fuli-context 0.11.0 → 0.11.1

package/graph-provider/fuli_graph/project_agent_delegations.py

@@ -0,0 +1,118 @@
+"""Short-lived, session-bound capabilities for a real roundtable invocation."""
+
+from hashlib import sha256
+from secrets import token_urlsafe
+
+from fastapi import HTTPException
+from pydantic import Field
+
+from .models import SourceApplication, StrictModel
+from .personal_project_access import authorize_personal_project
+
+
+class AgentDelegationIssue(StrictModel):
+    personal_space_id: str = Field(min_length=1, max_length=128)
+    task_context_token: str = Field(min_length=1, max_length=256)
+    source_application: SourceApplication
+    agent_id: str = Field(min_length=1, max_length=128)
+    target_application: SourceApplication
+    target_session_id: str | None = Field(default=None, min_length=1, max_length=256)
+    lifetime_seconds: int = Field(default=300, ge=30, le=900)
+
+
+class AgentDelegationCheck(StrictModel):
+    personal_space_id: str = Field(min_length=1, max_length=128)
+    token: str = Field(min_length=32, max_length=128)
+    session_id: str | None = Field(default=None, min_length=1, max_length=256)
+
+
+def token_hash(token):
+    return sha256(token.encode()).hexdigest()
+
+
+class StoreAgentDelegations:
+    async def issue_agent_delegation(self, actor, request):
+        self._require_personal()
+        space = await self.authorize(actor, request.personal_space_id, 'maintainer')
+        context = await self.get_task_context(actor, request.personal_space_id,
+                                             request.task_context_token, request.source_application)
+        project_id = context.get('personal_project_id')
+        if not project_id or (context.get('checkpoint') or {}).get('phase') == 'complete':
+            raise HTTPException(409, 'Delegation requires an active project task')
+        await authorize_personal_project(self, actor, space, project_id)
+        policy = await self.get_project_agent_coordination_policy(actor, request.personal_space_id, project_id)
+        lead = policy.team_lead_agent_id
+        sender = context.get('project_agent_id')
+        if not lead or not sender or (sender != lead and request.agent_id != lead):
+            raise HTTPException(403, 'Members must communicate through the project lead')
+        target = await self.get_project_agent(actor, request.personal_space_id, project_id, request.agent_id)
+        if (target.profile.status != 'active'
+                or request.target_application not in target.profile.allowed_clients):
+            raise HTTPException(403, 'The receiving Agent is unavailable in this client')
+        token = token_urlsafe(32)
+        # Only hashes are stored. A crash leaves a bounded lifetime, never a
+        # reusable authority derived from a public message or thread identifier.
+        await self.runtime.driver.execute_query(
+            '''MATCH (old:FuliAgentDelegation {space_id: $space_id})
+               WHERE old.expires_at <= datetime() DELETE old''', space_id=request.personal_space_id)
+        await self.runtime.driver.execute_query(
+            '''CREATE (:FuliAgentDelegation {token_hash: $token_hash, space_id: $space_id,
+                 project_id: $project_id, agent_id: $agent_id, source_application: $application,
+                 session_id: $session_id, sender_token: $sender_token, lead_agent_id: $lead,
+                 expires_at: datetime() + duration({seconds: $lifetime}), redeemed: false})''',
+            token_hash=token_hash(token), space_id=request.personal_space_id, project_id=project_id,
+            agent_id=request.agent_id, application=request.target_application,
+            session_id=request.target_session_id, sender_token=request.task_context_token,
+            lead=lead, lifetime=request.lifetime_seconds)
+        return {'token': token}
+
+    async def redeem_agent_delegation(self, request, lead):
+        if not request.delegation_token or not request.delegation_session_id or not request.agent_id:
+            return False
+        # Lock before reading the session binding: two different sessions cannot
+        # both claim a fresh capability. Same-session hook/MCP retries are safe.
+        rows, _, _ = await self.runtime.driver.execute_query(
+            '''MATCH (:FuliSpace {id: $space_id})-[:CONTAINS_PROJECT]->
+                  (:FuliPersonalProject {project_id: $project_id})-
+                  [:HAS_PROJECT_AGENT_COORDINATION_POLICY]->(policy:FuliProjectAgentCoordinationPolicy)
+               SET policy._fuli_write_lock = true
+               REMOVE policy._fuli_write_lock
+               WITH policy WHERE policy.team_lead_agent_id = $lead
+               MATCH (grant:FuliAgentDelegation {token_hash: $token_hash, space_id: $space_id,
+                  project_id: $project_id, agent_id: $agent_id, source_application: $application,
+                  lead_agent_id: $lead})
+               SET grant.write_serial = coalesce(grant.write_serial, 0) + 1
+               WITH grant
+               WHERE grant.expires_at > datetime()
+                 AND (grant.session_id IS NULL OR grant.session_id = $session_id)
+               MATCH (session:FuliTaskContextSession)-[:HAS_CONTEXT]->(task:FuliTaskContext)
+               WHERE task.token = grant.sender_token AND session.current_token = task.token
+                 AND NOT task.completed AND task.personal_space_id = grant.space_id
+                 AND task.personal_project_id = grant.project_id
+                 AND (task.project_agent_id = grant.lead_agent_id OR grant.agent_id = grant.lead_agent_id)
+               SET grant.session_id = $session_id, grant.redeemed = true
+               RETURN grant.token_hash AS token_hash''',
+            token_hash=token_hash(request.delegation_token), space_id=request.personal_space_id,
+            project_id=request.personal_project_id, agent_id=request.agent_id,
+            application=request.source_application, lead=lead, session_id=request.delegation_session_id)
+        return bool(rows)
+
+    async def verify_agent_delegation(self, actor, request):
+        self._require_personal()
+        await self.authorize(actor, request.personal_space_id, 'reader')
+        rows, _, _ = await self.runtime.driver.execute_query(
+            '''MATCH (grant:FuliAgentDelegation {token_hash: $token_hash, space_id: $space_id,
+                  session_id: $session_id, redeemed: true})
+               WHERE grant.expires_at > datetime()
+               RETURN grant.token_hash AS token_hash''',
+            token_hash=token_hash(request.token), space_id=request.personal_space_id,
+            session_id=request.session_id)
+        return {'redeemed': bool(rows)}
+
+    async def revoke_agent_delegation(self, actor, request):
+        self._require_personal()
+        await self.authorize(actor, request.personal_space_id, 'maintainer')
+        await self.runtime.driver.execute_query(
+            '''MATCH (grant:FuliAgentDelegation {token_hash: $token_hash, space_id: $space_id})
+               DELETE grant''', token_hash=token_hash(request.token), space_id=request.personal_space_id)
+        return {'revoked': True}

