Hive
Attention.

The loop to ship

Human work → autonomous handoff → explicit next → focused intervention → response → autonomous work. Agent completions feed the queue independently of this loop. A completion never advances the human to another project.

Design decision	V1 ruling
Backbone	Existing Hive broker, HTTP server, SQLite database, edge UDS transport, provider adapters, and durable delivery/outbox machinery.
Unit of scheduling	A concrete human intervention: review, decision, selection, unblock, or human-first work. Not a whole project and not every completed agent task.
Human concurrency	At most one active item per human. Hákon is the first configured human, with stable ID hakon.
Selection policy	FIFO among eligible items, plus an explicit human pick. Ordering is isolated behind a small selector so priority or context-aware selection can replace it later.
Switching trigger	Explicit next, or an explicitly requested resolve --next / defer --next. No inference that the human has become available.
Agent surface	hive-attention … from agent-affordances, forwarding to canonical hive attention … commands.
Human surface	Canonical hive attention CLI. A hotkey can invoke it later; no desktop application is required.
Return path	A persisted human response produces a durable continuation to the originating seat. Exact-session return is enforced where the captured route supports it; otherwise an explicitly declared context-restored return carries the saved work packet. Never silently substitute a different session.
Model requirement	None in the scheduling or state-transition path. Structured fields produce the handoff brief.
Scope boundary	Not a new task tracker, calendar optimizer, agent harness, approval platform, or replacement for the review loop.

What acceptance authorizes

Implementation across Skrates/hive, Skrates/agent-affordances, and the relevant distribution/skill surfaces in Skrates/weave-doctrine. It does not authorize autonomous changes to the operator’s calendar, automatic approval of agent work, changes to seat permissions, or deployment before the release gates in this briefing pass.

The human is conceptually a seat with concurrency one, but must not be enrolled as a provider-backed Hive actor. Do not add human to ProviderSchema, consume an actor lease while Hákon is thinking, or include him in WAKE: everyone expansion.

Exact source snapshots

Repository	Inspected default-branch commit	Role
Skrates/hive	e20912ae64f7d6fba0abac5c6c1b6c0a7c813094	Authoritative runtime baseline; latest inspected commit dated 11 October 2026. S01
Skrates/agent-affordances	b676b7de2ecdc476574719896fb9e791801a800f	CLI distribution baseline; latest inspected commit dated 11 October 2026. S02
Skrates/weave-doctrine	c37f3a6ef70b83c9bf789123286009dac02e5588	Seat registry, skills and packaging baseline; inspected head dated 17 September 2026. S03

Before coding, compare the current checkout to these commits. If main has advanced, preserve the requirements and adapt the named seams; do not reset main to this snapshot. Read each repository’s applicable instructions. Do not infer deployment freshness from a Git commit.

Existing capability versus required delta

Existing, verified in source	Consequence for this implementation
BrokerStore exposes its better-sqlite3 handle, enables WAL and foreign keys, and owns events, deliveries and outbox records. Broker schema generation is 5. S06	Add an attention module on the same handle, with its own additive schema version. No Redis, second broker, or separate service.
bootReviewRuntime constructs a separate state machine on broker.db; BrokerHttpServer consults routeReview before its generic edge gate. S07S08	Follow this composition pattern for attention, without importing review business policy.
The CLI uses Commander; runtime is TypeScript/Node, built with TypeScript and checked through Bun scripts. The package exposes hive. S09	Add a command group, not another runtime stack inside Hive.
Edges expose an owner-only UDS and forward authenticated requests to the broker. resolveMintSource resolves a short-lived dispatch token to a delivery and generation. S10S11	Reuse this path for headless source enrollment, but do not pretend it covers all sessions.
hive wake explicitly refuses calls without HIVE_DELIVERY_TOKEN; its error notes live-delivered turns cannot mint. Tokens disappear when the dispatched turn settles. S12S11	Add an attention-specific source binding for live/manual sessions and long-running work. Merely wrapping hive wake would fail this product.
mintSystemWake already mints durable, deduplicated deliveries, but uses review: identity and hive-review attribution. S13	Generalize its internal origin parameter while preserving existing review behavior and keys exactly. Attention responses must not impersonate the review machine.
Ordinary events coalesce by actor/channel/thread. Current live registration is keyed by actor/provider, not arbitrary parallel sessions. S14S15	Give attention continuations their own coalescing group and explicit route constraints. An actor name alone is not an exact-session address.
Multi-slot actors require spawn, no pinned session, and slot-specific working directories. The edge bypasses live routing for them. S16S11	Do not resume an old multi-slot worktree behind the existing scheduler’s back. Use explicit context restoration through its normal slot allocation.
Claude’s inbox is actor-scoped and its hook currently reads every matching delivery file; the Codex bridge has explicit foreground attachment support. S17S12	Exact-session return requires a receiver-side session check, especially for Claude. A check only at enqueue time is insufficient.
agent-affordances consists of independent uv projects; afford belongs to Spark rather than a generic root dispatcher. S18	Add an independent attention/ project with a thin hive-attention launcher. Do not graft this into Spark.
The marketplace is an explicit snapshot; provenance records source revisions and installation is not automatic. S19	Update canonical skills and explicit packaging together. A commit in agent-affordances does not mean every seat has the command.
Review contracts already use JSON Schema, generated TypeScript and Ajv; the generator’s existing provenance is review-specific. S20	Use the same contract approach for attention, but keep Hive-owned attention schema provenance separate from the vendored review contract.

Preserve the current doctrine, not superseded machinery

AGENTS.md identifies ADR-0003 as authoritative. Keep broker-only Slack custody, outward-only edges, pinned account profiles, harness-owned authority, at-least-once delivery with visible failure, and resume never escalating to spawn. Do not resurrect ADR-0001/0002’s removed ambiguity adjudication, launch-grant system, or exactly-once claims. The README’s older channel-mistrust description is not the governing trust model. S04S05

ID	Feature	Required behavior
F01	Summon	An enrolled seat submits one actionable intervention and receives a durable ID, revision, source identity and status. Broker persistence is the success boundary.
F02	Rich handoff	Every item names the project/work, the precise human action, the context needed to begin, relevant artifacts, and what the response will unblock.
F03	No unsolicited switching	New items, amendments, blockers, deadlines and completed agents never replace the active item, open a window, play a sound or notify the operator.
F04	One active intervention	Repeated next returns the existing active item. A second terminal, browser or retry cannot claim a different item concurrently.
F05	Resolve and return	Record the human’s response and a return effect atomically; release human attention without waiting for Slack, a seat, or a provider.
F06	Defer, requeue, cancel	Preserve the record and history. Deferral may be until a time or indefinite. Nothing is destructively popped.
F07	Human-first work	The operator can add and start work that no agent has yet begun: a grant argument, an application, feature design, or content review.
F08	Stable identity	Transport retries do not duplicate interventions; subsequent rounds are distinct. Amendments preserve the item’s queue position.
F09	Explicit context return	Capture source provenance while it exists. Distinguish pinned_session, actor_context and none return modes.
F10	Inspectability	Queue, active item, history, route mode, pending responses, failed deliveries and next deferred time are visible through structured CLI output.
F11	All enrolled seat types	Headless Codex/Claude/Grok, registered live Codex/Claude, and explicitly bound manual sessions can summon. No source depends on a hard-coded list of agent names.
F12	Additive rollout	Existing wakes, reviews, subscriptions, credentials and database rows continue to work. Attention can be disabled without stopping Hive.

The handoff brief

The default human rendering must fit on one terminal screen for an ordinary item. Render the title, requested action, short context, artifact references, expected unblock, optional human-time estimate, and source/return route. Include queue position only as advisory: the queue can change.

