trantor 0.17.67 → 0.17.69

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.67",
+  "version": "0.17.69",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/bridge.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+// trantor bridge — TEMPORARY card mirror between two hubs for ONE project.
+//
+// Exists for the split-brain case: a crew bound to one hub while the project's canonical
+// board lives on another (env-inherited RELAY_URL at `trantor up` time — 2026-08-14,
+// crebral-health). Killing a working crew mid-build just to rebind it is worse than the
+// split, so this process runs ALONGSIDE: no hub restart, no seat restart, additive only.
+//
+//   node bin/bridge.mjs <project> [--from <hubA>] [--to <hubB>] [--since <ms|ISO>]
+//                       [--interval <sec>] [--once] [--map <file>]
+//
+//   forward (from → to): every card created/updated since --since mirrors + tracks.
+//   reverse (to → from): OPEN cards (todo/doing/testing/failed) mirror so the crew's
+//                        relay_board shows its assignments.
+//   Mapped pairs sync STATUS + assignee both ways; on a same-tick conflict the card's
+//   ORIGIN side wins. Mapping persists to disk, so restarts never duplicate.
+//
+// What it deliberately does NOT mirror: messages (duplicate delivery + prompt-injection
+// surface) and presence (heartbeats must stay honest — a bridge that fakes liveness lies
+// to the liveness doctrine). Cards attributed via `by` may flicker the seat "online" on
+// the target for ONLINE_MS after a mirrored write; that tracks real seat activity closely
+// enough to be acceptable for a temporary bridge.
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+import { resolveHub } from "../lib/project.mjs";
+
+const argv = process.argv.slice(2);
+const PROJECT = argv[0] && !argv[0].startsWith("--") ? argv[0] : "";
+if (!PROJECT) { console.error("usage: bridge.mjs <project> [--from hub] [--to hub] [--since ms|ISO] [--interval sec] [--once]"); process.exit(1); }
+const val = (k, d) => { const i = argv.indexOf(`--${k}`); return i >= 0 ? argv[i + 1] : d; };
+
+const BUS_DIR = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+let config = {}; try { config = JSON.parse(readFileSync(join(BUS_DIR, "config.json"), "utf8")); } catch {}
+const FROM = val("from", "http://127.0.0.1:4477");
+const TO = val("to", resolveHub(PROJECT, {}));           // {}: never let this process's own env leak in
+const SINCE = (() => { const s = val("since", "0"); const n = Number(s); return Number.isFinite(n) && n > 0 ? n : (Date.parse(s) || 0); })();
+const INTERVAL = Math.max(2, Number(val("interval", 5))) * 1000;
+const ONCE = argv.includes("--once");
+const MAPFILE = val("map", join(BUS_DIR, `bridge-${PROJECT}.json`));
+const OPEN = new Set(["todo", "doing", "testing", "failed"]);
+// reverse direction only mirrors open cards TOUCHED recently — a split-brain bridge is for
+// live coordination, not for pouring a months-old open backlog onto the crew's board.
+const _rw = Number(val("reverse-window", 24));
+const REVERSE_WINDOW_MS = (Number.isFinite(_rw) && _rw > 0 ? _rw : 24) * 3600 * 1000;
+
+const id = loadOrCreate(config.ownerIdentity || "admin", "human");
+const call = async (hub, method, path, payload) => {
+  const r = await sfetchJson(`${hub}${path}`, { method, identity: id, payload, signal: AbortSignal.timeout(8000) });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok || j.error) throw new Error(`${hub}${path}: ${j.error || r.status}`);
+  return j;
+};
+
+// pairs: [{ aId, bId, origin: "A"|"B", lastA, lastB }] — lastX is the updated-stamp we have
+// already accounted for on that side (our own writes included, so they never echo back).
+let map = { pairs: [] };
+try { map = JSON.parse(readFileSync(MAPFILE, "utf8")); } catch {}
+const saveMap = () => { try { mkdirSync(dirname(MAPFILE), { recursive: true }); writeFileSync(MAPFILE, JSON.stringify(map)); } catch {} };
+
+const cardBody = (t) => ({ project: PROJECT, title: t.title, status: t.status, assignee: t.assignee || "",
+  difficulty: t.difficulty || undefined, model: t.model || undefined, phase: t.phase || undefined,
+  by: t.by || "", source: "bridge" });
+
+async function tick() {
+  const [a, b] = await Promise.all([call(FROM, "GET", `/tasks?project=${encodeURIComponent(PROJECT)}`),
+                                    call(TO, "GET", `/tasks?project=${encodeURIComponent(PROJECT)}`)]);
+  const A = new Map((a.tasks || []).map(t => [t.id, t]));
+  const B = new Map((b.tasks || []).map(t => [t.id, t]));
+  const mappedA = new Set(map.pairs.map(p => p.aId));
+  const mappedB = new Set(map.pairs.map(p => p.bId));
+  let created = 0, synced = 0, seeded = 0;
+
+  // SEED: the hubs may share ancestry (one was migrated from the other), so the same card can
+  // exist on both sides under the SAME id + title. Pair those instead of duplicating them.
+  // Seeding is PASSIVE — long-diverged statuses are accepted as-is, never mass-rewritten —
+  // EXCEPT a card the crew side touched after --since: that one is live work, and pushes.
+  for (const t of A.values()) {
+    if (mappedA.has(t.id)) continue;
+    const twin = B.get(t.id);
+    if (twin && !mappedB.has(twin.id) && twin.title === t.title) {
+      const live = SINCE > 0 && (t.updated || 0) >= SINCE;
+      map.pairs.push({ aId: t.id, bId: twin.id, origin: "A", lastA: live ? 0 : (t.updated || 0), lastB: twin.updated || 0 });
+      mappedA.add(t.id); mappedB.add(twin.id); seeded++;
+    }
+  }
+
+  // forward: new A-side cards since SINCE → create on B
+  for (const t of A.values()) {
+    if (mappedA.has(t.id) || (t.updated || t.ts || 0) < SINCE) continue;
+    const r = await call(TO, "POST", "/task", cardBody(t));
+    map.pairs.push({ aId: t.id, bId: r.task.id, origin: "A", lastA: t.updated || 0, lastB: r.task.updated || 0 });
+    mappedA.add(t.id); mappedB.add(r.task.id); created++;
+  }
+  // reverse: recently-touched OPEN B-side cards → create on A (assignments reach the crew)
+  for (const t of B.values()) {
+    if (mappedB.has(t.id) || !OPEN.has(t.status) || (Date.now() - (t.updated || t.ts || 0)) > REVERSE_WINDOW_MS) continue;
+    const r = await call(FROM, "POST", "/task", cardBody(t));
+    map.pairs.push({ aId: r.task.id, bId: t.id, origin: "B", lastA: r.task.updated || 0, lastB: t.updated || 0 });
+    mappedB.add(t.id); mappedA.add(r.task.id); created++;
+  }
+  // mapped pairs: status/assignee follow whichever side moved; origin wins a tie
+  for (const p of map.pairs) {
+    const ta = A.get(p.aId), tb = B.get(p.bId);
+    if (!ta || !tb) continue;                            // deleted on one side: leave the other alone
+    const aMoved = (ta.updated || 0) > p.lastA, bMoved = (tb.updated || 0) > p.lastB;
+    const differs = ta.status !== tb.status || (ta.assignee || "") !== (tb.assignee || "");
+    if (differs && (aMoved || bMoved)) {
+      const aWins = aMoved && bMoved ? p.origin === "A" : aMoved;
+      const [src, dstHub, dstId] = aWins ? [ta, TO, p.bId] : [tb, FROM, p.aId];
+      const r = await call(dstHub, "POST", "/task/update", { id: dstId, status: src.status, assignee: src.assignee || "", by: src.by || "bridge" });
+      if (aWins) { p.lastA = ta.updated || 0; p.lastB = r.task.updated || 0; }
+      else { p.lastB = tb.updated || 0; p.lastA = r.task.updated || 0; }
+      synced++;
+    } else { p.lastA = Math.max(p.lastA, ta.updated || 0); p.lastB = Math.max(p.lastB, tb.updated || 0); }
+  }
+  saveMap();
+  return { created, synced, seeded };
+}
+
+console.log(`[bridge] ${PROJECT}: ${FROM} <-> ${TO} · since ${SINCE ? new Date(SINCE).toISOString() : "epoch"} · map ${MAPFILE}`);
+if (ONCE) {
+  const r = await tick();
+  console.log(`[bridge] tick: +${r.created} mirrored, ${r.synced} synced`);
+} else {
+  writeFileSync(join(BUS_DIR, `bridge-${PROJECT}.pid`), String(process.pid));
+  let failures = 0;
+  while (true) {
+    try { const r = await tick(); failures = 0; if (r.created || r.synced) console.log(`[bridge] +${r.created} mirrored, ${r.synced} synced`); }
+    catch (e) { if (++failures % 10 === 1) console.error(`[bridge] tick failed (${failures}x): ${e.message}`); }
+    await new Promise(r => setTimeout(r, INTERVAL));
+  }
+}

