@volter/supercode-orchestrator 0.5.43 → 0.5.44

package/agents.mjs

@@ -13,18 +13,14 @@ import { supercodeHome } from '@volter/teams/home';
 const entry=fileURLToPath(new URL('./bin/agent-door.mjs',import.meta.url));
 // The caller each door names to Teams (X-Supercode-Caller): this host's own command words, then the door's operation.
 const HOST_CALLER=(process.env.SUPERCODE_CALLER_NAME??`orchestrator ${process.argv.slice(2).filter(arg=>!arg.startsWith('-')).slice(0,2).filter(arg=>/^[a-z][a-z0-9-]{0,30}$/.test(arg)).join(' ')}`).slice(0,80);
+const lastJson=text=>{for(const line of String(text??'').trim().split('\n').reverse()){try{const value=JSON.parse(line);if(value&&typeof value==='object')return value;}catch{/* not the door's line */}}return null;};
 export function agentDoor(op,args=[],{context,timeout=25000}={}){
   const reply=spawnSync(process.execPath,[entry],{input:JSON.stringify({op,args,context}),encoding:'utf8',timeout,maxBuffer:4*1024*1024,env:{...process.env,SUPERCODE_CALLER_NAME:`${HOST_CALLER} agent-door ${op}`}});
-  // The door's answer to a failure is its last stderr line; a runtime's own lines may come before it (a preload's notice).
-  if(reply.status!==0){let detail;try{detail=JSON.parse(String(reply.stderr).trim().split('\n').at(-1));}catch{detail={message:reply.error?.message??String(reply.stderr).slice(-1000)};}throw Object.assign(new Error(detail.message??'Teams agent door unavailable'),detail);}
+  // The door's answer to a failure is the last stderr line that is JSON: a runtime's own lines (a preload's notice, a
+  // Node warning) may come before or after it.
+  if(reply.status!==0){const detail=lastJson(reply.stderr)??{message:reply.error?.message??String(reply.stderr).slice(-1000)};throw Object.assign(new Error(detail.message??'Teams agent door unavailable'),detail);}
   return JSON.parse(reply.stdout);
 }
-/** Teams is not configured, not reachable, or no longer accepts this login: identity stays local until it syncs.
- * A refusal Teams decided (forbidden, conflict, not found, invalid) is never read as absence. */
-export function teamsUnavailable(error){
-  if(error?.status!=null)return error.status>=500||error.status===401;
-  return !['forbidden','conflict','not_found','invalid_request','revision_mismatch','idempotency_conflict'].includes(error?.code);
-}
 /** The Org agent identity belongs to: the selected Teams context as this home records it (read locally, no request),
  * or this home's local store when none is selected. A context named but unreadable here is this home's error, and throws. */
 export function agentScope(context){return agentDoor('scope',[],{context});}
@@ -38,11 +34,6 @@ function store(root){
   CREATE TABLE IF NOT EXISTS agent_end_outbox(org TEXT NOT NULL,agent_id TEXT NOT NULL,reason TEXT NOT NULL,created_at INTEGER NOT NULL,PRIMARY KEY(org,agent_id));
   CREATE TABLE IF NOT EXISTS agent_runtime_sessions(org TEXT NOT NULL,runtime_ref TEXT NOT NULL,session_ref TEXT NOT NULL,PRIMARY KEY(org,runtime_ref));
   CREATE TABLE IF NOT EXISTS agent_runs(org TEXT NOT NULL,agent_id TEXT NOT NULL,session_ref TEXT NOT NULL,machine TEXT,run_id TEXT,profile_json TEXT,ended_at INTEGER,end_reason TEXT,main INTEGER NOT NULL DEFAULT 1,starter_session TEXT,usage_json TEXT,PRIMARY KEY(org,session_ref));`);
-  // A declaration Teams refused is asked again a bounded number of times (synchronizeLocalAgents), then left failed.
-  const columns=new Set(db.prepare('PRAGMA table_info(agent_intents)').all().map(c=>c.name));
-  for(const [column,type] of Object.entries({declare_attempts:'INTEGER NOT NULL DEFAULT 0',declare_next_at:'INTEGER NOT NULL DEFAULT 0',declare_failed_at:'INTEGER',declare_error:'TEXT'}))if(!columns.has(column))db.exec(`ALTER TABLE agent_intents ADD COLUMN ${column} ${type}`);
-  // An end is claimed by the pass sending it (synchronizeAgentEnds).
-  if(!new Set(db.prepare('PRAGMA table_info(agent_end_outbox)').all().map(c=>c.name)).has('claimed_at'))db.exec('ALTER TABLE agent_end_outbox ADD COLUMN claimed_at INTEGER');
   return db;
 }
 const digest=value=>createHash('sha256').update(value).digest('hex');
@@ -86,24 +77,6 @@ export function finishAgentAssignment(root,org,assignment,reason){
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
 }
-export function synchronizeAgentEnds(root,org,{context}={}){
-  const db=store(root),pending=[];
-  try{
-    for(const row of db.prepare('SELECT * FROM agent_end_outbox WHERE org=? ORDER BY created_at LIMIT 100').all(org)){
-      if(db.prepare("SELECT 1 FROM agent_assignments WHERE org=? AND agent_id=? AND state='active'").get(org,row.agent_id)){db.prepare('DELETE FROM agent_end_outbox WHERE org=? AND agent_id=?').run(org,row.agent_id);continue;}
-      // claimed by compare-and-set on its claimed_at (free, or a claim older than SYNC_CLAIM_MS from a pass that died);
-      // deleted only after Teams ended the agent (the end is idempotent by its digest), handed back when it failed
-      if(db.prepare('UPDATE agent_end_outbox SET claimed_at=? WHERE org=? AND agent_id=? AND (claimed_at IS NULL OR claimed_at<?)').run(Date.now(),org,row.agent_id,Date.now()-SYNC_CLAIM_MS).changes!==1)continue;
-      try{
-        agentDoor('end',[row.agent_id,row.reason,digest(`${org}/${row.agent_id}/end/${row.created_at}`)],{context});
-        db.prepare('UPDATE agent_runs SET ended_at=COALESCE(ended_at,?),end_reason=COALESCE(end_reason,?) WHERE org=? AND agent_id=?').run(Date.now(),row.reason,org,row.agent_id);
-        db.prepare('DELETE FROM agent_end_outbox WHERE org=? AND agent_id=?').run(org,row.agent_id);
-      }
-      catch(error){db.prepare('UPDATE agent_end_outbox SET claimed_at=NULL WHERE org=? AND agent_id=?').run(org,row.agent_id);pending.push({agent:row.agent_id,error:error.message});}
-    }
-    return pending;
-  }finally{db.close();}
-}
 /** Mint and retain intent before any network call. Offline declarations keep their immutable id for sync. */
 export function declareAgentIntent({root,org,server,profiles,profile,key,machine=null,refresh=true}) {
   const intended=resolveAgentProfile(profiles,profile),stable=`${server}/${org}/${key}`,db=store(root);
@@ -121,16 +94,6 @@ export function declareAgentIntent({root,org,server,profiles,profile,key,machine
     return {id:row.id,key:row.key,baseKey:stable,declared:!!row.declared,intended:refresh?intended:JSON.parse(row.profile_json),fresh,org};
   }finally{db.close();}
 }
-function adoptAgentIntent(root,intent,identity){
-  const db=store(root);try{
-    db.exec('BEGIN IMMEDIATE');
-    const existing=db.prepare('SELECT * FROM agent_intents WHERE org=? AND id=?').get(intent.org,identity.id);
