agent-relay-server 0.121.4 → 0.122.0

package/src/event-loop-lag.ts

@@ -53,6 +53,21 @@ export function eventLoopLagMaxMs(): number {
   return maxMs;
 }
 
+// Cumulative retained lag — the SUM of every sample in the ring, i.e. the total
+// event-loop processing debt across the retained window. SIDE-EFFECT-FREE (like
+// eventLoopLagMaxMs it never touches maxSinceLastReadMs, so reading it doesn't steal
+// the /health poller's spike). This is the stale/bus reaper's grace (#1055): the max
+// SINGLE sample (#1048) covers one contiguous stall (the 337s incident) but UNDER-
+// covers sustained NON-contiguous degradation — many sub-TTL stalls whose backlog
+// still sums past STALE_TTL. Summing every stall in the window extends the grace to the
+// real accumulated heartbeat backlog. Always >= eventLoopLagMaxMs(), so it can only
+// WIDEN the #1048 grace, never shrink it — no new false-reap risk introduced.
+export function eventLoopLagGraceMs(): number {
+  let total = 0;
+  for (let i = 0; i < sampleCount; i += 1) total += samples[i] ?? 0;
+  return total;
+}
+
 export function getEventLoopLagSnapshot(): EventLoopLagSnapshot {
   const maxMs = eventLoopLagMaxMs();
   const maxSinceLastRead = maxSinceLastReadMs;

package/src/gate-resolver.ts

@@ -9,7 +9,12 @@
 //      outright. A project that declared gates knows better than any heuristic.
 //   2. Derive from `package.json` — run the repo's DECLARED scripts via its detected
 //      package manager (from `packageManager` field or lockfile). A repo whose
-//      `scripts.test` is `jest` gets `<pm> run test`, never `bun test`.
+//      `scripts.test` is `jest` gets `<pm> run test`, never `bun test`. When the repo
+//      declares a full-gate script (`ci:land` preferred, else `ci`), that IS its gate
+//      (the set the release enforces): the steward runs it wholesale so land gates ==
+//      release gates (#1044), instead of a file-relevance subset that would let
+//      drift/lint/doc breakage land. `ci:land` exists for the worktree-safe subset — see
+//      the note at the derivation for why land gates can't run every release check.
 //   3. Default — the legacy bun heuristic, only when there's nothing to derive from
 //      (no repo path, or no readable package.json).
 import { existsSync, readFileSync } from "node:fs";
@@ -98,6 +103,24 @@ export function resolveStewardChecks(files: string[], repoRoot?: string): Stewar
   const pkg = repoRoot ? readPackageInfo(repoRoot) : null;
   if (pkg) {
     const runScript = (name: string) => `${pkg.pm} run ${name}`;
+    // 2a. Land==release parity (#1044): a repo that declares its full validation gate as
+    // a script has ALREADY named the set the release enforces. Run that ONE gate wholesale
+    // instead of a file-relevance subset (typecheck+test), so a land can't introduce
+    // drift/lint/doc breakage that only a narrower gate misses and that would otherwise
+    // surface at release time (failing `*:check`/lint gates).
+    //
+    // Prefer a `ci:land` script when the repo declares one: land gates run inside a git
+    // WORKTREE, and some release checks are not worktree-safe. agent-relay's own
+    // `build:claude-monitor:check` bundles provider modules whose resolution depends on
+    // checkout topology — a worktree's symlinked `node_modules` double-inlines them, so
+    // that check false-fails in every worktree (its topology-determinism root fix is
+    // tracked in #1045). `ci:land` is the worktree-safe subset of `ci` (ci == the two
+    // bundle steps + ci:land), so the steward and the release share ONE source of truth
+    // for the land-relevant gates without the steward hitting a structural false failure.
+    const fullGate = pkg.scripts["ci:land"] ? "ci:land" : pkg.scripts.ci ? "ci" : undefined;
+    if (fullGate && files.length) {
+      return [{ command: runScript(fullGate), reason: `repo declares a full "${fullGate}" gate (land==release parity)` }];
+    }
     if (has(/\.(ts|tsx|mts|cts)$/) && pkg.scripts.typecheck) {
       checks.push({ command: runScript("typecheck"), reason: "TypeScript files changed" });
     }