package/bin/cli.mjs

@@ -70,8 +70,10 @@ switch (cmd) {
   case "adopt": run("bin/adopt.mjs"); break;
   case "summarize": run("bin/summarize.mjs"); break;
   case "policy": run("bin/policy.mjs"); break;
+  case "proposals": case "proposal": run("bin/proposals.mjs"); break;
   case "inbox": run("bin/inbox.mjs"); break;
   case "duty": run("bin/duty.mjs"); break;
+  case "orchestrate": run("bin/orchestrate.mjs"); break;
   case "app": run("bin/app.mjs"); break;
   case "patrol": run("bin/patrol.mjs"); break;
   case "identity": {
@@ -172,7 +174,9 @@ switch (cmd) {
   trantor watch       live bus feed in the terminal
   trantor inbox       THIS session's unread bus messages, signed (works under enforce) — [--all] [--consume] [--json]
   trantor policy      the autonomy ladder: show | set <project> <1-4> | link <a> <b> --reason "<why>"
+  trantor proposals   agent-proposed permissions awaiting YOUR decision: [--all] | approve <id> [--note "…"] | deny <id> --note "…"
   trantor duty        the always-on fleet duty agent: up | down | status — hub-escalated triage so you are not the switchboard
+  trantor orchestrate a per-project ORCHESTRATOR with a MISSION.md and a pulse: up [--every 10m] | down | status — the loop-orchestrator pattern
   trantor patrol      machine-wide resource sweep: crews/runners/workspaces/orphans — [--json] [--reap] (reap = dead rows + stale artifacts ONLY)
 
 Claude Code plugin (the orchestrator side):

package/bin/crew-runner.mjs

@@ -24,7 +24,10 @@ const DIR = process.argv[3] || process.cwd();
 // back to the git-repo-root basename — never a loose dir basename that could
 // fork the host's "builtbetter.ai" into a separate "builtbetter" lane.
 const PROJ = process.env.RELAY_PROJECT || resolveProject(DIR);
-const SESSION = `${AGENT}:${PROJ}`;
+// RUNNER_SESSION override: an orchestrator seat (bin/orchestrate.mjs) runs the same CLI as a crew
+// seat but must live on the bus under its own name (claude-orch:proj), or it would collide with a
+// plain claude crew seat on the same project.
+const SESSION = process.env.RUNNER_SESSION || `${AGENT}:${PROJ}`;
 // One keypair per seat, so `deepseek:crebral` and `deepseek:trantor` are genuinely different
 // identities on the bus rather than one shared string label.
 const identity = loadOrCreate(SESSION, "agent");
@@ -54,6 +57,9 @@ import { mkdirSync } from "node:fs";
 try { mkdirSync(LOGDIR, { recursive: true }); } catch {}
 let TURN = 0;
 const telemetry = (rec) => { try { appendFileSync(join(LOGDIR, `${AGENT}-${PROJ}.jsonl`), JSON.stringify(rec) + "\n"); } catch {} };
+// Boot line records the HUB this runner bound to — the 2026-08-14 split-brain took an hour to
+// diagnose because nothing on disk said which hub a seat was talking to.
+telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, boot: true, hub: HUB });
 const banner = (trigger) => {
   console.log(`\x1b[2J\x1b[H\x1b[48;5;236m\x1b[38;5;43m  ◤ ${AGENT.toUpperCase()} ◢  trantor crew · ${PROJ} · turn ${TURN} · ${trigger}${MODEL ? ` · ${MODEL}` : ""}  \x1b[0m\n`);
 };
@@ -147,7 +153,17 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go (doing -> testing -> done; run the tests in 'testing', use 'failed' + a report if they break). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, query the board for related PAST cards and lessons (relay_board — 1900+ cards of tribal knowledge; prior work may already answer half of it). Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go (doing -> testing -> done; run the tests in 'testing', use 'failed' + a report if they break). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
+
+// ---- the pulse (Scape's Lloyd/Argus loop, Trantor-shaped) --------------------
+// A message-driven seat is DEAF between messages. An orchestrator seat with a mission needs a
+// metronome: RUNNER_PULSE_MS re-runs its mission note on a cadence even when the bus is silent.
+// The pulse prompt is deliberately almost verbatim the one that works in the wild: re-read the
+// note, continue, check your children, record. Boot discipline rides with it — an empty mission
+// means STAND BY, never invented work.
+const PULSE_MS = Math.max(0, Number(process.env.RUNNER_PULSE_MS || 0));
+const MISSION_FILE = process.env.RUNNER_MISSION_FILE || "MISSION.md";
+const PULSE_PROMPT = `[pulse] Re-read your mission note (${MISSION_FILE} in your working directory) and continue your mission. Check on your children and your board, unblock what is stuck, and record what you did. If the mission note is missing, empty, or has no actionable mission, reply ONLY that you are standing by and end your turn — do NOT invent work, create files, or spawn anything.`;
 
 // ---- failure visibility ----------------------------------------------------
 // A turn's CLI can fail (credits exhausted, auth, crash) and the runner would just
@@ -265,12 +281,27 @@ async function loadLessons() {
   let pendingBcast = [];
   const ec0 = runTurn(KICKOFF + LESSONS, true, "kickoff");
   if (ec0) await reportFailure(ec0, "kickoff");   // a failed kickoff = the "fired up, died, nobody knew" case
+  let lastTurnAt = Date.now();
+  if (PULSE_MS) log(`pulse armed — mission re-read every ${Math.round(PULSE_MS / 1000)}s (${MISSION_FILE})`);
   log(`parked — long-polling the bus as ${SESSION} (free; this poll is also the heartbeat)`);
 
   while (true) {
+    // pulse first: a due mission beat runs even on a silent bus. Measured from the END of the
+    // last turn, so a long turn doesn't stack an immediate pulse on top of itself.
+    if (PULSE_MS && Date.now() - lastTurnAt >= PULSE_MS) {
+      const ecp = runTurn(PULSE_PROMPT + "\n\n" + RULES + LESSONS, false, "pulse");
+      if (ecp) await reportFailure(ecp, "pulse"); else await reportHealthy();
+      lastTurnAt = Date.now();
+      log("parked — waiting for the next message or pulse");
+      continue;
+    }
+    // cap the long-poll hold so a due pulse never waits out a full silent 280s window
+    const holdS = PULSE_MS
+      ? Math.max(5, Math.min(280, Math.ceil((PULSE_MS - (Date.now() - lastTurnAt)) / 1000)))
+      : 280;
     let msgs = [];
     try {
-      const r = await api(`/poll?session=${encodeURIComponent(SESSION)}&since=${cursor}&wait=280`);
+      const r = await api(`/poll?session=${encodeURIComponent(SESSION)}&since=${cursor}&wait=${holdS}`);
       msgs = r.messages || []; cursor = r.cursor ?? cursor;
     } catch (e) {
       // Deadline-abort on the LONG-POLL is not an outage — it means the hold expired with no hub
@@ -281,6 +312,9 @@ async function loadLessons() {
       await new Promise(s => setTimeout(s, expired ? 250 : 5000)); continue;
     }
     if (!msgs.length) continue;                       // heartbeat tick, nothing for us
+    // never wake on your own broadcasts: a claude seat's report contains "claude:" and matched the
+    // @mention filter, buying one echo turn per report (seen live on the first pulsed orchestrator)
+    msgs = msgs.filter(m => m.from !== SESSION);
     const direct = msgs.filter(m => m.to === SESSION);
     const mentions = msgs.filter(m => m.to === "all" && (m.text.includes(`@${AGENT}`) || m.text.toLowerCase().includes(`${AGENT}:`)));
     const bcast = msgs.filter(m => m.to === "all" && !mentions.includes(m));
@@ -294,6 +328,7 @@ async function loadLessons() {
     await loadLessons();
     const ec = runTurn(prompt + LESSONS, false, direct.length ? "direct message" : "@mention");
     if (ec) await reportFailure(ec, "message"); else await reportHealthy();
+    lastTurnAt = Date.now();
     log("parked — waiting for the next message");
   }
 })();

