eve-hub 0.5.6 → 0.5.7

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # eve-hub
 
+## 0.5.7
+
+### Patch Changes
+
+- `post_message` takes a reviewer's `verdict` (ship, fix-first, rethink) and `decisions`; a ship without a change-explainer for the PR shows "no explainer" on the Dash.
+
 ## 0.5.6
 
 ### Patch Changes

package/README.md

@@ -8,8 +8,9 @@ The bot-side code every hub agent shares (milestone M3 in [`docs/architecture`](
 | `tools/create_thread.ts`, `post_message.ts`, `archive_thread.ts`, `unarchive_thread.ts`, `list_agents.ts`, `create_agent.ts`, `remove_agent.ts`, `restart_agent.ts`, `agent_send.ts`, `tag_threads.ts`, `apply_tags.ts` | The orchestrator's tools | `main`'s `agent/tools/<same name>.ts` |
 | `hooks/sandbox.ts` | Migrates legacy Docker sessions to the host sandbox (`defineHook`) | `agent/hooks/sandbox.ts` |
 | `instructions/main.ts`, `main-instructions.mjs` | main's instructions (`defineInstructions`), rendered at build time from the kit's `templates/main-instructions.md` + `workspace-protocol.md`, so no workspace carries a copy | `main`'s `agent/instructions.ts`; workspace-only additions in `agent/instructions/*.md` |
-| `instructions/protocol.ts` | The shared protocol alone, rendered from `templates/workspace-protocol.md` | every other bot's `agent/instructions/protocol.ts`, appended after its own `instructions.md` (who the bot is) |
-| `memory/workspace.ts`, `memory.mjs` | an eve memory slot (default export, constant `workspace` scope) whose provider recalls the workspace's `memory/<id>.md` entries, one message each, at every turn start and after compaction, only the ones whose text changed since the session last saw them, as new messages after the history; `validateMemory(root)` for a workspace's tests | every bot's (main too) `agent/memory/workspace.ts`: `export { default } from "eve-hub/memory/workspace"` |
+| `instructions/protocol.ts` | The shared protocol alone, rendered from `templates/workspace-protocol.md` followed by `templates/engineering.md` | every other bot's `agent/instructions/protocol.ts`, appended after its own `instructions.md` (who the bot is) |
+| `instructions/engineering.ts` | The engineering page alone (`templates/engineering.md`), for a subagent that doesn't carry the protocol | the subagent's `instructions/engineering.ts` |
+| `memory/workspace.ts`, `memory.mjs` | an eve memory slot (default export, constant `workspace` scope) whose provider recalls the workspace's `memory/<id>.md` entries (plus the `memory/<domain>/` folders the bot lists as `domains` in its roster entry), one message each, at every turn start and after compaction, only the ones whose text changed since the session last saw them, as new messages after the history; `validateMemory(root)` for a workspace's tests | every bot's (main too) `agent/memory/workspace.ts`: `export { default } from "eve-hub/memory/workspace"` |
 | `memory/bot.ts` | the same for the bot's own `agents/<bot>/memory/<id>.md` entries; the bot is found from its directory (`findBotDir`), scope is its name | every bot's `agent/memory/bot.ts`: `export { default } from "eve-hub/memory/bot"` |
 | `channels/eve-roster-user.ts` | `eveChannel({ auth: [rosterUser, localDev()] })`: eve's default steer policy, and the registry's `x-roster-user` human as a user principal | every bot's `agent/channels/eve.ts` |
 | `channels/eve.ts` | Re-exports `eve-roster-user.ts`, for stubs written before every bot shared one channel | older `agent/channels/eve.ts` stubs |
@@ -56,11 +57,11 @@ Add a changeset (`pnpm changeset`, pick `eve-hub`) when a tool's name, schema, o
 
 ## Published package (deployed workspaces)
 
-A deployed workspace (`node scripts/workspace-template.mjs <dir>`, lib/workspace-template.mjs) has no hub checkout to link, so it installs the kit from npm, published as [`eve-hub`](https://www.npmjs.com/package/eve-hub): `"eve-hub": "<version>"`. `node packages/agent-kit/scripts/pack.mjs <outDir>` builds the package: every `.ts` module compiled to `.js` + `.d.ts` in place (node won't strip types under `node_modules`), the `exports` map pointed at them, and `templates/` included.
+A deployed workspace (lib/workspace-template.mjs, staged by hosted-hub/scripts/stage-workspace.mjs) has no hub checkout to link, so it installs the kit from npm, published as [`eve-hub`](https://www.npmjs.com/package/eve-hub): `"eve-hub": "<version>"`. `node packages/agent-kit/scripts/pack.mjs <outDir>` builds the package: every `.ts` module compiled to `.js` + `.d.ts` in place (node won't strip types under `node_modules`), the `exports` map pointed at them, and `templates/` included.
 
 Releases go through Changesets, as in eve. A PR that changes the kit adds a changeset (`pnpm changeset`) and applies it (`pnpm changeset version`); when it merges, `.github/workflows/release.yml` runs `changeset publish` (no bot commits to main: its ruleset allows only PR merges): the kit's `prepack` stages the package into `dist/npm` (its `publishConfig.directory`), npm gets it, and the `eve-hub@<version>` GitHub release is created. npm auth is the repo's `NPM_TOKEN` secret (an npm automation token). The template pins the version this checkout carries.
 
-The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` and, since the hosted hub keeps Vercel Authentication on, `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret), each when set.
+The template's main gets a Vercel Sandbox and only the kit stubs that run without the hub's machine (lib/workspace-template.mjs `DEPLOYED_KIT_FILES`; eve's own bash replaces the kit's). The template's builder also mounts eve-code (`eve/extensions/code`: `apply_patch`, `grep`, the review skills, a read-only worker) and `eve/extensions/git` (`git({})`), both with no `github` option. The bot uses `gh` and `git` from bash, whose GitHub token is the sandbox firewall's (`VERCEL_SANDBOX`), and no `gh` tool is contributed. A deployed workspace's eve is the one pin in `hosted-hub/bots/package.json`, which staging copies over the template's (an eve snapshot with both `eve/world-hub` and `eve/extensions/git`; `hosted-hub/test/stage-workspace.test.mjs` checks the staged imports resolve against it). The hub and local bots stay on the hub's eve. The published tarball (`scripts/pack.mjs`) leaves out the kit__worker extension, which mounts only on the hub's machine. The hub reaches each bot's eve channel with `Authorization: Bearer $BOT_TOKEN` (`bot-token.mjs`); the kit's calls to the hub (`registry-fetch.mjs`, at `ROSTER_REGISTRY_URL`) carry `Authorization: Bearer $HUB_TOKEN` and, since the hosted hub keeps Vercel Authentication on, `x-vercel-protection-bypass: $HUB_PROTECTION_BYPASS` (the hub project's automation bypass secret), each when set.
 
 ## Vercel Kit connection
 

package/fork-env.mjs

@@ -5,13 +5,14 @@
 // the fork brief only restate this; the sandbox enforces the defaults.
 // Short-lived either way: a fork can be retired (and an in-place fork's
 // thread go back to the shared root) while its session lives on.
-import { registryBase, registryFetch } from "./registry-fetch.mjs";
+import { registryFetch, sandboxRegistry } from "./registry-fetch.mjs";
 
 const TTL_MS = 3000;
 