-    if(!existing)db.prepare('INSERT INTO agent_intents(org,id,key,profile_ref,profile_json,declared,created_at) VALUES (?,?,?,?,?,1,?)').run(intent.org,identity.id,`${intent.baseKey}/adopted/${identity.id}`,identity.profile,JSON.stringify(intent.intended),Date.now());
-    db.prepare('UPDATE agent_declaration_heads SET agent_id=? WHERE org=? AND key=?').run(identity.id,intent.org,intent.baseKey);
-    db.exec('COMMIT');
-    return {...intent,id:identity.id,key:existing?.key??`${intent.baseKey}/adopted/${identity.id}`,declared:true};
-  }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
-}
 function nextAgentGeneration(root,intent,machine){
   const db=store(root);try{
     db.exec('BEGIN IMMEDIATE');
@@ -145,125 +108,6 @@ function nextAgentGeneration(root,intent,machine){
     db.exec('COMMIT');return {...intent,id,key,declared:false};
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
 }
-function synchronizeIntent(intent,{root,context,body}) {
-  let identity;
-  if(intent.declared)identity=agentDoor('get',[intent.id],{context}).data;
-  else {
-    try{identity=agentDoor('declare',[{...body,id:intent.id},digest(intent.key)],{context}).data;}
-    catch(error){if(error.code==='idempotency_conflict')identity=agentDoor('get',[intent.id],{context}).data;else throw error;}
-    identity=agentDoor('get',[intent.id],{context}).data;
-    const db=store(root);try{db.prepare('UPDATE agent_intents SET declared=1 WHERE org=? AND id=?').run(intent.org,intent.id);}finally{db.close();}
-  }
-  if(identity.state!=='active')throw new Error(`agent ${identity.path} is ${identity.state}: ${identity.suspension_reason??identity.end_reason??'unavailable'}`);
-  if(body.profile!==identity.profile)identity=agentDoor('profile',[identity.id,body.profile,identity.revision],{context}).data;
-  if(body.parent!==undefined&&body.parent!==identity.parent)identity=agentDoor('reparent',[identity.id,body.parent,identity.revision],{context}).data;
-  return identity;
-}
-export function ensureRootAgent(options) {
-  const {root,org,context,profile=options.profiles.default?'default':null}=options;
-  if(!profile)throw new Error('declare the Org root with a named profile before launching card agents');
-  let intent=declareAgentIntent({...options,profile,key:'root'});
-  let identity;
-  try{identity=agentDoor('root',[],{context}).data;}
-  catch(error){
-    if(error.status!==404)throw error;
-    try{identity=synchronizeIntent(intent,{root,context,body:{name:basename(root),profile,root:true}});}
-    catch(conflict){if(conflict.status!==409)throw conflict;identity=agentDoor('root',[],{context}).data;}
-  }
-  if(identity.state==='ended'){
-    if(intent.id!==identity.id)intent=adoptAgentIntent(root,intent,identity);
-    intent=nextAgentGeneration(root,intent,options.machine);
-    identity=synchronizeIntent(intent,{root,context,body:{name:identity.name,profile,root:true}});
-  }
-  if(intent.id!==identity.id)adoptAgentIntent(root,intent,identity);
-  // Another admitted manager may have declared the root first; its server id remains authoritative.
-  if(identity.state!=='active')throw new Error('the Org root agent is not active');
-  return identity;
-}
-/** Cold starts and relaunches use the same local intent and public declaration. Reviewer and implementer keys differ. */
-export function ensureCardAgent(options) {
-  const {root,org,profiles,profile,card,role,sponsor=null,context}=options;
-  const assigned=activeAgentAssignments(root).find(item=>item.org===org&&item.kind==='card'&&item.target===card&&item.role===role);
-  // A locally minted agent that has not reached Teams yet is declared below under the same key and id.
-  if(assigned&&agentIntent(root,org,assigned.agent_id)?.declared!==0) {
-    const identity=agentDoor('get',[assigned.agent_id],{context}).data;
-    if(identity.state==='active'){
-      const intended=resolveAgentProfile(profiles,identity.profile);
-      const db=store(root);try{db.prepare('UPDATE agent_intents SET profile_ref=?,profile_json=? WHERE org=? AND id=?').run(identity.profile,JSON.stringify(intended),org,identity.id);}finally{db.close();}
-      return {identity,intended,assignment:assigned.id,
-        assignments:activeAgentAssignments(root).filter(item=>item.org===org&&item.agent_id===identity.id),org};
-    }
-    if(identity.state!=='ended')throw new Error(`card's assigned agent is ${identity.state}`);
-    finishAgentAssignment(root,org,assigned.id,`agent ${identity.id} is ended`);
-  }
-  let intent=declareAgentIntent({...options,key:`card/${card}/${role}`});
-  const rootAgent=ensureRootAgent({...options,profile:profiles.default?'default':profile});
-  if(!intent.declared){
-    const existing=agentDoor('find',[`${card}-${role}`,rootAgent.id],{context}).data;
-    if(existing){
-      intent=adoptAgentIntent(root,intent,existing);
-    }
-  }
-  if(intent.declared&&agentDoor('get',[intent.id],{context}).data.state==='ended')intent=nextAgentGeneration(root,intent,options.machine);
-  const identity=synchronizeIntent(intent,{root,context,body:{name:`${card}-${role}`,parent:rootAgent.id,sponsor,profile,...(options.starterSession?{starter_session:options.starterSession}:{})}});
-  const assignment=assignAgent(root,org,identity.id,{kind:'card',target:card,role});
-  return {identity,intended:intent.intended,assignment,assignments:[{kind:'card',target:card,role}],org};
-}
-/** Starting a named profile declares its standing agent; bindings are sessions of that identity. */
-export function ensureProfileAgent(options){
-  const {root,org,profiles,profile,context,agent:declared=null,declarations={}}=options;
-  if(declared&&declared!==profile){
-    // A declared agent (the IR's `agents`) runs as a shared profile under its own identity and parent.
-    const decl=declarations[declared]??{};
-    const rootAgent=ensureRootAgent({...options,profile:profiles.default?'default':profile});
-    const parent=decl.parent?ensureProfileAgent({...options,profile:declarations[decl.parent]?.profile??decl.parent,agent:decl.parent}).identity:rootAgent;
-    let declaration=declareAgentIntent({...options,key:`agent/${declared}`});
-    if(!declaration.declared){
-      const existing=agentDoor('find',[declared,parent.id],{context}).data;
-      if(existing)declaration=adoptAgentIntent(root,declaration,existing);
-    }
-    if(declaration.declared&&agentDoor('get',[declaration.id],{context}).data.state==='ended')declaration=nextAgentGeneration(root,declaration,options.machine);
-    const identity=synchronizeIntent(declaration,{root,context,body:{name:declared,parent:parent.id,profile,...(decl.sponsor?{sponsor:decl.sponsor}:{})}});
-    const assignment=assignAgent(root,org,identity.id,{kind:'agent',target:declared,role:'declared'});
-    return {identity,intended:declaration.intended,assignment,assignments:[{kind:'agent',target:declared,role:'declared'}],org};
-  }
