@volter/supercode-orchestrator 0.5.205 → 0.5.207

package/board/owner-door-worker.mjs

@@ -0,0 +1,61 @@
+// The thread that serves the board owner's socket (owner-door.mjs). A listing is answered here, read on a connection of
+// its own; every other request is handed to the owner's thread and its answer written back.
+import { parentPort, workerData } from 'node:worker_threads';
+import { createServer } from 'node:net';
+import { chmodSync } from 'node:fs';
+import { boardOwnerSocket } from '@volter/teams/board-owner';
+import { parse } from './args.mjs';
+import { answerOne } from './cli.mjs';
+import { knowLocalMachine } from './dispatch.mjs';
+import { holdOwnerHealth } from './owner-health.mjs';
+import { ownHome } from './owner-files.mjs';
+import { writeOwnerAnswer } from './reply.mjs';
+import { holdWorkflow } from './workflow.mjs';
+
+const { root, machine } = workerData;
+const waiting = new Map(); // request id → its answer's resolve
+let next = 0;
+parentPort.on('message', (frame) => {
+  if (frame.type === 'health') holdOwnerHealth(frame.boards, frame.round);
+  else if (frame.type === 'workflow') holdWorkflow(frame.root, frame.entry);
+  else if (frame.type === 'answer') { waiting.get(frame.id)?.(frame.answer); waiting.delete(frame.id); }
+});
+await knowLocalMachine(machine);
+ownHome(root);
+
+const byOwner = (line) => new Promise((resolve) => { const id = ++next; waiting.set(id, resolve); parentPort.postMessage({ type: 'request', id, line }); });
+const isListing = (line) => {
+  try {
+    const request = JSON.parse(line);
+    return !request?.tool && Array.isArray(request?.argv) && request.argv.every((arg) => typeof arg === 'string') && ['list', 'ls'].includes(parse(request.argv)._[0]);
+  } catch { return false; } // the owner answers what it cannot read
+};
+const answer = async (line) => {
+  if (!isListing(line)) return byOwner(line);
+  const read = await answerOne(root, line, { readOnly: true });
+  return read.byOwner ? byOwner(line) : read;
+};
+
+// allowHalfOpen: a caller that ends its side after its request still gets the answer, written when it is ready
+const server = createServer({ allowHalfOpen: true }, (socket) => {
+  let input = '';
+  socket.setEncoding('utf8');
+  socket.on('error', () => { /* the caller went away */ });
+  socket.on('data', (chunk) => {
+    if (input === null) return;
+    input += chunk;
+    const end = input.indexOf('\n');
+    if (end < 0) return;
+    const line = input.slice(0, end);
+    input = null;
+    // one answer per call, whatever the request did: a request that fails is a failed answer, never the door's end
+    answer(line)
+      .catch((error) => ({ code: 1, stdout: '', stderr: `supercode workflow: ${error?.message ?? error}\n` }))
+      .then((reply) => writeOwnerAnswer(socket, reply))
+      .catch(() => { socket.destroy(); }); // a disconnected caller leaves no queued reply
+  });
+});
+const path = boardOwnerSocket(root);
+await new Promise((done, fail) => { server.once('error', fail); server.listen(path, () => { server.off('error', fail); done(); }); });
+try { chmodSync(path, 0o600); } catch { /* the home is the user's own */ }
+parentPort.postMessage({ type: 'ready' });

