fix(agent): use None for bootstrap thread source_channel

The bootstrap/hydration path has no incoming message, so hardcoding "gateway" was incorrect. Use None to indicate no known source channel, which permits approval from any channel (backward-compatible). Addresses Gemini review feedback on #1582. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
style: fix rustfmt formatting in thread_ops channel auth check
2026-08-25 14:53:34 +00:00 · 2026-03-23 05:56:35 -07:00 · 2026-03-23 08:07:12 +00:00 · 2026-03-23 00:28:14 -07:00
175 changed files with 5242 additions and 15607 deletions
@@ -0,0 +1,259 @@
+---
+name: pr-review-batch
+description: IronClaw maintainer PR review -- batch review open PRs against ironclaw project standards (Rust, WASM tools, dual-backend DB, security-first)
+triggers:
+  - review PR
+  - review PRs
+  - review open PRs
+  - batch review
+  - "review #"
+  - check PRs
+---
+
+# IronClaw PR Review Workflow
+
+Maintainer review workflow for the **nearai/ironclaw** repository. Optimized for batch review with parallel data fetching, security-first evaluation against IronClaw's Rust/WASM architecture, and structured GitHub review comments.
+
+- **Repository:** nearai/ironclaw
+- **Maintainer GitHub:** zmanian
+- **Primary language:** Rust (async tokio, wasmtime, axum)
+- **Key subsystems:** WASM tool sandbox, dual-backend DB (postgres + libsql), LLM provider decorator chain, multi-channel system, SKILL.md skills, registry/installer
+- **CI jobs that matter:** Formatting, Clippy (default, all-features, libsql-only, Windows), Regression test enforcement
+- **CI jobs that DON'T prove much:** classify, scope (these always pass, even on fork PRs with no secrets)
+
+## Review Modes
+
+The user controls how interactive the review is. Detect the mode from their message:
+
+| User Says | Mode | Behavior |
+|-----------|------|----------|
+| "Review 938, 933" | **Autonomous** | Fetch, evaluate, post reviews without stopping |
+| "Review PRs. Interview me" | **Interactive** | Present findings, ask for input before posting |
+| "Check on open PRs" | **Triage** | Summarize state of each PR, ask what to review in depth |
+| "Approve 683 and 687" | **Direct verdict** | Post the specified verdict without full analysis |
+
+**Default is autonomous** unless the user says "interview", "ask me", "discuss", "check with me", or similar.
+
+## Step 1: Parse PR Numbers
+
+Extract PR numbers from the user's message. Accept formats:
+- "Review 938, 933, 918"
+- "Review #834 and #922"
+- "Review all open PRs" (use `gh pr list --state open --limit 30`)
+
+## Step 2: Fetch Data (Parallel)
+
+For EACH PR, fetch all of these in parallel:
+
+```bash
+# Metadata: title, author, base/head branch, size
+gh pr view <N> --json title,author,state,headRefName,baseRefName,additions,deletions,changedFiles \
+  --jq '{title, author: .author.login, state, base: .baseRefName, head: .headRefName, additions, deletions, changedFiles}'
+
+# Full diff
+gh pr diff <N> --patch
+
+# CI status
+gh pr checks <N>
+
+# Previous reviews (for re-reviews)
+gh pr view <N> --json reviews --jq '.reviews[] | {author: .author.login, state: .state, body: .body[:200]}'
+```
+
+For large diffs (>1000 lines), use `gh pr diff <N> --patch | head -500` first, then fetch remaining sections as needed. Note Cargo.lock churn separately -- don't count it as meaningful diff.
+
+## Step 3: Evaluate Each PR
+
+Check in this priority order:
+
+### 3a. CI Status
+- All checks must pass -- not just classify/scope. Must have: Formatting, Clippy (all 3 feature combos), Regression test enforcement.
+- **Fork PRs (critical gotcha):** Only classify/scope run because GitHub Actions secrets aren't available for fork PRs. The PR will APPEAR to have passing checks. Never trust this. Flag it -- local CI verification or maintainer-triggered re-run required before merge.
+
+### 3b. Previous Reviews
+- Check if zmanian already reviewed -- if so, this is a re-review
+- For re-reviews: verify each previous feedback item was addressed, referencing specific commit hashes
+- Note reviews from Gemini, Copilot -- cross-reference their findings but don't trust blindly
+
+### 3c. Security (Highest Priority -- IronClaw-Specific)
+- **Identity file write protection:** PROTECTED_IDENTITY_FILES (AGENTS.md, SOUL.md, USER.md, IDENTITY.md) must not become LLM-writable
+- **Tool approval requirements:** ApprovalRequirement changes (Never vs UnlessAutoApproved vs Always) -- especially for tools that cross trust boundaries (tool_install, tool_auth, build_tool, shell)
+- **WASM sandbox boundaries:** fuel limits, memory limits, network allowlists must not be weakened
+- **Credential handling:** no secrets in logs/errors/SSE events; use `redact_params()` before broadcast
+- **SSRF vectors:** URL validation must resolve DNS before checking for private/loopback IPs
+- **Prompt injection defense:** sanitizer/validator/policy changes in `src/safety/`
+
+### 3d. Correctness (IronClaw-Specific)
+- **No `.unwrap()/.expect()` in production code** (tests are fine)
+- **String safety:** no byte-index slicing (`&s[..n]`) on user/external strings -- use `is_char_boundary()` or `char_indices()`
+- **Dual-backend DB:** new persistence features must support BOTH postgres AND libsql. Check for missing trait implementations.
+- **Feature flags:** changes must compile under `--no-default-features --features libsql`, default, and `--all-features`
+- **Transaction safety:** multi-step DB operations wrapped in transactions (both backends)
+- **LLM provider decorator chain:** new `LlmProvider` trait methods must be delegated in ALL wrapper types (grep `impl LlmProvider for`)
+
+### 3e. Architecture & Conventions
+- `crate::` for cross-module imports (not `super::` except tests and intra-module)
+- `thiserror` for error types in `error.rs`; map errors with context via `.map_err()`
+- Strong types over strings (enums, newtypes)
+- Module specs followed -- if a module has a CLAUDE.md (agent, web, db, llm, setup, tools, workspace), check it
+- Module-owned initialization: init logic lives in owning module as public factory fn, not in main.rs/app.rs
+- No unnecessary dependencies (check `~/.claude/approved-dependencies.md` list)
+
+### 3f. Tests
+- Bug fixes MUST have regression tests (enforced by CI regression-check job and commit-msg hook)
+- Tests use `tempfile` crate, not hardcoded `/tmp/` paths
+- No real network requests in tests (use mocks or RFC 5737 TEST-NET IPs like 192.0.2.1)
+- Test names and comments match actual test behavior and assertions
+- `[skip-regression-check]` in commit message or PR label only if genuinely not feasible
+
+## Step 4: Interview (Interactive Mode)
+
+In interactive mode, present findings and ask for the maintainer's judgment before posting. **Do NOT post reviews until the maintainer confirms.**
+
+### When to Interview (Even in Autonomous Mode)
+
+Always pause and ask the maintainer when you encounter:
+
+1. **Judgment calls on architecture direction** -- "This PR adds a named provider for Z.AI. Should we prefer named providers or push contributors toward openai_compatible for niche providers?"
+2. **Security tradeoffs with usability** -- "Removing approval from tool_install reduces friction but weakens the trust boundary. What's your stance?"
+3. **Scope creep concerns** -- "This PR started as a bug fix but adds 300 lines of new feature. Accept as-is or ask to split?"
+4. **Dependency additions** -- "This adds `datafusion` (heavy dep). Worth it for the use case?"
+5. **Contradictory signals** -- "Gemini approved but Copilot flagged a real issue. The code works but the pattern is fragile."
+6. **Taking over vs requesting changes** -- "This PR has 5+ issues. Want me to take it over or send detailed feedback?"
+7. **Merge ordering for conflicting PRs** -- "PRs #933 and #918 both modify cli/mod.rs. Which should land first?"
+
+### Interview Format
+
+Present findings concisely, then ask a specific question:
+
+```
+**PR #922: Relax tool approval requirements**
+
+The HTTP GET change is clean (tiered: credentials->Always, GET->Never, other->UnlessAutoApproved).
+
+But it also removes approval from:
+- build_tool (can execute shell commands)
+- tool_install (downloads WASM modules)
+- tool_auth (grants credentials to tools)
+
+These cross the trust boundary. Options:
+1. Approve as-is (maximum convenience)
+2. Request changes: keep build_tool + extension tools gated, accept the rest
+3. Request changes: revert everything except HTTP GET and list_dir
+
+Which direction?
+```
+
+Wait for the maintainer's response before posting.
+
+### Triage Mode
+
+In triage mode, present a dashboard first:
+
+```
+| PR | Author | Title | CI | Reviews | Age | Risk |
+|----|--------|-------|----|---------|-----|------|
+| #938 | reidliu41 | Z.AI provider | green | none | 1d | low |
+| #922 | ilblackdragon | relax approvals | green | copilot:concern | 2d | medium |
+| #927 | ilblackdragon | chat onboarding | green | zmanian:changes | 3d | high |
+```
+
+Then ask: "Which ones should I review in depth? Or should I go through all of them?"
+
+## Step 5: Determine Verdict
+
+| Verdict | Criteria |
+|---------|----------|
+| **APPROVE** | Clean, follows IronClaw patterns, full CI green, no security issues, tests present |
+| **REQUEST CHANGES** | Security regressions, functional bugs, .expect() in production, trust boundary violations, missing dual-backend support, missing error handling |
+| **COMMENT** | Good direction but needs discussion, or already approved with observations |
+
+In interactive mode, confirm the verdict with the maintainer before posting. In autonomous mode, post directly.
+
+## Step 6: Post Reviews
+
+Post reviews via `gh pr review` using HEREDOC for body formatting.
+
+### New Review Format
+
+```
+## Review: <short summary of what PR does>
+
+<1-2 sentence assessment>
+
+Positives:
+- <what works well>
+- <pattern compliance>
+
+### <Severity>: <issue title>
+<Detailed explanation>
+
+### <Severity>: <issue title>
+<Detailed explanation>
+
+Minor notes:
+- <non-blocking observation>
+
+<Concrete suggestion if requesting changes>
+```
+
+Severity levels: Critical, Concerning, Minor (non-blocking)
+
+### Re-Review Format
+
+```
+## Re-review: <status summary>
+
+All/N items from my previous review have been resolved:
+
+1. **<item>** -- Fixed in commit <hash>. <What changed>.
+2. **<item>** -- Fixed. <Details>.
+
+<Additional observations if any>
+
+LGTM.
+```
+
+## Step 7: Handle GitHub API Errors
+
+GitHub 502s are common during batch posting. Retry with `sleep 5` between attempts. Post reviews sequentially (not in parallel) to avoid rate limits.
+
+## Step 8: Summary
+
+After all reviews are posted, provide a summary table:
+
+```
+| PR | Title | Verdict |
+|----|-------|---------|
+| #938 | Z.AI provider | Approved |
+| #933 | channels list CLI | Approved |
+| #918 | skills CLI | Approved |
+```
+
+Note cross-PR conflicts (e.g., PRs that both modify `src/cli/mod.rs` and snapshot files).
+
+## Special Cases
+
+### Fork PRs
+Only classify/scope CI jobs run. **Never merge with only these passing.** Either:
+- Run local CI: `cargo check --all-features && cargo clippy --all && cargo test`
+- Or trigger full CI by pushing a maintainer commit to the PR branch
+
+### Registry/WASM PRs
+- Verify artifact URLs match the naming convention: `<kind>-<name>-<version>-wasm32-wasip2.tar.gz`
+- Check SHA256 checksums against actual release assets
+- Ensure `name` field in manifest matches crate_name in source config
+- Cross-reference with `.github/workflows/release.yml` for automated patching
+
+### Taking Over a PR
+When a contributor PR has too many issues:
+1. Create new branch from staging
+2. Cherry-pick or apply the contributor's changes
+3. Fix the issues
+4. Create superseding PR referencing the original
+
+### Cross-PR Context
+When PRs are related (e.g., all touch registry manifests, or both modify cli/mod.rs), post context comments on each explaining how they fit together and merge ordering.
