trantor 0.18.85 → 0.18.86

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.85",
+  "version": "0.18.86",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -24,6 +24,7 @@ switch (cmd) {
   case "profile": run("bin/profile.mjs"); break;
   case "provider": case "providers": run("bin/provider.mjs"); break;
   case "secrets": run("bin/secrets.mjs"); break;
+  case "keys":    run("bin/keys.mjs"); break;
   case "models": run("bin/models.mjs"); break;
   case "advise":  run("bin/advise.mjs"); break;
   case "verify":  run("bin/crew-verify.mjs"); break;
@@ -70,6 +71,10 @@ switch (cmd) {
       }
       break;
     }
+    // Local throwaway: the hub's default is RELAY_AUTH=enforce (#11368), but a foreground
+    // `trantor hub` on loopback is a dev convenience — keep it usable (warn) unless the
+    // operator asked for a mode explicitly.
+    if (!process.env.RELAY_AUTH) process.env.RELAY_AUTH = "warn";
     run("hub.mjs"); break;
   }
   case "project": {
@@ -235,6 +240,7 @@ switch (cmd) {
   trantor profile     declare your plans:  trantor profile set claude=max codex=plus deepseek=api
   trantor provider    bring ANY model (BYOM): list · status [--json] · verify <name> --key … · add <name> --key … · remove <name>
   trantor secrets     provider keys in the OS keychain: list · set <NAME> (stdin) · remove <NAME> · migrate [--dry-run]
+  trantor keys        identity keys in the OS keychain: status · migrate [--dry-run] — ~/.agent-bus/keys keeps public material only
   trantor models      browse live models behind each seat + the router's pick per difficulty
   trantor up …        spawn a crew here:   trantor up codex kimi deepseek:deepseek glm:zai-coding-plan
   trantor open        host THIS session as the project's orchestrator pane (trantor down spares it)

package/bin/crew/cmux.mjs

@@ -110,13 +110,13 @@ export function spawnCmux(ctx, specs, resolve, prune) {
   for (let index = 0; index < specs.length; index += 1) {
     const seat = resolve(specs[index]);
     if (!seat) continue;
-    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
-    const old = reuse ? readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmux" && row.agent === seat.agent).at(-1)?.handle || "" : "";
+    const launcher = seatLauncher(ctx, (seat.persona || seat.agent), runnerCommand(ctx, seat.agent, seat.model, seat.effort, seat.persona));
+    const old = reuse ? readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmux" && row.persona === (seat.persona || seat.agent)).at(-1)?.handle || "" : "";
     let pane = "";
     if (reuse) {
-      console.log(ctx.dry ? `[dry] cmux: reuse workspace ${workspace} — new-split for ${seat.agent}${old ? ` (replacing ${old})` : ""}` : `  → reusing workspace ${workspace}`);
+      console.log(ctx.dry ? `[dry] cmux: reuse workspace ${workspace} — new-split for ${(seat.persona || seat.agent)}${old ? ` (replacing ${old})` : ""}` : `  → reusing workspace ${workspace}`);
       pane = ctx.dry ? `%DRYT${index}` : split(ctx, workspace, "right", old || panes.at(-1) || "", launcher);
-      if (old) { closePane(ctx, old); dropState(ctx, ctx.project, "cmux", seat.agent); }
+      if (old) { closePane(ctx, old); dropState(ctx, ctx.project, "cmux", (seat.persona || seat.agent)); }
     } else if (index === 0) {
       if (ctx.dry) {
         console.log(`[dry] cmux: new-workspace (cwd ${ctx.dir}) --command 'bash ${launcher}' → rename 'trantor:${ctx.project}'`);
@@ -133,8 +133,8 @@ export function spawnCmux(ctx, specs, resolve, prune) {
       } else pane = split(ctx, workspace, direction, target, launcher);
     }
     panes.push(pane);
-    recordState(ctx, ctx.project, "cmux", seat.agent, pane);
-    console.log(`  → ${seat.agent} seat in cmux workspace (${ctx.project})`);
+    recordState(ctx, ctx.project, "cmux", (seat.persona || seat.agent), pane, seat);
+    console.log(`  → ${(seat.persona || seat.agent)} seat in cmux workspace (${ctx.project})`);
   }
   console.log(`— crew grouped in cmux: ONE workspace tab for ${ctx.project}, seats tiled + sidebar status. Teardown (this project only): trantor down —`);
 }
@@ -150,8 +150,8 @@ function spawnAppleScript(ctx, specs, resolve) {
   for (let index = 0; index < specs.length; index += 1) {
     const seat = resolve(specs[index]);
     if (!seat) continue;
-    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
-    const old = reuse ? readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmux" && row.agent === seat.agent).at(-1)?.handle || "" : "";
+    const launcher = seatLauncher(ctx, (seat.persona || seat.agent), runnerCommand(ctx, seat.agent, seat.model, seat.effort, seat.persona));
+    const old = reuse ? readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmux" && row.persona === (seat.persona || seat.agent)).at(-1)?.handle || "" : "";
     let pane;
     if (!tab && index === 0) {
       if (ctx.dry) {
@@ -167,11 +167,11 @@ function spawnAppleScript(ctx, specs, resolve) {
         console.log(`[dry] cmux(AppleScript): split ${direction} from ${target || "<focused>"} + run 'bash ${launcher}'`);
         pane = `%DRYT${index}`;
       } else pane = splitAppleScriptPane(ctx, tab, target, direction, launcher);
-      if (old && pane && pane !== "ERR") { closePane(ctx, old); dropState(ctx, ctx.project, "cmux", seat.agent); }
+      if (old && pane && pane !== "ERR") { closePane(ctx, old); dropState(ctx, ctx.project, "cmux", (seat.persona || seat.agent)); }
     }
     panes.push(pane);
-    recordState(ctx, ctx.project, "cmux", seat.agent, pane);
-    console.log(`  → ${seat.agent} seat in cmux workspace (${ctx.project})`);
+    recordState(ctx, ctx.project, "cmux", (seat.persona || seat.agent), pane, seat);
+    console.log(`  → ${(seat.persona || seat.agent)} seat in cmux workspace (${ctx.project})`);
   }
   console.log(`— crew grouped in cmux (AppleScript): ONE workspace tab for ${ctx.project}, seats tiled. Teardown: trantor down —`);
 }

package/bin/crew/core.mjs

@@ -139,7 +139,7 @@ export function gridColumns(size) {
 // flag documented there finally arms the seat that reads it.
 const FORWARDED_ENV = STATE_FLAGS;
 
-export function runnerCommand(ctx, agent, model = "", effort = null) {
+export function runnerCommand(ctx, agent, model = "", effort = null, persona = agent) {
   const forwarded = FORWARDED_ENV
     .filter((name) => process.env[name])
     .map((name) => `${name}=${shellQuote(process.env[name])} `)
@@ -147,8 +147,9 @@ export function runnerCommand(ctx, agent, model = "", effort = null) {
   // #7777: the launcher resolved the catalog's per-difficulty effort for this seat; the runner
   // reads CREW_EFFORT, applies what the CLI accepts and logs the one-line summary.
   const swapEnv = ctx.swap ? ` CREW_SWAP_STAGE=${shellQuote(ctx.swap.path)} CREW_SWAP_LABEL=${shellQuote(ctx.swap.label)} CREW_SWAP_AGENT=${shellQuote(ctx.swap.agent)} CREW_SWAP_DRIVER=${shellQuote(ctx.swap.driver || "")}` : "";
+  const personaEnv = ` CREW_AGENT=${shellQuote(agent)} CREW_PERSONA=${shellQuote(ctx.swap?.persona || persona)}`;
   const effortEnv = effort ? ` CREW_EFFORT=${shellQuote(JSON.stringify(effort))}` : "";
-  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv}${swapEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
+  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv}${swapEnv}${personaEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(persona)} ${shellQuote(ctx.dir)}`;
 }
 