package/src/maintenance/jobs.ts

@@ -1,7 +1,7 @@
 import { getArtifactStorage } from "../artifact-storage";
 import { deriveAgentBusyHealth } from "../agent-busy-health";
 import { expireStaleBusAgents } from "../bus";
-import { eventLoopLagMaxMs } from "../event-loop-lag";
+import { eventLoopLagGraceMs } from "../event-loop-lag";
 import { pruneOutbox } from "../bus-outbox";
 import { expireCommands } from "../commands-db";
 import { getRetentionConfig } from "../retention-config-store";
@@ -22,6 +22,7 @@ import {
   releaseExpiredClaims,
   releaseExpiredDriveLeases,
   releaseOrphanedTasks,
+  revokeOrphanedRuntimeTokens,
   runDbMaintenanceAsync,
   sweepArtifacts,
 } from "../db";
@@ -278,7 +279,7 @@ export const definitions: MaintenanceJobDefinition[] = [
     intervalMs: REAP_INTERVAL_MS,
     runOnStart: true,
     handler() {
-      const expired = expireStaleBusAgents(undefined, eventLoopLagMaxMs());
+      const expired = expireStaleBusAgents(undefined, eventLoopLagGraceMs());
       for (const id of expired.agentIds) {
         getLifecycleManager().onAgentDisappeared(id);
         // #636/#659 — only after the stale reconnect grace expires do we turn a bare
@@ -301,11 +302,13 @@ export const definitions: MaintenanceJobDefinition[] = [
     intervalMs: REAP_INTERVAL_MS,
     runOnStart: true,
     handler() {
-      // #1048 — gate staleness on the relay's OWN event-loop health. eventLoopLagMaxMs()
-      // is side-effect-free (does not consume the /health poller's spike max). During a
-      // relay self-stall this grace keeps live agents whose heartbeats we simply couldn't
+      // #1048/#1055 — gate staleness on the relay's OWN event-loop health.
+      // eventLoopLagGraceMs() is side-effect-free (does not consume the /health poller's
+      // spike max) and sums the retained window's lag, so BOTH one contiguous stall and
+      // sustained non-contiguous overload (many sub-TTL stalls whose backlog sums past the
+      // TTL) extend the grace. Keeps live agents whose heartbeats we simply couldn't
       // process from being reaped as dead.
-      const lagGraceMs = eventLoopLagMaxMs();
+      const lagGraceMs = eventLoopLagGraceMs();
       const reapedAgentIds = reapStaleAgents(STALE_TTL_MS, lagGraceMs);
       for (const id of reapedAgentIds) {
         emitAgentStatus(id);
@@ -336,6 +339,20 @@ export const definitions: MaintenanceJobDefinition[] = [
       return { prunedAgentIds };
     },
   },
+  {
+    id: "orphan-token-revoker",
+    title: "Orphaned runtime-token revoker",
+    description: "Revoke ('stale', re-mintable) the runtime tokens of agents whose process the orchestrator confirmed dead and that have not been heard from since.",
+    intervalMs: REAP_INTERVAL_MS,
+    runOnStart: false,
+    handler() {
+      // #1057(1) — same lag discipline as the stale reaper (#1048/#1055): while the relay's own
+      // event loop was stalled, a live replacement's heartbeats may still be unprocessed, so the
+      // grace widens by the observed lag instead of misreading the backlog as post-mortem silence.
+      const revokedOrphanTokens = revokeOrphanedRuntimeTokens(STALE_TTL_MS, eventLoopLagGraceMs());
+      return { revokedOrphanTokens };
+    },
+  },
   {
     id: "orphaned-session-reaper",
     title: "Orphaned session reaper",

package/src/managed-policy.ts

@@ -1,6 +1,7 @@
 import { getManifest } from "agent-relay-providers";
 import { getAgentProfile } from "./config-store";
 import { withResolvedProvisioning } from "./db";
+import { composeProfileSpawnInstructions } from "./project-instructions";
 import { runnerRuntimeTokenEnv } from "./runtime-tokens";
 import { buildSpawnCommand, resolveSpawnModelParams } from "./spawn-command";
 import { applyDefaultSharedMcp } from "./shared-mcp";
@@ -10,11 +11,19 @@ function managedPolicyPromptMode(policy: SpawnPolicy): "prompt" | "append-system
   return getManifest(policy.provider)?.launch?.managedPolicyPrompt?.alwaysOn ?? "prompt";
 }
 
-export function managedPolicyProviderArgs(policy: SpawnPolicy): string[] {
+/**
+ * The always-on keepalive prompt an `append-system-prompt`-mode provider (Claude) carries as a
+ * system-prompt append (Codex uses the launch `prompt` channel instead — see
+ * `managedPolicyLaunchPrompt`). Returns undefined when it does not apply. #1052 folds this into
+ * `composeSpawnInstructionsWithEvents` as the caller append so there is a SINGLE ordered
+ * `--append-system-prompt` block (profile role charter + project knowledge + this keepalive),
+ * instead of a second stray `--append-system-prompt` arg that could stack on the composed one.
+ */
+export function managedPolicyAppendSystemPrompt(policy: SpawnPolicy): string | undefined {
   if (policy.mode === "always-on" && policy.prompt?.trim() && managedPolicyPromptMode(policy) === "append-system-prompt") {
-    return [...policy.providerArgs, "--append-system-prompt", policy.prompt.trim()];
+    return policy.prompt.trim();
   }
-  return policy.providerArgs;
+  return undefined;
 }
 