package/bin/crew.sh

@@ -26,6 +26,17 @@ DIR="$(pwd)"
 # across subdirs), else the cwd basename. The crew inherits this exact key so one repo = one lane.
 PROJ="${RELAY_PROJECT:-$(basename "$(git -C "$DIR" rev-parse --show-toplevel 2>/dev/null || echo "$DIR")")}"
 BUS_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+# Hub binding for every seat, resolved HERE and BAKED into the seat command (RELAY_URL=…), so the
+# launcher's environment can never silently rebind a crew. Precedence: CREW_HUB (explicit operator
+# override) > the project's config PIN > inherited RELAY_URL (tests, unpinned setups) > config.url
+# > default. The pin beating inherited env is the 2026-08-14 lesson: a crew launched from a seat
+# that lives on the local hub (kimi-orch) inherited its RELAY_URL and recorded a whole build onto
+# a board nobody was looking at.
+HUB_URL="${CREW_HUB:-$(CFG="${AGENT_BUS_DIR:-$HOME/.agent-bus}/config.json" HUBPROJ="$PROJ" node -e '
+const fs=require("fs");let c={};try{c=JSON.parse(fs.readFileSync(process.env.CFG,"utf8"))}catch{}
+const pin=c.hubs&&c.hubs[process.env.HUBPROJ];
+console.log(pin||process.env.RELAY_URL||c.url||"http://127.0.0.1:4477");' 2>/dev/null)}"
+[ -n "$HUB_URL" ] || HUB_URL="${RELAY_URL:-http://127.0.0.1:4477}"
 STATE="$HOME/.agent-bus/crew-windows.txt"
 mkdir -p "$HOME/.agent-bus"
 TMUX_SESS="trantor:$PROJ"                                  # one tmux session per project
@@ -291,6 +302,7 @@ while [ $# -gt 0 ]; do
 done
 if [ ${#_ARGS[@]} -gt 0 ]; then set -- "${_ARGS[@]}"; else set --; fi
 [ $# -eq 0 ] && { echo "usage: crew.sh up [--task K --difficulty D] codex glm kimi deepseek (agent:provider picks a live model; agent:provider/model pins one)"; exit 1; }
+echo "[crew] hub for $PROJ: $HUB_URL (baked into every seat; CREW_HUB=<url> overrides)"
 
 # scrooge (the model-routing brain) is bundled with this trantor install; fall back to PATH.
 SCROOGE="$BUS_DIR/engine/bin/scrooge"
@@ -356,7 +368,7 @@ reap_seat() {
 # which captures ALL stdout. Anything that prints — including run()'s `[dry]` echo — would be swallowed
 # into the command string and end up inside the launcher. The reap therefore lives in resolve_spec(),
 # which every spawn path calls as a plain statement immediately before this.
-RUN_CMD() { printf 'cd %q && CREW_MODEL=%q RELAY_PROJECT=%q node %q %q %q' "$DIR" "$MODEL" "$PROJ" "$BUS_DIR/bin/crew-runner.mjs" "$AGENT" "$DIR"; }
+RUN_CMD() { printf 'cd %q && CREW_MODEL=%q RELAY_PROJECT=%q RELAY_URL=%q node %q %q %q' "$DIR" "$MODEL" "$PROJ" "$HUB_URL" "$BUS_DIR/bin/crew-runner.mjs" "$AGENT" "$DIR"; }
 
 # ── tmux spawn: ONE session `trantor:$PROJ`, one named pane per seat, one Terminal window attached ────
 spawn_tmux() {   # $@ = specs

package/bin/duty.mjs

@@ -43,7 +43,7 @@ function fleetHub() {
 const AGENT = val("agent", "claude");
 const SESSION = `${AGENT}:fleet`;
 
-const RULES = `Rules: you are ${SESSION}, the trantor fleet DUTY AGENT — the always-on triage seat. You NEVER write code and NEVER edit project files. On every wake: (1) read the message(s) that woke you; (2) patrol: run \`node ${ROOT}/bin/patrol.mjs --json\`; reap only when an orphan is provably dead, and DM sasha about anything ambiguous such as a live orphan runner or dev server older than 24h; (3) triage with your relay tools — relay_peers for who is live/down, relay_board with the project param for any board, relay_inbox for your own backlog; runner logs live at ~/.agent-bus/logs/<agent>-<project>.jsonl if a seat looks dead; (4) ACT: an UNDELIVERED escalation means the recipient is idle, deaf (wrong hub / stale hooks — a known failure mode), or gone — relay the content to a live session that can act, wake a crew seat with a direct message, or post the information into the project lane so the human's app notifies them; an OVERSEER warning means two parties may collide — message them to coordinate; a seat reported down/errored — check its log tail and either resend its contract or report exactly what is needed. (5) Report each action and patrol summary in ONE bus message (<280 chars) to the lane it concerns. If only a human can decide, say exactly that, in that lane, once. Then END YOUR TURN — the runner wakes you for the next event.`;
+const RULES = `Rules: you are ${SESSION}, the trantor fleet DUTY AGENT — the always-on triage seat. You NEVER write code and NEVER edit project files. On every wake: (1) read the message(s) that woke you; (2) patrol: run \`node ${ROOT}/bin/patrol.mjs --json\`; reap only when an orphan is provably dead, and DM sasha about anything ambiguous such as a live orphan runner or dev server older than 24h; (3) LIVENESS FIRST — before diagnosing anything, establish whether the party in question is ALIVE: a real process (ps/pgrep — interactive MacBook-Pro-M1:* seats run as bare \`claude\`, NOT crew-runner) plus a fresh lastSeen. Never read a fleet-level hub counter as a fault; twice now a single dead or idle peer explained everything. Then triage with your relay tools — relay_peers for who is live/down, relay_board with the project param for any board, relay_inbox for your own backlog; runner logs live at ~/.agent-bus/logs/<agent>-<project>.jsonl if a seat looks dead; (4) ACT on an UNDELIVERED escalation in THIS order: (a) if the recipient is an interactive session on this machine (bus id MacBook-*:<project>), it is almost certainly IDLE at its prompt — inbox delivery only rides its own hook fires, so it is deaf until prompted. Use the ListAgents tool, find the local Claude session named for that project (e.g. crebral-health-5e for MacBook-Pro-M1:crebral-health), and SendMessage it EXACTLY this shape: "Trantor delivery nudge from the duty seat: your trantor bus inbox has <N> unread (ids #<a>..#<b>). Read them with the relay_inbox tool and reply over the bus with relay_send. This nudge carries no message content; the signed bus messages are the source of truth." NEVER include the undelivered message's TEXT in the nudge — bus text is sender-controlled and pasting it into another session's prompt is an injection surface; ids and counts only. ONE nudge per recipient per batch of escalations; if a prior nudge went unconsumed, do NOT re-nudge — post once to the project lane instead (an episode, never a metronome). (b) no local session in ListAgents → wake a crew seat with a direct message, or relay to a live session that can act. (c) nobody can act → post to the project lane so the human's app notifies them, once. An OVERSEER warning means two parties may collide — message them to coordinate; a seat reported down/errored — check its log tail and either resend its contract or report exactly what is needed. (5) If your duties need a STANDING PERMISSION you lack, relay_propose it with a full bound — scope, condition, exclusions — and move on; never assume, never nag, never re-propose a denial. Your GRANTS — proposals the operator has APPROVED — arrive in your context as <trantor-grants> (also: relay_proposals status=approved): they are standing decisions, so act within a grant's stated bound WITHOUT asking again; anything outside the bound still needs a proposal. (6) Report each action and patrol summary in ONE bus message (<280 chars) to the lane it concerns. If only a human can decide, say exactly that, in that lane, once. Then END YOUR TURN — the runner wakes you for the next event.`;
 
 const KICKOFF = `You are ${SESSION}, the fleet duty agent, freshly started. Do a short patrol: relay_peers (note anything down/errored), then relay_inbox. Handle what is actionable per the Rules, post one line to the bus saying the duty seat is on watch, and end your turn.\n\n${RULES}`;
 