-  const rootAgent=ensureRootAgent({...options,profile:profiles.default?'default':profile});
-  let identity=rootAgent,intent;
-  if(profile===(profiles.default?'default':profile))intent=agentIntent(root,org,identity.id)?.profile;
-  else{
-    // Profile ancestry and agent parentage are the same intended narrowing tree.
-    // Resolve first to reject a cycle before declaring any parent along it.
-    resolveAgentProfile(profiles,profile);
-    const parentProfile=profiles[profile].parent;
-    const parent=parentProfile?ensureProfileAgent({...options,profile:parentProfile}).identity:rootAgent;
-    let declaration=declareAgentIntent({...options,key:`profile/${profile}`});
-    if(!declaration.declared){
-      const existing=agentDoor('find',[profile,parent.id],{context}).data;
-      if(existing)declaration=adoptAgentIntent(root,declaration,existing);
-    }
-    if(declaration.declared&&agentDoor('get',[declaration.id],{context}).data.state==='ended')declaration=nextAgentGeneration(root,declaration,options.machine);
-    identity=synchronizeIntent(declaration,{root,context,body:{name:profile,parent:parent.id,profile}});
-    intent=declaration.intended;
-  }
-  const assignment=assignAgent(root,org,identity.id,{kind:'profile',target:profile,role:'profile'});
-  return {identity,intended:intent??resolveAgentProfile(profiles,profile),assignment,assignments:[{kind:'profile',target:profile,role:'profile'}],org};
-}
-/** An explicit fork declares a child; a routine helper launch keeps its starter's identity. */
-export function ensureForkAgent(options) {
-  const {root,org,profiles,parent,session,name,key,context}=options;
-  const managed=agentDoor('management',[parent],{context}).data;
-  const source=agentDoor('session',[session],{context}).data;
-  if(source.agent?.id!==parent)throw new Error('fork source is not owned by the declared parent');
-  const parentIntent=agentIntent(root,org,parent)?.profile??resolveAgentProfile(profiles,managed.profile);
-  let intent=declareAgentIntent({...options,profile:managed.profile,key:`fork/${parent}/${key}`,refresh:false});
-  if(intent.declared&&agentDoor('get',[intent.id],{context}).data.state==='ended')throw new Error('this fork identity ended; declare a new fork key');
-  // The snapshot copies configuration only. Memory stays the new child's own empty state.
-  const intended=structuredClone(intent.fresh?parentIntent:intent.intended);
-  const db=store(root);try{db.prepare('UPDATE agent_intents SET profile_json=? WHERE org=? AND id=?').run(JSON.stringify(intended),org,intent.id);}finally{db.close();}
-  const identity=synchronizeIntent(intent,{root,context,body:{name,parent,profile:managed.profile,starter_session:session}});
-  const assignment=assignAgent(root,org,identity.id,{kind:'fork',target:session,role:key});
-  return {identity,intended,assignment,assignments:[{kind:'fork',target:session,role:key}],org};
-}
 export function agentRunForKey(root,org,agent,key) {
   const db=store(root);try{return db.prepare('SELECT * FROM agent_runs WHERE org=? AND agent_id=? AND run_id=? ORDER BY rowid DESC LIMIT 1').get(org,agent,key)??null;}finally{db.close();}
 }
@@ -272,20 +116,20 @@ const endedHere=(root,org,id)=>{const db=store(root);try{return !!db.prepare('SE
 function recordDeclaration(root,org,id,declaration){
   const db=store(root);try{db.prepare('UPDATE agent_intents SET declaration_json=? WHERE org=? AND id=? AND declared=0').run(JSON.stringify(declaration),org,id);}finally{db.close();}
 }
-/** The identity a run starts as without asking Teams: the daemon-minted id and retained intent. An identity not yet
- * declared is declared later under the same id (synchronizeLocalAgents). Nothing is granted from this local record;
- * `identity.synced` says whether Teams has the declaration, and the record's own `synced: false` that Teams was not read. */
+/** The identity a run starts as, never asking Teams: the daemon-minted id and retained intent. Its declaration is handed
+ * to this machine's daemon (handOffAgents), which declares it to Teams under the same id. Nothing is granted from this
+ * local record; `identity.synced` says whether the declaration has been handed on. */
 function localAgent(options,{key,name,declaration,assignment,parent=null,starter}){
   const {root,org,server,profiles,profile,machine=null}=options;
   const rootProfile=profiles.default?'default':profile;
   const rootIntent=declareAgentIntent({root,org,server,profiles,profile:rootProfile,key:'root',machine,refresh:false});
-  recordDeclaration(root,org,rootIntent.id,{kind:'root',profile:rootProfile});
+  recordDeclaration(root,org,rootIntent.id,{kind:'root',profile:rootProfile,name:basename(root),parent:null});
   let intent=key==='root'?rootIntent:declareAgentIntent({root,org,server,profiles,profile,key,machine});
-  // An agent Teams ended is never started again: its end, once synchronized, is on its runs here (synchronizeAgentEnds),
-  // and the key's next generation is minted in its place, with fresh memory.
+  // An agent ended here is never started again: its end is on its runs here (handOffAgents), and the key's next generation
+  // is minted in its place, with fresh memory.
   if(key!=='root'&&endedHere(root,org,intent.id))intent=nextAgentGeneration(root,intent,machine);
-  if(key!=='root')recordDeclaration(root,org,intent.id,declaration);
   const above=parent??(key==='root'?null:{id:rootIntent.id,path:basename(root)});
+  if(key!=='root')recordDeclaration(root,org,intent.id,{...declaration,name,parent:above?.id??null});
   const identity={id:intent.id,kind:'agent',org,name,path:above?`${above.path}/${name}`:name,parent:above?.id??null,
     lineage:{starter},sponsor:options.sponsor??null,explicit_sponsor:options.sponsor??null,profile,state:'active',
     synced:!!intent.declared,main_session:null,revision:0};
@@ -356,38 +200,61 @@ function adoptLocalOrg(root,scope){
     db.exec('COMMIT');
   }catch(error){try{db.exec('ROLLBACK');}catch{}throw error;}finally{db.close();}
 }
-const DECLARE_ATTEMPTS=6;
-// A sync claim outlasts one Teams call chain (each door call bounded at 25-60 s).
-const SYNC_CLAIM_MS=600000;
-/** Declare every locally minted identity once Teams is reachable, under the id its sessions already carry. */
-export function synchronizeLocalAgents({root,profiles,context,machine=null,declarations={}}){
+/** An explicit fork's child, declared under its parent and started by the fork's source session; the source must be a
+ * session this home ran for the parent. Local: the child's declaration is handed on like any other (handOffAgents). */
+export function localForkAgent(options){
+  const {root,org,profiles,parent,session,name,key}=options;
+  const owner=agentRunForSession(root,[session]);
+  if(owner?.agent_id!==parent)throw new Error('fork source is not a session of the declared parent');