+
+### Batch Merge
+When the user says "merge" after reviews, use `gh pr merge <N> --squash` for each approved PR. Verify CI is still green before each merge.
@@ -54,7 +54,7 @@ jobs:
          - group: features
            files: "tests/e2e/scenarios/test_skills.py tests/e2e/scenarios/test_tool_approval.py tests/e2e/scenarios/test_webhook.py"
          - group: extensions
-            files: "tests/e2e/scenarios/test_extensions.py tests/e2e/scenarios/test_extension_oauth.py tests/e2e/scenarios/test_oauth_url_parameters.py tests/e2e/scenarios/test_telegram_token_validation.py tests/e2e/scenarios/test_telegram_hot_activation.py tests/e2e/scenarios/test_wasm_lifecycle.py tests/e2e/scenarios/test_tool_execution.py tests/e2e/scenarios/test_pairing.py tests/e2e/scenarios/test_mcp_auth_flow.py tests/e2e/scenarios/test_oauth_credential_fallback.py tests/e2e/scenarios/test_routine_oauth_credential_injection.py"
+            files: "tests/e2e/scenarios/test_extensions.py tests/e2e/scenarios/test_extension_oauth.py tests/e2e/scenarios/test_telegram_token_validation.py tests/e2e/scenarios/test_telegram_hot_activation.py tests/e2e/scenarios/test_wasm_lifecycle.py tests/e2e/scenarios/test_tool_execution.py tests/e2e/scenarios/test_pairing.py tests/e2e/scenarios/test_mcp_auth_flow.py tests/e2e/scenarios/test_oauth_credential_fallback.py tests/e2e/scenarios/test_routine_oauth_credential_injection.py"
          - group: routines
            files: "tests/e2e/scenarios/test_owner_scope.py tests/e2e/scenarios/test_routine_event_batch.py"
    steps:
@@ -12,7 +12,6 @@ jobs:
  tests:
    name: Tests (${{ matrix.name }})
    runs-on: ubuntu-latest
-    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
@@ -41,14 +40,11 @@ jobs:
      - name: Build WASM channels (for integration tests)
        run: ./scripts/build-wasm-extensions.sh --channels
      - name: Run Tests
-        run: |
-          timeout --signal=INT --kill-after=30s 40m \
-            cargo test ${{ matrix.flags }} -- --nocapture
+        run: cargo test ${{ matrix.flags }} -- --nocapture

  heavy-integration-tests:
    name: Heavy Integration Tests
    runs-on: ubuntu-latest
-    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
@@ -62,13 +58,9 @@ jobs:
      - name: Build Telegram WASM channel
        run: cargo build --manifest-path channels-src/telegram/Cargo.toml --target wasm32-wasip2 --release
      - name: Run thread scheduling integration tests
-        run: |
-          timeout --signal=INT --kill-after=30s 15m \
-            cargo test --no-default-features --features libsql,integration --test e2e_thread_scheduling -- --nocapture
+        run: cargo test --no-default-features --features libsql,integration --test e2e_thread_scheduling -- --nocapture
      - name: Run Telegram thread-scope regression test
-        run: |
-          timeout --signal=INT --kill-after=30s 10m \
-            cargo test --features integration --test telegram_auth_integration test_private_messages_use_chat_id_as_thread_scope -- --exact
+        run: cargo test --features integration --test telegram_auth_integration test_private_messages_use_chat_id_as_thread_scope -- --exact

  telegram-tests:
    name: Telegram Channel Tests
@@ -76,7 +68,6 @@ jobs:
      github.event_name != 'pull_request' ||
      github.base_ref != 'staging'
    runs-on: ubuntu-latest
-    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
@@ -84,9 +75,7 @@ jobs:
        uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Run Telegram Channel Tests
-        run: |
-          timeout --signal=INT --kill-after=30s 10m \
-            cargo test --manifest-path channels-src/telegram/Cargo.toml -- --nocapture
+        run: cargo test --manifest-path channels-src/telegram/Cargo.toml -- --nocapture

  windows-build:
    name: Windows Build (${{ matrix.name }})
@@ -121,7 +110,6 @@ jobs:
      github.event_name != 'pull_request' ||
      github.base_ref != 'staging'
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
@@ -137,9 +125,7 @@ jobs:
      - name: Build all WASM extensions against current WIT
        run: ./scripts/build-wasm-extensions.sh
      - name: Instantiation test (host linker compatibility)
-        run: |
-          timeout --signal=INT --kill-after=30s 20m \
-            cargo test --all-features wit_compat -- --nocapture
+        run: cargo test --all-features wit_compat -- --nocapture

  bench-compile:
    name: Benchmark Compilation
@@ -0,0 +1,4 @@
+{
+  "setup": [],
+  "teardown": []
+}
@@ -7,156 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

-## [0.23.0](https://github.com/nearai/ironclaw/compare/ironclaw-v0.22.0...ironclaw-v0.23.0) - 2026-03-27
-
-### Added
-
- complete multi-tenant isolation — phases 2–4 ([#1614](https://github.com/nearai/ironclaw/pull/1614))
-
-### Fixed
-
- *(routines)* recover delete name after failed update fallback ([#1108](https://github.com/nearai/ironclaw/pull/1108))
- *(mcp)* handle 202 Accepted and wire session manager for Streamable HTTP ([#1437](https://github.com/nearai/ironclaw/pull/1437))
- *(extensions)* channel-relay auth dead-end, observability, and URL override ([#1681](https://github.com/nearai/ironclaw/pull/1681))
- *(agent)* discard truncated tool calls when finish_reason == Length ([#1631](https://github.com/nearai/ironclaw/pull/1631)) ([#1632](https://github.com/nearai/ironclaw/pull/1632))
- *(llm)* filter XML tool-call recovery by context ([#1641](https://github.com/nearai/ironclaw/pull/1641))
-
-### Other
-
- Support direct hosted OAuth callbacks with proxy auth token ([#1684](https://github.com/nearai/ironclaw/pull/1684))
-
-## [0.22.0](https://github.com/nearai/ironclaw/compare/ironclaw-v0.21.0...ironclaw-v0.22.0) - 2026-03-25
-
-### Added
-
- *(agent)* thread per-tool reasoning through provider, session, and all surfaces ([#1513](https://github.com/nearai/ironclaw/pull/1513))
- *(cli)* show credential auth status in tool info ([#1572](https://github.com/nearai/ironclaw/pull/1572))
- multi-tenant auth with per-user workspace isolation ([#1118](https://github.com/nearai/ironclaw/pull/1118))
- *(cli)* add ironclaw models subcommands (list/status/set/set-provider) ([#1043](https://github.com/nearai/ironclaw/pull/1043))
- *(workspace)* multi-scope workspace reads ([#1117](https://github.com/nearai/ironclaw/pull/1117))
- *(ux)* complete UX overhaul — design system, onboarding, web polish ([#1277](https://github.com/nearai/ironclaw/pull/1277))
- *(gemini_oauth)* full Gemini CLI OAuth integration with Cloud Code API ([#1356](https://github.com/nearai/ironclaw/pull/1356))
- *(shell)* add Low/Medium/High risk levels for graduated command approval (closes #172) ([#368](https://github.com/nearai/ironclaw/pull/368))
- *(agent)* queue and merge messages during active turns ([#1412](https://github.com/nearai/ironclaw/pull/1412))
- *(cli)* add `ironclaw hooks list` subcommand ([#1023](https://github.com/nearai/ironclaw/pull/1023))
- *(extensions)* support text setup fields in web configure modal ([#496](https://github.com/nearai/ironclaw/pull/496))
- *(llm)* add GitHub Copilot as LLM provider ([#1512](https://github.com/nearai/ironclaw/pull/1512))
- *(workspace)* layered memory with sensitivity-based privacy redirect ([#1112](https://github.com/nearai/ironclaw/pull/1112))
- *(webhooks)* add public webhook trigger endpoint for routines ([#736](https://github.com/nearai/ironclaw/pull/736))
- *(llm)* Add OpenAI Codex (ChatGPT subscription) as LLM provider ([#1461](https://github.com/nearai/ironclaw/pull/1461))
- *(web)* add light theme with dark/light/system toggle ([#1457](https://github.com/nearai/ironclaw/pull/1457))
- *(agent)* activate stuck_threshold for time-based stuck job detection ([#1234](https://github.com/nearai/ironclaw/pull/1234))
- chat onboarding and routine advisor ([#927](https://github.com/nearai/ironclaw/pull/927))
-
-### Fixed
-
- ensure LLM calls always end with user message (closes #763) ([#1259](https://github.com/nearai/ironclaw/pull/1259))
- restore owner-scoped gateway startup ([#1625](https://github.com/nearai/ironclaw/pull/1625))
- remove stale stream_token gate from channel-relay activation ([#1623](https://github.com/nearai/ironclaw/pull/1623))
- *(agent)* case-insensitive channel match and user_id filter for event triggers ([#1211](https://github.com/nearai/ironclaw/pull/1211))
- *(routines)* normalize status display across web and CLI ([#1469](https://github.com/nearai/ironclaw/pull/1469))
- *(tunnel)* managed tunnels target wrong port and die from SIGPIPE ([#1093](https://github.com/nearai/ironclaw/pull/1093))
- *(agent)* persist /model selection to .env, TOML, and DB ([#1581](https://github.com/nearai/ironclaw/pull/1581))
- post-merge review sweep — 8 fixes across security, perf, and correctness ([#1550](https://github.com/nearai/ironclaw/pull/1550))
- generate Mistral-compatible 9-char alphanumeric tool call IDs ([#1242](https://github.com/nearai/ironclaw/pull/1242))
- *(mcp)* handle empty 202 notification acknowledgements ([#1539](https://github.com/nearai/ironclaw/pull/1539))
- *(tests)* eliminate env mutex poison cascade ([#1558](https://github.com/nearai/ironclaw/pull/1558))
- *(safety)* escape tool output XML content and remove misleading sanitized attr ([#1067](https://github.com/nearai/ironclaw/pull/1067))
- *(oauth)* reject malformed ic2.* states in decode_hosted_oauth_state ([#1441](https://github.com/nearai/ironclaw/pull/1441)) ([#1454](https://github.com/nearai/ironclaw/pull/1454))
- parameter coercion and validation for oneOf/anyOf/allOf schemas ([#1397](https://github.com/nearai/ironclaw/pull/1397))
- persist startup-loaded MCP clients in ExtensionManager ([#1509](https://github.com/nearai/ironclaw/pull/1509))
- *(deps)* patch rustls-webpki vulnerability (RUSTSEC-2026-0049)
- *(routines)* add missing extension_manager field in trigger_manual EngineContext
- *(ci)* serialize env-mutating OAuth wildcard tests with ENV_MUTEX ([#1280](https://github.com/nearai/ironclaw/pull/1280)) ([#1468](https://github.com/nearai/ironclaw/pull/1468))
- *(setup)* remove redundant LLM config and API keys from bootstrap .env ([#1448](https://github.com/nearai/ironclaw/pull/1448))
- resolve wasm broadcast merge conflicts with staging ([#395](https://github.com/nearai/ironclaw/pull/395)) ([#1460](https://github.com/nearai/ironclaw/pull/1460))
- skip credential validation for Bedrock backend ([#1011](https://github.com/nearai/ironclaw/pull/1011))
- register sandbox jobs in ContextManager for query tool visibility ([#1426](https://github.com/nearai/ironclaw/pull/1426))
- prefer execution-local message routing metadata ([#1449](https://github.com/nearai/ironclaw/pull/1449))
- *(security)* validate embedding base URLs to prevent SSRF ([#1221](https://github.com/nearai/ironclaw/pull/1221))
- f32→f64 precision artifact in temperature causes provider 400 errors ([#1450](https://github.com/nearai/ironclaw/pull/1450))
- *(routines)* surface errors when sandbox unavailable for full_job routines ([#769](https://github.com/nearai/ironclaw/pull/769))