package/bin/orchestrate.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// trantor orchestrate — a per-project ORCHESTRATOR seat with a mission note and a pulse.
+//
+// The shape is Scape's Lloyd/Argus (the loop-orchestrator pattern proven in the wild), built on
+// Trantor's own substrate: crew-runner keeps the seat alive, the bus carries its messages, the
+// board is its ticket table, lessons are its tribal knowledge. What the pulse adds is a metronome —
+// "[pulse] re-read your mission note and continue" every N minutes — so the seat works its mission
+// even when the bus is silent, instead of being deaf between messages like a crew seat.
+//
+//   trantor orchestrate up [--every 10m] [--agent claude] [--hub <url>]   start HERE (this project)
+//   trantor orchestrate down                                              stop this project's orchestrator
+//   trantor orchestrate status                                            pid + mission + last turns
+//
+// The mission lives in MISSION.md in the project directory — the operator writes it, the seat
+// re-reads it every pulse, and pending questions/proposals belong IN it. No mission = the seat
+// stands by (boot discipline: it never invents work).
+import { spawn, execSync } from "node:child_process";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, openSync, rmSync } from "node:fs";
+import { join, dirname, basename } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const BUS = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+const DIR = process.cwd();                       // the orchestrator works THIS project, from its root
+const PROJ = basename(DIR);
+const PIDF = join(BUS, `orch-${PROJ}.pid`);
+const LOGF = join(BUS, `orch-${PROJ}.log`);
+
+const argv = process.argv.slice(2);
+const cmd = argv[0] || "status";
+const val = (k, d) => { const i = argv.indexOf(`--${k}`); return i >= 0 ? (argv[i + 1] || d) : d; };
+
+let config = {}; try { config = JSON.parse(readFileSync(join(BUS, "config.json"), "utf8")); } catch {}
+function projectHub() {
+  return val("hub", config.hubs?.[PROJ] || config.url || "http://127.0.0.1:4477");
+}
+
+/** "10m" / "90s" / "1h" → ms. The default matches the pattern's field-proven cadence. */
+function parseEvery(v) {
+  const m = String(v || "10m").match(/^(\d+)(s|m|h)?$/);
+  if (!m) { console.error(`bad --every '${v}' (want e.g. 90s, 10m, 1h)`); process.exit(1); }
+  return Number(m[1]) * { s: 1000, m: 60000, h: 3600000 }[m[2] || "m"];
+}
+
+const AGENT = val("agent", "claude");
+// `-orch` keeps the orchestrator distinguishable from a same-CLI crew seat on the same project —
+// the naming the fleet already uses (kimi-orch:<project> since the kimi port).
+const SESSION = `${AGENT}-orch:${PROJ}`;
+
+// The doctrine. Verbs from the Argus prompts that demonstrably work, grounded in Trantor's tools.
+const RULES = `Rules: you are ${SESSION}, the ORCHESTRATOR for project ${PROJ}. Your mission lives in MISSION.md in this directory; the operator writes it, you execute it. BOOT DISCIPLINE: if MISSION.md is missing, empty, or has no actionable mission, reply only that you are standing by and end your turn — do NOT invent work, create files or cards, or spawn anything. On every pulse or message: (1) re-read MISSION.md; (2) TRIBAL KNOWLEDGE FIRST — before staffing or starting ANY task, query the board for related past cards and lessons (relay_board; the board is your ticket history and prior work may already answer half of it); (3) NEVER DUPLICATE — before creating a card or engaging a session for a task, check whether an existing card or live session (relay_peers) already covers it, and never re-create work something is already on; (4) if the mission names log files or running services, READ THE LOGS — a noisy-but-not-erroring problem nobody reported becomes a card for the human to triage; (5) file cards for bugs and ideas you surface (relay_task_add) — that is your voice, the human triages them; (6) unblock stalled work: message the responsible session directly (relay_send), never ask the human to relay; (7) if your mission needs a STANDING PERMISSION you lack (deploy rights, push-to-main, spending, scope beyond the mission), relay_propose it with a full bound — scope, condition, exclusions — and move on with what you CAN do; never assume you have it, never nag, and never re-propose a denial; permissions the operator has APPROVED arrive in your context as <trantor-grants> — those are standing decisions you act on within their bound without re-asking; (8) record what you did: move cards, then ONE bus report (<280 chars) to the project lane. If only the human can decide something, write the question at the END of MISSION.md under '## Pending for operator' (create the section if missing) AND say it in your bus report, once. Then END YOUR TURN — the runner pulses you on cadence and wakes you for messages.`;
+
+const KICKOFF = `You are ${SESSION}, freshly started as this project's orchestrator. Read MISSION.md if it exists. If it has an actionable mission, do ONE opening survey (board via relay_board, peers via relay_peers) and post a one-line "orchestrator on watch" report to the bus. If there is no actionable mission, reply only that you are standing by. Then end your turn.\n\n${RULES}`;
+
+async function ensureIdentity(hub) {
+  const id = loadOrCreate(SESSION, "agent");
+  const probe = await sfetchJson(`${hub}/peers`, { method: "GET", identity: id, signal: AbortSignal.timeout(5000) }).catch(() => null);
+  if (probe && probe.status !== 401) return true;
+  const owner = loadOrCreate(config.ownerIdentity || "admin", "human");
+  const inv = await sfetchJson(`${hub}/invite`, { identity: owner, payload: { scopes: [{ project: PROJ, role: "write" }], ttlSec: 3600 }, signal: AbortSignal.timeout(5000) }).catch(() => null);
+  const invJson = await inv?.json().catch(() => ({})) ?? {};
+  if (!inv?.ok || !invJson.token) { console.error(`could not mint invite on ${hub}: ${invJson.error || (inv ? inv.status : "unreachable")}`); return false; }
+  const enr = await sfetchJson(`${hub}/enroll`, { identity: id, payload: { token: invJson.token, pubkey: id.pubkey, name: SESSION, kind: "agent" }, signal: AbortSignal.timeout(5000) });
+  if (!enr.ok) { console.error(`enroll failed: ${(await enr.json().catch(() => ({}))).error || enr.status}`); return false; }
+  console.log(`— enrolled ${SESSION} on ${hub} (write on ${PROJ}) —`);
+  return true;
+}
+
+function alivePid() {
+  try {
+    const pid = Number(readFileSync(PIDF, "utf8"));
+    if (pid) { process.kill(pid, 0); return pid; }
+  } catch {}
+  return 0;
+}
+
+if (cmd === "up") {
+  const hub = projectHub();
+  const pulseMs = parseEvery(val("every", "10m"));
+  const prior = alivePid();
+  if (prior) { console.log(`— reaping prior orchestrator (pid ${prior}) —`); try { process.kill(prior); } catch {} }
+  try { execSync(`pkill -f "crew-runner.mjs ${AGENT}-orch ${DIR}"`, { stdio: "ignore" }); } catch {}
+  if (!(await ensureIdentity(hub))) process.exit(1);
+  if (!existsSync(join(DIR, "MISSION.md"))) {
+    console.log(`  note: no MISSION.md here — the seat will STAND BY until you write one (boot discipline).`);
+  }
+  const out = openSync(LOGF, "a");
+  // The seat's AGENT is `<agent>-orch` so crew tooling (prune, per-seat down) treats it as its own
+  // seat; crew-runner resolves the CLI by stripping nothing — so pass the real agent via CREW_CLI?
+  // No: crew-runner keys CLI by its first arg. `claude-orch` is not a known CLI, so we pass the
+  // REAL agent and override the session name instead.
+  const child = spawn(process.execPath, [join(ROOT, "bin", "crew-runner.mjs"), AGENT, DIR], {
+    detached: true, stdio: ["ignore", out, out],
+    env: {
+      ...process.env,
+      RELAY_URL: hub,
+      RUNNER_SESSION: SESSION,
+      RUNNER_RULES: RULES,
+      CREW_KICKOFF: KICKOFF,
+      RUNNER_PULSE_MS: String(pulseMs),
+      RUNNER_MISSION_FILE: "MISSION.md",
+    },
+  });
+  child.unref();
+  writeFileSync(PIDF, String(child.pid));
+  console.log(`— orchestrator up: ${SESSION} (pid ${child.pid}) · pulse every ${val("every", "10m")} · hub ${hub}`);
+  console.log(`  mission: ${join(DIR, "MISSION.md")} — log: ${LOGF}`);
+  process.exit(0);
+}
+
+if (cmd === "down") {
+  const pid = alivePid();
+  if (pid) { try { process.kill(pid); } catch {} console.log(`— orchestrator stopped (pid ${pid}) —`); }
+  else console.log(`no orchestrator running for ${PROJ}`);
+  try { execSync(`pkill -f "crew-runner.mjs ${AGENT}-orch ${DIR}"`, { stdio: "ignore" }); } catch {}
+  try { rmSync(PIDF, { force: true }); } catch {}
+  process.exit(0);
+}
+
+// status
+{
+  const pid = alivePid();
+  console.log(pid ? `orchestrator RUNNING (pid ${pid}) as ${SESSION}` : `no orchestrator running for ${PROJ}`);
+  const mission = join(DIR, "MISSION.md");
+  console.log(existsSync(mission) ? `mission: ${mission}` : "mission: NONE — the seat stands by until MISSION.md exists");
+  try {
+    const lines = readFileSync(join(BUS, "logs", `${AGENT}-${PROJ}.jsonl`), "utf8").trim().split("\n").slice(-3);
+    console.log("last turns:"); for (const l of lines) console.log(`  ${l}`);
+  } catch { console.log("(no turns logged yet)"); }
+  process.exit(0);
+}

