trantor 0.17.59 → 0.17.61

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "trantor",
       "source": "./",
       "description": "The hub-world for AI agent crews. Say \"fire up the crew\" and Claude becomes the architect: a plan-aware Advisor routes the work (solo / cheap inline calls / live crew of Codex, GLM, Kimi & DeepSeek in their own terminal windows), a Kanban/flow command center with a testing gate tracks it, and an economics brain (Scrooge) keeps the receipts. Includes the relay MCP, a SessionStart auto-discovery hook, and a PreCompact context-handoff so a fresh session can take over a full window instead of compacting.",
-      "version": "0.17.59",
+      "version": "0.17.60",
       "author": {
         "name": "Sasha Bogojevic"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.59",
+  "version": "0.17.61",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -25,6 +25,7 @@ switch (cmd) {
   case "up":      process.argv.splice(2, 1); spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "up", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "down":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "down", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "swap":    spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "swap", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
+  case "prune":   spawn("/bin/bash", [join(ROOT, "bin/crew.sh"), "prune", ...args], { stdio: "inherit", cwd: process.cwd() }).on("exit", c => process.exit(c ?? 0)); break;
   case "hub": {
     const sub = args[0];
     // Per-project hub routing (TDD §12.1): a project lives on exactly ONE hub; codependent
@@ -70,6 +71,7 @@ switch (cmd) {
   case "summarize": run("bin/summarize.mjs"); break;
   case "policy": run("bin/policy.mjs"); break;
   case "inbox": run("bin/inbox.mjs"); break;
+  case "duty": run("bin/duty.mjs"); break;
   case "identity": {
     const { load, publicView, generate, keyPath } = await import(join(ROOT, "lib/identity.mjs"));
     const sub = args[0], name = args[1] || "human";
@@ -166,6 +168,7 @@ switch (cmd) {
   trantor watch       live bus feed in the terminal
   trantor inbox       THIS session's unread bus messages, signed (works under enforce) — [--all] [--consume] [--json]
   trantor policy      the autonomy ladder: show | set <project> <1-4> | link <a> <b> --reason "<why>"
+  trantor duty        the always-on fleet duty agent: up | down | status — hub-escalated triage so you are not the switchboard
 
 Claude Code plugin (the orchestrator side):
   claude plugin marketplace add sashabogi/trantor && claude plugin install trantor

package/bin/crew-runner.mjs

@@ -136,7 +136,9 @@ const cli = CLI[AGENT] || (NATIVE.has(AGENT) ? null : CLI.opencode);
 if (!cli) { console.error(`unknown agent '${AGENT}' (native: ${[...NATIVE].join(", ")}; any other name = an opencode provider seat)`); process.exit(1); }
 if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an opencode provider (BYOM)`);
 
-const RULES = `Rules: you are ${SESSION} on the trantor crew. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go (doing -> testing -> done; run the tests in 'testing', use 'failed' + a report if they break). When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
+// RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
+// always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go (doing -> testing -> done; run the tests in 'testing', use 'failed' + a report if they break). When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
 
 // ---- failure visibility ----------------------------------------------------
 // A turn's CLI can fail (credits exhausted, auth, crash) and the runner would just