package/graph-provider/fuli_graph/project_agent_employee_numbers.py

@@ -0,0 +1,41 @@
+"""Space-wide FLA employee numbers, assigned in the identity write transaction.
+
+Both identity creation paths take the space lock before touching an Agent.
+The high-water mark survives archives and identity aliases; numbers are never
+reused. Existing identities are backfilled in creation order on upgrade.
+"""
+
+EMPLOYEE_NUMBER_LOCK = '''
+    SET space._employee_number_lock = true
+    REMOVE space._employee_number_lock
+    WITH space
+'''
+
+# Keep outer variables (notably ``agent``) intact. The subquery always returns
+# one row, including when the space has no missing numbers.
+ASSIGN_EMPLOYEE_NUMBERS = '''
+    WITH space, agent
+    CALL {
+      WITH space
+      MATCH (space)-[:HAS_PROJECT_AGENT_IDENTITY]->(employee:FuliProjectAgent)
+      WITH DISTINCT space, employee
+      ORDER BY employee.created_at, employee.agent_id
+      WITH space, collect(employee) AS employees
+      WITH space, employees,
+           [employee IN employees WHERE employee.employee_number IS NULL] AS missing,
+           reduce(high = coalesce(space.fla_employee_sequence, 0), employee IN employees |
+             CASE WHEN coalesce(employee.employee_number, 0) > high
+               THEN employee.employee_number ELSE high END) AS high
+      SET space.fla_employee_sequence = high + size(missing)
+      FOREACH (index IN range(0, size(missing) - 1) |
+        FOREACH (employee IN [missing[index]] |
+          SET employee.employee_number = high + index + 1))
+      FOREACH (employee IN [item IN employees WHERE item.employee_number_space_id IS NULL] |
+        SET employee.employee_number_space_id = space.id)
+      RETURN space.fla_employee_sequence AS employee_sequence
+    }
+'''
+
+
+def employee_number_label(number: int | None) -> str | None:
+    return f'{number:06d}' if number is not None else None