Example, illustrative rather than live data:

ATN-42 · Birthday film · Select the next render
Do: compare the four candidates and select one for the video batch.
Context: this is the parent-likeness test, round 2; lighting is held constant.
Open: contact-sheet artifact and individual candidates.
Unblocks: the next generation batch. Estimated human time: 8 minutes.
Return: originating seat, saved session; queued 14 minutes ago.

Fields are authored by the submitting seat, not inferred from “task complete” prose. Schema validation checks shape and limits, not whether the broker agrees with an agent’s judgement. Artifact contents are not fetched or interpreted by the broker.

Seat behavior

Summon when a useful human intervention is ready, including a genuine blocker or decision before completion. Do not summon merely because a test finished, a PR was opened, or an autonomous peer can perform the next step. Use the existing review loop first where appropriate; this queue does not bypass review or merge policy.

After a successful summons, finish the current Hive delivery normally. An attention request is not an outcome acknowledgement, and an outcome acknowledgement is not a summons. Do not hold a provider process or actor lease open waiting for the human.

A seat receiving a human response reads the item’s current packet, applies the response within its existing harness permissions, and acknowledges the continuation through normal Hive completion reporting. New work requiring another human decision uses a new intervention key.

Human commands define availability

1. start records already-begun human work as the active item, or next selects a waiting item.
2. Agents and render jobs run independently and submit interventions whenever ready.
3. At a natural handoff, the operator resolves or defers the active item. --next is an explicit request to choose another item in the same transaction.
4. The brief for the selected item is returned to the operator. Pending response delivery proceeds independently.

resolve --next means “my part here is finished; show me the next intervention.” It does not assert that the receiving agent has already started implementation. The receipt distinguishes response saved, continuation queued, dispatched and processed.

There is no automatic rotation timer. estimate_minutes is a planning hint, not a lease or preemption deadline. Hákon can remain in a productive block as long as needed.

FIFO-1: the initial policy

Define selectNext(eligibleItems, explicitPick?) as a deterministic function. The default order is (ready_sequence ASC, item_id ASC). ready_sequence is a broker-assigned monotonic sequence from the event that most recently made the item ready; callers cannot choose it.

An item is eligible when state = queued. Before selection, the same transaction promotes due deferred items to queued, ordered by (deferred_until, original_item_id), allocating fresh ready sequences. Deferral therefore moves the item to the tail when it becomes ready again; it cannot repeatedly monopolize the head. Amendments never reset age or ready sequence.

A human can explicitly select an eligible item by ID. This is a visible override, not a priority score. An indefinite deferred item must be requeued before selection. A future priority policy must be versioned and explainable, but no priority, aging formula, context-switch score or ETA model is implemented in V1.

If an active item exists, next returns it—even when a different explicit pick was requested—with result = already_active. Switching requires a resolve, defer or cancel. This prevents an accidental hotkey press from discarding context.

If no item is eligible, return result = empty, the deferred count and earliest known deferred time. Do not invent tasks or silently start polling. Human-first items must be seeded explicitly; the system cannot guarantee progress on a project that has never been entered.

No-push rule

An incoming summons writes attention state only. No Slack mention, DM, toast, sound, application focus or human wake is emitted. Queue inspection is pull-based. Existing agent outcome posts remain governed by Hive; this feature does not promise to suppress notifications from unrelated Slack settings.

A future digest or calendar projection is outside V1. Human-attention requests are not ordinary actor deliveries and must not inherit their TTL or retry behavior.

Item state machine

queued → active → resolved is the ordinary path. queued/active → deferred → queued postpones work. queued/deferred/active → cancelled is an explicit human cancellation. A producer can withdraw only its own queued or deferred item; withdrawal of an active item is refused rather than removing work under the human.

Command	Allowed source state	Result
summon / human add	No matching semantic key	Create queued item.
Identical summon	Any existing state, including terminal	Return existing identity and state; never reopen.
amend	Queued, deferred, active	Replace allowed packet fields under revision check; retain state and order.
next	No active item; eligible queued item	Claim as active.
start	No active item	Create a human-origin item directly as active.
resolve	Active	Save terminal response and optional durable return effect.
defer	Queued or active	Move to deferred; a future UTC timestamp or explicit indefinite hold is required.
requeue	Deferred	Move to queued, assigning a fresh ready sequence.
Human cancel	Queued, deferred, active	Cancel with reason; no implementation instruction is sent.
Producer withdraw	Own queued or deferred item	Cancel with source-provided reason.
retry-return	Resolved item with failed/blocked return	Retry according to §10; never change the human decision.

Resolved and cancelled items are terminal. A follow-up round creates a new semantic key and can reference the predecessor. There is no reopen operation in V1.

Invariants to enforce in code and tests

I01 — Single active: at most one active item per human_id, enforced by SQLite, not only application logic.

I02 — Non-preemption: only an authenticated operator command may change which item occupies the active slot or transition it out of active. Time, source updates and return delivery cannot do so. A permitted source amendment changes packet content and revision, not focus ownership.

I03 — Durable acknowledgement: no successful mutation receipt is returned before the transaction containing its state, event history and command receipt commits.

I04 — Semantic identity: one item per (human_id, owner_principal, project_id, work_id, intervention_key). Repeated notification of the same round cannot mint a second item.

I05 — Revision honesty: amendments and item-targeted mutations require the expected item revision. Stale decisions are refused; they are not applied to a newer artifact silently.

I06 — Response durability: resolving an item and recording its return intent commit atomically. A Slack outage cannot lose a response or retain the human’s focus slot.

I07 — Two clocks: human work can wait for days; provider delivery leases/TTLs remain bounded independently.

I08 — No phantom continuation: processed describes the ordinary Hive continuation outcome, not a verified business result. Persisted human approval does not itself merge, deploy, spend money or execute shell commands.

I09 — Route honesty: the system never claims exact-session delivery unless the receiver actually accepts that session binding. Context restoration is explicitly named; route drift is visible.

I10 — Existing authority: attention binding permits producing requests, not issuing arbitrary wakes, selecting human work or acquiring the admin credential.

I11 — Audit preservation: display, claim, response retry and source retirement never delete intervention history. Historical source/transport IDs are soft references with saved snapshots, not cascade-delete dependencies on core Hive rows.

I12 — Scheduling isolation: no model call, network request or artifact fetch occurs inside a scheduling transaction. Failed continuation publication cannot block an unrelated next.

Canonical ownership

Create a Hive-owned JSON Schema at contracts/attention/attention-v1.schema.json. Generate src/attention/contract.generated.ts and validate the same schema with Ajv in src/attention/contract.ts. Generated TypeScript is not manually edited. The Python launcher forwards bytes/argv and contains no duplicate schema or scheduling rules.

Keep the existing review schema and contracts/SOURCE provenance untouched. Extend the contract generation/check pipeline to check both outputs, with the attention banner identifying its local schema source. Name every definition once. Use strict objects (additionalProperties: false) and discriminated action schemas.

Intervention packet

Field	Contract
schema_version	Integer constant 1.
human_id	Stable configured human ID; hakon initially. No provider enrollment.
project_id	Stable slug, 1–80 characters. Examples: birthday-film, krepis, rannis.
work_id	Stable work identity, 1–200 characters: a Linear key, repository issue identity, render batch or operator-defined job.
intervention_key	Stable identity of this particular human intervention/round, 1–160 characters. Not a timestamp regenerated on every retry.
kind	review, decision, selection, unblock, or human_work.
title	1–160 characters.
requested_action	1–1,500 characters; something the human can actually do now.
context	1–3,000 characters; sufficient to start without searching chat history.
unblocks	1–800 characters. Human-first work may describe the next milestone rather than an agent.
artifacts	0–12 references; each has label (1–120), uri (1–2,048), optional immutable version (1–200), optional edge_id (1–80).
estimate_minutes	Integer 1–240 or null. Human effort only, not total agent runtime.
deadline_at	UTC timestamp or null. Display-only under FIFO-1.
predecessor_item_id	Existing attention ID or null, for a subsequent round.