 export function managedPolicyLaunchPrompt(policy: SpawnPolicy): string | undefined {
@@ -33,10 +42,29 @@ interface ManagedSpawnContext {
 }
 
 export function buildManagedSpawnParams(policy: SpawnPolicy, requestId: string, ctx: ManagedSpawnContext): Record<string, unknown> {
-  const providerArgs = managedPolicyProviderArgs(policy);
   const prompt = managedPolicyLaunchPrompt(policy);
   const resolvedProfile = withResolvedProvisioning(policy.profile ? getAgentProfile(policy.profile)?.value : undefined, policy.provider);
   const agentProfile = resolvedProfile ? applyDefaultSharedMcp(resolvedProfile) : undefined;
+
+  // #1052 — run the SAME instruction projection a fresh interactive spawn gets
+  // (composeSpawnInstructionsWithEvents, the single home in spawn-agent.ts), so a MANAGED agent
+  // (e.g. the always-on coordinator) is onboarded IDENTICALLY on its first launch AND on every
+  // restart / deploy-bounce relaunch — this builder feeds both `spawnAgent` and `restartAgent`.
+  // Previously the managed path forwarded only `agentProfile` (for provisioning) + providerArgs
+  // and silently dropped the profile ROLE CHARTER (`instructions.system`/`append`), project-
+  // knowledge preamble, and scoped {profile|user} memory, so a restarted coordinator reverted to
+  // provider-default IC behavior until a human re-injected the role file (#1052). The always-on
+  // keepalive prompt folds in as the caller append → one ordered `--append-system-prompt` block,
+  // no double-inject. The projection is deterministic (sorted + deduped), so re-running it on a
+  // native-resume relaunch reproduces a byte-identical block rather than stacking a second copy.
+  const alwaysOnAppend = managedPolicyAppendSystemPrompt(policy);
+  const composed = composeProfileSpawnInstructions({
+    cwd: policy.cwd,
+    ...(policy.profile ? { profileName: policy.profile } : {}),
+    ...(agentProfile ? { profile: agentProfile } : {}),
+    ...(alwaysOnAppend ? { callerSystemPromptAppend: alwaysOnAppend } : {}),
+  });
+
   return buildSpawnCommand({
     provider: policy.provider,
     orchestratorId: policy.orchestratorId,
@@ -51,8 +79,10 @@ export function buildManagedSpawnParams(policy: SpawnPolicy, requestId: string,
     capabilities: policy.capabilities,
     approvalMode: policy.permissionMode,
     permissionMode: policy.permissionMode,
-    providerArgs,
+    providerArgs: policy.providerArgs,
     prompt: prompt || undefined,
+    ...(composed.systemPromptAppend ? { systemPromptAppend: composed.systemPromptAppend } : {}),
+    ...(composed.relayInjectionEvents.length ? { relayInjectionEvents: composed.relayInjectionEvents } : {}),
     headless: true,
     policyName: policy.name,
     spawnRequestId: requestId,

package/src/mcp-plan-tools.ts

@@ -1,5 +1,6 @@
-import { McpNotFoundError } from "./mcp-errors";
+import { McpAuthError, McpNotFoundError } from "./mcp-errors";
 import { ValidationError } from "./db";
+import { ServiceAuthError } from "./services/errors";
 import { authContextFromMcp } from "./services/auth-context";
 import {
   addPlanEdge,
@@ -126,6 +127,17 @@ function stringArg(value: unknown, field: string): string {
 }
 
 export function relayPlanTool(auth: McpAuthLike, name: string, args: Record<string, unknown>): Record<string, unknown> {
+  try {
+    return dispatchPlanTool(auth, name, args);
+  } catch (e) {
+    // A service-layer auth failure (e.g. #1043's message:send gate on the auto-mint) is an auth
+    // error on the wire — map it like the messaging tools do so the MCP edge returns 403.
+    if (e instanceof ServiceAuthError) throw new McpAuthError(e.message);
+    throw e;
+  }
+}
+
+function dispatchPlanTool(auth: McpAuthLike, name: string, args: Record<string, unknown>): Record<string, unknown> {
   const ctx = authContextFromMcp(auth);
   if (name === "relay_plan_create") return createPlan(args as unknown as Parameters<typeof createPlan>[0], ctx) as unknown as Record<string, unknown>;
   if (name === "relay_plan_add_node") {

