openvisio-agent 0.18.0 → 0.18.2

package/src/watch.mjs

@@ -10,7 +10,11 @@ import { homedir } from 'node:os'
 import { join, dirname } from 'node:path'
 import { OV_DIR, DEFAULT_WORKSPACE, readConfig, writeJson, configPath, onPath, fail, ok, info, slugify, stripSlash, chmodSafe } from './lib.mjs'
 import { connectAgentWs, assertWebSocket } from './ws.mjs'
-import { agentStateRequest, buildTaskCompletionReport, codexPolicyBlock, mentionDedupeKeys, opencodeEventEvidence, requestTargetsLaterAgent, shouldSuppressCodexDiagnostic, taskAgentId, taskFromEvent, taskIsAwaitingReview, taskIsCompleted } from './events.mjs'
+import { agentStateRequest, buildTaskCompletionReport, codexPolicyBlock, mentionDedupeKeys, normalizeRenderedMessageText, opencodeEventEvidence, renderedAgentMessages, requestTargetsLaterAgent, shouldSuppressCodexDiagnostic, taskAgentId, taskFromEvent, taskIsAwaitingReview, taskIsCompleted } from './events.mjs'
+import { createByoMemoryGraph } from './memory.mjs'
+import { repositoryHasPrPushAuthorization } from './pr-push.mjs'
+import { createMcpHttpClient } from './mcp-http.mjs'
+import { buildOpencodeConfig, opencodeRuntimeLayout } from './opencode-config.mjs'
 
 // Behaviour prompts. The openvisio-team MCP bridge requires the agent's
 // credentials as ARGUMENTS on every tool call — those are injected at runtime by
@@ -286,25 +290,25 @@ export async function runWatch({ flags }) {
 // ── opencode cycle runner ─────────────────────────────────────────────────────
 // opencode (opencode.ai) has no persistent stream-json protocol like Claude Code,
 // so each cycle is a headless `opencode run <prompt> --auto [--model provider/model]`.
-// The openvisio-team MCP is declared in an `opencode.json` written into the run cwd
-// (opencode reads it from there). `--auto` approves tool use non-interactively.
+// The openvisio-team MCP is declared in a private per-agent config. The actual
+// code workspace is passed through --dir, so two agents never overwrite each
+// other's MCP identity even when they work in the same repository.
+// `--auto` approves tool use non-interactively.
 // Same { runCycle, canCode } contract as the Claude runner.
 function createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, maxCycleMs, log, debug, model, onTool, systemPrompt }) {
-  // opencode reads opencode.json from its CWD: the code workspace, or a dedicated
-  // per-agent dir for chat-only agents.
-  const cwd = workdir || join(OV_DIR, 'opencode-' + (cfgKey || 'agent'))
+  const { configDir, configPath: opencodeConfigPath, workspace } = opencodeRuntimeLayout({ cfgKey, workdir })
   const bin = onPath('opencode') || 'opencode'
+  const redactKey = String(mcpHeaders?.['x-agent-api-key'] || '')
+  const opencodeConfig = buildOpencodeConfig({ mcpUrl, mcpHeaders })
   let configured = false
   const ensureConfig = () => {
     if (configured) return
     configured = true
     try {
-      mkdirSync(cwd, { recursive: true })
-      if (mcpUrl) {
-        writeJson(join(cwd, 'opencode.json'), {
-          $schema: 'https://opencode.ai/config.json',
-          mcp: { 'openvisio-team': { type: 'remote', url: mcpUrl, enabled: true, ...(mcpHeaders && Object.keys(mcpHeaders).length ? { headers: mcpHeaders } : {}) } },
-        }, true)
+      mkdirSync(configDir, { recursive: true })
+      mkdirSync(workspace, { recursive: true })
+      if (opencodeConfig) {
+        writeJson(opencodeConfigPath, opencodeConfig, true)
       } else {
         log('WARNING: no --mcp-url — opencode has no openvisio-team tools to act with. Re-connect with --mcp-url.')
       }
@@ -320,7 +324,7 @@ function createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, ma
       const full = systemPrompt ? systemPrompt + '\n\n' + prompt : prompt
       // JSON mode is the evidence boundary. Formatted stdout only tells us that
       // OpenCode exited; raw events tell us which tools actually completed.
-      const args = ['run', full, '--auto', '--format', 'json', ...(m ? ['--model', m] : [])]
+      const args = ['run', full, '--auto', '--format', 'json', '--dir', workspace, ...(m ? ['--model', m] : [])]
       let child = null, done = false, didCode = false, didRepoMutation = false, didMessage = false, didChannelMessage = false, didMcpTaskRead = false, didMcpTaskUpdate = false
       let outputText = '', jsonlBuffer = ''
       const mcpCalls = new Set(), mcpErrors = new Set(), runtimeErrors = new Set()
@@ -348,6 +352,10 @@ function createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, ma
         if (evidence.runtimeError) runtimeErrors.add(evidence.runtimeError)
         if (!evidence.tool) return
         if (debug) log('  → tool ' + evidence.tool + (evidence.failed ? ' (failed)' : evidence.completed ? ' (completed)' : ''))
+        if (evidence.failed && evidence.toolError) {
+          const safeError = (redactKey ? String(evidence.toolError).split(redactKey).join('[redacted]') : String(evidence.toolError)).replace(/\s+/g, ' ').slice(0, 240)
+          log('  ✗ opencode tool ' + evidence.tool + ': ' + safeError)
+        }
         try { onTool && onTool(evidence.tool) } catch { /* activity is best-effort */ }
         if (evidence.mcpTool) {
           mcpCalls.add(evidence.mcpTool)
@@ -368,7 +376,18 @@ function createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, ma
       }, maxCycleMs)
       log('running opencode cycle…' + (m ? ' [' + m + ']' : ''))
       try {
-        child = spawn(bin, args, { cwd, stdio: ['ignore', 'pipe', 'inherit'] })
+        child = spawn(bin, args, {
+          cwd: configDir,
+          env: {
+            ...process.env,
+            OPENCODE_CONFIG: opencodeConfigPath,
+            // Inline config has higher precedence than a project opencode.json.
+            // This prevents a stale generated workspace file from replacing this
+            // agent's URL or credentials while keeping normal project settings.