Total serialized command size is at most 64 KiB, checked at broker and edge ingress before buffering beyond the limit. String limits are schema bounds; the byte limit is additional. Unknown fields are refused. Canonicalize timestamps to UTC milliseconds before persistence; compare instants, not user-supplied string formats.

Supported artifact references are https://…, an existing validated Hive handle, or an explicit edge-qualified absolute file reference. Local paths must identify the edge that owns them. A path on a remote seat is not presented as a locally accessible file. No uploads, downloads, URL execution or arbitrary URI-handler launching occur in V1. Escape terminal controls and markup when rendering, while preserving the stored data.

Source identity, queue state, revision, ready sequence, claimed human and return route are not producer-supplied packet fields. They come from the authenticated source binding and broker state.

Source binding

An immutable AttentionSource records source_id, issuer edge, canonical actor (or operator), provider, project/work scope, source delivery coordinates when available, observed session ID or named absence, cwd, account-profile fingerprint, return mode, and a real Slack channel/thread reference when a return is required. It also records creation time, revocation state and provenance (dispatch, live_registration, or operator_binding).

owner_principal is seat:<canonical_actor> for seat work and human:<human_id> for human-origin work. The semantic key therefore remains stable across source re-enrollment. Fresh seat amendments/withdrawals additionally require the item’s exact source ID; a replacement source does not silently inherit write access. The operator may make the correction explicitly. Submitted project/work fields must match the bound source scope.

A source is not a task tracker or a reservation of agent capacity. Its life is independent of the original delivery. A local random source handle maps to it in the edge store and is never written into packet text, Slack, event history or logs.

Mutation envelope

{
  "schema_version": 1,
  "command_id": "8ba99410-c894-4632-aea6-b33a06a6b015",
  "action": "summon",
  "payload": {
    "human_id": "hakon",
    "project_id": "birthday-film",
    "work_id": "parents-likeness-round-2",
    "intervention_key": "candidate-selection",
    "kind": "selection",
    "title": "Choose the next birthday-film render",
    "requested_action": "Select candidate A, B, C or D for the next video batch.",
    "context": "Round 2. Same lighting and composition; compare likeness and expression.",
    "unblocks": "The next video-generation batch.",
    "artifacts": [],
    "estimate_minutes": 8,
    "deadline_at": null,
    "predecessor_item_id": null
  }
}

The local CLI supplies its source handle separately over UDS. The edge resolves it and forwards source_id under its machine authentication. Neither the caller nor the wrapper can insert an actor, principal, admin credential or source delivery ID into this envelope to establish attribution.

Command action shapes

All actions include command_id; item mutations include item_id and expected_revision. Fields not listed for an action are refused.

Action	Action-specific payload	Caller
summon	Intervention packet, bound source supplied by edge	Seat
amend	Item/revision plus replacement mutable packet fields	Owning seat or operator
withdraw	Item/revision, reason	Owning seat
add	Intervention packet; optional existing return source ID	Operator
start	Same as add; create directly active	Operator
next	Human ID, optional explicit item ID	Operator
resolve	Item/revision, outcome, response, select_next boolean	Operator
defer	Item/revision, reason, until timestamp or null for indefinite, select_next	Operator
requeue	Item/revision, reason	Operator
cancel	Item/revision, reason, select_next	Operator
retry_return	Item/revision, expected return generation	Operator
reroute_return	Item/revision, expected return generation, new enrolled source ID, reason	Operator

outcome is approved, changes_requested, answered, selected, delegated, or completed. response is required, 1–4,000 characters, and records exactly what the operator decided. These are workflow labels, not permissions or executable actions. A human-first item without a return source has no continuation effect. Resolving with delegated does not create an agent assignment from prose: it records the handoff, or sends it through an explicitly bound return route.

Producer amendments may replace title, requested_action, context, unblocks, artifacts, estimate_minutes, and deadline_at. They cannot alter the semantic key, owner, state, source, predecessor or route. Route corrections are explicit operator acts. An amendment of an active item increments its revision, so a response based on the old packet is refused until reread.

Receipts and error behavior

Every receipt includes schema_version, broker_uuid, command_id, action, result, replayed, as_of, affected item ID/revision when present, current active item when relevant, and return effect ID/phase when present. next also includes selection_reason and next_deferred_at. Queue/list responses use keyset pagination with default 25 and maximum 100 items; no durable pagination-snapshot machinery is introduced. Each page carries as_of; a moving queue is not a snapshot, and a client refreshes from the head to obtain a newly ordered view.

The same command ID with the same authenticated principal and normalized content returns the original committed result. The same ID with different content is command_id_conflict, even when the first item is terminal. Exact replay is resolved before time-varying lease, revision, source-liveness or route checks; current edge/operator authentication remains required.

A repeated semantic key under a new command ID returns the existing item if its submitted content is identical. Different content is item_exists_use_amend; a changed packet cannot silently overwrite an active review.

HTTP	Error / result class	CLI exit
200 / 201	Successful mutation, replay, already_active or empty	0
400 / 413 / 422	Malformed or oversized request; schema rejection	2
401 / 403	Authentication or source/caller authority failure	3
404	Missing item/source/command or feature unavailable on older server	4
409	Revision, state, semantic-key or return-generation conflict	5
429 / 503, network failure	Temporary inability to commit; retry same command ID	6
Other 5xx	Unexpected server failure; report diagnostic and preserve retry envelope	7

A blocked continuation does not retroactively fail a successfully saved human response. Its phase is visible in the successful receipt and subsequent reads. Unknown response status must not be reported as a definite failure to commit; on timeouts print the saved request ID and a reconciliation command.

Canonical CLI

# Headless seat: bind while its dispatch token is valid, then ring the bell.
hive-attention bind --project birthday-film --work parents-likeness-round-2 \
  --return actor-context --out ./attention-source.json
hive-attention summon --source-file ./attention-source.json --file ./summon.json

# Human: inspect and take a turn. A repeated next returns the same active item.
hive attention queue --human hakon
hive attention next --human hakon
hive attention show 42 --json

# Human: finish this intervention and explicitly request the next one.
hive attention resolve 42 --expected-revision 3 --outcome selected \
  --response "Use candidate C; retain the current lighting." --next

# Human: postpone without dropping the work.
hive attention defer 51 --expected-revision 1 \
  --until 2026-10-13T09:00:00Z --reason "Needs tomorrow's input" --next
hive attention requeue 51 --expected-revision 2 --reason "Input arrived"

# Human-first work: supplied as a packet, with no fabricated agent completion.
hive attention add --file ./rannis-intervention.json
hive attention start --file ./current-design-work.json

# Explicit recovery, never an unobserved second decision.
hive attention retry-command <command-uuid>
hive attention retry-return 42 --expected-revision 4 --return-generation 1
hive attention doctor --json

Examples are proposed syntax. bind uses the source-resolution rules in §08; it refuses an unsupported pinned route rather than pretending it exists. --return actor-context and --return none are explicit alternatives. Human add and start files contain a packet; the CLI wraps them in a mutation envelope. summon --file accepts the complete saved envelope shown in §06.

For live enrollment, bind requires the exact --actor and --session announced by the provider hook/bridge, or an explicit per-session binding file from that surface. Those flags select a registry entry; they are not identity proof on their own. Headless binding derives identity from the valid dispatch token. A hook may put its binding-file path into that session’s hook context; it must not pretend that a child hook can export environment variables into an already-running parent process.