package/bin/proposals.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+// trantor proposals — the operator's half of agent-proposed permissions (governance).
+// Agents file bounded proposals over the bus (relay_propose); THIS is where the human decides.
+//   trantor proposals                       pending proposals across your hubs
+//   trantor proposals --all                 every proposal, all statuses
+//   trantor proposals approve <id> [--note "…"]
+//   trantor proposals deny <id> --note "…"       (a denial without a reason teaches nothing)
+//   trantor proposals revoke <id> [--note "…"]   (withdraw a GRANT — not a denial, no denial memory)
+//   [--hub <url>]                           target one hub when an id exists on several
+// Owner-signed: /proposal/decide is owner-gated hub-side — approval is the human's act alone.
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { loadOrCreate } from "../lib/identity.mjs";
+import { sfetchJson } from "../lib/signed-fetch.mjs";
+
+const BUS_DIR = process.env.AGENT_BUS_DIR || join(homedir(), ".agent-bus");
+let config;
+try { config = JSON.parse(readFileSync(join(BUS_DIR, "config.json"), "utf8")); } catch { config = {}; }
+
+const ownerId = loadOrCreate(config.ownerIdentity || "admin", "human");
+const argv = process.argv.slice(2);
+const val = (k) => { const i = argv.indexOf(`--${k}`); return i >= 0 ? argv[i + 1] : undefined; };
+const hubs = val("hub") ? [val("hub")] : [...new Set([config.url || "http://127.0.0.1:4477", ...Object.values(config.hubs || {})])];
+
+const get = async (hub, path) => {
+  const r = await sfetchJson(`${hub}${path}`, { method: "GET", identity: ownerId, signal: AbortSignal.timeout(8000) });
+  return r.json();
+};
+const post = async (hub, path, payload) => {
+  const r = await sfetchJson(`${hub}${path}`, { method: "POST", identity: ownerId, payload, signal: AbortSignal.timeout(8000) });
+  const j = await r.json();
+  if (!r.ok || j.error) throw new Error(j.error || `HTTP ${r.status}`);
+  return j;
+};
+
+const ICON = { pending: "⏳", approved: "✅", denied: "⛔", withdrawn: "↩️", revoked: "🚫" };
+const when = (ts) => ts ? new Date(ts).toLocaleString([], { month: "short", day: "numeric", hour: "2-digit", minute: "2-digit" }) : "";
+function show(p, hub) {
+  console.log(`  #${p.id} ${ICON[p.status] || ""} ${p.status.toUpperCase()} · ${p.project} · from ${p.session} · ${when(p.ts)}`);
+  console.log(`      scope:      ${p.scope}`);
+  console.log(`      when:       ${p.condition}`);
+  console.log(`      NOT covered: ${p.exclusions}`);
+  if (p.status !== "pending") console.log(`      decided ${when(p.decidedTs)} by ${p.decidedBy}${p.note ? ` — "${p.note}"` : ""}`);
+}
+function usage() {
+  console.log('usage: trantor proposals [--all] | approve <id> [--note "…"] | deny <id> --note "…" | revoke <id> [--note "…"]  [--hub <url>]');
+  process.exit(1);
+}
+
+const cmd = argv[0] && !argv[0].startsWith("--") ? argv[0] : "list";
+
+if (cmd === "list") {
+  let shown = 0;
+  for (const hub of hubs) {
+    try {
+      const q = argv.includes("--all") ? "" : "?status=pending";
+      const { proposals } = await get(hub, `/proposals${q}`);
+      if (!proposals?.length) continue;
+      console.log(hub);
+      for (const p of proposals) { show(p, hub); shown++; }
+    } catch (err) { console.warn(`  ⚠ ${hub}: ${err.message}`); }
+  }
+  if (!shown) console.log(argv.includes("--all") ? "no proposals on any hub" : "no pending proposals — nothing waiting on you");
+  else if (!argv.includes("--all")) console.log(`\ndecide with: trantor proposals approve <id> [--note "…"]  ·  trantor proposals deny <id> --note "…"`);
+  process.exit(0);
+}
+
+if (cmd === "approve" || cmd === "deny" || cmd === "revoke") {
+  const id = Number(argv[1]);
+  if (!Number.isInteger(id) || id <= 0) usage();
+  const note = val("note");
+  if (cmd === "deny" && !note) { console.error('a denial needs a reason: deny <id> --note "why" — the note is what stops the agent re-proposing blind'); process.exit(1); }
+  // an id is only unique per hub — find where THIS proposal lives before deciding
+  // (approve/deny act on a PENDING row; revoke acts on an APPROVED one)
+  const wantStatus = cmd === "revoke" ? "approved" : "pending";
+  const holding = [];
+  for (const hub of hubs) {
+    try {
+      const { proposals } = await get(hub, `/proposals?status=${wantStatus}`);
+      if (proposals?.some(p => p.id === id)) holding.push(hub);
+    } catch {}
+  }
+  if (!holding.length) { console.error(`no ${wantStatus.toUpperCase()} proposal #${id} on ${hubs.length > 1 ? "any of your hubs" : hubs[0]}`); process.exit(1); }
+  if (holding.length > 1) { console.error(`proposal #${id} is ${wantStatus} on several hubs (${holding.join(", ")}) — pick one with --hub <url>`); process.exit(1); }
+  try {
+    // `by` is the warn-mode fallback only — under enforce the hub stamps the SIGNER's name over it
+    const status = cmd === "approve" ? "approved" : cmd === "deny" ? "denied" : "revoked";
+    const { proposal } = await post(holding[0], "/proposal/decide", { id, status, note, by: ownerId.name || "owner" });
+    console.log(`${ICON[proposal.status]} #${proposal.id} ${proposal.status} on ${holding[0]} — the proposer (${proposal.session}) has been told over the bus`);
+  } catch (err) { console.error(`⚠ ${holding[0]}: ${err.message}`); process.exit(1); }
+  process.exit(0);
+}
+
+usage();

package/hooks/file-claim.mjs

@@ -74,10 +74,14 @@ try {
   if (!conflicts.length) allow();
 
   const who = conflicts.map(c => `${c.session} (${ago(c.agoSec)} ago)`).join(", ");
+  // NO permissionDecision on purpose. This hook exists to WARN, and `additionalContext` reaches the
+  // model on its own — a decision is not required to deliver it. Setting "allow" here (as this did
+  // until 2026-08-12) approves the tool call and bypasses the operator's own permission rules, so a
+  // deny or an approval prompt on Edit/Write was silently overridden for exactly the files two
+  // sessions were fighting over. Omitting it leaves the normal permission flow untouched.
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
-      permissionDecision: "allow",
       additionalContext:
         `⚠️ trantor: ${who} also edited ${file} in project "${ctx.project}" within the last few minutes — ` +
         `you are both touching the same file RIGHT NOW. Before making conflicting changes, coordinate over ` +

package/hooks/sessionstart.mjs

@@ -15,7 +15,7 @@ import { resolveProject, hostId } from "../lib/project.mjs";
 import { formatSubagentManifest } from "../lib/subagent-manifest.mjs";
 import { updateAvailable, maybeNotifyDesktop, readConfig } from "./lib/update-check.mjs";
 import { maybeCheckBalances } from "./lib/balance-check.mjs";
-import { relayUrl, getJSON, signedPost } from "./lib/api.mjs";
+import { relayUrl, getJSON, signedGet, signedPost } from "./lib/api.mjs";
 
 // Load the most recent UNCONSUMED handoff for this project (written by precompact.mjs
 // / the heartbeat early-warning). `claim` marks it consumed so exactly one session
@@ -162,6 +162,21 @@ try {
     additionalContext += `</trantor>\n`;
   }
 
