agent-dealer 0.2.0 → 1.0.0

package/bundle/server/dist/db/authority-attempts-stale-at-migration.test.js

@@ -0,0 +1,65 @@
+// Regression test for the bug `npm run dev` hit against any database that ran migrate()
+// between NOT-93 (introduced `authority_attempts`) and NOT-91 (added its `stale_at`
+// column + an index on it): schema.sql's own `CREATE INDEX idx_authority_attempts_stale
+// ON authority_attempts(status, stale_at)` threw "no such column: stale_at" against the
+// pre-existing table, aborting migrate() before it ever reached the incremental-ALTER
+// section below it — see db/index.ts's pre-schema.sql guard.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-authattempt-migrate-"));
+const { migrate, getDb } = await import("./index.js");
+test("migrate() upgrades a pre-NOT-91 authority_attempts table that has no stale_at column", () => {
+    migrate();
+    const db = getDb();
+    // Recreate the pre-NOT-91 world: the table and its two original indexes, but without
+    // stale_at or the index on it — exactly what a database that last ran migrate() between
+    // NOT-93 and NOT-91 landing would have.
+    db.exec(`
+    DROP INDEX IF EXISTS idx_authority_attempts_owner;
+    DROP INDEX IF EXISTS idx_authority_attempts_stale;
+    DROP INDEX IF EXISTS idx_authority_attempts_status;
+    DROP TABLE authority_attempts;
+    CREATE TABLE authority_attempts (
+      id TEXT PRIMARY KEY,
+      owner_kind TEXT NOT NULL,
+      owner_id TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      authority_id TEXT,
+      deck_id TEXT NOT NULL,
+      run_id TEXT NOT NULL,
+      attempt_id TEXT NOT NULL,
+      ttl_ms INTEGER NOT NULL,
+      tool_scope_hint_json TEXT,
+      status TEXT NOT NULL,
+      expires_at TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+    CREATE INDEX idx_authority_attempts_owner ON authority_attempts(owner_kind, owner_id);
+    CREATE INDEX idx_authority_attempts_status ON authority_attempts(status);
+  `);
+    const preFixCols = db.prepare("PRAGMA table_info(authority_attempts)").all();
+    assert.ok(!preFixCols.some((c) => c.name === "stale_at"), "test setup must reproduce the pre-fix table exactly");
+    const now = new Date().toISOString();
+    db.prepare(`INSERT INTO authority_attempts (id, owner_kind, owner_id, idempotency_key, deck_id, run_id, attempt_id, ttl_ms, status, created_at, updated_at)
+     VALUES ('a1', 'developer', 'issue-1:developer', 'a1:1', 'deck-1', 'run-1', 'a1', 60000, 'acquiring', ?, ?)`).run(now, now);
+    // This is the actual regression: pre-fix, this throws "no such column: stale_at" from
+    // schema.sql's own CREATE INDEX, before ever reaching an incremental ALTER.
+    assert.doesNotThrow(() => migrate());
+    const cols = db.prepare("PRAGMA table_info(authority_attempts)").all();
+    assert.ok(cols.some((c) => c.name === "stale_at"), "stale_at must exist after migrate()");
+    // The pre-existing row survived the migration untouched.
+    const row = db.prepare("SELECT stale_at FROM authority_attempts WHERE id = 'a1'").get();
+    assert.equal(row.stale_at, null);
+    // The stale-tracking index now exists and is actually usable.
+    db.exec("UPDATE authority_attempts SET stale_at = '2026-01-01T00:00:00.000Z' WHERE id = 'a1'");
+    const staleRows = db
+        .prepare("SELECT id FROM authority_attempts WHERE status = 'acquiring' AND stale_at IS NOT NULL")
+        .all();
+    assert.deepEqual(staleRows.map((r) => r.id), ["a1"]);
+    // A second migrate() is a no-op (column already present) and still starts cleanly.
+    assert.doesNotThrow(() => migrate());
+});

package/bundle/server/dist/db/idempotency-index-migration.test.js

@@ -0,0 +1,57 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-idem-migrate-"));
+const { migrate, getDb } = await import("./index.js");
+const { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID } = await import("@agent-dealer/shared");
+const { createIssue } = await import("../repository/issues.js");
+test("migrate() upgrades a pre-fix non-unique idempotency index that already holds duplicates", () => {
+    migrate();
+    const db = getDb();
+    const issue = createIssue({
+        title: "T",
+        repo: "/r",
+        baseBranch: "main",
+        developerAgentId: BUILTIN_AGENT_CLAUDE_ID,
+        reviewerAgentId: BUILTIN_AGENT_CURSOR_ID,
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual",
+    });
+    // Recreate the pre-fix world: non-unique index + duplicate provider keys.