+            ...(opencodeConfig ? { OPENCODE_CONFIG_CONTENT: JSON.stringify(opencodeConfig) } : {}),
+          },
+          stdio: ['ignore', 'pipe', 'inherit'],
+        })
         child.stdout?.on('data', (data) => {
           jsonlBuffer += String(data)
           const lines = jsonlBuffer.split('\n')
@@ -387,7 +406,7 @@ function createOpencodeRunner({ mcpUrl, mcpHeaders, cfgKey, workdir, canCode, ma
     })
   }
 
-  log('opencode runner ready' + (model ? ' [model ' + model + ']' : '') + (canCode ? ' [CODE workspace ' + cwd + ']' : ' [CHAT-ONLY — cfg ' + cwd + ']'))
+  log('opencode runner ready' + (model ? ' [model ' + model + ']' : '') + (canCode ? ' [CODE workspace ' + workspace + '; isolated cfg ' + configDir + ']' : ' [CHAT-ONLY; isolated cfg ' + configDir + ']'))
   return { runCycle, canCode }
 }
 
@@ -402,12 +421,14 @@ function createCodexRunner({ mcpUrl, mcpHeaders, workdir, canCode, maxCycleMs, l
   const tomlString = (v) => JSON.stringify(String(v))
   const headerEntries = Object.entries(mcpHeaders || {}).map(([k, v]) => `${JSON.stringify(k)} = ${tomlString(v)}`).join(', ')
 
-  function runCycle(prompt, cycleModel) {
+  function runCycle(prompt, cycleModel, cycleOptions = {}) {
     return new Promise((resolve) => {
       const m = cycleModel || model
       const full = systemPrompt ? systemPrompt + '\n\n' + prompt : prompt
+      const disabledMcpTools = Array.isArray(cycleOptions.disabledMcpTools) ? cycleOptions.disabledMcpTools.filter(Boolean) : []
+      const disabledToolConfig = disabledMcpTools.length ? `, disabled_tools = [${disabledMcpTools.map(tomlString).join(', ')}]` : ''
       const mcpOverride = mcpUrl
-        ? `mcp_servers={ openvisio-team = { url = ${tomlString(mcpUrl)}${headerEntries ? `, http_headers = { ${headerEntries} }` : ''} } }`
+        ? `mcp_servers={ openvisio-team = { url = ${tomlString(mcpUrl)}${headerEntries ? `, http_headers = { ${headerEntries} }` : ''}${disabledToolConfig} } }`
         : ''
       const args = ['exec', '--ignore-user-config', '--skip-git-repo-check', '--ephemeral', '--json', '--color', 'never',
         ...(canCode ? ['--approve-for-me'] : ['--sandbox', 'read-only']),
@@ -448,8 +469,9 @@ function createCodexRunner({ mcpUrl, mcpHeaders, workdir, canCode, maxCycleMs, l
       const inspectLine = (line) => {
         const s = line.trim()
         if (!s) return
+        policyBlock = codexPolicyBlock(s) || policyBlock
         if (/command_execution|file_change|apply_patch|shell_command|exec_command/i.test(s)) didCode = true
-        if (/file_change|apply_patch/i.test(s) || /\b(?:git\s+(?:commit|push)|gh\s+pr\s+create)\b/i.test(s)) didRepoMutation = true
+        if (/file_change|apply_patch/i.test(s) || /\b(?:git\s+(?:commit|push)|gh\s+pr\s+create|openvisio-agent\s+push-pr-branch)\b/i.test(s)) didRepoMutation = true
         if (/post_message|comment_ticket/i.test(s)) didMessage = true
         try {
           const event = JSON.parse(s)
@@ -461,6 +483,7 @@ function createCodexRunner({ mcpUrl, mcpHeaders, workdir, canCode, maxCycleMs, l
             try { onTool && onTool(tool) } catch { /* activity is best-effort */ }
             if (/^(?:get_ticket|list_tasks|list_task_types)$/.test(tool)) didMcpTaskRead = true
             if (tool === 'update_ticket') didMcpTaskUpdate = true
+            if (/^(?:create_codebase_branch|create_codebase_commit|write_codebase_file|create_pull_request)$/.test(tool)) { didCode = true; didRepoMutation = true }
             if (/post_message|comment_ticket/.test(tool)) didMessage = true
             if (/post_message/.test(tool)) didChannelMessage = true
             if (/fail|error/i.test(String(item.status || '')) || item.error) mcpErrors.add(tool)
@@ -664,7 +687,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   const canCode = !!workdir
   // The Mastra bridge authenticates per-CALL: every openvisio-team tool needs
   // agent_identifier + agent_api_key as arguments. Hand them over up front.
-  const credNote = `AUTH: the openvisio-team tools REQUIRE two arguments on EVERY call — agent_identifier: "${identifier}" and agent_api_key: "${apiKey}". Include BOTH on every openvisio-team tool call. Use ONLY names shown in the current tool list. On backend MCP, discover and update work with list_agents, list_projects, list_tasks, get_ticket, update_ticket, comment_ticket, and list_activity; get_marching_orders and poll_inbox may be absent. Tools may be namespaced — call whichever names actually appear. The credentials are given here; do NOT hunt for them. Bash/git/gh ARE for code work; this rule only forbids searching for keys.`
+  const credNote = `AUTH: the openvisio-team tools REQUIRE two arguments on EVERY call — agent_identifier: "${identifier}" and agent_api_key: "${apiKey}". Include BOTH on every openvisio-team tool call. Use ONLY names shown in the current tool list. On backend MCP, discover and update work with list_agents, list_projects, list_tasks, list_task_types, get_ticket, update_ticket, comment_ticket, list_channels, list_message_thread, and list_activity as applicable. get_marching_orders, poll_inbox, and get_resource are relay-only and are NOT available here; never call them. Tools may be namespaced — call whichever names actually appear. The credentials are given here; do NOT hunt for them. Bash/git/gh ARE for code work; this rule only forbids searching for keys.`
   // The STATIC charter + creds are the session system prompt (cached, billed once),
   // NOT re-sent in every cycle's user message — the big token saving.
   const systemPrompt = (canCode ? CODE_CHARTER : CHAT_CHARTER) + '\n\n' + credNote
@@ -678,8 +701,13 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     work: createCycleRunner({ ...runnerOptions, onTool: (name) => { if (/post_message/.test(name)) emitLaneStatus('work', 'typing') } }),
     reply: createCycleRunner({ ...runnerOptions, cfgKey: identifier + '-reply', onTool: (name) => { if (/post_message/.test(name)) emitLaneStatus('reply', 'typing') } }),
   }
-  const fullPrompt = canCode ? CODE_FULL : CYCLE
-  const fastPrompt = canCode ? CODE_FAST : CYCLE_FAST
+  const codexPushGuide = agent === 'codex' && canCode
+    ? '\n\nCODEX PR DELIVERY: first inspect the OpenVisio MCP tools. When list_codebases, create_codebase_branch, create_codebase_commit (or write_codebase_file), and create_pull_request are available, use that authenticated linked-codebase flow to create the agent/* branch, publish the verified changed files, and open the PR. This is the preferred path and requires no local git push. If those tools are unavailable for the repository, do not run git push directly. From the repository run `openvisio-agent push-pr-branch`. It is a user-authorized constrained fallback that can only push HEAD to the matching agent/* branch on the exact authorized origin. If it reports OPENVISIO_PR_PUSH_AUTH_REQUIRED, do not retry or route around it. Report the one-time command `openvisio-agent authorize-pr-push` as the blocker.'
+    : ''
+  const backendToolRule = 'BACKEND MCP RULE: the event and watcher already provide the work source. Never call get_marching_orders, poll_inbox, get_resource, or other relay-only tools; they are not exposed by the backend MCP. Use only names present in the current openvisio-team tool list. For discovery use list_agents, list_projects, list_tasks, list_task_types, list_activity, get_ticket, and list_channels as applicable.'