package/src/project-instructions.ts

@@ -10,7 +10,8 @@
 // content — a policy switch here, zero schema/composer change. `project_entries.source`
 // is that lever: the included-source set is a policy PARAMETER, and the `vanilla`
 // policy includes `manual`+`promoted` while excluding `ingested`.
-import { resolveProjectEntries } from "./db";
+import { DEFAULT_USER_ID } from "agent-relay-sdk";
+import { resolveProjectEntries, resolveProjectForCwd, resolveScopedAnchor } from "./db";
 import { renderTemplate } from "./prompt-resolver";
 import { PROJECT_ENTRY_SOURCES, type AgentProfile, type Project, type ProjectEntryKind, type ProjectEntrySource, type RelayInjectionCategory, type ResolvedProjectEntry } from "./types";
 
@@ -57,7 +58,7 @@ interface SpawnInstructionInjectionEvent {
   detail: Record<string, unknown>;
 }
 
-interface ComposedSpawnInstructions {
+export interface ComposedSpawnInstructions {
   systemPromptAppend?: string;
   relayInjectionEvents: SpawnInstructionInjectionEvent[];
 }
@@ -295,6 +296,39 @@ export function composeSpawnInstructions(input: Parameters<typeof composeSpawnIn
   return composeSpawnInstructionsWithEvents(input).systemPromptAppend;
 }
 
+/**
+ * #1052 — the SINGLE home that resolves a profile's spawn-time knowledge world (project
+ * preamble for the cwd + scoped {profile|user} memory anchors) and runs
+ * `composeSpawnInstructionsWithEvents`. Every path that (re)builds a profile-bearing spawn —
+ * fresh managed spawn, managed-policy restart, AND the dashboard "restart Runner/Agent" relaunch
+ * for a NON-policy agent — must call this so a restarted agent is onboarded byte-identically to
+ * its first launch (role charter + project knowledge + scoped memory). Before #1052-v2 the
+ * dashboard-restart path for a dashboard-spawned (non-policy) coordinator called
+ * `buildSpawnCommand` WITHOUT this projection, so the relaunched process came back with EMPTY
+ * injection logs and silently reverted to provider-default IC behavior.
+ */
+export function composeProfileSpawnInstructions(input: {
+  cwd?: string;
+  profileName?: string;
+  profile?: Pick<AgentProfile, "instructions" | "maxSpawnedAgents" | "projectInstructions">;
+  callerSystemPromptAppend?: string;
+  /** Operator/user anchor key; defaults to the single-operator default store. */
+  operatorId?: string;
+}): ComposedSpawnInstructions {
+  const callerProject = input.cwd ? resolveProjectForCwd(input.cwd) ?? undefined : undefined;
+  const projectInstructions = input.profile?.projectInstructions;
+  const profileAnchor = input.profileName ? resolveScopedAnchor("profile", input.profileName) ?? undefined : undefined;
+  const userAnchor = resolveScopedAnchor("user", input.operatorId ?? DEFAULT_USER_ID) ?? undefined;
+  return composeSpawnInstructionsWithEvents({
+    ...(callerProject ? { callerProject } : {}),
+    ...(projectInstructions ? { projectInstructions } : {}),
+    ...(profileAnchor ? { profileAnchor } : {}),
+    ...(userAnchor ? { userAnchor } : {}),
+    ...(input.profile ? { profile: input.profile } : {}),
+    ...(input.callerSystemPromptAppend ? { callerSystemPromptAppend: input.callerSystemPromptAppend } : {}),
+  });
+}
+
 /**
  * Parse a spawn-transport's `projectInstructions` wire value into the normalized policy
  * (or undefined = OFF). Shared by the MCP and HTTP spawn paths so they cannot drift.

package/src/quota-advisory.ts

@@ -5,7 +5,7 @@ import { emitRelayEvent } from "./events";
 import { routeNotification } from "./notification-router";
 import { DEFAULT_QUOTA_THRESHOLD_CONFIG, validateQuotaThresholdConfig } from "./quota-threshold-config";
 import { parseJson } from "./utils";
-import { setProviderQuotaAdvisoryHandler, type ProviderQuotaAdvisoryInput } from "./db/provider-quotas.ts";
+import { setProviderQuotaAdvisoryHandler, type ProviderQuotaAdvisoryInput, type ProviderQuotaAdvisoryResult } from "./db/provider-quotas.ts";
 import { processBandTransitions } from "./quota-band-transition";
 import type { QuotaState } from "./types";
 
@@ -40,7 +40,7 @@ export function installQuotaAdvisoryHandler(): void {
   setProviderQuotaAdvisoryHandler(handleProviderQuotaAdvisory);
 }
 