+    db.exec("DROP INDEX idx_workflow_events_idempotency");
+    db.exec("CREATE INDEX idx_workflow_events_idempotency ON workflow_events(idempotency_key) WHERE idempotency_key IS NOT NULL");
+    const insert = db.prepare(`INSERT INTO workflow_events (id, issue_id, type, actor_type, stage, idempotency_key, causation_event_id, ts)
+     VALUES (?, ?, 'pull_request.updated', 'system', 'developing', ?, ?, ?)`);
+    insert.run("e1", issue.id, "dup-key", null, "2026-01-01T00:00:00.000Z");
+    insert.run("e2", issue.id, "dup-key", null, "2026-01-01T00:00:01.000Z");
+    insert.run("e3", issue.id, "dup-key", null, "2026-01-01T00:00:02.000Z");
+    insert.run("e4", issue.id, "other-key", null, "2026-01-01T00:00:03.000Z");
+    // A downstream event whose recorded cause is a duplicate that will be discarded.
+    insert.run("e5", issue.id, "later-key", "e2", "2026-01-01T00:00:04.000Z");
+    // A duplicate row that itself points at another duplicate.
+    insert.run("e6", issue.id, "dup-key", "e3", "2026-01-01T00:00:05.000Z");
+    assert.doesNotThrow(() => migrate());
+    // The first event recorded for the repeated key is kept; later copies dropped.
+    const kept = db
+        .prepare("SELECT id FROM workflow_events WHERE idempotency_key = 'dup-key' ORDER BY id")
+        .all();
+    assert.deepStrictEqual(kept.map((r) => r.id), ["e1"]);
+    assert.equal(db.prepare("SELECT COUNT(*) c FROM workflow_events WHERE idempotency_key = 'other-key'").get().c, 1);
+    // Causality is remapped to the canonical event, not left dangling or dropped.
+    assert.equal(db.prepare("SELECT causation_event_id x FROM workflow_events WHERE id = 'e5'").get().x, "e1");
+    // Every causation reference still resolves to a surviving event.
+    assert.equal(db
+        .prepare(`SELECT COUNT(*) c FROM workflow_events e
+         WHERE e.causation_event_id IS NOT NULL
+           AND NOT EXISTS (SELECT 1 FROM workflow_events p WHERE p.id = e.causation_event_id)`)
+        .get().c, 0);
+    // The index is now unique and actually enforced.
+    const idx = db.prepare("PRAGMA index_list(workflow_events)").all().find((i) => i.name === "idx_workflow_events_idempotency");
+    assert.equal(idx?.unique, 1);
+    assert.throws(() => insert.run("e7", issue.id, "dup-key", null, "2026-01-01T00:00:06.000Z"), /UNIQUE constraint failed: workflow_events\.idempotency_key/);
+    // A second migrate() is a no-op (index already unique) and still starts cleanly.
+    assert.doesNotThrow(() => migrate());
+});

package/bundle/server/dist/db/index.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import Database from "better-sqlite3";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID, CURSOR_DEFAULT_MODEL, } from "@agent-dealer/shared";
+import { BUILTIN_AGENT_CLAUDE_ID, BUILTIN_AGENT_CURSOR_ID, BUILTIN_AGENT_CODEX_ID, CURSOR_DEFAULT_MODEL, } from "@agent-dealer/shared";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 export function getDataDir() {
     const home = process.env.AGENT_DEALER_HOME ?? path.join(os.homedir(), ".agent-dealer");
@@ -23,8 +23,35 @@ export function getDb() {
     }
     return dbInstance;
 }
+/** Tests only — drops the cached connection so a later getDb()/migrate() reopens against
+ * whatever AGENT_DEALER_HOME is set to next, instead of silently reusing a stale handle
+ * to the previous test's database. */
+export function closeDb() {
+    dbInstance?.close();
+    dbInstance = null;
+}
 export function migrate() {
     const db = getDb();
+    // NOT-91 added `stale_at` (and an index on it) to `authority_attempts`, but that table
+    // itself was introduced earlier (NOT-93). Every other incremental ALTER in this function
+    // runs AFTER the schema.sql exec below because schema.sql's CREATE TABLE/INDEX
+    // statements are themselves idempotent (IF NOT EXISTS) against an already-current table.