+  const parentIntent=agentIntent(root,org,parent);
+  if(!parentIntent)throw new Error('fork parent has no retained profile intent here');
+  let intent=declareAgentIntent({...options,profile:parentIntent.profile_ref,key:`fork/${parent}/${key}`,refresh:false});
+  if(endedHere(root,org,intent.id))throw new Error('this fork identity ended; declare a new fork key');
+  // The snapshot copies configuration only. Memory stays the new child's own empty state.
+  const intended=structuredClone(intent.fresh?parentIntent.profile:intent.intended);
+  const db=store(root);try{db.prepare('UPDATE agent_intents SET profile_json=? WHERE org=? AND id=?').run(JSON.stringify(intended),org,intent.id);}finally{db.close();}
+  recordDeclaration(root,org,intent.id,{kind:'fork',profile:parentIntent.profile_ref,name,parent,starterSession:session});
+  const assignment=assignAgent(root,org,intent.id,{kind:'fork',target:session,role:key});
+  const identity={id:intent.id,kind:'agent',org,name,path:name,parent,lineage:{starter:{kind:'session',id:session}},sponsor:null,explicit_sponsor:null,
+    profile:parentIntent.profile_ref,state:'active',synced:!!intent.declared,main_session:null,revision:0};
+  return {identity,intended,assignment,assignments:[{kind:'fork',target:session,role:key}],org,synced:false};
+}
+/**
+ * Hand this home's agent declarations and ends to this machine's daemon (`harness.v1.agents.declare|end`, its local
+ * socket), which declares and ends them in Teams (D137: identity is Teams' job, never the dispatcher's or the gateway's).
+ * Local only: a daemon not running keeps them here for the next hand-off. Answers what could not be handed on.
+ */
+export function handOffAgents(root,{context=process.env.SUPERCODE_CONTEXT}={}){
   const scope=agentScope(context);if(scope.offline)return [];
   adoptLocalOrg(root,scope);
-  const db=store(root);let rows;
-  try{rows=db.prepare('SELECT * FROM agent_intents WHERE org=? AND declared=0 AND declaration_json IS NOT NULL AND declare_failed_at IS NULL AND declare_next_at<=? ORDER BY created_at').all(scope.org,Date.now());}finally{db.close();}
-  const pending=[],base={root,org:scope.org,server:scope.server,profiles,context,machine};
+  const waiting=[];
+  let db=store(root),rows,ends;
+  try{
+    rows=db.prepare('SELECT * FROM agent_intents WHERE org=? AND declared=0 AND declaration_json IS NOT NULL ORDER BY created_at').all(scope.org);
+    ends=db.prepare('SELECT * FROM agent_end_outbox WHERE org=? ORDER BY created_at LIMIT 100').all(scope.org);
+  }finally{db.close();}
   for(const row of rows){
     const declaration=JSON.parse(row.declaration_json);
-    // claimed by compare-and-set on its own next attempt time, set ahead only while it is due: a second pass skips it
-    const claim=store(root);let claimed;
-    try{claimed=claim.prepare('UPDATE agent_intents SET declare_next_at=? WHERE org=? AND id=? AND declared=0 AND declare_failed_at IS NULL AND declare_next_at<=?').run(Date.now()+SYNC_CLAIM_MS,row.org,row.id,Date.now()).changes===1;}finally{claim.close();}
-    if(!claimed)continue;
+    const body={org:scope.org,id:row.id,name:declaration.name??declaration.profile,parent:declaration.parent??null,profile:declaration.profile,
+      ...(declaration.kind==='root'?{root:true}:{}),...(declaration.sponsor?{sponsor:declaration.sponsor}:{}),
+      ...(declaration.starterSession?{starter_session:declaration.starterSession}:{}),key:digest(row.key)};
+    const reply=runtimeDoor(null,'harness.v1.agents.declare',body,{timeout:15_000});
+    if(reply.code!==0){waiting.push({agent:row.id,error:`not handed to this machine's daemon: ${reply.stderr.trim().split('\n').at(-1)}`});break;}
+    db=store(root);try{db.prepare('UPDATE agent_intents SET declared=1 WHERE org=? AND id=?').run(scope.org,row.id);}finally{db.close();}
+  }
+  for(const row of ends){
+    db=store(root);let active;
+    try{active=db.prepare("SELECT 1 FROM agent_assignments WHERE org=? AND agent_id=? AND state='active'").get(scope.org,row.agent_id);if(active)db.prepare('DELETE FROM agent_end_outbox WHERE org=? AND agent_id=?').run(scope.org,row.agent_id);}finally{db.close();}
+    if(active)continue;
+    const reply=runtimeDoor(null,'harness.v1.agents.end',{org:scope.org,agent:row.agent_id,reason:row.reason,key:digest(`${scope.org}/${row.agent_id}/end/${row.created_at}`)},{timeout:15_000});
+    if(reply.code!==0){waiting.push({agent:row.agent_id,error:`end not handed to this machine's daemon: ${reply.stderr.trim().split('\n').at(-1)}`});break;}
+    db=store(root);
     try{
-      if(declaration.kind==='root')ensureRootAgent({...base,profile:declaration.profile});
-      else if(declaration.kind==='card')ensureCardAgent({...base,profile:declaration.profile,card:declaration.card,role:declaration.role,sponsor:declaration.sponsor,starterSession:declaration.starterSession});
-      else if(declaration.kind==='profile')ensureProfileAgent({...base,profile:declaration.profile});
-      else if(declaration.kind==='declared')ensureProfileAgent({...base,profile:declaration.profile,agent:declaration.agent,declarations});
-    }catch(error){
-      // Teams unreachable is no answer about this declaration: the rest wait for the next pass, and no attempt is counted.
-      if(teamsUnavailable(error)){const db=store(root);try{db.prepare('UPDATE agent_intents SET declare_next_at=? WHERE org=? AND id=?').run(row.declare_next_at??0,row.org,row.id);}finally{db.close();}return [...pending,{agent:row.id,error:error.message}];}
-      // A refusal is this declaration's own: asked again after a doubling wait (one minute, at most an hour), and after
-      // DECLARE_ATTEMPTS refusals left failed, said once, and never asked again.
-      const made=Number(row.declare_attempts??0)+1,failed=made>=DECLARE_ATTEMPTS,db=store(root);
-      try{db.prepare('UPDATE agent_intents SET declare_attempts=?,declare_next_at=?,declare_failed_at=?,declare_error=? WHERE org=? AND id=?').run(made,Date.now()+Math.min(3600000,60000*2**(made-1)),failed?Date.now():null,String(error.message).slice(0,500),row.org,row.id);}finally{db.close();}
-      pending.push({agent:row.id,error:error.message,attempts:made,failed});
-    }
+      db.prepare('UPDATE agent_runs SET ended_at=COALESCE(ended_at,?),end_reason=COALESCE(end_reason,?) WHERE org=? AND agent_id=?').run(Date.now(),row.reason,scope.org,row.agent_id);
+      db.prepare('DELETE FROM agent_end_outbox WHERE org=? AND agent_id=?').run(scope.org,row.agent_id);
+    }finally{db.close();}
   }
-  return pending;
+  return waiting;
 }
 /** A managed runtime may report its native id after opening. Keep the lease pointer out of the catalogue. */
 export function recordNativeAgentSession(root,runtimeRef,session) {