+  const fullPrompt = (canCode ? CODE_FULL + codexPushGuide : 'Handle the supplied verified backend ticket with the available OpenVisio tools. Update or comment on the ticket as requested, do not claim repository work in chat-only mode, and stop after the verified action.') + '\n\n' + backendToolRule
+  const fastPrompt = (canCode ? CODE_FAST : CYCLE_FAST) + '\n\n' + backendToolRule
+  const coordinatePrompt = COORDINATE + '\n\n' + backendToolRule
   // Live model state — changeable at runtime by the in-chat `/model` command.
   // codeModel drives full/sweep cycles; chatModel (if set) the lighter fast/intro
   // ones, so routine chatter can run cheaper than real code work.
@@ -687,8 +715,8 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   let liteModel = chatModel || model
 
   const lanes = {
-    work: { busy: false, queued: null, pending: [], targets: new Set(), taskRefs: [] },
-    reply: { busy: false, queued: null, pending: [], targets: new Set(), taskRefs: [] },
+    work: { busy: false, queued: null, pending: [], targets: new Set(), taskRefs: [], deferred: [] },
+    reply: { busy: false, queued: null, pending: [], targets: new Set(), taskRefs: [], deferred: [] },
   }
   // Tasks we've already reacted to (keyed task-id:agent — so a REASSIGNMENT to a
   // different agent re-triggers), so a noisy stream of task:updated events doesn't
@@ -703,6 +731,8 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   const seenMentions = new Set(Array.isArray(replayState.seenMentions) ? replayState.seenMentions : [])
   const recentMentionSignatures = new Map(Array.isArray(replayState.recentMentionSignatures) ? replayState.recentMentionSignatures : [])
   const seenActivities = new Set(Array.isArray(replayState.seenActivities) ? replayState.seenActivities : [])
+  const deliveredReplies = new Set(Array.isArray(replayState.deliveredReplies) ? replayState.deliveredReplies : [])
+  const memory = createByoMemoryGraph({ path: join(OV_DIR, 'watch-' + slug + '-memory.json') })
   // Completion delivery is runtime-owned for assigned coding work. Persist both
   // pending and delivered keys so a reconnect can finish a missed notification
   // without re-running the model or posting the same result twice.
@@ -714,6 +744,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   // unassigned. This prevents a 30-minute reconciliation retry from repeatedly
   // attempting the same rejected egress action.
   const blockedTasks = new Set(Array.isArray(replayState.blockedTasks) ? replayState.blockedTasks : [])
+  const blockedTaskRepos = new Map(Array.isArray(replayState.blockedTaskRepos) ? replayState.blockedTaskRepos : [])
   const trimSeen = (set) => { while (set.size > 500) set.delete(set.values().next().value) }
   const MENTION_SIGNATURE_TTL_MS = 10 * 60 * 1000
   const pruneMentionSignatures = () => {
@@ -728,7 +759,9 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
         seenMentions: [...seenMentions],
         recentMentionSignatures: [...recentMentionSignatures],
         seenActivities: [...seenActivities],
+        deliveredReplies: [...deliveredReplies],
         blockedTasks: [...blockedTasks],
+        blockedTaskRepos: [...blockedTaskRepos],
         pendingCompletionReports: [...pendingCompletionReports],
         reportedCompletions: [...reportedCompletions],
         reportedTaskComments: [...reportedTaskComments],
@@ -754,60 +787,56 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   let lastTaskTriggeredAt = 0
   let lastInboxSignature = ''
   let selfAgentId = null
-  let mcpSessionId = ''
-  let mcpRpcId = 0
-
-  const mcpPayload = async (res) => {
-    const body = await res.text()
-    const data = body.split(/\r?\n/).filter((line) => line.startsWith('data:')).map((line) => line.slice(5).trim()).pop()
-    return JSON.parse(data || body || '{}')
-  }
-  const mcpPost = async (message, withSession = true) => {
-    const res = await fetch(mcpUrl, {
-      method: 'POST',
-      headers: {
-        'content-type': 'application/json',
-        accept: 'application/json, text/event-stream',
-        'x-agent-api-key': apiKey,
-        'x-agent-identifier': identifier,
-        ...(withSession && mcpSessionId ? { 'mcp-session-id': mcpSessionId } : {}),
-      },
-      body: JSON.stringify(message),
-    })
-    return res
-  }
-  const ensureMcpSession = async () => {
-    if (mcpSessionId) return
-    const res = await mcpPost({ jsonrpc: '2.0', id: ++mcpRpcId, method: 'initialize', params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'openvisio-agent', version: '0.18.0' } } }, false)
-    if (!res.ok) throw new Error('MCP initialize HTTP ' + res.status)
-    await mcpPayload(res)
-    mcpSessionId = res.headers.get('mcp-session-id') || ''
-    if (!mcpSessionId) throw new Error('MCP initialize returned no session id')
-    const ready = await mcpPost({ jsonrpc: '2.0', method: 'notifications/initialized' })
-    if (!ready.ok) throw new Error('MCP initialized HTTP ' + ready.status)
-  }
-  const callMcpTool = async (name, args = {}, retried = false) => {
-    await ensureMcpSession()
-    const res = await mcpPost({ jsonrpc: '2.0', id: ++mcpRpcId, method: 'tools/call', params: { name, arguments: { ...args, agent_api_key: apiKey, agent_identifier: identifier } } })
-    if (!res.ok) {
-      if (!retried && (res.status === 400 || res.status === 404)) { mcpSessionId = ''; return callMcpTool(name, args, true) }
-      throw new Error(`MCP ${name} HTTP ${res.status}`)
-    }
-    const payload = await mcpPayload(res)
-    if (payload.error) throw new Error(`MCP ${name}: ${payload.error.message || 'tool error'}`)
-    const result = payload.result ?? payload
-    if (result?.isError) {
-      const detail = result.content?.find?.((c) => c?.type === 'text')?.text || 'tool error'
-      throw new Error(`MCP ${name}: ${detail}`)
-    }
-    return result
-  }
+  const mcpClient = createMcpHttpClient({ url: mcpUrl, apiKey, identifier, clientVersion: '0.18.2', log })
+  const callMcpTool = (name, args = {}) => mcpClient.callTool(name, args)
   const toolData = (result) => {
     const text = result?.content?.find?.((c) => c?.type === 'text')?.text
     if (typeof text !== 'string') return result?.structuredContent ?? result ?? {}
     try { return JSON.parse(text) } catch { return { text } }
   }
 
+  // All watcher-owned message delivery goes through this gate. For threaded
+  // replies it first reads the live backend thread and inspects rows already
+  // rendered as this agent. A persisted delivery key closes the crash/reconnect
+  // gap; an in-flight promise closes the two-lane race inside one watcher.