 export function listPids(pattern) {

package/bin/crew/herdr.mjs

@@ -159,18 +159,18 @@ function prepareWorkspace(ctx, prune) {
 function replacementPane(ctx, workspace, spec, hostPane, resolve) {
   const seat = resolve(spec);
   if (!seat) return null;
-  const old = readRows(ctx).filter(row => row.project === ctx.project && row.kind === "herdr" && row.agent === seat.agent).at(-1)?.handle || "";
+  const old = readRows(ctx).filter(row => row.project === ctx.project && row.kind === "herdr" && row.persona === (seat.persona || seat.agent)).at(-1)?.handle || "";
   let pane;
   if (ctx.dry) {
-    console.log(`[dry] herdr: reuse workspace ${workspace} — pane split for ${seat.agent}${old ? ` (replacing ${old})` : ""}`);
+    console.log(`[dry] herdr: reuse workspace ${workspace} — pane split for ${(seat.persona || seat.agent)}${old ? ` (replacing ${old})` : ""}`);
     pane = `%DRYT${spec.index}`;
   } else {
     pane = splitPane(ctx, hostPane, "right", ctx.dir);
-    runSeat(ctx, pane, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
+    runSeat(ctx, pane, (seat.persona || seat.agent), runnerCommand(ctx, seat.agent, seat.model, seat.effort, seat.persona));
   }
   if (old) {
     closePane(ctx, old);
-    dropState(ctx, ctx.project, "herdr", seat.agent);
+    dropState(ctx, ctx.project, "herdr", (seat.persona || seat.agent));
   }
   return { ...seat, pane };
 }
@@ -194,8 +194,8 @@ export function spawnHerdr(ctx, specs, resolve, prune) {
     workspace = seat.workspace || workspace;
     panes.push(seat.pane);
     reportAgent(ctx, seat.pane, seat.agent);
-    recordState(ctx, ctx.project, "herdr", seat.agent, seat.pane);
-    console.log(`  → ${seat.agent} seat in herdr workspace (${ctx.project})`);
+    recordState(ctx, ctx.project, "herdr", (seat.persona || seat.agent), seat.pane, seat);
+    console.log(`  → ${(seat.persona || seat.agent)} seat in herdr workspace (${ctx.project})`);
   }
   console.log(`— crew grouped in herdr: ONE workspace for ${ctx.project}, seats as named panes in its server. Teardown (this project only): trantor down —`);
 }
@@ -203,7 +203,7 @@ export function spawnHerdr(ctx, specs, resolve, prune) {
 function freshPane(ctx, workspace, spec, panes, columns, resolve) {
   const seat = resolve(spec.value);
   if (!seat) return null;
-  const command = runnerCommand(ctx, seat.agent, seat.model, seat.effort);
+  const command = runnerCommand(ctx, seat.agent, seat.model, seat.effort, seat.persona);
   let pane = "";
   if (spec.index === 0) {
     if (ctx.dry) {
@@ -221,7 +221,7 @@ function freshPane(ctx, workspace, spec, panes, columns, resolve) {
       pane = `%DRYT${spec.index}`;
     } else pane = splitPane(ctx, target, direction, ctx.dir);
   }
-  runSeat(ctx, pane, seat.agent, command);
+  runSeat(ctx, pane, (seat.persona || seat.agent), command);
   return { ...seat, pane, workspace };
 }
 

package/bin/crew/state.mjs

@@ -7,9 +7,9 @@ import { statePathFor as dockerStatePathFor, sweep as dockerSweep } from "../../
 
 export function parseRow(line) {
   const fields = line.split("\t");
-  if (fields.length >= 4) return { project: fields[0], kind: fields[1], agent: fields[2], handle: fields[3] };
-  if (fields.length === 2) return { project: "", kind: "win", agent: fields[0], handle: fields[1] };
-  return { project: "", kind: "win", agent: fields[0] || "", handle: fields[1] || "" };
+  if (fields.length >= 4) return { project: fields[0], kind: fields[1], persona: fields[2], agent: fields[4] || fields[2], model: fields[5] || "", handle: fields[3] };
+  if (fields.length === 2) return { project: "", kind: "win", persona: fields[0], model: "", agent: fields[0], handle: fields[1] };
+  return { project: "", kind: "win", persona: fields[0], model: "", agent: fields[0] || "", handle: fields[1] || "" };
 }
 
 export function readRows(ctx) {
@@ -24,24 +24,24 @@ export function writeRows(ctx, rows) {
     return;
   }
   const tmp = `${ctx.statePath}.tmp`;
-  writeFileSync(tmp, `${rows.map(row => [row.project, row.kind, row.agent, row.handle].join("\t")).join("\n")}\n`);
+  writeFileSync(tmp, `${rows.map(row => [row.project, row.kind, row.persona || row.agent, row.handle, ...((row.persona && row.persona !== row.agent) || row.model ? [row.agent, row.model || ""] : [])].join("\t")).join("\n")}\n`);
   renameSync(tmp, ctx.statePath);
 }
 
-export function recordState(ctx, project, kind, agent, handle) {
+export function recordState(ctx, project, kind, persona, handle, metadata = {}) {
   if (ctx.dry) return;
   const rows = readRows(ctx);
   // #7285: an exact duplicate carries no new fact, and a doubled herdrws row is how `up` came to
   // see the live workspace as its own stale copy. One row per fact — refuse the push.
-  if (rows.some(row => row.project === project && row.kind === kind && row.agent === agent && row.handle === handle)) return;
-  rows.push({ project, kind, agent, handle });
+  if (rows.some(row => row.project === project && row.kind === kind && row.persona === persona && row.handle === handle)) return;
+  rows.push({ project, kind, persona, agent: metadata.agent || persona, model: metadata.model || "", handle });
   writeRows(ctx, rows);
 }
 
 export function dropState(ctx, project, kind, agent = "", handle = "") {
   const rows = readRows(ctx).filter(row => !(
     row.project === project && row.kind === kind &&
-    (!agent || row.agent === agent) && (!handle || row.handle === handle)
+    (!agent || row.persona === agent) && (!handle || row.handle === handle)
   ));
   writeRows(ctx, rows);
 }
@@ -108,7 +108,7 @@ async function closeRow(ctx, row, selected, orchProjects, adapters, tmuxClosed)
   if (row.kind === "herdr" && (perSeat || hasOrch)) adapters.herdr.closePane(row.handle);
   if (row.kind === "tmux") closeTmux(ctx, row, perSeat, tmuxClosed);
   if ((row.kind === "win" || row.kind === "attach") && !(perSeat && row.kind === "attach")) killTerminal(ctx, row.handle);
-  if (!["cmuxws", "attach", "herdrws", "orch"].includes(row.kind)) await killSeatProcesses(ctx, row.project, row.agent);
+  if (!["cmuxws", "attach", "herdrws", "orch"].includes(row.kind)) await killSeatProcesses(ctx, row.project, row.persona);
 }
 
 function closeTmux(ctx, row, perSeat, seen) {
@@ -128,11 +128,11 @@ export async function down(ctx, args, adapters) {
   if (options.error) return 1;
   const rows = readRows(ctx);
   if (!rows.length) { console.log("no tracked crew windows"); return 0; }
-  const scoped = rows.filter(row => (options.all || row.project === ctx.project) && (!options.agents.length || options.agents.includes(row.agent)));
+  const scoped = rows.filter(row => (options.all || row.project === ctx.project) && (!options.agents.length || options.agents.includes(row.persona)));
   const scope = options.all ? "all projects" : `project \"${ctx.project}\"`;
   if (!scoped.length) { console.log(`nothing to tear down for ${scope}`); return 0; }
   console.log(`— tearing down (${scope}):`);
-  for (const row of scoped) if (!["attach", "cmuxws", "herdrws", "orch"].includes(row.kind)) console.log(`  • ${row.project || "<legacy>"} · ${row.agent} (${row.kind})`);
+  for (const row of scoped) if (!["attach", "cmuxws", "herdrws", "orch"].includes(row.kind)) console.log(`  • ${row.project || "<legacy>"} · ${row.persona} (${row.kind})`);
   if (options.all && !options.yes) {
     console.log("— this is EVERY project's crew. Re-run with --yes to confirm:  trantor down --all --yes");
     return 0;
@@ -140,22 +140,22 @@ export async function down(ctx, args, adapters) {
   const orchProjects = new Set(rows.filter(row => row.kind === "orch").map(row => row.project));
   const tmuxClosed = new Set();
   for (const row of scoped) await closeRow(ctx, row, options.agents, orchProjects, adapters, tmuxClosed);
-  const removed = new Set(scoped.map(row => `${row.project}|${row.kind}|${row.agent}|${row.handle}`));
-  const kept = rows.filter(row => !removed.has(`${row.project}|${row.kind}|${row.agent}|${row.handle}`) || (orchProjects.has(row.project) && ["herdrws", "cmuxws", "orch"].includes(row.kind)));
+  const removed = new Set(scoped.map(row => `${row.project}|${row.kind}|${row.persona}|${row.handle}`));
+  const kept = rows.filter(row => !removed.has(`${row.project}|${row.kind}|${row.persona}|${row.handle}`) || (orchProjects.has(row.project) && ["herdrws", "cmuxws", "orch"].includes(row.kind)));
   writeRows(ctx, kept);
   const seatRows = scoped.filter(row => !["attach", "cmuxws", "herdrws", "orch"].includes(row.kind));
   if (!ctx.dry) {
     const logDir = join(dirname(ctx.statePath), "logs");
     mkdirSync(logDir, { recursive: true });
-    for (const row of new Map(seatRows.map(row => [`${row.project}/${row.agent}`, row])).values()) {
-      appendFileSync(join(logDir, `${row.agent}-${row.project}.jsonl`),
-        `${JSON.stringify({ ts: Date.now(), agent: row.agent, project: row.project, stopped: true })}\n`);
+    for (const row of new Map(seatRows.map(row => [`${row.project}/${row.persona}`, row])).values()) {
+      appendFileSync(join(logDir, `${row.persona}-${row.project}.jsonl`),
+        `${JSON.stringify({ ts: Date.now(), agent: row.persona, project: row.project, stopped: true })}\n`);
     }
   }
   if (options.agents.length) {
-    const stopped = [...new Set(seatRows.map(row => row.agent))];
+    const stopped = [...new Set(seatRows.map(row => row.persona))];
     const remaining = [...new Set(kept.filter(row => row.project === ctx.project &&
-      !["attach", "cmuxws", "herdrws", "orch"].includes(row.kind)).map(row => row.agent))];
+      !["attach", "cmuxws", "herdrws", "orch"].includes(row.kind)).map(row => row.persona))];
     console.log(`— ${stopped.join(", ") || options.agents.join(", ")} stopped${remaining.length ? ` (${remaining.join(", ")} still running)` : ""} (${scope})`);
   } else console.log(`— crew torn down (${scope})`);
   return 0;