+    // This one column can't wait that long: schema.sql's own
+    // `CREATE INDEX idx_authority_attempts_stale ON authority_attempts(status, stale_at)`
+    // throws "no such column: stale_at" against a pre-NOT-91 `authority_attempts` table
+    // before the exec below ever reaches the incremental-ALTER section — aborting migrate()
+    // (and every table's schema updates after it) for any database that ran migrate()
+    // between NOT-93 and NOT-91 landing. Must run first, and only if the table already
+    // exists — a brand-new database gets the column from schema.sql's CREATE TABLE directly.
+    const authorityAttemptsExists = db
+        .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'authority_attempts'")
+        .get();
+    if (authorityAttemptsExists) {
+        const authorityAttemptCols = db.prepare("PRAGMA table_info(authority_attempts)").all();
+        if (!authorityAttemptCols.some((c) => c.name === "stale_at")) {
+            db.exec("ALTER TABLE authority_attempts ADD COLUMN stale_at TEXT");
+        }
+    }
     const schema = readFileSync(path.join(__dirname, "schema.sql"), "utf8");
     db.exec(schema);
     const runCols = db.prepare("PRAGMA table_info(runs)").all();
@@ -55,12 +82,333 @@ export function migrate() {
         db.exec("ALTER TABLE runs ADD COLUMN plan_model TEXT");
         db.exec("ALTER TABLE runs ADD COLUMN execute_model TEXT");
     }
+    // NOT-60: role-neutral agent-profile columns + the frozen per-session execution
+    // snapshot. Additive ALTERs (SQLite has no ADD COLUMN IF NOT EXISTS), guarded by a
+    // PRAGMA check so re-running migrate() is a no-op.
+    const agentCols4 = db.prepare("PRAGMA table_info(agents)").all();
+    if (!agentCols4.some((c) => c.name === "default_model")) {
+        db.exec("ALTER TABLE agents ADD COLUMN default_model TEXT");
+        db.exec("ALTER TABLE agents ADD COLUMN default_budget_json TEXT");
+        db.exec("ALTER TABLE agents ADD COLUMN purpose TEXT");
+        db.exec("ALTER TABLE agents ADD COLUMN playbook_ids_json TEXT");
+        db.exec("ALTER TABLE agents ADD COLUMN external_memory_refs_json TEXT");
+        db.exec("ALTER TABLE agents ADD COLUMN permission_policy_json TEXT");
+        // Backfill the role-neutral defaults from the legacy phase columns — execute first,
+        // then plan (design §`agents`). The old columns stay legacy-readable for one release.
+        db.exec(`
+      UPDATE agents SET
+        default_model = COALESCE(default_execute_model, default_plan_model),
+        default_budget_json = COALESCE(default_execute_budget_json, default_plan_budget_json)
+      WHERE default_model IS NULL AND default_budget_json IS NULL
+    `);
+    }
+    // NOT-81: reasoning effort on the agent profile (frozen into the session snapshot).
+    const agentCols5 = db.prepare("PRAGMA table_info(agents)").all();
+    if (!agentCols5.some((c) => c.name === "default_effort")) {
+        db.exec("ALTER TABLE agents ADD COLUMN default_effort TEXT");
+    }
+    const workerSessionCols = db.prepare("PRAGMA table_info(worker_sessions)").all();
+    if (!workerSessionCols.some((c) => c.name === "profile_snapshot_json")) {
+        db.exec("ALTER TABLE worker_sessions ADD COLUMN profile_snapshot_json TEXT");
+    }
+    // NOT-124: spawned-CLI liveness evidence. Existing rows stay NULL, which recovery reads
+    // as "no evidence" and falls back to the timestamp-only reclaim it has always done.
+    //
+    // Each column is guarded on its OWN presence, not on the pair. Every `ALTER TABLE` here
+    // commits separately, so a process killed between two of them leaves the table half
+    // upgraded — and a guard keyed on the first column would then skip the block forever
+    // while every worker_sessions INSERT still names the second, failing permanently. Checked
+    // independently, the same pass that could have produced that state also repairs it.