package/graph-provider/fuli_graph/project_agent_memory_routes.py

@@ -15,6 +15,7 @@ from .project_agent_context_models import (
 from .agent_conversation_routes import register_agent_conversation_routes
 from .default_project_lead import DefaultProjectLeadRequest
 from .task_context_routes import register_task_context_routes
+from .project_agent_delegations import AgentDelegationIssue, AgentDelegationCheck
 
 
 def register_project_agent_memory_routes(application, store, Actor):
@@ -26,6 +27,18 @@ def register_project_agent_memory_routes(application, store, Actor):
     async def resolve_context(request: ProjectAgentContextRequest, actor: Actor):
         return await store.resolve_project_agent_context(actor, request)
 
+    @application.post('/v1/project-agent-context/delegations')
+    async def issue_delegation(request: AgentDelegationIssue, actor: Actor):
+        return await store.issue_agent_delegation(actor, request)
+
+    @application.post('/v1/project-agent-context/delegations/verify')
+    async def verify_delegation(request: AgentDelegationCheck, actor: Actor):
+        return await store.verify_agent_delegation(actor, request)
+
+    @application.post('/v1/project-agent-context/delegations/revoke')
+    async def revoke_delegation(request: AgentDelegationCheck, actor: Actor):
+        return await store.revoke_agent_delegation(actor, request)
+
     @application.post(
         '/v1/project-agent-context/default-lead', response_model=ProjectAgentContextResolution,
     )

package/graph-provider/fuli_graph/project_agent_models.py

@@ -277,6 +277,7 @@ class ProjectAgentAssignmentReplaceResult(StrictModel):
 
 class ProjectAgentRecord(StrictModel):
     agent_id: str
+    employee_number: str | None = None
     legacy_agent_ids: list[str] = Field(default_factory=list)
     personal_space_id: str
     personal_project_id: str | None = None

package/graph-provider/fuli_graph/project_agent_team_growth.py

@@ -33,8 +33,8 @@ async def enroll_recruited_team_member(store, recruitment, profile):
              policy.team_lead_agent_id IS NULL AS needs_lead,
              coalesce(policy.team_lead_agent_id = agent.agent_id, false)
                OR agent.agent_id IN members AS already_member
-        WITH *, enabled AND NOT already_member
-                  AND (needs_lead OR size(members) < 32) AS changed
+        WITH *, NOT already_member
+                  AND (needs_lead OR (enabled AND size(members) < 32)) AS changed
         FOREACH (_ IN CASE WHEN changed THEN [1] ELSE [] END |
           SET policy.team_lead_agent_id = CASE WHEN needs_lead
                 THEN agent.agent_id ELSE policy.team_lead_agent_id END,

package/graph-provider/fuli_graph/runtime.py

@@ -226,6 +226,10 @@ class GraphitiRuntime:
             'CREATE CONSTRAINT fuli_workflow_review_preview_token IF NOT EXISTS '
             'FOR (n:FuliWorkflowReviewPreview) REQUIRE n.token_hash IS UNIQUE'
         )
+        await self.driver.execute_query(
+            'CREATE CONSTRAINT fuli_agent_delegation_token IF NOT EXISTS '
+            'FOR (n:FuliAgentDelegation) REQUIRE n.token_hash IS UNIQUE'
+        )
         await self.driver.execute_query(
             'CREATE CONSTRAINT fuli_workflow_rule_id IF NOT EXISTS '
             'FOR (n:FuliWorkflowRule) REQUIRE n.id IS UNIQUE'
@@ -285,6 +289,9 @@ class GraphitiRuntime:
             'FOR (n:FuliConversationPolicy) REQUIRE n.id IS UNIQUE',
             'CREATE CONSTRAINT fuli_project_agent_id IF NOT EXISTS '
             'FOR (n:FuliProjectAgent) REQUIRE n.id IS UNIQUE',
+            'CREATE CONSTRAINT fuli_project_agent_employee_number IF NOT EXISTS '
+            'FOR (n:FuliProjectAgent) '
+            'REQUIRE (n.employee_number_space_id, n.employee_number) IS UNIQUE',
             'CREATE CONSTRAINT fuli_agent_attention_id IF NOT EXISTS '
             'FOR (n:FuliAgentAttention) REQUIRE n.id IS UNIQUE',
             'CREATE CONSTRAINT fuli_project_agent_assignment_id IF NOT EXISTS '

package/graph-provider/fuli_graph/store_project_agent_context.py

@@ -4,16 +4,21 @@ from .personal_project_access import authorize_personal_project
 from .project_agent_context_models import ProjectAgentContextResolution
 from .project_agent_task_models import ProjectAgentTaskSubmit
 from .task_context_temporary_owner import temporary_task_owner
+from .project_agent_delegations import StoreAgentDelegations
 