package/bin/crew.sh

@@ -125,6 +125,36 @@ end tell
 OSA
 }
 
+# surgical STATE row removal: drop every row matching PROJECT+KIND (+AGENT/+HANDLE when given).
+# Empty $3/$4 = wildcard. Callers beware: uses _parse_row, which clobbers the RP/RK/RA/RH globals.
+_state_drop() {   # $1=project $2=kind $3=agent(''=any) $4=handle(''=any)
+  [ "$DRY" = "1" ] && return 0
+  [ -f "$STATE" ] || return 0
+  local tmp="$STATE.tmp" line
+  : > "$tmp"
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    _parse_row "$line"
+    if [ "$RP" = "$1" ] && [ "$RK" = "$2" ] && { [ -z "$3" ] || [ "$RA" = "$3" ]; } && { [ -z "$4" ] || [ "$RH" = "$4" ]; }; then continue; fi
+    printf '%s\t%s\t%s\t%s\n' "$RP" "$RK" "$RA" "$RH" >> "$tmp"
+  done < "$STATE"
+  mv "$tmp" "$STATE"; [ -s "$STATE" ] || rm -f "$STATE"
+}
+
+# Belt-and-suspenders on seat teardown: closing the pane/window SHOULD take the runner with it, but a
+# STALE handle (the 2026-07-30 duplicate-row incident) closes nothing while teardown thinks it's done —
+# the runner survives invisible, still long-polling the inbox. So teardown also kills the seat's
+# processes directly: the per-seat launcher shell, and the runner via the same ANCHORED pattern
+# doctrine as reap_seat (…/<project>$ — a sibling project can never match). CREW_NO_PROC_KILL=1 is the
+# test-suite escape hatch: the suite seeds real project names, and a live crew must survive `npm test`.
+_kill_seat_procs() {   # $1=project $2=agent
+  [ "${CREW_NO_PROC_KILL:-0}" = "1" ] && return 0
+  [ -n "$1" ] && [ -n "$2" ] || return 0
+  local pid
+  for pid in $(pgrep -f "seats/$1-$2\.sh" 2>/dev/null); do run "kill -9 $pid 2>/dev/null"; done
+  for pid in $(pgrep -f "crew-runner\.mjs $2 .*/$1"'$' 2>/dev/null); do run "kill -9 $pid 2>/dev/null"; done
+}
+
 # ── down: PROJECT-SCOPED teardown (never touches another project's crew) ─────────────────────────────
 usage_down() {
   cat <<EOF
@@ -187,6 +217,7 @@ down() {
         fi ;;
       win|attach) { [ "${#AGENTS[@]}" -gt 0 ] && [ "$K2" = "attach" ]; } && continue; _kill_win "$H2" ;;
     esac
+    case "$K2" in cmuxws|attach) : ;; *) _kill_seat_procs "$P2" "$A2" ;; esac
   done
 
   # rewrite STATE minus the rows we tore down (leaves OTHER projects' rows intact)
@@ -205,13 +236,26 @@ down() {
   echo "— crew torn down ($SCOPE_DESC)"
 }
 [ "$CMD" = "down" ] && { down "$@"; exit $?; }
-case "$CMD" in up|swap) ;; *) echo "usage: crew.sh up <agent...> | crew.sh swap <old> <new[:provider[/model]]> | crew.sh down [<agent>...] [--all --yes]"; exit 1 ;; esac
+case "$CMD" in up|swap|prune) ;; *) echo "usage: crew.sh up <agent...> | crew.sh swap <old> <new[:provider[/model]]> | crew.sh down [<agent>...] [--all --yes] | crew.sh prune"; exit 1 ;; esac
 