package/board/owner-door.mjs

@@ -0,0 +1,46 @@
+// The board owner's socket, served on a thread of its own (owner-door-worker.mjs), so a caller is heard while the
+// owner's loop is held by a round. A listing (`list`, `ls`) is read on that thread, each on a connection of its own in
+// one SQLite read transaction (store.mjs openBoard, readOnly): WAL serves it beside the owner's writes, and neither
+// waits on the other. Every other request, and a listing that thread leaves to the owner (listing.mjs byOwner), comes
+// here and is answered by the board's one writer exactly as before. The thread holds what a listing says of the owner:
+// its dispatcher's health (owner-health.mjs) and the workflow it read (workflow.mjs), sent on each change.
+import { Worker } from 'node:worker_threads';
+import { watchOwnerHealth } from './owner-health.mjs';
+import { watchWorkflows } from './workflow.mjs';
+
+const failed = (error) => ({ code: 1, stdout: '', stderr: `supercode workflow: ${error?.message ?? error}\n` });
+
+/**
+ * Serve the owner's socket for the home at `root` (the caller holds its lock and has removed any old socket): resolves
+ * once the socket is bound. `answer(line)` answers a request here; `machine` is this machine's name as the owner learned
+ * it. A door that ends while the owner runs leaves the home with no door: the owner says so and exits, for its keeper to
+ * start it again. Answers the door's close.
+ */
+export async function openOwnerDoor(root, { machine, answer, log }) {
+  const worker = new Worker(new URL('./owner-door-worker.mjs', import.meta.url), { name: 'supercode board door', workerData: { root, machine } });
+  let open = false, closing = false;
+  const send = (frame) => { try { worker.postMessage(frame); } catch (error) { log(`board door: could not hand the door ${frame.type}: ${error.message}`); } };
+  const stops = [
+    watchOwnerHealth(({ boards, round }) => send({ type: 'health', boards, round })),
+    watchWorkflows((at, { workflow, params, profiles }) => send({ type: 'workflow', root: at, entry: { workflow, params, profiles } })),
+  ];
+  const close = () => { closing = true; for (const stop of stops) stop(); worker.terminate().catch(() => { /* ended */ }); };
+  worker.on('message', (frame) => {
+    if (frame?.type !== 'request') return;
+    // one answer per request, whatever it did: a request that fails is a failed answer, never the owner's end
+    Promise.resolve().then(() => answer(frame.line)).catch(failed)
+      .then((result) => { if (!closing) send({ type: 'answer', id: frame.id, answer: result }); });
+  });
+  await new Promise((resolve, reject) => {
+    const ended = (error) => {
+      if (closing) return;
+      if (!open) { close(); reject(error); return; }
+      log(`board door: ${error.message}; this home has no door now; stopping, for the keeper to start the owner again`);
+      process.exit(1);
+    };
+    worker.on('message', (frame) => { if (frame?.type === 'ready') { open = true; resolve(); } });
+    worker.on('error', ended);
+    worker.on('exit', (code) => ended(new Error(`the door's thread ended (${code})`)));
+  });
+  return close;
+}

package/board/owner-health.mjs

@@ -4,17 +4,23 @@
 const switches = new Map(); // board slug → { on, at, by, reason }
 let round = null; // { at, errors }
 let holding = false;
+// the owner's read door holds the same (owner-door.mjs), told of each change
+const watchers = new Set();
+const told = () => { for (const watcher of watchers) watcher({ boards: [...switches], round }); };
+/** `watcher` is told what the owner holds now and after each change; answers its stop. */
+export function watchOwnerHealth(watcher) { watchers.add(watcher); watcher({ boards: [...switches], round }); return () => watchers.delete(watcher); }
 
 /** The owner starts holding: each board's switch as stored, and the last round its predecessor recorded. */
 export function holdOwnerHealth(boards, lastRound) {
   holding = true;
   for (const [slug, state] of boards) switches.set(slug, state);
   round = lastRound;
+  told();
 }
 /** The owner wrote a board's switch. */
-export function holdSwitch(slug, state) { if (holding) switches.set(slug, state); }
+export function holdSwitch(slug, state) { if (holding) { switches.set(slug, state); told(); } }
 /** The owner completed a round. */
-export function holdRound(at, errors) { if (holding) round = { at, errors }; }
+export function holdRound(at, errors) { if (holding) { round = { at, errors }; told(); } }
 
 /** The notice for a verb on `slug`: dispatching off (a state), or a stalled round and its standing errors (failures). */
 export function dispatcherNotice(slug) {