+  const messageDeliveries = new Map()
+  const postMessageOnce = async ({ key, channelId, parentId, projectId, content, skipIfAnyAgentReply = false, sourceKey = '' }) => {
+    const deliveryKey = String(key || '')
+    const message = String(content || '').trim()
+    if (!deliveryKey || !Number.isFinite(Number(channelId)) || !message) return { posted: false, reason: 'invalid-delivery' }
+    if (deliveredReplies.has(deliveryKey) || memory.has(deliveryKey, 'rendered')) return { posted: false, reason: 'remembered' }
+    if (messageDeliveries.has(deliveryKey)) return messageDeliveries.get(deliveryKey)
+
+    const run = (async () => {
+      if (parentId != null) {
+        const live = toolData(await callMcpTool('list_message_thread', { channel_id: Number(channelId), message_id: Number(parentId) }))
+        const rendered = renderedAgentMessages(live, { id: selfAgentId, identifier, slug, name: slug })
+        const duplicate = rendered.some((row) => normalizeRenderedMessageText(row.content) === normalizeRenderedMessageText(message))
+        if (duplicate || (skipIfAnyAgentReply && rendered.length)) {
+          deliveredReplies.add(deliveryKey); trimSeen(deliveredReplies); persistReplay()
+          memory.remember({ key: deliveryKey, kind: 'delivery', state: 'rendered', summary: duplicate ? message : rendered.at(-1)?.content, refs: { channelId: Number(channelId), threadId: Number(parentId) }, meta: { discoveredFromBackend: true } })
+          if (sourceKey) memory.connect(deliveryKey, sourceKey, 'responds_to')
+          log('message delivery ' + deliveryKey + ' already rendered — skipped')
+          return { posted: false, reason: duplicate ? 'same-content-rendered' : 'agent-reply-rendered' }
+        }
+      }
+
+      sendStatus(Number(channelId), 'typing')
+      const result = toolData(await callMcpTool('post_message', {
+        ...(Number.isFinite(Number(projectId)) ? { project_id: Number(projectId) } : {}),
+        channel_id: Number(channelId),
+        ...(parentId != null ? { parent_id: Number(parentId) } : {}),
+        content: message,
+      }))
+      deliveredReplies.add(deliveryKey); trimSeen(deliveredReplies); persistReplay()
+      memory.remember({ key: deliveryKey, kind: 'delivery', state: 'rendered', summary: message, refs: { channelId: Number(channelId), ...(parentId != null ? { threadId: Number(parentId) } : {}), ...(Number.isFinite(Number(projectId)) ? { projectId: Number(projectId) } : {}) }, meta: { messageId: result.id ?? result.message?.id ?? null } })
+      if (sourceKey) memory.connect(deliveryKey, sourceKey, 'responds_to')
+      return { posted: true, result }
+    })().finally(() => messageDeliveries.delete(deliveryKey))
+    messageDeliveries.set(deliveryKey, run)
+    return run
+  }
+
   const statusChannelCache = new Map()
   const projectStatusChannel = async (projectId) => {
     const key = Number(projectId)
@@ -829,6 +858,22 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     }
   }
 
+  const announceIntroduction = async () => {
+    const projectsData = toolData(await callMcpTool('list_projects'))
+    const projects = Array.isArray(projectsData.projects) ? projectsData.projects : []
+    const project = projects.find((item) => Number.isFinite(Number(item.id)))
+    if (!project) { log('no project available for first-connection introduction'); return false }
+    const channelId = await projectStatusChannel(project.id)
+    if (!Number.isFinite(Number(channelId))) return false
+    await postMessageOnce({
+      key: `intro:${identifier}:${project.id}`,
+      projectId: Number(project.id),
+      channelId: Number(channelId),
+      content: "I'm here, I pick up tasks assigned to me, and I respond to @mentions. Send work my way whenever you need me.",
+    })
+    return true
+  }
+
   const announceTaskCompletion = async (taskRef, result = {}) => {
     const projectId = Number(taskRef?.projectId)
     const ticketId = Number(taskRef?.ticketId)
@@ -838,6 +883,15 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     const ticket = current.ticket ?? current.task ?? current
     const report = buildTaskCompletionReport(ticket, { projectId, fallbackText: result.outputText })
     if (!report) return false
+    const memoryKey = `ticket:${projectId}:${ticketId}`
+    memory.remember({
+      key: memoryKey,
+      kind: 'ticket',
+      state: 'handoff',
+      summary: report.content,
+      refs: { projectId, ticketId },
+      meta: { reportKey: report.key, prUrl: report.prUrl },
+    })
     // Ticket comments are now a backend first-class surface. The watcher owns the
     // final comment so every runtime (Claude, Codex, OpenCode) closes the ticket
     // loop consistently, and the persisted report key prevents reconnect repeats.
@@ -862,10 +916,10 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     }
     const channelId = Number.isFinite(Number(taskRef.channelId)) ? Number(taskRef.channelId) : await projectStatusChannel(projectId)
     if (!Number.isFinite(channelId)) return false
-    sendStatus(channelId, 'typing')
-    await callMcpTool('post_message', { project_id: projectId, channel_id: channelId, content: report.content })
+    await postMessageOnce({ key: `completion:${report.key}`, projectId, channelId, content: report.content, sourceKey: memoryKey })
     reportedCompletions.add(report.key); trimSeen(reportedCompletions)
     pendingCompletionReports.delete(taskKey); persistReplay()
+    memory.remember({ key: memoryKey, kind: 'ticket', state: 'reported', summary: report.content, refs: { projectId, ticketId, channelId }, meta: { reportKey: report.key, prUrl: report.prUrl } })
     log('posted verified completion for ticket #' + ticketId + ' in channel ' + channelId)
     return true
   }
@@ -882,11 +936,9 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     let delivered = false
     if (Number.isFinite(channelId)) {
       try {
-        await callMcpTool('post_message', {
-          channel_id: channelId,
-          ...(parentMatch ? { parent_id: Number(parentMatch[1]) } : {}),
-          content: notice,
-        })
+        const parentId = parentMatch ? Number(parentMatch[1]) : null
+        const blockerKey = `blocker:${channelId}:${parentId ?? 'top'}:${normalizeRenderedMessageText(notice).slice(0, 180)}`
+        await postMessageOnce({ key: blockerKey, channelId, parentId, projectId, content: notice, sourceKey: Number.isFinite(ticketId) && Number.isFinite(projectId) ? `ticket:${projectId}:${ticketId}` : '' })
         delivered = true
       } catch (e) {
         log('failed to post blocker in channel ' + channelId + ': ' + (e?.message || e))
@@ -899,6 +951,13 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
 
     const key = `${projectId}:${ticketId}`
     if (pause) { blockedTasks.add(key); persistReplay() }
+    memory.remember({
+      key: `ticket:${projectId}:${ticketId}`,
+      kind: 'ticket',
+      state: pause ? 'authorization-blocked' : 'blocked',
+      summary: ticketNotice,
+      refs: { projectId, ticketId, ...(Number.isFinite(channelId) ? { channelId } : {}) },
+    })
     try {
       await callMcpTool('comment_ticket', { project_id: projectId, ticket_id: ticketId, text: ticketNotice })
       delivered = true
@@ -921,6 +980,18 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
   }
 
   const reportPolicyBlock = async (prompt, taskRef, block) => {
+    if (block?.kind === 'pr-push-authorization-required') {