- restore libSQL vector search with dynamic dimensions ([#1393](https://github.com/nearai/ironclaw/pull/1393))
- staging CI triage — consolidate retry parsing, fix flaky tests, add docs ([#1427](https://github.com/nearai/ironclaw/pull/1427))
-
-### Other
-
- Merge branch 'main' into staging-promote/455f543b-23329172268
- Merge pull request #1655 from nearai/codex/fix-staging-promotion-1451-version-bumps
- Merge pull request #1499 from nearai/staging-promote/9603fefd-23364438978
- Fix libsql prompt scope regressions ([#1651](https://github.com/nearai/ironclaw/pull/1651))
- Normalize cron schedules on routine create ([#1648](https://github.com/nearai/ironclaw/pull/1648))
- Fix MCP lifecycle trace user scope ([#1646](https://github.com/nearai/ironclaw/pull/1646))
- Fix REPL single-message hang and cap CI test duration ([#1643](https://github.com/nearai/ironclaw/pull/1643))
- extract AppEvent to crates/ironclaw_common ([#1615](https://github.com/nearai/ironclaw/pull/1615))
- Fix hosted OAuth refresh via proxy ([#1602](https://github.com/nearai/ironclaw/pull/1602))
- *(agent)* optimize approval thread resolution (UUID parsing + lock contention) ([#1592](https://github.com/nearai/ironclaw/pull/1592))
- *(tools)* auto-compact WASM tool schemas, add descriptions, improve credential prompts ([#1525](https://github.com/nearai/ironclaw/pull/1525))
- Default new lightweight routines to tools-enabled ([#1573](https://github.com/nearai/ironclaw/pull/1573))
- Google OAuth URL broken when initiated from Telegram channel ([#1165](https://github.com/nearai/ironclaw/pull/1165))
- add gitcgr code graph badge ([#1563](https://github.com/nearai/ironclaw/pull/1563))
- Fix owner-scoped message routing fallbacks ([#1574](https://github.com/nearai/ironclaw/pull/1574))
- *(tools)* remove unconditional params clone in shared execution (fix #893) ([#926](https://github.com/nearai/ironclaw/pull/926))
- *(llm)* move transcription module into src/llm/ ([#1559](https://github.com/nearai/ironclaw/pull/1559))
- *(agent)* avoid preview allocations for non-truncated strings (fix #894) ([#924](https://github.com/nearai/ironclaw/pull/924))
- Expand AGENTS.md with coding agents guidance ([#1392](https://github.com/nearai/ironclaw/pull/1392))
- Fix CI approval flows and stale fixtures ([#1478](https://github.com/nearai/ironclaw/pull/1478))
- Use live owner tool scope for autonomous routines and jobs ([#1453](https://github.com/nearai/ironclaw/pull/1453))
- use Arc in embedding cache to avoid clones on miss path ([#1438](https://github.com/nearai/ironclaw/pull/1438))
- Add owner-scoped permissions for full-job routines ([#1440](https://github.com/nearai/ironclaw/pull/1440))
-
-## [0.21.0](https://github.com/nearai/ironclaw/compare/v0.20.0...v0.21.0) - 2026-03-20
-
-### Added
-
- structured fallback deliverables for failed/stuck jobs ([#236](https://github.com/nearai/ironclaw/pull/236))
- LRU embedding cache for workspace search ([#1423](https://github.com/nearai/ironclaw/pull/1423))
- receive relay events via webhook callbacks ([#1254](https://github.com/nearai/ironclaw/pull/1254))
-
-### Fixed
-
- bump Feishu channel version for promotion
- *(approval)* make "always" auto-approve work for credentialed HTTP requests ([#1257](https://github.com/nearai/ironclaw/pull/1257))
- skip NEAR AI session check when backend is not nearai ([#1413](https://github.com/nearai/ironclaw/pull/1413))
-
-### Other
-
- Make hosted OAuth and MCP auth generic ([#1375](https://github.com/nearai/ironclaw/pull/1375))
-
-## [0.20.0](https://github.com/nearai/ironclaw/compare/v0.19.0...v0.20.0) - 2026-03-19
-
-### Added
-
- *(self-repair)* wire stuck_threshold, store, and builder ([#712](https://github.com/nearai/ironclaw/pull/712))
- *(testing)* add FaultInjector framework for StubLlm ([#1233](https://github.com/nearai/ironclaw/pull/1233))
- *(gateway)* unified settings page with subtabs ([#1191](https://github.com/nearai/ironclaw/pull/1191))
- upgrade MiniMax default model to M2.7 ([#1357](https://github.com/nearai/ironclaw/pull/1357))
-
-### Fixed
-
- navigate telegram E2E tests to channels subtab ([#1408](https://github.com/nearai/ironclaw/pull/1408))
- add missing `builder` field and update E2E extensions tab navigation ([#1400](https://github.com/nearai/ironclaw/pull/1400))
- remove debug_assert guards that panic on valid error paths ([#1385](https://github.com/nearai/ironclaw/pull/1385))
- address valid review comments from PR #1359 ([#1380](https://github.com/nearai/ironclaw/pull/1380))
- full_job routine runs stay running until linked job completion ([#1374](https://github.com/nearai/ironclaw/pull/1374))
- full_job routine concurrency tracks linked job lifetime ([#1372](https://github.com/nearai/ironclaw/pull/1372))
- remove -x from coverage pytest to prevent suite-blocking failures ([#1360](https://github.com/nearai/ironclaw/pull/1360))
- add debug_assert invariant guards to critical code paths ([#1312](https://github.com/nearai/ironclaw/pull/1312))
- *(mcp)* retry after missing session id errors ([#1355](https://github.com/nearai/ironclaw/pull/1355))
- *(telegram)* preserve polling after secret-blocked updates ([#1353](https://github.com/nearai/ironclaw/pull/1353))
- *(llm)* cap retry-after delays ([#1351](https://github.com/nearai/ironclaw/pull/1351))
- *(setup)* remove nonexistent webhook secret command hint ([#1349](https://github.com/nearai/ironclaw/pull/1349))
- Rate limiter returns retry after None instead of a duration ([#1269](https://github.com/nearai/ironclaw/pull/1269))
-
-### Other
-
- bump telegram channel version to 0.2.5 ([#1410](https://github.com/nearai/ironclaw/pull/1410))
- *(ci)* enforce test requirement for state machine and resilience changes ([#1230](https://github.com/nearai/ironclaw/pull/1230)) ([#1304](https://github.com/nearai/ironclaw/pull/1304))
- Fix duplicate LLM responses for matched event routines ([#1275](https://github.com/nearai/ironclaw/pull/1275))
- add Japanese README ([#1306](https://github.com/nearai/ironclaw/pull/1306))
- *(ci)* add coverage gates via codecov.yml ([#1228](https://github.com/nearai/ironclaw/pull/1228)) ([#1291](https://github.com/nearai/ironclaw/pull/1291))
- Redesign routine create requests for LLMs ([#1147](https://github.com/nearai/ironclaw/pull/1147))
-
 ## [0.19.0](https://github.com/nearai/ironclaw/compare/v0.18.0...v0.19.0) - 2026-03-17

 ### Added
@@ -157,7 +157,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -168,7 +168,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
 "anstyle",
 "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2136,7 +2136,7 @@ dependencies = [
 "libc",
 "option-ext",
 "redox_users 0.5.2",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2323,7 +2323,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3390,7 +3390,7 @@ dependencies = [

 [[package]]
 name = "ironclaw"
-version = "0.23.0"
+version = "0.19.0"
 dependencies = [
 "aes-gcm",
 "aho-corasick",
@@ -3428,7 +3428,6 @@ dependencies = [
 "hyper-util",
 "iana-time-zone",
 "insta",
- "ironclaw_common",
 "ironclaw_safety",
 "json5",
 "libsql",
@@ -3486,17 +3485,9 @@ dependencies = [
 "zip",
 ]

-[[package]]
-name = "ironclaw_common"
-version = "0.1.0"
-dependencies = [
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "ironclaw_safety"
-version = "0.2.0"
+version = "0.1.0"
 dependencies = [
 "aho-corasick",
 "regex",
@@ -4143,7 +4134,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5481,7 +5472,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.12.1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6163,7 +6154,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
 "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6363,9 +6354,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"

 [[package]]
 name = "tar"
-version = "0.4.45"
+version = "0.4.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+checksum = "1d863878d212c87a19c1a610eb53bb01fe12951c0501cf5a0d65f724914a667a"
 dependencies = [
 "filetime",
 "libc",
@@ -6388,7 +6379,7 @@ dependencies = [
 "getrandom 0.4.2",
 "once_cell",
 "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -7188,7 +7179,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
 "memoffset",
 "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -8038,7 +8029,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -1,5 +1,5 @@
 [workspace]
-members = [".", "crates/ironclaw_common", "crates/ironclaw_safety"]
+members = [".", "crates/ironclaw_safety"]
 exclude = [
    "channels-src/discord",
    "channels-src/telegram",
@@ -20,7 +20,7 @@ exclude = [

 [package]
 name = "ironclaw"
-version = "0.23.0"
+version = "0.19.0"
 edition = "2024"
 rust-version = "1.92"
 description = "Secure personal AI assistant that protects your data and expands its capabilities on the fly"
@@ -100,11 +100,8 @@ tower-http = { version = "0.6", features = ["trace", "cors", "set-header"] }
 # Cron scheduling for routines
 cron = "0.13"

-# Shared types
-ironclaw_common = { path = "crates/ironclaw_common", version = "0.1.0" }
-
 # Safety/sanitization
-ironclaw_safety = { path = "crates/ironclaw_safety", version = "0.2.0" }
+ironclaw_safety = { path = "crates/ironclaw_safety", version = "0.1.0" }
 regex = "1"
 aho-corasick = "1"

@@ -161,7 +161,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | `config` | ✅ | ✅ | - | Read/write config plus validate/path helpers |
 | `backup` | ✅ | ❌ | P3 | Create/verify local backup archives |
 | `channels` | ✅ | 🚧 | P2 | `list` implemented; `enable`/`disable`/`status` deferred pending config source unification |
-| `models` | ✅ | 🚧 | P1 | `models list [<provider>]` (`--verbose`, `--json`; fetches live model list when provider specified), `models status` (`--json`), `models set <model>`, `models set-provider <provider> [--model model]` (alias normalization, config.toml + .env persistence). Remaining: `set` doesn't validate model against live list. |
+| `models` | ✅ | 🚧 | - | Model selector in TUI |
 | `status` | ✅ | ✅ | - | System status (enriched session details) |
 | `agents` | ✅ | ❌ | P3 | Multi-agent management |
 | `sessions` | ✅ | ❌ | P3 | Session listing (shows subagent models) |
@@ -21,7 +21,7 @@
      },
      {
        "name": "feishu_app_secret",
-        "prompt": "Enter your Feishu/Lark App Secret (from your app settings at open.feishu.cn)",
+        "prompt": "Enter your Feishu/Lark App Secret",
        "optional": false
      },
      {
@@ -1,17 +0,0 @@
-[package]
-name = "ironclaw_common"
-version = "0.1.0"
-edition = "2024"
-rust-version = "1.92"
-description = "Shared types and utilities for the IronClaw workspace"
-authors = ["NEAR AI <[email protected]>"]
-license = "MIT OR Apache-2.0"
-homepage = "https://github.com/nearai/ironclaw"
-repository = "https://github.com/nearai/ironclaw"
-
-[package.metadata.dist]
-dist = false
-
-[dependencies]
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
@@ -1,393 +0,0 @@
-//! Application-wide event types.