package/board/published.mjs

@@ -177,7 +177,7 @@ export function cardSnapshot(db,row,rows=perCard(db)) {
   const runs=rows.attempts(row.id);
   const attempts=runs.map(run=>{
     const native=parse(run.metadata,{})?.supercode??null;
-    const session=native?{machine:native.machine,harness:native.harness,session_id:native.session_id,address:native.address,pane:native.pane,surface:native.surface,state:native.state,closed_at:native.closed_at,agent:native.agent_id??null,counted:native.counted??null,profile_differences:native.agent_profile_mismatch?.differences??null}:null;
+    const session=native?{machine:native.machine,harness:native.harness,session_id:native.session_id,address:native.address,pane:native.pane,surface:native.surface,state:native.state,closed_at:native.closed_at,detached_at:native.detached_at??null,detached_to:native.detached_to??null,agent:native.agent_id??null,counted:native.counted??null,profile_differences:native.agent_profile_mismatch?.differences??null}:null;
     const metadata=parse(run.metadata,{});delete metadata.supercode;
     return {id:String(run.id),profile:run.profile,step:run.step_key,status:run.status,started_at:at(run.started_at),ended_at:at(run.ended_at),outcome:run.outcome,error:run.error,execution:executionOf(run),session,handoff:run.summary||Object.keys(metadata).length?{summary:run.summary,metadata}:null};
   });
@@ -186,7 +186,7 @@ export function cardSnapshot(db,row,rows=perCard(db)) {
     execution:executionOf(runs.find(run=>run.id===row.current_run_id)),
     priority:row.priority,created_by:row.created_by,created_at:at(row.created_at),started_at:at(row.started_at),completed_at:at(row.completed_at),result:row.result,skills:parse(row.skills,[]),model:row.model_override,provider:row.provider_override,
     tags:parse(own.tags,null)??(row.tenant?[row.tenant]:[]),sponsor:own.sponsor??null,sponsor_evidence:parse(own.sponsor_evidence),requested_by_unverified:parse(own.requested_by_unverified),machine:own.machine??null,subtask_of:own.subtask_of??null,archived:!!own.archived,
-    blocked_by:parse(own.blocked_by,[]),paused:parse(own.paused),every:own.every??null,
+    blocked_by:parse(own.blocked_by,[]),paused:parse(own.paused),detached:parse(own.detached),every:own.every??null,
     workspace:{kind:row.workspace_kind,path:row.workspace_path,branch:row.branch_name,root:own.workspace_root,anchor:own.workspace_anchor},
     parents:rows.parents(row.id),
     agents:rows.agents(row.id),reviews,children:rows.children(row.id),comments,attempts};

package/board/record-view.mjs

@@ -62,9 +62,11 @@ export class RecordView {
     this.progressTimer.unref?.();
   }
   fail(error) {
+    this.ready = false;
     this.failure = error;
     for (const waiter of this.waiters) { clearTimeout(waiter.timer); waiter.reject(error); }
     this.waiters.clear();
+    try { this.onUnavailable?.(error); } catch { /* unavailable never becomes a fresh observation */ }
   }
   own(key) { return key.role === 'producer' ? key.machine === this.self : key.role === 'holder' && key.machine !== this.self; }
   apply(frame) {