 # self-heal: drop STATE rows whose Terminal window is already gone (dead crews from past sessions), so the
-# file doesn't accumulate ghosts across ups. tmux rows are validated by their session existing.
+# file doesn't accumulate ghosts across ups. tmux rows are validated by their session existing; cmux rows
+# by the workspace/surface uuid still existing on the control socket. Socket off (or an empty/unparsable
+# workspace list) ⇒ cmux rows are KEPT — we can't prove death, and they self-heal next time it answers.
 prune_dead_state() {
   [ -f "$STATE" ] || return 0
   [ "$DRY" = "1" ] && return 0
+  local CLIVE=""
+  if _cmux_ok; then
+    local wids wid
+    wids="$(_cmux workspace list --id-format both --json 2>/dev/null | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));const a=Array.isArray(o)?o:(o.workspaces||[]);console.log(a.map(x=>x.id).filter(Boolean).join(" "))}catch(e){}})')"
+    if [ -n "$wids" ]; then
+      CLIVE="$wids"
+      for wid in $wids; do
+        CLIVE="$CLIVE $(_cmux list-pane-surfaces --workspace "$wid" --id-format uuids --json 2>/dev/null | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));const a=o.surfaces||o.panes||o;console.log((Array.isArray(a)?a:[]).map(s=>s.id||s.surface_id).filter(Boolean).join(" "))}catch(e){}})')"
+      done
+    fi
+  fi
   local tmp="$STATE.tmp" line alive
   : > "$tmp"
   while IFS= read -r line; do
@@ -222,11 +266,15 @@ prune_dead_state() {
       [ -n "$(osascript -e "tell application \"Terminal\" to get id of (first window whose id is $RH)" 2>/dev/null)" ] || alive=0
     elif [ "$RK" = "tmux" ]; then
       tmux has-session -t "trantor:$RP" 2>/dev/null || alive=0
+    elif [ "$RK" = "cmuxws" ] || [ "$RK" = "cmux" ]; then
+      if [ -n "$CLIVE" ]; then case " $CLIVE " in *" $RH "*) : ;; *) alive=0 ;; esac; fi
     fi
     [ "$alive" = "1" ] && printf '%s\t%s\t%s\t%s\n' "$RP" "$RK" "$RA" "$RH" >> "$tmp"
   done < "$STATE"
   mv "$tmp" "$STATE"; [ -s "$STATE" ] || rm -f "$STATE"
 }
+# `crew.sh prune` — run the self-heal on demand (ops: clean ghost rows without spawning anything).
+[ "$CMD" = "prune" ] && { prune_dead_state; echo "— pruned dead crew rows ($STATE) —"; exit 0; }
 