-//!
-//! `AppEvent` is the real-time event protocol used across the entire
-//! application.  The web gateway serialises these to SSE / WebSocket
-//! frames, but other subsystems (agent loop, orchestrator, extensions)
-//! produce and consume them too.
-
-use serde::{Deserialize, Serialize};
-
-/// A single tool decision in a reasoning update (SSE DTO).
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ToolDecisionDto {
-    pub tool_name: String,
-    pub rationale: String,
-}
-
-impl ToolDecisionDto {
-    /// Parse a list of tool decisions from a JSON array value.
-    pub fn from_json_array(value: &serde_json::Value) -> Vec<Self> {
-        value
-            .as_array()
-            .map(|arr| {
-                arr.iter()
-                    .filter_map(|d| {
-                        Some(Self {
-                            tool_name: d.get("tool_name")?.as_str()?.to_string(),
-                            rationale: d.get("rationale")?.as_str()?.to_string(),
-                        })
-                    })
-                    .collect()
-            })
-            .unwrap_or_default()
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(tag = "type")]
-pub enum AppEvent {
-    #[serde(rename = "response")]
-    Response { content: String, thread_id: String },
-    #[serde(rename = "thinking")]
-    Thinking {
-        message: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-    #[serde(rename = "tool_started")]
-    ToolStarted {
-        name: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-    #[serde(rename = "tool_completed")]
-    ToolCompleted {
-        name: String,
-        success: bool,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        error: Option<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        parameters: Option<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-    #[serde(rename = "tool_result")]
-    ToolResult {
-        name: String,
-        preview: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-    #[serde(rename = "stream_chunk")]
-    StreamChunk {
-        content: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-    #[serde(rename = "status")]
-    Status {
-        message: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-    #[serde(rename = "job_started")]
-    JobStarted {
-        job_id: String,
-        title: String,
-        browse_url: String,
-    },
-    #[serde(rename = "approval_needed")]
-    ApprovalNeeded {
-        request_id: String,
-        tool_name: String,
-        description: String,
-        parameters: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-        /// Whether the "always" auto-approve option should be shown.
-        allow_always: bool,
-    },
-    #[serde(rename = "auth_required")]
-    AuthRequired {
-        extension_name: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        instructions: Option<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        auth_url: Option<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        setup_url: Option<String>,
-    },
-    #[serde(rename = "auth_completed")]
-    AuthCompleted {
-        extension_name: String,
-        success: bool,
-        message: String,
-    },
-    #[serde(rename = "error")]
-    Error {
-        message: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-    #[serde(rename = "heartbeat")]
-    Heartbeat,
-
-    // Sandbox job streaming events (worker + Claude Code bridge)
-    #[serde(rename = "job_message")]
-    JobMessage {
-        job_id: String,
-        role: String,
-        content: String,
-    },
-    #[serde(rename = "job_tool_use")]
-    JobToolUse {
-        job_id: String,
-        tool_name: String,
-        input: serde_json::Value,
-    },
-    #[serde(rename = "job_tool_result")]
-    JobToolResult {
-        job_id: String,
-        tool_name: String,
-        output: String,
-    },
-    #[serde(rename = "job_status")]
-    JobStatus { job_id: String, message: String },
-    #[serde(rename = "job_result")]
-    JobResult {
-        job_id: String,
-        status: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        session_id: Option<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        fallback_deliverable: Option<serde_json::Value>,
-    },
-
-    /// An image was generated by a tool.
-    #[serde(rename = "image_generated")]
-    ImageGenerated {
-        data_url: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        path: Option<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-
-    /// Suggested follow-up messages for the user.
-    #[serde(rename = "suggestions")]
-    Suggestions {
-        suggestions: Vec<String>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-
-    /// Per-turn token usage and cost summary.
-    #[serde(rename = "turn_cost")]
-    TurnCost {
-        input_tokens: u64,
-        output_tokens: u64,
-        cost_usd: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-
-    /// Extension activation status change (WASM channels).
-    #[serde(rename = "extension_status")]
-    ExtensionStatus {
-        extension_name: String,
-        status: String,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        message: Option<String>,
-    },
-
-    /// Agent reasoning update (why it chose specific tools).
-    #[serde(rename = "reasoning_update")]
-    ReasoningUpdate {
-        narrative: String,
-        decisions: Vec<ToolDecisionDto>,
-        #[serde(skip_serializing_if = "Option::is_none")]
-        thread_id: Option<String>,
-    },
-
-    /// Reasoning update for a sandbox job.
-    #[serde(rename = "job_reasoning")]
-    JobReasoning {
-        job_id: String,
-        narrative: String,
-        decisions: Vec<ToolDecisionDto>,
-    },
-}
-
-impl AppEvent {
-    /// The wire-format event type string (matches the `#[serde(rename)]` value).
-    pub fn event_type(&self) -> &'static str {
-        match self {
-            Self::Response { .. } => "response",
-            Self::Thinking { .. } => "thinking",
-            Self::ToolStarted { .. } => "tool_started",
-            Self::ToolCompleted { .. } => "tool_completed",
-            Self::ToolResult { .. } => "tool_result",
-            Self::StreamChunk { .. } => "stream_chunk",
-            Self::Status { .. } => "status",
-            Self::JobStarted { .. } => "job_started",
-            Self::ApprovalNeeded { .. } => "approval_needed",
-            Self::AuthRequired { .. } => "auth_required",
-            Self::AuthCompleted { .. } => "auth_completed",
-            Self::Error { .. } => "error",
-            Self::Heartbeat => "heartbeat",
-            Self::JobMessage { .. } => "job_message",
-            Self::JobToolUse { .. } => "job_tool_use",
-            Self::JobToolResult { .. } => "job_tool_result",
-            Self::JobStatus { .. } => "job_status",
-            Self::JobResult { .. } => "job_result",
-            Self::ImageGenerated { .. } => "image_generated",
-            Self::Suggestions { .. } => "suggestions",
-            Self::TurnCost { .. } => "turn_cost",
-            Self::ExtensionStatus { .. } => "extension_status",
-            Self::ReasoningUpdate { .. } => "reasoning_update",
-            Self::JobReasoning { .. } => "job_reasoning",
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Verify that `event_type()` returns the same string as the serde
-    /// `"type"` field for every variant.  This catches drift between the
-    /// `#[serde(rename)]` attributes and the manual match arms.
-    #[test]
-    fn event_type_matches_serde_type_field() {
-        let variants: Vec<AppEvent> = vec![
-            AppEvent::Response {
-                content: String::new(),
-                thread_id: String::new(),
-            },
-            AppEvent::Thinking {
-                message: String::new(),
-                thread_id: None,
-            },
-            AppEvent::ToolStarted {
-                name: String::new(),
-                thread_id: None,
-            },
-            AppEvent::ToolCompleted {
-                name: String::new(),
-                success: true,
-                error: None,
-                parameters: None,
-                thread_id: None,
-            },
-            AppEvent::ToolResult {
-                name: String::new(),
-                preview: String::new(),
-                thread_id: None,
-            },
-            AppEvent::StreamChunk {
-                content: String::new(),
-                thread_id: None,
-            },
-            AppEvent::Status {
-                message: String::new(),
-                thread_id: None,
-            },
-            AppEvent::JobStarted {
-                job_id: String::new(),
-                title: String::new(),
-                browse_url: String::new(),
-            },
-            AppEvent::ApprovalNeeded {
-                request_id: String::new(),
-                tool_name: String::new(),
-                description: String::new(),
-                parameters: String::new(),
-                thread_id: None,
-                allow_always: false,
-            },
-            AppEvent::AuthRequired {
-                extension_name: String::new(),
-                instructions: None,
-                auth_url: None,
-                setup_url: None,
-            },
-            AppEvent::AuthCompleted {
-                extension_name: String::new(),
-                success: true,
-                message: String::new(),
-            },
-            AppEvent::Error {
-                message: String::new(),
-                thread_id: None,
-            },
-            AppEvent::Heartbeat,
-            AppEvent::JobMessage {
-                job_id: String::new(),
-                role: String::new(),
-                content: String::new(),
-            },
-            AppEvent::JobToolUse {
-                job_id: String::new(),
-                tool_name: String::new(),
-                input: serde_json::Value::Null,
-            },
-            AppEvent::JobToolResult {
-                job_id: String::new(),
-                tool_name: String::new(),
-                output: String::new(),
-            },
-            AppEvent::JobStatus {
-                job_id: String::new(),
-                message: String::new(),
-            },
-            AppEvent::JobResult {
-                job_id: String::new(),
-                status: String::new(),
-                session_id: None,
-                fallback_deliverable: None,
-            },
-            AppEvent::ImageGenerated {
-                data_url: String::new(),
-                path: None,
-                thread_id: None,
-            },
-            AppEvent::Suggestions {
-                suggestions: vec![],
-                thread_id: None,
-            },
-            AppEvent::TurnCost {
-                input_tokens: 0,
-                output_tokens: 0,
-                cost_usd: String::new(),
-                thread_id: None,
-            },
-            AppEvent::ExtensionStatus {
-                extension_name: String::new(),
-                status: String::new(),
-                message: None,
-            },
-            AppEvent::ReasoningUpdate {
-                narrative: String::new(),
-                decisions: vec![],
-                thread_id: None,
-            },
-            AppEvent::JobReasoning {
-                job_id: String::new(),
-                narrative: String::new(),
-                decisions: vec![],
-            },
-        ];
-
-        for variant in &variants {
-            let json: serde_json::Value = serde_json::to_value(variant).unwrap();
-            let serde_type = json["type"].as_str().unwrap();
-            assert_eq!(
-                variant.event_type(),
-                serde_type,
-                "event_type() mismatch for variant: {:?}",
-                variant
-            );
-        }
-    }
-
-    #[test]
-    fn round_trip_deserialize() {
-        let original = AppEvent::Response {
-            content: "hello".to_string(),
-            thread_id: "t1".to_string(),
-        };
-        let json = serde_json::to_string(&original).unwrap();
-        let deserialized: AppEvent = serde_json::from_str(&json).unwrap();
-        assert_eq!(deserialized.event_type(), "response");
-    }
-}
@@ -1,7 +0,0 @@
-//! Shared types and utilities for the IronClaw workspace.
-
-mod event;
-mod util;
-
-pub use event::{AppEvent, ToolDecisionDto};
-pub use util::truncate_preview;
@@ -1,100 +0,0 @@
-//! Shared utility functions.
-
-/// Truncate a string to at most `max_bytes` bytes at a char boundary, appending "...".
-///
-/// If the input is wrapped in `<tool_output ...>...</tool_output>` and truncation
-/// removes the closing tag, the tag is re-appended so downstream XML parsers
-/// never see an unclosed element.
-pub fn truncate_preview(s: &str, max_bytes: usize) -> String {
-    if s.len() <= max_bytes {
-        return s.to_string();
-    }
-    // Walk backwards from max_bytes to find a valid char boundary
-    let mut end = max_bytes;
-    while end > 0 && !s.is_char_boundary(end) {
-        end -= 1;
-    }
-    let mut result = format!("{}...", &s[..end]);
-
-    // Re-close <tool_output> if truncation cut through the closing tag.
