Runs record a context manifest once a model turn succeeds; the chat
marks each human message with the agents that read its current version.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Write-granted runs whose directories overlap (same folder, symlink or
junction, or nested) wait for each other, at claim time and for manual
runs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claims skip agents that already have a running run, manual runs refuse a
busy agent, a run whose task was reassigned fails before executing, and
tasks with a run in progress cannot be deleted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
create_task now pins upstream files by content hash and carries the
source task, source thread, verified facts, open questions and
acceptance criteria into the assignee's prompt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every mention already wakes the agent through its own chat-wake task, so
ordinary tasks no longer inject the org-wide mention inbox.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The three third-party keys were hardcoded or read from the environment.
Operators now enter them in Settings > Integrations; they are stored
encrypted in the app-wide integration_keys table (migration 058).
An agent holding connector grants fails loudly when no Composio key is
saved. The goal-review test no longer depends on absolute dates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A wake run whose model answered in plain final text (the coding-tuned
Kimi family does this instead of calling send_message) completed
'successfully', closed its vehicle task, and left the founder staring
at a silent conversation — the reply lived only in provider_requests.
deliverChatReplyIfMissing now runs before a chat-wake run may complete:
when the run never posted into the source thread (run-start watermark,
so a send_message it did make suppresses the fallback), its final text
is delivered as the agent's reply. A delivery failure fails the run
loudly instead of closing it on silence.
A single transient failure from a background run used to silence the whole
company — founder included — for the full ten-minute cooldown. The
interactive lane now claims one probe per park window: the founder's
message tries the provider immediately, a success lifts the cooldown for
everyone (a served request is proof of health), and a failed probe re-arms
the park with the probe spent, so a real outage is never hammered.
Autonomous work still waits cooldowns out unconditionally.
Wake runs stamp sourceSenderType into their secret scope, and the claim
query orders interactive-first: a wake born from an employee or board
message means a person is waiting at the keyboard, so it outranks any
autonomous backlog; within each lane FIFO holds. Non-chat runs carry no
stamp and stay in the autonomous lane. With wake expiry this closes the
live incident: the founder's CEO DM now claims on the next tick instead
of 13th in line. Red-green tested.
Live incident: the founder DMed the CEO and got silence — the reply run
sat 13th in a FIFO queue behind chat wakes from four days ago, which the
reopened app was faithfully executing (necro-replies that woke yet more
agents). A wake run is a conversation reply; past one hour the moment is
gone. expireStaleChatWakes (chat-agent-wake-service) fails queued
chat_mention runs older than the TTL and closes their vehicle tasks;
the worker tick runs it before claiming, with one log line. Real work
(heartbeat/kickoff triggers) never expires. Red-green tested.