+    if (!workerSessionCols.some((c) => c.name === "process_pid")) {
+        db.exec("ALTER TABLE worker_sessions ADD COLUMN process_pid INTEGER");
+    }
+    if (!workerSessionCols.some((c) => c.name === "process_owner")) {
+        db.exec("ALTER TABLE worker_sessions ADD COLUMN process_owner TEXT");
+    }
+    // NOT-131: portable liveness evidence. Added NULL on existing rows, which processLiveness
+    // reads as "unknown" — a session in flight across the upgrade degrades to timestamp-only
+    // reclaim rather than being mistaken for alive.
+    if (!workerSessionCols.some((c) => c.name === "process_started_at")) {
+        db.exec("ALTER TABLE worker_sessions ADD COLUMN process_started_at TEXT");
+    }
+    // Tighten the workflow-event idempotency index to UNIQUE for DBs created before the
+    // constraint (schema.sql's IF NOT EXISTS won't upgrade an existing non-unique index).
+    // A pre-fix DB may already hold duplicate keys — the old index was non-unique and
+    // appendWorkflowEvent() inserted unconditionally — so dedupe first, then swap the
+    // index, all inside one transaction so a failure never leaves the table indexless.
+    const wfIdemIdx = db.prepare("PRAGMA index_list(workflow_events)").all();
+    const nonUnique = wfIdemIdx.find((i) => i.name === "idx_workflow_events_idempotency" && i.unique === 0);
+    if (nonUnique) {
+        db.transaction(() => {
+            // Preservation policy: for each repeated provider key keep the first event
+            // recorded for it (lowest rowid = earliest insert) and drop the later copies —
+            // a duplicate delivery should collapse to its original, matching the runtime
+            // ON CONFLICT DO NOTHING behaviour.
+            //
+            // causation_event_id is a self-FK, so first repoint any reference that points at
+            // a discarded duplicate to the canonical (kept) event for that key — otherwise
+            // the DELETE below fails with FOREIGN KEY constraint failed and rolls back.
+            db.exec(`
+        WITH canon AS (
+          SELECT idempotency_key, MIN(rowid) AS keep_rowid
+          FROM workflow_events
+          WHERE idempotency_key IS NOT NULL
+          GROUP BY idempotency_key
+        ),
+        remap AS (
+          SELECT e.id AS dup_id, k.id AS canon_id
+          FROM workflow_events e
+          JOIN canon c ON c.idempotency_key = e.idempotency_key
+          JOIN workflow_events k ON k.rowid = c.keep_rowid
+          WHERE e.idempotency_key IS NOT NULL AND e.rowid <> c.keep_rowid
+        )
+        UPDATE workflow_events
+        SET causation_event_id = remap.canon_id
+        FROM remap
+        WHERE workflow_events.causation_event_id = remap.dup_id
+      `);
+            db.exec(`
+        DELETE FROM workflow_events
+        WHERE idempotency_key IS NOT NULL
+          AND rowid NOT IN (
+            SELECT MIN(rowid) FROM workflow_events
+            WHERE idempotency_key IS NOT NULL
+            GROUP BY idempotency_key
+          )
+      `);
+            db.exec("DROP INDEX idx_workflow_events_idempotency");
+            db.exec("CREATE UNIQUE INDEX idx_workflow_events_idempotency ON workflow_events(idempotency_key) WHERE idempotency_key IS NOT NULL");
+        })();
+    }
+    const artifactCols = db.prepare("PRAGMA table_info(artifacts)").all();
+    if (!artifactCols.some((c) => c.name === "issue_id")) {
+        // Additive per spec §"artifacts": issue_id/worker_session_id are nullable here since
+        // existing rows predate the issue model — every row the migration or new coordinator
+        // writes going forward populates issue_id.
+        db.exec("ALTER TABLE artifacts ADD COLUMN issue_id TEXT REFERENCES issues(id)");
+        db.exec("ALTER TABLE artifacts ADD COLUMN worker_session_id TEXT REFERENCES worker_sessions(id)");
+    }
+    // NOT-57 Task 1 amendment: issue-linked artifacts have no run, so run_id must be
+    // nullable — but SQLite can't ALTER a column's NOT NULL away, so rebuild the table for
+    // any database created before schema.sql dropped the constraint (fresh databases from
+    // the updated schema.sql never hit this branch).
