0034: Agent text is durable and independent of transport and agent work

Agent conversations have their own history, sender queue and receiving work in SQLite. They are ongoing exchanges between role identities, independent of a human conversation and of the connection used to reach the peer. Human transcripts retain their existing ownership and storage.

One delivery module accepts outgoing text and handles incoming text, acknowledgement and rejection. Direct local delivery and WebSocket are adapters at that seam. Only an acknowledgement means durable acceptance. Retries retain the message ID; a receiver commits text and deduplication identity together before acknowledging. Agent scheduling follows the committed receiving work, including after restart, and does not participate in delivery acknowledgements.

Each installation seals its signing key locally with the existing secrets key and pins approved peer public keys. Invitation creation and import approval are the two approvals. JWTs authenticate installation endpoints and expire with the socket. Current database connections, exposures and private outgoing grants authorize each message. An invitation is consumed atomically and only an identical pairing response can repeat an established result.

Agent conversations use the existing run host and runtime configurations with an explicitly selected local sponsor, under the receiving role's identity. A role explicitly sends replies through the same delivery path; its final runtime output stays in the local run transcript. Posting selected text to a human conversation is a separate authorized local send.

Considered Options

Extending human conversations would make their required human owner optional, changing existing privacy, subscriptions, sync audiences and task-creation semantics. Reusing human messages as the remote queue would also transmit or imply human context the feature does not authorize. Separate agent history lets us reuse the runtime seam and conversation display while retaining those human rules.

Transport-owned queues would duplicate persistence and retry behavior between local and network delivery. Acknowledging completion of an agent turn would couple durable delivery to runtime availability, model latency and agent behavior, making offline recovery ambiguous.

Consequences

The run subject gains an agent conversation alongside tasks and human conversations. The migration preserves existing runs and their references. Accepted receiving work remains discoverable even if the server stopped before a run existed. A failed attempted send without an acknowledgement remains unconfirmed; failure is not evidence of nonreceipt. Agent work may resume after a crash, and its external side effects are separate from text acceptance and deduplication.

Revocation is permanent for that connection ID. New pairing creates a new connection. Existing accepted history and failed records are retained. Rollback must retain these records and the migration registry; a destructive schema downgrade is refused.

Local human target discovery

A role can list existing human conversations belonging to itself, under the same role ownership boundary as get/send. People continue to list only their own conversations. The CLI exposes this as conversation list, alongside assignee list for local person identities. These IDs and metadata stay local; discovery neither opens conversations nor forwards text. An active human runtime is unnecessary for an explicit post.