-    if s.starts_with("<tool_output") && !result.ends_with("</tool_output>") {
-        result.push_str("\n</tool_output>");
-    }
-
-    result
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_truncate_preview_short_string() {
-        assert_eq!(truncate_preview("hello", 10), "hello");
-    }
-
-    #[test]
-    fn test_truncate_preview_exact_boundary() {
-        assert_eq!(truncate_preview("hello", 5), "hello");
-    }
-
-    #[test]
-    fn test_truncate_preview_truncates_ascii() {
-        assert_eq!(truncate_preview("hello world", 5), "hello...");
-    }
-
-    #[test]
-    fn test_truncate_preview_empty_string() {
-        assert_eq!(truncate_preview("", 10), "");
-    }
-
-    #[test]
-    fn test_truncate_preview_multibyte_char_boundary() {
-        let s = "a\u{20AC}b";
-        let result = truncate_preview(s, 3);
-        assert_eq!(result, "a...");
-    }
-
-    #[test]
-    fn test_truncate_preview_emoji() {
-        let s = "hi\u{1F980}";
-        let result = truncate_preview(s, 4);
-        assert_eq!(result, "hi...");
-    }
-
-    #[test]
-    fn test_truncate_preview_cjk() {
-        let s = "\u{4F60}\u{597D}\u{4E16}\u{754C}";
-        let result = truncate_preview(s, 7);
-        assert_eq!(result, "\u{4F60}\u{597D}...");
-    }
-
-    #[test]
-    fn test_truncate_preview_zero_max_bytes() {
-        assert_eq!(truncate_preview("hello", 0), "...");
-    }
-
-    #[test]
-    fn test_truncate_preview_closes_tool_output_tag() {
-        let s = "<tool_output name=\"search\">\nSome very long content here\n</tool_output>";
-        let result = truncate_preview(s, 60);
-        assert!(result.ends_with("</tool_output>"));
-        assert!(result.contains("..."));
-    }
-
-    #[test]
-    fn test_truncate_preview_no_extra_close_when_intact() {
-        let s = "<tool_output name=\"echo\">\nshort\n</tool_output>";
-        let result = truncate_preview(s, 500);
-        assert_eq!(result, s);
-        assert_eq!(result.matches("</tool_output>").count(), 1);
-    }
-
-    #[test]
-    fn test_truncate_preview_non_xml_unaffected() {
-        let s = "Just a plain long string that gets truncated";
-        let result = truncate_preview(s, 10);
-        assert_eq!(result, "Just a pla...");
-        assert!(!result.contains("</tool_output>"));
-    }
-}
@@ -1,6 +1,6 @@
 [package]
 name = "ironclaw_safety"
-version = "0.2.0"
+version = "0.1.0"
 edition = "2024"
 rust-version = "1.92"
 description = "Prompt injection defense, input validation, secret leak detection, and safety policy enforcement"
@@ -8,6 +8,7 @@ authors = ["NEAR AI <[email protected]>"]
 license = "MIT OR Apache-2.0"
 homepage = "https://github.com/nearai/ironclaw"
 repository = "https://github.com/nearai/ironclaw"
+publish = false

 [package.metadata.dist]
 dist = false
@@ -0,0 +1,101 @@
+# Proactive Docker Detection
+
+Date: 2026-02-21
+
+## Problem
+
+IronClaw's sandbox system requires Docker but provides no proactive guidance. Docker availability is only checked at runtime when a sandbox job is attempted, resulting in a confusing error. Users have no way to know during setup or startup whether Docker is properly configured.
+
+## Goals
+
+1. Detect Docker installation AND daemon running status at two points: setup wizard and every startup
+2. Provide platform-specific installation guidance (macOS, Linux, Windows)
+3. Surface Docker status clearly in the boot screen
+4. Allow users to skip/continue without Docker (sandbox is optional)
+
+## Non-Goals
+
+- Auto-installing Docker
+- Changing the default sandbox setting (stays `enabled: false`)
+- Modifying the existing `connect_docker()` function
+
+## Design
+
+### Docker Status Model
+
+New file `src/sandbox/detect.rs` with centralized detection:
+
+```rust
+pub enum DockerStatus {
+    Available,      // Binary on PATH + daemon responding to ping
+    NotInstalled,   // `docker` binary not found on PATH
+    NotRunning,     // Binary found but daemon not responding
+    Disabled,       // Sandbox not enabled (no check performed)
+}
+
+pub enum Platform { MacOS, Linux, Windows }
+
+pub struct DockerDetection {
+    pub status: DockerStatus,
+    pub platform: Platform,
+}
+```
+
+Detection logic:
+1. Check if `docker` binary exists on PATH (reuse `which`/`where` pattern from `skills/gating.rs`)
+2. If found, attempt `connect_docker()` to ping the daemon
+3. Return `Available`, `NotInstalled`, or `NotRunning`
+
+### Platform-Specific Guidance
+
+| Platform | Not Installed | Not Running |
+|----------|--------------|-------------|
+| macOS | "Install Docker Desktop: https://docs.docker.com/desktop/install/mac-install/" | "Start Docker Desktop from Applications, or run: open -a Docker" |
+| Linux | "Install Docker Engine: https://docs.docker.com/engine/install/" | "Start the Docker daemon: sudo systemctl start docker" |
+| Windows | "Install Docker Desktop: https://docs.docker.com/desktop/install/windows-install/" | "Start Docker Desktop from the Start menu" |
+
+### Wizard Step (First-Run)
+
+Add Step 8 "Docker Sandbox" (current steps 8 becomes 9, total becomes 9):
+
+1. Ask "Do you want to enable Docker sandbox for isolated code execution?"
+2. If yes, run Docker detection
+3. Based on status:
+   - **Available**: Enable sandbox, confirm
+   - **Not Installed**: Show install guidance, offer to skip or retry after installing
+   - **Not Running**: Show start guidance, offer to skip or retry
+4. If user skips, sandbox stays disabled
+
+### Startup Check (Every Launch)
+
+In `main.rs`, when `config.sandbox.enabled == true`, before creating `ContainerJobManager`:
+
+1. Run `DockerDetection::check()`
+2. If **Available**: proceed normally
+3. If **NotInstalled** or **NotRunning**: log warning, disable sandbox for this session, continue startup
+
+### Boot Screen Changes
+
+`BootInfo` gains `docker_status: DockerStatus` field.
+
+Features line rendering:
+- `Available` + enabled: `sandbox` (as today)
+- `NotInstalled` + enabled in config: `sandbox (docker not installed)`
+- `NotRunning` + enabled in config: `sandbox (docker not running)`
+- `Disabled`: no sandbox shown (as today)
+
+Warning lines shown in yellow when Docker is configured but unavailable.
+
+## Files
+
+| Action | File | Change |
+|--------|------|--------|
+| Create | `src/sandbox/detect.rs` | Detection logic, platform hints |
+| Modify | `src/sandbox/mod.rs` | Export `detect` module |
+| Modify | `src/setup/wizard.rs` | Add Docker/Sandbox wizard step |
+| Modify | `src/main.rs` | Startup check before ContainerJobManager |
+| Modify | `src/boot_screen.rs` | Show Docker status |
+
+## Dependencies
+
+No new crate dependencies. Uses existing `bollard` (via `connect_docker()`), `std::process::Command` (for binary detection), and `std::env::consts::OS` (for platform detection).
@@ -0,0 +1,450 @@
+# Docker Detection Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Add proactive Docker detection at startup and in the setup wizard, with platform-specific installation guidance.
+
+**Architecture:** New `src/sandbox/detect.rs` module for centralized Docker detection. Wizard gets a new step. Startup check in `main.rs` warns and disables sandbox if Docker unavailable. Boot screen shows Docker status.
+
+**Tech Stack:** Rust, bollard (existing), std::process::Command
+
+---
+
+### Task 1: Create `src/sandbox/detect.rs` -- Docker Detection Module
+
+**Files:**
+- Create: `src/sandbox/detect.rs`
+- Modify: `src/sandbox/mod.rs`
+
+**Step 1: Write the failing test**
+
+```rust
+// In src/sandbox/detect.rs
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_detect_platform() {
+        let platform = Platform::current();
+        // Should return a valid platform on any CI/dev machine
+        match platform {
+            Platform::MacOS | Platform::Linux | Platform::Windows => {}
+        }
+    }
+
+    #[test]
+    fn test_install_hint_not_empty() {
+        for platform in [Platform::MacOS, Platform::Linux, Platform::Windows] {
+            assert!(!platform.install_hint().is_empty());
+            assert!(!platform.start_hint().is_empty());
+        }
+    }
+
+    #[test]
+    fn test_docker_status_display() {
+        assert_eq!(DockerStatus::Available.as_str(), "available");
+        assert_eq!(DockerStatus::NotInstalled.as_str(), "not installed");
+        assert_eq!(DockerStatus::NotRunning.as_str(), "not running");
+        assert_eq!(DockerStatus::Disabled.as_str(), "disabled");
+    }
+
+    #[test]
+    fn test_docker_status_is_ok() {
+        assert!(DockerStatus::Available.is_ok());
+        assert!(!DockerStatus::NotInstalled.is_ok());
+        assert!(!DockerStatus::NotRunning.is_ok());
+        assert!(!DockerStatus::Disabled.is_ok());
+    }
+
+    #[tokio::test]
+    async fn test_check_docker_returns_valid_status() {
+        let result = check_docker().await;
+        // On CI without Docker, should be NotInstalled or NotRunning
+        // On dev with Docker, should be Available
+        // Either way, should not panic
+        match result.status {
+            DockerStatus::Available
+            | DockerStatus::NotInstalled
+            | DockerStatus::NotRunning => {}
+            DockerStatus::Disabled => panic!("check_docker should never return Disabled"),
+        }
+    }
+}
+```
+
+**Step 2: Write the implementation**
+
+```rust
+//! Proactive Docker detection with platform-specific guidance.
+
+/// Docker daemon availability status.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DockerStatus {
+    /// Docker binary found on PATH and daemon responding to ping.
+    Available,
+    /// `docker` binary not found on PATH.
+    NotInstalled,
+    /// Binary found but daemon not responding.
+    NotRunning,
+    /// Sandbox feature not enabled (no check performed).
+    Disabled,
+}
+
+impl DockerStatus {
+    pub fn is_ok(&self) -> bool {
+        matches!(self, DockerStatus::Available)
+    }
+
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            DockerStatus::Available => "available",
+            DockerStatus::NotInstalled => "not installed",
+            DockerStatus::NotRunning => "not running",
+            DockerStatus::Disabled => "disabled",
+        }
+    }
+}
+
+/// Host platform for install guidance.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Platform {
+    MacOS,
+    Linux,
+    Windows,
+}
+
+impl Platform {
+    pub fn current() -> Self {
+        match std::env::consts::OS {
+            "macos" => Platform::MacOS,
+            "windows" => Platform::Windows,
+            _ => Platform::Linux,
+        }
+    }
+
+    pub fn install_hint(&self) -> &'static str {
+        match self {
+            Platform::MacOS => "Install Docker Desktop: https://docs.docker.com/desktop/install/mac-install/",
+            Platform::Linux => "Install Docker Engine: https://docs.docker.com/engine/install/",
+            Platform::Windows => "Install Docker Desktop: https://docs.docker.com/desktop/install/windows-install/",
+        }
+    }
+
+    pub fn start_hint(&self) -> &'static str {
+        match self {
+            Platform::MacOS => "Start Docker Desktop from Applications, or run: open -a Docker",
+            Platform::Linux => "Start the Docker daemon: sudo systemctl start docker",
+            Platform::Windows => "Start Docker Desktop from the Start menu",
+        }
+    }
+}
+
+/// Result of a Docker detection check.
+pub struct DockerDetection {
+    pub status: DockerStatus,
+    pub platform: Platform,
+}
+
+/// Check whether Docker is installed and running.
