trantor 0.18.22 → 0.18.24

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.22",
+  "version": "0.18.24",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/bridge.mjs

@@ -110,7 +110,10 @@ async function tick() {
     if (differs && (aMoved || bMoved)) {
       const aWins = aMoved && bMoved ? p.origin === "A" : aMoved;
       const [src, dstHub, dstId] = aWins ? [ta, TO, p.bId] : [tb, FROM, p.aId];
-      const r = await call(dstHub, "POST", "/task/update", { id: dstId, status: src.status, assignee: src.assignee || "", by: src.by || "bridge" });
+      // reassign:true — the bridge REPLICATES a hand-change that already happened on the source
+      // hub; without the explicit marker the #5406 assignee-immutability guard would 409 every
+      // cross-hub sync whose assignee moved (deepseek flagged this at review, 2026-08-31).
+      const r = await call(dstHub, "POST", "/task/update", { id: dstId, status: src.status, assignee: src.assignee || "", reassign: true, by: src.by || "bridge" });
       if (aWins) { p.lastA = ta.updated || 0; p.lastB = r.task.updated || 0; }
       else { p.lastB = tb.updated || 0; p.lastA = r.task.updated || 0; }
       synced++;

package/bin/crew-payload.mjs

@@ -0,0 +1,115 @@
+// Payload composition for crew-runner turn prompts — pure, unit-testable (card #5683).
+//
+// A fresh codex seat burned 306k tokens and crash-looped into a remote-compact 404. The runner-side
+// part of that: every turn re-feeds the FULL lessons block (22,298 of the 24,698 chars in codex's
+// last turn file — 90%), plus an unbounded FYI-broadcast backlog that grows across a failure streak
+// and is replayed on every redelivery, on a RESUMED session where it all stacks. So every section
+// here is capped, and the assembled prompt has ONE hard total cap with a visible truncation notice.
+// Below the caps the output is byte-identical to the old string concatenation.
+
+export const PAYLOAD_CAPS = Object.freeze({
+  wakeCount: 10,       // direct/@mention messages: keep the last ~10
+  wakeMsgChars: 2000,  // per-message body cap (the hub caps card notes at 2000 too)
+  bcastCount: 10,      // FYI broadcast context: keep the last ~10
+  bcastMsgChars: 1000,
+  lessonsCount: 15,    // top ~15 lessons, ranked by relevance to this turn's trigger
+  lessonsChars: 16000,
+  totalChars: 40000,   // ONE hard total cap for the whole prompt
+});
+
+const WORD_RE = /[a-z0-9]{4,}/g;
+const n = v => Number(v).toLocaleString("en-US");
+
+// ---- wake messages (the task): keep the last `wakeCount`, cap each body ----
+export function capWake(wake, caps = PAYLOAD_CAPS) {
+  const list = Array.isArray(wake) ? wake : [];
+  const kept = list.slice(-caps.wakeCount);
+  const lines = kept.map(m => {
+    let body = String(m?.text ?? "");
+    if (body.length > caps.wakeMsgChars)
+      body = body.slice(0, caps.wakeMsgChars) + ` …[+${n(body.length - caps.wakeMsgChars)} chars of this message dropped]`;
+    return `[${m?.from}${m?.to === "all" ? " -> all (mentions you)" : ""}]: ${body}`;
+  });
+  return { text: lines.join("\n"), kept: kept.length, total: list.length };
+}
+
+// ---- FYI broadcast context (context only): keep the last `bcastCount`, cap each body ----
+export function capBcast(bcast, caps = PAYLOAD_CAPS) {
+  const list = Array.isArray(bcast) ? bcast : [];
+  const kept = list.slice(-caps.bcastCount);
+  const lines = kept.map(m => {
+    let body = String(m?.text ?? "");
+    if (body.length > caps.bcastMsgChars)
+      body = body.slice(0, caps.bcastMsgChars) + ` …[+${n(body.length - caps.bcastMsgChars)} chars dropped]`;
+    return `[${m?.from} -> all]: ${body}`;