package/bin/crew/swap.mjs

@@ -1,3 +1,4 @@
+import { updatePersona } from "../../lib/persona.mjs";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -89,12 +90,11 @@ export function swapRuntime(ctx, adapters, spawn) {
   let replacementPid;
   return {
     validate: options => {
-      if (options.agent !== options.from && readRows(ctx).some(row => row.project === ctx.project && row.agent === options.agent)) throw new Error(`replacement seat ${options.agent} already exists; old seat unchanged`);
       return validateReplacement(ctx, options);
     },
     async start(seat, stage) {
       const staged = { ...ctx, swap: { ...stage, agent: seat.agent, driver: seat.driver } };
-      spawn(staged, { ...seat, agent: stage.label });
+      spawn(staged, { ...seat, persona: stage.label });
     },
     async ready(stage) {
       const deadline = Date.now() + 30000;
@@ -118,10 +118,11 @@ export function swapRuntime(ctx, adapters, spawn) {
       signalProcesses(pids, "SIGKILL");
     },
     async cancel(stage) { await down(ctx, [stage.label], adapters); },
-    release(stage, agent, cursor) {
-      writeRows(ctx, readRows(ctx).map(row => row.project === ctx.project && row.agent === stage.label ? { ...row, agent } : row));
-      writeFileSync(runnerRecord(ctx, ctx.project, agent), JSON.stringify({ label: stage.label, dir: ctx.dir }));
-      writeFileSync(`${stage.path}.release`, JSON.stringify({ agent, cursor }));
+    release(stage, persona, cursor) {
+      writeRows(ctx, readRows(ctx).map(row => row.project === ctx.project && row.persona === stage.label ? { ...row, persona } : row));
+      writeFileSync(runnerRecord(ctx, ctx.project, persona), JSON.stringify({ label: stage.label, dir: ctx.dir }));
+      updatePersona({ dir: join(ctx.home, ".agent-bus"), project: ctx.project, persona, agent: stage.agent, model: stage.model });
+      writeFileSync(`${stage.path}.release`, JSON.stringify({ agent: stage.agent, persona, cursor }));
     },
   };
 }
@@ -133,23 +134,22 @@ export async function performSwap(ctx, options, runtime) {
     const seat = await runtime.validate(options);
     const label = `${options.agent}-swap-${randomUUID().slice(0, 8)}`;
     mkdirSync(ctx.seatDir, { recursive: true });
-    stage = { label, path: join(ctx.seatDir, label) };
+    stage = { label, path: join(ctx.seatDir, label), persona: options.from, agent: seat.agent, model: seat.model };
     await runtime.start(seat, stage);
     const readySession = await runtime.ready(stage);
     frozen = true;
     await runtime.freeze(options.from);
     const pending = readPending(ctx, options.from);
-    const target = options.agent === options.from ? pending : readPending(ctx, options.agent);
-    const from = `${options.from}:${ctx.project}`, to = `${options.agent}:${ctx.project}`;
+    const target = pending;
+    const from = `${options.from}:${ctx.project}`, to = from;
     const handoff = await runtime.transfer({ from, to, project: ctx.project, readySession, _op: `swap-${stage.label}`, heldAsk: pending.ask || 0, pendingIds: pending.wake.map(m => m.id) });
     transferred = true;
     result.moved = [...new Set([...pending.wake.map(m => m.id), ...handoff.moved])];
     const wake = new Map([...target.wake, ...pending.wake, ...handoff.messages].map(m => [m.id, { ...m, to }]));
-    savePending(ctx, options.agent, { ...target, wake: [...wake.values()], bcast: [...new Map([...target.bcast, ...pending.bcast].map(m => [m.id, m])).values()], ask: handoff.messages.some(m => m.re === pending.ask) ? 0 : pending.ask || target.ask, askTo: pending.askTo || target.askTo });
+    savePending(ctx, options.from, { ...target, wake: [...wake.values()], bcast: [...new Map([...target.bcast, ...pending.bcast].map(m => [m.id, m])).values()], ask: handoff.messages.some(m => m.re === pending.ask) ? 0 : pending.ask || target.ask, askTo: pending.askTo || target.askTo });
     await runtime.stop(options.from);
     frozen = false;
-    if (options.agent !== options.from) savePending(ctx, options.from, { ...pending, wake: [], bcast: [], ask: 0, askTo: "" });
-    await runtime.release(stage, options.agent, handoff.cursor);
+    await runtime.release(stage, options.from, handoff.cursor);
     return { ...result, ok: true };
   } catch (error) {
     if (!transferred) {

package/bin/crew/tmux.mjs

@@ -7,7 +7,7 @@ export function spawnTmux(ctx, specs, resolve) {
   for (const spec of specs) {
     const seat = resolve(spec);
     if (!seat) continue;
-    const command = runnerCommand(ctx, seat.agent, seat.model, seat.effort);
+    const command = runnerCommand(ctx, seat.agent, seat.model, seat.effort, seat.persona);
     let pane = ctx.dry ? "%DRY" : "";
     if (first) {
       run(ctx, "tmux", ["new-session", "-d", "-s", session, "-n", "crew", "-x", "260", "-y", "60"], { rendered: `tmux new-session -d -s '${session}' -n crew -x 260 -y 60` });
@@ -18,9 +18,9 @@ export function spawnTmux(ctx, specs, resolve) {
       run(ctx, "tmux", ["select-layout", "-t", session, "tiled"], { rendered: `tmux select-layout -t '${session}' tiled >/dev/null 2>&1` });
     }
     if (!ctx.dry) pane = call("tmux", ["display-message", "-p", "-t", session, "#{pane_id}"], { env: ctx.env }).stdout;
-    run(ctx, "tmux", ["select-pane", "-t", pane || session, "-T", seat.agent.toUpperCase()], { rendered: `tmux select-pane -t '${pane || session}' -T ${seat.agent.toUpperCase()}` });
-    recordState(ctx, ctx.project, "tmux", seat.agent, pane || "%?");
-    console.log(`  → ${seat.agent} pane in ${session}`);
+    run(ctx, "tmux", ["select-pane", "-t", pane || session, "-T", (seat.persona || seat.agent).toUpperCase()], { rendered: `tmux select-pane -t '${pane || session}' -T ${(seat.persona || seat.agent).toUpperCase()}` });
+    recordState(ctx, ctx.project, "tmux", (seat.persona || seat.agent), pane || "%?", seat);
+    console.log(`  → ${(seat.persona || seat.agent)} pane in ${session}`);
   }
   run(ctx, "tmux", ["set-option", "-t", session, "pane-border-status", "top"], { rendered: `tmux set-option -t '${session}' pane-border-status top >/dev/null 2>&1` });
   run(ctx, "tmux", ["set-option", "-t", session, "pane-border-format", " #{pane_title} "], { rendered: `tmux set-option -t '${session}' pane-border-format ' #{pane_title} ' >/dev/null 2>&1` });
@@ -48,17 +48,17 @@ export function spawnTerminal(ctx, specs, resolve) {
     const x = rect.x + (index % columns) * width;
     const y = rect.y + Math.floor(index / columns) * height;
     if (ctx.dry) {
-      console.log(`[dry] Terminal window for ${seat.agent} at ${x},${y}`);
-      recordState(ctx, ctx.project, "win", seat.agent, `%DRYWIN${index}`);
+      console.log(`[dry] Terminal window for ${(seat.persona || seat.agent)} at ${x},${y}`);
+      recordState(ctx, ctx.project, "win", (seat.persona || seat.agent), `%DRYWIN${index}`, seat);
       continue;
     }
-    const command = `clear && ${runnerCommand(ctx, seat.agent, seat.model, seat.effort)}`;
-    const title = `${ctx.project} · ${seat.agent.toUpperCase()}`;
+    const command = `clear && ${runnerCommand(ctx, seat.agent, seat.model, seat.effort, seat.persona)}`;
+    const title = `${ctx.project} · ${(seat.persona || seat.agent).toUpperCase()}`;
     const result = appleScript(`tell application "Terminal"\nset w to do script "${appleScriptString(command)}"\nset custom title of w to "${appleScriptString(title)}"\nset theWin to first window whose tabs contains w\nset bounds of theWin to {${x}, ${y}, ${x + width}, ${y + height}}\nreturn id of theWin\nend tell\n`);
     if (result.stdout) {
-      recordState(ctx, ctx.project, "win", seat.agent, result.stdout);
-      console.log(`  → ${seat.agent} window spawned (${ctx.project} · ${seat.agent})`);
-    } else console.log(`  ✗ ${seat.agent} osascript spawn ERROR`);
+      recordState(ctx, ctx.project, "win", (seat.persona || seat.agent), result.stdout, seat);
+      console.log(`  → ${(seat.persona || seat.agent)} window spawned (${ctx.project} · ${(seat.persona || seat.agent)})`);
+    } else console.log(`  ✗ ${(seat.persona || seat.agent)} osascript spawn ERROR`);
     call("sleep", ["1.2"]);
   }
 }

package/bin/crew-runner.mjs

@@ -7,6 +7,7 @@ import { join, basename } from "node:path";
 import { homedir } from "node:os";
 import { resolveProject, resolveHub, withEnvFiles, hostId } from "../lib/project.mjs";
 import { resolveSecrets, shadowEnv, withSecretExports } from "../lib/secrets.mjs";
+import { runnerPersona } from "../lib/persona.mjs";
 import { loadOrCreate } from "../lib/identity.mjs";
 import { signedHeaders } from "../lib/signed-fetch.mjs";
 import { ensureEnrolled } from "../lib/enroll.mjs";
@@ -74,7 +75,8 @@ function newerVersion(next, previous) {
   return false;
 }
 if (!releaseState) await awaitSwapRelease();
-const AGENT = process.env.CREW_SWAP_AGENT || process.argv[2];
+const AGENT = process.env.CREW_SWAP_AGENT || process.env.CREW_AGENT || process.argv[2];
+const PERSONA = runnerPersona(process.env, AGENT);
 const DIR = process.argv[3] || process.cwd();
 // Crew agents MUST share the orchestrator's project key (one repo = one lane).
 // RELAY_PROJECT is inherited from crew.mjs (the host's resolved key); else fall
@@ -88,7 +90,7 @@ function gitOut(args, cwd = DIR) {
 }
 