All commands offer --json. Standard output is either the requested human rendering or one JSON object; diagnostics go to standard error. No progress spinner, model prose or debug output corrupts JSON mode. Reads never mark an item processed or claim it implicitly.

For convenience human mutations, generate a UUID and save the normalized request under ~/.hive/attention/requests/<command_id>.json before I/O, mode 0600. retry-command reuses those exact bytes. This is a local request journal, not an offline scheduling authority. Seat automation should supply saved command envelopes, so task-level retries preserve identity too. Never store the admin token or source secret inside those request files.

Transport layout

Surface	Proposed route / behavior
Broker capability discovery	GET /v1/attention/capabilities: schema version, enabled state, supported actions and routing features. Edge or operator authentication.
Broker source enrollment	POST /v1/attention/sources: edge-authenticated verified binding, or explicit operator enrollment. Returns public source metadata; local secret issuance remains at the edge.
Broker command path	POST /v1/attention/commands: strict action envelope; authenticated principal determines allowed actions.
Broker reads	GET /v1/attention/queue, /items/:id, /items/:id/events, /commands/:uuid. Edge/operator reads share the private-workspace view; receipt lookup is restricted to the issuing principal or operator.
Broker return guard	GET /v1/attention/returns/:resolution_command_id/guard?generation=…&delivery_id=…: edge-authenticated transport validation, as defined in §10.
Local edge source binding	POST /attention/bind: resolve dispatch/live/operator binding and durably associate a local handle.
Local edge command relay	POST /attention/act: validate source handle for seat mutations, forward source ID under edge credential, relay status/error unchanged.
Local edge read relay	POST /attention/read: typed read operation and arguments; no arbitrary URL proxy.
Human mutations	Direct authenticated broker calls using the existing operator credential. They are not enabled by the ordinary edge socket.

Mount routeAttention before the broker’s generic edge gate, as the review route is mounted today. Reuse common JSON/error and authentication helpers; do not add a web framework, new MCP transport or credential-scope hierarchy. Discovery reads may identify an older server as unsupported; mutations must never silently fall back to writing Slack text.

Agent-affordances packaging

Add attention/pyproject.toml, attention/src/hive_attention/cli.py, tests and a README. Export hive-attention. The launcher resolves HIVE_BIN when explicitly configured, otherwise the installed hive executable, and forwards attention plus the original argument vector without a shell. Preserve stdout, stderr, signals and exit codes. Reject recursion/missing executables with a useful diagnostic. The launcher owns no database, HTTP client, command schema, sorting or retry semantics.

Follow the repository’s Python/uv standards. A forwarding-only launcher does not need Typer or httpx merely to satisfy a template. Install with the project’s uv workflow; record the tested Hive capability version rather than relying on an agent-affordances version alone.

Why a new source binding is necessary

The existing headless delivery token is deliberately short-lived and not issued to live sessions. Keeping it alive until the human responds would distort actor leases; accepting --actor ariadne as proof would regress existing attribution. Source binding solves only this seam. It is not a general launch capability system. S10S11S12

Three enrollment paths

Dispatch-backed: while the current HIVE_DELIVERY_TOKEN is valid, the edge resolves it with resolveMintSource; the broker validates custody with assertLease and derives the actor from the delivery. Capture the selected provider/profile/workspace and any known pinned session from actual dispatch state. Register an immutable attention source. The resulting attention handle survives completion of that original delivery and can be passed deliberately to a long-running job callback.

Registered live: bind resolves the current live surface by exact actor/provider/session, not by “most recent conversation.” Extend live registration with observed cwd and expose a minimal binding lookup/verification seam. The edge compares the source to the registered surface and the broker’s enrolled profile. The current code lacks this complete attention binding: it must be added. Automatic startup integration can create a per-session source file; it must not overwrite one global “latest source” file that another session could consume.

Explicit operator binding: for an interactive/manual session that has no usable live registration, the operator can enroll a work context deliberately, choosing an existing actor, verified home edge/profile and either a proven session or actor_context. Add hive attention bind --operator --actor … --project … --work … --return … --out …. This setup command runs on the designated source edge, not a different workstation hoping to create a remote token file. The broker authenticates the operator for enrollment; that edge validates local profile/cwd evidence and issues the source file through its owner-local control plane. Only the operator’s setup process reads the operator credential; it is neither stored in the source file nor inherited by the seat. Remote setup may use the operator’s existing host-access workflow, not a new inbound edge service. This is an explicit setup action, not an agent fallback to the admin token. Where a session cannot be verified, only context-restored return is available.

The CLI must fail clearly when no valid source can be resolved. It must not guess identity from the author’s Git name, process recency, free-text actor name, or a stale delivery number.

Local durability and authority

Persist source-handle hashes and their source IDs in an additive edge table, with broker_uuid so a handle cannot accidentally bind to a different broker. Store the handle file with mode 0600 under the explicit per-work path; directories are owner-only. Fresh source mutations verify that the source belongs to this edge and has not been revoked. Already-committed receipt lookup must still work after revocation or source retirement when authenticated as the original edge/operator.

Sources remain valid until explicitly revoked or their actor/profile binding is retired. They are not automatically revoked when the original provider turn ends. Provide hive attention source show <id>, source list, and source revoke <id> --reason … as operator actions; revoke invalidates new source writes but preserves queued work and its provenance. A source’s identity is immutable; rebinding creates a new source ID. Enrollment and revocation use the same UUID/receipt discipline: source_bind includes a binding request plus verified edge evidence, and source_revoke includes a source ID and reason. Enrollment routes authenticate dispatch/live evidence or the explicit operator; revocation is operator-only. The local edge retains revoked handle identity for command-receipt recovery, but rejects new writes. Revocation does not prevent an already-recorded human response from returning to an otherwise valid captured route; retirement/profile drift does.

This is the existing single-Unix-user/private-workspace boundary, not protection against a hostile co-tenant that reads another process’s files. Do not claim otherwise. No source secret is sent to Slack, inherited by unrelated seats, or accepted for operator actions.

Return-mode matrix

Source	Initial return mode	Required behavior
Registered live Codex or Claude, known session/cwd, single-slot actor	pinned_session	Deliver only to that captured session or resume it on its home edge under existing policy.
Headless single-slot resume with known session	pinned_session	Reuse the known session only when route and profile still agree.
Spawned/multi-slot job without a safe reusable session/worktree	actor_context	Ordinary seat routing/slot allocation plus the saved packet and response. Receipt says context restored, not same session.
Manually bound session with verified identity	Explicitly selected mode	Verification determines whether pinned return is available.
Human-first work with no return target	none	Resolve locally; no agent wake is minted.
Unregistered or unverifiable source	No implicit binding	Refuse with recovery instructions; operator binding is available.

A pinned route that becomes unavailable does not automatically downgrade to actor_context. The operator must reroute it explicitly. This is the deliberate boundary that prevents “reply sent to Ariadne” from meaning “some unrelated Ariadne conversation received it.”

Component responsibilities

Agent-affordances launcher → Hive CLI → edge UDS → Attention HTTP adapter → Attention service/store → broker SQLite. The operator CLI calls the same attention service through the operator-authenticated broker route. A separate, small continuation publisher turns persisted return intents into ordinary Hive deliveries; existing edges and provider adapters execute them.

The attention store is authoritative for the human queue. Core Hive remains authoritative for transport. Linear remains the work/ownership ledger where a work item already exists; Git remains executable truth and artifact stores retain their outputs. References connect these systems without copying entire tickets or building a new work graph.