 
-class StoreProjectAgentContext:
+class StoreProjectAgentContext(StoreAgentDelegations):
     async def resolve_project_agent_context(self, actor, request):
         self._require_personal()
         space = await self.authorize(actor, request.personal_space_id, 'reader')
         await authorize_personal_project(self, actor, space, request.personal_project_id)
-        temporary_owner = await temporary_task_owner(self, actor, request)
+        temporary_owner = await temporary_task_owner(self, actor, request) if not request.delegation_token else None
         if temporary_owner is not None:
             return temporary_owner
+        policy = await self.get_project_agent_coordination_policy(
+            actor, request.personal_space_id, request.personal_project_id,
+        )
+        project_lead = getattr(policy, 'team_lead_agent_id', None)
         owner = None
         if request.session_id and not request.agent_id:
             rows, _, _ = await self.runtime.driver.execute_query(
@@ -39,7 +44,8 @@ class StoreProjectAgentContext:
             idempotency_key='read-only-task-context',
             title='Resolve task context', objective='Select one existing durable role.',
             work_kind=request.work_kind, required_capabilities=request.required_capabilities,
-            lead_agent_id=request.agent_id or owner, source_application=request.source_application,
+            lead_agent_id=request.agent_id or (project_lead if owner else None),
+            source_application=request.source_application,
             routing_reason='Read-only task-entry context recovery',
         )
         if owner and not request.agent_id:
@@ -71,16 +77,58 @@ class StoreProjectAgentContext:
                     'using project_context for continuity only',
                     *basis,
                 ]
-        if owner and selected:
+        requested_agent_id = None
+        reporting_lead_agent_id = None
+        peer_request = bool(request.agent_id and selected and self._is_implicit_peer(selected[0]))
+        delegated = bool(request.delegation_token)
+        if delegated and (not selected or selected[0]['agent_id'] != request.agent_id):
+            return ProjectAgentContextResolution(status='agent_unavailable', reason='delegation_invalid')
+        if not peer_request:
+            if not project_lead:
+                if delegated:
+                    return ProjectAgentContextResolution(status='agent_unavailable', reason='delegation_invalid')
+                return ProjectAgentContextResolution(
+                    status='unassigned', reason='project_lead_required',
+                    requested_agent_id=request.agent_id,
+                    match_basis=['Every project requires one accountable lead before work begins.'],
+                )
+            if selected and selected[0]['agent_id'] != project_lead:
+                # Validate the named specialist first, then route accountability
+                # through the lead. Never load the specialist's private memory here.
+                rows = await self._assignment_candidates(request.personal_space_id, request.personal_project_id)
+                lead = next((row for row in rows if row['agent_id'] == project_lead
+                             and (delegated or self._agent_client_allowed(row, request.source_application))), None)
+                if not lead:
+                    return ProjectAgentContextResolution(status='agent_unavailable',
+                        reason='team_lead_unavailable', match_basis=['The configured project lead is unavailable.'])
+                if delegated:
+                    # A real lead-to-member worker invocation keeps the member's
+                    # isolated identity; its result returns to the project lead.
+                    reporting_lead_agent_id = project_lead
+                    reason = 'delegated_member'
+                    basis = ['This member worker reports to the configured project lead.']
+                else:
+                    requested_agent_id = request.agent_id
+                    selected = [lead]
+                    reason = 'project_lead_reporting'
+                    basis = ['The project lead owns the task; requested members report results to this lead.']
+        if owner and selected and owner == selected[0]['agent_id']:
             reason, basis = 'active_task_owner', ['reuse the owner of this host session task']
         agent = await self.get_project_agent(
             actor, request.personal_space_id, request.personal_project_id,
             selected[0]['agent_id'],
         ) if selected else None
+        # A reporting lead does not execute in the member's client. Acknowledge
+        # the capability only after the executing role passes selection, so a
+        # failed resolution cannot be accepted as that member's answer.
+        if delegated and (not agent or not await self.redeem_agent_delegation(request, project_lead)):
+            return ProjectAgentContextResolution(status='agent_unavailable', reason='delegation_invalid')
         return ProjectAgentContextResolution(
             status='ready' if agent else (
                 'manual_selection' if reason == 'manual_agent_selection'
                 else 'agent_unavailable' if reason == 'agent_unavailable' else 'unassigned'
             ),
             agent=agent, reason=reason, match_basis=basis, candidate_count=len(candidates),
+            requested_agent_id=requested_agent_id,
+            reporting_lead_agent_id=reporting_lead_agent_id,
         )