 function seatWorktree(sourceDir) {
-  const wt = ensureSeatWorktree({ sourceDir, project: PROJ, agent: AGENT });
+  const wt = ensureSeatWorktree({ sourceDir, project: PROJ, agent: PERSONA });
   // #7760: a worktree is a git checkout — it lacks the gitignored files the build needs and cannot
   // resolve relative sibling packages. The project's declaration provides both before the first turn.
   if (wt.root) {
@@ -129,7 +131,7 @@ function ocSid(dir) {
 // RUNNER_SESSION override: an orchestrator seat (bin/orchestrate.mjs) runs the same CLI as a crew
 // seat but must live on the bus under its own name (claude-orch:proj), or it would collide with a
 // plain claude crew seat on the same project.
-const SESSION = process.env.RUNNER_SESSION || `${AGENT}:${PROJ}`;
+const SESSION = process.env.RUNNER_SESSION || `${PERSONA}:${PROJ}`;
 // One keypair per seat, so `deepseek:crebral` and `deepseek:trantor` are genuinely different
 // identities on the bus rather than one shared string label.
 const identity = loadOrCreate(SESSION, "agent");
@@ -157,9 +159,9 @@ const log = (s) => console.log(`\x1b[38;5;43m[runner]\x1b[0m ${redactKeys(String
 const LOGDIR = join(homedir(), ".agent-bus", "logs");
 try { mkdirSync(LOGDIR, { recursive: true }); } catch {}
 let TURN = releaseState?.turn || 0;
-const telemetry = (rec) => { try { appendFileSync(join(LOGDIR, `${AGENT}-${PROJ}.jsonl`), JSON.stringify(rec) + "\n"); } catch {} };
+const telemetry = (rec) => { try { appendFileSync(join(LOGDIR, `${PERSONA}-${PROJ}.jsonl`), JSON.stringify(rec) + "\n"); } catch {} };
 // The boot line records the HUB this runner bound to, so a split-brain is diagnosable from disk.
-telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, boot: true, hub: HUB, pid: process.pid, version: bootVersion });
+telemetry({ ts: Date.now(), persona: PERSONA, agent: AGENT, project: PROJ, boot: true, hub: HUB, pid: process.pid, version: bootVersion });
 // A seat can open a terminal window on a machine whose owner never asked for one and does not know
 // what they are looking at. "◤ CLAUDE ◢ trantor crew · fleet" tells that person nothing: not what
 // started, not what it will do, not how to stop it. RUNNER_TITLE names it in full and RUNNER_ABOUT
@@ -206,7 +208,7 @@ function cmuxStatus(value, color, icon = "robot", opts = {}) {
   // Label with the REAL seat identity (this is the DISPLAY path, distinct from the bus identity).
   // Pill = "<agent> · <state>" in the agent's brand color; alerts keep their alarm color.
   const col = opts.alert ? color : (BRAND_HEX[AGENT.toLowerCase()] || color);
-  try { spawnSync(CMUX_BIN, ["set-status", SESSION, `${AGENT} · ${value}`, "--color", col, "--icon", icon, "--priority", String(opts.priority ?? 0)], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
+  try { spawnSync(CMUX_BIN, ["set-status", SESSION, `${PERSONA} · ${AGENT} · ${value}`, "--color", col, "--icon", icon, "--priority", String(opts.priority ?? 0)], { stdio: "ignore", timeout: 1500, env: { ...process.env, CMUX_QUIET: "1" } }); } catch {}
 }
 // herdr drops a pane's agent registration when the process inside exits, and a seat's CLI exits
 // every turn, so re-report at each turn boundary. Argument order: pane id FIRST, then the flags.
@@ -216,7 +218,7 @@ function herdrAgent(state) {
     if (!existsSync(f)) return;
     const row = readFileSync(f, "utf8").split("\n")
       .map(l => l.split("\t"))
-      .filter(c => c.length >= 4 && c[0] === PROJ && c[1] === "herdr" && c[2] === AGENT)
+      .filter(c => c.length >= 4 && c[0] === PROJ && c[1] === "herdr" && c[2] === PERSONA)
       .pop();
     if (!row || !row[3]) return;
     spawnSync("herdr", ["pane", "report-agent", row[3], "--source", "crew", "--agent", AGENT, "--state", state],
@@ -318,7 +320,7 @@ let lastEmptyTurn = false;
 // at turn end rides along so the assigner's notice can name it.
 let lastNoDelivery = false;
 let lastNoDeliveryStatus = "";
-const ERRF = join(homedir(), ".agent-bus", `err-${AGENT}-${PROJ}.txt`);
+const ERRF = join(homedir(), ".agent-bus", `err-${PERSONA}-${PROJ}.txt`);
 const DUTY_NUDGES = process.env.RUNNER_DUTY_NUDGES === "1";
 const DUTY_NUDGE_STATE = process.env.RUNNER_DUTY_NUDGE_STATE
   || join(homedir(), ".agent-bus", "duty-nudged.json");
@@ -339,15 +341,15 @@ function startDutyNudgeWatcher(plan, sinceMs) {
 // ---- undelivered wake messages (the runner owns delivery, not the hub) ----
 // The hub hands a message out exactly once, so a turn that died took its wake with it. Here a
 // message is consumed only when a turn exits 0; the queue lives on disk and retries on backoff.
-const PENDF = join(homedir(), ".agent-bus", `pending-${AGENT}-${PROJ}.json`);
+const PENDF = join(homedir(), ".agent-bus", `pending-${PERSONA}-${PROJ}.json`);
 // #7914: the park, on disk, for everyone who is not on the bus. A park announces itself once and
 // then the seat looks exactly like an idle one — which is how three seats sat 46 minutes while
 // `trantor seat-why` read "live, last turn failed". This file is the state behind that event, so a
 // reader who missed the message still finds the reason, the evidence and when it lifts.
-const PARKF = join(homedir(), ".agent-bus", `park-${AGENT}-${PROJ}.json`);
+const PARKF = join(homedir(), ".agent-bus", `park-${PERSONA}-${PROJ}.json`);
 // #9778: the seat's recorded containers, persisted per seat so a card close, a park or
 // `trantor down <seat>` can stop what the seat started even after this runner is gone.
-const DOCKERF = dockerStatePathFor(AGENT, PROJ);
+const DOCKERF = dockerStatePathFor(PERSONA, PROJ);
 // One bus line per sweep, naming what was stopped; docker absent sweeps stay silent by contract.
 async function janitorStop(why, card) {
   const r = dockerSweep({ path: DOCKERF, card });
@@ -403,7 +405,7 @@ function savePending(wake, bcast) {
     // the dedupe ledger outlives the deliveries it guards, and a restarted runner must wait for
     // the answer instead of redelivering the very contract the seat already asked about.
     if (!wake.length && !bcast.length && !seenLedger.length && !awaitingAsk) { try { unlinkSync(PENDF); } catch {} return; }
-    writeFileSync(PENDF, JSON.stringify({ agent: AGENT, project: PROJ, ts: Date.now(), wake, bcast, seen: seenLedger, ask: awaitingAsk?.id || 0, askTo: awaitingAsk?.to || "" }));
+    writeFileSync(PENDF, JSON.stringify({ persona: PERSONA, agent: AGENT, project: PROJ, ts: Date.now(), wake, bcast, seen: seenLedger, ask: awaitingAsk?.id || 0, askTo: awaitingAsk?.to || "" }));
   } catch {}
 }
 function loadPending() {
@@ -435,7 +437,7 @@ async function reportFailure(exit, trigger, undelivered = 0, reasonOverride = ""
   const reason = reasonOverride || classify(exit);
   const down = consecFails >= 2;
   const status = down ? `down: ${reason} · ${consecFails} fails` : `errored: ${reason}`;
-  await api("/register", { session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status, persona: PERSONA, agent: AGENT, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   const hint = reason === "exhausted" ? " — needs `trantor swap`"
     : reason === "stalled" ? " — CLI silent for the whole watchdog window: check the provider, or `trantor swap`"
     : reason === "auth" ? " — check credentials"
@@ -497,7 +499,7 @@ async function parkSeat(reason, undelivered, resetHint = 0, { evidence = "" } =
   parkState = { reason, until, evidence, held: undelivered, ts: Date.now(), bounded };
   // The park is a STATE, and every reader of it is off the bus: `trantor seat-why`, the app, the
   // operator at a terminal an hour later. The message below is the event; this file is the state.
-  try { writeFileSync(PARKF, JSON.stringify({ session: SESSION, agent: AGENT, project: PROJ, ...parkState })); } catch {}
+  try { writeFileSync(PARKF, JSON.stringify({ session: SESSION, persona: PERSONA, agent: AGENT, project: PROJ, ...parkState })); } catch {}
   if (!parkAnnounced) {
     parkAnnounced = true;
     // #7752: a stalled park names the CLI and its model — the swap decision needs both, and this
@@ -518,7 +520,7 @@ async function parkSeat(reason, undelivered, resetHint = 0, { evidence = "" } =
     `${undelivered} message(s) held${when ? ` — retrying after ${when}` : ` — needs \`trantor up ${AGENT}\``}`);
   // #7749: parked is a first-class phase — the file and the peer row both say so, so an
   // orchestrator stops confusing a quota-held seat with a working or a dead one.
-  writeTurnState(AGENT, PROJ, { phase: "parked", since: Date.now() });
+  writeTurnState(PERSONA, PROJ, { phase: "parked", since: Date.now() });
   await registerStatus(`parked (${reason})`, { phase: "parked", phaseSince: Date.now() });
   // #9778: a parked seat is done working for now — its recorded containers go down with it.
   await janitorStop(`seat parked (${reason})`);
@@ -581,7 +583,7 @@ async function balanceRows() {
 // #7749: the live phase + its start ride the same call, so /peers answers what the seat does NOW.
 async function registerStatus(status, extra = {}) {
   const url = HUB + "/register";
-  const body = JSON.stringify({ session: SESSION, project: PROJ, status, llm: AGENT, model: MODEL, ...extra });
+  const body = JSON.stringify({ session: SESSION, project: PROJ, status, persona: PERSONA, agent: AGENT, llm: AGENT, model: MODEL, ...extra });
   try {
     const opts = { method: "POST", headers: { "content-type": "application/json", connection: "close" }, body };
     await fetch(url, { ...opts, headers: { ...opts.headers, ...signedHeaders(identity, url, opts) }, signal: AbortSignal.timeout(5000) });
@@ -633,7 +635,7 @@ async function reportHealthy() {
   // Recovery is a change too, so the next failure is news again — a park included.
   announced = "";
   parkAnnounced = false;
-  await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, persona: PERSONA, agent: AGENT, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ, kind: "status" }).catch(() => {});
   cmuxStatus("ok", "#14b8a6", "check"); herdrAgent("idle");
 }
@@ -647,7 +649,7 @@ for (const [name, flag] of Object.entries(stateFlags)) {
   if (flag.value && process.env[name] === undefined) process.env[name] = flag.value;
 }
 const STATE_FLAG_ON = process.env[STATE_ENV] === "1";
-const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${AGENT}-${PROJ}.json`);
+const STATE_SCHEMA_FILE = join(homedir(), ".agent-bus", `state-schema-${PERSONA}-${PROJ}.json`);
 const STATE_MODE = (() => {
   if (!STATE_FLAG_ON) return false;
   if (AGENT !== "claude") { log(`${STATE_ENV}=1 but this seat is '${AGENT}' — state mode is claude-only (TDD §7.3); staying on the transcript path`); return false; }
@@ -771,8 +773,8 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   await registerStatus(`working · ${trigger}`, { phase: "working", phaseSince: t0 });
   // #7749: the same boundary on disk — the watchdog refreshes lastBytesAt/lastTranscriptAt while
   // the turn runs, so a live reader sees the turn advance without waiting for its end.
-  writeTurnState(AGENT, PROJ, { turn: TURN, phase: "working", since: t0, card: sessionCard || 0, lastBytesAt: t0, lastTranscriptAt: 0 });
-  const pf = join(homedir(), ".agent-bus", `turn-${AGENT}-${PROJ}.txt`);
+  writeTurnState(PERSONA, PROJ, { turn: TURN, phase: "working", since: t0, card: sessionCard || 0, lastBytesAt: t0, lastTranscriptAt: 0 });
+  const pf = join(homedir(), ".agent-bus", `turn-${PERSONA}-${PROJ}.txt`);
   appendFileSync(pf, "", { flag: "w" }); // truncate
   appendFileSync(pf, prompt);
   // #5868: where HEAD stood when the turn began. A turn that moved it shipped real work, and an
@@ -830,7 +832,7 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // instead of prose, and the operator watches that window. So on a state step stdout goes to a
   // file and the runner prints the result line and the cost line itself. stderr still streams to
   // the window through the process substitution below, unchanged.
-  const ENVF = join(homedir(), ".agent-bus", `envelope-${AGENT}-${PROJ}.json`);
+  const ENVF = join(homedir(), ".agent-bus", `envelope-${PERSONA}-${PROJ}.json`);
   if (opts.state) { try { unlinkSync(ENVF); } catch {} }
   const inner = opts.state
     ? `${cmd} > ${ENVF}`
@@ -838,20 +840,20 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   // #5684: runTurn is spawnSync, so a DETACHED watchdog (stamp-armed) watches the turn and sends
   // ONE stall report, never a kill. #6206: floor 10 min, never derived from TRANTOR_TURN_MAX_MS.
   const WD_MS = Number(process.env.TRANTOR_TURN_WATCHDOG_MS) || 10 * 60 * 1000;
-  const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${AGENT}-${PROJ}.json`);
+  const STAMPF = join(homedir(), ".agent-bus", `turnstamp-${PERSONA}-${PROJ}.json`);
   // #6206: the CLI's transcript dir (a missing dir is a quiet channel), exported so a drill's fake
   // CLI can write lines the watchdog sees. CUTF is written by the shell's time box: cut, not crashed.
-  const CUTF = join(homedir(), ".agent-bus", `turncut-${AGENT}-${PROJ}`);
+  const CUTF = join(homedir(), ".agent-bus", `turncut-${PERSONA}-${PROJ}`);
   try { unlinkSync(CUTF); } catch {}
   // #7752: written by the watchdog's kill mode when EVERY liveness channel has been quiet for
   // the whole window; the box sweeps on the marker, so a silent turn ends at the stall window
   // instead of burning the box. Unlinked at turn start and again with the cut cleanup.
-  const STALLF = join(homedir(), ".agent-bus", `turnstall-${AGENT}-${PROJ}`);
+  const STALLF = join(homedir(), ".agent-bus", `turnstall-${PERSONA}-${PROJ}`);
   try { unlinkSync(STALLF); } catch {}
   // #7761: the watchdog writes the extended deadline (epoch seconds) here for the shell box to
   // re-read, and one row per extension to EXTF for the ledger. Both unlinked at turn start.
-  const DEADLINEF = join(homedir(), ".agent-bus", `turndeadline-${AGENT}-${PROJ}`);
-  const EXTF = join(homedir(), ".agent-bus", `turnext-${AGENT}-${PROJ}`);
+  const DEADLINEF = join(homedir(), ".agent-bus", `turndeadline-${PERSONA}-${PROJ}`);
+  const EXTF = join(homedir(), ".agent-bus", `turnext-${PERSONA}-${PROJ}`);
   try { unlinkSync(DEADLINEF); } catch {}
   try { unlinkSync(EXTF); } catch {}
   const boxPlan = TURN_EXTENSIONS_MAX ? {
@@ -861,7 +863,7 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
   } : undefined;
   // Touched by the stderr scrubber as its LAST act (the shell below); node waits for it after
   // spawnSync before reading ERRF — see the drain note at the spawnSync call.
-  const DRAINF = join(homedir(), ".agent-bus", `turndrain-${AGENT}-${PROJ}`);
+  const DRAINF = join(homedir(), ".agent-bus", `turndrain-${PERSONA}-${PROJ}`);
   try { unlinkSync(DRAINF); } catch {}
   try {
     const activity = cli.pinned || ["kimi", "claude"].includes(AGENT) ? {
@@ -874,7 +876,7 @@ async function runTurn(prompt, isFirst, trigger = "kickoff", opts = {}) {
       // end the turn, so the watchdog stays report-only (reporting is the whole job, boxless).
       TURN_MAX_MS ? STALLF : "",
       // #7749: the turn-state file the watchdog refreshes mid-turn (lastBytesAt/lastTranscriptAt).
-      join(homedir(), ".agent-bus", `turnstate-${AGENT}-${PROJ}.json`)],
+      join(homedir(), ".agent-bus", `turnstate-${PERSONA}-${PROJ}.json`)],
       { detached: true, stdio: "ignore" });
     WD_CHILD = wd;
     wd.unref();
@@ -982,7 +984,7 @@ exit $turn_exit`;
   // #7749: the cut boundary lands on disk and on the peer row BEFORE the follow-up turn overwrites
   // it — a reader sampling mid-chain sees what actually just happened, not a stale "working".
   if (cut) {
-    writeTurnState(AGENT, PROJ, { phase: stallCut ? "stalled" : "cut", since: Date.now() });
+    writeTurnState(PERSONA, PROJ, { phase: stallCut ? "stalled" : "cut", since: Date.now() });
     await registerStatus(stallCut ? "stalled · no activity" : "cut at the time box", { phase: stallCut ? "stalled" : "cut", phaseSince: Date.now() });
   }
   // #5869: scrub AT REST, synchronously, before anything reads the file back. The explicit shell
@@ -1130,7 +1132,7 @@ exit $turn_exit`;
   // empty/stalled turns to the card that produced nothing. `cut` stays too: the drills read it.
   const outcome = cut ? (stallCut ? "stalled" : "cut") : (effExit !== 0 ? "api-error" : noDelivery ? "no-delivery" : lastEmptyTurn ? "empty" : "completed");
   const finalOutcome = askVerdict ? "asked" : blockedVerdict ? "blocked" : outcome;
-  const telemetryRow = { ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
+  const telemetryRow = { ts: Date.now(), persona: PERSONA, agent: AGENT, project: PROJ, turn: TURN, trigger, card: sessionCard || 0, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, emptyTurn: lastEmptyTurn, verdict, outcome: finalOutcome, tokens };
   if (usage) telemetryRow.usage = usage;
   if (dockerNew.length) telemetryRow.containers = dockerNew.map(c => c.name || c.id);
   if (cut) telemetryRow.cut = true;
@@ -1149,7 +1151,7 @@ exit $turn_exit`;
   // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
   // pulsing it even before the next /poll heartbeat. Failure keeps reportFailure's down/errored.
   if (realExit === 0 && effExit === 0) {
-    writeTurnState(AGENT, PROJ, { phase: "idle", since: Date.now() });
+    writeTurnState(PERSONA, PROJ, { phase: "idle", since: Date.now() });
     await registerStatus("idle", { phase: "idle", phaseSince: Date.now() });
   }
   // The follow-up rides the SAME session, exactly once. A state step gets none: TIME_BOX_PROMPT
@@ -1314,7 +1316,7 @@ function shouldWake(message) {
   }
   return message?.to === "all"
     && isContract(message)
-    && (message.text.includes(`@${AGENT}`) || message.text.toLowerCase().includes(`${AGENT}:`));
+    && (message.text.includes(`@${PERSONA}`) || message.text.toLowerCase().includes(`${PERSONA.toLowerCase()}:`));
 }
 