+      const location = block.root ? ` from \`${block.root}\`` : ' from the repository'
+      const notice = `Action required: run \`openvisio-agent authorize-pr-push\`${location}. This is a one-time, repository-scoped opt-in. It permits only the constrained \`openvisio-agent push-pr-branch\` helper for the current \`agent/*\` branch, never main/master, force pushes, another remote, or merges. I've paused the ticket until it is enabled.`
+      const ticketNotice = `I'm paused before the PR push. Run \`openvisio-agent authorize-pr-push\`${location}; the watcher will resume this ticket after the repository-scoped helper is authorized.`
+      const projectId = Number(taskRef?.projectId)
+      const ticketId = Number(taskRef?.ticketId)
+      if (block.root && Number.isFinite(projectId) && Number.isFinite(ticketId)) {
+        blockedTaskRepos.set(`${projectId}:${ticketId}`, block.root)
+        persistReplay()
+      }
+      return publishBlocker({ prompt, taskRef, notice, ticketNotice, pause: true })
+    }
     const command = block?.command || 'the requested external repository action'
     const payload = [block?.commit && `commit ${block.commit}`, block?.branch && `branch ${block.branch}`, block?.remote && `remote ${block.remote}`].filter(Boolean).join(', ')
     const approval = block?.commit && block?.branch
@@ -962,12 +1033,13 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           if (taskAgentId !== Number(self.id) && taskIdent !== identifier) continue
           const taskKey = `${project.id}:${task.id}`
           if (taskIsCompleted(task, doneIds) || taskIsAwaitingReview(task, reviewIds)) {
+            memory.remember({ key: `ticket:${project.id}:${task.id}`, kind: 'ticket', state: 'handoff', summary: task.title, refs: { projectId: project.id, ticketId: task.id } })
             if (pendingCompletionReports.has(taskKey)) {
               const activityChannel = await projectStatusChannel(project.id)
               try { await announceTaskCompletion({ projectId: project.id, ticketId: task.id, channelId: activityChannel }) }
               catch (e) { log('completion report retry failed for ticket #' + task.id + ': ' + (e?.message || e)) }
             }
-            if (blockedTasks.delete(taskKey)) persistReplay()
+            if (blockedTasks.delete(taskKey)) { blockedTaskRepos.delete(taskKey); persistReplay() }
             // Release the in-flight de-dupe key at handoff. If a reviewer moves
             // the ticket back to an actionable column, that update must start a
             // fresh work cycle.
@@ -976,11 +1048,14 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           }
           if (blockedTasks.has(taskKey)) {
             const approvalText = [task.title, task.description].filter(Boolean).join(' ')
-            if (/\b(?:i\s+)?(?:explicitly\s+)?(?:approve|authorize)\b[\s\S]{0,240}\b(?:git\s+push|push(?:ing)?\s+(?:the\s+)?(?:branch|code)|github|remote)\b/i.test(approvalText)) {
-              blockedTasks.delete(taskKey); seenTasks.delete(taskKey); persistReplay()
-              log('backlog ticket #' + task.id + ' now contains explicit push authorization — resuming')
+            const blockedRepo = blockedTaskRepos.get(taskKey)
+            const helperAuthorized = blockedRepo && repositoryHasPrPushAuthorization({ cwd: blockedRepo })
+            if (helperAuthorized || /\b(?:i\s+)?(?:explicitly\s+)?(?:approve|authorize)\b[\s\S]{0,240}\b(?:git\s+push|push(?:ing)?\s+(?:the\s+)?(?:branch|code)|github|remote)\b/i.test(approvalText)) {
+              blockedTasks.delete(taskKey); blockedTaskRepos.delete(taskKey); seenTasks.delete(taskKey); persistReplay()
+              log('backlog ticket #' + task.id + (helperAuthorized ? ' has repository-scoped PR push authorization' : ' now contains explicit push authorization') + ' — resuming')
             } else continue
           }
+          memory.remember({ key: `ticket:${project.id}:${task.id}`, kind: 'ticket', state: 'assigned', summary: task.title, refs: { projectId: project.id, ticketId: task.id }, meta: { updatedAt: task.updated_at ?? task.updatedAt } })
           assigned.push({ id: task.id, projectId: project.id, project: project.name, title: task.title, priority: task.priority, typeId: task.type_id ?? task.typeId, updatedAt: task.updated_at ?? task.updatedAt })
         }
         const activities = Array.isArray(activityData.activities) ? activityData.activities : Array.isArray(activityData.activity) ? activityData.activity : []
@@ -999,7 +1074,13 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
             // The same logical mention may already have arrived over WebSocket.
             // Share the id/signature guard instead of starting a second model turn.
             if (markMentionHandled(activityMessage, activityChannelId)) continue
-            mentionActivity.push({ projectId: project.id, project: project.name, activity: item })
+            mentionActivity.push({
+              projectId: project.id,
+              project: project.name,
+              channelId: activityChannelId,
+              message: activityMessage,
+              activity: item,
+            })
           }
         }
       }
@@ -1022,18 +1103,28 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       const inboxSignature = JSON.stringify(mentionActivity.slice(-20)).slice(0, 4000)
       if (mentionActivity.length && inboxSignature !== lastInboxSignature) {
         lastInboxSignature = inboxSignature
-        log('backlog reconciliation found mention activity -> reply cycle')
-        void drain('fast', `Recent project activity contains these messages mentioning YOU: ${inboxSignature}. Handle each still-unanswered mention once using the channel/message ids in the activity. Do not call nonexistent poll_inbox or get_marching_orders tools. Skip anything already answered by you.`)
+        log('backlog reconciliation found ' + mentionActivity.length + ' mention(s) -> guarded reply cycle(s)')
+        // Replay each real message through the exact same delivery path as a live
+        // WebSocket mention. This preserves thread ids and lets postMessageOnce
+        // consult the rendered thread before any reply is emitted.
+        for (const mention of mentionActivity) {
+          onEvent('agent:mention', {
+            project_id: mention.projectId,
+            channel_id: mention.channelId,
+            message: mention.message,
+            _mentionAlreadyMarked: true,
+          })
+        }
       } else if (!mentionActivity.length) lastInboxSignature = ''
     } catch (e) {
-      mcpSessionId = ''
+      mcpClient.reset()
       log('backlog reconciliation failed: ' + (e && e.message ? e.message : e))
     } finally { backlogProbeBusy = false }
   }
 
   // Higher rank wins when coalescing cycles requested while one is running.
   const RANK = { fast: 0, intro: 1, coord: 2, sweep: 2, full: 3 }
-  const baseFor = (kind) => kind === 'intro' ? INTRO : kind === 'full' ? fullPrompt : (kind === 'coord' || kind === 'sweep') ? COORDINATE : fastPrompt
+  const baseFor = (kind) => kind === 'intro' ? INTRO : kind === 'full' ? fullPrompt : (kind === 'coord' || kind === 'sweep') ? coordinatePrompt : fastPrompt
   // Codex and OpenCode expose structured action streams. Require runtime facts
   // from those streams before accepting a full coding cycle. Claude's evidence
   // shape is different and remains on its existing completion path.