package/graph-provider/fuli_graph/store_project_agent_coordination_policy.py

@@ -93,6 +93,8 @@ class StoreProjectAgentCoordinationPolicy:
         members = (request.team_member_agent_ids if 'team_member_agent_ids' in request.model_fields_set
                    else current.team_member_agent_ids)
         auto_grow = current.auto_grow_team if request.auto_grow_team is None else request.auto_grow_team
+        if 'team_lead_agent_id' in request.model_fields_set and not lead:
+            raise HTTPException(status_code=422, detail='each project requires a lead; select a replacement instead of clearing the lead')
         if members and not lead:
             raise HTTPException(status_code=422, detail='select a team lead before adding members')
         if lead in members:
@@ -115,9 +117,21 @@ class StoreProjectAgentCoordinationPolicy:
         updated_at = now_utc()
         written, _, _ = await self.runtime.driver.execute_query(
             '''
-            MATCH (:FuliSpace {id: $personal_space_id, kind: 'personal'})-
+            MATCH (space:FuliSpace {id: $personal_space_id, kind: 'personal'})-
                   [:CONTAINS_PROJECT]->
                   (project:FuliPersonalProject {project_id: $personal_project_id})
+            OPTIONAL MATCH (space)-[:HAS_PROJECT_AGENT_IDENTITY]->(role:FuliProjectAgent)
+            WHERE role.agent_id IN $team_agent_ids
+            WITH project, role ORDER BY role.agent_id
+            FOREACH (locked IN CASE WHEN role IS NULL THEN [] ELSE [role] END |
+              SET locked._task_lifecycle_lock = true
+              REMOVE locked._task_lifecycle_lock)
+            WITH project, collect(role) AS roles
+            WHERE size(roles) = size($team_agent_ids)
+              AND all(role IN roles WHERE role.status = 'active' AND EXISTS {
+                MATCH (project)-[:HAS_PROJECT_AGENT_ASSIGNMENT]->
+                      (:FuliProjectAgentAssignment {status: 'active'})-[:ASSIGNED_AGENT]->(role)
+              })
             MERGE (policy:FuliProjectAgentCoordinationPolicy {
               policy_id: $policy_id
             })
@@ -147,6 +161,7 @@ class StoreProjectAgentCoordinationPolicy:
             auto_grow_team=auto_grow,
             team_lead_agent_id=lead,
             team_member_agent_ids=members,
+            team_agent_ids=([lead] if lead else []) + members,
             expected_updated_at=current.updated_at,
             updated_at=updated_at,
         )

package/graph-provider/fuli_graph/store_project_agent_task_staffing.py

@@ -54,14 +54,15 @@ class StoreProjectAgentTaskStaffing:
             row for row in assignment_rows
             if self._agent_client_allowed(row, request.source_application)
         ]
-        if request.staffing_intent in {'new_durable', 'temporary'}:
+        if request.staffing_intent in {'new_durable', 'temporary', 'default_lead'}:
             return (
                 [],
                 rows,
                 'explicit_temporary_agent'
                 if request.staffing_intent == 'temporary'
                 else 'explicit_new_agent',
-                ['user explicitly requested recruitment'],
+                ['project requires an accountable lead' if request.staffing_intent == 'default_lead'
+                 else 'user explicitly requested recruitment'],
             )
         policy = await self.get_project_agent_coordination_policy(
             actor,