 // #6228: the operator's declared project links, cached briefly so a burst of wakes doesn't hit
@@ -1377,7 +1379,7 @@ async function resolveWakeCard(messages, { session }) {
   // session is — the overseer's declared-crew exemption reads it, and on the remote hub there is
   // no crew-windows.txt to fall back to. /register preserves absent fields, so a seat running an
   // older runner never loses a kind an updated one stamped.
-  await api("/register", { session: SESSION, project: PROJ, status: "crew member booting", llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
+  await api("/register", { session: SESSION, project: PROJ, status: "crew member booting", persona: PERSONA, agent: AGENT, llm: AGENT, model: MODEL, kind: "agent" }).catch(() => {});
   // Announce runner-side, signed as THIS seat: the runner process is per-seat by construction, so
   // its signature cannot be borrowed the way a shared opencode MCP daemon once borrowed identities.
   try {
@@ -1452,7 +1454,7 @@ async function resolveWakeCard(messages, { session }) {
     }
     try {
       // Persist before exec: a held contract and a released ask both survive the boundary.
-      writeFileSync(PENDF, JSON.stringify({ agent: AGENT, project: PROJ, ts: Date.now(),
+      writeFileSync(PENDF, JSON.stringify({ persona: PERSONA, agent: AGENT, project: PROJ, ts: Date.now(),
         wake: pendingWake, bcast: pendingBcast, seen: seenLedger, ask: awaitingAsk?.id || 0, askTo: awaitingAsk?.to || "" }));
       const state = { cursor, turn: TURN, sid, sessionCard, retryAt, deliveryFails,
         noDeliveryRetry, askReleased, lastTurnAt, attempted: [...attemptedVersions] };