@@ -1074,9 +1165,16 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     lastTaskSignature = ''
   }
 
-  async function drain(kind, context, targetChannels = [], taskRef = null) {
+  async function drain(kind, context, targetChannels = [], taskRef = null, delivery = null) {
     const laneName = kind === 'full' ? 'work' : 'reply'
     const lane = lanes[laneName]
+    // A guarded reply is never coalesced with another event. It carries one
+    // source message and one delivery key, so queue it as an independent cycle.
+    if (lane.busy && delivery) {
+      lane.deferred.push({ kind, context, targetChannels, taskRef, delivery })
+      log(laneName + ' lane busy — queued one guarded ' + kind + ' cycle')
+      return
+    }
     if (context) lane.pending.push(context)
     if (taskRef) lane.taskRefs.push(taskRef)
     for (const channelId of targetChannels) if (Number.isFinite(Number(channelId))) lane.targets.add(Number(channelId))
@@ -1089,7 +1187,11 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     laneStatusTargets[laneName] = new Set(targets)
     // credNote + charter live in the cached system prompt now — the per-cycle
     // message is just the event context + the small base instruction.
-    const prompt = (ctx.length ? ctx.join('\n') + '\n\n' : '') + baseFor(kind)
+    const memoryRefs = delivery
+      ? { channelId: delivery.channelId, threadId: delivery.parentId }
+      : activeTaskRef ? { projectId: activeTaskRef.projectId, ticketId: activeTaskRef.ticketId } : {}
+    const recalled = memory.context(memoryRefs)
+    const prompt = (ctx.length ? ctx.join('\n') + '\n\n' : '') + (recalled ? recalled + '\n\n' : '') + baseFor(kind)
     // Chat-shaped cycles (mentions/intro) may run on the cheaper chat model; code
     // work (full/sweep) uses the main model.
     const useModel = agent === 'codex' ? codeModel : kind === 'full' ? codeModel : liteModel
@@ -1101,7 +1203,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     // 20 seconds so long coding runs do not create needless network/battery load.
     const heartbeat = targets.length ? setInterval(() => emitLaneStatus(laneName, 'working'), 20_000) : null
     try {
-      const result = await runners[laneName].runCycle(prompt, useModel)
+      const result = await runners[laneName].runCycle(prompt, useModel, agent === 'codex' && delivery ? { disabledMcpTools: ['post_message'] } : {})
       let completionResult = result
       if (agent === 'codex' && result?.subtype === 'blocked' && result?.policyBlock) {
         log('WORK_CYCLE_BLOCKED authorization required; pausing this ticket and publishing an action-required notice')
@@ -1130,7 +1232,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       const missing = missingWorkEvidence(result, ticketCycle)
       if (evidenceGatedRuntime && kind === 'full' && result?.subtype === 'ok' && missing.length) {
         log(agent + ' coding cycle incomplete; recovery requires: ' + missing.join(', '))
-        const recovery = await runners.work.runCycle(`The assigned task is NOT complete. Missing runtime evidence: ${missing.join('; ')}. Do not post an acknowledgement or claim success. Resume now. Use get_ticket/list_tasks and list_task_types, perform and verify the repository work, commit and push an agent/* branch, open the PR, and call update_ticket with the correct board column. Post only when the original context supplies a source thread.`, codeModel)
+        const recovery = await runners.work.runCycle(`The assigned task is NOT complete. Missing runtime evidence: ${missing.join('; ')}. Do not post an acknowledgement or claim success. Resume now. Use get_ticket/list_tasks and list_task_types, perform and verify the repository work, publish an agent/* branch, open the PR, and call update_ticket with the correct board column. ${agent === 'codex' ? 'Prefer the available OpenVisio create_codebase_branch/create_codebase_commit/create_pull_request tools. Only when that linked-codebase flow is unavailable, run openvisio-agent push-pr-branch; never retry a rejected direct git push.' : ''} Post only when the original context supplies a source thread.`, codeModel, agent === 'codex' && delivery ? { disabledMcpTools: ['post_message'] } : {})
         const recoveredResult = combineWorkEvidence(result, recovery)
         const recoveryMissing = missingWorkEvidence(recoveredResult, ticketCycle)
         if (recovery?.subtype !== 'ok' || recoveryMissing.length) {
@@ -1161,11 +1263,22 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           log('completion report failed for ticket #' + activeTaskRef.ticketId + ': ' + (e?.message || e) + '; retained for reconnect retry')
         }
       }
+      if (agent === 'codex' && delivery) {
+        const reply = String(completionResult?.outputText || '').trim()
+        if (!reply) {
+          log('guarded reply produced no final text; leaving delivery unrecorded for retry')
+        } else {
+          try { await postMessageOnce({ ...delivery, content: reply }) }
+          catch (e) { log('guarded reply delivery failed closed: ' + (e?.message || e)) }
+        }
+      }
     } finally {
       if (heartbeat) clearInterval(heartbeat)
       laneStatusTargets[laneName].clear()
       lane.busy = false
-      if (lane.queued || lane.pending.length) { const next = lane.queued || (laneName === 'work' ? 'full' : 'fast'); lane.queued = null; void drain(next) }
+      const deferred = lane.deferred.shift()
+      if (deferred) void drain(deferred.kind, deferred.context, deferred.targetChannels, deferred.taskRef, deferred.delivery)
+      else if (lane.queued || lane.pending.length) { const next = lane.queued || (laneName === 'work' ? 'full' : 'fast'); lane.queued = null; void drain(next) }
     }
   }
 
@@ -1229,22 +1342,28 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       const assignedIdentifier = String(ticket.agent?.identifier ?? ticket.assigned_agent?.identifier ?? '')
       const belongsToSelf = (selfAgentId != null && assignedId === selfAgentId) || assignedIdentifier === identifier
       const key = `${projectId}:${ticketId}`
-      if (!belongsToSelf) { blockedTasks.delete(key); pendingCompletionReports.delete(key); persistReplay(); seenTasks.delete(key); log(kind + ' ticket #' + ticketId + ' is not assigned to this agent — ignored'); return }
+      if (!belongsToSelf) {
+        memory.remember({ key: `ticket:${projectId}:${ticketId}`, kind: 'ticket', state: 'unassigned', summary: ticket.title, refs: { projectId, ticketId } })
+        blockedTasks.delete(key); blockedTaskRepos.delete(key); pendingCompletionReports.delete(key); persistReplay(); seenTasks.delete(key); log(kind + ' ticket #' + ticketId + ' is not assigned to this agent — ignored'); return
+      }
       if (taskIsCompleted(ticket) || taskIsAwaitingReview(ticket)) {
+        memory.remember({ key: `ticket:${projectId}:${ticketId}`, kind: 'ticket', state: 'handoff', summary: ticket.title, refs: { projectId, ticketId } })
         if (pendingCompletionReports.has(key)) {
           const activityChannel = await projectStatusChannel(projectId)
           try { await announceTaskCompletion({ projectId, ticketId, channelId: activityChannel }) }
           catch (e) { log('completion report failed for ticket #' + ticketId + ': ' + (e?.message || e) + '; retained for reconnect retry') }
         }