package/board/store.mjs

@@ -19,7 +19,7 @@ import { hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { openZtrackBoard } from './ztrack.mjs';
-import { LIST_CONNECTION, TASK_SUMMARY_INDEX, TASK_SUMMARY_INDEX_SQL } from './listing.mjs';
+import { byOwner, LIST_CONNECTION, TASK_SUMMARY_INDEX, TASK_SUMMARY_INDEX_SQL } from './listing.mjs';
 import { isFilesBoard, openFilesBoard } from './files.mjs';
 import { signalBoardWrite } from './wake.mjs';
 import { PUBLICATION_SCHEMA, pruneDue, prunePublications, publicationTriggers, recordCardPublications } from './published.mjs';
@@ -76,14 +76,22 @@ CREATE INDEX IF NOT EXISTS idx_events_run ON task_events(run_id, id);
 // supercode's part of a card, beside Hermes's row: where its session runs, and the arc a subtask belongs to (a
 // subtask is worked by its arc's session and never started on its own).
 const OURS = `CREATE TABLE IF NOT EXISTS supercode_cards (task_id TEXT PRIMARY KEY, machine TEXT, subtask_of TEXT, stage TEXT);
-CREATE TABLE IF NOT EXISTS supercode_effects (id INTEGER PRIMARY KEY AUTOINCREMENT, effect TEXT NOT NULL);`;
+CREATE TABLE IF NOT EXISTS supercode_effects (id INTEGER PRIMARY KEY AUTOINCREMENT, effect TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS supercode_session_custody (
+  address TEXT PRIMARY KEY, task_id TEXT NOT NULL, person TEXT NOT NULL,
+  detached_at INTEGER NOT NULL, detached_by TEXT NOT NULL, run_id INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS supercode_session_operations (
+  token TEXT PRIMARY KEY, card_ref TEXT, address TEXT, kind TEXT NOT NULL,
+  owner TEXT NOT NULL, started_at INTEGER NOT NULL
+);`;
 // `stage`: the card's workflow status where kanban.db stores another (a `reviewing` card is `running` to Hermes)
 // `since`: when the card entered its workflow status; `after_fired`: which of the status's `after` moves have run since
 // `tags`: the card's ordered tags (Hermes's `tenant` holds the first); `sponsor`, `sponsor_evidence`, `requested_by_unverified`: C4
 // An effect's attempts: how many were made, when the next may be, and, once its attempts are spent, when it failed and
 // why (engine.mjs runEffects). A failed effect is kept as the record of its terminal state and never tried again.
 const EFFECT_COLUMNS = { attempts: 'INTEGER NOT NULL DEFAULT 0', next_at: 'INTEGER NOT NULL DEFAULT 0', failed_at: 'INTEGER', last_error: 'TEXT' };
-const OURS_COLUMNS = { workspace_anchor: 'TEXT', workspace_root: 'TEXT', subtask_of: 'TEXT', stage: 'TEXT', since: 'INTEGER', after_fired: 'TEXT', blocked_by: 'TEXT', paused: 'TEXT', archived: 'INTEGER DEFAULT 0', every: 'TEXT', next_run_at: 'INTEGER', tags: 'TEXT', sponsor: 'TEXT', sponsor_evidence: 'TEXT', requested_by_unverified: 'TEXT' };
+const OURS_COLUMNS = { workspace_anchor: 'TEXT', workspace_root: 'TEXT', subtask_of: 'TEXT', stage: 'TEXT', since: 'INTEGER', after_fired: 'TEXT', blocked_by: 'TEXT', paused: 'TEXT', detached: 'TEXT', archived: 'INTEGER DEFAULT 0', every: 'TEXT', next_run_at: 'INTEGER', tags: 'TEXT', sponsor: 'TEXT', sponsor_evidence: 'TEXT', requested_by_unverified: 'TEXT' };
 
 // ------------------------------------------------------------------ backings
 //
@@ -151,6 +159,18 @@ const RUN_SESSION = "json_extract(metadata, '$.supercode.session_id')";
 const RUN_ADDRESS = "json_extract(metadata, '$.supercode.address')";
 const RUN_LAUNCH_PENDING = "json_extract(metadata, '$.supercode.launch_pending')";
 export const CALLER_RUN_ADDRESS = `SELECT ${RUN_ADDRESS} AS address FROM task_runs WHERE ${RUN_SESSION} = ? ORDER BY id DESC LIMIT 1`;
+// Launch/adoption commits the native address and its immutable role-agent together.
+// Pending/unissued launches are not an ownership receipt. Read only that identity,
+// never the current assignee, a profile hint, or mutable manager/admission state.
+export const CALLER_RUN_AGENT = `SELECT DISTINCT
+  json_extract(metadata, '$.supercode.agent_id') AS agent_id,
+  json_extract(metadata, '$.supercode.agent_org') AS org
+  FROM task_runs WHERE ${RUN_SESSION} = ? AND ${RUN_ADDRESS} = ?
+  AND COALESCE(${RUN_LAUNCH_PENDING}, 0) = 0
+  AND COALESCE(json_extract(metadata, '$.supercode.launch_deferred'), 0) = 0
+  AND json_extract(metadata, '$.supercode.mode') IN ('fresh', 'resume', 'adopt')
+  AND json_extract(metadata, '$.supercode.agent_id') IS NOT NULL
+  AND json_extract(metadata, '$.supercode.agent_org') IS NOT NULL`;
 const RUN_SESSION_INDEX = 'idx_runs_supercode_session';
 const RUN_LAUNCH_PENDING_INDEX = 'idx_runs_supercode_launch_pending';
 // The indexes on a run's metadata. The second holds only the runs whose launch is pending (7 of 1,387 on the store
@@ -256,6 +276,34 @@ function layOutHistoryIndexes(db) {
   }
 }
 