package/bin/crew.mjs

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { seatProcesses } from "./crew/processes.mjs";
+import { allocatePersona } from "../lib/persona.mjs";
 import { join } from "node:path";
 import { call, createContext } from "./crew/core.mjs";
 import { createCmuxAdapter, spawnCmux } from "./crew/cmux.mjs";
@@ -7,7 +9,7 @@ import { resolveSpec, reportSkipped } from "./crew/models.mjs";
 import { openOrchestrator } from "./crew/open.mjs";
 import { performSwap, swapOptions, swapRuntime } from "./crew/swap.mjs";
 import { redactKeys } from "../lib/redact.mjs";
-import { reapSeat, down, prune } from "./crew/state.mjs";
+import { reapSeat, down, prune, readRows } from "./crew/state.mjs";
 import { spawnTerminal, spawnTmux } from "./crew/tmux.mjs";
 import { epochMs, failedAgents, verifyCrew } from "./crew/verify.mjs";
 import { guardCrossProjectUp } from "./crew/worktrees.mjs";
@@ -46,17 +48,16 @@ function parseUpArgs(args) {
     const arg = args[index];
     if (arg === "--task") result.task = args[++index] || "code";
     else if (arg === "--difficulty" || arg === "--diff") result.difficulty = args[++index] || "medium";
-    else result.specs.push(arg);
+    else if (arg === "--as") {
+      result.persona = args[++index];
+      if (!result.persona) throw new Error("--as requires a persona name");
+    } else result.specs.push(arg);
   }
   return result;
 }
 
 function spawnCrew(options, skipped) {
-  const resolve = spec => {
-    const seat = resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
-    if (seat) reapSeat(ctx, seat.agent);
-    return seat;
-  };
+  const resolve = seat => { reapSeat(ctx, seat.persona); return seat; };
   const pruneNow = () => prune(ctx, adapters);
   if (ctx.mux === "herdr") spawnHerdr(ctx, options.specs, resolve, pruneNow);
   else if (ctx.mux === "cmux") spawnCmux(ctx, options.specs, resolve, pruneNow);
@@ -73,6 +74,7 @@ async function runUp(args, verify = true) {
   const options = parseUpArgs(args);
   const requested = resolveAgentLaunchSpecs(options.specs, readConfig());
   options.specs = requested.specs;
+  if (options.persona && options.specs.length !== 1) throw new Error("--as requires exactly one agent");
   resultSeat = options.specs.map(spec => spec.split(":")[0]).join(",");
   if (!options.specs.length) {
     console.log("usage: crew.mjs up [--task K --difficulty D] codex glm kimi deepseek (or set a default in Settings → Agents)");
@@ -87,8 +89,18 @@ async function runUp(args, verify = true) {
   console.log(`[crew] hub for ${ctx.project}: ${ctx.hub} (baked into every seat; CREW_HUB=<url> overrides)`);
   console.log(`— bringing up crew for ${ctx.project} (${ctx.mux === "terminal" ? "Terminal windows" : ctx.mux}) —`);
   // #7760: build once in the first seat's worktree before any seat gets a contract.
-  if (!ctx.dry) await preflightFirstSeat(ctx, options.specs[0].split(":")[0]);
   const skipped = [];
+  const occupied = readRows(ctx).filter(row => row.project === ctx.project).map(row => row.persona);
+  options.specs = options.specs.map(spec => {
+    const resolved = resolveSpec(ctx, spec, options.task, options.difficulty, skipped);
+    if (!resolved) return null;
+    if (seatProcesses(ctx, ctx.project, resolved.agent).length && !occupied.includes(resolved.agent)) occupied.push(resolved.agent);
+    const seat = allocatePersona({ dir: join(ctx.home, ".agent-bus"), project: ctx.project, ...resolved, name: options.persona, occupied, dry: ctx.dry });
+    occupied.push(seat.persona);
+    return { ...resolved, ...seat };
+  }).filter(Boolean);
+  resultSeat = options.specs.map(seat => seat.persona).join(",");
+  if (!ctx.dry && options.specs.length) await preflightFirstSeat(ctx, options.specs[0].persona);
   const started = epochMs();
   spawnCrew(options, skipped);
   if (ctx.dry || !verify) {
@@ -96,9 +108,9 @@ async function runUp(args, verify = true) {
     return reportSkipped(skipped);
   }
   console.log("— verifying on the bus (the spawn is not the truth; the bus is) —");
-  let failed = failedAgents(verifyCrew(ctx, options.specs.map(spec => spec.split(":")[0]), started));
+  let failed = failedAgents(verifyCrew(ctx, options.specs.map(seat => seat.persona), started));
   if (failed.length) {
-    const retry = options.specs.filter(spec => failed.includes(spec.split(":")[0]));
+    const retry = options.specs.filter(seat => failed.includes(seat.persona));
     console.log(`— retrying failed spawns: ${retry.join(" ")} —`);
     options.specs = retry;
     spawnCrew(options, skipped);