-        blockedTasks.delete(key); persistReplay(); seenTasks.delete(key)
+        blockedTasks.delete(key); blockedTaskRepos.delete(key); persistReplay(); seenTasks.delete(key)
         log(kind + ' ticket #' + ticketId + ' is already complete or awaiting review — ignored')
         return
       }
       if (blockedTasks.has(key)) {
         const approvalText = [ticket.title, ticket.description].filter(Boolean).join(' ')
-        if (/\b(?:i\s+)?(?:explicitly\s+)?(?:approve|authorize)\b[\s\S]{0,240}\b(?:git\s+push|push(?:ing)?\s+(?:the\s+)?(?:branch|code)|github|remote)\b/i.test(approvalText)) {
-          blockedTasks.delete(key); seenTasks.delete(key); persistReplay()
-          log(kind + ' ticket #' + ticketId + ' contains explicit push authorization — resuming')
+        const blockedRepo = blockedTaskRepos.get(key)
+        const helperAuthorized = blockedRepo && repositoryHasPrPushAuthorization({ cwd: blockedRepo })
+        if (helperAuthorized || /\b(?:i\s+)?(?:explicitly\s+)?(?:approve|authorize)\b[\s\S]{0,240}\b(?:git\s+push|push(?:ing)?\s+(?:the\s+)?(?:branch|code)|github|remote)\b/i.test(approvalText)) {
+          blockedTasks.delete(key); blockedTaskRepos.delete(key); seenTasks.delete(key); persistReplay()
+          log(kind + ' ticket #' + ticketId + (helperAuthorized ? ' has repository-scoped PR push authorization' : ' contains explicit push authorization') + ' — resuming')
         } else {
           log(kind + ' ticket #' + ticketId + ' is paused for explicit repository push authorization — ignored')
           return
@@ -1253,6 +1372,7 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       if (seenTasks.has(key)) { log(kind + ' ticket #' + ticketId + ' already queued/active — ignored'); return }
       seenTasks.add(key); trimSeen(seenTasks)
       const title = String(ticket.title || hinted.title || '')
+      memory.remember({ key: `ticket:${projectId}:${ticketId}`, kind: 'ticket', state: 'queued', summary: title, refs: { projectId, ticketId }, meta: { sourceEvent: kind } })
       const taskText = [title, ticket.description, ticket.type, ticket.kind].filter(Boolean).join(' ')
       const cycleKind = canCode && !coordinationOnly(taskText) ? 'full' : 'coord'
       log(kind + ' verified ticket #' + ticketId + ' “' + title + '” -> ' + cycleKind + ' lane')
@@ -1282,20 +1402,28 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       // De-dupe: the same mention re-delivered (reconnect replay / dup fan-out) must
       // NOT trigger a second reply. Key by message id, or a channel+text signature
       // when the payload carries no id.
-      if (markMentionHandled(msg, cid)) { log('agent:mention (dup) — skipped'); return }
+      if (!raw._mentionAlreadyMarked && markMentionHandled(msg, cid)) { log('agent:mention (dup) — skipped'); return }
       if (requestTargetsLaterAgent(text, [slug, identifier])) {
         log('agent:mention addressed to a later-mentioned agent — skipped')
         return
       }
+      const mentionKeys = mentionDedupeKeys(msg, cid)
+      const sourceKey = `mention:${cid ?? '?'}:${mentionKeys.idKey || mentionKeys.signatureKey || threadRoot || Date.now()}`
+      memory.remember({ key: sourceKey, kind: 'mention', state: 'received', summary: text, refs: { channelId: cid, threadId: threadRoot, messageId: mid } })
+      const guardedDelivery = (stage = 'reply', skipIfAnyAgentReply = stage !== 'result') => agent === 'codex' && cid != null
+        ? { key: `reply:${sourceKey}:${stage}`, channelId: Number(cid), parentId: threadRoot, skipIfAnyAgentReply, sourceKey }
+        : null
       // Under-the-hood model control from chat (view / switch the model the agent runs).
       const mcmd = cid != null ? parseModelCmd(text) : null
       if (mcmd) {
         const thread = threadRoot != null ? `, parent_id ${threadRoot}` : ''
         if (mcmd.report) {
           log('model query → code ' + codeModel + ' / chat ' + liteModel)
-          void drain('fast', `An engineer asked which model you're running. Reply once in channel ${cid}${thread} (with your agent creds): "I'm on ${codeModel} for code work${liteModel !== codeModel ? ` and ${liteModel} for chat replies` : ' (and chat)'}." One line. Then stop.`)
+          const delivery = guardedDelivery('model')
+          void drain('fast', `An engineer asked which model you're running. ${delivery ? `Return exactly this one-line final answer without calling post_message: "I'm on ${codeModel} for code work${liteModel !== codeModel ? ` and ${liteModel} for chat replies` : ' (and chat)'}.” The watcher will verify and deliver it once.` : `Reply once in channel ${cid}${thread} (with your agent creds): "I'm on ${codeModel} for code work${liteModel !== codeModel ? ` and ${liteModel} for chat replies` : ' (and chat)'}.” One line. Then stop.`}`, [cid], null, delivery)
         } else if (mcmd.invalid) {
-          void drain('fast', `An engineer tried to switch your model to "${mcmd.invalid}", which isn't one you recognize. Reply once in channel ${cid}${thread} (with your agent creds): say you support "opus", "sonnet", "haiku", or a full "claude-…" id, and ask which they meant. One line. Then stop.`)
+          const delivery = guardedDelivery('model')
+          void drain('fast', `An engineer tried to switch your model to "${mcmd.invalid}", which isn't one you recognize. ${delivery ? 'Return one short final answer saying you support "opus", "sonnet", "haiku", or a full model id and asking which they meant. Do not call post_message; the watcher will verify and deliver it once.' : `Reply once in channel ${cid}${thread} (with your agent creds): say you support "opus", "sonnet", "haiku", or a full "claude-…" id, and ask which they meant. One line. Then stop.`}`, [cid], null, delivery)
         } else {
           const tgt = mcmd.target // 'chat' | 'code' | 'both'
           const prev = `code ${codeModel}/chat ${liteModel}`
@@ -1305,7 +1433,8 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
           persistModel()
           const label = tgt === 'chat' ? 'chat model' : tgt === 'code' ? 'code model' : 'model'
           log('model switched (' + tgt + ') ' + prev + ' → code ' + codeModel + '/chat ' + liteModel + (who ? ' (by ' + who + ')' : ''))
-          void drain('fast', `An engineer switched your ${label} to "${mcmd.set}" — active for your next ${tgt === 'chat' ? 'chat replies' : tgt === 'code' ? 'code cycles' : 'actions'}. Post ONE short confirmation in channel ${cid}${thread} (with your agent creds): e.g. "Switched my ${label} to ${mcmd.set} — I'll use it from here." Then stop.`)
+          const delivery = guardedDelivery('model')
+          void drain('fast', `An engineer switched your ${label} to "${mcmd.set}" — active for your next ${tgt === 'chat' ? 'chat replies' : tgt === 'code' ? 'code cycles' : 'actions'}. ${delivery ? `Return one short final confirmation such as "Switched my ${label} to ${mcmd.set}. I'll use it from here." Do not call post_message; the watcher will verify and deliver it once.` : `Post ONE short confirmation in channel ${cid}${thread} (with your agent creds): e.g. "Switched my ${label} to ${mcmd.set} — I'll use it from here." Then stop.`}`, [cid], null, delivery)
         }
         return
       }
@@ -1314,16 +1443,24 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
       // subsequent working/typing heartbeat for its lane.