+// A card's number (#42): short and sequential, given once when the card is made, never changed and never given to
+// another card, as an issue tracker numbers its issues. The store gives it, whoever makes the card (a verb, a document
+// import, Hermes's own writer): a trigger on `tasks` numbers each new card id. AUTOINCREMENT never hands a number out
+// twice, and a number stays with its card id while the card's row is replaced or removed. The trigger inserts only
+// where the id has no number yet, so no conflict arises in it (a writing statement's own conflict clause would govern
+// the trigger's insert: published.mjs). Its first installation numbers the cards already there, in the order they were
+// made (created_at, then id), in the same savepoint.
+export const CARD_NUMBERS = 'supercode_card_numbers';
+function layOutNumbers(db) {
+  if (db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'trigger' AND name = 'supercode_number_cards'").get()) return;
+  db.exec('SAVEPOINT supercode_card_numbering');
+  try {
+    db.exec(`CREATE TABLE IF NOT EXISTS ${CARD_NUMBERS} (number INTEGER PRIMARY KEY AUTOINCREMENT, task_id TEXT NOT NULL UNIQUE);
+      INSERT INTO ${CARD_NUMBERS} (task_id) SELECT id FROM tasks WHERE id NOT IN (SELECT task_id FROM ${CARD_NUMBERS}) ORDER BY created_at, id;
+      CREATE TRIGGER IF NOT EXISTS supercode_number_cards AFTER INSERT ON tasks BEGIN
+        INSERT INTO ${CARD_NUMBERS} (task_id) SELECT NEW.id WHERE NOT EXISTS (SELECT 1 FROM ${CARD_NUMBERS} WHERE task_id = NEW.id);
+      END;`);
+    db.exec('RELEASE supercode_card_numbering');
+  } catch (error) { db.exec('ROLLBACK TO supercode_card_numbering; RELEASE supercode_card_numbering'); throw error; }
+}
+
+/** Raise the numbers' high-water mark to the highest number held, and to `floor`: AUTOINCREMENT hands out only numbers
+ *  above it. For a store whose numbers were given or copied explicitly. */
+export function raiseCardNumbers(db, floor = 0) {
+  db.prepare(`INSERT INTO sqlite_sequence (name, seq) SELECT ?, 0 WHERE NOT EXISTS (SELECT 1 FROM sqlite_sequence WHERE name = ?)`).run(CARD_NUMBERS, CARD_NUMBERS);
+  db.prepare(`UPDATE sqlite_sequence SET seq = MAX(seq, ?, (SELECT COALESCE(MAX(number), 0) FROM ${CARD_NUMBERS})) WHERE name = ?`).run(Number(floor) || 0, CARD_NUMBERS);
+}
+
 /** Hermes's tables on a fresh board, supercode's own table and columns on every one. */
 export function layOut(db, { fresh }) {
   if (fresh) db.exec(SCHEMA);
@@ -267,6 +315,7 @@ export function layOut(db, { fresh }) {
   // each read walked every card's row. Laid out here, after the column it names exists on a store of any age and before
   // any statement is prepared; no statement names it, so a store without it is only slower.
   db.exec('CREATE INDEX IF NOT EXISTS idx_supercode_cards_subtask_of ON supercode_cards(subtask_of)');
+  layOutNumbers(db);
   layOutEventIndex(db);
   layOutHistoryIndexes(db);
   // A covering summary index keeps human listings out of task records' body overflow pages.
@@ -371,6 +420,8 @@ export function heldConfigWatched(slug, source, watched) {
 }
 
 export function openBoard(root, slug = DEFAULT_BOARD, options = {}) {
+  // a listing on the owner's read door reads on a connection of its own, never the held board's (openReadOnly)
+  if (current().readOnly) return openReadOnly(root, slug);
   if (holding !== null && !options.create && realRoot(root) === holding && !untrustedConfig.get(slug)?.size) {
     let entry = heldBoards.get(slug);
     if (!entry) {
@@ -400,6 +451,33 @@ function heldHandle(entry, slug) {
     close() { if (closed) return; closed = true; entry.uses -= 1; if (entry.retired && !entry.uses) try { entry.board.close(); } catch { /* closed */ } } };
 }
 