+    const artifactRunIdCol = db.prepare("PRAGMA table_info(artifacts)").all().find((c) => c.name === "run_id");
+    if (artifactRunIdCol?.notnull === 1) {
+        db.exec(`
+      CREATE TABLE artifacts_new (
+        id TEXT PRIMARY KEY,
+        run_id TEXT REFERENCES runs(id),
+        kind TEXT NOT NULL,
+        content_json TEXT,
+        blob_path TEXT,
+        author TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        issue_id TEXT REFERENCES issues(id),
+        worker_session_id TEXT REFERENCES worker_sessions(id)
+      );
+      INSERT INTO artifacts_new (id, run_id, kind, content_json, blob_path, author, created_at, issue_id, worker_session_id)
+        SELECT id, run_id, kind, content_json, blob_path, author, created_at, issue_id, worker_session_id FROM artifacts;
+      DROP TABLE artifacts;
+      ALTER TABLE artifacts_new RENAME TO artifacts;
+      CREATE INDEX IF NOT EXISTS idx_artifacts_run ON artifacts(run_id);
+    `);
+    }
+    // NOT-63: infra-attempt budget, separate from the review-round budget above — a flaky
+    // session/git/gh/Agent Deck/publish failure must not spend the same counter as a
+    // reviewer's genuine `changes_requested`.
+    const issueCols = db.prepare("PRAGMA table_info(issues)").all();
+    if (!issueCols.some((c) => c.name === "max_infra_attempts")) {
+        db.exec("ALTER TABLE issues ADD COLUMN max_infra_attempts INTEGER NOT NULL DEFAULT 3");
+        db.exec("ALTER TABLE issues ADD COLUMN infra_attempts INTEGER NOT NULL DEFAULT 0");
+    }
+    // NOT-102: per-issue auto-merge after reviewer approve (kick UI defaults on; existing
+    // rows stay off so in-flight workflows keep the human final_review path).
+    const issueColsForAutoMerge = db.prepare("PRAGMA table_info(issues)").all();
+    if (!issueColsForAutoMerge.some((c) => c.name === "auto_merge")) {
+        db.exec("ALTER TABLE issues ADD COLUMN auto_merge INTEGER NOT NULL DEFAULT 0");
+    }
+    // NOT-93: Deck's own correlation id for the INTERACTION_REQUIRED response that raised a
+    // deck_interaction_required action — lets a repeated signal for the same request dedupe
+    // to one open action instead of piling up duplicates.
+    const humanActionCols = db.prepare("PRAGMA table_info(human_actions)").all();
+    if (!humanActionCols.some((c) => c.name === "request_id")) {
+        db.exec("ALTER TABLE human_actions ADD COLUMN request_id TEXT");
+    }
+    // NOT-95: a Run-scoped action (outbound-draft delivery parking) has no Issue, so issue_id
+    // must become nullable — SQLite can't ALTER a column's NOT NULL away, so rebuild the table
+    // for any database created before schema.sql dropped the constraint (fresh databases from
+    // the updated schema.sql never hit this branch). Same recipe as the artifacts_new rebuild
+    // above.
+    const humanActionIssueIdCol = db.prepare("PRAGMA table_info(human_actions)").all().find((c) => c.name === "issue_id");
+    if (humanActionIssueIdCol?.notnull === 1) {
+        db.exec(`
+      CREATE TABLE human_actions_new (
+        id TEXT PRIMARY KEY,
+        issue_id TEXT REFERENCES issues(id),
+        run_id TEXT REFERENCES runs(id),
+        workflow_instance_id TEXT REFERENCES workflow_instances(id),
+        action_type TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        question TEXT NOT NULL,
+        evidence_json TEXT,
+        response_options_json TEXT,
+        continuation_preview_json TEXT,
+        request_id TEXT,
+        status TEXT NOT NULL,
+        resolution_json TEXT,
+        resolved_by TEXT,
+        requested_at TEXT NOT NULL,
+        resolved_at TEXT
+      );
+      INSERT INTO human_actions_new (
+        id, issue_id, workflow_instance_id, action_type, reason, question, evidence_json,
+        response_options_json, continuation_preview_json, request_id, status, resolution_json,
+        resolved_by, requested_at, resolved_at
+      )
+        SELECT
+          id, issue_id, workflow_instance_id, action_type, reason, question, evidence_json,
+          response_options_json, continuation_preview_json, request_id, status, resolution_json,
+          resolved_by, requested_at, resolved_at
+        FROM human_actions;
+      DROP TABLE human_actions;
+      ALTER TABLE human_actions_new RENAME TO human_actions;
+      CREATE INDEX IF NOT EXISTS idx_human_actions_issue ON human_actions(issue_id);
+      CREATE INDEX IF NOT EXISTS idx_human_actions_status ON human_actions(status);
+    `);
+    }
+    else if (!humanActionCols.some((c) => c.name === "run_id")) {
+        // Rebuild already happened in a prior migrate() run (or this is a fresh schema.sql
+        // database missing only this additive column for some other reason) — plain add.