package/board/agent-declarations.mjs

@@ -1,5 +1,7 @@
-// Consume the card-creation intent after the board transaction; retries reuse the daemon-minted id.
-import { agentScope, teamsUnavailable, ensureCardAgent, localCardAgent, finishAgentAssignment } from '../agents.mjs';
+// Consume the card-creation intent after the board transaction; retries reuse the daemon-minted id. The card's agent is
+// minted and recorded here, and its declaration handed to this machine's daemon, which declares it in Teams: whoever ran
+// the effect (the creating command, or a delivery pass retrying it) makes no Teams call (D137).
+import { agentScope, localCardAgent, finishAgentAssignment, activeAgentAssignments, handOffAgents } from '../agents.mjs';
 import { event, json, tx, view } from './store.mjs';
 import { workflowFor } from './workflow.mjs';
 
@@ -15,15 +17,26 @@ export function declareCardAgentEffect(board,effect) {
     const context=effect.context??process.env.SUPERCODE_CONTEXT,scope=agentScope(context);
     const options={root:board.root,org:scope.org,server:scope.server,profiles:entry.profiles,
       profile,card:effect.id,role:effect.role,sponsor:task.sponsor??null,context,starterSession:effect.starter_session};
-    // Without a reachable Teams the role's identity is minted here; the board's reconcile declares it later.
-    let agent;
-    if(scope.offline)agent=localCardAgent(options);
-    else try{agent=ensureCardAgent(options);}catch(error){if(!teamsUnavailable(error))throw error;agent=localCardAgent(options);}
+    const agent=localCardAgent(options);
     if(task.archived||['done','cancelled','archived'].includes(task.status))finishAgentAssignment(board.root,scope.org,agent.assignment,`card ${effect.id} ${task.status}`);
-    tx(board,db=>event(db,effect.id,'agent_declared',{agent:agent.identity.id,org:scope.org,role:effect.role,profile,assignment:agent.assignment,synced:agent.synced!==false}));
+    // A daemon not running keeps the declaration here; every delivery pass hands it on again.
+    const waiting=handOffAgents(board.root,{context});
+    tx(board,db=>event(db,effect.id,'agent_declared',{agent:agent.identity.id,org:scope.org,role:effect.role,profile,assignment:agent.assignment,handed_to_machine:!waiting.length}));
     return true;
   }catch(error) {
     if(!told.has(error.message))tx(board,db=>event(db,effect.id,'agent_declaration_pending',{role:effect.role,profile,reason:error.message}));
     return false;
   }
 }
+
+/** The card agents of `ids` whose cards are done, cancelled or archived end their assignments, and an agent left with
+ * none has its end handed to this machine's daemon: run by the verb that closed the card, so no dispatcher is needed. */
+export function endFinishedAgents(board,ids){
+  const wanted=new Set(ids.map(String)),assignments=activeAgentAssignments(board.root).filter(item=>item.kind==='card'&&wanted.has(String(item.target)));
+  if(!assignments.length)return [];
+  for(const assignment of assignments){
+    const task=view(board,db=>db.prepare('SELECT t.status,c.archived FROM tasks t JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(assignment.target));
+    if(task&&(task.archived||['done','cancelled','archived'].includes(task.status)))finishAgentAssignment(board.root,assignment.org,assignment.id,`card ${assignment.target} ${task.archived?'archived':task.status}`);
+  }
+  return handOffAgents(board.root);
+}

package/board/dispatch.mjs

@@ -20,7 +20,7 @@ import { readMachineFleet } from './machine-fleet.mjs';
 let fleetRoot = null;
 import { inspectCompletionEvidence, noCodeChange, openReviewPullRequests, reviewDue, withCompletionEvidence, reviewCandidate, workflowRevision, retainWorkflowTick } from './ci.mjs';
 import { runtimeDoor } from './runtime-door.mjs';
-import { agentScope, localCardAgent, localReaderContext, localAgentSessions, synchronizeLocalAgents, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds, agentRunForSession } from '../agents.mjs';
+import { agentScope, localCardAgent, localReaderContext, localAgentSessions, runBudgetRefusal, runsAwaitingUsage, recordRunUsage, agentPreamble, agentEnvironment, recordAgentRun, activeAgentAssignments,finishAgentAssignment,handOffAgents, agentRunForSession } from '../agents.mjs';
 import { materializeAgentHome } from '../agent-home.mjs';
 import { memorySnapshotSync } from '../hermes-cli.mjs';
 import { createRequire } from 'node:module';
@@ -1302,15 +1302,14 @@ export function reconcileCallerLaunch(board, sid) {
   }
 }
 