+/**
+ * Board `slug` as one committed state, for a listing on the owner's read door: a connection of its own in one SQLite
+ * read transaction (WAL's snapshot, beside any writer, with no busy timeout), kept until `close`. It makes, lays out,
+ * recovers and writes nothing; a board it cannot read so (a `files` board, whose card files have no commit point a
+ * reader can take; a store not in WAL or not laid out; one it cannot begin reading, `unreadable`) is left to the owner
+ * (listing.mjs byOwner).
+ */
+function openReadOnly(root, slug) {
+  const use = backingOf(root, slug);
+  if (!use) throw new Error(`no board ${slug} in ${root} (${boardPath(root, slug)})`);
+  const path = backingPaths(root, slug)[use];
+  if (use === 'ztrack') return { ...openZtrackBoard(path, { init: layOut, root, slug, readOnly: true }), root, slug, path, backing: use };
+  if (use === 'files') throw byOwner(`board ${slug} is kept in files`);
+  let db;
+  try {
+    db = new DatabaseSync(path, { readOnly: true });
+    if (String(db.prepare('PRAGMA journal_mode').get()?.journal_mode).toLowerCase() !== 'wal') throw byOwner(`${path} is not in WAL mode`);
+    db.exec('BEGIN');
+    // the transaction's first read begins its snapshot
+    if (!indexed(db, TASK_SUMMARY_INDEX)) throw byOwner(`${path} is not laid out yet`);
+  } catch (error) {
+    db?.close();
+    throw unreadable(error) ? byOwner(error.message) : error;
+  }
+  return { db, root, slug, path, backing: use, tx: () => { throw new Error('a listing reads the board and writes nothing'); }, close: () => db.close() };
+}
+
 function openBoardNow(root, slug, { create = false, backing = null, document = null, declared = null, held = false } = {}) {
   noteOrigin(root);
   const kept = backingOf(root, slug);
@@ -477,6 +555,9 @@ export function publishMarked(root) {
 export const contention = (error) => [5, 6].includes(Number(error?.errcode) & 255)
   || ['SQLITE_BUSY', 'SQLITE_LOCKED'].includes(error?.code)
   || /^database (?:table |schema )?is locked$/i.test(error?.message ?? '');
+// What keeps a read-only connection from beginning its read where the owner's own would not: contention, or a store it
+// may not open or read as it stands (SQLite CANTOPEN, READONLY). The listing is then the owner's (openReadOnly).
+export const unreadable = (error) => contention(error) || [8, 14].includes(Number(error?.errcode) & 255);
 // The store's volume refusing a write (SQLite IOERR or FULL and their extended codes; ENOSPC or EIO from a file write):
 // a fault of the machine's storage at that minute, never of the card or the operation that met it. A transaction it
 // rolled back is tried again a bounded number of times (STORAGE_TRIES); one still refused fails cleanly, and its caller

package/board/tools.mjs

@@ -7,7 +7,9 @@ import { mkdirSync, statSync, writeFileSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import { DEFAULT_BOARD, actorOf, event, json, openBoard, setActor, tx } from './store.mjs';
 import * as engine from './engine.mjs';
+import { assertSourceReceipt } from './ci.mjs';
 import { completionOwnerOf, isLatestReviewer, loadWorkflow } from './workflow.mjs';
+import { attachmentRecord, readAttachment } from './attachment-read.mjs';
 
 const ok = (fields = {}) => JSON.stringify({ ok: true, ...fields });
 const error = (message) => JSON.stringify({ error: message });
@@ -30,6 +32,7 @@ const ORCHESTRATOR_ONLY = new Set(['kanban_list', 'kanban_unblock']);
 
