CedarCopilot wants to merge 3 commits into staging from worktree-delegated-dispatch-forcer
Live on prod, no production signal yet
Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.
Verification reached its 120s wall-clock budget before a tied verdict. Libra is keeping this intent verifying until the next check.
Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.
Verification reached its 120s wall-clock budget before a tied verdict. Libra is keeping this intent verifying until the next check.
Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.
Since 2026-09-08T22:34:24Z, CloudWatch shows 0 invocations for @org/subagents/drafter and 0 for @org/subagents/next-steps, and OTEL shows 0 spans carrying either exact org-scoped ref. Therefore there is no positive runtime evidence that the intended org-document generic path.
Libra has verdicts on 0 of 8 tracked behaviors on prod; 8 are still being checked. Libra checks hourly for 3 days after each deploy.
Daily-agenda's review sweep dispatched next-steps/crm-updater/strategist via runAgent directly , the generic, unrestricted automation path , instead of the real run-subagent tool, which is the only place in the codebase that correctly routes these system agents to their dedicated, curated-allowlist dispatch tools. That's how a next-steps review run ended up with modify-calendar-event in its toolset and sent a real calendar invite to external attendees with no approval step (Pax/Trey account, 2026-09-08).
Full design/investigation: apps/server/docs/design/delegated-dispatch-forcer.md (added in this PR).
next-steps and drafter now dispatch through the real run-subagent tool from the review path, exactly as the on-event orchestrator already does , no more bespoke re-implementation (runDrafterRef deleted, replaced by a generic runNamedSubagentViaTool).crm-updater and strategist are excluded from conversation review entirely (REVIEW_EXCLUDED_SUBAGENT_NAMES), per explicit product decision , filtered out of the triage candidate list before the classifier ever sees them. Their dedicated tools hard-require a live event a review never has, so they can't yet be routed the same way next-steps/drafter are; rather than leave them running unrestricted until that's built, they simply don't run on review at all. This is a real functionality loss, not just a security tightening , the morning sweep stops producing crm-updater's field syncs and strategist's MEDDPICC/strategy output for reviewed deals until they're migrated. Measured exposure this closes immediately: crm-updater called save-draft from review 9 times and strategist 34 times in one 7-day sample, under the same unrestricted toolset (REVIEW_DRAFT_HANDOFF_DENIED_TOOLS's own comment).agentSubRunId/executorRunId) that agenda-run-telemetry.ts needs to correctly attribute tool calls , reproducing the exact bug class the deleted runDrafterRef's own fallback logic existed to prevent. Now forwarded through both run-subagent and updateNextStepsAndTasksTool's output schemas.Explicitly deferred, not this PR (see design doc): migrating crm-updater/strategist onto run-subagent (needs a no-live-event review mode built into each , real tool-logic work); a runAgent-level reserved-name guard (considered and rejected as unsafe in its naive form , it would break legitimate org-level-ref and no-parentRunId-sentinel fallthrough; needs its own scoping pass); migrating run-single-subagent.ts (the subagent-runner CLI, a third confirmed instance of the same bug class); gating calendar in agent-scope.ts's TOOL_ACTIONS (calendar is currently ungatable by connection scope for anything on the generic path at all).
No test coverage was added , there is no existing test scaffolding for runPlaybookSectionExecution's dispatch loop or runSubagentTool.ts to extend, so this would be new test infrastructure, not a quick addition. Verified instead via pnpm --filter @zero/server run types, pnpm run deps:check, and oxlint --deny-warnings on every touched file (all clean) plus manual tracing of every claim in the design doc (execution-row parenting, org-level/no-parentRunId fallthrough, telemetry attribution). Libra's separate "could dispatch more than once" advisory is not a new risk from this change , the existing canRunExecutor/REVIEW_SKIP_IF_RUN_WITHIN_HOURS dedupe machinery is untouched by every commit here.
pnpm --filter @zero/server run types , cleanpnpm run deps:check , 0 violations (confirms the lazy await import() pattern is correct)pnpm dlx oxlint@1.78.0 --deny-warnings on every touched file , cleanagentSubRunId/executorRunId propagation,Libra has not measured any production surfaces for this change yet.