+///
+/// 1. Checks if `docker` binary exists on PATH
+/// 2. If found, tries to connect and ping the Docker daemon
+/// 3. Returns `Available`, `NotInstalled`, or `NotRunning`
+pub async fn check_docker() -> DockerDetection {
+    let platform = Platform::current();
+
+    // Step 1: Check if docker binary is on PATH
+    if !docker_binary_exists() {
+        return DockerDetection {
+            status: DockerStatus::NotInstalled,
+            platform,
+        };
+    }
+
+    // Step 2: Try to connect to the daemon
+    match crate::sandbox::connect_docker().await {
+        Ok(_) => DockerDetection {
+            status: DockerStatus::Available,
+            platform,
+        },
+        Err(_) => DockerDetection {
+            status: DockerStatus::NotRunning,
+            platform,
+        },
+    }
+}
+
+/// Check if the `docker` binary exists on PATH.
+fn docker_binary_exists() -> bool {
+    #[cfg(unix)]
+    {
+        std::process::Command::new("which")
+            .arg("docker")
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
+            .status()
+            .is_ok_and(|s| s.success())
+    }
+    #[cfg(windows)]
+    {
+        std::process::Command::new("where")
+            .arg("docker")
+            .stdout(std::process::Stdio::null())
+            .stderr(std::process::Stdio::null())
+            .status()
+            .is_ok_and(|s| s.success())
+    }
+}
+```
+
+**Step 3: Export from `src/sandbox/mod.rs`**
+
+Add `pub mod detect;` and re-export key types.
+
+**Step 4: Run tests**
+
+Run: `cargo test sandbox::detect::tests -- --nocapture`
+Expected: All pass
+
+**Step 5: Clippy**
+
+Run: `cargo clippy --all --all-features`
+Expected: Zero warnings on new code
+
+**Step 6: Commit**
+
+```bash
+git add src/sandbox/detect.rs src/sandbox/mod.rs
+git commit -m "feat: add Docker detection module with platform guidance"
+```
+
+---
+
+### Task 2: Update Boot Screen to Show Docker Status
+
+**Files:**
+- Modify: `src/boot_screen.rs`
+
+**Step 1: Add `docker_status` to `BootInfo`**
+
+Add field: `pub docker_status: DockerStatus` (import from `crate::sandbox::detect::DockerStatus`).
+
+**Step 2: Update `print_boot_screen` features rendering**
+
+When sandbox is enabled in config but Docker isn't available, show a warning:
+- `DockerStatus::Available`: "sandbox" (as today)
+- `DockerStatus::NotInstalled`: "sandbox (docker not installed)" in yellow
+- `DockerStatus::NotRunning`: "sandbox (docker not running)" in yellow
+- `DockerStatus::Disabled`: don't show sandbox (as today)
+
+**Step 3: Update tests**
+
+Update all 3 existing `BootInfo` test structs to include `docker_status` field.
+
+**Step 4: Run tests**
+
+Run: `cargo test boot_screen::tests`
+Expected: All pass
+
+**Step 5: Commit**
+
+```bash
+git add src/boot_screen.rs
+git commit -m "feat: show Docker status in boot screen"
+```
+
+---
+
+### Task 3: Add Startup Docker Check in `main.rs`
+
+**Files:**
+- Modify: `src/main.rs`
+
+**Step 1: Add Docker check before `ContainerJobManager` creation**
+
+Before line ~989 (`let container_job_manager = if config.sandbox.enabled`), insert:
+
+```rust
+// Proactive Docker detection
+let docker_status = if config.sandbox.enabled {
+    let detection = ironclaw::sandbox::detect::check_docker().await;
+    match detection.status {
+        ironclaw::sandbox::detect::DockerStatus::Available => {
+            tracing::info!("Docker is available");
+            detection.status
+        }
+        ironclaw::sandbox::detect::DockerStatus::NotInstalled => {
+            tracing::warn!(
+                "Docker is not installed. Sandbox disabled for this session. {}",
+                detection.platform.install_hint()
+            );
+            detection.status
+        }
+        ironclaw::sandbox::detect::DockerStatus::NotRunning => {
+            tracing::warn!(
+                "Docker is installed but not running. Sandbox disabled for this session. {}",
+                detection.platform.start_hint()
+            );
+            detection.status
+        }
+        ironclaw::sandbox::detect::DockerStatus::Disabled => detection.status,
+    }
+} else {
+    ironclaw::sandbox::detect::DockerStatus::Disabled
+};
+```
+
+Then gate the `ContainerJobManager` creation on `docker_status.is_ok()`:
+```rust
+let container_job_manager = if config.sandbox.enabled && docker_status.is_ok() {
+    // ... existing code ...
+```
+
+**Step 2: Pass `docker_status` to `BootInfo`**
+
+In the boot screen construction, add the `docker_status` field.
+
+**Step 3: Run full test suite**
+
+Run: `cargo test`
+Expected: All pass
+
+**Step 4: Commit**
+
+```bash
+git add src/main.rs
+git commit -m "feat: check Docker availability at startup"
+```
+
+---
+
+### Task 4: Add Docker/Sandbox Wizard Step
+
+**Files:**
+- Modify: `src/setup/wizard.rs`
+
+**Step 1: Increment `total_steps` from 8 to 9**
+
+**Step 2: Add `step_docker_sandbox()` method**
+
+Insert after Extensions (step 7), before Heartbeat:
+
+```rust
+/// Step 8: Docker Sandbox
+async fn step_docker_sandbox(&mut self) -> Result<(), SetupError> {
+    print_info("The Docker sandbox provides isolated execution for code generation,");
+    print_info("builds, and untrusted commands. It requires Docker to be installed.");
+    println!();
+
+    if !confirm("Enable Docker sandbox?", false).map_err(SetupError::Io)? {
+        self.settings.sandbox.enabled = false;
+        print_info("Sandbox disabled. You can enable it later with SANDBOX_ENABLED=true.");
+        return Ok(());
+    }
+
+    // Check Docker availability
+    let detection = crate::sandbox::detect::check_docker().await;
+
+    match detection.status {
+        crate::sandbox::detect::DockerStatus::Available => {
+            self.settings.sandbox.enabled = true;
+            print_success("Docker is installed and running. Sandbox enabled.");
+        }
+        crate::sandbox::detect::DockerStatus::NotInstalled => {
+            println!();
+            print_error("Docker is not installed.");
+            print_info(detection.platform.install_hint());
+            println!();
+            // Offer retry or skip
+            if confirm("Retry after installing Docker?", false).map_err(SetupError::Io)? {
+                let retry = crate::sandbox::detect::check_docker().await;
+                if retry.status.is_ok() {
+                    self.settings.sandbox.enabled = true;
+                    print_success("Docker is now available. Sandbox enabled.");
+                } else {
+                    self.settings.sandbox.enabled = false;
+                    print_info("Docker still not available. Sandbox disabled for now.");
+                }
+            } else {
+                self.settings.sandbox.enabled = false;
+                print_info("Sandbox disabled. Install Docker and set SANDBOX_ENABLED=true later.");
+            }
+        }
+        crate::sandbox::detect::DockerStatus::NotRunning => {
+            println!();
+            print_error("Docker is installed but not running.");
+            print_info(detection.platform.start_hint());
+            println!();
+            if confirm("Retry after starting Docker?", false).map_err(SetupError::Io)? {
+                let retry = crate::sandbox::detect::check_docker().await;
+                if retry.status.is_ok() {
+                    self.settings.sandbox.enabled = true;
+                    print_success("Docker is now running. Sandbox enabled.");
+                } else {
+                    self.settings.sandbox.enabled = false;
+                    print_info("Docker still not responding. Sandbox disabled for now.");
+                }
+            } else {
+                self.settings.sandbox.enabled = false;
+                print_info("Sandbox disabled. Start Docker and set SANDBOX_ENABLED=true later.");
+            }
+        }
+        _ => {
+            self.settings.sandbox.enabled = false;
+        }
+    }
+
+    Ok(())
+}
+```
+
+**Step 3: Wire into `run()` method**
+
+```rust
+// Step 8: Docker Sandbox
+print_step(8, total_steps, "Docker Sandbox");
+self.step_docker_sandbox().await?;
+self.persist_after_step().await;
+
+// Step 9: Heartbeat (was Step 8)
+print_step(9, total_steps, "Background Tasks");
+self.step_heartbeat()?;
+self.persist_after_step().await;
+```
+
+**Step 4: Run tests**
+
+Run: `cargo test setup`
+Expected: All pass
+
+**Step 5: Commit**
+
+```bash
+git add src/setup/wizard.rs
+git commit -m "feat: add Docker sandbox step to setup wizard"
+```
+
+---
+
+### Task 5: Final Verification
+
+**Step 1: Run full test suite**
+
+Run: `cargo test`
+Expected: All pass
+
+**Step 2: Run clippy**
+
+Run: `cargo clippy --all --all-features --benches --tests --examples`
+Expected: Zero warnings
+
+**Step 3: Check for unwrap/expect in production code**
+
+Grep changed files for `.unwrap()` and `.expect(` -- should have none in production code.
+
+**Step 4: Verify both feature flags compile**
+
+Run: `cargo check` and `cargo check --no-default-features --features libsql`
+Expected: Both clean
@@ -0,0 +1,66 @@
+# Skills Tab - Web UI Design
+
+## Goal
+
+Add a Skills tab to the IronClaw web gateway that lets users browse installed skills, search ClawHub for new skills, and install/remove skills -- all from the browser.
+
+## Scope
+
+**Frontend only.** The REST API endpoints already exist:
+
+| Method | Endpoint | Purpose |
+|--------|----------|---------|
+| GET | `/api/skills` | List installed skills |
+| POST | `/api/skills/search` | Search ClawHub + local |
+| POST | `/api/skills/install` | Install (requires `X-Confirm-Action: true`) |
+| DELETE | `/api/skills/{name}` | Remove (requires `X-Confirm-Action: true`) |
+
+No Rust changes needed.
+
+## Layout
+
+Three sections inside the tab panel:
+
+### 1. Search ClawHub
+
+A search input at the top. On submit, calls `POST /api/skills/search` and renders catalog results as dashed-border cards (matching the "available extension" pattern). Cards that match an already-installed skill show "Installed" instead of an Install button.
+
+Staggered fade-in animation on search results for polish.
+
+### 2. Installed Skills
+
+Grid of cards for all locally loaded skills. Each card shows:
+- **Name** (bold, `.ext-name` style)
+- **Trust badge**: "Trusted" (green) or "Installed" (blue) -- small pill
+- **Version** (small, secondary text)
+- **Description** (`.ext-desc` style)
+- **Activation keywords** as small tags (`.ext-keywords` style)
+- **Remove button** -- only for registry-installed skills (trust=Installed), not user-placed trusted skills
+
+### 3. Install by URL
+
+A small form matching the WASM install form pattern:
+- Name input
+- URL input (HTTPS)
+- Install button
+
+## Visual Design
+
+Reuses existing `.ext-card`, `.extensions-list`, `.extensions-section`, `.btn-ext` classes. New CSS limited to:
+- `.skill-trust` badge pill (green for Trusted, blue for Installed)
+- `.skill-version` small version label
+- Staggered `@keyframes skillFadeIn` for search results
+- `.skill-search-box` for the search input styling
+
+## Files Modified
+
+- `src/channels/web/static/index.html` -- Add Skills tab button + panel markup
+- `src/channels/web/static/app.js` -- Add `loadSkills()`, `searchClawHub()`, `installSkill()`, `removeSkill()`, render functions, wire into `switchTab()`
+- `src/channels/web/static/style.css` -- Trust badge styles, search box, fade-in animation
+
+## Decisions
+
+- Reuse ext-card classes rather than creating a parallel card system
+- Trust badge differentiates skills from extensions visually
+- Confirmation uses `window.confirm()` dialog matching `removeExtension()` pattern
+- Search is manual (button/enter) not live-as-you-type to avoid hammering ClawHub
@@ -0,0 +1,574 @@
+# Skills Tab Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Add a Skills tab to the IronClaw web UI for browsing installed skills, searching ClawHub, and installing/removing skills.