 # --task/--difficulty drive LAZY live-model selection for provider-only specs (agent:provider).
 TASK="code"; DIFF="medium"; _ARGS=()
@@ -395,17 +443,86 @@ spawn_cmux() {   # $@ = specs
     echo "  ~/.config/cmux/cmux.json (cmux auto-reloads). —"
     spawn_cmux_applescript "$@"; return
   fi
+  # ── replace, never stack (workspace edition, 2026-08-07) ──────────────────────────────────────────
+  # Every `up` used to create a brand-new workspace — no awareness of a crew already on screen — so
+  # repeated ups (and the bus-verify RETRY path, which re-enters spawn_crew) stacked dead
+  # trantor:<proj> tabs in the sidebar. Observed six deep on crebral-health. Now the NEWEST tracked
+  # workspace for this project is REUSED: each spec becomes a fresh pane inside it, replacing any old
+  # pane for the same agent; older stacked workspaces are closed. Rows are read even in DRY mode
+  # (read-only) so tests can seed a board.
+  local REUSE_WS="" line w
+  local stale_ws=()
+  if [ -f "$STATE" ]; then
+    while IFS= read -r line; do
+      [ -n "$line" ] || continue
+      _parse_row "$line"
+      { [ "$RP" = "$PROJ" ] && [ "$RK" = "cmuxws" ]; } || continue
+      [ -n "$REUSE_WS" ] && stale_ws+=("$REUSE_WS")
+      REUSE_WS="$RH"
+    done < "$STATE"
+  fi
+  if [ "${#stale_ws[@]}" -gt 0 ]; then
+    for w in "${stale_ws[@]}"; do
+      echo "  → closing stale stacked crew workspace for $PROJ ($w)"
+      _cmux_close_tab "$w"; _state_drop "$PROJ" "cmuxws" "" "$w"
+    done
+    prune_dead_state    # the closed workspaces' seat rows just died with them
+  fi
+  # Untracked strays: LIVE workspaces named trantor:<proj> that STATE doesn't know (rows lost, or a
+  # pre-fix pileup). Adopt one as the reuse target if we have none; close the rest.
+  if [ "$DRY" != "1" ]; then
+    local named nid
+    named="$(_cmux workspace list --id-format both --json 2>/dev/null | WSNAME="trantor:$PROJ" node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{try{const o=JSON.parse(d.slice(d.search(/[\[{]/)));const a=Array.isArray(o)?o:(o.workspaces||[]);console.log(a.filter(x=>x.custom_title===process.env.WSNAME||x.name===process.env.WSNAME).map(x=>x.id).filter(Boolean).join(" "))}catch(e){}})')"
+    for nid in $named; do
+      [ "$nid" = "$REUSE_WS" ] && continue
+      [ -f "$STATE" ] && grep -qF "$nid" "$STATE" && continue     # tracked → handled above
+      if [ -z "$REUSE_WS" ]; then
+        echo "  → adopting existing untracked crew workspace for $PROJ ($nid)"
+        REUSE_WS="$nid"; record_state "$PROJ" "cmuxws" "__ws__" "$nid"
+      else
+        echo "  → closing stray crew workspace for $PROJ ($nid)"
+        _cmux_close_tab "$nid"
+      fi
+    done
+  fi
   # Grid tiling: COLS = ceil(sqrt(N)) → 2 seats side-by-side, 4 = 2×2, 6 = 3×2. Row 0 is built with
   # RIGHT splits off the previous column; each later row splits DOWN from the pane directly above it.
   # Every split TARGETS a recorded surface id (--surface) — never "whatever pane happens to be focused",
-  # which is what produced the old staircase layout.
+  # which is what produced the old staircase layout. (In REUSE mode a replaced seat splits off its OWN
+  # old pane — keeping its spot — and added seats split right off the previous new pane; the fresh-grid
+  # math only applies to a fresh workspace.)
   local N=$# COLS=1; while [ $(( COLS * COLS )) -lt "$N" ]; do COLS=$(( COLS + 1 )); done
   local SPEC wsid="" surf="" i=0
   local surfs=()
+  [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
   for SPEC in "$@"; do
     resolve_spec "$SPEC"
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
-    if [ "$i" = "0" ]; then
+    if [ -n "$REUSE_WS" ]; then
+      # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
+      # then close the old pane — split-first so the workspace can never hit zero surfaces mid-swap.
+      local OLD_SURF=""
+      if [ -f "$STATE" ]; then
+        while IFS= read -r line; do
+          [ -n "$line" ] || continue
+          _parse_row "$line"
+          [ "$RP" = "$PROJ" ] && [ "$RK" = "cmux" ] && [ "$RA" = "$AGENT" ] && OLD_SURF="$RH"
+        done < "$STATE"
+      fi
+      if [ "$DRY" = "1" ]; then
+        echo "[dry] cmux: reuse workspace $wsid — new-split for $AGENT${OLD_SURF:+ (replacing $OLD_SURF)}"
+        surf="%DRYT$i"
+        [ -n "$OLD_SURF" ] && _cmux_close_term "$OLD_SURF"
+      else
+        local tflag=()
+        if [ -n "$OLD_SURF" ]; then tflag=(--surface "$OLD_SURF")