+        db.exec("ALTER TABLE human_actions ADD COLUMN run_id TEXT REFERENCES runs(id)");
+    }
+    // Always last, once run_id is guaranteed to exist (fresh schema.sql create, the rebuild
+    // above, or the plain ALTER above) — see schema.sql's comment on why this index isn't
+    // declared there.
+    db.exec("CREATE INDEX IF NOT EXISTS idx_human_actions_run ON human_actions(run_id)");
+    // NOT-91: findOpenHumanActionByRequestId's dedupe was a plain read-then-create check —
+    // two concurrent duplicate INTERACTION_REQUIRED deliveries could both see "no open
+    // action" and both insert. Tighten to a real constraint enforced via createHumanAction's
+    // `ON CONFLICT ... DO NOTHING` (repository/human-actions.ts). Must run AFTER the NOT-95
+    // rebuild above: that rebuild drops and recreates `human_actions` (to make issue_id
+    // nullable) without carrying over any index created before it, so creating this index
+    // earlier in the same migrate() call — as a prior version of this migration did — got it
+    // silently dropped by the very next block, and only a second restart (skipping the rebuild
+    // block on its now-nullable issue_id) actually created it (review-caught bug). Re-querying
+    // PRAGMA index_list here, after the rebuild, is what makes this idempotent no matter which
+    // branch above ran. A pre-fix database may already hold a duplicate open pair from exactly
+    // that race — dedupe first (keep the earliest per (issue_id, action_type, request_id),
+    // auto-resolve any later duplicate), then create the index, all in one transaction so a
+    // failure never leaves the table indexless.
+    const humanActionIdx = db.prepare("PRAGMA index_list(human_actions)").all();
+    if (!humanActionIdx.some((i) => i.name === "idx_human_actions_open_request")) {
+        db.transaction(() => {
+            db.exec(`
+        UPDATE human_actions SET
+          status = 'resolved',
+          resolution_json = '{"choice":"resolved_via_dedupe_migration"}',
+          resolved_by = 'system',
+          resolved_at = datetime('now')
+        WHERE status = 'open' AND request_id IS NOT NULL AND rowid NOT IN (
+          SELECT MIN(rowid) FROM human_actions
+          WHERE status = 'open' AND request_id IS NOT NULL
+          GROUP BY issue_id, action_type, request_id
+        )
+      `);
+            db.exec(`
+        CREATE UNIQUE INDEX idx_human_actions_open_request ON human_actions(issue_id, action_type, request_id)
+        WHERE status = 'open' AND request_id IS NOT NULL
+      `);
+        })();
+    }
+    // NOT-111: runtime usage-cap availability (one row per runtime account).
+    const runtimeAvail = db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'runtime_availability'")
+        .get();
+    if (!runtimeAvail) {
+        db.exec(`
+      CREATE TABLE runtime_availability (
+        runtime TEXT PRIMARY KEY,
+        unavailable_until TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        evidence_json TEXT,
+        observed_at TEXT NOT NULL
+      );
+    `);
+    }
+    // NOT-103: sequential issue admission queue.