Proposed module map

Repository/path	Change	Responsibility / extension seam
hive/contracts/attention/attention-v1.schema.json	New	Single wire/domain schema with examples and strict action definitions.
hive/src/attention/contract.ts, contract.generated.ts	New	Ajv validators and generated types.
hive/src/attention/reducer.ts, selector.ts	New	Pure transition decisions and FIFO-1 selection. No I/O.
hive/src/attention/store.ts	New	Additive migrations, immediate transactions, idempotence, revisions, events and effects.
hive/src/attention/service.ts, http.ts, runtime.ts	New	Caller resolution, command handling, route mounting and composition on broker.db.
hive/src/attention/render.ts, cli.ts	New	Deterministic handoff formatting, JSON output and Commander group.
hive/src/attention/returns.ts	New	Return planning, durable effect drain and transport-phase projection.
hive/src/cli.ts	Modify	registerAttentionCommands, runtime boot, config, housekeeping and shutdown.
hive/src/broker/http.ts	Modify	Mount attention adapter; reuse/extract authentication helpers without changing old routes.
hive/src/broker/store.ts	Modify narrowly	Origin-aware internal system wakes, non-coalescing continuation identity, effective target lookup/claim constraints. Preserve existing review defaults.
hive/src/domain.ts	Modify narrowly	Optional typed continuation target on delivered envelopes; reuse actor canonicalization. Do not add a human provider.
hive/src/edge/control.ts, broker-client.ts, service.ts, store.ts	Modify	Attention relay, source binding persistence, exact origin capture and return-target checks.
hive/src/edge/live-registry.ts	Modify	Observed cwd and verified attention-source binding, without treating historical absence as proof.
hive/src/edge/providers.ts	Modify narrowly	Carry optional expected session through live delivery; preserve existing resume/spawn/profile paths.
hive/src/channel/claude-hook.ts, src/codex/live.ts	Modify narrowly	Receiver-side exact-session checks for constrained attention returns. Ordinary envelopes retain current behavior.
hive/scripts/gen-contract-types.mjs, package.json	Modify	Generate/check attention types alongside review types without changing review provenance.
agent-affordances/attention/…, README.md	New/modify	Thin independent uv launcher, tests, installation and examples.
weave-doctrine/skills/hive-attention/SKILL.md	New	When to summon, source binding, stable keys, brief quality, return handling and no-push rules.
weave-doctrine/seats/registry.json and explicit marketplace surfaces	Modify	Install for applicable enrolled seats; refresh explicit snapshots/provenance rather than silently editing only a bundled copy.
hive/docs/adr/ and docs/operations.md	Add/modify	Record accepted attention decision and operational runbook. Choose the next available ADR number at implementation time.

These new paths are implementation assignments, not assertions that files already exist. Add optional attention_protocol=1 to upgraded edges’ existing delivery-claim requests through BrokerClient.claim, BrokerService.claim and BrokerStore.claimNext; absence means protocol 0. An old edge must never claim a protocol-1 attention continuation. This is per-request capability declaration, not a cached flag that can survive an edge rollback incorrectly.

Keep test files alongside the modules according to the current Hive convention. No hard-coded seat aliases, host addresses or profile paths from this report belong in production code.

Broker tables

Use the broker’s existing database handle, not a second connection per request. Table names are attention-prefixed. Columns below are the minimum logical model; timestamps are canonical UTC and JSON columns are schema-validated on write.

Table	Minimum contents / rules
attention_schema	Singleton module schema version, initially 1. Does not change broker PRAGMA user_version = 5.
attention_sources	Source ID; immutable provenance/route snapshot; issuer principal/edge; project/work scope; created/revoked metadata. No local source secret.
attention_items	Integer autoincrement ID; human and semantic-key columns; source ID; state; revision; packet JSON; ready sequence; deferred-until; created/updated/claimed/resolved times; terminal response/reason.
attention_events	Monotonic event ID; item/source reference; command ID; principal; event type; timestamp; immutable payload. Ready events supply ready sequences.
attention_commands	Globally unique command UUID; issuer principal; normalized payload hash; committed receipt JSON; timestamp. Shared with source-enrollment/revocation command receipts.
attention_returns	Return ID; item/resolution command; generation; route/source snapshot; phase; retry timing/reason; minted delivery ID; transport outcome snapshot. One logical return per resolution, with explicit retry generations.

Edge storage adds attention_source_handles with handle hash, broker UUID, source ID and local provenance. It owns no queue state.

CREATE UNIQUE INDEX attention_one_active_per_human
  ON attention_items(human_id)
  WHERE state = 'active';

CREATE UNIQUE INDEX attention_semantic_identity
  ON attention_items(human_id, owner_principal, project_id, work_id, intervention_key);

CREATE INDEX attention_ready_order
  ON attention_items(human_id, state, ready_sequence, item_id);

CREATE INDEX attention_deferred_due
  ON attention_items(human_id, state, deferred_until, item_id);

Core deliveries additionally gains nullable continuation_target_json and required_edge_protocol INTEGER NOT NULL DEFAULT 0, added through the existing additive-column migration pattern. Ordinary rows stay null/0; only internal attention minting writes protocol 1. These are delivery routing metadata, not attention queue state.

Use CHECK constraints for state/revision and appropriate indexes for source ownership, command UUID and pending returns. Do not add foreign keys from attention history to core deliveries/subscriptions whose existing retirement path deletes those rows. Save enough source and transport metadata to remain truthful after retirement. References within the attention module may use restrictive foreign keys; no cascaded history deletion.

Transaction algorithm: next

BEGIN IMMEDIATE
  authenticate principal; resolve an already-committed command replay
  promote due deferred items, recording fresh ready events
  if an active item exists for this human:
      persist receipt(already_active, that item)
  else:
      choose eligible item with FIFO-1 or explicit human pick
      if none: persist receipt(empty, next deferred time)
      else: mark active, increment revision, append claimed event,
            persist receipt(claimed, item + deterministic brief)
COMMIT
return committed receipt

No item is deleted. Human claims do not have a TTL: a laptop sleep, terminal crash or long design session must not schedule a second item. Recovery is show, followed by explicit resolve/defer/cancel.

Transaction algorithm: resolve --next

BEGIN IMMEDIATE
  authenticate operator; resolve exact command replay first
  verify active item and expected revision
  save outcome + response; increment revision; append resolved event
  if a return source exists: insert one pending return intent
  if select_next: promote due deferred items and claim the next eligible item
  persist the complete receipt, including the newly selected item if any
COMMIT
return immediately; continuation publication runs independently

If no next item exists, the resolution still commits. If the revision is stale, neither the resolution nor the next selection occurs. A retry of the same combined command returns the originally selected next item, not whatever happens to be queued now.

Generalize the existing internal wake primitive

Extend SystemWakeMint with an internal origin discriminator defaulting to review. Existing calls retain their current sender, review: event ID, raw shape and dedupe behavior. Attention calls use attention: event IDs, hive-attention attribution and structured resolution coordinates. This is not an edge-accessible arbitrary system-wake endpoint. S13

Give every attention return its own coalescing identity: attention-return:<resolution_command_id>:<generation>. Do not merge it with unrelated pending wakes in the same Slack thread. Extend the internal ingest options rather than accepting a coalescing key from Slack text or a seat packet. Existing non-attention callers remain unchanged.

The attention return worker uses the same SQLite handle. When routing is possible, mint the core delivery and record its delivery ID/minted phase in a single synchronous transaction. No Slack network request is needed to save the intent or mint the delivery. The normal broker outbox and delivery lifecycle handle external transport afterward.

What the continuation contains

Include the item ID and broker UUID, resolution command ID, source work/project identity, recorded return mode, outcome, the exact human response and hive attention show <id> --json to retrieve the complete persisted packet. Keep the inline envelope within 8,000 characters; the response limit leaves room for bounded routing metadata. Do not silently truncate a human response or artifact identity. The full packet is available through the existing edge-authenticated read relay.