package/bin/keys.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// trantor keys — identity private keys in the macOS Keychain instead of plaintext files (#11370).
+//   status [--json] · migrate [--dry-run] [--json]
+// migrate copies each file-held key into the Keychain (service trantor-identity), proves a
+// signature round-trip, and only then rewrites the file as a pubkey-only stub. Keys are never printed.
+import { migrateKeysToKeychain, keyLocationReport, IDENTITY_SERVICE } from "../lib/identity.mjs";
+
+const args = process.argv.slice(2);
+const verb = args[0] || "status";
+const JSON_MODE = args.includes("--json");
+const C = { dim: "\x1b[2m", grn: "\x1b[32m", yel: "\x1b[33m", red: "\x1b[31m", off: "\x1b[0m" };
+const usage = () => {
+  console.error("usage: trantor keys status [--json] | migrate [--dry-run] [--json]");
+  process.exit(1);
+};
+const tilde = (p) => String(p).replace(process.env.HOME || "", "~");
+const shortPub = (p) => (p ? `${p.slice(0, 16)}…` : "(unreadable)");
+
+function status() {
+  const rows = keyLocationReport();
+  if (JSON_MODE) { console.log(JSON.stringify({ service: IDENTITY_SERVICE, rows }, null, 2)); return; }
+  if (!rows.length) { console.log(`${C.dim}no identities yet (~/.agent-bus/keys is empty)${C.off}`); return; }
+  console.log(`identity keys (keychain service: ${IDENTITY_SERVICE}):`);
+  for (const r of rows) {
+    const mark = r.where === "keychain" ? `${C.grn}✓${C.off}` : r.fileKey ? `${C.yel}•${C.off}` : `${C.red}✗${C.off}`;
+    console.log(`  ${mark} ${r.name.padEnd(28)} ${shortPub(r.pubkey).padEnd(19)} ${r.where}`);
+  }
+  const plaintext = rows.filter((r) => r.fileKey);
+  if (plaintext.length) console.log(`\n${plaintext.length} key(s) still in plaintext files → trantor keys migrate`);
+}
+
+function migrate() {
+  const dryRun = args.includes("--dry-run");
+  const r = migrateKeysToKeychain({ dryRun });
+  if (JSON_MODE) { console.log(JSON.stringify(r, null, 2)); return; }
+  if (!r.usable) {
+    console.log("no Keychain on this platform (or TRANTOR_NO_KEYCHAIN=1) — identity keys stay in files; nothing to do");
+    return;
+  }
+  const did = dryRun ? "would move" : "moved";
+  console.log(`${dryRun ? `${C.dim}dry run${C.off} · ` : ""}keychain service: ${r.service}`);
+  for (const n of r.moved) console.log(`  ${C.grn}✓${C.off} ${did} ${n}${dryRun ? "" : " (file is now a pubkey-only stub)"}`);
+  for (const n of r.already) console.log(`  ${C.dim}already in the keychain: ${n}${C.off}`);
+  for (const f of r.failed) console.log(`  ${C.red}✗${C.off} ${f.name}: ${f.reason} — the file was left untouched`);
+  if (!r.moved.length && !r.failed.length && !r.already.length) console.log(`  ${C.dim}nothing to move${C.off}`);
+  if (r.failed.length) process.exit(1);
+}
+
+switch (verb) {
+  case "status": status(); break;
+  case "migrate": migrate(); break;
+  default: usage();
+}

package/hub/auth.mjs

@@ -330,7 +330,7 @@ const seenNonces = new Map();
     const guard = crossProjectGuard(auth, P, { scopes });
     if (!guard.ok) return json(res, guard.code, { error: guard.error });
     const ttlSec = Math.min(Math.max(Number(b0.ttlSec) || 86400, 1), 30 * 86400);
-    const token = randomBytes(24).toString("hex");
+    const token = randomBytes(32).toString("hex");
     state.inviteTokens[token] = { scopes, kind: invitedKind, expiresAt: now() + ttlSec * 1000, used: false,
       createdBy: auth.identity?.pubkey || "", createdAt: now() };
     markDirty();

package/hub.mjs

@@ -27,7 +27,7 @@ const PG_URL = process.env.RELAY_DATABASE_URL || process.env.POSTGRES_URL ||
   ((RAW_STORE_KIND === "pg" || RAW_STORE_KIND === "postgres") ? process.env.DATABASE_URL : "");
 const STORE_KIND = RAW_STORE_KIND || (PG_URL ? "pg" : "json");
 const ORG_ID = process.env.RELAY_ORG_ID || DEFAULT_ORG;
-const AUTH_MODE = ["off", "warn", "enforce"].includes(process.env.RELAY_AUTH) ? process.env.RELAY_AUTH : "warn";
+const AUTH_MODE = ["off", "warn", "enforce"].includes(process.env.RELAY_AUTH) ? process.env.RELAY_AUTH : "enforce";
 const ENROLL_MODE = process.env.RELAY_ENROLL || "tofu";
 const ONLINE_MS = Number(process.env.RELAY_ONLINE_MS || 5 * 60 * 1000);
 const PEER_TTL_DEFAULT_MS = 21600000;

package/lib/identity.mjs

@@ -1,7 +1,8 @@
 // trantor — cryptographic identity, THE INTERFACE CONTRACT for Phase 0 (docs/TDD-trantor-platform.md §7).
 // An identity is an Ed25519 keypair and the label is cosmetic; every primitive lives behind this module.
 import { generateKeyPairSync, createPublicKey, createPrivateKey, sign as cryptoSign, verify as cryptoVerify, createHash, randomBytes } from "node:crypto";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, chmodSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, chmodSync, readdirSync, unlinkSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { asFunction, asString } from "./decode.mjs";
@@ -64,23 +65,120 @@ function privKeyObject(identity) {
   });
 }
 
+// --- the keychain layer (#11370) -----------------------------------------------------------------
+// The private half moves OFF disk into the macOS Keychain (service below, account = the raw
+// identity name); `trantor keys migrate` rewrites the file as a pubkey-only stub. Reads go
+// Keychain-first through a per-process cache, with a one-line file fallback when locked/absent.
+export const IDENTITY_SERVICE = "trantor-identity";
+const SECURITY = "/usr/bin/security";
+// A drill points this at a throwaway keychain so the operator's real one is never touched.
+const kcArgs = () => process.env.TRANTOR_IDENTITY_KEYCHAIN ? [process.env.TRANTOR_IDENTITY_KEYCHAIN] : [];
+
+// Test seam: drills inject a fake ({ get, set, remove } — get returns the stored string | null and
+// may THROW to simulate a locked keychain) so no test needs the real thing.
+let injectedKeychain = null;
+export function injectIdentityKeychain(fake) {
+  injectedKeychain = fake || null;
+  processCache.clear();
+  warned = false;
+}
+
+const keychainUsable = () =>
+  !!injectedKeychain ||
+  (process.platform === "darwin" && process.env.TRANTOR_NO_KEYCHAIN !== "1" && existsSync(SECURITY));
+
+let warned = false;
+function warnOnce(msg) {
+  if (warned) return;
+  warned = true;
+  console.error(`trantor identity: ${msg}`);
+}
+
+// Three outcomes matter: a hit, a MISS (never stored — normal before migrate), and UNAVAILABLE
+// (locked, headless, pre-wake). Only the last one ever warns.
+function keychainGet(account) {
+  if (injectedKeychain) {
+    try { return { value: injectedKeychain.get(account) || null }; }
+    catch { return { error: true }; }
+  }
+  const r = spawnSync(SECURITY, ["find-generic-password", "-a", account, "-s", IDENTITY_SERVICE, "-w", ...kcArgs()], { encoding: "utf8", timeout: 8000 });
+  if (r.status === 0) return { value: String(r.stdout).replace(/\n$/, "") };
+  return r.status === 44 ? {} : { error: true };   // 44 = errSecItemNotFound
+}
+
+function keychainSet(account, value) {
+  if (injectedKeychain) { injectedKeychain.set(account, value); return; }
+  // The value travels on stdin in `security -i` syntax, so it never shows in the process table;
+  // only the exit code comes back (security echoes the failing line, so stderr is not relayed).
+  const quote = (s) => `"${String(s).replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  const kc = kcArgs();
+  const line = `add-generic-password -a ${quote(account)} -s ${quote(IDENTITY_SERVICE)} -U -w ${quote(value)}${kc.length ? ` ${quote(kc[0])}` : ""}\n`;
+  const r = spawnSync(SECURITY, ["-i"], { encoding: "utf8", input: line, timeout: 8000 });
+  if (r.status !== 0) throw new Error(`keychain write failed for ${account} (security exited ${r.status ?? "signal"})`);
+}
+
+// A keychain entry is the whole identity as JSON, so it stays self-sufficient even if the stub
+// file is lost. Anything that does not parse to a well-formed Ed25519 pair is not a key.
+const HEX64 = /^[0-9a-f]{64}$/i;
+function parseStored(raw) {
+  try {
+    const id = JSON.parse(raw);
+    return HEX64.test(id?.pubkey || "") && HEX64.test(id?.privkey || "") ? id : null;
+  } catch { return null; }
+}
+
 // --- key file ----------------------------------------------------------------------------------
+// One read per process: hooks sign often, and the Keychain read is the expensive half.
+const processCache = new Map();
+const cacheKey = (name) => `${keysDir()}\x00${name}`;
 export function load(name) {
+  const ck = cacheKey(String(name));
+  if (processCache.has(ck)) return processCache.get(ck);
+  const id = resolveIdentity(String(name));
+  processCache.set(ck, id);
+  return id;
+}
+
+function resolveIdentity(name) {
   const f = keyPath(name);
-  if (!existsSync(f)) return null;
-  try {
-    const id = JSON.parse(readFileSync(f, "utf8"));
-    if (!id?.pubkey || !id?.privkey) return null;
-    return id;
-  } catch { return null; }
+  let fileId = null;
+  if (existsSync(f)) {
+    try {
+      const parsed = JSON.parse(readFileSync(f, "utf8"));
+      if (parsed?.pubkey) fileId = parsed;
+    } catch { fileId = null; }
+  }
+  // A file still carrying its privkey is the live record: a rotate or a fresh mint lands in the
+  // file first, so it must win over any older keychain copy under the same name.
+  if (fileId?.privkey) return fileId;
+  if (keychainUsable()) {
+    const kc = keychainGet(String(name));
+    const stored = kc.value ? parseStored(kc.value) : null;
+    // The keychain holds a self-consistent pair; the stub contributes display fields only. Taking
+    // the stub's pubkey with the keychain's privkey would mint an identity whose signatures never
+    // verify — so the crypto pair always comes from the same store.
+    if (stored) return fileId ? { ...stored, ...fileId, privkey: stored.privkey, pubkey: stored.pubkey } : stored;
+    if (fileId) {
+      warnOnce(kc.error
+        ? `the Keychain is unavailable (locked?) and "${name}" has no key file to fall back on — signing fails until it unlocks`
+        : `"${name}": the key file is a pubkey-only stub but the Keychain has no entry — re-run \`trantor keys migrate\` or restore the key`);
+    }
+  } else if (fileId) {
+    warnOnce(`the Keychain is disabled on this platform and "${name}" has no key file to fall back on — signing fails`);
+  }
+  return null;
 }
 