-/** The board's agent records: each run kept in the agent store, identities minted offline declared, ends, and usage.
- * Teams I/O, so it runs in the delivery pass (`deliver`), never in a dispatch round. A run's session is bound to its
- * agent by the machine that runs it, from the agent its launch named (the connector's bindAgentSessions), never here. */
-function synchronizeAgents(board, report, entry) {
+/** The board's agent records: each run kept in the agent store, closed cards' assignments ended, declarations and ends
+ * handed to this machine's daemon, and usage read from each machine's own doors. No Teams call: the daemon declares and
+ * ends agents and binds their sessions (D137). It runs in the delivery pass (`deliver`), never in a dispatch round. */
+function synchronizeAgents(board, report) {
   // A delayed launch receipt/catalogue event binds the same declared agent, never another identity.
   // A resumed session is held by its newest run; an earlier run of the same session no longer owns it.
   const agentRuns=[...new Map(view(board,db=>db.prepare("SELECT id,task_id,metadata,ended_at FROM task_runs WHERE json_extract(metadata,'$.supercode.agent_id') IS NOT NULL ORDER BY id").all())
     .map(row=>{const session=json(row.metadata,{})?.supercode;return [session?.session_id?addressOf(session):`run:${row.id}`,row];})).values()];
-  const orgs=new Map();
   for(const row of agentRuns){
     const session=json(row.metadata,{})?.supercode;
     if(!session?.session_id||!session.agent_org)continue;
@@ -1330,16 +1329,7 @@ function synchronizeAgents(board, report, entry) {
     // One run whose session another agent already owns is that card's problem, said on it; the round goes on for the rest.
     try{recordAgentRun(board.root,session.agent_org,session.agent_id,{session:ref,machine:session.machine,run:row.id});}
     catch(error){report.queued.push([row.task_id,`run ${row.id}: ${error.message}`]);continue;}
-    orgs.set(session.agent_org,session.agent_context);
   }
-  // Identities minted while Teams was absent are declared under their ids before their sessions are joined.
-  const context=process.env.SUPERCODE_CONTEXT;
-  let scope;try{scope=agentScope(context);}catch(error){scope={offline:true};report.failed.push(['agents',`agent declarations wait: ${error.message}`]);}
-  if(!scope.offline){
-    orgs.set(scope.org,orgs.get(scope.org)??context);
-    for(const pending of synchronizeLocalAgents({root:board.root,profiles:entry.profiles,context}))(pending.failed?report.failed:report.queued).push([pending.agent,`agent declaration ${pending.failed?`failed for good after ${pending.attempts} refusals`:'pending'}: ${pending.error}`]);
-  }
-  orgs.delete('local');
   // G3: an ended run's session usage, read once from its harness's own records on its machine
   for(const org of new Set(agentRuns.map(row=>json(row.metadata,{})?.supercode?.agent_org).filter(Boolean))){
     let read=0;
@@ -1361,7 +1351,9 @@ function synchronizeAgents(board, report, entry) {
     const task=getTaskNow(board,assignment.target);
     if(task&&(task.archived||['done','cancelled'].includes(task.status)))finishAgentAssignment(board.root,assignment.org,assignment.id,`card ${assignment.target} ${task.archived?'archived':task.status}`);
   }
-  for(const [org,context] of orgs)for(const pending of synchronizeAgentEnds(board.root,org,{context}))report.queued.push([pending.agent,`agent end synchronization pending: ${pending.error}`]);
+  // What a creating or closing verb could not hand on (no daemon running then) is handed on here.
+  try{for(const pending of handOffAgents(board.root))report.queued.push([pending.agent,pending.error]);}
+  catch(error){report.queued.push(['agents',`agent hand-off waits: ${error.message}`]);}
 }
 
 function reconcileLaunches(board, fleet, report, entry, effects, settings, lanes) {
@@ -2657,7 +2649,7 @@ export async function deliver({ root, slugs = null }) {
       tx(board, (db) => queueBoardMail(db)); phase('mail');
       report.effects = await runEffects(board, [], { pending: true }); phase('effects');
       await notify(board, fleet, report, entry); phase('notify');
-      synchronizeAgents(board, report, entry); phase('agents');
+      synchronizeAgents(board, report); phase('agents');
       report.effects_failed = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NOT NULL').get().n);
       report.effects_waiting = Number(board.db.prepare('SELECT COUNT(*) AS n FROM supercode_effects WHERE failed_at IS NULL').get().n);
     } catch (error) { report.error = error.message; }

package/board/engine.mjs

@@ -418,6 +418,8 @@ export async function act(board, id, name, { roles = null, payload = {}, extra =
     return r;
   });
   await runEffects(board, result.effects);
+  // A card this verb closed ends its agents' assignments; the verb hands the ends on itself (agent-declarations.mjs).
+  if (result.moved) { const { endFinishedAgents } = await import('./agent-declarations.mjs'); endFinishedAgents(board, [id]); }
   return { from: result.from, to: result.to, moved: result.moved, ...(result.commentId ? { commentId: result.commentId } : {}) };
 }
 
@@ -445,6 +447,7 @@ export async function requestStateMany(board, ids, payload = {}) {
     return { results, effects };
   });
   await runEffects(board, result.effects);
+  { const { endFinishedAgents } = await import('./agent-declarations.mjs'); endFinishedAgents(board, targets); }
   return result.results;
 }
 

package/index.d.ts

@@ -110,30 +110,28 @@ export function agentStateHome(root: Path, org: string, id: string): Path;
 export function recordNativeAgentSession(root: Path, runtimeRef: string, session: string): Record<string, unknown> | null;
 export function materializeAgentHome(root: Path, org: string, id: string, profile: Profile): Path;
 export function declareAgentIntent(options: {root: Path; org: string; server: string; profiles: Record<string, Profile>; profile: string; key: string; machine?: string | null}): Record<string, unknown>;
-export function ensureRootAgent(options: {root: Path; org: string; server: string; profiles: Record<string, Profile>; profile?: string; context?: string; machine?: string | null}): AgentIdentity;
-export function ensureCardAgent(options: {root: Path; org: string; server: string; profiles: Record<string, Profile>; profile: string; card: string; role: string; sponsor?: string | null; context?: string; machine?: string | null; starterSession?: string | null}): {identity: AgentIdentity; intended: ReturnType<typeof resolveAgentProfile>; assignment: string; assignments: Array<Record<string, unknown>>; org: string};
-export function ensureProfileAgent(options: {root: Path; org: string; server: string; profiles: Record<string, Profile>; profile: string; context?: string; machine?: string | null}): ReturnType<typeof ensureCardAgent>;
-export function ensureForkAgent(options: {root: Path; org: string; server: string; profiles: Record<string, Profile>; parent: string; session: string; name: string; key: string; context?: string; machine?: string | null}): ReturnType<typeof ensureCardAgent>;
 export function agentRunForKey(root: Path, org: string, agent: string, key: string): Record<string, unknown> | null;
 export function agentIntent(root: Path, org: string, id: string): Record<string, unknown> | null;
 export function assignAgent(root: Path, org: string, id: string, assignment: {kind: string; target: string; role: string}): string;
 export function reassignAgent(root: Path, org: string, assignment: string, to: string, options?: {context?: string}): Record<string, unknown>;
 export function activeAgentAssignments(root: Path): Array<Record<string, unknown>>;
 export function finishAgentAssignment(root: Path, org: string, assignment: string, reason: string): void;
-export function synchronizeAgentEnds(root: Path, org: string, options?: {context?: string}): Array<{agent: string; error: string}>;
 export function recordAgentRun(root: Path, org: string, id: string, run: {session: string; machine?: string | null; run: string | number; profile?: unknown; main?: boolean; starterSession?: string | null}): void;
 export function agentRunForSession(root: Path, references: Array<string | null | undefined>): Record<string, unknown> | null;
-export function agentPreamble(agent: ReturnType<typeof ensureCardAgent>, options?: {main?: boolean; previous?: Array<{session: string; machine?: string | null; ended_at?: number | null; end_reason?: string | null}>}): string;
-export function agentEnvironment(agent: ReturnType<typeof ensureCardAgent>, options: {root: Path; context?: string; session?: string | null; main?: boolean}): Record<string, string>;
+export function agentPreamble(agent: LocalAgent, options?: {main?: boolean; previous?: Array<{session: string; machine?: string | null; ended_at?: number | null; end_reason?: string | null}>}): string;
+export function agentEnvironment(agent: LocalAgent, options: {root: Path; context?: string; session?: string | null; main?: boolean}): Record<string, string>;
 /** The Org for agent identity, read from this home's selected context without a request; `offline` when none is selected. Throws when a named context cannot be read. */
 export function agentScope(context?: string): {server: string; org: string; principal: string | null; offline?: true; reason?: string};
-export function teamsUnavailable(error: unknown): boolean;
 /** The identity a run starts as without asking Teams; `identity.synced` is false until Teams has its declaration, made later under the same id. */
-export function localCardAgent(options: Parameters<typeof ensureCardAgent>[0]): ReturnType<typeof ensureCardAgent> & {synced: false};
-export function localProfileAgent(options: Parameters<typeof ensureProfileAgent>[0]): ReturnType<typeof ensureCardAgent> & {synced: false};
-export function localAgentRecord(root: Path, org: string, id: string): ReturnType<typeof ensureCardAgent> | null;
+/** A local agent: its daemon-minted id, retained intent and assignments. */
+export type LocalAgent = {identity: AgentIdentity; intended: ReturnType<typeof resolveAgentProfile>; assignment: string; assignments: Array<Record<string, unknown>>; org: string};
+export function localCardAgent(options: {root: Path; org: string; server: string; profiles: Record<string, Profile>; profile: string; card: string; role: string; sponsor?: string | null; machine?: string | null; starterSession?: string | null}): LocalAgent & {synced: false};
+export function localProfileAgent(options: {root: Path; org: string; server: string; profiles: Record<string, Profile>; profile: string; machine?: string | null; agent?: string | null; declarations?: Record<string, unknown>}): LocalAgent & {synced: false};
+export function localForkAgent(options: {root: Path; org: string; server: string; profiles: Record<string, Profile>; parent: string; session: string; name: string; key: string}): LocalAgent;
+/** Hand this home's agent declarations and ends to this machine's daemon, which declares and ends them in Teams. Answers what could not be handed on. */
+export function handOffAgents(root: Path, options?: {context?: string}): Array<{agent: string; error: string}>;
+export function localAgentRecord(root: Path, org: string, id: string): LocalAgent | null;
 export function localAgentSessions(root: Path, org: string, id: string): Array<{session: string; machine: string | null; ended_at: number | null; end_reason: string | null}>;
-export function synchronizeLocalAgents(options: {root: Path; profiles: Record<string, Profile>; context?: string; machine?: string | null}): Array<{agent: string; error: string}>;
 export function agentProfileMismatch(intent: unknown, resolved: unknown): import('@volter/teams/agent-profile').ProfileComparison;
 