+        elif [ "$i" -gt 0 ] && [ -n "${surfs[$(( i - 1 ))]}" ]; then tflag=(--surface "${surfs[$(( i - 1 ))]}"); fi
+        surf="$(_cmux new-split right --workspace "$wsid" ${tflag[@]+"${tflag[@]}"} --id-format uuids --json 2>/dev/null | _cmux_surf_json)"
+        [ -n "$surf" ] || surf="$(_cmux new-split right --workspace "$wsid" --id-format uuids --json 2>/dev/null | _cmux_surf_json)"
+        [ -n "$surf" ] && { _cmux send --surface "$surf" "bash $launcher" >/dev/null 2>&1; _cmux send-key --surface "$surf" enter >/dev/null 2>&1; }
+        if [ -n "$OLD_SURF" ]; then _cmux_close_term "$OLD_SURF"; _state_drop "$PROJ" "cmux" "$AGENT" ""; fi
+      fi
+    elif [ "$i" = "0" ]; then
       if [ "$DRY" = "1" ]; then
         echo "[dry] cmux: new-workspace (cwd $DIR) --command 'bash $launcher' → rename 'trantor:$PROJ'"
         wsid="%DRYWS"; surf="%DRYT0"
@@ -444,10 +561,54 @@ spawn_cmux_applescript() {   # $@ = specs
   local N=$# COLS=1; while [ $(( COLS * COLS )) -lt "$N" ]; do COLS=$(( COLS + 1 )); done
   local SPEC tabid="" termid="" i=0
   local terms=()
+  # replace, never stack — AppleScript edition. No socket ⇒ no liveness list, so the newest tracked
+  # tab is validated by asking cmux for it directly; a dead tracked tab is dropped, older stacked
+  # tabs are closed. Reuse then rides the normal split path (i>0) from the first seat.
+  local line t REUSE_TAB=""
+  local stale_tabs=()
+  if [ -f "$STATE" ]; then
+    while IFS= read -r line; do
+      [ -n "$line" ] || continue
+      _parse_row "$line"
+      { [ "$RP" = "$PROJ" ] && [ "$RK" = "cmuxws" ]; } || continue
+      [ -n "$REUSE_TAB" ] && stale_tabs+=("$REUSE_TAB")
+      REUSE_TAB="$RH"
+    done < "$STATE"
+  fi
+  if [ "${#stale_tabs[@]}" -gt 0 ]; then
+    for t in "${stale_tabs[@]}"; do
+      echo "  → closing stale stacked crew workspace for $PROJ ($t)"
+      _cmux_close_tab "$t"; _state_drop "$PROJ" "cmuxws" "" "$t"
+    done
+  fi
+  if [ -n "$REUSE_TAB" ] && [ "$DRY" != "1" ]; then
+    local ok; ok="$(osascript 2>/dev/null <<OSA
+tell application "cmux"
+  repeat with w in windows
+    repeat with tt in tabs of w
+      if (id of tt) is "$REUSE_TAB" then return "OK"
+    end repeat
+  end repeat
+  return "ERR"
+end tell
+OSA
+)"
+    [ "$ok" = "OK" ] || { _state_drop "$PROJ" "cmuxws" "" "$REUSE_TAB"; _state_drop "$PROJ" "cmux" "" ""; REUSE_TAB=""; }
+  fi
+  [ -n "$REUSE_TAB" ] && { tabid="$REUSE_TAB"; echo "  → reusing existing crew workspace for $PROJ ($tabid)"; }
   for SPEC in "$@"; do
     resolve_spec "$SPEC"
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
-    if [ "$i" = "0" ]; then
+    # In REUSE mode, replace-in-place: split off the agent's old terminal when tracked, close it after.
+    local OLD_SURF=""
+    if [ -n "$REUSE_TAB" ] && [ -f "$STATE" ]; then
+      while IFS= read -r line; do
+        [ -n "$line" ] || continue
+        _parse_row "$line"
+        [ "$RP" = "$PROJ" ] && [ "$RK" = "cmux" ] && [ "$RA" = "$AGENT" ] && OLD_SURF="$RH"
+      done < "$STATE"
+    fi
+    if [ -z "$tabid" ] && [ "$i" = "0" ]; then
       if [ "$DRY" = "1" ]; then
         echo "[dry] cmux(AppleScript): new tab (trantor:$PROJ) + run 'bash $launcher'"; tabid="%DRYTAB"; termid="%DRYT0"
       else
@@ -470,11 +631,15 @@ OSA
       fi
       record_state "$PROJ" "cmuxws" "__ws__" "$tabid"
     else
-      local dir target
-      if [ $(( i / COLS )) = "0" ]; then dir="right"; target="${terms[$(( i - 1 ))]}"
-      else dir="down"; target="${terms[$(( i - COLS ))]}"; fi
+      local dir target=""
+      if [ -n "$OLD_SURF" ]; then dir="right"; target="$OLD_SURF"          # replace-in-place: keep the seat's spot
+      elif [ "$i" -gt 0 ]; then
+        if [ $(( i / COLS )) = "0" ]; then dir="right"; target="${terms[$(( i - 1 ))]}"
+        else dir="down"; target="${terms[$(( i - COLS ))]}"; fi
+      else dir="right"; fi                                                 # reuse mode, first seat, nothing tracked → focused terminal
       if [ "$DRY" = "1" ]; then
         echo "[dry] cmux(AppleScript): split $dir from ${target:-<focused>} + run 'bash $launcher'"; termid="%DRYT$i"
+        [ -n "$OLD_SURF" ] && _cmux_close_term "$OLD_SURF"
       else
         termid="$(osascript 2>/dev/null <<OSA
 tell application "cmux"
@@ -497,6 +662,7 @@ tell application "cmux"
 end tell
 OSA
 )"
+        [ -n "$OLD_SURF" ] && [ -n "$termid" ] && [ "$termid" != "ERR" ] && { _cmux_close_term "$OLD_SURF"; _state_drop "$PROJ" "cmux" "$AGENT" ""; }
       fi
     fi
     terms+=("$termid")