package/graph-provider/fuli_graph/store_project_agents.py

@@ -5,6 +5,9 @@ from fastapi import HTTPException
 
 from .personal_project_access import authorize_personal_project
 from .project_agent_access import authorize_project_agent
+from .project_agent_employee_numbers import (
+    ASSIGN_EMPLOYEE_NUMBERS, EMPLOYEE_NUMBER_LOCK, employee_number_label,
+)
 from .project_agent_models import (
     ProjectAgentAssignmentCreate,
     ProjectAgentAssignmentEnd,
@@ -134,6 +137,7 @@ class StoreProjectAgents:
         records, _, _ = await self.runtime.driver.execute_query(
             '''
             MATCH (space:FuliSpace {id: $personal_space_id, kind: 'personal'})
+            ''' + EMPLOYEE_NUMBER_LOCK + '''
             MERGE (agent:FuliProjectAgent {id: $id})
             ON CREATE SET agent.agent_id = $agent_id,
                           agent.created_at = $updated_at,
@@ -143,7 +147,12 @@ class StoreProjectAgents:
             SET agent._profile_upsert_lock = true
             REMOVE agent._profile_upsert_lock
             WITH space, agent
-            WHERE agent.status IS NULL OR agent.status <> 'archived'
+            WHERE (agent.status IS NULL OR agent.status <> 'archived')
+              AND ($status = 'active' OR NOT EXISTS {
+                MATCH (space)-[:CONTAINS_PROJECT]->(:FuliPersonalProject)-
+                      [:HAS_PROJECT_AGENT_COORDINATION_POLICY]->(policy:FuliProjectAgentCoordinationPolicy)
+                WHERE policy.team_lead_agent_id = agent.agent_id
+              })
             SET agent.profile_json = $profile_json,
                 agent.name = $name,
                 agent.occupation_emoji = $occupation_emoji,
@@ -159,6 +168,7 @@ class StoreProjectAgents:
                   agent.recruitment_id, $recruitment_id),
                 agent.updated_at = $updated_at
             MERGE (space)-[:HAS_PROJECT_AGENT_IDENTITY]->(agent)
+            ''' + ASSIGN_EMPLOYEE_NUMBERS + '''
             RETURN agent
             ''',
             personal_space_id=request.personal_space_id,
@@ -182,7 +192,7 @@ class StoreProjectAgents:
             raise HTTPException(
                 status_code=409,
                 detail=(
-                    'archived Project Agents require a dedicated restore operation'
+                    'archived Agents require a dedicated restore operation; project leads must hand off before deactivation'
                 ),
         )
         if request.personal_project_id:
@@ -420,7 +430,12 @@ class StoreProjectAgents:
                              'awaiting_recruitment', 'queued', 'running',
                              'paused', 'blocked', 'awaiting_review'
                            ]] AS open_tasks
-            WHERE agent.status = 'archived' OR size(open_tasks) = 0
+            WHERE (agent.status = 'archived' OR size(open_tasks) = 0)
+              AND NOT EXISTS {
+                MATCH (space)-[:CONTAINS_PROJECT]->(:FuliPersonalProject)-
+                      [:HAS_PROJECT_AGENT_COORDINATION_POLICY]->(policy:FuliProjectAgentCoordinationPolicy)
+                WHERE policy.team_lead_agent_id = agent.agent_id
+              }
             SET agent.status = 'archived',
                 agent.archive_reason = coalesce(agent.archive_reason, $reason),
                 agent.archived_at = coalesce(agent.archived_at, $updated_at),
@@ -446,7 +461,7 @@ class StoreProjectAgents:
         if not records:
             raise HTTPException(
                 status_code=409,
-                detail='Agent is missing or still has non-terminal task work',
+                detail='Agent is missing, has non-terminal task work, or is a project lead; hand off before archiving',
             )
         return await self.get_project_agent(
             actor,
@@ -768,6 +783,11 @@ class StoreProjectAgents:
             WITH project, assignment, agent
             WHERE assignment.status = 'active'
               AND coalesce(assignment.revision, 0) = $expected_revision
+              AND NOT EXISTS {
+                MATCH (project)-[:HAS_PROJECT_AGENT_COORDINATION_POLICY]->
+                      (policy:FuliProjectAgentCoordinationPolicy)
+                WHERE policy.team_lead_agent_id = agent.agent_id
+              }
             SET assignment.status = 'ended',
                 assignment.end_reason = $reason,
                 assignment.ended_at = $updated_at,
@@ -786,7 +806,7 @@ class StoreProjectAgents:
         if not records:
             raise HTTPException(
                 status_code=409,
-                detail='assignment is not active or revision is stale',
+                detail='assignment is not active, revision is stale, or project leadership requires a handoff',
             )
         row = records[0]
         return self._assignment(
@@ -851,6 +871,11 @@ class StoreProjectAgents:
             REMOVE lifecycle_agent._task_lifecycle_lock
             WITH project, ended, ended_agent, replacement_agent,
                  collect(lifecycle_agent) AS locked_agents
+            WHERE ended.status <> 'active' OR NOT EXISTS {
+              MATCH (project)-[:HAS_PROJECT_AGENT_COORDINATION_POLICY]->
+                    (policy:FuliProjectAgentCoordinationPolicy)
+              WHERE policy.team_lead_agent_id = ended_agent.agent_id
+            }
             OPTIONAL MATCH (existing_replacement:FuliProjectAgentAssignment {
               id: $replacement_id
             })
@@ -1075,6 +1100,7 @@ class StoreProjectAgents:
         })
         return ProjectAgentRecord(
             agent_id=raw['agent_id'],
+            employee_number=employee_number_label(raw.get('employee_number')),
             legacy_agent_ids=list(raw.get('legacy_agent_ids') or []),
             personal_space_id=personal_space_id,
             personal_project_id=projection_project_id,