+  });
+  return { text: lines.join("\n"), kept: kept.length, total: list.length };
+}
+
+// ---- lessons: top `lessonsCount` ranked by word overlap with this turn's trigger, then char-capped.
+// No trigger (kickoff/pulse) → no signal to rank on, so original order stands.
+export function pickLessons(lessons, trigger = "", caps = PAYLOAD_CAPS) {
+  const list = Array.isArray(lessons) ? lessons.filter(Boolean) : [];
+  if (!list.length) return { text: "", kept: 0, total: 0 };
+  const tw = new Set(String(trigger).toLowerCase().match(WORD_RE) || []);
+  const ranked = list
+    .map((l, i) => {
+      const words = String(l?.text || "").toLowerCase().match(WORD_RE) || [];
+      let score = 0;
+      for (const w of words) if (tw.has(w)) score++;
+      return { l, i, score };
+    })
+    .sort((a, b) => b.score - a.score || a.i - b.i)
+    .slice(0, caps.lessonsCount)
+    .sort((a, b) => a.i - b.i);
+  let budget = caps.lessonsChars;
+  const lines = [];
+  for (const { l } of ranked) {
+    const line = `- [${l?.scope}] ${l?.text}`;
+    if (line.length > budget) continue;   // doesn't fit — a shorter one may
+    budget -= line.length + 1;
+    lines.push(line);
+  }
+  if (!lines.length) return { text: "", kept: 0, total: list.length };
+  return {
+    text: "\n\nLESSONS from previous crews (hard-won — follow them):\n" + lines.join("\n"),
+    kept: lines.length,
+    total: list.length,
+  };
+}
+
+// ---- one composer, one hard total cap ----
+// sections: [{ name, text, trim?, order? }] joined in order. `trim: "drop"` removes the whole
+// section when the total is over `totalChars` (lowest `order` dropped first); `trim: "truncate"`
+// cuts the section to the remaining budget. Sections without `trim` are never touched — they are
+// the runner-authored frame. The payload carries a visible notice naming every trim.
+export function composePrompt(sections, caps = PAYLOAD_CAPS) {
+  const secs = sections.map(s => ({ ...s, text: String(s?.text ?? "") }));
+  let total = secs.reduce((a, s) => a + s.text.length, 0);
+  const dropped = [];
+  const trimmable = secs.filter(s => s.trim).sort((a, b) => a.order - b.order);
+  for (const s of trimmable) {
+    if (total <= caps.totalChars) break;
+    if (s.trim === "drop") {
+      dropped.push(`${s.name} (${n(s.text.length)} chars dropped)`);
+      total -= s.text.length;
+      s.text = "";
+    } else {
+      const rest = total - s.text.length;
+      const budget = Math.max(0, caps.totalChars - rest);
+      dropped.push(`${s.name} (${n(s.text.length)} → ${n(budget)} chars)`);
+      s.text = s.text.slice(0, budget) + " …[truncated — payload hit the hard cap]";
+      total = rest + s.text.length;
+    }
+  }
+  const prompt = secs.map(s => s.text).join("")
+    + (dropped.length
+      ? `\n\n[PAYLOAD TRUNCATED: hard cap ${n(caps.totalChars)} chars — ${dropped.join("; ")}.]`
+      : "");
+  return {
+    prompt,
+    sections: secs.map(s => ({ name: s.name, chars: s.text.length })),
+    truncated: dropped.length > 0,
+    dropped,
+  };
+}

package/bin/crew-runner.mjs

@@ -16,6 +16,7 @@ import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
+import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
 
 const AGENT = process.argv[2];
 const DIR = process.argv[3] || process.cwd();
@@ -483,14 +484,35 @@ function runTurn(prompt, isFirst, trigger = "kickoff") {
 const KICKOFF = process.env.CREW_KICKOFF ||
   `You just joined (your arrival was already announced on the bus). 1) relay_inbox — if a contract for you is already waiting, do it now per the Rules. 2) End your turn.\n\n${RULES}`;
 
-let LESSONS = "";
+let LESSONS_RAW = [];
 async function loadLessons() {
   try {
     const { lessons } = await api(`/lessons?agent=${encodeURIComponent(AGENT)}`);
-    if (lessons?.length) LESSONS = "\n\nLESSONS from previous crews (hard-won — follow them):\n" + lessons.map(l => `- [${l.scope}] ${l.text}`).join("\n");
+    if (lessons?.length) LESSONS_RAW = lessons;
   } catch {}
 }
 
+// card #5683: every section of a turn prompt is capped (bin/crew-payload.mjs) and the whole
+// payload has ONE hard total cap. Codex burned 306k tokens into a remote-compact 404 crash-loop
+// because a resumed session re-fed the full lessons block (22,298 of the 24,698 chars in its last
+// turn file — 90%) plus an unbounded broadcast backlog on EVERY turn, redelivery after redelivery.
+// Below the caps the composition is byte-identical to the old concatenation.
+function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "", tailText = "", rulesText = "", lessons = null }) {
+  const built = composePrompt([
+    { name: "base", text: base },
+    { name: "wake", text: wakeText, trim: "truncate", order: 4 },
+    { name: "ctx", text: ctxText, trim: "drop", order: 1 },
+    { name: "again", text: againText },
+    { name: "tail", text: tailText },
+    { name: "rules", text: rulesText, trim: "drop", order: 3 },
+    { name: "lessons", text: lessons?.text || "", trim: "drop", order: 2 },
+  ]);
+  const parts = built.sections.filter(s => s.chars).map(s => `${s.name} ${s.chars.toLocaleString("en-US")}c`).join(" · ");
+  const lessonsNote = lessons && lessons.total ? ` (lessons ${lessons.kept}/${lessons.total})` : "";
+  log(`payload: ${parts}${lessonsNote} → ${built.prompt.length.toLocaleString("en-US")}c${built.truncated ? ` \x1b[33mTRUNCATED — ${built.dropped.join("; ")}\x1b[0m` : ""}`);
+  return built.prompt;
+}
+
 (async () => {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
@@ -520,7 +542,7 @@ async function loadLessons() {
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
 
-  const ec0 = runTurn(KICKOFF + LESSONS, true, "kickoff");
+  const ec0 = runTurn(composedTurn({ base: KICKOFF, lessons: pickLessons(LESSONS_RAW, "") }), true, "kickoff");
   if (ec0) await reportFailure(ec0, "kickoff", pendingWake.length);   // a failed kickoff = the "fired up, died, nobody knew" case
   let lastTurnAt = Date.now();
   if (PULSE_MS) log(`pulse armed — mission re-read every ${Math.round(PULSE_MS / 1000)}s (${MISSION_FILE})`);
@@ -530,7 +552,7 @@ async function loadLessons() {
     // pulse first: a due mission beat runs even on a silent bus. Measured from the END of the
     // last turn, so a long turn doesn't stack an immediate pulse on top of itself.
     if (PULSE_MS && Date.now() - lastTurnAt >= PULSE_MS) {
-      const ecp = runTurn(PULSE_PROMPT + "\n\n" + RULES + LESSONS, false, "pulse");
+      const ecp = runTurn(composedTurn({ base: PULSE_PROMPT + "\n\n", rulesText: RULES, lessons: pickLessons(LESSONS_RAW, PULSE_PROMPT) }), false, "pulse");
       if (ecp) await reportFailure(ecp, "pulse"); else await reportHealthy();
       lastTurnAt = Date.now();
       log("parked — waiting for the next message or pulse");
@@ -589,22 +611,33 @@ async function loadLessons() {
   // queued, on disk, with a backoff — which is the whole point of the change.
   async function deliverWake() {
     const wake = pendingWake;
-    const ctx = pendingBcast.length ? `\nFYI broadcasts since your last turn (context only):\n${pendingBcast.map(m => `[${m.from} -> all]: ${m.text}`).join("\n")}\n` : "";
-    const lines = wake.map(m => `[${m.from}${m.to === "all" ? " -> all (mentions you)" : ""}]: ${m.text}`).join("\n");
+    const wakeCapped = capWake(wake);
+    const bcastCapped = capBcast(pendingBcast);
+    const wakeText = wakeCapped.text
+      ? `NEW BUS MESSAGE${wake.length > 1 ? "S" : ""} for you:\n${wakeCapped.text}\n`
+      : "";
+    const ctxText = bcastCapped.text
+      ? `\nFYI broadcasts since your last turn (context only):\n${bcastCapped.text}\n`
+      : "";
     // Say plainly that this is a second look. Without it the model re-reads an old escalation as
     // brand new and can redo work it already half-did before the turn died.
-    const again = deliveryFails
+    const againText = deliveryFails
       ? `\n(REDELIVERY, attempt ${deliveryFails + 1} — an earlier turn failed before acting on ${wake.length > 1 ? "these" : "this"}. Check what you already did before repeating it.)\n`
       : "";
-    const prompt = `NEW BUS MESSAGE${wake.length > 1 ? "S" : ""} for you:\n${lines}\n${ctx}${again}\nAct on what's addressed to you, then end your turn.\n\n${RULES}`;
     await loadLessons();
+    const lessons = pickLessons(LESSONS_RAW, wakeCapped.text + " " + bcastCapped.text);
     const trigger = wake.some(m => m.to === SESSION) ? "direct message" : "@mention";
     // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success.
     const assigners = [];
     for (const m of wake) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
     const asked = String(wake[0]?.text || "").replace(/\s+/g, " ").trim().slice(0, 90);
     const tStart = Date.now();
-    const ec = runTurn(prompt + LESSONS, false, deliveryFails ? `${trigger} (redelivery)` : trigger);
+    const prompt = composedTurn({
+      wakeText, ctxText, againText,
+      tailText: "\nAct on what's addressed to you, then end your turn.\n\n",
+      rulesText: RULES, lessons,
+    });
+    const ec = runTurn(prompt, false, deliveryFails ? `${trigger} (redelivery)` : trigger);
     const secs = Math.round((Date.now() - tStart) / 1000);
     if (ec) {
       deliveryFails++;

package/hooks/sessionstart.mjs

@@ -369,6 +369,23 @@ try {
     }
   } catch {}
 
+  // THE ORCHESTRATOR ROLE (2026-08-31 — the operator had to say it by hand, twice in one day:
+  // "your job is to oversee and be a project manager, not a coder"). A session opened by
+  // `trantor open` carries TRANTOR_ORCH=<project>; every such session gets the doctrine at
+  // boot, so the role survives wakes, handoffs and restarts without anyone restating it.
+  try {
+    if (project && (process.env.TRANTOR_ORCH || "") === project) {
+      additionalContext += `<trantor-orchestrator-role project="${sanitize(project)}">\n` +
+        `🎛️ **You are this project's ORCHESTRATOR — a project manager, not a coder** (operator ruling, 2026-08-31).\n` +
+        `- Building goes to the CREW: invoke the trantor:crew skill (Advisor → \`trantor up\` seats → contracts over the bus), or relay_scrooge for grunt one-shots.\n` +
+        `- Spend your own tokens on design, contracts, supervision, integration and VERIFICATION — run the seats' tests yourself; bounce hollow dones.\n` +
+        `- Write code yourself ONLY for small one-head seam work that needs this session's full context — and say so when you do.\n` +
+        `- Check relay_inbox and the board before asking the operator anything a peer may already have answered.\n` +
+        `</trantor-orchestrator-role>\n`;
+      process.stderr.write(`[trantor] injected orchestrator-role doctrine for ${project}\n`);
+    }
+  } catch {}
+
   // Update available? Surface it the way a terminal tool should — an in-terminal `systemMessage`
   // line the USER sees at session start (NOT a macOS desktop popup, which macOS misattributes to
   // Script Editor and which fires off-screen). It shows every session while an update is pending and

package/hub.mjs

@@ -435,7 +435,12 @@ setTimeout(overseerTick, 2000).unref?.();
 // Env still wins at boot (an operator's declared config beats a seat's claim); otherwise the last
 // registered seat is restored from state, so a hub restart doesn't silently end the duty feed.
 let DUTY_SESSION = String(process.env.RELAY_DUTY_SESSION || state.dutySession || "");
-const DUTY_UNDELIVERED_MS = Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 10 * 60 * 1000);
+// 2 MINUTES, not 10 (2026-08-31): scribe DMed the woken crebral-health session at 16:11 and the
+// operator hand-relayed at 16:21:58 — beating the old 10m escalation by seconds. Two agents
+// actively collaborating cannot wait ten minutes; with duty's direct-wake the full chain
+// (escalate → duty nudge → target's hooks poll) now lands in ~3m. Duty's own batch rules
+// (one nudge per recipient per batch, consumed on activity) keep the shorter window from nagging.
+const DUTY_UNDELIVERED_MS = Number(process.env.RELAY_DUTY_UNDELIVERED_MS || 2 * 60 * 1000);
 const dutyEscalated = new Set();
 // #5686: the janitor died 08-27 and NOTHING noticed for 4 days — the hub kept escalating to a
 // corpse. Duty liveness is now a first-class state: dark = configured but no heartbeat inside
@@ -1908,6 +1913,22 @@ const server = http.createServer(async (req, res) => {
     if (req.method === "POST" && P === "/task/update") {    // move/edit a card
       const b = await body(req); const t = state.tasks.find(x => x.id === Number(b.id));
       if (!t) return json(res, 404, { error: "no such task" });
+      // Board integrity (#5406): a card can never change hands silently. The assignee is frozen once
+      // set; a mutation is legitimate only as a HANDOFF (the current assignee reassigning to someone
+      // else) or an EXPLICIT reassign (reassign:true — e.g. the orchestrator re-routing work after a
+      // seat dies). A silent third-party overwrite 409s so the caller knows the board refused to move.
+      // Runs BEFORE any other field mutation so a refused steal cannot half-apply a status move.
+      if (b.assignee !== undefined) {
+        const want = String(b.assignee).slice(0, 60);
+        if (want !== t.assignee) {
+          const mover = String(auth?.identity?.name || b.by || "").slice(0, 120);
+          const isOwner = !!t.assignee && mover === t.assignee;
+          const explicit = b.reassign === true;
+          if (!isOwner && !explicit) {
+            return json(res, 409, { error: "assignee is immutable", id: t.id, assignee: t.assignee });
+          }
+        }
+      }
       let eventType = "updated", eventFrom = null, eventTo = null;
       if (b.status && ["todo","doing","testing","failed","done","blocked","stale"].includes(b.status) && b.status !== t.status) {
         eventType = "moved"; eventFrom = t.status; eventTo = b.status;
@@ -1925,7 +1946,13 @@ const server = http.createServer(async (req, res) => {
       if (b.difficulty && ["easy","medium","hard"].includes(b.difficulty)) t.difficulty = b.difficulty;
       if (b.model !== undefined) t.model = String(b.model).slice(0, 60);
       if (Array.isArray(b.deps)) t.deps = [...new Set(b.deps.map(Number).filter(n => Number.isInteger(n) && n > 0 && n !== t.id))].slice(0, 20);
-      if (b.assignee !== undefined) t.assignee = b.assignee;
+      if (b.assignee !== undefined && String(b.assignee).slice(0, 60) !== t.assignee) {
+        const prev = t.assignee || "(none)";
+        const mover = String(auth?.identity?.name || b.by || "").slice(0, 120);
+        t.assignee = String(b.assignee).slice(0, 60);
+        // the handover is part of the card's story, not a silent overwrite
+        appendTaskLog(t, mover, `reassigned ${prev} → ${t.assignee}${b.reassign === true ? " (explicit)" : " (handoff)"}`, now());
+      }
       if (b.title !== undefined) t.title = String(b.title).slice(0,200);
       // the narrative line a human reads on the board ("assigned — did"), written by the cheap
       // summarizer; rides the tasks.extra column, so it survives restarts everywhere

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.22",
+  "version": "0.18.24",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"