-function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): string {
+function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): ProviderQuotaAdvisoryResult {
   const config = effectiveQuotaNotificationConfig().quotaThreshold;
   const state = parseJson<QuotaAdvisoryState>(input.previousAdvisoryState ?? "{}", {});
   const nextState: QuotaAdvisoryState = { ...state };
@@ -101,8 +101,10 @@ function handleProviderQuotaAdvisory(input: ProviderQuotaAdvisoryInput): string
     };
   }
 
-  processBandTransitions(input);
-  return JSON.stringify(nextState);
+  // #1074 — thread the persisted band-hysteresis state through the transition pipeline and return
+  // the new state so it is written back to quota_band_state, surviving relay restarts.
+  const bandState = processBandTransitions(input, input.previousBandState);
+  return { advisoryState: JSON.stringify(nextState), bandState };
 }
 
 function hasLastQuotaAdvisory(previous: QuotaAdvisoryWindowState | undefined): boolean {

package/src/quota-band-transition.ts

@@ -38,6 +38,7 @@ import { getSpawnCapableAgentIds } from "./routing-policy-push";
 import { getProviderBandInfo, quotaBandFromSignal, windowRecommendedAction } from "./spawn-targets";
 import type { ProviderBandInfo, ProviderBandWindow, QuotaBand } from "./spawn-targets";
 import type { ProviderQuotaAdvisoryInput } from "./db/provider-quotas";
+import { parseJson } from "./utils";
 
 const DEBOUNCE_SAMPLES = 3;
 // #798 — EMA time constant for the low-pass. "A few minutes": longer than the ~5-min poll-cadence
@@ -68,6 +69,13 @@ interface TransitionState {
   emaUpdatedAt: number;
 }
 
+// #1074 — the per-`provider:role` hysteresis state (EMA low-pass, lastNotifiedBand, debounce
+// counters, lastTransitionAt). Serialized to the provider_quotas.quota_band_state DB column so it
+// survives a relay restart: without it every restart re-seeds lastNotifiedBand="normal" and re-fires
+// an already-sent degradation to the whole fleet. Mirrors the previousAdvisoryState round-trip in
+// quota-advisory.ts — state is passed IN and returned OUT, this module holds no cross-call memory.
+type BandTransitionState = Record<string, TransitionState>;
+
 // #798 — dt-based EMA blend factor: 1 − e^(−dt/τ). dt = 0 (or first sample) → seed verbatim.
 function emaAlpha(dtMs: number): number {
   if (!(dtMs > 0)) return 1;
@@ -79,12 +87,6 @@ function emaStep(prev: number | null, value: number, dtMs: number): number {
   return prev + emaAlpha(dtMs) * (value - prev);
 }
 
-const bandState = new Map<string, TransitionState>();
-
-export function _resetBandTransitionStateForTesting(): void {
-  bandState.clear();
-}
-
 // Test hook: supply a controlled band-info function to exercise hysteresis logic
 // without a full DB setup. Set to null to restore the real implementation.
 let _bandInfoSupplier: ((provider: string, now: number) => ProviderBandInfo | undefined) | null = null;
@@ -95,15 +97,24 @@ export function _clearBandInfoSupplierForTesting(): void {
   _bandInfoSupplier = null;
 }
 
-export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void {
+// #1074 — pure state-threading transition step. Takes the previously persisted band state
+// (serialized `quota_band_state`, may be null/empty on a fresh provider), applies the band-transition
+// hysteresis pipeline for this sample, and returns the new serialized state to persist. Holds no
+// module-level memory, so a relay restart that re-hydrates from the DB continues hysteresis seamlessly
+// instead of re-seeding to "normal" and re-firing an already-sent degradation.
+export function processBandTransitions(
+  input: ProviderQuotaAdvisoryInput,
+  previousBandState?: string | null,
+): string {
+  const bandState = parseJson<BandTransitionState>(previousBandState ?? "{}", {});
   const info = (_bandInfoSupplier ?? getProviderBandInfo)(input.provider, input.now);
-  if (!info) return;
+  if (!info) return JSON.stringify(bandState);
 
   for (const window of info.windows) {
     if (window.confidence === "low" || window.burnRatio === null) continue;
 
     const key = `${input.provider}:${window.role}`;
-    const state: TransitionState = bandState.get(key) ?? {
+    const state: TransitionState = bandState[key] ?? {
       lastNotifiedBand: "normal",
       pendingBand: null,
       pendingCount: 0,
@@ -124,7 +135,7 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
     state.emaUpdatedAt = input.now;
     // Persist immediately so the low-pass state survives every early-continue below (the state is
     // then mutated in place by reference — the EMA must carry across ticks to smooth excursions).
-    bandState.set(key, state);
+    bandState[key] = state;
     const smoothedBand = quotaBandFromSignal(emaPenalty, emaSlack, info.quotaBands, info.preferSlackAt);
 