package/bin/duty.mjs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// trantor duty — the always-on fleet DUTY AGENT: one seat that watches the whole hub and triages
+// so the human never has to be a switchboard.
+//
+//   trantor duty up [--hub <url>] [--agent claude]     start (idempotent — reaps a prior seat)
+//   trantor duty down                                  stop
+//   trantor duty status                                pid + last turns + presence
+//
+// Division of labor (the overseer doctrine, extended): DETECTION stays mechanical and hub-side —
+// RELAY_DUTY_SESSION makes the hub DM this seat when a direct message sits undelivered past
+// RELAY_DUTY_UNDELIVERED_MS or the overseer emits a warning. The SEAT only triages: relay, wake,
+// annotate, and only involves the human when a real decision is needed. It runs under the same
+// crew-runner that keeps crew seats alive (long-poll wake, turn telemetry, failure reporting) —
+// just with a triage doctrine instead of "work your card" (RUNNER_RULES / CREW_KICKOFF).
+import { spawn, execSync } from "node:child_process";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, openSync, rmSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const BUS = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+const DIR = join(BUS, "fleet");                  // the seat's cwd — project name "fleet"
+const PIDF = join(BUS, "duty.pid");
+const LOGF = join(BUS, "duty.log");
+
+const argv = process.argv.slice(2);
+const cmd = argv[0] || "status";
+const val = (k, d) => { const i = argv.indexOf(`--${k}`); return i >= 0 ? (argv[i + 1] || d) : d; };
+
+let config = {}; try { config = JSON.parse(readFileSync(join(BUS, "config.json"), "utf8")); } catch {}
+// The fleet hub: where the projects live. Default = the most common per-project hub in config,
+// falling back to the global url — a fleet watcher belongs where the fleet is.
+function fleetHub() {
+  const counts = new Map();
+  for (const u of Object.values(config.hubs || {})) counts.set(u, (counts.get(u) || 0) + 1);
+  const top = [...counts.entries()].sort((a, b) => b[1] - a[1])[0];
+  return val("hub", top?.[0] || config.url || "http://127.0.0.1:4477");
+}
+
+const AGENT = val("agent", "claude");
+const SESSION = `${AGENT}:fleet`;
+
+const RULES = `Rules: you are ${SESSION}, the trantor fleet DUTY AGENT — the always-on triage seat. You NEVER write code and NEVER edit project files. On every wake: (1) read the message(s) that woke you; (2) triage with your relay tools — relay_peers for who is live/down, relay_board with the project param for any board, relay_inbox for your own backlog; runner logs live at ~/.agent-bus/logs/<agent>-<project>.jsonl if a seat looks dead; (3) ACT: an UNDELIVERED escalation means the recipient is idle, deaf (wrong hub / stale hooks — a known failure mode), or gone — relay the content to a live session that can act, wake a crew seat with a direct message, or post the information into the project lane so the human's app notifies them; an OVERSEER warning means two parties may collide — message them to coordinate; a seat reported down/errored — check its log tail and either resend its contract or report exactly what is needed. (4) Report each action in ONE bus message (<280 chars) to the lane it concerns. If only a human can decide, say exactly that, in that lane, once. Then END YOUR TURN — the runner wakes you for the next event.`;
+