 /** One board tool call. `root` is the home; `env` the worker's task environment (`HERMES_KANBAN_*`). */
 export async function boardTool(root, name, args = {}, env = {}) {
+  try { assertSourceReceipt(args); } catch (e) { return error(e.message); }
   const own = env.HERMES_KANBAN_TASK || null;
   const runId = env.HERMES_KANBAN_RUN_ID ? Number(env.HERMES_KANBAN_RUN_ID) : null;
   const author = env.HERMES_PROFILE || 'worker';
@@ -112,7 +115,7 @@ export async function boardTool(root, name, args = {}, env = {}) {
           }
         }
         if (env.HERMES_SESSION_ID && own === tid) metadata = { ...(metadata ?? {}), worker_session_id: env.HERMES_SESSION_ID };
-        await engine.complete(board, tid, { summary, result, metadata, commit: args.commit ?? null, ci_run: args.ci_run ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args.pr_head ?? null, reviewed_sha: args.reviewed_sha ?? null });
+        await engine.complete(board, tid, { summary, result, metadata, commit: args.commit ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args.pr_head ?? null, reviewed_sha: args.reviewed_sha ?? null });
         return ok({ task_id: tid, status: 'done' });
       }
       case 'kanban_block': {
@@ -122,12 +125,12 @@ export async function boardTool(root, name, args = {}, env = {}) {
       }
       case 'kanban_request_state': {
         const stale = ownRun(); if (stale) return error(stale);
-        await engine.requestStateMany(board, targets, { state: args.state, reason: args.reason, on: args.on ?? null, waiting_on: args.waiting_on ?? null, evidence: args.evidence ?? null, commit: args.commit ?? null, ci_run: args.ci_run ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args.pr_head ?? null, reviewed_sha: args.reviewed_sha ?? null, deployed_sha: args.deployed_sha ?? null });
+        await engine.requestStateMany(board, targets, { state: args.state, reason: args.reason, on: args.on ?? null, waiting_on: args.waiting_on ?? null, evidence: args.evidence ?? null, commit: args.commit ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args.pr_head ?? null, reviewed_sha: args.reviewed_sha ?? null });
         return ok({ task_id: tid, task_ids: targets, requested: args.state, changed: false });
       }
       case 'kanban_request_review': {
         const stale = ownRun(); if (stale) return error(stale);
-        await engine.requestReview(board, tid, { summary: args.summary ? redact(String(args.summary)) : null, metadata: args.metadata ? redact(args.metadata) : null, commit: args.commit ?? null, ci_run: args.ci_run ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args.pr_head ?? args.commit ?? null, reviewer: args.reviewer ?? null, expectedRunId: own === tid && runId ? runId : null });
+        await engine.requestReview(board, tid, { summary: args.summary ? redact(String(args.summary)) : null, metadata: args.metadata ? redact(args.metadata) : null, commit: args.commit ?? null, branch: args.branch ?? null, pr: args.pr ?? null, pr_head: args.pr_head ?? args.commit ?? null, reviewer: args.reviewer ?? null, expectedRunId: own === tid && runId ? runId : null });
         return ok({ task_id: tid, status: 'review' });
       }
       case 'kanban_request_changes': {
@@ -172,11 +175,15 @@ export async function boardTool(root, name, args = {}, env = {}) {
         return ok({ task_id: tid, attachment_id: id, path });
       }
       case 'kanban_attachments':
+        if (args.attachment_id !== undefined) {
+          const row = tx(board, (db) => attachmentRecord(db, tid, args.attachment_id));
+          return ok(await readAttachment(root, slug, row, { offset: args.offset, length: args.length, version: args.version }));
+        }
         return ok({ task_id: tid, attachments: tx(board, (db) => engine.attachments(db, tid)).map((a) => ({ id: a.id, filename: a.filename, size: a.size, content_type: a.content_type, path: a.stored_path })) });
       case 'kanban_create': {
         const workspace = args.workspace_kind ? `${args.workspace_kind}${args.workspace_path ? `:${args.workspace_path}` : ''}` : undefined;
         const made = engine.createCard(board, await engine.prepareCard(board, {
-          title: args.title, body: args.body ? redact(String(args.body)) : null, assignee: args.assignee ?? null, parents: [args.parents ?? []].flat(), tenant: args.tenant ?? null,
+          title: args.title, body: args.body ? redact(String(args.body)) : null, assignee: args.assignee ?? null, reviewer: args.reviewer ?? null, parents: [args.parents ?? []].flat(), tenant: args.tenant ?? null,
           priority: args.priority ?? 0, workspace, project: args.project ?? null, triage: Boolean(args.triage), idempotencyKey: args.idempotency_key ?? null,
           maxRuntime: args.max_runtime_seconds ?? null, initialStatus: args.initial_status ?? null, skills: args.skills ?? null, model: args.model ?? null, provider: args.provider ?? null,
           goal: args.goal_mode ? { maxTurns: args.goal_max_turns ?? null } : null, createdBy: author,