     // #756 (layer 2): asymmetric hysteresis — recovery needs penalty HYSTERESIS_MARGIN below the
@@ -149,7 +160,6 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
       // #756: rate-limit recovery — it is not an actionable signal for coordinators.
       const isRecovery = bandRank(effectiveBand) < bandRank(state.lastNotifiedBand);
       if (isRecovery && input.now - state.lastTransitionAt < RECOVERY_MIN_INTERVAL_MS) {
-        bandState.set(key, state);
         continue;
       }
 
@@ -158,7 +168,6 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
       state.pendingBand = null;
       state.pendingCount = 0;
       state.lastTransitionAt = input.now;
-      bandState.set(key, state);
       emitBandTransition({
         provider: input.provider,
         window,
@@ -169,10 +178,10 @@ export function processBandTransitions(input: ProviderQuotaAdvisoryInput): void
         recommendedAction: windowRecommendedAction(effectiveBand, window.slack),
         now: input.now,
       });
-    } else {
-      bandState.set(key, state);
     }
   }
+
+  return JSON.stringify(bandState);
 }
 
 // Asymmetric hysteresis: degradation uses the normal (entry) threshold; recovery requires

package/src/routes/agent-sessions.ts

@@ -2,7 +2,7 @@
 import { RELAY_TOKEN_HEADER, isRecord, isSpawnProvider } from "agent-relay-sdk";
 import { VALID_AGENT_ACTIONS, agentControlActionIcon, auditEvent, authAuditMetadata, authorizeAgentRoute, authorizeRoute, canViewAgentRoute, cleanAttachmentRefs, dashboardAttribution, emitCommand, error, json, metaString, parseBody, requestUserAddress, requestUserId, spawnRequestId, type AgentControlAction, type Handler } from "./_shared";
 import { arbitrateDrive, currentDriver, drivingMessage, releaseDrive, type DriveArbitration } from "../agent-drive-arbiter";
-import { ValidationError, getAgent, getAgentTimeline, getOrchestrator, markReady, mergeAgentMeta, sendMessage, withResolvedProvisioning } from "../db";
+import { ValidationError, getAgent, getAgentTimeline, getOrchestrator, markReady, mergeAgentMeta, readSpawnCallerSystemPromptAppend, resolveAgentOwnership, sendMessage, withResolvedProvisioning } from "../db";
 import { announcePresence, viewersForAgent } from "../dashboard-presence";
 import { buildManagedSpawnParams } from "../managed-policy";
 import { buildSpawnCommand, generateSpawnRequestId, resolveSpawnModelParams } from "../spawn-command";
@@ -19,6 +19,7 @@ import { ShutdownAuthError, ShutdownTargetError, shutdownAgent } from "../servic
 import { type AgentCard, type SpawnApprovalMode } from "../types";
 import { type ProviderEffort } from "agent-relay-sdk/provider-catalog";
 import { getManifest } from "agent-relay-providers";
+import { composeProfileSpawnInstructions } from "../project-instructions";
 import { relayToken } from "../config";
 
 // 409 when a second human tries to drive an agent another user is already driving (#394). The
@@ -95,7 +96,7 @@ function managedControlOrchestrator(agent: AgentCard): NonNullable<ReturnType<ty
   return candidates.find((orch) => orch.status === "online") ?? null;
 }
 