Use the saved real Slack thread for traceability. For operator-created contexts without a thread, setup must supply a valid configured attention thread before enabling an automatic return. return_mode = none remains valid without Slack. Queue writes and resolution persistence do not depend on thread replay availability; actual provider continuation retains Hive’s existing replay behavior.

Enforce route constraints at both ends

For pinned_session, attach an immutable continuation target to the minted delivery: source ID, actor, expected provider/profile binding, home edge, exact session ID and cwd. It is broker-derived, not parsed from arbitrary message text. The broker’s claim path considers this target before handing out a claim; the edge uses it when choosing live versus resume. Add one pure effectiveDeliveryRoute(subscription, continuationTarget) helper used by both claim eligibility and edge route selection. Keep the original subscription snapshot intact, and pass a derived per-delivery session/cwd to existing adapters. A target must not replace the permission profile with an old, more permissive snapshot. Recheck the actual profile/session at provider ingress as described below. Do not rewrite the actor’s global subscription to deliver a single response.

The generated routing shape is equivalent to:

type AttentionContinuationTarget = {
  kind: "attention_return";
  protocol: 1;
  source_id: string;
  resolution_command_id: string;
  generation: number;
  actor: string;
  mode: "pinned_session" | "actor_context";
  pinned: null | {
    provider: "codex" | "claude" | "grok";
    home_edge: string;
    account_profile_fingerprint: string;
    session_id: string;
    cwd: string;
  };
};

pinned is non-null only for pinned_session; enforce that discriminant in JSON Schema. The profile fingerprint is a hash of the canonical provider/home-edge/profile-path identity, not of credentials. Record actual source profile metadata through existing edge evidence; do not read or hash authentication secret contents. actor_context keeps pinned = null and uses normal current subscription routing. The target is written on the core delivery in the mint transaction and read consistently on every broker transition; callers do not reconstruct it from mutable item text.

Only the originating home edge may resume a machine-local session. Exact live delivery requires the registered session to match. If that session is not live, use the existing provider resume path only when policy permits and the captured route is still valid. Missing sessions, profile changes, cwd loss, incompatible slot configuration or a changed binding produce an explicit route failure. live_only stays live-only; resume never becomes spawn.

A broker claim from a client that omits attention_protocol=1 skips these deliveries, including context-restored returns. An upgraded edge advertises protocol 1 only when its installed provider surfaces support the constrained-message checks. This prevents a partially upgraded fleet from silently ignoring route constraints.

The receiver must repeat the exact-session check immediately before accepting the envelope. For Claude, write expectedSessionId on constrained inbox messages and have the hook drain only messages matching its actual session_id; unknown/mismatched sessions do not consume those files. For Codex, the live bridge validates the expected task/binding before accepting /deliver. Route replacement between registry lookup and delivery must not redirect the response. Ordinary, unconstrained wake behavior is not changed.

To prevent stale constrained Claude inbox files being consumed after a return is retried or rerouted, the hook validates the attention return generation and core delivery status through the edge before emission. Use the local /attention/read operation return_guard, carrying the resolution command ID, return generation and delivery ID; the edge calls the dedicated broker guard read under its machine credential. The response is {eligible, reason, as_of}. Eligibility requires that this is the current, unsuperseded return generation, that its stored delivery ID matches, that the delivery is dispatching or dispatched, and that its claiming edge is the authenticated caller. Session matching remains an independent receiver-side check. An expired delivery lease alone must not invalidate an otherwise eligible Claude outcome-waiting message; retain the existing grace semantics. Superseded/terminal transport attempts are quarantined, not delivered. An unavailable validation path leaves a constrained message unconsumed for retry; ordinary wakes retain their existing behavior. This is an attention routing check, not a new general authority-grant system. It cannot retract an envelope already accepted by a provider, and does not claim atomicity across the broker and provider boundary.

For actor_context, use the actor’s current ordinary route and capacity rules, including slot-specific worktrees. The envelope explicitly says context is being restored, points at the saved packet and names source artifacts/work identity. It must not claim that the old provider transcript or checkout was resumed. Existing harness/workflow instructions determine how the seat obtains the correct repository/artifacts; inability to do so is a visible agent outcome, not a reason to execute in an unrelated project.

Return phases

Attention return phase	Meaning / next step
pending	Human response is durable; a continuation has not yet been minted.
blocked	Source/thread/route cannot currently be used. Preserve response and reason; retry transient availability on bounded schedule or await explicit route repair.
minted	A core Hive delivery exists. Project its actual pending/claimed/dispatched/terminal status; do not mint another behind it.
processed	Core Hive recorded the continuation’s ordinary outcome. Not an assertion that a business goal was met.
failed	Core delivery is failed/undeliverable, or return planning encountered a permanent route defect. Human action may retry or reroute.
superseded	An operator explicitly replaced a failed/unstarted return generation. Historical decision and transport records remain intact.

Each drain performs two bounded passes: due unminted returns, and minted returns whose core delivery is terminal or missing. Persist terminal outcome snapshots during the second pass. In-flight minted deliveries are read for status, not reminted; they must not consume the entire pending-publication batch or starve it.

Hook the small return drain into the existing five-second housekeeping cadence as an independent job, not ahead of review publication or outbox draining. Use the existing Clock seam for due work and tests. S21

A source temporarily without a usable subscription may be marked blocked and checked again after 60 seconds; no tight loop or growing number of deliveries. Apply bounded batches (maximum 25 due return rows per pass). Permanent route drift waits for an operator. Once a delivery is minted, core Hive owns its retries, backoff, attempt limit and TTL; attention must not continuously mint replacements to evade them.

retry-return is idempotent while a delivery is still active and refuses to resend a processed return. For a failed generation, an explicit operator retry allocates the next generation and a new dedupe key. reroute-return is permitted only before minting or after the previous core delivery is terminal; it cannot retract an already-running provider turn. Retry/reroute additionally checks that the previous return’s source and packet revision are the ones the operator inspected. The operator must see any uncertainty/previous outcome before authorizing a new route. No claim of exactly-once provider execution is made.

Failure table

Failure	Required result
Summon response is lost after commit	Retry original command; same item and receipt, no duplicate.
Broker restarts while a human is reviewing	Same item remains active, with its latest revision.
Human resolves during Slack outage	Response and optional next selection commit; return is pending/minted until normal transport recovers.
Source delivery finishes or its token disappears	Bound attention source remains usable; no actor lease is held for the human.
Two devices request next simultaneously	One active item; both responses identify it, or the stale transaction retries and reads it.
Agent amends artifact while human is deciding	Revision changes; stale resolve is a 409 with fresh metadata.
Actor/profile/session is retired or changed	Queue history remains; exact return is visibly blocked/failed, never silently rerouted.
Return is delivered twice after transport uncertainty	Stable resolution ID/generation in envelope; receiving seat follows normal duplicate-aware Hive behavior.
Core transport row is later deleted by actor retirement	Saved outcome snapshot remains; absent transport without a snapshot is explicitly transport_record_missing, never inferred processed.
Queue is empty or everything is deferred	No dispatch, no task invention, no forced project switch.

The operator uses the existing flat admin credential. Do not expose it to seat environments, command packets, marketplace snapshots or the ordinary edge relay. Edge authentication identifies the machine; source handles identify the enrolled work context. The broker resolves the source’s actor from its own record and enforces owning-source amendment/withdrawal.

Attention binds a producer to a work context, not to mutation authority over code or external systems. “Approved” is recorded data and an instruction returned to the seat; the receiver’s existing harness and workflow remain the authority ceiling. No new universal approval gate is added to ordinary Hive deliveries.