+    const queueEntries = db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'queue_entries'")
+        .get();
+    if (!queueEntries) {
+        db.exec(`
+      CREATE TABLE queue_entries (
+        id TEXT PRIMARY KEY,
+        issue_id TEXT NOT NULL,
+        position INTEGER NOT NULL,
+        enqueued_at TEXT NOT NULL,
+        state TEXT NOT NULL CHECK (state IN ('queued', 'admitted', 'removed')),
+        wait_reason TEXT,
+        wait_reason_at TEXT
+      );
+      CREATE UNIQUE INDEX idx_queue_entries_queued_issue
+        ON queue_entries(issue_id) WHERE state = 'queued';
+      CREATE INDEX idx_queue_entries_queued_position
+        ON queue_entries(position) WHERE state = 'queued';
+    `);
+    }
     seedBuiltinAgents(db);
     seedIntakeSettings(db);
     migrateLegacyAgentDeckPort(db);
+    migrateLinearInboxUnlock(db);
     // Default agents are normal rows — clear legacy built-in flag.
     db.exec("UPDATE agents SET is_builtin = 0 WHERE is_builtin = 1");
 }
+/** One-shot: unlock assigneeMe / stateFilter only when they still hold pre-unlock defaults.
+ * Deliberate Settings customizations and env-seeded filters (e.g. Todo+Backlog) are left alone. */
+function migrateLinearInboxUnlock(db) {
+    const flag = db
+        .prepare("SELECT value_json FROM intake_settings WHERE key = ?")
+        .get("linear.inboxUnlockV1");
+    if (flag)
+        return;
+    const openStates = ["Backlog", "Todo", "In Progress", "In Review"];
+    const upsert = db.prepare("INSERT INTO intake_settings (key, value_json) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value_json = excluded.value_json");
+    const assigneeRow = db
+        .prepare("SELECT value_json FROM intake_settings WHERE key = ?")
+        .get("linear.assigneeMe");
+    let assigneeMe = true; // pre-unlock default when missing
+    if (assigneeRow) {
+        try {
+            assigneeMe = JSON.parse(assigneeRow.value_json);
+        }
+        catch {
+            assigneeMe = true;
+        }
+    }
+    if (assigneeMe === true) {
+        upsert.run("linear.assigneeMe", JSON.stringify(false));
+    }
+    const stateRow = db
+        .prepare("SELECT value_json FROM intake_settings WHERE key = ?")
+        .get("linear.stateFilter");
+    let stateFilter = ["Todo"]; // pre-unlock code default when missing
+    if (stateRow) {
+        try {
+            stateFilter = JSON.parse(stateRow.value_json);
+        }
+        catch {
+            stateFilter = ["Todo"];
+        }
+    }
+    if (isLegacyLinearStateFilterDefault(stateFilter)) {
+        upsert.run("linear.stateFilter", JSON.stringify(openStates));
+    }
+    upsert.run("linear.inboxUnlockV1", JSON.stringify(true));
+}
+/** Pre-unlock persisted default was exactly `["Todo"]` (see prior getPersistedLinearIntakeConfig). */
+export function isLegacyLinearStateFilterDefault(value) {
+    return Array.isArray(value) && value.length === 1 && value[0] === "Todo";
+}
 function migrateLegacyAgentDeckPort(db) {
     const row = db
         .prepare("SELECT value_json FROM intake_settings WHERE key = ?")
@@ -78,15 +426,16 @@ function migrateLegacyAgentDeckPort(db) {
     }
 }
 function seedIntakeSettings(db) {
-    const stateFilter = (process.env.LINEAR_STATE_FILTER ?? "Todo")
+    const openDefault = ["Backlog", "Todo", "In Progress", "In Review"];
+    const stateFilter = (process.env.LINEAR_STATE_FILTER ?? openDefault.join(","))
         .split(",")
         .map((s) => s.trim())
         .filter(Boolean);
     const teamId = process.env.LINEAR_TEAM_ID ?? null;
     const defaults = {
-        "linear.stateFilter": stateFilter.length > 0 ? stateFilter : ["Todo"],
+        "linear.stateFilter": stateFilter.length > 0 ? stateFilter : openDefault,
         "linear.teamId": teamId,
-        "linear.assigneeMe": true,
+        "linear.assigneeMe": false,
         "linear.defaultAgentId": null,
         "linear.syncEnabled": true,
         "linear.routingRules": [],
@@ -117,9 +466,12 @@ function seedBuiltinAgents(db) {
   `);
     insert.run(BUILTIN_AGENT_CLAUDE_ID, "Claude", "claude_code", now, now);
     insert.run(BUILTIN_AGENT_CURSOR_ID, "Cursor", "cursor_local", now, now);
+    insert.run(BUILTIN_AGENT_CODEX_ID, "Codex", "codex_local", now, now);
+    // NOT-71: seeds the role-neutral column the issue workflow actually reads. The legacy
+    // default_plan_model / default_execute_model columns are read-only compatibility now
+    // (profile-snapshot.ts falls back to them for profiles saved before default_model existed).
     db.prepare(`UPDATE agents SET
-      default_plan_model = COALESCE(default_plan_model, ?),
-      default_execute_model = COALESCE(default_execute_model, ?),
+      default_model = COALESCE(default_model, ?),
       updated_at = ?