+const KICKOFF = `You are ${SESSION}, the fleet duty agent, freshly started. Do a short patrol: relay_peers (note anything down/errored), then relay_inbox. Handle what is actionable per the Rules, post one line to the bus saying the duty seat is on watch, and end your turn.\n\n${RULES}`;
+
+async function ensureFleetIdentity(hub) {
+  const id = loadOrCreate(SESSION, "agent");
+  const probe = await sfetchJson(`${hub}/peers`, { method: "GET", identity: id, signal: AbortSignal.timeout(5000) }).catch(() => null);
+  if (probe && probe.status !== 401) return true;          // enrolled (or hub not enforcing)
+  // Not enrolled: mint an owner invite with FLEET-WIDE write (write ⊇ read) and enroll with it.
+  const owner = loadOrCreate(config.ownerIdentity || "admin", "human");
+  const inv = await sfetchJson(`${hub}/invite`, { identity: owner, payload: { scopes: [{ project: "*", role: "write" }], ttlSec: 3600 }, signal: AbortSignal.timeout(5000) });
+  const invJson = await inv.json().catch(() => ({}));
+  if (!inv.ok || !invJson.token) { console.error(`could not mint fleet invite on ${hub}: ${invJson.error || inv.status} — is ${config.ownerIdentity || "admin"} the owner there?`); return false; }
+  const enr = await sfetchJson(`${hub}/enroll`, { identity: id, payload: { token: invJson.token, pubkey: id.pubkey, name: SESSION, kind: "agent" }, signal: AbortSignal.timeout(5000) });
+  const enrJson = await enr.json().catch(() => ({}));
+  if (!enr.ok) { console.error(`fleet enroll failed: ${enrJson.error || enr.status}`); return false; }
+  console.log(`— enrolled ${SESSION} on ${hub} with fleet-wide write —`);
+  return true;
+}
+
+function alivePid() {
+  try {
+    const pid = Number(readFileSync(PIDF, "utf8"));
+    if (pid && process.kill(pid, 0) === undefined) return pid;
+  } catch {}
+  return 0;
+}
+
+if (cmd === "up") {
+  const hub = fleetHub();
+  mkdirSync(DIR, { recursive: true });
+  const prior = alivePid();
+  if (prior) { console.log(`— reaping prior duty seat (pid ${prior}) —`); try { process.kill(prior); } catch {} }
+  try { execSync(`pkill -f "crew-runner.mjs ${AGENT} ${DIR}"`, { stdio: "ignore" }); } catch {}
+  if (!(await ensureFleetIdentity(hub))) process.exit(1);
+  const out = openSync(LOGF, "a");
+  const child = spawn(process.execPath, [join(ROOT, "bin", "crew-runner.mjs"), AGENT, DIR], {
+    detached: true, stdio: ["ignore", out, out],
+    env: { ...process.env, RELAY_URL: hub, RUNNER_RULES: RULES, CREW_KICKOFF: KICKOFF },
+  });
+  child.unref();
+  writeFileSync(PIDF, String(child.pid));
+  console.log(`— duty agent up: ${SESSION} (pid ${child.pid}) watching ${hub} — log: ${LOGF}`);
+  console.log(`  hub feeds it: undelivered DMs (>${Math.round(Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 600000) / 60000)}m) + overseer warnings — set RELAY_DUTY_SESSION=${SESSION} on the hub service.`);
+  process.exit(0);
+}
+
+if (cmd === "down") {
+  const pid = alivePid();
+  if (pid) { try { process.kill(pid); } catch {} console.log(`— duty seat stopped (pid ${pid}) —`); }
+  else console.log("no duty seat running");
+  try { execSync(`pkill -f "crew-runner.mjs ${AGENT} ${DIR}"`, { stdio: "ignore" }); } catch {}
+  try { rmSync(PIDF, { force: true }); } catch {}
+  process.exit(0);
+}
+
+// status
+{
+  const pid = alivePid();
+  console.log(pid ? `duty seat RUNNING (pid ${pid}) as ${SESSION}` : "duty seat NOT running");
+  try {
+    const lines = readFileSync(join(BUS, "logs", `${AGENT}-fleet.jsonl`), "utf8").trim().split("\n").slice(-3);
+    console.log("last turns:"); for (const l of lines) console.log(`  ${l}`);
+  } catch { console.log("(no turns logged yet)"); }
+  process.exit(0);
+}