+
+**Architecture:** Frontend-only changes to three static files (HTML, CSS, JS). The REST API (`/api/skills/*`) already exists and needs no modification. Follows the existing Extensions tab pattern: card grid layout, `apiFetch()` helper, `showToast()` for feedback.
+
+**Tech Stack:** Vanilla HTML/CSS/JS (no frameworks), existing design system (CSS variables, `ext-card` family classes).
+
+---
+
+### Task 1: Add Skills tab button and panel markup to index.html
+
+**Files:**
+- Modify: `src/channels/web/static/index.html:39-44` (tab bar) and `188-232` (before extensions panel)
+
+**Step 1: Add the Skills tab button**
+
+In `index.html`, inside the `.tab-bar` div, add a Skills button between Extensions and the spacer. Change lines 43-44 from:
+
+```html
+      <button data-tab="extensions">Extensions</button>
+      <div class="spacer"></div>
+```
+
+to:
+
+```html
+      <button data-tab="extensions">Extensions</button>
+      <button data-tab="skills">Skills</button>
+      <div class="spacer"></div>
+```
+
+**Step 2: Add the Skills tab panel**
+
+Add the Skills panel markup after the Extensions panel closing `</div>` (after line 232) and before the toasts div:
+
+```html
+    <!-- Skills Tab -->
+    <div class="tab-panel" id="tab-skills">
+      <div class="extensions-container">
+        <div class="extensions-section">
+          <h3>Search ClawHub</h3>
+          <div class="skill-search-box">
+            <input type="text" id="skill-search-input" placeholder="Search for skills...">
+            <button onclick="searchClawHub()">Search</button>
+          </div>
+          <div class="extensions-list" id="skill-search-results"></div>
+        </div>
+        <div class="extensions-section">
+          <h3>Installed Skills</h3>
+          <div class="extensions-list" id="skills-list">
+            <div class="empty-state">Loading skills...</div>
+          </div>
+        </div>
+        <div class="extensions-section">
+          <h3>Install Skill by URL</h3>
+          <div class="ext-install-form">
+            <input type="text" id="skill-install-name" placeholder="Skill name or slug">
+            <input type="text" id="skill-install-url" placeholder="HTTPS URL to SKILL.md (optional)">
+            <button onclick="installSkillFromForm()">Install</button>
+          </div>
+        </div>
+      </div>
+    </div>
+```
+
+**Step 3: Verify the HTML is well-formed**
+
+Open the file and confirm the new panel is between the Extensions panel closing tag and `<div id="toasts">`.
+
+**Step 4: Commit**
+
+```bash
+git add src/channels/web/static/index.html
+git commit -m "feat(web): add Skills tab markup to index.html"
+```
+
+---
+
+### Task 2: Add Skills CSS (trust badges, search box, fade-in animation)
+
+**Files:**
+- Modify: `src/channels/web/static/style.css` (append before the `@media` responsive block at line 2810)
+
+**Step 1: Add skill-specific CSS**
+
+Insert the following CSS before the `/* --- Activity toolbar --- */` comment (before line 2810):
+
+```css
+/* --- Skills tab --- */
+
+.skill-search-box {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  margin-bottom: 12px;
+}
+
+.skill-search-box input {
+  flex: 1;
+  padding: 8px 12px;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  color: var(--text);
+  font-size: 13px;
+}
+
+.skill-search-box input:focus {
+  outline: none;
+  border-color: var(--accent);
+  box-shadow: 0 0 0 3px rgba(52, 211, 153, 0.1);
+}
+
+.skill-search-box button {
+  padding: 8px 20px;
+  background: var(--accent);
+  color: #09090b;
+  border: none;
+  border-radius: var(--radius);
+  cursor: pointer;
+  font-size: 13px;
+  font-weight: 600;
+  transition: background 0.2s, transform 0.2s;
+}
+
+.skill-search-box button:hover {
+  background: var(--accent-hover);
+  transform: translateY(-1px);
+}
+
+.skill-trust {
+  font-size: 10px;
+  padding: 2px 6px;
+  border-radius: 8px;
+  font-weight: 500;
+  text-transform: uppercase;
+  letter-spacing: 0.3px;
+}
+
+.skill-trust.trust-trusted {
+  background: rgba(52, 211, 153, 0.15);
+  color: var(--success);
+}
+
+.skill-trust.trust-installed {
+  background: rgba(96, 165, 250, 0.15);
+  color: #60a5fa;
+}
+
+.skill-version {
+  font-size: 11px;
+  color: var(--text-secondary);
+  font-family: var(--font-mono);
+}
+
+@keyframes skillFadeIn {
+  from { opacity: 0; transform: translateY(8px); }
+  to { opacity: 1; transform: translateY(0); }
+}
+
+.skill-search-result {
+  animation: skillFadeIn 0.3s ease-out both;
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/channels/web/static/style.css
+git commit -m "feat(web): add Skills tab CSS styles"
+```
+
+---
+
+### Task 3: Wire Skills tab into switchTab() and keyboard shortcuts
+
+**Files:**
+- Modify: `src/channels/web/static/app.js:823-827` (switchTab function) and `2700-2704` (keyboard shortcuts)
+
+**Step 1: Add skills tab loading to switchTab()**
+
+In the `switchTab()` function, after line 827 (`if (tab === 'extensions') loadExtensions();`), add:
+
+```javascript
+  if (tab === 'skills') loadSkills();
+```
+
+**Step 2: Update keyboard shortcut tab array**
+
+At line 2702, change:
+
+```javascript
+    const tabs = ['chat', 'memory', 'jobs', 'routines', 'extensions'];
+```
+
+to:
+
+```javascript
+    const tabs = ['chat', 'memory', 'jobs', 'routines', 'extensions', 'skills'];
+```
+
+And update the key range check at line 2700 from `'5'` to `'6'`:
+
+```javascript
+  if (mod && e.key >= '1' && e.key <= '6') {
+```
+
+**Step 3: Commit**
+
+```bash
+git add src/channels/web/static/app.js
+git commit -m "feat(web): wire Skills tab into switchTab and keyboard shortcuts"
+```
+
+---
+
+### Task 4: Implement loadSkills() -- render installed skills
+
+**Files:**
+- Modify: `src/channels/web/static/app.js` (add new section after the Extensions section, before keyboard shortcuts)
+
+**Step 1: Add the loadSkills function**
+
+Add this code block before the `// --- Keyboard shortcuts ---` comment (before line 2692):
+
+```javascript
+// --- Skills ---
+
+function loadSkills() {
+  var skillsList = document.getElementById('skills-list');
+  apiFetch('/api/skills').then(function(data) {
+    if (!data.skills || data.skills.length === 0) {
+      skillsList.innerHTML = '<div class="empty-state">No skills installed</div>';
+      return;
+    }
+    skillsList.innerHTML = '';
+    for (var i = 0; i < data.skills.length; i++) {
+      skillsList.appendChild(renderSkillCard(data.skills[i]));
+    }
+  }).catch(function(err) {
+    skillsList.innerHTML = '<div class="empty-state">Failed to load skills: ' + escapeHtml(err.message) + '</div>';
+  });
+}
+
+function renderSkillCard(skill) {
+  var card = document.createElement('div');
+  card.className = 'ext-card';
+
+  var header = document.createElement('div');
+  header.className = 'ext-header';
+
+  var name = document.createElement('span');
+  name.className = 'ext-name';
+  name.textContent = skill.name;
+  header.appendChild(name);
+
+  var trust = document.createElement('span');
+  var trustClass = skill.trust.toLowerCase() === 'trusted' ? 'trust-trusted' : 'trust-installed';
+  trust.className = 'skill-trust ' + trustClass;
+  trust.textContent = skill.trust;
+  header.appendChild(trust);
+
+  var version = document.createElement('span');
+  version.className = 'skill-version';
+  version.textContent = 'v' + skill.version;
+  header.appendChild(version);
+
+  card.appendChild(header);
+
+  var desc = document.createElement('div');
+  desc.className = 'ext-desc';
+  desc.textContent = skill.description;
+  card.appendChild(desc);
+
+  if (skill.keywords && skill.keywords.length > 0) {
+    var kw = document.createElement('div');
+    kw.className = 'ext-keywords';
+    kw.textContent = 'Activates on: ' + skill.keywords.join(', ');
+    card.appendChild(kw);
+  }
+
+  var actions = document.createElement('div');
+  actions.className = 'ext-actions';
+
+  // Only show Remove for registry-installed skills, not user-placed trusted skills
+  if (skill.trust.toLowerCase() !== 'trusted') {
+    var removeBtn = document.createElement('button');
+    removeBtn.className = 'btn-ext remove';
+    removeBtn.textContent = 'Remove';
+    removeBtn.addEventListener('click', function() { removeSkill(skill.name); });
+    actions.appendChild(removeBtn);
+  }
+
+  card.appendChild(actions);
+  return card;
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/channels/web/static/app.js
+git commit -m "feat(web): implement loadSkills and renderSkillCard"
+```
+
+---
+
+### Task 5: Implement searchClawHub() -- search and render catalog results
+
+**Files:**
+- Modify: `src/channels/web/static/app.js` (add after `renderSkillCard`, before keyboard shortcuts)
+
+**Step 1: Add search and catalog card rendering**
+
+Add this code after the `renderSkillCard` function:
+
+```javascript
+function searchClawHub() {
+  var input = document.getElementById('skill-search-input');
+  var query = input.value.trim();
+  if (!query) return;
+
+  var resultsDiv = document.getElementById('skill-search-results');
+  resultsDiv.innerHTML = '<div class="empty-state">Searching...</div>';
+
+  apiFetch('/api/skills/search', {
+    method: 'POST',
+    body: { query: query },
+  }).then(function(data) {
+    resultsDiv.innerHTML = '';
+
+    // Show catalog results
+    if (data.catalog && data.catalog.length > 0) {
+      // Build a set of installed skill names for quick lookup
+      var installedNames = {};
+      if (data.installed) {
+        for (var j = 0; j < data.installed.length; j++) {
+          installedNames[data.installed[j].name] = true;
+        }
+      }
+
+      for (var i = 0; i < data.catalog.length; i++) {
+        var card = renderCatalogSkillCard(data.catalog[i], installedNames);
+        card.style.animationDelay = (i * 0.06) + 's';
+        resultsDiv.appendChild(card);
+      }
+    }
+
+    // Show matching installed skills too
+    if (data.installed && data.installed.length > 0) {
+      for (var k = 0; k < data.installed.length; k++) {
+        var installedCard = renderSkillCard(data.installed[k]);
+        installedCard.style.animationDelay = ((data.catalog ? data.catalog.length : 0) + k) * 0.06 + 's';
+        installedCard.classList.add('skill-search-result');
+        resultsDiv.appendChild(installedCard);
+      }
+    }
+
+    if (resultsDiv.children.length === 0) {
+      resultsDiv.innerHTML = '<div class="empty-state">No skills found for "' + escapeHtml(query) + '"</div>';
+    }
+  }).catch(function(err) {
+    resultsDiv.innerHTML = '<div class="empty-state">Search failed: ' + escapeHtml(err.message) + '</div>';
+  });
+}
+
+function renderCatalogSkillCard(entry, installedNames) {
+  var card = document.createElement('div');
+  card.className = 'ext-card ext-available skill-search-result';
+
+  var header = document.createElement('div');
+  header.className = 'ext-header';
+
+  var name = document.createElement('span');
+  name.className = 'ext-name';
+  name.textContent = entry.name || entry.slug;
+  header.appendChild(name);
+
+  if (entry.version) {
+    var version = document.createElement('span');
+    version.className = 'skill-version';