-     WHERE id = ? AND runtime = 'cursor_local'`).run(CURSOR_DEFAULT_MODEL, CURSOR_DEFAULT_MODEL, now, BUILTIN_AGENT_CURSOR_ID);
+     WHERE id = ? AND runtime = 'cursor_local'`).run(CURSOR_DEFAULT_MODEL, now, BUILTIN_AGENT_CURSOR_ID);
 }

package/bundle/server/dist/db/linear-inbox-unlock.test.js

@@ -0,0 +1,67 @@
+import { test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-inbox-unlock-"));
+delete process.env.LINEAR_STATE_FILTER;
+delete process.env.LINEAR_TEAM_ID;
+const { migrate, getDb, closeDb } = await import("./index.js");
+const { isLegacyLinearStateFilterDefault } = await import("./index.js");
+function readSetting(key) {
+    const row = getDb()
+        .prepare("SELECT value_json FROM intake_settings WHERE key = ?")
+        .get(key);
+    assert.ok(row, `expected setting ${key}`);
+    return JSON.parse(row.value_json);
+}
+function writeSetting(key, value) {
+    getDb()
+        .prepare("INSERT INTO intake_settings (key, value_json) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value_json = excluded.value_json")
+        .run(key, JSON.stringify(value));
+}
+function clearUnlockFlag() {
+    getDb().prepare("DELETE FROM intake_settings WHERE key = ?").run("linear.inboxUnlockV1");
+}
+beforeEach(() => {
+    closeDb();
+    process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-inbox-unlock-"));
+    delete process.env.LINEAR_STATE_FILTER;
+    migrate();
+});
+afterEach(() => closeDb());
+test("isLegacyLinearStateFilterDefault only matches the pre-unlock [Todo] default", () => {
+    assert.equal(isLegacyLinearStateFilterDefault(["Todo"]), true);
+    assert.equal(isLegacyLinearStateFilterDefault(["Todo", "Backlog"]), false);
+    assert.equal(isLegacyLinearStateFilterDefault(["Backlog", "Todo", "In Progress", "In Review"]), false);
+    assert.equal(isLegacyLinearStateFilterDefault("Todo"), false);
+});
+test("inbox unlock flips legacy assigneeMe true + [Todo] filter once", () => {
+    clearUnlockFlag();
+    writeSetting("linear.assigneeMe", true);
+    writeSetting("linear.stateFilter", ["Todo"]);
+    closeDb();
+    migrate();
+    assert.equal(readSetting("linear.assigneeMe"), false);
+    assert.deepEqual(readSetting("linear.stateFilter"), ["Backlog", "Todo", "In Progress", "In Review"]);
+    assert.equal(readSetting("linear.inboxUnlockV1"), true);
+});
+test("inbox unlock preserves customized assigneeMe false and Todo+Backlog filter", () => {
+    clearUnlockFlag();
+    writeSetting("linear.assigneeMe", false);
+    writeSetting("linear.stateFilter", ["Todo", "Backlog"]);
+    closeDb();
+    migrate();
+    assert.equal(readSetting("linear.assigneeMe"), false);
+    assert.deepEqual(readSetting("linear.stateFilter"), ["Todo", "Backlog"]);
+    assert.equal(readSetting("linear.inboxUnlockV1"), true);
+});
+test("inbox unlock is a no-op when the flag is already set even if values look legacy", () => {
+    writeSetting("linear.inboxUnlockV1", true);
+    writeSetting("linear.assigneeMe", true);
+    writeSetting("linear.stateFilter", ["Todo"]);
+    closeDb();
+    migrate();
+    assert.equal(readSetting("linear.assigneeMe"), true);
+    assert.deepEqual(readSetting("linear.stateFilter"), ["Todo"]);
+});