package/graph-provider/fuli_graph/system_agents.py

@@ -8,6 +8,7 @@ original coordinator reference.
 import json
 
 from .project_agent_models import ProjectAgentProfile
+from .project_agent_employee_numbers import ASSIGN_EMPLOYEE_NUMBERS, EMPLOYEE_NUMBER_LOCK
 from .provider_values import now_utc, stable_uuid
 
 SYSTEM_COORDINATOR_AGENT_ID = 'employee.jefa'
@@ -75,6 +76,7 @@ async def ensure_system_identity(driver, provider_id, space_id, agent_id):
     await driver.execute_query(
         '''
         MATCH (space:FuliSpace {id: $space_id, kind: 'personal'})
+        ''' + EMPLOYEE_NUMBER_LOCK + '''
         MERGE (agent:FuliProjectAgent {id: $id})
         ON CREATE SET agent.agent_id = $agent_id,
                       agent.name = $name,
@@ -90,7 +92,7 @@ async def ensure_system_identity(driver, provider_id, space_id, agent_id):
             agent.status = 'active',
             agent.system_managed = true
         MERGE (space)-[:HAS_PROJECT_AGENT_IDENTITY]->(agent)
-        ''',
+        ''' + ASSIGN_EMPLOYEE_NUMBERS + ' RETURN agent',
         space_id=space_id,
         id=node_id,
         agent_id=agent_id,

package/graph-provider/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fuli-graph-provider"
-version = "0.11.0"
+version = "0.11.1"
 description = "Graphiti-backed personal and shared project provider for Fuli."
 requires-python = ">=3.12"
 dependencies = [

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "fuli-context",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "fuli-context",
-      "version": "0.11.0",
+      "version": "0.11.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@a2a-js/sdk": "1.3.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fuli-context",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Local-first collaboration relationship graph for AI agents.",
   "type": "module",
   "files": [

package/src/agent-roundtable/service.js

@@ -10,7 +10,7 @@ const NESTED_ASK_LIMIT = 3;
 // Agents talk to each other directly: an ask wakes the recipient in its own
 // client and returns its answer, or waits in its inbox for its next task.
 export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFactory = randomUUID,
-  locateCwd = sessionWorkingDirectory, clientAvailable = (client) => Boolean(resolveClientCommand(client)) }) {
+  env = process.env, locateCwd = sessionWorkingDirectory, clientAvailable = (client) => Boolean(resolveClientCommand(client)) }) {
   const spaceId = () => app.config.personal.spaceId;
   // Opened on first use: most MCP processes never touch the roundtable.
   let opened = null;
@@ -35,6 +35,9 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
     const all = await agents();
     const exact = all.find((agent) => agent.agentId === needle || agent.agentId === decodeURIComponent(needle));
     if (exact) return exact;
+    const number = needle.match(/^(?:FLA\s*)?(\d{6,})$/i)?.[1];
+    const numbered = number && all.find((agent) => agent.employeeNumber === number);
+    if (numbered) return numbered;
     const named = all.filter((agent) => [agent.profile.displayName, agent.profile.name]
       .some((name) => name?.toLowerCase() === needle.toLowerCase()));
     if (named.length === 1) return named[0];
@@ -53,11 +56,12 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
 