 export type ChatType = 'dm' | 'group' | 'channel' | 'thread';

package/index.mjs

@@ -39,5 +39,5 @@ export { hermesAccess, recordIncident, hermesToolEnv, hermesInstall } from './he
 export { holdGatewayLock, gatewayLockHeld, acquireTokenLock, releaseTokenLock, looksLikeGateway, TOKEN_SCOPES } from './hermes-locks.mjs';
 
 export { resolveAgentProfile, profileDifferences, sessionAgent } from "./agent-profiles.mjs";
-export { agentScope, teamsUnavailable, localCardAgent, localProfileAgent, localAgentRecord, localAgentSessions, synchronizeLocalAgents, declareAgentIntent, ensureRootAgent, ensureCardAgent,ensureProfileAgent,ensureForkAgent,agentRunForKey, agentIntent, assignAgent, reassignAgent,activeAgentAssignments,finishAgentAssignment,synchronizeAgentEnds,recordAgentRun, recordNativeAgentSession, agentRunForSession,agentPreamble, agentEnvironment, agentProfileMismatch } from "./agents.mjs";
+export { agentScope, localCardAgent, localProfileAgent, localAgentRecord, localAgentSessions, declareAgentIntent, agentRunForKey, agentIntent, assignAgent, reassignAgent, activeAgentAssignments, finishAgentAssignment, recordAgentRun, recordNativeAgentSession, agentRunForSession, agentPreamble, agentEnvironment, agentProfileMismatch, localForkAgent, handOffAgents} from "./agents.mjs";
 export { agentStateHome,materializeAgentHome } from './agent-home.mjs';

package/loop.mjs

@@ -24,7 +24,7 @@ import { harnessHomes } from './mcp/verbs.mjs';
 import { checkMonitor, runJobScript } from './gates.mjs';
 import { startBoard } from './board.mjs';
 import { SenderIdentityRecord } from '@volter/teams/sender-identity';
-import { agentDoor,agentScope,teamsUnavailable,ensureProfileAgent,localProfileAgent,localAgentRecord,localAgentSessions,synchronizeLocalAgents,ensureForkAgent,agentRunForKey,agentIntent,agentPreamble,agentEnvironment,recordAgentRun,recordNativeAgentSession,agentRunForSession } from './agents.mjs';
+import { agentScope,localProfileAgent,localAgentRecord,localAgentSessions,localForkAgent,handOffAgents,localReaderContext,agentRunForKey,agentPreamble,agentEnvironment,recordAgentRun,recordNativeAgentSession,agentRunForSession } from './agents.mjs';
 import { materializeAgentHome } from './agent-home.mjs';
 import { localMachine } from './board/dispatch.mjs';
 import { execFile } from 'node:child_process';
@@ -194,14 +194,12 @@ export class Orchestrator {
     );
   }
 
-  /** Identities minted while Teams was absent are declared under their ids. Their sessions are bound to them by the
-   * machine that runs them, from the agent each launch named (the connector's bindAgentSessions), never here. */
+  /** The home's agent declarations and ends a launch could not hand to this machine's daemon (none was running) are
+   * handed on. The daemon declares and ends them in Teams and binds their sessions; the gateway makes no Teams call. */
   declareLocalAgents(){
     if(!existsSync(join(this.state.root,'agent-state.sqlite')))return;
-    try{
-      const context=process.env.SUPERCODE_CONTEXT;
-      for(const pending of synchronizeLocalAgents({root:this.state.root,profiles:this.state.profiles,context,declarations:this.state.agents??{}}))this.log('warn',`agent ${pending.agent} declaration pending: ${pending.error}`);
-    }catch(error){this.log('warn',`agent declaration: ${error.message}`);}
+    try{for(const pending of handOffAgents(this.state.root))this.log('warn',`agent ${pending.agent}: ${pending.error}`);}
+    catch(error){this.log('warn',`agent hand-off: ${error.message}`);}
   }
 
