnOnce(`${session}: ${lastLine(error)}`, `${values.agent}: its seat is not bound to its main session ${main} (exit ${error.status ?? '?'}: ${lastLine(error)}); retried every 15 s with the record read again`); return; }
+  // The session by its reference (RH2 ADR 0050 decision 4); RH2 takes the registration that provides this agent's sessions.
+  await seatSession({ harness: bound.session.harness, reference: bound.session.reference });
   failedAs = null;
-  await seatSession({ harness: bound.harness, sessionId: bound.sessionId, team: bound.team, teamsUrl: bound.teamsUrl });
   boundTo = session;
-  log('info', `${values.agent}: its DM in the account Room is its main session ${session}`);
+  log('info', `${values.agent}: its seat in the account Room carries its main session ${session}`);
 }
-await bindDm();
-const rebinding = setInterval(() => { void bindDm().catch((error) => log('warn', `${values.agent}: binding its DM: ${error.message}`)); }, 15_000);
+// A refused seat is said once per reason and retried on the next tick, the first one too: it never ends the channel (a
+// refusal at start would otherwise restart the service in a loop, with the mailbox bridge down each time).
+const rebind = () => bindMainSession().catch((error) => warnOnce(`seat: ${error.message}`, `${values.agent}: its seat was refused its main session (${error.message}); retried every 15 s`));
+await rebind();
+const rebinding = setInterval(() => { void rebind(); }, 15_000);
 const stop = async () => { clearInterval(rebinding); await bridge.stop(); await client.close?.(); process.exit(0); };
 process.on('SIGTERM', stop);
 process.on('SIGINT', stop);