-function restartSpawnParamsForAgent(
+export function restartSpawnParamsForAgent(
   agent: AgentCard,
   orchestrator: NonNullable<ReturnType<typeof getOrchestrator>> | null,
   policyName?: string,
@@ -103,7 +104,15 @@ function restartSpawnParamsForAgent(
   opts: { resumeId?: string } = {},
 ): Record<string, unknown> | undefined {
   if (!orchestrator) return undefined;
-  const requestId = spawnRequestId ?? spawnRequestIdForRestart();
+  // #1065 — mint a FRESH spawnRequestId for the successor, NEVER reuse the predecessor's. Reusing
+  // it voided the #1059 instance guard (exitCertificateMatchesInstance keys death-certificate
+  // identity on spawnRequestId): a late/duplicate exit report for the dead predecessor carried the
+  // same id as the live successor, so the guard treated the stale certificate as a match and
+  // false-reaped the running session (#1054/#1059 reopener). Every other respawn path mints fresh
+  // (lifecycle-manager, spawn-policy) and the runner documents the invariant (control.ts:284). The
+  // predecessor id (`spawnRequestId`) is still used below to recover the #1062 parent brief from the
+  // ORIGINAL agent.spawn command — read before the mint so the brief follows the agent, not the id.
+  const requestId = generateSpawnRequestId();
   const policy = policyName ? getSpawnPolicy(policyName) : null;
   const requestedBy = opts.resumeId ? "dashboard-resume" : "dashboard-restart";
   if (policy) {
@@ -124,6 +133,27 @@ function restartSpawnParamsForAgent(
   const agentProfile = resolvedProfile ? applyDefaultSharedMcp(resolvedProfile) : undefined;
   const workspaceMode = metaString(agent.meta, "workspaceMode") ?? "inherit";
   const resolvedModel = resolveSpawnModelParams(provider, model, effort, { onError: "passthrough", skipDefaultWhenEmpty: true });
+  // #1052-v2 — a dashboard-spawned agent has NO spawn policy, so its restart skips the
+  // `buildManagedSpawnParams` policy branch above and lands here. Re-project the profile role
+  // charter / project knowledge / scoped memory (the SAME projection a fresh spawn gets) so the
+  // relaunch is onboarded byte-identically instead of reverting to provider-default IC behavior.
+  // #1062 — two remaining fresh-spawn divergences closed here: (1) anchor the user/operator scoped
+  // memory to the agent's OWNER via resolveAgentOwnership (a fresh spawn does the same), not the
+  // default operator; and (2) re-thread the parent's ORIGINAL caller brief, recovered from the
+  // persisted agent.spawn command, so a restarted spawned child keeps its task brief.
+  // #1065 — key this on the PREDECESSOR id (`spawnRequestId`), NOT the freshly-minted `requestId`:
+  // the caller brief was persisted on the original agent.spawn command, which the successor's fresh
+  // id has no row for. Recovering it here re-injects the brief onto the new instance.
+  // #1067 — recovery must survive N restarts, not just one. Because #1065 rotates the id every
+  // restart and never writes an agent.spawn row for the successor, a naive single-hop lookup found
+  // the brief on restart #1 (predecessor = original id) but lost it on restart #2 (predecessor =
+  // the fresh id from restart #1, which has no spawn row). Fix: re-persist the RAW brief under the
+  // fresh id below (passed through to `callerSystemPromptAppend` on this restart's `restartSpawn`
+  // params — the SAME field a fresh agent.spawn stashes it in, see spawn-agent.ts). The reader then
+  // recovers it from either the original agent.spawn row OR a later agent.restart row, so each
+  // generation has its own recoverable copy and the brief follows the agent across every rotation.
+  const callerAppend = readSpawnCallerSystemPromptAppend(spawnRequestId);
+  const composed = composeProfileSpawnInstructions({ cwd, operatorId: resolveAgentOwnership(agent.id).ownerUserId, ...(profileName ? { profileName } : {}), ...(agentProfile ? { profile: agentProfile } : {}), ...(callerAppend ? { callerSystemPromptAppend: callerAppend } : {}) });
   const params = buildSpawnCommand({
     provider,
     modelParams: resolvedModel,
@@ -138,6 +168,12 @@ function restartSpawnParamsForAgent(
     approvalMode: approvalMode ?? "guarded",
     permissionMode: approvalMode ?? "guarded",
     providerArgs: providerArgs.length ? providerArgs : undefined,
+    ...(composed.systemPromptAppend ? { systemPromptAppend: composed.systemPromptAppend } : {}),
+    // #1067 — re-persist the RAW brief (pre-composition) under this restart's fresh spawnRequestId so
+    // the NEXT restart, whose predecessor id is this fresh id, can recover it. Without this the brief
+    // survives only one restart (the original agent.spawn row is keyed on the very first id).
+    ...(callerAppend ? { callerSystemPromptAppend: callerAppend } : {}),
+    ...(composed.relayInjectionEvents.length ? { relayInjectionEvents: composed.relayInjectionEvents } : {}),
     policyName: policyName || undefined,
     headless: true,
     spawnRequestId: requestId,
@@ -157,10 +193,6 @@ function restartSpawnParamsForAgent(
   return opts.resumeId ? withResumeParams(params, opts.resumeId, agent.id) : params;
 }
 
-function spawnRequestIdForRestart(): string {
-  return generateSpawnRequestId();
-}
-
 function withResumeParams(params: Record<string, unknown>, resumeId: string, agentId: string): Record<string, unknown> {
   return {
     ...params,