Reject unknown fields, invalid enums/IDs, excessive bodies, invalid timestamp formats and unsupported return modes. Use parameterized SQL. Render all external text as inert text. Do not fetch artifact URLs, execute response strings, evaluate shell snippets, or process WAKE:/Effort: text inside saved packets as a new attention command. Existing outgoing Hive metadata remains excluded from Slack re-admission. S04

All broker/edge attention requests must have an enforced timeout with cancellation, default 10 seconds, and bounded request bodies. A request timeout does not prove non-commit; reconcile with the saved command ID. Keep off-box traffic on the existing HTTPS/private-tunnel transport. Map unexpected attention-handler failures to a typed 500 response rather than the broker’s broad legacy bad-request fallback; a database-busy timeout is a retryable 503. Use the existing client/UDS machinery where possible, adding bounded options rather than a second transport implementation.

Initial limits are operational guardrails, not scheduling priorities: 64 KiB per command, 12 artifacts per item, 100 rows per read page, 25 return intents per drain pass. Do not silently drop items at a queue length limit. An abnormal producer flood must surface as a visible rate refusal with the original stable key preserved; add per-source rate limiting only if existing deployment policy requires it, not as a prerequisite for the pilot.

Implement in this order. Each package is independently reviewable, but the product is not done after the first queue table.

Package	Work	Exit condition
P0 · Baseline and contract	Compare current repos to pinned baseline; read current instructions; add accepted ADR, canonical schema, examples and generated types. Record any baseline drift.	Schema and examples validate; generated diff gate passes; no review contract changes.
P1 · Durable queue	Add attention tables, pure transitions, FIFO selector, idempotent command handling, revisions and deterministic renders.	Core state/concurrency/restart tests pass with a real temporary SQLite database.
P2 · Human surface	Mount authenticated routes; add CLI reads, add/start/next/resolve/defer/requeue/cancel and local request replay.	Two terminal clients cannot create two active items; human-first loop works without any model or Slack availability.
P3 · Seat sources and summons	Add durable edge source handles and dispatch/live/operator enrollment. Implement summon/amend/withdraw and source revocation.	Every required source class can submit; no tokenless-live dead end; foreign source/actor spoofing is refused.
P4 · Return loop	Generalize system wake origin, isolate coalescing, persist return effects, add exact-route constraints and receiver checks, project transport outcomes.	Correct-seat response survives restart/outage; pinned mismatch never reaches a different session; context-restored mode is visibly distinct.
P5 · Distribution and doctrine	Add agent-affordances launcher, install docs, Weave skill and seat rollout changes. Refresh explicit marketplace artifacts/provenance through the repo’s existing process.	Every pilot seat discovers the same command and capability version; stale packaging is diagnosed.
P6 · Acceptance and pilot	Exercise multi-project loop, failure injection, regression gates and real-provider smoke tests. Publish test/deployment receipts and runbook.	All release-blocking scenarios in §13 pass; operator accepts the pilot behavior.

Coding-agent start instructions

Create a normal feature branch/worktree according to each repository’s instructions. Do not edit generated contracts directly, reformat unrelated modules, change model versions, redesign the review state machine, alter seat authority, or create new hosted infrastructure. Use the existing broker composition, error-envelope, actor-canonicalization, UDS, provider and clock seams.

Start with schema/examples and P1 tests. Implement return routing deliberately; do not label P2/P3 as complete product delivery. For every changed seam in the module map, add a focused regression proving the pre-existing path still works. All operational addresses and secret locations come from the existing deployment configuration, never from this briefing.

Completion output must include changed repositories/commits, schema and CLI contract versions, checks actually run, live-provider matrix results, migration/rollback proof, any explicitly unavailable source class, and the operator’s commands to try the loop. Do not assert that a source type is supported on the strength of a mock alone.

Tests should prove user-visible outcomes and the invariants above, not multiply fixtures without a failure they protect against. Use an injected clock, temporary file-backed SQLite databases, two connections/processes for concurrency tests, fake provider transports for deterministic failure injection, and separate real-provider smoke tests.

ID	Scenario	Pass condition
A01	Agent rings while human is active	New item is queued; active ID/revision unchanged; no notification or focus change.
A02	FIFO sequence and amendment	Initial order preserved; amendment does not jump the queue.
A03	Explicit human pick	Eligible item chosen with selection_reason = explicit_pick; remaining order unchanged.
A04	Repeated and concurrent next	One active item globally for the human, including independent client processes.
A05	Crash after claim commit, before response	Replay returns the same active item after reopening the database.
A06	Combined resolve-and-next replay	One response, one return intent, one next claim; retry returns the original selected item.
A07	Stale combined resolve	No resolution, return or next selection occurs; 409 exposes current revision.
A08	Deferral and time advance	Item remains absent before due time, joins FIFO tail when due, indefinite hold never auto-promotes.
A09	Human-first work	Add/start/resolve works with no source delivery or running agent.
A10	Empty queue	Explicit empty receipt with deferred metadata; no model/provider call.
A11	Same command, lost response	Original result survives source completion/revocation; no duplicate item.
A12	Same command ID, different bytes	Conflict with no state change.
A13	Same semantic key, changed packet	Requires amend; never overwrites or reopens terminal work.
A14	New intervention round	New key creates a distinct item with valid predecessor reference.
A15	Producer ownership	A source cannot amend/withdraw a peer’s work or execute next/resolve.
A16	Active withdrawal	Refused; active item cannot disappear under the human.
A17	Headless source lifecycle	Codex, Claude and Grok dispatch-backed sources submit; binding remains usable after the original turn ends.
A18	Live source lifecycle	Registered live Codex/Claude submit without relying on HIVE_DELIVERY_TOKEN; precise session/cwd recorded.
A19	Manual operator binding	Works without guessing recency; unverified session cannot claim pinned return.
A20	Source attribution and reboot	Client-supplied actor/delivery identity refused; persisted handle survives edge restart; wrong broker UUID refused.
A21	Resolve with broker Slack transport unavailable	Human response and next claim durable; no blocking network wait in transaction.
A22	Return mint crash boundary	SQLite rollback/restart yields one logical generation/core delivery mapping, not an orphan or duplicate.
A23	Review wake regression	Existing review event identities, sender, coalescing and published outcomes remain unchanged.
A24	Attention return coalescing	Two attention responses and an ordinary wake in one actor/thread remain correctly correlated and isolated.
A25	Exact-session race	Change the live binding between plan, claim and ingress; no different session accepts the constrained envelope.
A26	Claude inbox isolation	Mismatched/unknown sessions cannot drain constrained files; superseded generations cannot arrive later. Ordinary wakes still drain.
A27	Policy and profile preservation	Missing profile, live-only restriction, home-edge restriction and resume-no-spawn invariants preserved.
A28	Multi-slot context restoration	Normal slot allocation/cwd isolation retained; no old worktree silently resumed; receipt names restored context.
A29	Route loss and explicit repair	Retired/missing source visible; response retained; retry/reroute cannot duplicate an active or processed return.
A30	At-least-once redelivery	Stable resolution coordinate present on every retry; provider duplicates are not falsely reported impossible.
A31	Schema and output boundary	Unknown fields, oversized bodies and terminal-control injection handled; JSON stdout stays valid and token-lean.
A32	Packaging	Wrapper preserves argv/exit/signals, missing Hive diagnosed, all selected seats receive command and skill; provenance points at actual source revisions.
A33	Upgrade and disable	Additive migration preserves baseline subscriptions/deliveries/reviews; old protocol-0 edges never claim attention continuations; disabled attention creates no new effects and ordinary Hive continues operating.
A34	Nonblocking housekeeping	Slow review publisher/Slack drain does not block attention selection; attention failures do not block the other jobs.
A35	Actor retirement/history	Existing retirement is not broken by attention foreign keys; historical source and terminal return facts remain readable.
A36	Real daily loop	Design → agent implementation → next review → render selection → return to bug fixes works without checking every agent window.