   async function findAgents({ query = null, personalProjectId = null } = {}) {
     const needle = query?.trim().toLowerCase();
-    const matches = (await agents()).filter((agent) => !needle || [agent.agentId, agent.profile.displayName,
+    const matches = (await agents()).filter((agent) => !needle || [agent.agentId,
+      agent.employeeNumber ? `FLA ${agent.employeeNumber}` : null, agent.profile.displayName,
       agent.profile.name, agent.profile.responsibility, ...(agent.profile.capabilities ?? [])]
       .some((value) => value?.toLowerCase().includes(needle)));
     return { agents: await Promise.all(matches.slice(0, 20).map(async (agent) => ({
-      agentId: agent.agentId, name: label(agent), responsibility: agent.profile.responsibility,
+      agentId: agent.agentId, employeeNumber: agent.employeeNumber, name: label(agent), responsibility: agent.profile.responsibility,
       clients: (agent.profile.allowedClients ?? []).filter((client) => WAKE_CLIENTS.includes(client)),
       recentConversations: await conversations(agent, personalProjectId)
     }))),
@@ -107,6 +111,7 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
       to: { agentId: target.agentId, name: label(target) } });
     const nested = history.filter((message) => message.kind === 'ask' && message.status === 'delivering').length;
     if (!wait || nested >= NESTED_ASK_LIMIT) return queued(thread, ask, target, nested ? 'nested_limit' : 'not_waiting');
+    if (!taskContextToken || !from.projectId) return queued(thread, ask, target, 'task_context_required');
     const attempts = await deliveryTargets(target, conversation, from.projectId, projectPath);
     if (!attempts.length) return queued(thread, ask, target, 'no_client');
     const prompt = wakePrompt({ thread, ask, target, senderName: ask.from_name, senderClient: from.client });
@@ -117,8 +122,20 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
       if (unusable.has(delivery.client)) continue;
       store.updateMessage(ask.id, { status: 'delivering', toClient: delivery.client, toSession: delivery.sessionId });
       let answer;
+      let grant;
       try {
-        answer = await wake({ client: delivery.client, sessionId: delivery.sessionId, cwd: delivery.cwd, timeoutMs, prompt });
+        grant = await app.personal.issueAgentDelegation({ personal_space_id: spaceId(),
+          task_context_token: taskContextToken, source_application: from.client, agent_id: target.agentId,
+          target_application: delivery.client,
+          // Claude resumes into a fork with a new ID. Only Codex resumes in place.
+          target_session_id: delivery.client === 'codex' ? delivery.sessionId : null,
+          lifetime_seconds: timeoutMs / 1000 });
+        answer = await wake({ client: delivery.client, sessionId: delivery.sessionId, cwd: delivery.cwd,
+          timeoutMs, prompt, delegationToken: grant.token });
+        const verified = answer.sessionId && await app.personal.verifyAgentDelegation({
+          personal_space_id: spaceId(), token: grant.token, session_id: answer.sessionId });
+        if (!verified?.redeemed) throw Object.assign(new Error('The receiving session did not restore the Agent'),
+          { code: 'delegation_not_redeemed' });
       } catch (error) {
         failure = error.code ?? 'wake_failed';
         // A missing or logged-out client cannot answer from any session. A conversation
@@ -127,6 +144,11 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
         // A timeout already used the caller's wait.
         if (failure === 'wake_timeout') break;
         continue;
+      } finally {
+        // Even failed or timed-out attempts lose their authority. Expiry remains
+        // the fail-closed backstop if the Provider is temporarily unreachable.
+        if (grant?.token) await app.personal.revokeAgentDelegation({
+          personal_space_id: spaceId(), token: grant.token }).catch(() => {});
       }
       const via = `${delivery.client}:${delivery.sessionId ? 'resume' : 'new'}`;
       store.updateMessage(ask.id, { status: 'answered', via });
@@ -187,7 +209,14 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
         to: { agentId: message.to_agent, name: message.to_name, client: message.to_client } })) };
   }
 
-  return { findAgents, messageAgent, readMessages, replyMessage, threads, thread,
+  function taskEntryDelegation({ sessionId }) {
+    // The public thread header is presentation only. The Provider validates this
+    // process-local capability, including project, recipient, client and session.
+    return env.FULI_ROUNDTABLE_DELEGATION
+      ? { token: env.FULI_ROUNDTABLE_DELEGATION, sessionId: sessionId ?? null } : null;
+  }
+
+  return { findAgents, messageAgent, readMessages, replyMessage, threads, thread, taskEntryDelegation,
     pending: (agentId) => store.pendingFor(spaceId(), agentId).map(inboxItem),
     close: () => opened?.close() };
 }