+  // ── GRANTS: standing permissions the operator has APPROVED for this project ──────
+  // The mechanical half of governance: an approval used to live only in a one-shot DM that died
+  // with the session that received it. Injecting the active grants here means EVERY future seat
+  // (including the duty agent and orchestrators, whose runners fire this hook each turn) inherits
+  // the operator's recorded decisions instead of re-asking or acting around them.
+  try {
+    const { grants = [] } = await jget(`${url}/grants?project=${encodeURIComponent(project)}`, session);
+    if (grants.length) {
+      additionalContext += `<trantor-grants project="${sanitize(project)}">\n`;
+      additionalContext += `Standing permissions the operator has APPROVED (act within the stated bound without re-asking; everything outside it still needs a proposal):\n`;
+      for (const g of grants.slice(-10)) additionalContext += `- [#${g.id}${g.key ? ` ${sanitize(g.key)}` : ""}] ${sanitize(g.scope)} — WHEN: ${sanitize(g.condition)} — NOT covered: ${sanitize(g.exclusions)}\n`;
+      additionalContext += `</trantor-grants>\n`;
+    }
+  } catch {}
+
   // ── ADOPT live crews (intersession-ops S1+S2, contract #4215) ─────────────────
   // Every boot inventories leftover crew resources via the #4214 detection lib and steers the
   // session toward ADOPTING a live crew rather than `trantor up`-ing over it (replace-in-place

package/hub.mjs

@@ -86,7 +86,7 @@ function scanTelemetry() {
 // TIMELINE view are untouched; every NEW type is dotted ("message", "presence.online", …) and is
 // filtered OUT of /history. Loads from the old `cardEvents` key when `events` is absent.
 function emptyState() {
-  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {}, dutySession: "" };
+  return { messages: [], peers: {}, seq: 0, tasks: [], taskSeq: 0, projectMeta: {}, lessons: [], events: [], cardEventsBackfilled: false, aliases: {}, phaseMeta: {}, verifyGates: [], verifyGateSeq: 0, proposals: [], proposalSeq: 0, balances: { ts: 0, by: "", entries: [] }, subagentCostReset: false, handoffLog: [], identities: {}, inviteTokens: {}, focus: {}, orgPolicy: {}, instances: {}, dutySession: "" };
 }
 
 function normalizeState(loaded = {}) {
@@ -103,6 +103,8 @@ function normalizeState(loaded = {}) {
   s.phaseMeta = loaded.phaseMeta && typeof loaded.phaseMeta === "object" ? loaded.phaseMeta : {};
   s.verifyGates = Array.isArray(loaded.verifyGates) ? loaded.verifyGates : [];
   s.verifyGateSeq = Number(loaded.verifyGateSeq || Math.max(0, ...s.verifyGates.map(g => Number(g.id) || 0))) || 0;
+  s.proposals = Array.isArray(loaded.proposals) ? loaded.proposals : [];
+  s.proposalSeq = Number(loaded.proposalSeq || Math.max(0, ...s.proposals.map(p => Number(p.id) || 0))) || 0;
   s.balances = loaded.balances && typeof loaded.balances === "object" ? loaded.balances : { ts: 0, by: "", entries: [] };
   s.subagentCostReset = !!loaded.subagentCostReset;
   s.handoffLog = Array.isArray(loaded.handoffLog) ? loaded.handoffLog : [];
@@ -532,6 +534,11 @@ function canon(name) {
 function subFp(title) {
   return String(title || "").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim().slice(0, 80);
 }
+// Governance (agent-proposed permissions): pending-per-session cap, and the normalized fingerprint
+// the denial memory compares against. scope+condition define WHAT is being asked; exclusions are
+// deliberately left out of the fingerprint so narrowing the exclusions alone cannot dodge a denial.
+const PROPOSAL_CAP = Number(process.env.RELAY_PROPOSAL_CAP || 3);
+const propFp = (scope, condition) => `${scope} ${condition}`.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
 let HUB_VERSION = ""; try { HUB_VERSION = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8")).version || ""; } catch {}
 // dependency-free semver compare: -1 if a<b, 0 if equal, 1 if a>b (numeric parts only)
 function cmpSemver(a, b) {
@@ -541,8 +548,8 @@ function cmpSemver(a, b) {
 }
 const AUTH_HEADERS = ["x-trantor-pubkey", "x-trantor-sig", "x-trantor-ts", "x-trantor-nonce"];
 const PUBLIC_ENDPOINTS = new Set(["/", "/ui", "/health", "/enroll"]);
-const OWNER_ENDPOINTS = new Set(["/project/delete", "/sweep", "/reconcile", "/invite", "/import", "/policy"]);
-const READ_ENDPOINTS = new Set(["/peers", "/tasks", "/events", "/inbox", "/peer", "/card", "/stream", "/history", "/projects", "/catchup", "/phases", "/recent", "/handoffs", "/verify-gates", "/claims", "/overseer/context", "/overseer/status"]);
+const OWNER_ENDPOINTS = new Set(["/project/delete", "/sweep", "/reconcile", "/invite", "/import", "/policy", "/proposal/decide"]);
+const READ_ENDPOINTS = new Set(["/peers", "/tasks", "/events", "/inbox", "/peer", "/card", "/stream", "/history", "/projects", "/catchup", "/phases", "/recent", "/handoffs", "/verify-gates", "/claims", "/proposals", "/grants", "/overseer/context", "/overseer/status"]);
 const roleRank = { read: 1, write: 2, owner: 3 };
 const hasAuthHeaders = (req) => AUTH_HEADERS.some(h => !!req.headers[h]);
 const authPath = (u) => `${u.pathname}${u.search || ""}`;
@@ -587,6 +594,12 @@ function projectFromRequest(P, q, b) {
     return canon(String(b?.project || fromProj || "").slice(0, 80));
   }
   if (P === "/project/merge") return canon(String(b?.to || b?.from || "").slice(0, 80));
+  // decide/withdraw carry only an id — authorization must run against the PROPOSAL's project, or a
+  // project-scoped owner could decide any proposal on the hub through the empty-project wildcard.
+  if (P === "/proposal/decide" || P === "/proposal/withdraw") {
+    const p = state.proposals.find(x => x.id === Number(b?.id ?? q?.id));
+    return p?.project || "";
+  }
   return canon(String(b?.project || q?.project || "").slice(0, 80));
 }
 async function authenticate(req, path) {
@@ -1787,6 +1800,119 @@ const server = http.createServer(async (req, res) => {
       if (q.all !== "1") gates = gates.filter(g => g.status === "open");
       return json(res, 200, { gates });
     }
+    // --- agent-proposed permissions (governance): the autonomy ladder made two-directional ---
+    // The operator sets levels top-down (`trantor policy`); this is the bottom-up half — an agent
+    // that needs more rope FILES A PROPOSAL instead of assuming, working around, or DM'ing the
+    // human free-form. Three rules, all Argus-derived and all enforced HERE, not by convention:
+    //   1. A proposal must state its BOUND — scope (what), condition (when), exclusions (what is
+    //      still NOT covered). A permission without a bound is a blank cheque, so an unbounded
+    //      proposal is a 400, not a pending row.
+    //   2. The queue is CAPPED per session (default 3 pending). To file past the cap the agent
+    //      must withdraw one of its own — a full queue is a prioritization exercise, not a bug.
+    //   3. Denials are REMEMBERED. A near-duplicate of a denied proposal (normalized scope +
+    //      condition, same project) is refused with the operator's original note, so "ask again
+    //      until the human gives in" is structurally impossible.
+    // Deciding is the HUMAN's act alone: /proposal/decide is owner-gated (OWNER_ENDPOINTS) and
+    // nothing hub-side ever flips a proposal to approved. Approval grants nothing mechanical
+    // today — it is a recorded operator decision the agent may rely on, like a mission note line.
+    if (req.method === "POST" && P === "/propose") {
+      const b = await body(req);
+      const session = String(b.session || b.by || "").slice(0, 120);
+      if (!session) return json(res, 400, { error: "session required" });
+      if (auth?.identity && String(session) !== String(auth.identity.name || "")) return json(res, 403, { error: "session must match signer" });
+      const proj = canon(String(b.project || state.peers[session]?.project || (session.includes(":") ? session.split(":").pop() : "")).slice(0, 80));
+      const scope = String(b.scope || "").trim().slice(0, 300);
+      const condition = String(b.condition || "").trim().slice(0, 300);
+      const exclusions = String(b.exclusions || "").trim().slice(0, 300);
+      if (!scope || !condition || !exclusions) {
+        return json(res, 400, { error: "a proposal must state its bound: scope (what), condition (when), exclusions (what is still NOT covered) — a permission without a bound is a blank cheque" });
+      }
+      // optional machine-readable capability key ("patrol.reap-orphans") — lets a TOOL check a
+      // grant exactly instead of text-matching prose. Never part of the denial fingerprint.
+      const key = String(b.key || "").trim().toLowerCase().slice(0, 60);
+      if (key && !/^[a-z0-9][a-z0-9._-]*$/.test(key)) return json(res, 400, { error: "key must be a slug: [a-z0-9._-]" });
+      const fp = propFp(scope, condition);
+      const denied = state.proposals.find(p => p.status === "denied" && p.project === proj && propFp(p.scope, p.condition) === fp);
+      if (denied) {
+        return json(res, 409, { error: "near-duplicate of a DENIED proposal — do not re-propose; refine the bound or move on",
+          deniedId: denied.id, note: denied.note || "", decidedTs: denied.decidedTs || 0 });
+      }
+      const pending = state.proposals.filter(p => p.status === "pending" && p.session === session);
+      const dup = pending.find(p => p.project === proj && propFp(p.scope, p.condition) === fp);
+      if (dup) return json(res, 200, { ok: true, proposal: dup, dedup: true });
+      if (pending.length >= PROPOSAL_CAP) {
+        return json(res, 409, { error: `queue full: ${pending.length}/${PROPOSAL_CAP} pending for this session — withdraw one of yours to file another`,
+          pending: pending.map(p => ({ id: p.id, scope: p.scope })) });
+      }
+      touch(session, undefined, proj, undefined, auth);
+      const pr = { id: ++state.proposalSeq, session, project: proj, scope, condition, exclusions, key,
+        status: "pending", ts: now(), decidedTs: 0, decidedBy: "", note: "" };
+      state.proposals.push(pr); if (state.proposals.length > 500) state.proposals.splice(0, 100);
+      dirty = true;
+      appendEvent("proposal.filed", proj, session, { proposalId: pr.id, scope, condition, exclusions, ...(key ? { key } : {}) });
+      return json(res, 200, { ok: true, proposal: pr });
+    }
+    if (req.method === "POST" && P === "/proposal/decide") {
+      const b = await body(req);
+      const pr = state.proposals.find(p => p.id === Number(b.id));
+      if (!pr) return json(res, 404, { error: "no such proposal" });
+      // A grant that GATES tool behavior needs an off-switch: the operator may REVOKE an
+      // approved proposal. Revocation is not a denial — it leaves no denial memory, so the
+      // agent may re-propose a refined bound later.
+      if (b.status === "revoked") {
+        if (pr.status !== "approved") return json(res, 409, { error: `only an approved proposal can be revoked (is ${pr.status})`, proposal: pr });
+      } else if (pr.status !== "pending") return json(res, 409, { error: `already ${pr.status}`, proposal: pr });
+      const decision = ["approved", "denied", "revoked"].includes(b.status) ? b.status : "";
+      if (!decision) return json(res, 400, { error: "status must be 'approved', 'denied' or 'revoked'" });
+      pr.status = decision; pr.decidedTs = now();
+      pr.decidedBy = String(auth?.identity?.name || b.by || "").slice(0, 120);
+      pr.note = String(b.note || "").slice(0, 300);
+      dirty = true;
+      appendEvent("proposal.decided", pr.project, pr.decidedBy, { proposalId: pr.id, scope: pr.scope, status: decision, note: pr.note });
+      // Tell the proposer directly — a decision it never hears about is a decision it will act
+      // around. One DM per decision (a transition, never a repeat), hub-authored like escalations.
+      hubSend(pr.session,
+        `📜 proposal #${pr.id} ${decision.toUpperCase()}${pr.note ? `: ${pr.note}` : ""} — scope was "${pr.scope}". ${decision === "approved" ? "You may rely on it within its stated bound." : decision === "revoked" ? "This grant no longer applies — stop relying on it. You may propose a refined bound." : "Do not re-propose this; refine the bound or move on."}`,
+        pr.project);
+      return json(res, 200, { ok: true, proposal: pr });
+    }
+    if (req.method === "POST" && P === "/proposal/withdraw") {
+      const b = await body(req);
+      const pr = state.proposals.find(p => p.id === Number(b.id));
+      if (!pr) return json(res, 404, { error: "no such proposal" });
+      if (pr.status !== "pending") return json(res, 409, { error: `already ${pr.status}`, proposal: pr });
+      // own proposals only — a signed request must BE the proposer; unsigned (warn/off) must claim it
+      const claimant = String(auth?.identity?.name || b.session || b.by || "").slice(0, 120);
+      if (claimant !== pr.session) return json(res, 403, { error: "only the proposing session may withdraw" });
+      pr.status = "withdrawn"; pr.decidedTs = now(); pr.decidedBy = pr.session;
+      dirty = true;
+      appendEvent("proposal.withdrawn", pr.project, pr.session, { proposalId: pr.id, scope: pr.scope });
+      return json(res, 200, { ok: true, proposal: pr });
+    }
+    if (req.method === "GET" && P === "/proposals") {
+      const proj = q.project ? canon(String(q.project).slice(0, 80)) : "";
+      const rows = filterReadable(auth, state.proposals.filter(p =>
+        (!proj || p.project === proj) &&
+        (!q.status || p.status === q.status) &&
+        (!q.session || p.session === q.session)), p => p.project || "").slice(-200);
+      const pendingCount = filterReadable(auth, state.proposals.filter(p => p.status === "pending"), p => p.project || "").length;
+      return json(res, 200, { proposals: rows, pendingCount });
+    }
+    // GRANTS = the mechanical face of approvals: the ACTIVE approved proposals, queryable by the
+    // tools and sessions that must honor them. Same rows as /proposals?status=approved, but this
+    // is the contract surface — a grant listed here may be relied on within its stated bound;
+    // revocation removes it here first.
+    if (req.method === "GET" && P === "/grants") {
+      const proj = q.project ? canon(String(q.project).slice(0, 80)) : "";
+      const rows = filterReadable(auth, state.proposals.filter(p =>
+        p.status === "approved" &&
+        (!proj || p.project === proj) &&
+        (!q.key || (p.key || "") === String(q.key).toLowerCase()) &&
+        (!q.session || p.session === q.session)), p => p.project || "").slice(-200);
+      return json(res, 200, { grants: rows.map(p => ({ id: p.id, session: p.session, project: p.project,
+        scope: p.scope, condition: p.condition, exclusions: p.exclusions, key: p.key || "",
+        decidedBy: p.decidedBy, decidedTs: p.decidedTs, note: p.note || "" })) });
+    }
     if (req.method === "GET" && P === "/economics") {   // the brain's books, surfaced: scrooge ledger + quota profile
       const out = { scrooge: null, lifetime: null, profile: null };
       try { out.profile = JSON.parse(readFileSync(join(homedir(), ".agent-bus", "profile.json"), "utf8")).providers || {}; } catch {}