 // Create-if-missing, safe against two hooks racing at session start: write to a unique temp file,
 // rename into place (atomic on the same filesystem), and if we lost the race, use the winner's key.
 // Two identities for one name would silently split a session's history in half.
+// New keys are born as FILES even when the Keychain is up — `trantor keys migrate` moves them.
 export function loadOrCreate(name, kind = "agent") {
   const existing = load(name);
   if (existing) return existing;
+  // A record exists (a pubkey-only stub, or a keychain entry the read above could not use) but its
+  // private half is unreachable right now: minting a new key would split the history, so refuse.
+  if (existsSync(keyPath(name))) return null;
   mkdirSync(keysDir(), { recursive: true, mode: 0o700 });
   try { chmodSync(keysDir(), 0o700); } catch {}
   const { pubkey, privkey } = generate();
@@ -89,11 +187,16 @@ export function loadOrCreate(name, kind = "agent") {
   const tmp = `${f}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
   try {
     writeFileSync(tmp, JSON.stringify(id), { mode: 0o600 });
-    if (existsSync(f)) { return load(f && name) || id; }     // someone beat us between check and write
+    if (existsSync(f)) {                                     // someone beat us between check and write
+      try { unlinkSync(tmp); } catch {}                      // the loser's tmp still holds a private key
+      return load(name) || id;
+    }
     renameSync(tmp, f);
     chmodSync(f, 0o600);
+    processCache.set(cacheKey(String(name)), id);
     return id;
   } catch {
+    try { unlinkSync(tmp); } catch {}
     return load(name) || id;                                  // lost the race, or unwritable — never throw
   }
 }
@@ -103,6 +206,76 @@ export function publicView(identity) {
   return { name: identity.name, kind: identity.kind, pubkey: identity.pubkey, createdAt: identity.createdAt };
 }
 
+// --- migrate + status (`trantor keys …`) ---------------------------------------------------------
+// One <safe-name>.json per durable identity; the instances/ subdir holds per-session subkeys that
+// die with the session and stay files by design.
+export function listKeyNames() {
+  let files = [];
+  try { files = readdirSync(keysDir()); } catch { return []; }
+  return files.filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -".json".length)).sort();
+}
+
+// The stub keeps everything a peer may see plus a pointer at where the private half now lives.
+function writeKeyStub(f, id) {
+  const stub = { name: id.name, kind: id.kind, pubkey: id.pubkey, createdAt: id.createdAt, keychain: IDENTITY_SERVICE };
+  const tmp = `${f}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  writeFileSync(tmp, JSON.stringify(stub), { mode: 0o600 });
+  renameSync(tmp, f);
+  try { chmodSync(f, 0o600); } catch {}
+}
+
+// Copy each file-held private key into the Keychain, prove the stored copy SIGNS (a round-trip
+// against the file's pubkey), and only then rewrite the file as a pubkey-only stub. A key that
+// fails to store or to verify keeps its file untouched.
+export function migrateKeysToKeychain({ dryRun = false } = {}) {
+  const result = { service: IDENTITY_SERVICE, usable: keychainUsable(), moved: [], already: [], failed: [], dryRun };
+  if (!result.usable) return result;
+  for (const fileBase of listKeyNames()) {
+    let id = null;
+    try { id = JSON.parse(readFileSync(keyPath(fileBase), "utf8")); } catch {}
+    // The keychain account is the IDENTITY's name (card #11370), i.e. the raw name the JSON
+    // carries — the file's name is only the sanitised lookup key and load() reads back by the
+    // raw name, so storing under "name_proj" while hooks look for "name:proj" would orphan
+    // every migrated key on its first read.
+    const name = id?.name ?? fileBase;
+    if (!id?.pubkey) { result.failed.push({ name, reason: "unreadable key file" }); continue; }
+    if (!id.privkey) { result.already.push(name); continue; }
+    if (dryRun) { result.moved.push(name); continue; }
+    try {
+      keychainSet(name, JSON.stringify(id));
+      const stored = parseStored(keychainGet(name).value || "");
+      if (!stored || stored.privkey !== id.privkey || stored.pubkey !== id.pubkey) throw new Error("read-back mismatch");
+      const probe = Buffer.from(`trantor-keychain-migrate\n${id.pubkey}`, "utf8");
+      const sig = cryptoSign(null, probe, privKeyObject(stored));
+      if (!cryptoVerify(null, probe, pubFromHex(id.pubkey), sig)) throw new Error("signature round-trip failed");
+      writeKeyStub(keyPath(name), id);
+      processCache.clear();                    // this process now reads stub + keychain
+      result.moved.push(name);
+    } catch (e) {
+      result.failed.push({ name, reason: String(e?.message || e) });
+    }
+  }
+  return result;
+}
+
+// Where does each identity's PRIVATE half live? Presence booleans only — key material is never
+// read into the report.
+export function keyLocationReport() {
+  const usable = keychainUsable();
+  return listKeyNames().map((fileBase) => {
+    let fileKey = false, pubkey = null, name = fileBase;
+    try {
+      const id = JSON.parse(readFileSync(keyPath(fileBase), "utf8"));
+      fileKey = !!id?.privkey;
+      pubkey = id?.pubkey || null;
+      name = id?.name ?? fileBase;               // the identity's real name is what the keychain is keyed on
+    } catch {}
+    const inKeychain = usable ? !!parseStored(keychainGet(name).value || "") : false;
+    const where = fileKey && inKeychain ? "file + keychain" : fileKey ? "file (plaintext)" : inKeychain ? "keychain" : "NO USABLE PRIVATE KEY";
+    return { name, pubkey, where, keychain: inKeychain, fileKey };
+  });
+}
+
 // --- canonical request -------------------------------------------------------------------------
 export function bodyHash(body) {
   if (body === undefined || body === null || body === "") return "";

package/lib/persona.mjs

@@ -0,0 +1,43 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+export function personaName(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value || "")) throw new Error("persona must contain only letters, digits, underscores or hyphens");
+  return value;
+}
+
+export function runnerPersona(env, agent) {
+  return personaName(env.CREW_PERSONA || agent);
+}
+
+export function allocatePersona({ dir, project, agent, model = "", name, occupied = [], dry = false }) {
+  personaName(agent);
+  const folder = join(dir, "personas", encodeURIComponent(project));
+  if (!dry) mkdirSync(folder, { recursive: true });
+  for (let n = 1; ; n++) {
+    const persona = personaName(name || (n === 1 ? agent : `${agent}-${n}`));
+    if (occupied.includes(persona)) {
+      if (name) throw new Error(`persona ${persona} is already active`);
+      continue;
+    }
+    const file = join(folder, `${persona}.json`);
+    const seat = { persona, agent, model };
+    if (dry) return seat;
+    try {
+      writeFileSync(file, JSON.stringify(seat), { flag: "wx", mode: 0o600 });
+      return seat;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (!name) continue;
+      const prior = JSON.parse(readFileSync(file, "utf8"));
+      if (prior.agent !== agent) throw new Error(`persona ${persona} runs ${prior.agent}; use swap to change its agent`);
+      return { ...prior, model };
+    }
+  }
+}
+
+export function updatePersona({ dir, project, persona, agent, model = "" }) {
+  const folder = join(dir, "personas", encodeURIComponent(project));
+  mkdirSync(folder, { recursive: true });
+  writeFileSync(join(folder, `${personaName(persona)}.json`), JSON.stringify({ persona, agent, model }), { mode: 0o600 });
+}

package/lib/session-liveness.mjs

@@ -23,14 +23,14 @@ function query(db, statement) {
     const r = spawnSync("sqlite3", ["-readonly", db, statement], {
       encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 2000,
     });
-    return r.status === 0 ? r.stdout.trim() : "";
-  } catch { return ""; }
+    return r.status === 0 ? r.stdout.trim() : null;
+  } catch { return null; }
 }
 
 // Pin the root once discovered. A fresh root must have been created during this turn;
 // a resumed root is supplied by the runner. Never use global DB/WAL mtimes.
 export function sessionActivityReader({ kind, sid = "", db, workDir, home, startedAt, transcriptDir }) {
-  let root = sid, logDir = "";
+  let root = sid, logDir = "", lastDb = 0;
   const cwd = canonical(workDir);
   return () => {
     if (kind === "opencode") {
@@ -41,7 +41,9 @@ export function sessionActivityReader({ kind, sid = "", db, workDir, home, start
         + ` UNION SELECT s.id FROM session s JOIN own ON s.parent_id=own.id)`
         + ` SELECT MAX(t) FROM (SELECT MAX(time_created,time_updated) t FROM message WHERE session_id IN (SELECT id FROM own)`
         + ` UNION ALL SELECT MAX(time_created,time_updated) t FROM part WHERE session_id IN (SELECT id FROM own));`);
-      return Number(value) || 0;
+      // #9832: a locked or timed-out read is unknown, not silence; keep the last seen activity.
+      if (value === null) return lastDb;
+      return (lastDb = Math.max(lastDb, Number(value) || 0));
     }
     if (kind === "claude") {
       if (!root) {

package/lib/state/gate.mjs

@@ -3,7 +3,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, mkdtempSync, readdirSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { CAPS } from "./schema.mjs";
 
 const DEFAULT_MAX_MS = 300_000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.85",
+  "version": "0.18.86",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"