   /**
@@ -418,42 +416,21 @@ export class Orchestrator {
     materializeSkills(profile);
     let launch,agent,scope,context,agentPrompt,main,agentHome;
     try {
+      // The launch asks Teams nothing (D137): the agent is this home's minted identity, its declaration handed to this
+      // machine's daemon, its reader context the one this machine holds (the daemon delegates one when it binds the
+      // session), its earlier sessions the ones this home ran.
       context=process.env.SUPERCODE_CONTEXT;scope=agentScope(context);
-      const local=error=>{if(!teamsUnavailable(error))throw error;this.log('warn',`agent identity for ${profileName} stays local: ${error.message}`);};
-      let previous=null,reader=null;
+      let previous=null;
       if(agent_as) {
-        // A launch as a named agent is an act Teams authorizes; it never proceeds on local intent alone.
-        agentDoor('management',[agent_as],{context});
-        const identity=agentDoor('get',[agent_as],{context}).data,intent=agentIntent(this.state.root,scope.org,agent_as);
-        if(!intent)throw new Error('launch as an agent requires its retained profile intent');
-        agent={identity,intended:intent.profile,assignments:intent.assignments,org:scope.org};
-      } else if(!scope.offline) {
-        try{agent=ensureProfileAgent({root:this.state.root,org:scope.org,server:scope.server,profiles:this.state.profiles,profile:profileName,context,agent:agentName,declarations:this.state.agents});}catch(error){local(error);}
+        const record=localAgentRecord(this.state.root,scope.org,agent_as);
+        if(!record)throw new Error('launch as an agent requires its retained profile intent');
+        agent=record;
       }
-      // Situation 16: no reachable Teams. The locally minted identity runs now and is declared later under its id.
       agent??=localProfileAgent({root:this.state.root,org:scope.org,server:scope.server,profiles:this.state.profiles,profile:profileName,agent:agentName,declarations:this.state.agents});
+      if(!scope.offline)for(const pending of handOffAgents(this.state.root,{context}))this.log('warn',`agent ${pending.agent}: ${pending.error}`);
       agent.intended.resolved.worker={...agent.intended.resolved.worker,...worker,cwd};
       main=new_fork||!agent.identity.main_session;
-      if(agent.synced!==false){
-        try{
-          previous=agentDoor('sessions',[agent.identity.id,{limit:200}],{context}).items??[];
-          if(resume_runtime_id&&!new_fork) {
-            // a session no sync rule publishes is unknown to Teams: its owner is the local run record, read below
-            let resumed=null;
-            try{resumed=agentDoor('session',[`${worker.harness}:${resume_runtime_id}`],{context}).data;}catch(error){if(error.code!=='not_found')throw error;}
-            if(resumed){
-              if(resumed.agent?.id!==agent.identity.id)throw new Error('the resumed session is not owned by this profile agent');
-              main=resumed.main;
-            } else {
-              const owner=agentRunForSession(this.state.root,[`${worker.harness}:${resume_runtime_id}`]);
-              if(owner&&owner.agent_id!==agent.identity.id)throw new Error('the resumed session is not owned by this profile agent');
-              if(owner)main=owner.main===1;
-            }
-          }
-          reader=agentDoor('readerContext',[agent.identity.id,null],{context,timeout:60000});
-        }catch(error){local(error);}
-      }
-      if(resume_runtime_id&&!new_fork&&!previous){
+      if(resume_runtime_id&&!new_fork){
         const owner=agentRunForSession(this.state.root,[`${worker.harness}:${resume_runtime_id}`]);
         if(owner&&owner.agent_id!==agent.identity.id)throw new Error('the resumed session is not owned by this profile agent');
         if(owner)main=owner.main===1;
@@ -468,7 +445,7 @@ export class Orchestrator {
       const route = workerRoute(profile, worker, this.vault);
       // a worker of any harness but Hermes gets Hermes's CLI against its profile's home (row 7)
       const tools = worker.harness === 'hermes' ? {} : hermesToolEnv(agentHome);
-      const env = { ...tools, ...activationEnv({ root: this.state.root, profile, surfaceKey: keyString, vault: this.vault }), ...route.env,...agentEnvironment(agent,{root:this.state.root,context:reader?.context,main}) };
+      const env = { ...tools, ...activationEnv({ root: this.state.root, profile, surfaceKey: keyString, vault: this.vault }), ...route.env,...agentEnvironment(agent,{root:this.state.root,context:localReaderContext(scope.org,agent.identity.id)??undefined,main}) };
       env.HERMES_HOME=agentHome;
       declareWorkerHome({ harness: worker.harness, env, cwd, log: (level, message) => this.log(level, message) });
       // All sessions of this agent carry its state; a shared profile contributes configuration only.
@@ -537,8 +514,9 @@ export class Orchestrator {
     if(!binding||binding.ended_at)throw new Error('register the fork target conversation before starting its runtime');
     if(this.runtimes.has(leaseId(profileName,keyString)))throw new Error('fork requires an unoccupied target conversation');
     if(!(await this.descriptorFor(locator.harness))?.runtime?.capabilities?.resume_session)throw new Error('this harness cannot resume a materialized fork');
-    const context=process.env.SUPERCODE_CONTEXT,scope=agentDoor('scope',[],{context}),session=`${locator.harness}:${locator.session_id}`;
-    const child=ensureForkAgent({root:this.state.root,org:scope.org,server:scope.server,profiles:this.state.profiles,parent,session,name,key,context});
+    const context=process.env.SUPERCODE_CONTEXT,scope=agentScope(context),session=`${locator.harness}:${locator.session_id}`;
+    const child=localForkAgent({root:this.state.root,org:scope.org,server:scope.server,profiles:this.state.profiles,parent,session,name,key});
+    if(!scope.offline)for(const pending of handOffAgents(this.state.root,{context}))this.log('warn',`agent ${pending.agent}: ${pending.error}`);
     const runKey=`fork:${key}`,prior=agentRunForKey(this.state.root,scope.org,child.identity.id,runKey);
     let target;
     if(prior) {
@@ -580,19 +558,10 @@ export class Orchestrator {
     let preamble=null;
     if(owner) {
       try {
-        const context=process.env.SUPERCODE_CONTEXT;
-        const intent=agentIntent(this.state.root,owner.org,owner.agent_id);
-        if(!intent)throw new Error('retained session has no agent profile intent');
-        try{
-          const live=agentDoor('session',[owner.session_ref],{context}).data;
-          if(live.agent?.id!==owner.agent_id||live.agent.state!=='active')throw new Error('retained session agent is no longer active or has different ownership');
-          const previous=agentDoor('sessions',[owner.agent_id,{limit:200}],{context}).items??[];
-          preamble=agentPreamble({identity:live.agent,intended:intent.profile,assignments:intent.assignments},{main:live.main,previous});
-        }catch(error){
-          // Teams cannot be asked: the session continues as the agent this home recorded, never as another.
-          if(!teamsUnavailable(error))throw error;
-          preamble=agentPreamble(localAgentRecord(this.state.root,owner.org,owner.agent_id),{main:owner.main===1,previous:localAgentSessions(this.state.root,owner.org,owner.agent_id)});
-        }
+        // The session continues as the agent this home recorded for it, never as another; Teams is not asked.
+        const record=localAgentRecord(this.state.root,owner.org,owner.agent_id);
+        if(!record)throw new Error('retained session has no agent profile intent');
+        preamble=agentPreamble(record,{main:owner.main===1,previous:localAgentSessions(this.state.root,owner.org,owner.agent_id)});
       }catch(error){return interrupted(`agent identity unavailable: ${error.message}`);}
     }
     let capable = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.5.43",
+  "version": "0.5.44",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@volter/supercode-harness-sdk": "^0.3.60",
-    "@volter/teams": "0.2.15",
+    "@volter/teams": "0.2.16",
     "@volter/ztrack": "^2.4.23",
     "yaml": "^2.9.0"
   },