package/hub.mjs

@@ -245,6 +245,7 @@ function overseerTick() {
     overseerWarned.set(key, now());
     appendEvent("overseer.warn", c.project, "overseer",
       { kind: c.kind, sessions: c.sessions || [], files: c.files || [], detail: c.detail || "", narrated: false });
+    if (DUTY_SESSION) hubSend(DUTY_SESSION, `⚠️ OVERSEER ${c.kind} [${c.project}]: ${c.detail || ""} — if the parties are not already coordinating, message them.`, c.project);
     const level = _overseer.levelFor ? _overseer.levelFor(c.project, pol.autonomy) : 1;
     if (level >= 3 && c.kind === "file-conflict") {
       const g = { id: ++state.verifyGateSeq, project: c.project, status: "open", ts: now(),
@@ -257,6 +258,41 @@ function overseerTick() {
 }
 setInterval(overseerTick, OVERSEER_TICK_MS).unref?.();
 
+// --- the DUTY AGENT feed (deterministic escalation; the seat itself is bin/duty.mjs) -----------
+// RELAY_DUTY_SESSION names the always-on triage seat (e.g. "claude:fleet"). The hub DMs it when:
+//   1. a DIRECT message has sat undelivered past RELAY_DUTY_UNDELIVERED_MS — the sender believes
+//      it was heard and nobody is listening (the crebral-health 4-day failure mode);
+//   2. the overseer emits a warning (wired inside overseerTick below).
+// Escalations are hub-authored ("hub:duty") — they never impersonate a session — and dedup per
+// message id so a standing outage escalates once, not every tick.
+const DUTY_SESSION = String(process.env.RELAY_DUTY_SESSION || "");
+const DUTY_UNDELIVERED_MS = Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 10 * 60 * 1000);
+const dutyEscalated = new Set();
+function hubSend(to, text, project) {
+  const msg = { id: ++state.seq, ts: now(), from: "hub:duty", to, text: String(text).slice(0, 2000), project: String(project || "").slice(0, 80) };
+  state.messages.push(msg); if (state.messages.length > 5000) state.messages.splice(0, 1000);
+  dirty = true; pushToStreams(msg);
+  appendEvent("message", msg.project, msg.from, { msgId: msg.id, toSession: msg.to, text: msg.text.slice(0, 2000), refs: [] });
+  return msg;
+}
+function dutyTick() {
+  if (!DUTY_SESSION) return;
+  const cutoff = now() - DUTY_UNDELIVERED_MS;
+  const floor = now() - 24 * 3600 * 1000;                 // never escalate ancient history
+  for (const m of state.messages) {
+    if (m.ts > cutoff || m.ts < floor) continue;
+    if (!m.to || m.to === "all" || m.to === DUTY_SESSION || m.from === "hub:duty") continue;
+    if (dutyEscalated.has(m.id)) continue;
+    if ((state.peers[m.to]?.deliveredUpTo || 0) >= m.id) continue;
+    dutyEscalated.add(m.id);
+    hubSend(DUTY_SESSION,
+      `⚠️ UNDELIVERED for ${Math.round((now() - m.ts) / 60000)}m: #${m.id} ${m.from} -> ${m.to} — "${String(m.text).slice(0, 280)}" — the recipient has not been handed this. Triage: is the recipient's session idle, deaf (wrong hub / old hooks), or gone? Relay, wake, or note it on their board.`,
+      m.project || "");
+  }
+  if (dutyEscalated.size > 5000) { let n = dutyEscalated.size - 4000; for (const k of dutyEscalated) { dutyEscalated.delete(k); if (--n <= 0) break; } }
+}
+setInterval(dutyTick, OVERSEER_TICK_MS).unref?.();
+
 if (durableStore?.subscribeChanges) {
   durableStore.subscribeChanges((p) => {
     if (p && p.src === HUB_SRC) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.59",
+  "version": "0.17.61",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "pg": "^8.22.0"
   },
   "scripts": {
-    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && bash test-crew.sh"
+    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [