trantor 0.18.35 → 0.18.36

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.35",
+  "version": "0.18.36",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew-runner.mjs

@@ -9,7 +9,7 @@
 // agent arrives it RESUMES the CLI session (native resume = full context kept) with that
 // message as the prompt. The model just works and ends its turn; the runner does the rest.
 import { execSync, spawnSync, spawn } from "node:child_process";
-import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, unlinkSync, existsSync, appendFileSync, mkdirSync, realpathSync } from "node:fs";
 import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project.mjs";
@@ -109,6 +109,26 @@ function ensureSeatWorktree(sourceDir) {
 }
 
 const TURN_DIR = ensureSeatWorktree(DIR);
+
+// #6154: opencode prints no session id on stdout, but it records every session in its own sqlite
+// DB with the directory the session was created in. The newest row for OUR worktree is the only
+// session a resume may pin — anything else in that DB belongs to another project on this machine,
+// which is exactly what `run -c` used to hand us. Read-only, fail-open: no DB or no row means the
+// next turn starts fresh, which is always safe, instead of resuming a stranger, which never is.
+const OC_DB = join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "opencode", "opencode.db");
+function ocSid(dir) {
+  try {
+    // opencode stores the directory as IT sees its cwd, which on macOS can be the /private/var
+    // realpath of the /var/... path the runner holds — query both spellings.
+    const dirs = [dir];
+    try { const real = realpathSync(dir); if (real !== dir) dirs.push(real); } catch {}
+    const list = dirs.map((d) => `'${d.replaceAll("'", "''")}'`).join(", ");
+    const q = `SELECT id FROM session WHERE directory IN (${list}) ORDER BY time_updated DESC LIMIT 1;`;
+    const r = spawnSync("sqlite3", ["-readonly", OC_DB, q], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 });
+    const id = String(r.stdout || "").trim();
+    return /^ses_[A-Za-z0-9]+$/.test(id) ? id : "";
+  } catch { return ""; }
+}
 // RUNNER_SESSION override: an orchestrator seat (bin/orchestrate.mjs) runs the same CLI as a crew
 // seat but must live on the bus under its own name (claude-orch:proj), or it would collide with a
 // plain claude crew seat on the same project.
@@ -244,16 +264,25 @@ const CLI = {
   // --yolo in prompt mode (prompt mode auto-approves tools), and emits session_-prefixed ids.
   kimi:     { first: `kimi{M} -p "$(cat {P})" < /dev/null`,
               next:  `kimi{M} -r {SID} -p "$(cat {P})" < /dev/null`, mflag: " --model ", sid: /To resume this session: kimi -r (\S+)/ },
-  deepseek: { first: `opencode run{M} "$(cat {P})"`,
-              next:  `opencode run -c{M} "$(cat {P})"`, mflag: " -m ", env: join(homedir(), ".token-scrooge", ".env") },
-  opencode: { first: `opencode run{M} "$(cat {P})"`,
-              next:  `opencode run -c{M} "$(cat {P})"`, mflag: " -m ", env: join(homedir(), ".token-scrooge", ".env") },
+  // #6154: the opencode family never resumes blind. `run -c` continues the GLOBALLY last session
+  // on this machine — any project's (opencode.db showed a pr-os session interleaved between two
+  // trantor ones) — and the resumed session's stored directory becomes the Location every relative
+  // path resolves against. A seat then `cd desktop/src-tauri` inside its own worktree while
+  // opencode resolves it against a stranger's root, the bash tool reads it as external_directory
+  // and auto-rejects, and the turn dies mid-work with everything uncommitted. So: every spawn
+  // pins --dir to the seat worktree, and a resume pins -s to the session id looked up from
+  // opencode's own DB by directory — the session CREATED here (ocSid below). A missed lookup
+  // degrades to a fresh session, never to a foreign one.
+  deepseek: { first: `opencode run --dir {DIR}{M} "$(cat {P})"`,
+              next:  `opencode run --dir {DIR} -s {SID}{M} "$(cat {P})"`, mflag: " -m ", pinned: true, env: join(homedir(), ".token-scrooge", ".env") },
+  opencode: { first: `opencode run --dir {DIR}{M} "$(cat {P})"`,
+              next:  `opencode run --dir {DIR} -s {SID}{M} "$(cat {P})"`, mflag: " -m ", pinned: true, env: join(homedir(), ".token-scrooge", ".env") },
   // OpenRouter rides the opencode CLI exactly like deepseek/glm, but under its OWN agent label so
   // its bus identity is `openrouter:<project>` (RELAY_AGENT is set per-spawn) — never colliding with
   // the glm `opencode` seat. Model ids come pre-qualified (`openrouter/<vendor>/<model>`). Sources
   // the token-scrooge .env so an existing OPENROUTER_API_KEY authenticates with no extra wiring.
-  openrouter: { first: `opencode run{M} "$(cat {P})"`,
-              next:  `opencode run -c{M} "$(cat {P})"`, mflag: " -m ", env: join(homedir(), ".token-scrooge", ".env") },
+  openrouter: { first: `opencode run --dir {DIR}{M} "$(cat {P})"`,
+              next:  `opencode run --dir {DIR} -s {SID}{M} "$(cat {P})"`, mflag: " -m ", pinned: true, env: join(homedir(), ".token-scrooge", ".env") },
   claude:   { first: `claude{M} -p "$(cat {P})" --dangerously-skip-permissions`,
               next:  `claude -c{M} -p "$(cat {P})" --dangerously-skip-permissions`, mflag: " --model " },
   // DeepSeek Harness. Every turn is a FRESH session — headless has no resume yet — so the seat
@@ -275,7 +304,7 @@ if (!CLI[AGENT]) log(`'${AGENT}' is not a built-in seat — running it as an ope
 
 // RUNNER_RULES / RUNNER_KICKOFF env overrides: the runner is also the substrate for non-crew
 // always-on seats (the fleet DUTY agent, bin/duty.mjs) whose doctrine is not "work your card".
-const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message.`;
+const RULES = process.env.RUNNER_RULES || `Rules: you are ${SESSION} on the trantor crew. Before starting a card, read YOUR card: relay_board with card:<id> (the card, its deps, its notes, and the last five done cards whose title shares a word); never the whole board. Work your assigned file(s), report on the bus (relay_send, <280 chars), move your Kanban card as you go with a NOTE saying what you did (doing -> testing -> done; in 'testing' run YOUR OWN test file — never the full npm test, suites collide across seats — plus \`node bin/slop-gate.mjs\` when the repo has one: it lints ONLY your changed files against the anti-slop rules, and a card must not reach done with slop-gate failing; use 'failed' + a report if anything breaks). If you need something from another session, message THAT SESSION (relay_peers to find its id, relay_send to reach it) — never ask the human to pass it along; carrying messages between agents is the job this bus exists to remove. When your work for THIS message is finished, END YOUR TURN — do NOT park, do NOT loop relay_wait; the runner waits for you and will wake you with the next message. Path discipline: build/test from your worktree root ${TURN_DIR} with absolute paths or --manifest-path/--prefix instead of cd-ing into subdirs, and put anything that must land outside the repo under ${TURN_DIR}/.agent-bus-out/ (gitignored) — never ~/.agent-bus.`;
 
 // ---- the pulse (Scape's Lloyd/Argus loop, Trantor-shaped) --------------------
 // A message-driven seat is DEAF between messages. An orchestrator seat with a mission needs a
@@ -520,9 +549,11 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // exit-0 turn with real output must never be re-labelled "auth" by the #5405 escalation — the
   // qwen specimen committed aa3c340 while its captured stream still tripped the auth regex.
   const headBefore = gitOut(["rev-parse", "HEAD"], TURN_DIR);
-  let cmd = (isFirst || (cli.sid && !sid)) ? cli.first : cli.next;
+  // #6154: a pinned seat with no sid yet resumes as FRESH — the guard below fails open, because
+  // a resume without an id must fall back to a new session, never to `next`'s bare resume shape.
+  let cmd = (isFirst || ((cli.sid || cli.pinned) && !sid)) ? cli.first : cli.next;
   const mfrag = MODEL && cli.mflag ? `${cli.mflag}${MODEL}` : "";
-  cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid);
+  cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid).replaceAll("{DIR}", TURN_DIR);
   // PRECEDENCE, and it is easy to get backwards — this is the second time.
   // Each file is PREPENDED, so the one prepended LAST runs FIRST, and in shell the file that runs
   // LAST wins. To make ~/.agent-bus/.env (the CREW layer) win it must be prepended FIRST, i.e.
@@ -558,6 +589,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // the window with no ERRF growth earns ONE direct stall report to the foreman, never a kill.
   const WD_MS = Number(process.env.TRANTOR_TURN_WATCHDOG_MS || 15 * 60 * 1000);
   const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${AGENT}-${PROJ}.json`);
+  // Written by the shell's own time box (below) and read back here — the only honest signal that
+  // the turn was CUT rather than that the CLI failed on its own. Cleared before every turn.
+  const CUTF = join(homedir(), ".agent-bus", `turncut-${AGENT}-${PROJ}`);
+  try { unlinkSync(CUTF); } catch {}
   try {
     writeFileSync(STAMPF, JSON.stringify({ turn: TURN, startedAt: Date.now() }));
     const wd = spawn(process.execPath, [join(import.meta.dirname, "turn-watchdog.mjs"), STAMPF, ERRF, String(WD_MS), SESSION, PROJ, HUB],
@@ -567,7 +602,34 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // Preserve the CLI's exit before waiting for the stderr process substitution. Without the
   // explicit wait, a short failing CLI can return while its error is still in the scrub pipe;
   // under load the classifier then reads an empty ERRF and reports the wrong failure reason.
-  const shell = `set -o pipefail; { ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF}); turn_exit=$?; wait; exit $turn_exit`;
+  // #6134-followup: the time box has to fire from INSIDE the shell, while the process tree is
+  // still standing. Killing the turn's process group from node missed a grandchild — codex runs
+  // its own commands via setsid, so `sleep 400` sat in a different group and survived
+  // process.kill(-pid). Worse, by the time node's timeout has killed bash the survivors have been
+  // reparented to init, so there is no tree left to walk and nothing to sweep.
+  //
+  // So bash boxes itself: at the deadline it walks its own descendants and kills them bottom-up.
+  // setsid changes a process's group and session but NEVER its parent, so `pgrep -P` recursion
+  // reaches exactly the children that a group signal cannot. Children first, then the parent, so
+  // nothing gets reparented mid-sweep and escapes the walk.
+  //
+  // The marker file is how node learns the turn was cut rather than merely failing: an exit status
+  // alone cannot tell "killed at the box" from "the CLI died on its own".
+  const sweep = `sweep() { local p; for p in $(pgrep -P $1 2>/dev/null); do sweep $p; done; kill -KILL $1 2>/dev/null; }`;
+  const box = TURN_MAX_MS ? `
+${sweep}
+( sleep ${Math.ceil(TURN_MAX_MS / 1000)}
+  kill -0 $job 2>/dev/null || exit 0
+  : > ${CUTF}
+  sweep $job
+) & boxpid=$!` : "boxpid=";
+  const shell = `set -o pipefail
+{ ${inner} ; } 2> >(${SCRUB} --tee2 ${ERRF}) &
+job=$!${box}
+wait $job; turn_exit=$?
+[ -n "$boxpid" ] && kill $boxpid 2>/dev/null
+wait
+exit $turn_exit`;
   const r = spawnSync("/bin/bash", ["-c", shell], {
     // detached: bash leads its OWN process group, so the time box can kill the CLI and everything
     // it spawned with one signal instead of orphaning the model process behind a dead shell.
@@ -576,7 +638,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
     // takes SIGTTIN and stops forever. Nothing here runs interactively — every CLI is in -p /
     // exec / run mode — so closing stdin is what makes the group safe.
     detached: true,
-    ...(TURN_MAX_MS ? { timeout: TURN_MAX_MS, killSignal: "SIGKILL" } : {}),
+    // A BACKSTOP only, deliberately later than the shell's own box: if bash itself wedges, node
+    // still ends the turn. When the in-shell box works — the normal path — this never fires, which
+    // is the point: the shell kills while the tree is still walkable, node cannot.
+    ...(TURN_MAX_MS ? { timeout: TURN_MAX_MS + 30000, killSignal: "SIGKILL" } : {}),
     cwd: TURN_DIR, encoding: "utf8", stdio: cli.sid ? ["ignore", "pipe", "inherit"] : ["ignore", "inherit", "inherit"],
     env: { ...process.env, RELAY_URL: HUB, RELAY_AGENT: AGENT, RELAY_SESSION: SESSION, RELAY_PROJECT: PROJ,
       // A RUNNER-MANAGED SEAT MUST NEVER HAND ITSELF A BATON.
@@ -593,13 +658,15 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
     maxBuffer: 16 * 1024 * 1024,
   });
   try { unlinkSync(STAMPF); } catch {}   // turn over — disarm the watchdog
-  // #6134: node's timeout signals only the shell it spawned. The CLI and its children share the
-  // detached group, so sweep the whole group — otherwise a boxed turn leaves a model still running
-  // (and still billing) against a runner that has moved on.
-  const cut = !!TURN_MAX_MS && (r.error?.code === "ETIMEDOUT" || (r.signal === "SIGKILL" && Date.now() - t0 >= TURN_MAX_MS));
-  if (cut && r.pid) {
-    try { process.kill(-r.pid, "SIGKILL"); } catch {}
-    log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI process group ended\x1b[0m`);
+  // The shell's box leaves the marker; the backstop leaves an ETIMEDOUT. Either way the turn was
+  // cut, not merely failed.
+  const boxed = existsSync(CUTF);
+  const cut = !!TURN_MAX_MS && (boxed || r.error?.code === "ETIMEDOUT");
+  if (cut) {
+    // Belt and braces after the shell's descendant sweep: anything still sharing the turn's group.
+    if (r.pid) { try { process.kill(-r.pid, "SIGKILL"); } catch {} }
+    try { unlinkSync(CUTF); } catch {}
+    log(`\x1b[33mturn cut at the ${Math.round(TURN_MAX_MS / 1000)}s time box — CLI and every descendant ended${boxed ? "" : " (node backstop: bash itself was wedged)"}\x1b[0m`);
   }
   // #5869: scrub AT REST, synchronously, before anything reads the file back. The explicit shell
   // wait above drains the live stderr scrubber first; this pass is defense in depth for redaction.
@@ -612,6 +679,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   try { ownOut = stripPromptEcho(readFileSync(ERRF, "utf8"), readPromptText(pf)); } catch { ownOut = ""; }
   lastErrText = ownOut.slice(-4000);
   if (cli.sid && r.stdout) { const m = r.stdout.match(cli.sid); if (m) sid = m[1]; }
+  // #6154: the opencode family prints no sid on stdout — the id comes from opencode's own DB,
+  // keyed by the worktree the session was created in. Fail-open: nothing found leaves sid empty,
+  // and the next turn starts fresh rather than resuming whatever other project ran last.
+  if (cli.pinned) { const found = ocSid(TURN_DIR); if (found) sid = found; }
   const realExit = r.status;
   // A zero exit is NOT proof the turn ran: opencode prints "401 Unauthorized" / "Invalid API key"
   // and exits 0, so a bare 0 made the runner ack "✅ done", clear the pending queue and heartbeat

package/hub.mjs

@@ -10,7 +10,7 @@ import { homedir, hostname } from "node:os";
 import { join } from "node:path";
 import { timingSafeEqual, randomBytes } from "node:crypto";
 import { verifyRequest, verifyEndorsement, publicView } from "./lib/identity.mjs";
-import { DEFAULT_ORG } from "./lib/store-contract.mjs";
+import { DEFAULT_ORG, IDENTITY_KINDS } from "./lib/store-contract.mjs";
 import { assertNoSecrets } from "./lib/scrub.mjs";
 import { createPersistHealth } from "./lib/persist-health.mjs";
 
@@ -220,7 +220,12 @@ function normalizeState(loaded = {}) {
     // migrate old numeric form
     s.peers[session] = typeof v === "number"
       ? { lastSeen: v, status: "", project: "" }
-      : { lastSeen: v.lastSeen || 0, status: v.status || "", project: v.project || "", pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "", hookVersion: v.hookVersion || "", deliveredUpTo: v.deliveredUpTo || v.delivered_up_to || 0, _on: v._on === true || v.online === true };
+      // #6170: `kind` must be carried across the load. This normalizer rebuilds every peer from an
+      // explicit field list, so a field missing here is dropped no matter how faithfully the store
+      // returned it — which is exactly what happened: the column was added, Postgres held the right
+      // values, and the kinds still came back empty on the first live restart. llm/model stay
+      // out on purpose: those ARE in-memory presence, re-supplied by the next heartbeat.
+      : { lastSeen: v.lastSeen || 0, status: v.status || "", project: v.project || "", pubkey: v.pubkey || "", identity: v.identity || null, authWarning: v.authWarning || "", hookVersion: v.hookVersion || "", kind: v.kind || "", deliveredUpTo: v.deliveredUpTo || v.delivered_up_to || 0, _on: v._on === true || v.online === true };
   }
   return s;
 }
@@ -1447,6 +1452,10 @@ const server = http.createServer(async (req, res) => {
       const raw = req._rawBody || "";
       const verified = verifyRequest({ headers: req.headers, method: req.method, path: authPath(u), body: raw });
       if (!verified.ok) return json(res, 401, { error: verified.reason || "bad signature" });
+      const requestedKind = String(b0.kind || "agent").slice(0, 40);
+      if (!IDENTITY_KINDS.includes(requestedKind)) {
+        return json(res, 400, { error: `kind must be one of: ${IDENTITY_KINDS.join(", ")}`, allowedKinds: IDENTITY_KINDS });
+      }
       const existing = findIdentity(verified.pubkey);
       if (existing) return json(res, 200, { ok: true, identity: publicView(existing), scopes: existing.scopes || [] });
       let enrolledBy = "";
@@ -1482,7 +1491,7 @@ const server = http.createServer(async (req, res) => {
       }
       const identity = {
         name: String(b0.name || "").slice(0, 120) || verified.pubkey.slice(0, 16),
-        kind: String(b0.kind || "agent").slice(0, 40),
+        kind: requestedKind,
         pubkey: verified.pubkey,
         createdAt: now(),
         enrolledBy,
@@ -1501,6 +1510,10 @@ const server = http.createServer(async (req, res) => {
       const az = authorize(auth, req.method, P, "*");
       if (!az.ok) return json(res, az.code || 403, { error: az.error || "forbidden" });
       const bi = await body(req);
+      const invitedKind = String(bi.kind || "agent").slice(0, 40);
+      if (!IDENTITY_KINDS.includes(invitedKind)) {
+        return json(res, 400, { error: `kind must be one of: ${IDENTITY_KINDS.join(", ")}`, allowedKinds: IDENTITY_KINDS });
+      }
       const scopes = (Array.isArray(bi.scopes) ? bi.scopes : []).map(cleanScope).filter(Boolean).slice(0, 20);
       if (!scopes.length) return json(res, 400, { error: "scopes required" });
       // Honour the requested TTL. A 60s FLOOR here silently inflated `ttlSec: 1` to a minute, so a
@@ -1508,7 +1521,7 @@ const server = http.createServer(async (req, res) => {
       // a live token straight through /enroll. Cap the ceiling, never the floor.
       const ttlSec = Math.min(Math.max(Number(bi.ttlSec) || 86400, 1), 30 * 86400);
       const token = randomBytes(24).toString("hex");
-      state.inviteTokens[token] = { scopes, expiresAt: now() + ttlSec * 1000, used: false,
+      state.inviteTokens[token] = { scopes, kind: invitedKind, expiresAt: now() + ttlSec * 1000, used: false,
         createdBy: auth.identity?.pubkey || "", createdAt: now() };
       dirty = true;
       return json(res, 200, { ok: true, token, scopes, expiresAt: state.inviteTokens[token].expiresAt });

package/lib/enroll.mjs

@@ -45,9 +45,10 @@ export async function ensureEnrolled(hubUrl, identity, project, { timeoutMs = 40
   if (!owner?.privkey) return { ok: false, reason: "no-owner-key" };
 
   try {
+    const identityKind = kind || identity.kind || "agent";
     const inv = await sfetch(`${hubUrl}/invite`, {
       method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ scopes: [{ project, role: "write" }], ttlSec: 300 }),
+      body: JSON.stringify({ scopes: [{ project, role: "write" }], ttlSec: 300, kind: identityKind }),
       signal: AbortSignal.timeout(timeoutMs),
     }, owner);
     if (!inv.ok) return { ok: false, reason: `invite-${inv.status}` };
@@ -55,7 +56,7 @@ export async function ensureEnrolled(hubUrl, identity, project, { timeoutMs = 40
 
     const en = await sfetch(`${hubUrl}/enroll`, {
       method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ name: identity.name, kind: kind || identity.kind || "agent", token }),
+      body: JSON.stringify({ name: identity.name, kind: identityKind, token }),
       signal: AbortSignal.timeout(timeoutMs),
     }, identity);
     return en.ok ? { ok: true, reason: "enrolled" } : { ok: false, reason: `enroll-${en.status}` };

package/lib/store-contract.mjs

@@ -20,6 +20,9 @@
 // an empty schema is free; adding it after 1,542 cards have migrated is surgery on live data.
 // ---------------------------------------------------------------------------------------------
 export const SCHEMA_VERSION = 1;
+export const IDENTITY_KINDS = Object.freeze(["human", "agent", "tool"]);
+
+const IDENTITY_KINDS_SQL = IDENTITY_KINDS.map(kind => `'${kind}'`).join(",");
 
 export const SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS orgs (
@@ -41,13 +44,19 @@ CREATE TABLE IF NOT EXISTS identities (
   pubkey      TEXT PRIMARY KEY,
   org_id      TEXT REFERENCES orgs(id) ON DELETE CASCADE,
   name        TEXT NOT NULL,
-  kind        TEXT NOT NULL CHECK (kind IN ('human','agent')),
+  kind        TEXT NOT NULL CHECK (kind IN (${IDENTITY_KINDS_SQL})),
   scopes      JSONB NOT NULL DEFAULT '{}'::jsonb,   -- { "<project>": "owner"|"write"|"read" }
   enrolled_by TEXT,
   created_at  BIGINT NOT NULL,
   revoked_at  BIGINT                                 -- set, never deleted: revocation is audit
 );
 
+-- 2026-09-03: installs created under CHECK (kind IN ('human','agent')) widen on boot; the genesis
+-- identity enrols as 'tool' (#6068) and the narrower check poisoned every persist delta for 13 min.
+ALTER TABLE identities DROP CONSTRAINT IF EXISTS identities_kind_check;
+ALTER TABLE identities ADD CONSTRAINT identities_kind_check CHECK (kind IN (${IDENTITY_KINDS_SQL}));
+
+
 -- THE LOG. Append-only, never updated, never deleted except by retention. Everything else derives.
 CREATE TABLE IF NOT EXISTS events (
   id         BIGSERIAL PRIMARY KEY,
@@ -120,8 +129,19 @@ CREATE TABLE IF NOT EXISTS peers (
   last_seen       BIGINT,
   online          BOOLEAN DEFAULT FALSE,
   delivered_up_to BIGINT DEFAULT 0,
+  kind            TEXT,                  -- #6170: WHAT this session is — 'agent' (crew seat),
+                                         -- 'orch', 'genesis', 'tool'. The overseer's crew
+                                         -- exemption reads it (#6075/#6148), so when a restart
+                                         -- forgot it the hub warned about its own crew.
   PRIMARY KEY (org_id, session)
 );
+-- additive migration for hubs whose peers table predates the kind column (#6170)
+ALTER TABLE peers ADD COLUMN IF NOT EXISTS kind TEXT;
+-- DELIBERATELY no CHECK on peers.kind, unlike identities.kind above. The hub accepts whatever a
+-- client stamps (hub.mjs /register takes any string up to 40 chars) and the vocabulary grows with
+-- the product — 'genesis' arrived in #6068, 'orch' in #6075. #6169 is the cost of getting this
+-- wrong in the other direction: a CHECK narrower than the values in flight poisoned every persist
+-- delta for 13 minutes. A column that stores what it is given cannot fail that way.
 
 -- The fields that currently ride in-memory and are LOST on restart. This is the debt being paid.
 CREATE TABLE IF NOT EXISTS kv (

package/lib/store-pg.mjs

@@ -117,6 +117,7 @@ function peerFromRow(row) {
     lastSeen: row.last_seen == null ? 0 : Number(row.last_seen),
     online: !!row.online,
     deliveredUpTo: row.delivered_up_to == null ? 0 : Number(row.delivered_up_to),
+    kind: row.kind || "",   // #6170: survives the restart that used to forget who was crew
   };
 }
 
@@ -332,8 +333,8 @@ export class PgStore {
   async touchPeer(orgId, session, patch = {}) {
     if (!session || session === "all") return;
     await this.pool.query(
-      `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to)
-       VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9)
+      `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to, kind)
+       VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
        ON CONFLICT(org_id, session) DO UPDATE SET
          pubkey=COALESCE(EXCLUDED.pubkey, peers.pubkey),
          project=COALESCE(NULLIF(EXCLUDED.project,''), peers.project),
@@ -341,11 +342,17 @@ export class PgStore {
          hook_version=COALESCE(NULLIF(EXCLUDED.hook_version,''), peers.hook_version),
          last_seen=EXCLUDED.last_seen,
          online=EXCLUDED.online,
-         delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to)`,
+         delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to),
+         -- #6170: a KINDLESS beat must never demote a known peer. Most heartbeats carry no kind
+         -- (the MCP one only learns it under TRANTOR_ORCH), and plain last_seen refreshes are the
+         -- majority of writes here — overwriting on every one is how the orchestrator kept
+         -- reverting to a nameless agent between registrations.
+         kind=COALESCE(NULLIF(EXCLUDED.kind,''), peers.kind)`,
       [
         session, orgId, patch.pubkey || null, patch.project || "", patch.status ?? null,
         patch.hookVersion || patch.hook_version || "", ms(patch.lastSeen || patch.last_seen),
         patch.online ?? true, Number(patch.deliveredUpTo || patch.delivered_up_to || 0),
+        patch.kind || "",
       ],
     );
   }
@@ -474,11 +481,15 @@ export class PgStore {
       );
       for (const [session, p] of Object.entries(state.peers || {})) {
         await c.query(
-          `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to)
-           VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9)
+          `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to, kind)
+           VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
            ON CONFLICT(org_id, session) DO UPDATE SET pubkey=EXCLUDED.pubkey, project=EXCLUDED.project, status=EXCLUDED.status,
-             hook_version=EXCLUDED.hook_version, last_seen=EXCLUDED.last_seen, online=EXCLUDED.online, delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to)`,
-          [session, orgId, p.pubkey || "", p.project || "", p.status || "", p.hookVersion || "", Number(p.lastSeen || 0), p._on === true || p.online === true, Number(p.deliveredUpTo || 0)],
+             hook_version=EXCLUDED.hook_version, last_seen=EXCLUDED.last_seen, online=EXCLUDED.online, delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to),
+             -- #6170: same non-demoting rule as touchPeer. A snapshot is written from MEMORY, and
+             -- memory is exactly where the kind was being lost, so a blank in the snapshot means
+             -- "not known right now", never "this peer is nothing".
+             kind=COALESCE(NULLIF(EXCLUDED.kind,''), peers.kind)`,
+          [session, orgId, p.pubkey || "", p.project || "", p.status || "", p.hookVersion || "", Number(p.lastSeen || 0), p._on === true || p.online === true, Number(p.deliveredUpTo || 0), p.kind || ""],
         );
       }
       await c.query(
@@ -598,11 +609,15 @@ export class PgStore {
       if (messages.deletes.length) await c.query("DELETE FROM messages WHERE org_id=$1 AND id = ANY($2::bigint[])", [orgId, messages.deletes]);
       for (const p of peers.upserts) {
         await c.query(
-          `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to)
-           VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9)
+          `INSERT INTO peers(session, org_id, pubkey, project, status, hook_version, last_seen, online, delivered_up_to, kind)
+           VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
            ON CONFLICT(org_id, session) DO UPDATE SET pubkey=EXCLUDED.pubkey, project=EXCLUDED.project, status=EXCLUDED.status,
-             hook_version=EXCLUDED.hook_version, last_seen=EXCLUDED.last_seen, online=EXCLUDED.online, delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to)`,
-          [p.session, orgId, p.pubkey || "", p.project || "", p.status || "", p.hookVersion || "", Number(p.lastSeen || 0), p._on === true || p.online === true, Number(p.deliveredUpTo || 0)],
+             hook_version=EXCLUDED.hook_version, last_seen=EXCLUDED.last_seen, online=EXCLUDED.online, delivered_up_to=GREATEST(peers.delivered_up_to, EXCLUDED.delivered_up_to),
+             -- #6170: THIS is the path a running hub actually persists through — saveDelta on the
+             -- persist tick, not touchPeer or saveSnapshot. Adding the column to the other two and
+             -- not this one is why the first live restart still came back with empty kinds.
+             kind=COALESCE(NULLIF(EXCLUDED.kind,''), peers.kind)`,
+          [p.session, orgId, p.pubkey || "", p.project || "", p.status || "", p.hookVersion || "", Number(p.lastSeen || 0), p._on === true || p.online === true, Number(p.deliveredUpTo || 0), p.kind || ""],
         );
       }
       if (peers.deletes.length) await c.query("DELETE FROM peers WHERE org_id=$1 AND session = ANY($2::text[])", [orgId, peers.deletes]);

package/mcp.mjs

@@ -480,8 +480,15 @@ const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const nonProjectReason = nonSeatReason(projectDir);
 const isHomeDirSession = !!nonProjectReason;
 
+// #6170: WHAT this session is, when it can know. sessionstart stamps kind "orch" on the
+// orchestrator pane, but that runs once — every MCP beat afterwards was kindless, and the hub's
+// crew exemption reads the peer row's kind, so the orchestrator kept being demoted by its own
+// heartbeat and then warned about as an intruder on its own project. Same test sessionstart uses:
+// TRANTOR_ORCH names the project this pane orchestrates.
+const KIND = process.env.TRANTOR_ORCH && process.env.TRANTOR_ORCH === PROJECT ? { kind: "orch" } : {};
+
 if (!isHomeDirSession) {
-  await api("POST", "/register", { session: SESSION, project: PROJECT, status: `active in ${PROJECT}`, hookVersion: MCP_VERSION })
+  await api("POST", "/register", { session: SESSION, project: PROJECT, status: `active in ${PROJECT}`, hookVersion: MCP_VERSION, ...KIND })
     .catch((err) => { process.stderr.write(`[trantor-mcp] initial register failed: ${err?.message || err}\n`); });
 
   // Heartbeat — keep this session's presence fresh for as long as the MCP process lives.
@@ -493,7 +500,7 @@ if (!isHomeDirSession) {
   // hub refreshes lastSeen but preserves the session's meaningful status. setInterval pauses during
   // sleep and fires on wake, so presence self-heals within one interval; .unref() lets the process
   // still exit cleanly when the agent closes the stdio transport (no phantom peers).
-  setInterval(() => { api("POST", "/register", { session: SESSION, project: PROJECT, hookVersion: MCP_VERSION }).catch(() => {}); }, HEARTBEAT_MS).unref?.();
+  setInterval(() => { api("POST", "/register", { session: SESSION, project: PROJECT, hookVersion: MCP_VERSION, ...KIND }).catch(() => {}); }, HEARTBEAT_MS).unref?.();
 } else {
   process.stderr.write(`[trantor-mcp] ${nonProjectReason} — not auto-registering on the bus (set RELAY_SESSION or RELAY_PROJECT to opt in)\n`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.35",
+  "version": "0.18.36",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"