Required repository checks

For Hive, run the current bun run check gate, which includes contract checks, build and Node tests; also run a fresh build and the targeted attention tests through the existing test runner. Use the repository’s pinned toolchain rather than introducing new versions. S09

For the new affordance project, run its pytest, lint/format and type gates under uv according to the current repository standard. For doctrine, run the applicable skill/seat installation and snapshot/provenance checks defined in the current checkout. Record exact commands and outputs; do not invent a universal doctrine command not present in the repo.

The live smoke matrix must include one configured Codex seat, one Claude seat and one Grok seat, plus the live Codex/Claude paths where installed. No live credentials or provider invocations were exercised while preparing this specification. Unsupported deployment paths remain a release limitation until exercised; do not hide them behind green unit tests.

Configuration

Add HIVE_ATTENTION_ENABLED (default false for the first release) and HIVE_ATTENTION_HUMAN_ID (default hakon). Treat the attention human ID as a queue identity, not a person-profile lookup. Sources carry validated thread coordinates; no invented Slack IDs are required. Use the existing broker URL, operator credential and edge credentials.

When disabled, do not accept new attention mutations or mint returns. Reads may remain available when its schema is present. Already-minted core Hive deliveries retain their ordinary lifecycle; disabling attention is not a cancellation of a provider turn already running. The CLI capability check must explain this distinction.

Deployment order

Back up the current database with a consistent SQLite backup, including verification by opening the backup. Do not copy only the main database file while ignoring active WAL contents. Deploy the broker’s additive attention schema and routes first with the feature disabled, then updated edges/provider surfaces and CLI. Install the affordances launcher and canonical skill on pilot seats. Inspect doctor output and source bindings, then enable the pilot.

Migrations create attention-prefixed tables/indexes and a module version; they do not bump the broker’s generation-5 stamp or reset any live tables. Existing review and attention migrations run on the shared handle without closing it independently. Refuse an unknown newer attention schema with a clear diagnostic rather than guessing compatibility.

Disabling the feature pauses unminted return publication and mutations. Rolling code back is safe only after accounting for in-flight constrained attention returns: disable new mutations/publication, then let every already-minted attention delivery reach a recorded terminal disposition before downgrading the broker or provider surfaces. Do not rely on a hypothetical pause/cancel command absent from the baseline; an emergency shutdown requires inspection and recovery before dispatch resumes. Never claim that an old edge can safely understand a new constrained return. Retain attention tables for re-upgrade and audit; destructive removal is not part of rollback.

Doctor and status

hive attention doctor --json reports broker reachability/UUID, feature/schema/capability versions, CLI compatibility, edge reachability, source binding validity and supported return modes. It must not print secrets.

Queue status reports active item, eligible/deferred counts, oldest eligible age, next due deferral, pending/blocked/failed return counts and source route warnings. Show when each state was observed. “Agent running” may only be shown from an actual current delivery state or explicit source report; a summons or saved response alone is not evidence of continued agent execution.

Structured events/logs include command/item/source IDs, actor/human IDs, transition, revision, selection reason, return generation and delivery ID. Do not log response bodies, source secrets or artifact contents by default. Keep all item history and command receipts in V1; an archival policy can follow observed usage.

Proposed performance targets for the pilot are p95 below 250 ms for broker-local queue operations and below one second for end-to-end LAN/tunnel CLI interactions under normal conditions. These are targets to measure, not claims about current performance. More important release criteria are zero lost committed interventions, zero duplicate active items and zero silent wrong-session returns.

Pilot script

Seed one grant-writing intervention and one job-application intervention as human-first work. Start a design block. Have two coding seats and one generation-work producer submit distinct interventions while it is active. Verify nothing interrupts the block. Resolve the design handoff with --next, act on the next brief and reply. Restart the broker during the next active block, and repeat with Slack deliberately unavailable. Restore connectivity and verify pending continuations complete without repeating the human’s decision.

Only after this loop works should a menu-bar surface, hotkey integration or calendar view be considered. None is a dependency of this release.

Deliberately not in V1

Priority scheduling, starvation-prevention weights, project quotas, context-switch scoring, predicted agent durations, calendar blocking, automatic focus inference, automatic planning of all projects, dependency DAGs, notification escalation, GUI development, natural-language decision execution, autonomous human approvals, multi-user tenancy and a new worker execution system.

The schema keeps useful raw inputs such as project identity, creation time, estimate and deadline so later policy can use real observations. It does not prebuild those policies or promise that FIFO minimizes context switches mathematically. The natural-handoff rule is the initial mechanism for reducing unnecessary switches.

Acceptance is complete when

The operator can start human-first work, let several seats summon without interruption, take exactly one next item, understand its brief without reconstructing chat history, resolve or defer it, and see a correct, durable response reach the originating work context. The loop survives duplicate calls, restarts, stale artifacts, unavailable Slack and changed sessions. All enrolled pilot seat types have the command and skill. Existing Hive and review behavior remains intact.

Definition of done: the queue and response loop work end to end on the actual pilot seats, the release-blocking tests pass, rollout/rollback are demonstrated, and the implementation report names what was exercised. A table plus an enqueue command is a milestone—not completion.

Source references document the inspected baseline only. New contracts and design decisions are normative proposals in this report, not claims about existing code. Links are pinned to the inspected commits so the implementation agent can distinguish baseline facts from subsequent changes.

Ref	Inspected source	What it establishes
S01	Hive baseline commit	Runtime baseline identity.
S02	Agent-affordances baseline commit	CLI repository baseline identity.
S03	Weave-doctrine baseline commit (private source at the inspected revision)	Registry/packaging baseline identity.
S04	Hive AGENTS.md	Governing invariants and check gate.
S05	ADR-0003	Current trust, delivery and provider constraints; supersession of older machinery.
S06	BrokerStore, initialization and schema	Shared database handle, WAL, generation 5 and core tables.
S07	Review runtime	Module composition on broker.db.
S08	Broker HTTP	Route order, admin/edge authentication and HTTP adapters.
S09	Hive package.json	Actual dependencies, scripts, binary and runtime tooling.
S10	Edge control	UDS routing, dispatch-source resolution and broker relay behavior.
S11	Edge service	Dispatch-token lifetime, slot handling, source capture and provider route selection.
S12	CLI commands	Existing wake limitation, attachment commands and operator surface.
S13	Broker system/seat wake minting	Review-specific system attribution, dedupe and outbox integration.
S14	Broker subscription retirement and ingest	Thread coalescing and deletion of retired actors’ core records.
S15	Live ingress registry	Actual actor/provider keying and registration fields.
S16	Hive domain types	Provider/actor types, turn-slot constraints and dispatch-token contracts.
S17	Claude hook and provider adapters	Actor-scoped inbox and actual live/resume/spawn paths.
S18	Agent-affordances README	Independent uv projects and existing tool organization.
S19	Marketplace (private source at the inspected revision) and seat registry (private source at the inspected revision)	Explicit snapshot policy, tool launchers and enrolled-seat configuration.
S20	Contract generator	Existing JSON Schema→TypeScript pipeline and review-specific provenance.
S21	Broker service/housekeeping and CLI startup	Independent publication/outbox jobs and five-second runtime cadence.

---

Implementation handoff: implement this specification against the current repositories, preserving the baseline invariants and recording any source drift. Ship the smallest complete human-intervention loop, not a second orchestration platform.