package/lib/store-contract.mjs

@@ -129,8 +129,12 @@ CREATE TABLE IF NOT EXISTS schema_meta (version INT PRIMARY KEY, applied_at BIGI
 `;
 
 // Keys that MUST round-trip through kv. A restart that loses any of these is a failed migration.
+// `proposals` (agent-proposed permissions, v0.17.68) especially: a denied proposal is a MEMORY —
+// the hub refuses near-duplicate re-proposals against it, and a restart that forgets denials
+// silently re-opens every door the operator closed.
 export const KV_KEYS = ["verifyGates", "balances", "handoffLog", "aliases", "phaseMeta", "focus",
-                        "projectMeta", "lessons", "orgPolicy", "meta", "subagentCostReset", "seq"];
+                        "projectMeta", "lessons", "orgPolicy", "meta", "subagentCostReset", "seq",
+                        "proposals"];
 
 // ---------------------------------------------------------------------------------------------
 // INVARIANTS — carried forward from 0.17.54. Breaking one silently corrupts the board.

package/lib/store-pg.mjs

@@ -119,9 +119,11 @@ function kvFromState(state) {
     projectMeta: state.projectMeta || {},
     lessons: state.lessons || [],
     orgPolicy: state.orgPolicy || {},
+    proposals: state.proposals || [],
     meta: {
       taskSeq: Number(state.taskSeq || 0),
       verifyGateSeq: Number(state.verifyGateSeq || 0),
+      proposalSeq: Number(state.proposalSeq || 0),
       cardEventsBackfilled: !!state.cardEventsBackfilled,
       inviteTokens: state.inviteTokens || {},
       instances: state.instances || {},
@@ -651,6 +653,7 @@ export class PgStore {
     }
     const meta = kv.meta && typeof kv.meta === "object" ? kv.meta : {};
     const verifyGates = Array.isArray(kv.verifyGates) ? kv.verifyGates : [];
+    const proposals = Array.isArray(kv.proposals) ? kv.proposals : [];
     return {
       messages: messagesRows.rows.map(msgFromRow),
       peers,
@@ -665,6 +668,8 @@ export class PgStore {
       phaseMeta: kv.phaseMeta && typeof kv.phaseMeta === "object" ? kv.phaseMeta : {},
       verifyGates,
       verifyGateSeq: Number(meta.verifyGateSeq || Math.max(0, ...verifyGates.map(g => Number(g.id)))) || 0,
+      proposals,
+      proposalSeq: Number(meta.proposalSeq || Math.max(0, ...proposals.map(p => Number(p.id)))) || 0,
       balances: kv.balances && typeof kv.balances === "object" ? kv.balances : { ts: 0, by: "", entries: [] },
       subagentCostReset: !!kv.subagentCostReset,
       handoffLog: Array.isArray(kv.handoffLog) ? kv.handoffLog : [],

package/mcp.mjs

@@ -199,6 +199,45 @@ server.tool("relay_verify_gate", "Record a VERIFICATION GATE — a claim that MU
     return { content: [{ type: "text", text: r.dedup ? `gate already open (#${r.gate.id})` : `🔒 verification gate #${r.gate.id} recorded — surfaces on every handoff until you resolve it` }] };
   });
 
+server.tool("relay_propose", "PROPOSE a standing permission or scope change to the human operator — the ONLY approver; nothing auto-approves. A proposal must state its BOUND: scope (what), condition (when it applies), exclusions (what is still NOT covered) — a permission without a bound is a blank cheque and is rejected. It sits pending (max 3 per session — withdraw one to file another) until the operator decides in the app or CLI; you get a bus message with the decision. Denials are REMEMBERED: a near-duplicate of a denied proposal is refused, so never re-propose — refine the bound or move on. File it and continue your mission; never nag.",
+  { scope: z.string().describe("WHAT standing permission you want, specific and checkable — e.g. 'push directly to main in this repo'"),
+    condition: z.string().describe("WHEN it applies — e.g. 'only after the full test suite exits 0'"),
+    exclusions: z.string().describe("what is still NOT covered — e.g. 'never force-push, never touch release tags'"),
+    key: z.string().optional().describe("optional machine-readable capability slug (e.g. 'patrol.reap-orphans') — lets tools check the grant exactly instead of matching prose"),
+    project: z.string().optional().describe("project the permission concerns (default: this session's project)") },
+  async ({ scope, condition, exclusions, key, project }) => {
+    // signedPost directly (not api()) — a refusal's BODY is the teaching moment (denial note,
+    // queue guidance) and api() throws it away, leaving only "hub 409".
+    const r = await signedPost("/propose", { session: SESSION, project: project || PROJECT, scope, condition, exclusions, key }, { session: SESSION, instance: INSTANCE_ID });
+    if (!r.ok) {
+      const j = r.json || {};
+      const extra = j.note ? ` The operator's note on the prior denial: "${j.note}".` : "";
+      return { content: [{ type: "text", text: `REFUSED: ${j.error || `hub ${r.status}`}.${extra}` }], isError: true };
+    }
+    const pr = r.json.proposal;
+    return { content: [{ type: "text", text: r.json.dedup
+      ? `already pending as proposal #${pr.id} — the operator has it; do not re-file`
+      : `proposal #${pr.id} filed and PENDING operator review. Continue your mission — you'll get a bus message when it's decided. Do NOT act as if it were approved.` }] };
+  });
+
+server.tool("relay_proposals", "List THIS session's permission proposals and their statuses (pending / approved / denied / revoked / withdrawn), including the operator's decision notes. An APPROVED proposal is a standing GRANT — act within its stated bound without re-asking. Check here before relying on a permission you proposed — pending is not approved.", {},
+  async () => {
+    const { proposals } = await api("GET", `/proposals?session=${encodeURIComponent(SESSION)}`);
+    if (!proposals?.length) return { content: [{ type: "text", text: "no proposals filed by this session" }] };
+    const icon = { pending: "⏳", approved: "✅", denied: "⛔", withdrawn: "↩️", revoked: "🚫" };
+    const lines = proposals.map(p =>
+      `#${p.id} ${icon[p.status] || ""} ${p.status.toUpperCase()} — ${p.scope} · when: ${p.condition} · NOT covered: ${p.exclusions}${p.note ? ` · operator: "${p.note}"` : ""}`);
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+  });
+
+server.tool("relay_withdraw_proposal", "Withdraw one of THIS session's PENDING permission proposals (frees a queue slot — the pending queue caps at 3 per session).",
+  { id: z.number().describe("proposal id to withdraw (yours, pending only)") },
+  async ({ id }) => {
+    const r = await signedPost("/proposal/withdraw", { id, session: SESSION }, { session: SESSION, instance: INSTANCE_ID });
+    if (!r.ok) return { content: [{ type: "text", text: `could not withdraw: ${r.json?.error || `hub ${r.status}`}` }], isError: true };
+    return { content: [{ type: "text", text: `proposal #${id} withdrawn — one queue slot free` }] };
+  });
+
 server.tool("relay_board", "Show a project's Kanban board (all cards + their status + assignee). Defaults to THIS project; pass `project` to read a crew board you orchestrate from elsewhere.",
   { project: z.string().optional().describe("board to show (default: this session's project)") },
   async ({ project }) => {
@@ -278,12 +317,22 @@ server.tool("relay_wait", "Block up to `timeout` seconds waiting for the next me
 
 const HEARTBEAT_MS = Number(process.env.RELAY_HEARTBEAT_MS || 60 * 1000);
 
-// Mirror the SessionStart/PostToolUse hooks: a session opened in the home directory itself
-// isn't project work — auto-registering it would spawn a phantom "<username>" project board.
+// Mirror the SessionStart/PostToolUse hooks: some directories aren't project work, and
+// auto-registering from them spawns a phantom project lane that then sits in the sidebar forever.
+// PROJECT falls back to the cwd basename, so the directory name becomes the lane name:
+//   - the home directory itself      → a "<username>" lane
+//   - a plugin-cache snapshot        → a lane named after the VERSION, e.g. "0.17.66"
+// The second one is not hypothetical: `cd ~/.claude/plugins/cache/trantor/trantor/<ver> &&
+// node mcp.mjs` is the documented way to check the relay server still boots after a plugin
+// update, and every such check was leaving a version-numbered lane behind.
 // Opt in explicitly with RELAY_SESSION or RELAY_PROJECT. The MCP server still starts so the
 // user can call relay tools (e.g. relay_whoami) deliberately; we just skip auto-presence.
 const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-const isHomeDirSession = !process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && projectDir === homedir();
+const claudeDir = process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
+const nonProjectReason = projectDir === homedir() ? "home dir"
+  : projectDir.startsWith(join(claudeDir, "plugins", "cache")) ? "plugin cache"
+  : "";
+const isHomeDirSession = !process.env.RELAY_SESSION && !process.env.RELAY_PROJECT && !!nonProjectReason;
 
 if (!isHomeDirSession) {
   await api("POST", "/register", { session: SESSION, project: PROJECT, status: `active in ${PROJECT}` })
@@ -300,8 +349,8 @@ if (!isHomeDirSession) {
   // still exit cleanly when the agent closes the stdio transport (no phantom peers).
   setInterval(() => { api("POST", "/register", { session: SESSION, project: PROJECT }).catch(() => {}); }, HEARTBEAT_MS).unref?.();
 } else {
-  process.stderr.write("[trantor-mcp] home directory — not auto-registering on the bus (set RELAY_SESSION or RELAY_PROJECT to opt in)\n");
+  process.stderr.write(`[trantor-mcp] ${nonProjectReason} — not auto-registering on the bus (set RELAY_SESSION or RELAY_PROJECT to opt in)\n`);
 }
 
 await server.connect(new StdioServerTransport());
-process.stderr.write(`[trantor-mcp] connected as ${SESSION} -> ${URL_BASE}${isHomeDirSession ? " (no auto-presence: home dir)" : ` (heartbeat ${HEARTBEAT_MS}ms)`}\n`);
+process.stderr.write(`[trantor-mcp] connected as ${SESSION} -> ${URL_BASE}${isHomeDirSession ? ` (no auto-presence: ${nonProjectReason})` : ` (heartbeat ${HEARTBEAT_MS}ms)`}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.17.67",
+  "version": "0.17.69",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,9 +11,9 @@
     "pg": "^8.22.0"
   },
   "scripts": {
-    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && bash test-crew.sh"
+    "test": "node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-handoff.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-balances.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-inbox-delivery.mjs && node test-hub-routing.mjs && python3 engine/test-routing.py && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
-  "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
+  "description": "The hub-world for AI agent crews \u2014 orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [
     "hub.mjs",
     "mcp.mjs",
@@ -54,4 +54,4 @@
   "engines": {
     "node": ">=18"
   }
-}
+}