-export function createForkEnv({ registry = registryBase(), fetchImpl = globalThis.fetch, now = Date.now } = {}) {
+export function createForkEnv({ registry = sandboxRegistry(), fetchImpl = globalThis.fetch, now = Date.now } = {}) {
   const cache = new Map(); // sessionId -> { config, at }
   return async function lookup(sessionId) {
+    if (registry === null) return null; // no local hub: no forks
     const hit = cache.get(sessionId);
     if (hit && now() - hit.at < TTL_MS) return hit.config;
     let config = null;

package/host-browser.js

@@ -11,7 +11,7 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
-import { registryFetch } from "./registry-fetch.mjs";
+import { registryFetch, sandboxRegistry } from "./registry-fetch.mjs";
 export const VIEWPORT = { width: 1280, height: 800 };
 const FRAME_MS = 200; // at most 5 frames/s leave for the registry
 const IDLE_MS = 10 * 60_000; // an unused browser is closed; the next use reopens its last URL
@@ -43,6 +43,8 @@ export function findChrome() {
     return existsSync(chrome) ? { path: chrome, shell: false } : null;
 }
 function reportScreen(body) {
+    if (!sandboxRegistry())
+        return;
     void registryFetch(`/api/sandbox/screen`, {
         method: "POST",
         headers: { "content-type": "application/json" },

package/host-sandbox.d.ts

@@ -104,11 +104,10 @@ export interface Fence {
     (what: string): Promise<void>;
     readonly sessionId: string;
     readonly root: string;
-    readonly registry: string;
     admit(kind: TicketKind, op: TicketOp, what: string, group?: TicketGroup): Promise<Ticket>;
 }
 export declare function ownershipGuard(sessionId: string, { registry, rootSessionId, agent }?: {
-    registry?: string;
+    registry?: string | null;
     rootSessionId?: string;
     agent?: string;
 }): Fence;

package/host-sandbox.js

@@ -15,7 +15,7 @@ import { promisify } from "node:util";
 import { defineSandboxProvider } from "eve/sandbox/provider";
 import { closeBrowser } from "./host-browser.js";
 import { createForkEnv } from "./fork-env.mjs";
-import { registryBase, registryFetch, registryHeaders } from "./registry-fetch.mjs";
+import { registryFetch, registryHeaders, sandboxRegistry } from "./registry-fetch.mjs";
 const execFileAsync = promisify(execFile);
 export const HOST_ROOT = resolve(process.env.ROSTER_HOST_ROOT ?? join(homedir(), "wrk"));
 // The provider's lifecycle, exported so tests drive start/resume directly.
@@ -145,11 +145,13 @@ export function killTree(child) {
 // Live terminal: every process's output is teed to the roster registry so the
 // UI can show each bot's sandbox as it works. Best-effort; never blocks.
 let procSeq = 0;
-const forkConfig = createForkEnv({ registry: registryBase() });
+const forkConfig = createForkEnv({ registry: sandboxRegistry() });
 // `retries`: the exit report is the one that must land (without it the
 // registry eventually marks the proc interrupted), so it rides out a registry
 // restart of a few seconds.
 function reportProc(body, retries = 0) {
+    if (!sandboxRegistry())
+        return;
     void registryFetch(`/api/sandbox/proc`, {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -233,7 +235,8 @@ function teeProcess(child, sessionId, command, cwd, rootSessionId) {
 // with identical parameters until a definite answer or a bounded deadline,
 // after which the op is not performed (a paused launcher is killed; a "not-run"
 // release is queued for the id) and SessionFenceError is thrown.
-// HUB_OWNERSHIP_GUARD=off disables tickets entirely.
+// HUB_OWNERSHIP_GUARD=off disables tickets entirely, as does having no local
+// registry (sandboxRegistry(): a laptop bot of the hosted hub).
 //
 // LIMITS of the guarantee: (1) unfenced work while the registry is unreachable
 // is outside it, by policy, and only reported after the fact; (2) descendants
@@ -402,8 +405,10 @@ export function stopRevocationPollers() {
         p.stop();
     pollers.clear();
 }
-export function ownershipGuard(sessionId, { registry = registryBase(), rootSessionId, agent = process.env.HUB_AGENT } = {}) {
+export function ownershipGuard(sessionId, { registry = sandboxRegistry(), rootSessionId, agent = process.env.HUB_AGENT } = {}) {
     const root = rootSessionId ?? sessionId;
+    if (registry === null)
+        return Object.assign(async () => { }, { sessionId, root, admit: async () => UNFENCED }); // no local hub: none to fence with
     let warned = false;
     const warnOnce = (message) => {
         if (!warned)
@@ -507,7 +512,7 @@ export function ownershipGuard(sessionId, { registry = registryBase(), rootSessi
         if (!ownership.owner)
             throw refusal(what, ownership);
     };
-    return Object.assign(check, { sessionId, root, registry, admit });
+    return Object.assign(check, { sessionId, root, admit });
 }
 // The paused launcher. /bin/sh runs this with fd 3 a socket to us and the
 // shell-startup variables moved to HUB_LAUNCH_* (so neither sh nor anything it

package/instructions/engineering.d.ts

@@ -0,0 +1,4 @@
+declare const _default: {
+    content: any;
+};
+export default _default;

package/instructions/engineering.js

@@ -0,0 +1,6 @@
+import { defineInstructions } from "eve/instructions";
+import { engineeringPage } from "../main-instructions.mjs";
+// The engineering page alone, for a subagent that doesn't carry the workspace
+// protocol (the protocol ends with this same page). A subagent re-exports this as
+// its instructions/engineering.ts.
+export default defineInstructions({ content: engineeringPage() });

package/main-instructions.mjs

@@ -1,5 +1,6 @@
 // main's instructions, rendered from the kit's templates: templates/main-instructions.md,
-// then the shared protocol (templates/workspace-protocol.md). One source for
+// then the shared protocol (templates/workspace-protocol.md, then the engineering
+// page, templates/engineering.md). One source for
 // `hub workspace init` (lib/agent-template.mjs) and for every workspace's main,
 // which imports it (instructions/main.ts) instead of carrying a copy, so a
 // template edit reaches each workspace on main's next build. Every other bot
@@ -11,6 +12,7 @@ import { findWorkspaceRoot } from "./workspace.mjs";
 
 const HEAD = "main-instructions.md";
 const PROTOCOL = "workspace-protocol.md";
+const ENGINEERING = "engineering.md";
 const templatesOf = (kitDir) => join(kitDir, "templates");
 
 // The templates sit next to the kit in the hub checkout. Run by node, this
@@ -27,13 +29,18 @@ export function templatesDir({ env = process.env, cwd = process.cwd() } = {}) {
 }
 
 export function mainInstructions(options) {
-  const dir = templatesDir(options);
-  const read = (name) => readFileSync(join(dir, name), "utf8");
-  return `${read(HEAD).trimEnd()}\n\n${read(PROTOCOL)}`;
+  const head = readFileSync(join(templatesDir(options), HEAD), "utf8");
+  return `${head.trimEnd()}\n\n${workspaceProtocol(options)}`;
 }
 
-// The shared protocol alone: every bot but main appends it after its own
+// The engineering page alone: the protocol ends with it, and a subagent that
+// never sees the protocol includes it (instructions/engineering.ts).
+export function engineeringPage(options) {
+  return readFileSync(join(templatesDir(options), ENGINEERING), "utf8");
+}
+
+// The shared protocol: every bot but main appends it after its own
 // instructions.md (agent/instructions/protocol.ts re-exports instructions/protocol.ts).
 export function workspaceProtocol(options) {
-  return readFileSync(join(templatesDir(options), PROTOCOL), "utf8");
+  return `${readFileSync(join(templatesDir(options), PROTOCOL), "utf8")}\n${engineeringPage(options)}`;
 }

package/memory/workspace.js

@@ -1,13 +1,18 @@
 import { defineMemory, defineMemoryProvider } from "eve/memory";
-import { loadMemoryRecall } from "../memory.mjs";
+import { botDomains, findBotDir, loadMemoryRecall } from "../memory.mjs";
 import { findWorkspaceRoot } from "../workspace.mjs";
 // The workspace's memory/ entries as an eve memory slot (see ../memory.mjs).
 // Recall re-reads memory/ at the start of every turn and after compaction and
 // returns only the entries whose text changed since this session last saw
 // them; eve appends those as user-role messages after the history, so the
 // system prompt and the cached prefix stay put when an entry changes.
-// One constant scope and namespace: every bot, every session, the same entries.
-const recall = ({ messages }) => ({ messages: loadMemoryRecall(findWorkspaceRoot(), messages) });
+// One constant scope and namespace. The entries are memory/ (every bot) plus
+// the folders for the domains this bot lists in hub.workspace.json.
+const recall = ({ messages }) => {
+    const root = findWorkspaceRoot();
+    const dir = findBotDir();
+    return { messages: loadMemoryRecall(root, messages, { domains: dir ? botDomains(root, dir) : [] }) };
+};
 export default defineMemory({
     description: "The human's standing decisions for this workspace, from its memory/ directory.",
     namespace: "hub-workspace-memory",

package/memory.mjs

@@ -5,6 +5,12 @@
 // them at the start of every turn (memory/workspace.ts, memory/bot.ts), so an
 // added, edited or superseded entry reaches the bot's next turn with no
 // rebuild or restart, appended after the history. Node built-ins only.
+// A workspace may group entries into domains: folders under memory/, nestable
+// (memory/ui/, memory/ui/motion/), same entry format. memory/ itself is the
+// domain every bot shares. A bot lists its domains in its hub.workspace.json
+// entry (`domains: ["ui/motion"]`) and recalls memory/ plus each listed
+// folder and every folder above it. The kit names no domain; a workspace
+// defines its own.
 // Shared entries name no bot: bots pick who acts next from the live workspace
 // state, never from a name, and a rule for one role says so in its text. A
 // rule for one bot goes in that bot's memory/ (or its instructions.md).
@@ -24,7 +30,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
-import { isWorkspace } from "./workspace.mjs";
+import { isWorkspace, readWorkspaceFile } from "./workspace.mjs";
 
 export const MEMORY_DIR = "memory";
 export const MAX_RULE_LINES = 3;
@@ -82,28 +88,64 @@ export function parseEntry(text, file = "entry.md") {
   return { id: f.id, status: f.status, since: f.since, evidence: f.evidence, ...(supersededBy ? { supersededBy } : {}), rule: lines.join(" ") };
 }
 
-// Every entry under <dir>/memory, sorted by id, and one error string per file
-// that isn't a valid entry. No memory/ directory is an empty memory. `label`
-// names the directory in errors; `knownIds` are ids a superseded_by may also
-// point at (a bot's entries may hand over to a shared one).
-export function readMemory(root, { label = MEMORY_DIR, knownIds = new Set() } = {}) {
-  const dir = join(root, MEMORY_DIR);
-  if (!existsSync(dir)) return { entries: [], errors: [] };
+// The folders under <root>/memory a bot with these domains recalls, as paths
+// relative to memory/: "" (the shared root), then each domain and its ancestors.
+export function domainFolders(domains = []) {
+  const folders = new Set([""]);
+  for (const domain of domains) {
+    const parts = domain.split("/");
+    for (let i = 1; i <= parts.length; i++) folders.add(parts.slice(0, i).join("/"));
+  }
+  return [...folders].sort();
+}
+
+// Every folder under <root>/memory, "" included: what a workspace's tests validate.
+export function allMemoryFolders(root) {
+  const folders = [""];
+  const walk = (rel) => {
+    for (const d of readdirSync(join(root, MEMORY_DIR, rel), { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : 1))) {
+      if (!d.isDirectory() || d.name.startsWith(".")) continue;
+      folders.push(rel ? `${rel}/${d.name}` : d.name);
+      walk(rel ? `${rel}/${d.name}` : d.name);
+    }
+  };
+  if (existsSync(join(root, MEMORY_DIR))) walk("");
+  return folders;
+}
+
+// Every entry in the given folders of <dir>/memory (default: the root only),
+// sorted by id, and one error string per file that isn't a valid entry, per
+// listed folder that doesn't exist, and per id used twice. No memory/
+// directory is an empty memory. `label` names the directory in errors;
+// `knownIds` are ids a superseded_by may also point at (a bot's entries may
+// hand over to a shared one).
+export function readMemory(root, { label = MEMORY_DIR, knownIds = new Set(), folders = [""] } = {}) {
   const entries = [];
   const errors = [];
-  const files = readdirSync(dir).filter((name) => name.endsWith(".md") && !name.startsWith(".") && name.toLowerCase() !== "readme.md").sort();
-  for (const name of files) {
-    const file = `${label}/${name}`;
-    try {
-      const entry = parseEntry(readFileSync(join(dir, name), "utf8"), file);
-      if (`${entry.id}.md` !== name) throw new MemoryError(`${file}: id ${entry.id} doesn't match the file name; rename it ${entry.id}.md`);
-      entries.push(entry);
-    } catch (error) {
-      errors.push(error instanceof MemoryError ? error.message : `${file}: ${error.message}`);
+  const where = new Map();
+  for (const folder of folders) {
+    const dir = folder ? join(root, MEMORY_DIR, folder) : join(root, MEMORY_DIR);
+    const prefix = folder ? `${label}/${folder}` : label;
+    if (!existsSync(dir)) {
+      if (folder) errors.push(`${prefix}: domain folder doesn't exist`);
+      continue;
+    }
+    const files = readdirSync(dir, { withFileTypes: true }).filter((d) => d.isFile() && d.name.endsWith(".md") && !d.name.startsWith(".") && d.name.toLowerCase() !== "readme.md").map((d) => d.name).sort();
+    for (const name of files) {
+      const file = `${prefix}/${name}`;
+      try {
+        const entry = parseEntry(readFileSync(join(dir, name), "utf8"), file);
+        if (`${entry.id}.md` !== name) throw new MemoryError(`${file}: id ${entry.id} doesn't match the file name; rename it ${entry.id}.md`);
+        if (where.has(entry.id)) throw new MemoryError(`${file}: id ${entry.id} is also ${where.get(entry.id)}; an id is used once`);
+        where.set(entry.id, file);
+        entries.push(entry);
+      } catch (error) {
+        errors.push(error instanceof MemoryError ? error.message : `${file}: ${error.message}`);
+      }
     }
   }
   const ids = new Set(entries.map((e) => e.id));
-  for (const e of entries) if (e.supersededBy && !ids.has(e.supersededBy) && !knownIds.has(e.supersededBy)) errors.push(`${label}/${e.id}.md: superseded_by ${e.supersededBy} has no entry`);
+  for (const e of entries) if (e.supersededBy && !ids.has(e.supersededBy) && !knownIds.has(e.supersededBy)) errors.push(`${where.get(e.id)}: superseded_by ${e.supersededBy} has no entry`);
   entries.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
   return { entries, errors };
 }
@@ -190,10 +232,11 @@ const warnOnce = (msg) => {
   console.warn(`memory: ${msg}`);
 };
 
-const unreadableIds = (errors) => new Set(errors.map((e) => /(?:^|\/)memory\/([^/:]+)\.md:/.exec(e)?.[1]).filter(Boolean));
+const unreadableIds = (errors) => new Set(errors.map((e) => /(?:^|\/)memory\/(?:[^/:]+\/)*([^/:]+)\.md:/.exec(e)?.[1]).filter(Boolean));
 
-export function loadMemoryRecall(root, history = [], { warn = warnOnce } = {}) {
-  const { entries, errors } = readMemory(root);
+// `domains`: the bot's domains (hub.workspace.json), see the header.
+export function loadMemoryRecall(root, history = [], { warn = warnOnce, domains = [] } = {}) {
+  const { entries, errors } = readMemory(root, { folders: domainFolders(domains) });
   for (const error of errors) warn(error);
   return memoryRecall(entries, history, { unreadable: unreadableIds(errors) });
 }
@@ -203,7 +246,7 @@ export function loadMemoryRecall(root, history = [], { warn = warnOnce } = {}) {
 // never by shadowing it), so a clash is an error and that file is skipped.
 export function readBotMemory(root, botDir) {
   const label = `${relative(root, botDir).split(sep).join("/")}/${MEMORY_DIR}`;
-  const shared = new Set(readMemory(root).entries.map((e) => e.id));
+  const shared = new Set(readMemory(root, { folders: allMemoryFolders(root) }).entries.map((e) => e.id));
   const { entries, errors } = readMemory(botDir, { label, knownIds: shared });
   const clash = entries.filter((e) => shared.has(e.id));
   for (const e of clash) errors.push(`${label}/${e.id}.md: id ${e.id} is also ${MEMORY_DIR}/${e.id}.md; give it its own id and supersede the other explicitly`);
@@ -231,10 +274,21 @@ export function findBotDir({ env = process.env, cwd = process.cwd() } = {}) {
   return null;
 }
 
+// The domains the bot in `botDir` lists in its hub.workspace.json entry. The
+// bot is its directory name, as in findBotDir.
+export function botDomains(root, botDir) {
+  return readWorkspaceFile(root).agents.find((a) => a.name === basename(botDir))?.domains ?? [];
+}
+
 // For a workspace's tests: throws one MemoryError listing every bad file,
-// shared and per bot (agents/*/memory/). Returns the shared entries.
+// shared (every folder) and per bot (agents/*/memory/), and every domain a bot
+// lists that has no folder. Returns the shared entries.
 export function validateMemory(root) {
-  const { entries, errors } = readMemory(root);
+  const { entries, errors } = readMemory(root, { folders: allMemoryFolders(root) });
+  if (isWorkspace(root)) {
+    const folders = new Set(allMemoryFolders(root));
+    for (const { name, domains = [] } of readWorkspaceFile(root).agents) for (const d of domains) if (!folders.has(d)) errors.push(`hub.workspace.json: ${name} lists domain ${d}, which has no memory/${d}/ folder`);
+  }
   const agents = join(root, "agents");
   if (existsSync(agents)) for (const name of readdirSync(agents).sort()) if (existsSync(join(agents, name, MEMORY_DIR))) errors.push(...readBotMemory(root, join(agents, name)).errors);
   if (errors.length) throw new MemoryError(`${errors.length} bad memory entr${errors.length === 1 ? "y" : "ies"}:\n${errors.join("\n")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",

package/registry-fetch.mjs

@@ -22,6 +22,13 @@
 // is a different route (a 404 on the hosted hub).
 export const registryBase = () => (process.env.ROSTER_REGISTRY_URL ?? "http://127.0.0.1:3100").replace(/\/+$/, "");
 
+// The local hub's sandbox services: the live terminal (/api/sandbox/proc),
+// admission tickets and ownership, fork config, the browser screen, prune.
+// Only a hub on this machine has them. A laptop bot of the hosted hub has
+// none (HUB_SANDBOX_SERVICES=none, set by hosted-hub/runner/hub-runner.ts):
+// null, and their clients send nothing.
+export const sandboxRegistry = () => (process.env.HUB_SANDBOX_SERVICES === "none" ? null : registryBase());
+
 // Also used by the sandbox's node:http transport, which distinguishes
 // requests that never connected from ones whose result may have been lost.
 export function registryHeaders(init) {

package/schedules/dash-classify.mjs

@@ -33,7 +33,7 @@ const open = (t) => !!t && t.kind === "thread" && !t.schedule && !String(t.id).s
 const working = (t) => Object.values(t?.status ?? {}).includes("working");
 
 // What a classification was made from: the last message, the live status
-// class (waiting / working / idle) and the project and domain tags. The entry
+// class (waiting / working / idle) and the project and issue type tags. The entry
 // keeps it (entry.basis); a thread is classified again once it differs. Kept
 // in step with registry/dash.mjs classifyBasis (test/dash-entries.test.mjs).
 // The input version (registry/dash.mjs BASIS_VERSION): bumped when what the
@@ -46,7 +46,7 @@ export function classifyBasis(t) {
   // The newest status post (t.work, see the hub's lib/work-status.mjs), only
   // once a bot has posted one, so bases from before statuses existed stay valid.
   const reported = Object.values(t?.work?.bots ?? {}).map((b) => b?.messageId ?? "").sort().at(-1);
-  return [lastSaid(t)?.id ?? "", live, t?.tags?.project ?? "", t?.tags?.domain ?? "", ...(reported ? [reported] : []), BASIS_VERSION].join("|");
+  return [lastSaid(t)?.id ?? "", live, t?.tags?.project ?? "", (t?.tags?.issueType ?? t?.tags?.domain) ?? "", ...(reported ? [reported] : []), BASIS_VERSION].join("|");
 }
 
 // Paths come from the snapshot's legacy view; all depths in use are choices.

package/schedules/dash-rules.mjs

@@ -281,6 +281,7 @@ const prOf = (n) => ({
   key: `${n.repository?.nameWithOwner ?? "?"}#${n.number}`,
   title: n.title,
   url: n.url,
+  head: n.headRefOid ?? null,
   draft: !!n.isDraft,
   ci: String(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state ?? "none").toLowerCase(),
   review: String(n.reviewDecision ?? "none").toLowerCase(),
@@ -321,8 +322,11 @@ export function prsFromSearch(data) {
 }
 
 // The probe's query: the human's open PRs, plus `refs` ("owner/repo#12") by name.
-const PR_FIELDS = "number title url isDraft state merged mergeable reviewDecision repository { nameWithOwner } commits(last: 1) { nodes { commit { statusCheckRollup { state } } } }";
+const PR_FIELDS = "number title url headRefOid isDraft state merged mergeable reviewDecision repository { nameWithOwner } commits(last: 1) { nodes { commit { statusCheckRollup { state } } } }";
 const REF = /^([\w.-]+)\/([\w.-]+)#(\d+)$/;
+// GitHub gives up on a GraphQL request after ~10 s (502/504); a chunk of 40
+// names takes ~4 s.
+export const REFS_PER_QUERY = 40;
 export function dashQuery(refs = []) {
   const named = refs
     .map((ref) => ref.match(REF))

package/schedules/dash-run.mjs

@@ -11,7 +11,7 @@
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { runOnce } from "./hub.mjs";
-import { dashPrs, dashQuery, dashScan, dashWatchList, failedRefs, prsFromSearch } from "./dash-rules.mjs";
+import { REFS_PER_QUERY, dashPrs, dashQuery, dashScan, dashWatchList, failedRefs, prsFromSearch } from "./dash-rules.mjs";
 
 // The hub gives a schedule 60 s (registry/server.mjs
 // SCHEDULE_DISPATCH_TIMEOUT_MS): two 20 s tries and the registry calls fit.
@@ -76,9 +76,11 @@ export async function runDash(hub, { probe = (q) => withRetry(() => ghGraphql(q)
     let skip = new Set();
     let note = null;
     try {
-      const answer = await probe(dashQuery(refs));
-      prs = prsFromSearch(answer);
-      skip = failedRefs(answer, refs);
+      const chunks = [];
+      for (let i = 0; i < Math.max(refs.length, 1); i += REFS_PER_QUERY) chunks.push(refs.slice(i, i + REFS_PER_QUERY));
+      const answers = await Promise.all(chunks.map((c) => probe(dashQuery(c))));
+      prs = answers.flatMap(prsFromSearch);
+      skip = new Set(answers.flatMap((a, i) => [...failedRefs(a, chunks[i])]));
       if (skip.size) note = `${plural(skip.size)} skipped: GitHub couldn't answer for ${[...skip].slice(0, 3).join(", ")}${skip.size > 3 ? ", …" : ""}`;
     } catch (err) {
       ok = false;

package/schedules/thread-brief.mjs

@@ -67,7 +67,7 @@ export function threadBrief(t, snap, limits = BRIEF) {
     title: t?.title ?? t?.id,
     project: t?.tags?.project ?? null,
     path: t?.tags?.path ?? null,
-    domain: t?.tags?.domain ?? null,
+    issueType: t?.tags?.issueType ?? t?.tags?.domain ?? null,
     // The thread's stored summary (set_summary), when main wrote one.
     summary: t?.summary?.text ? { text: clip(flat(t.summary.text), limits.summary ?? 600), by: t.summary.by ?? null } : null,
     opening: ms.length > limits.recent ? line(ms[0], human, limits.opening) : null,
@@ -88,7 +88,7 @@ const who = (l) => `${l.author}${l.human ? " (human)" : ""}`;
 export function briefText(b) {
   return [
     `Title: ${b.title}`,
-    `Project: ${b.project ?? "none"}${b.path && b.path !== b.project ? ` · path: ${b.path}` : ""} · domain: ${b.domain ?? "none"}`,
+    `Project: ${b.project ?? "none"}${b.path && b.path !== b.project ? ` · path: ${b.path}` : ""} · issue type: ${b.issueType ?? "none"}`,
     ...(b.summary ? [`Summary${b.summary.by ? ` (by ${b.summary.by})` : ""}: ${b.summary.text}`] : []),
     ...(b.opening ? [`Opening message, ${who(b.opening)}: ${b.opening.text}`] : []),
     ...(b.phase ? [`Phase the bots reported: ${b.phase}`, ...b.reports.map((r) => `- ${r.bot}: ${r.summary}${r.pr ? ` (PR ${r.pr}${r.sha ? ` @ ${r.sha}` : ""})` : ""}`)] : []),

package/subagent-cap.d.mts

@@ -1,10 +1,11 @@
 export type Requested = { model?: string; reasoning?: string };
 export type SubagentCap = Requested & { models?: readonly string[] };
 export type CapAgent = { name: string; subagents?: Record<string, Requested>; subagentCap?: SubagentCap };
-export type Clamped = { model: string; reasoning: string; clamped: string[] };
-export const REASONING_LEVELS: readonly string[];
+export type ReasoningLevel = "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
+export type Clamped = { model: string; reasoning: ReasoningLevel; clamped: string[] };
+export const REASONING_LEVELS: readonly ReasoningLevel[];
 export const DEFAULT_SUBAGENT_CAP: Readonly<{ model: string; reasoning: string; models: readonly string[] }>;
 export function clampSubagent(requested?: Requested, cap?: SubagentCap): Clamped;
-export function capFor(agents: readonly CapAgent[], workspaceCap: SubagentCap, botName: string): SubagentCap;
+export function capFor(agents: readonly CapAgent[], workspaceCap: SubagentCap, botName: string | undefined): SubagentCap;
 export function resolveSubagent(agents: readonly CapAgent[], workspaceCap: SubagentCap, botName: string, name: string): Clamped;
 export function resolveSubagents(agents: readonly CapAgent[], workspaceCap: SubagentCap, botName: string): Array<Clamped & { name: string }>;

package/templates/engineering.md

@@ -0,0 +1,24 @@
+## Engineering
+
+### Premise first
+- Question the premise before you plan or build. Check that the problem as stated is the real one: the symptom is what the user sees, the cause is proven, and the asked-for fix would solve it. If you aren't sure, find out before designing. Question it again whenever two fixes on one idea fail.
+- Reduce the problem to what it fundamentally needs, then research before you design: prior art, the standard tool, the paper. Most problems are solved; use the proven tool. When one isn't, people have still spent serious time on it: find their partial answers, failed attempts, tradeoffs and open debates, and build on them instead of starting from zero.
+
+### Root cause
+- Fix the cause, not the symptom. Ask why until you reach the invariant that broke and the module that owns it; fix it there. No guard, retry, catch or default that hides a failure. Grep for the same bug elsewhere.
+- A bug fix comes with a test that fails before and passes after, on the user's exact case.
+- Debug from evidence, not by reading code: repro, logs, traces. Keep facts apart from hypotheses; change one thing against a control.
+
+### Simplicity
+- Subtract before you add. The best change deletes or moves code. Every new flag, option, layer, cache, retry or file needs a requirement that forces it today, not a future one.
+- Deep modules: a lot behind a small interface. Don't split code just to make it short. Prefer duplication to the wrong abstraction; reuse what exists before writing a helper.
+
+### State and contracts
+- One source of truth per fact; derive, don't mirror. A shape that crosses a process boundary has one definition, and CI fails on drift. Schema changes are expand/contract.
+- Contracts are explicit: precise types, dependencies passed in, no silent fallbacks.
+- Change related state in one step. No sleeps or ordering assumptions. Failure paths are explicit: timeouts set, retries jittered and budgeted, queues bounded.
+
+### Code and tests
+- No comments by default; write one only for a non-obvious why.
+- Don't copy a bad local pattern; flag it. After a patch, reread the whole module, not just the diff.
+- Test real I/O end to end; fake only at the network edge. Property tests for parsers and wire formats. No coverage targets.

package/templates/workspace-protocol.md

@@ -16,7 +16,7 @@ You are one named bot in a small workspace of long-lived bots. Work happens in t
 - You can `show` the human something: it moves their screen to a thread or DM, optionally scrolled to one message. Use it sparingly, when they need to look now.
 - You can `react` to any message by its `[msg_…]` id. React when a reply would be noise: 👍 to acknowledge, 👀 when you're picking something up that takes a while, ✅ when you've done what was asked, 🎉 for good news. Reactions are yours to choose; don't react to everything.
 - Images people post come with the message (shown as `[image: name]` in the log), and you see them. To post one yourself, call `attach_image` with a file from your sandbox or `screenshot: true` for your browser; it goes out with your next message. To look at an image file yourself (a screenshot you took, a capture), call `view_image` with its path; `read_file` can't read images and `attach_image` doesn't show them to you. To see an image posted in another thread, call `read_thread` with that message's `messageId`.
-- If a thread's scope has clearly changed, `update_thread` retitles it, and refreshes its track, domain and summary (everyone sees an inline "renamed this thread: old → new" line on a retitle). Do it rarely, and only for threads you're in.
+- If a thread's scope has clearly changed, `update_thread` retitles it, and refreshes its track, issue type and summary (everyone sees an inline "renamed this thread: old → new" line on a retitle). Do it rarely, and only for threads you're in.
 - Your session only sees the thread it lives in. To find or read any other thread (by title, who's busy there, archived or not), use `list_threads` and `read_thread`; don't guess from memory.
 - Never `sleep` or poll for more than 60s in one bash call, except `gh pr checks <n> --watch` while landing an approved PR (set timeoutSeconds). For other CI or a deploy, check once, report, and say what you're waiting on.
 - If you have `kit__worker`, split the work by cost. Exploration (reading code, tracing call sites) goes to an `agent` copy or researcher. An edit you can spec fully (files, the change, how to verify) goes to `kit__worker`. You keep the design, the debugging, reading every diff it makes, and running the tests.
@@ -29,6 +29,8 @@ When several bots work on one piece of work, coordinate through posts; don't rou
 1. When your workspace root changes (worktree, branch or base), post `@all` with the old and new values.
 2. When you push, tell the bots your change affects: the owner of a branch stacked on yours, and the reviewer. Use `@all` if you can't tell who. To reach a bot in another thread, use `post_message`. A branch has one owner; anyone else works on a branch stacked on top, or the owner hands it over.
 3. When the thread's phase changes (planning → working → reviewing → done; a review can send it back to working or planning), post a status: `post_message` into this thread with `status` set to the new phase, a one-line summary as the text, and `metadata: { pr, sha }` when there are any. It wakes nobody unless you @-mention someone, so it doesn't replace your message. The workspace state shows the thread's current phase.
+
+   A reviewer records its verdict on the same kind of post: `verdict` (`ship`, `fix-first` or `rethink`) with `metadata: { pr, sha }`, the PR as `owner/repo#12` and the sha you reviewed; the text is the one-line what-changed. Add `decisions`, a list of `{ question, options: [{ label, pickedBy? }] }` for what the human has to pick (`[]` if nothing; a `ship` without the list is refused). Publish the change explainer with `artifact_publish` at the first ship and reuse it on later passes; the Dash row says "no explainer" without one. CI and the PR's head come from GitHub, not from your post; don't state them as facts there.
 4. When you need another specialty or more help, ask main, or the bot whose role fits.
 
 On a conflict, read the push posts and ask the bot that pushed.
@@ -81,8 +83,8 @@ renders as:
    [ npm test -- test/port.test.mjs ]
 ```
 
-- Avatar and name head only the first message of a run. Your bubbles are gray, left, at most 620pt wide (90% of a narrower window); the human's are dark, right.
-- Paragraphs, lists, quotes and inline `code` stay in one bubble of 14pt text. Headings are 16–18pt: skip them in short replies.
+- Avatar and name head only the first message of a run. Your bubbles are gray, left, at most 540pt wide (90% of a narrower window); the human's are dark, right.
+- Paragraphs, lists, quotes and inline `code` stay in one bubble of 14.5pt text. Headings are 16–18pt: skip them in short replies.
 - `---` with a blank line on both sides starts a new bubble. Without the blank line above, it makes the line before it a heading.
 - Each top-level code fence is a card with a language label and a copy icon; each table is a table card. Inline code has no copy icon, so anything the reader will paste goes in a fence. Cards wrap rather than scroll: keep command lines short.
 - A link is a gray chip with an icon and its label, so labels are short nouns (`#412`, `Feed.swift:1015`). A bare URL shows only its hostname.

package/tools/apply_tags.d.ts

@@ -5,15 +5,15 @@ declare const _default: import("eve/tools").ToolDefinition<{
         threadId: string;
         path?: string | undefined;
         project?: string | undefined;
-        domain?: string | undefined;
+        issueType?: string | undefined;
     }[] | undefined;
     merges?: {
-        field: "domain";
+        field: "issueType";
         from: string[];
         to: string;
     }[] | undefined;
     labels?: {
-        field: "domain" | "path" | "project";
+        field: "issueType" | "path" | "project";
         tag: string;
         label: string | null;
     }[] | undefined;
@@ -25,15 +25,15 @@ declare const _default: import("eve/tools").ToolDefinition<{
             threadId: string;
             path?: string | undefined;
             project?: string | undefined;
-            domain?: string | undefined;
+            issueType?: string | undefined;
         }[] | undefined;
         merges?: {
-            field: "domain";
+            field: "issueType";
             from: string[];
             to: string;
         }[] | undefined;
         labels?: {
-            field: "domain" | "path" | "project";
+            field: "issueType" | "path" | "project";
             tag: string;
             label: string | null;
         }[] | undefined;

package/tools/apply_tags.js

@@ -6,20 +6,20 @@ import { z } from "zod";
 import { registryFetch } from "../registry-fetch.mjs";
 const tag = z.string().describe("Lowercase slug, e.g. 'checkout'.");
 export default defineTool({
-    description: "Retag threads, merge / rename tags, or set their display names, workspace-wide. Pass `assignments` (tags per thread), `merges` (domains only: fold the `from` domains into `to`; later uses land on `to`; a rename is a one-tag merge. Projects and paths merge or rename with move_path), and/or `labels` (a tag's display name, the sidebar group header, e.g. payments-api -> 'Payments API'; no threads change), or the `proposalId` of a batch staged with tag_threads. Writes immediately, no approval. Tags and labels the human set by hand are kept, merges included. Read the threads first (list_threads, read_thread) so tags follow what they did, not their titles.",
+    description: "Retag threads, merge / rename tags, or set their display names, workspace-wide. Pass `assignments` (tags per thread), `merges` (issue types only: fold the `from` issue types into `to`; later uses land on `to`; a rename is a one-tag merge. Projects and paths merge or rename with move_path), and/or `labels` (a tag's display name, the sidebar group header, e.g. payments-api -> 'Payments API'; no threads change), or the `proposalId` of a batch staged with tag_threads. Writes immediately, no approval. Tags and labels the human set by hand are kept, merges included. Read the threads first (list_threads, read_thread) so tags follow what they did, not their titles.",
     inputSchema: z.object({
         proposalId: z.string().optional().describe("A batch staged with tag_threads propose, e.g. tgp_02ab."),
         note: z.string().optional().describe("One line on what this pass changes and why."),
         assignments: z
-            .array(z.object({ threadId: z.string(), path: z.string().optional().describe("project/track, e.g. 'web/checkout'; sets the project too"), project: tag.optional(), domain: tag.optional() }))
+            .array(z.object({ threadId: z.string(), path: z.string().optional().describe("project/track, e.g. 'web/checkout'; sets the project too"), project: tag.optional(), issueType: tag.optional() }))
             .optional()
             .describe("Tags per thread."),
         merges: z
-            .array(z.object({ field: z.enum(["domain"]), from: z.array(tag).min(1), to: tag }))
+            .array(z.object({ field: z.enum(["issueType"]), from: z.array(tag).min(1), to: tag }))
             .optional()
             .describe("Fold the `from` tags into `to`."),
         labels: z
-            .array(z.object({ field: z.enum(["project", "domain", "path"]), tag, label: z.string().nullable().describe("Display name; null goes back to the title-cased tag.") }))
+            .array(z.object({ field: z.enum(["project", "issueType", "path"]), tag, label: z.string().nullable().describe("Display name; null goes back to the title-cased tag.") }))
             .optional()
             .describe("Display names per tag."),
     }),

package/tools/create_agent.d.ts

@@ -4,6 +4,7 @@ declare const _default: import("eve/tools").ToolDefinition<{
     reasoning?: "high" | "low" | "medium" | "xhigh" | undefined;
     role: string;
     instructions?: string | undefined;
+    domains?: string[] | undefined;
     preset?: "builder" | "read-only" | undefined;
 }, {
     name: string;
@@ -16,6 +17,7 @@ declare const _default: import("eve/tools").ToolDefinition<{
         reasoning?: "high" | "low" | "medium" | "xhigh" | undefined;
         role: string;
         instructions?: string | undefined;
+        domains?: string[] | undefined;
         preset?: "builder" | "read-only" | undefined;
     }, ctx: import("eve/tools").ToolContext): Promise<{
         name: string;

package/tools/create_agent.js

@@ -11,6 +11,7 @@ export default defineTool({
         reasoning: z.enum(["low", "medium", "high", "xhigh"]).optional(),
         role: z.string().describe("One line: what this bot does."),
         instructions: z.string().optional().describe("Extra guidance: specialty, style, who it hands off to."),
+        domains: z.array(z.string().regex(/^[a-z][a-z0-9-]*(\/[a-z][a-z0-9-]*)*$/)).optional().describe("Memory domains: folders under memory/ whose standing decisions this bot also recalls, e.g. [\"ui\"]. It always recalls memory/ itself."),
         preset: z
             .enum(["builder", "read-only"])
             .optional()

package/tools/create_thread.d.ts

@@ -2,9 +2,9 @@ declare const _default: import("eve/tools").ToolDefinition<{
     title: string;
     message: string;
     project?: string | undefined;
-    domain?: string | undefined;
+    issueType?: string | undefined;
     projectLabel?: string | undefined;
-    domainLabel?: string | undefined;
+    issueTypeLabel?: string | undefined;
     path?: string | undefined;
     pathLabel?: string | undefined;
     focus?: boolean | undefined;
@@ -16,9 +16,9 @@ declare const _default: import("eve/tools").ToolDefinition<{
         title: string;
         message: string;
         project?: string | undefined;
-        domain?: string | undefined;
+        issueType?: string | undefined;
         projectLabel?: string | undefined;
-        domainLabel?: string | undefined;
+        issueTypeLabel?: string | undefined;
         path?: string | undefined;
         pathLabel?: string | undefined;
         focus?: boolean | undefined;

package/tools/create_thread.js

@@ -2,23 +2,23 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { registryFetch } from "../registry-fetch.mjs";
 export default defineTool({
-    description: "Open a new workspace thread for one piece of work. The first message is posted as you; @-mention the bot who should start. File it under a path (project/track) and tag a domain when you can (reuse tags in use; list_threads shows each thread's tags); a thread left untagged asks its first bot to tag it.",
+    description: "Open a new workspace thread for one piece of work. The first message is posted as you; @-mention the bot who should start. File it under a path (project/track) and tag an issue type when you can (reuse tags in use; list_threads shows each thread's tags); a thread left untagged asks its first bot to tag it.",
     inputSchema: z.object({
         title: z.string().describe("Short thread title, e.g. 'Checkout: retry failed payments'."),
         message: z.string().describe("First message. Must @-mention who should act first."),
         project: z.string().optional().describe("Project tag: the codebase or effort, e.g. 'web', 'api'."),
-        domain: z.string().optional().describe("Domain tag: the kind of work, e.g. 'feature', 'bugfix', 'docs'."),
+        issueType: z.string().optional().describe("Issue type tag: the kind of work, e.g. 'feature', 'bugfix', 'docs'."),
         projectLabel: z.string().optional().describe("Display name for a new project tag, e.g. 'Payments API'. Only names a tag that has none yet."),
-        domainLabel: z.string().optional().describe("Display name for a new domain tag, e.g. 'Bug fixes'. Only names a tag that has none yet."),
+        issueTypeLabel: z.string().optional().describe("Display name for a new issue type tag, e.g. 'Bug fixes'. Only names a tag that has none yet."),
         path: z.string().optional().describe("Path: project, then the track inside it, e.g. 'web/checkout/cart' or 'api/billing'. Reuse a path in use (list_threads shows each thread's); the first segment is the project."),
         pathLabel: z.string().optional().describe("Display name for a new path's last segment, e.g. 'Cart'. Only names a path that has none yet."),
         focus: z.boolean().optional().describe("Move the human's screen to the new thread (default true)."),
     }),
-    async execute({ title, message, project, domain, projectLabel, domainLabel, path, pathLabel, focus = true }, ctx) {
+    async execute({ title, message, project, issueType, projectLabel, issueTypeLabel, path, pathLabel, focus = true }, ctx) {
         const res = await registryFetch(`/api/threads`, {
             method: "POST",
             headers: { "content-type": "application/json" },
-            body: JSON.stringify({ title, message, author: "main", sessionId: ctx.session.id, focus, project, domain, projectLabel, domainLabel, path, pathLabel }),
+            body: JSON.stringify({ title, message, author: "main", sessionId: ctx.session.id, focus, project, issueType, projectLabel, issueTypeLabel, path, pathLabel }),
         });
         if (!res.ok)
             throw new Error(`create_thread failed: ${res.status} ${await res.text()}`);

package/tools/list_threads.d.ts

@@ -6,7 +6,7 @@ declare const _default: import("eve/tools").ToolDefinition<{
     busy?: string | undefined;
     project?: string | undefined;
     path?: string | undefined;
-    domain?: string | undefined;
+    issueType?: string | undefined;
     limit?: number | undefined;
 }, any> & {
     execute(input: {
@@ -17,7 +17,7 @@ declare const _default: import("eve/tools").ToolDefinition<{
         busy?: string | undefined;
         project?: string | undefined;
         path?: string | undefined;
-        domain?: string | undefined;
+        issueType?: string | undefined;
         limit?: number | undefined;
     }, ctx: import("eve/tools").ToolContext): Promise<any>;
 };

package/tools/list_threads.js

@@ -5,7 +5,7 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { registryFetch } from "../registry-fetch.mjs";
 export default defineTool({
-    description: "List workspace threads, workspace-wide (not just the one you're in): id, title, participants, status (active/archived), who's busy there (since when, doing what), last activity, tags (path: project/track, e.g. 'web/checkout'; project; domain), and the thread's stored summary when main wrote one. Newest activity first. `paths` holds the listed threads' paths with each one's current summary (what's up in that feature). Use it to find a thread by title before asking someone, and read_thread to read one.",
+    description: "List workspace threads, workspace-wide (not just the one you're in): id, title, participants, status (active/archived), who's busy there (since when, doing what), last activity, tags (path: project/track, e.g. 'web/checkout'; project; issue type), and the thread's stored summary when main wrote one. Newest activity first. `paths` holds the listed threads' paths with each one's current summary (what's up in that feature). Use it to find a thread by title before asking someone, and read_thread to read one.",
     inputSchema: z.object({
         query: z.string().optional().describe("Match titles containing this text (or an exact id)."),
         archived: z.enum(["exclude", "include", "only"]).optional().describe("Archived threads: exclude (default), include, or only."),
@@ -14,7 +14,7 @@ export default defineTool({
         busy: z.string().optional().describe("'true' for threads with someone working, 'false' for none, or a bot name."),
         project: z.string().optional().describe("Only threads with this project tag ('none' for untagged)."),
         path: z.string().optional().describe("Only threads on this path or under it, e.g. 'web' or 'web/checkout'."),
-        domain: z.string().optional().describe("Only threads with this domain tag ('none' for untagged)."),
+        issueType: z.string().optional().describe("Only threads with this issue type tag ('none' for untagged)."),
         limit: z.number().int().min(1).max(500).optional().describe("Max threads (default 50)."),
     }),
     async execute(input) {

package/tools/post_message.d.ts

@@ -7,6 +7,14 @@ declare const _default: import("eve/tools").ToolDefinition<{
         pr?: string | undefined;
         sha?: string | undefined;
     } | undefined;
+    verdict?: "fix-first" | "rethink" | "ship" | undefined;
+    decisions?: {
+        question: string;
+        options: {
+            label: string;
+            pickedBy?: string | undefined;
+        }[];
+    }[] | undefined;
 }, {
     messageId: string;
     threadId: string;
@@ -23,6 +31,14 @@ declare const _default: import("eve/tools").ToolDefinition<{
             pr?: string | undefined;
             sha?: string | undefined;
         } | undefined;
+        verdict?: "fix-first" | "rethink" | "ship" | undefined;
+        decisions?: {
+            question: string;
+            options: {
+                label: string;
+                pickedBy?: string | undefined;
+            }[];
+        }[] | undefined;
     }, ctx: import("eve/tools").ToolContext): Promise<{
         messageId: string;
         threadId: string;

package/tools/post_message.js

@@ -27,13 +27,18 @@ export default defineTool({
         })
             .optional()
             .describe("With status: the PR and sha it's about."),
+        verdict: z.enum(["ship", "fix-first", "rethink"]).optional().describe("A reviewer's verdict on metadata.pr at metadata.sha (needs both, and a status). A ship needs decisions."),
+        decisions: z
+            .array(z.object({ question: z.string(), options: z.array(z.object({ label: z.string(), pickedBy: z.string().optional().describe("The bot that picked this option.") })) }))
+            .optional()
+            .describe("With a verdict: what the human has to pick. [] when nothing; required with ship."),
     }),
-    async execute({ threadId, agent, text, status, metadata }, ctx) {
+    async execute({ threadId, agent, text, status, metadata, verdict, decisions }, ctx) {
         const target = threadId ?? (agent ? `dm-${agent.replace(/^@/, "")}` : "here");
         const res = await registryFetch(`/api/threads/${encodeURIComponent(target)}/messages`, {
             method: "POST",
             headers: { "content-type": "application/json" },
-            body: JSON.stringify({ text, sessionId: ctx.session.id, ...(status ? { status } : {}), ...(metadata ? { metadata } : {}) }),
+            body: JSON.stringify({ text, sessionId: ctx.session.id, ...(status ? { status } : {}), ...(metadata ? { metadata } : {}), ...(verdict ? { verdict } : {}), ...(decisions ? { decisions } : {}) }),
         });
         if (!res.ok)
             throw new Error(`post_message failed: ${res.status} ${await res.text()}`);

package/tools/tag_threads.d.ts

@@ -6,15 +6,15 @@ declare const _default: import("eve/tools").ToolDefinition<{
         threadId: string;
         path?: string | undefined;
         project?: string | undefined;
-        domain?: string | undefined;
+        issueType?: string | undefined;
     }[] | undefined;
     merges?: {
-        field: "domain";
+        field: "issueType";
         from: string[];
         to: string;
     }[] | undefined;
     labels?: {
-        field: "domain" | "path" | "project";
+        field: "issueType" | "path" | "project";
         tag: string;
         label: string | null;
     }[] | undefined;
@@ -28,15 +28,15 @@ declare const _default: import("eve/tools").ToolDefinition<{
             threadId: string;
             path?: string | undefined;
             project?: string | undefined;
-            domain?: string | undefined;
+            issueType?: string | undefined;
         }[] | undefined;
         merges?: {
-            field: "domain";
+            field: "issueType";
             from: string[];
             to: string;
         }[] | undefined;
         labels?: {
-            field: "domain" | "path" | "project";
+            field: "issueType" | "path" | "project";
             tag: string;
             label: string | null;
         }[] | undefined;

package/tools/tag_threads.js

@@ -6,21 +6,21 @@ import { z } from "zod";
 import { registryFetch } from "../registry-fetch.mjs";
 const tag = z.string().describe("Lowercase slug, e.g. 'checkout'.");
 export default defineTool({
-    description: "Thread tags (project, domain) workspace-wide. action 'vocabulary': the tags in use with counts, saved merge aliases, untagged threads, and pending proposals. action 'propose': stage a backfill (tags per thread) or a domain merge (fold near-duplicate or one-off domains into others; projects and paths merge with move_path) for the human to review; nothing is written, and the reply has a review table to post. action 'dismiss': drop a pending proposal. For everyday retags and merges skip this and call apply_tags directly.",
+    description: "Thread tags (project, issue type) workspace-wide. action 'vocabulary': the tags in use with counts, saved merge aliases, untagged threads, and pending proposals. action 'propose': stage a backfill (tags per thread) or an issue type merge (fold near-duplicate or one-off issue types into others; projects and paths merge with move_path) for the human to review; nothing is written, and the reply has a review table to post. action 'dismiss': drop a pending proposal. For everyday retags and merges skip this and call apply_tags directly.",
     inputSchema: z.object({
         action: z.enum(["vocabulary", "propose", "dismiss"]),
         kind: z.enum(["backfill", "merge", "labels"]).optional().describe("For propose."),
         note: z.string().optional().describe("For propose: one line on what this pass did."),
         assignments: z
-            .array(z.object({ threadId: z.string(), path: z.string().optional().describe("project/track, e.g. 'web/checkout'; sets the project too"), project: tag.optional(), domain: tag.optional() }))
+            .array(z.object({ threadId: z.string(), path: z.string().optional().describe("project/track, e.g. 'web/checkout'; sets the project too"), project: tag.optional(), issueType: tag.optional() }))
             .optional()
             .describe("For propose: tags per thread."),
         merges: z
-            .array(z.object({ field: z.enum(["domain"]), from: z.array(tag).min(1), to: tag }))
+            .array(z.object({ field: z.enum(["issueType"]), from: z.array(tag).min(1), to: tag }))
             .optional()
             .describe("For propose: fold the `from` tags into `to`; later uses of a `from` tag land on `to`."),
         labels: z
-            .array(z.object({ field: z.enum(["project", "domain", "path"]), tag, label: z.string().nullable() }))
+            .array(z.object({ field: z.enum(["project", "issueType", "path"]), tag, label: z.string().nullable() }))
             .optional()
             .describe("For propose: display names per tag (the sidebar group headers)."),
         proposalId: z.string().optional().describe("For dismiss."),

package/tools/update_thread.d.ts

@@ -2,21 +2,21 @@ declare const _default: import("eve/tools").ToolDefinition<{
     threadId: string;
     title?: string | undefined;
     path?: string | null | undefined;
-    domain?: string | undefined;
+    issueType?: string | undefined;
     summary?: string | undefined;
     pathLabel?: string | undefined;
     projectLabel?: string | undefined;
-    domainLabel?: string | undefined;
+    issueTypeLabel?: string | undefined;
 }, any> & {
     execute(input: {
         threadId: string;
         title?: string | undefined;
         path?: string | null | undefined;
-        domain?: string | undefined;
+        issueType?: string | undefined;
         summary?: string | undefined;
         pathLabel?: string | undefined;
         projectLabel?: string | undefined;
-        domainLabel?: string | undefined;
+        issueTypeLabel?: string | undefined;
     }, ctx: import("eve/tools").ToolContext): Promise<any>;
 };
 export default _default;

package/tools/update_thread.js

@@ -1,5 +1,5 @@
 // The `update_thread` tool, shared by every bot: say what a thread is, in one
-// call. Title, path (project/track), domain and the thread's summary. The
+// call. Title, path (project/track), issue type and the thread's summary. The
 // registry keeps the rename history and posts an inline "<bot> renamed this
 // thread: old → new" marker; tags go on thread.tags (lib/tags.mjs) and the
 // summary is the one `set_summary` writes (lib/paths.mjs setSummary).
@@ -7,16 +7,16 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { registryFetch } from "../registry-fetch.mjs";
 export default defineTool({
-    description: "Update a workspace thread you're in: its title, track, domain and summary, in one call. Retitle when the work's scope has changed and the old title no longer fits: everyone sees a short 'renamed this thread: old → new' line; the history is kept. Keep titles short (at most 80 characters). File it on a path (project/track, e.g. 'web/checkout/cart': the first segment is the project, the rest the track) and tag a domain (the kind of work, e.g. 'feature', 'bugfix', 'infra'); reuse a path and domain already in use when they fit; for a new one, also give its display name (pathLabel / domainLabel, e.g. 'Payments API'). The summary is a short note on what the thread is about and where it stands; it replaces the previous one, and empty text clears it. The reply says what each tag was filed under and, for a tag no other thread uses, lists the ones in use so you can switch. Tags a human set by hand stay. DMs and archived threads can't be updated.",
+    description: "Update a workspace thread you're in: its title, track, issue type and summary, in one call. Retitle when the work's scope has changed and the old title no longer fits: everyone sees a short 'renamed this thread: old → new' line; the history is kept. Keep titles short (at most 80 characters). File it on a path (project/track, e.g. 'web/checkout/cart': the first segment is the project, the rest the track) and tag an issue type (the kind of work, e.g. 'feature', 'bugfix', 'infra'); reuse a path and issue type already in use when they fit; for a new one, also give its display name (pathLabel / issueTypeLabel, e.g. 'Payments API'). The summary is a short note on what the thread is about and where it stands; it replaces the previous one, and empty text clears it. The reply says what each tag was filed under and, for a tag no other thread uses, lists the ones in use so you can switch. Tags a human set by hand stay. DMs and archived threads can't be updated.",
     inputSchema: z.object({
         threadId: z.string().describe("Thread id, e.g. thr_0002 (shown in the [thread: …] header)."),
         title: z.string().optional().describe("New short title, e.g. 'Checkout: retry failed payments'. Omit to leave it."),
         path: z.string().nullable().optional().describe("Path: project, then the track inside it, e.g. 'web/checkout/cart' or 'api/billing'. Reuse a path in use (the naming prompt and list_threads show them); the first segment is the project. null: back to the project alone. A path a human set by hand stays."),
-        domain: z.string().optional().describe("Domain tag: the kind of work, e.g. 'feature', 'bugfix', 'infra', 'docs', 'review', 'research'. Lowercase slug."),
+        issueType: z.string().optional().describe("Issue type tag: the kind of work, e.g. 'feature', 'bugfix', 'infra', 'docs', 'review', 'research'. Lowercase slug."),
         summary: z.string().optional().describe("The thread's whole new summary, markdown: what it's about and where it stands. Empty clears it. Omit to leave it."),
         pathLabel: z.string().optional().describe("Display name for a new path's last segment, e.g. 'Cart'. Only names a path that has none yet."),
         projectLabel: z.string().optional().describe("Display name for a new project (a path's first segment), shown as its sidebar group, e.g. 'Payments API' for payments-api. Only names a project that has none yet."),
-        domainLabel: z.string().optional().describe("Display name for a new domain tag, e.g. 'Bug fixes' for bugfix. Only names a tag that has none yet."),
+        issueTypeLabel: z.string().optional().describe("Display name for a new issue type tag, e.g. 'Bug fixes' for bugfix. Only names a tag that has none yet."),
     }),
     async execute({ threadId, ...fields }, ctx) {
         const res = await registryFetch(`/api/threads/${encodeURIComponent(threadId)}/rename`, {

package/workspace.mjs

@@ -5,7 +5,7 @@
 //
 //   {
 //     "agents": [{ "name": "main", "model": "anthropic/claude-opus-5.5", "role": "…",
-//                  "color"?: "#a78bfa", "subagents"?: { "researcher": { "when"?: "…" } },
+//                  "color"?: "#a78bfa", "domains"?: ["ui/motion"], "subagents"?: { "researcher": { "when"?: "…" } },
 //                  "subagentCap"?: {…}, "limits"?: {…}, "port"?: 4201 }],
 //     "humans"?: [{ "name": "me", "color"?: "#f472b6" }],
 //     "subagentCap"?: { "model": "…", "reasoning": "low", "models": ["…"] },
@@ -37,10 +37,11 @@ import { limitsError } from "./session-limits.mjs";
 
 export const WORKSPACE_FILE = "hub.workspace.json";
 export const BASE_PORT = 4201;
+export const DOMAIN = /^[a-z][a-z0-9-]*(\/[a-z][a-z0-9-]*)*$/;
 export const NAME = /^[a-z][a-z0-9-]{1,30}$/;
 export const HUMAN_NAME = /^[a-z][a-z0-9-]{0,30}$/;
 const COLOR = /^#[0-9a-f]{3}([0-9a-f]{3})?$/i;
-const AGENT_KEYS = new Set(["name", "model", "role", "color", "subagents", "subagentCap", "limits", "port"]);
+const AGENT_KEYS = new Set(["name", "model", "role", "color", "subagents", "subagentCap", "limits", "port", "runsOn", "domains"]);
 
 export class WorkspaceError extends Error {}
 
@@ -82,6 +83,10 @@ export function parseWorkspace(data, file = WORKSPACE_FILE) {
       if (ports.has(agent.port)) fail(file, `${label}.port ${agent.port} is used twice`);
       ports.add(agent.port);
     }
+    // Where the bot runs: on the hosted bots project (default), or on the human's Mac, started by
+    // the app's local runner. Fixed at definition.
+    if (agent.runsOn !== undefined && agent.runsOn !== "hosted" && agent.runsOn !== "local") fail(file, `${label}.runsOn must be "hosted" or "local"`);
+    if (agent.domains !== undefined && (!Array.isArray(agent.domains) || agent.domains.some((d) => typeof d !== "string" || !DOMAIN.test(d)))) fail(file, `${label}.domains must be an array of memory folders like "ui" or "ui/motion"`);
     const unknown = Object.keys(agent).filter((k) => !AGENT_KEYS.has(k));
     if (unknown.length) fail(file, `${label}: unknown field(s) ${unknown.join(", ")}`);
     return { ...agent };