       if (cid != null) sendStatus(cid, 'thinking')
       const codingMention = canCode && needsCode(text)
+      const replyDelivery = guardedDelivery(codingMention ? 'result' : 'reply', !codingMention)
       const ctx = cid != null
-        ? `You were @mentioned in OpenVisio channel ${cid}${who ? ` by "${who}"` : ''}: "${text}". This mention is FOR YOU. ${codingMention ? 'This is repository work: complete the coding flow first, then send' : 'Send'} EXACTLY ONE reply with post_message: arguments: channel_id ${cid}${threadRoot != null ? `, parent_id ${threadRoot} (reply IN THAT THREAD, do not start a new top-level message)` : ''}, plus agent_identifier + agent_api_key from the AUTH line above, and a 1-3 sentence reply. Compose the whole answer, then post it ONCE. Do not post a first reply and then a revised version. FIRST read the recent messages in this thread: if you already answered this, or another agent was the one addressed, do NOT post at all. Be sure of your answer before sending.${who ? ` To @mention them back, write their EXACT full name "@${who}". A mention only links when the name matches exactly.` : ''} You ALREADY have the message here. Do not poll_inbox, and after your single reply, STOP.`
+        ? replyDelivery
+          ? `You were @mentioned in OpenVisio channel ${cid}${who ? ` by "${who}"` : ''}: "${text}". This mention is FOR YOU. ${codingMention ? 'Complete the repository work and verification first.' : 'Answer the request.'} Do NOT call post_message; it is intentionally unavailable. Return only the final 1-3 sentence reply as your final answer. The watcher will read the real thread, check its persistent memory graph, and render that answer at most once.${who ? ` To mention the requester, use their exact full name "@${who}".` : ''} The complete message is already here; do not call get_resource, get_marching_orders, or poll_inbox.`
+          : `You were @mentioned in OpenVisio channel ${cid}${who ? ` by "${who}"` : ''}: "${text}". This mention is FOR YOU. ${codingMention ? 'This is repository work: complete the coding flow first, then send' : 'Send'} EXACTLY ONE reply with post_message: arguments: channel_id ${cid}${threadRoot != null ? `, parent_id ${threadRoot} (reply IN THAT THREAD, do not start a new top-level message)` : ''}, plus agent_identifier + agent_api_key from the AUTH line above, and a 1-3 sentence reply. Compose the whole answer, then post it ONCE. Do not post a first reply and then a revised version. FIRST read the recent messages in this thread: if you already answered this, or another agent was the one addressed, do NOT post at all. Be sure of your answer before sending.${who ? ` To @mention them back, write their EXACT full name "@${who}". A mention only links when the name matches exactly.` : ''} The complete message is already here. Do not call get_resource, get_marching_orders, or poll_inbox, and after your single reply, STOP.`
         : undefined
       if (codingMention) {
-        const ack = cid != null
-          ? `You were asked for repository work in channel ${cid}${threadRoot != null ? `, thread ${threadRoot}` : ''}. The dedicated work lane has accepted it. Post exactly one short reply with post_message in that same thread saying you have picked it up and will return there with the verified result. Include agent_identifier + agent_api_key. Do not inspect or edit code in this reply lane.`
-          : undefined
-        void drain('coord', ack, cid == null ? [] : [cid])
-        void drain('full', ctx, cid == null ? [] : [cid])
-      } else void drain('fast', ctx, cid == null ? [] : [cid])
+        if (agent === 'codex' && cid != null) {
+          const ack = `${who ? `@${who} ` : ''}I've picked this up and will return here with the verified result.`
+          void postMessageOnce({ ...guardedDelivery('ack'), content: ack }).catch((e) => log('guarded acknowledgement failed closed: ' + (e?.message || e)))
+        } else {
+          const ack = cid != null
+            ? `You were asked for repository work in channel ${cid}${threadRoot != null ? `, thread ${threadRoot}` : ''}. The dedicated work lane has accepted it. Post exactly one short reply with post_message in that same thread saying you have picked it up and will return there with the verified result. Include agent_identifier + agent_api_key. Do not inspect or edit code in this reply lane.`
+            : undefined
+          void drain('coord', ack, cid == null ? [] : [cid])
+        }
+        void drain('full', ctx, cid == null ? [] : [cid], null, replyDelivery)
+      } else void drain('fast', ctx, cid == null ? [] : [cid], null, replyDelivery)
     } else if (k === 'error') {
       const detail = raw && (raw.message || raw.error || raw.reason || raw.code || raw.d?.message || raw.d?.error)
       log('error event: ' + (detail ? String(detail) : JSON.stringify(raw)).slice(0, 220))
@@ -1345,9 +1482,13 @@ function loopBackendWs({ backend, wsUrl, apiKey, identifier, slug, claude, agent
     // Workspace ethics: a one-time hello the FIRST time this agent ever connects.
     const introMarker = join(OV_DIR, 'intro-' + slugify(identifier) + '.done')
     if (!existsSync(introMarker)) {
-      try { mkdirSync(OV_DIR, { recursive: true }); writeFileSync(introMarker, new Date().toISOString() + '\n') } catch { /* best-effort */ }
       log('first connection — introducing self to the workspace')
-      introTimer = setTimeout(() => void drain('intro'), 5000) // let the socket subscribe first
+      introTimer = setTimeout(() => {
+        void announceIntroduction().then((delivered) => {
+          if (!delivered) return
+          try { mkdirSync(OV_DIR, { recursive: true }); writeFileSync(introMarker, new Date().toISOString() + '\n') } catch { /* best-effort */ }
+        }).catch((e) => log('guarded introduction failed: ' + (e?.message || e)))
+      }, 5000) // let the socket subscribe first
     }
     // Reconciliation replaces the old model-driven startup/daily sweep. It uses
     // supported MCP tools directly, stays silent when empty, and hands verified