package/src/routes/agents.ts

@@ -2,6 +2,7 @@
 import { VALID_AGENT_STATUSES, agentSessionStatus, auditEvent, canViewAgentRoute, error, json, memoryContext, memoryErrorResponse, normalizeAgentSessionGuard, parseBody, parseId, parseQueryInt, visibleAgentIdsForRequest, type Handler } from "./_shared";
 import { ValidationError, deleteAgent, getAgent, getAgentTimeline, getCrashReport, heartbeat, listAgentChatHistory, listAgents, listArtifactsForEntity, listContextSnapshots, listPendingReplyObligations, listQuotaSnapshots, markReady, searchAgents, setLabel, setStatus, setTags, validateAgentSession } from "../db";
 import { attachBranchState, attachBranchStates } from "../agent-branch-state";
+import { attachCommandActivities, attachCommandActivity } from "../agent-command-activity";
 import { attachIssueRepo, attachIssueRepos } from "../agent-issue-repo";
 import { cleanStringArray } from "../validation";
 import { clearActiveMemories, memoryBroker } from "../memory-service";
@@ -53,7 +54,7 @@ export const getAgents: Handler = (req) => {
   // (visibleAgentIdsForRequest returns every id), so today's list is byte-for-byte unchanged.
   const agents = listAgents({ tag, machine, status });
   const visible = visibleAgentIdsForRequest(req, agents.map((a) => a.id));
-  return json(attachIssueRepos(attachBranchStates(agents.filter((a) => visible.has(a.id)))));
+  return json(attachCommandActivities(attachIssueRepos(attachBranchStates(agents.filter((a) => visible.has(a.id))))));
 };
 
 export const findAgents: Handler = (req) => {
@@ -69,7 +70,7 @@ export const getAgentById: Handler = (req, params) => {
   if (!agent) return error("agent not found", 404);
   // #392: a non-visible agent must look indistinguishable from a missing one (no existence leak).
   if (!canViewAgentRoute(req, agent.id)) return error("agent not found", 404);
-  return json(attachIssueRepo(attachBranchState(agent)));
+  return json(attachCommandActivity(attachIssueRepo(attachBranchState(agent))));
 };
 
 // #636 — "why did it die" data source. The crash report outlives the agent row (separate table),

package/src/routes/tasks.ts

@@ -3,9 +3,9 @@ import { MAX_BODY_BYTES } from "../config";
 import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacks, emitCommand, error, json, normalizeAgentSessionGuard, parseBody, parseId, parseQueryInt, resolveActorLabel, type Handler } from "./_shared";
 import { getComponentAuth, isFullReachRequest } from "../security";
 import { authContextFromRequest } from "../services/auth-context";
-import { agentIdFromComponent, isTaskDispatchAuthorized, isTaskReadAuthorized } from "../task-authz";
+import { agentIdFromComponent, hasTaskReadAdminScope, isTaskDispatchAuthorized, isTaskReadAuthorized } from "../task-authz";
 import { dispatchShapeArg, pinArg, runTaskDispatch } from "../mcp-dispatch-tools";
-import { ValidationError, claimTask, getMessage, getTask, listTaskEvents, listTasks, recordTaskEvent, renewTaskClaim, updateTaskStatus } from "../db";
+import { ValidationError, claimTask, getMessage, getTask, listTaskEvents, listTasks, recordTaskEvent, renewTaskClaim, updateTaskStatus, type TaskStatusActor } from "../db";
 import { readTaskMemoryEnvelope } from "../db/task-memory";
 import {
   addTaskEntityDependency, addTaskEntityRef, assignTaskEntityAgent, createTaskEntity, getTaskEntity,
@@ -531,9 +531,21 @@ export const patchTaskStatus: Handler = async (req, params) => {
   if (id === null) return error("invalid task id");
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
+  // Ownership fence (#1063): bind the write to the AUTHENTICATED caller, not the request body.
+  // Full-reach/system callers and task-admin scopes bypass (same convention as isTaskDispatchAuthorized
+  // / #1043's ensureCanMintThread); an ordinary task:write holder is pinned to its own agent id and
+  // can only advance a task it actually owns. An unidentified non-privileged caller is refused rather
+  // than silently falling back to the owner id.
+  const ctx = authContextFromRequest(req);
+  const privileged = ctx.actor.kind === "system" || hasTaskReadAdminScope(ctx.scopes);
+  if (!privileged && !ctx.callerAgentId) return error("task status requires an identified caller", 403);
+  const actor: TaskStatusActor = privileged ? { privileged: true } : { agentId: ctx.callerAgentId };
   try {
-    const result = updateTaskStatus(id, normalizeTaskStatusInput(parsed.body));
-    if (!result.ok) return error(result.error!, result.error === "task not found" ? 404 : agentSessionStatus(result.error));
+    const result = updateTaskStatus(id, normalizeTaskStatusInput(parsed.body), actor);
+    if (!result.ok) {
+      const status = result.error === "task not found" ? 404 : result.conflict ? 409 : agentSessionStatus(result.error);
+      return error(result.error!, status);
+    }
     emitTaskChanged(result.task!, "task.status");
     const capturedMemory = result.task!.status === "done"
       ? await captureTaskResultMemory(result.task!, result.task!.result)