+    version.textContent = 'v' + entry.version;
+    header.appendChild(version);
+  }
+
+  card.appendChild(header);
+
+  if (entry.description) {
+    var desc = document.createElement('div');
+    desc.className = 'ext-desc';
+    desc.textContent = entry.description;
+    card.appendChild(desc);
+  }
+
+  var actions = document.createElement('div');
+  actions.className = 'ext-actions';
+
+  var slug = entry.slug || entry.name;
+  var isInstalled = installedNames[entry.name] || installedNames[slug];
+
+  if (isInstalled) {
+    var label = document.createElement('span');
+    label.className = 'ext-active-label';
+    label.textContent = 'Installed';
+    actions.appendChild(label);
+  } else {
+    var installBtn = document.createElement('button');
+    installBtn.className = 'btn-ext install';
+    installBtn.textContent = 'Install';
+    installBtn.addEventListener('click', (function(s, btn) {
+      return function() {
+        if (!confirm('Install skill "' + s + '" from ClawHub?')) return;
+        btn.disabled = true;
+        btn.textContent = 'Installing...';
+        installSkill(s, null, btn);
+      };
+    })(slug, installBtn));
+    actions.appendChild(installBtn);
+  }
+
+  card.appendChild(actions);
+  return card;
+}
+
+// Wire up Enter key on search input
+document.getElementById('skill-search-input').addEventListener('keydown', function(e) {
+  if (e.key === 'Enter') searchClawHub();
+});
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/channels/web/static/app.js
+git commit -m "feat(web): implement ClawHub search with staggered card animation"
+```
+
+---
+
+### Task 6: Implement installSkill() and removeSkill()
+
+**Files:**
+- Modify: `src/channels/web/static/app.js` (add after search functions, before keyboard shortcuts)
+
+**Step 1: Add install and remove functions**
+
+Add this code after the search event listener:
+
+```javascript
+function installSkill(nameOrSlug, url, btn) {
+  var body = { name: nameOrSlug };
+  if (url) body.url = url;
+
+  apiFetch('/api/skills/install', {
+    method: 'POST',
+    headers: { 'X-Confirm-Action': 'true' },
+    body: body,
+  }).then(function(res) {
+    if (res.success) {
+      showToast('Installed skill "' + nameOrSlug + '"', 'success');
+    } else {
+      showToast('Install failed: ' + (res.message || 'unknown error'), 'error');
+    }
+    loadSkills();
+    if (btn) { btn.disabled = false; btn.textContent = 'Install'; }
+  }).catch(function(err) {
+    showToast('Install failed: ' + err.message, 'error');
+    if (btn) { btn.disabled = false; btn.textContent = 'Install'; }
+  });
+}
+
+function removeSkill(name) {
+  if (!confirm('Remove skill "' + name + '"?')) return;
+  apiFetch('/api/skills/' + encodeURIComponent(name), {
+    method: 'DELETE',
+    headers: { 'X-Confirm-Action': 'true' },
+  }).then(function(res) {
+    if (res.success) {
+      showToast('Removed skill "' + name + '"', 'success');
+    } else {
+      showToast('Remove failed: ' + (res.message || 'unknown error'), 'error');
+    }
+    loadSkills();
+  }).catch(function(err) {
+    showToast('Remove failed: ' + err.message, 'error');
+  });
+}
+
+function installSkillFromForm() {
+  var name = document.getElementById('skill-install-name').value.trim();
+  if (!name) { showToast('Skill name is required', 'error'); return; }
+  var url = document.getElementById('skill-install-url').value.trim() || null;
+  if (url && !url.startsWith('https://')) {
+    showToast('URL must use HTTPS', 'error');
+    return;
+  }
+  if (!confirm('Install skill "' + name + '"?')) return;
+  installSkill(name, url, null);
+  document.getElementById('skill-install-name').value = '';
+  document.getElementById('skill-install-url').value = '';
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/channels/web/static/app.js
+git commit -m "feat(web): implement installSkill, removeSkill, and form handler"
+```
+
+---
+
+### Task 7: Fix apiFetch to merge extra headers properly
+
+**Files:**
+- Modify: `src/channels/web/static/app.js:86-98` (apiFetch function)
+
+**Context:** The current `apiFetch` function sets `opts.headers` as an object and always overwrites with `Authorization`. When we pass `headers: { 'X-Confirm-Action': 'true' }` in options, the current code does `opts.headers = opts.headers || {}` which preserves our custom headers, then adds Authorization. However, `fetch()` expects headers as a `Headers` object or plain object -- the plain object approach works fine. Verify this works by reading the function carefully.
+
+**Step 1: Verify apiFetch handles extra headers**
+
+Read `app.js:86-98`. The current code:
+```javascript
+function apiFetch(path, options) {
+  const opts = options || {};
+  opts.headers = opts.headers || {};
+  opts.headers['Authorization'] = 'Bearer ' + token;
+  ...
+}
+```
+
+This correctly merges: if we pass `{ headers: { 'X-Confirm-Action': 'true' } }`, it keeps our header and adds Authorization. **No change needed.** Move on.
+
+**Step 2: Commit (skip -- no changes)**
+
+---
+
+### Task 8: Manual testing and final commit
+
+**Step 1: Verify the HTML is valid**
+
+Open `src/channels/web/static/index.html` and confirm:
+- The Skills tab button appears in the tab bar
+- The `tab-skills` panel has the correct structure
+- No unclosed tags
+
+**Step 2: Verify the JS doesn't have syntax errors**
+
+Run a quick syntax check (if node is available):
+```bash
+node -c src/channels/web/static/app.js
+```
+
+**Step 3: Test the tab appears and loads**
+
+Start the app and open the web gateway. Verify:
+1. Skills tab appears in the tab bar between Extensions and the spacer
+2. Clicking it shows the three sections
+3. Installed skills load and display with trust badges and keywords
+4. ClawHub search returns results with staggered animation
+5. Install from search works (with confirm dialog)
+6. Remove works for registry-installed skills
+7. Install by URL form works
+8. Cmd+6 keyboard shortcut switches to Skills tab
+
+**Step 4: Final commit if any fixes were needed**
+
+```bash
+git add src/channels/web/static/index.html src/channels/web/static/app.js src/channels/web/static/style.css
+git commit -m "feat(web): complete Skills tab with ClawHub search, install, and remove"
+```
@@ -0,0 +1,480 @@
+# Fix Routine Silent Failures (#697) Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** When full_job routines fail due to missing sandbox/Docker infrastructure, surface loud, clear errors to the user instead of failing silently.
+
+**Architecture:** Three layers of improvement: (1) incorporate PR #711's sync mechanism so dispatched job completions/failures propagate back to routine runs, (2) fail fast at dispatch time when sandbox is configured but Docker is unavailable by threading sandbox availability into RoutineEngine, (3) send a user-visible notification at startup when sandbox is disabled due to missing Docker.
+
+**Tech Stack:** Rust, tokio, thiserror
+
+---
+
+## Prerequisites
+
+- Branch from `main` (not from the existing `fix/697-routine-silent-failure` branch)
+- We will incorporate PR #711's changes as part of this PR, making #711 superseded
+
+---
+
+### Task 1: Add `list_dispatched_routine_runs` to Database trait and implementations
+
+PR #711 adds this method. We incorporate it here.
+
+**Files:**
+- Modify: `src/db/mod.rs` (RoutineStore trait)
+- Modify: `src/db/postgres.rs`
+- Modify: `src/db/libsql/routines.rs`
+- Modify: `src/history/store.rs`
+
+**Step 1: Add trait method to RoutineStore**
+
+In `src/db/mod.rs`, add to the `RoutineStore` trait (after `link_routine_run_to_job`):
+
+```rust
+/// List routine runs that were dispatched as full_job (status = 'running'
+/// with a linked job_id). Used by the routine engine to sync completion
+/// status from the background job.
+async fn list_dispatched_routine_runs(&self) -> Result<Vec<RoutineRun>, DatabaseError>;
+```
+
+**Step 2: Implement for PostgreSQL**
+
+In `src/db/postgres.rs`, add the implementation (delegating to `Store`):
+
+```rust
+async fn list_dispatched_routine_runs(&self) -> Result<Vec<RoutineRun>, DatabaseError> {
+    self.inner.list_dispatched_routine_runs().await
+}
+```
+
+**Step 3: Implement for libSQL**
+
+In `src/db/libsql/routines.rs`, add:
+
+```rust
+pub async fn list_dispatched_routine_runs(
+    &self,
+) -> Result<Vec<RoutineRun>, DatabaseError> {
+    let conn = self.pool.connection().await.map_err(|e| {
+        DatabaseError::Query(format!("failed to get connection: {e}"))
+    })?;
+    let mut rows = conn
+        .query(
+            "SELECT id, routine_id, trigger_type, trigger_detail, started_at, \
+             completed_at, status, result_summary, tokens_used, job_id, created_at \
+             FROM routine_runs WHERE status = 'running' AND job_id IS NOT NULL",
+            (),
+        )
+        .await
+        .map_err(|e| DatabaseError::Query(e.to_string()))?;
+
+    let mut runs = Vec::new();
+    while let Some(row) = rows.next().await.map_err(|e| DatabaseError::Query(e.to_string()))? {
+        runs.push(parse_routine_run_row(&row)?);
+    }
+    Ok(runs)
+}
+```
+
+**Step 4: Implement for Store wrapper**
+
+In `src/history/store.rs`, add:
+
+```rust
+pub async fn list_dispatched_routine_runs(&self) -> Result<Vec<RoutineRun>, DatabaseError> {
+    sqlx::query_as::<_, RoutineRunRow>(
+        "SELECT id, routine_id, trigger_type, trigger_detail, started_at, \
+         completed_at, status, result_summary, tokens_used, job_id, created_at \
+         FROM routine_runs WHERE status = 'running' AND job_id IS NOT NULL"
+    )
+    .fetch_all(&self.pool)
+    .await
+    .map(|rows| rows.into_iter().map(Into::into).collect())
+    .map_err(|e| DatabaseError::Query(e.to_string()))
+}
+```
+
+**Step 5: Verify compilation**
+
+```bash
+cargo check
+cargo check --no-default-features --features libsql
+```
+
+**Step 6: Commit**
+
+```bash
+git add src/db/mod.rs src/db/postgres.rs src/db/libsql/routines.rs src/history/store.rs
+git commit -m "feat(db): add list_dispatched_routine_runs for routine-job sync (#697)"
+```
+
+---
+
+### Task 2: Add sync_dispatched_runs and fix dispatch status in routine_engine
+
+Incorporates PR #711's core fix: change `execute_full_job` to return `RunStatus::Running` instead of `Ok`, and add the periodic sync mechanism.
+
+**Files:**
+- Modify: `src/agent/routine_engine.rs`
+
+**Step 1: Write tests for job-state-to-run-status mapping and Running notification gating**
+
+Add to the `mod tests` block at the bottom of `routine_engine.rs`:
+
+```rust
+#[test]
+fn test_running_status_does_not_notify() {
+    let config = NotifyConfig {
+        on_success: true,
+        on_failure: true,
+        on_attention: true,
+        ..Default::default()
+    };
+
+    let should_notify = match RunStatus::Running {
+        RunStatus::Ok => config.on_success,
+        RunStatus::Attention => config.on_attention,
+        RunStatus::Failed => config.on_failure,
+        RunStatus::Running => false,
+    };
+    assert!(!should_notify);
+}
+
+#[test]
+fn test_full_job_dispatch_returns_running_status() {
+    assert_eq!(RunStatus::Running.to_string(), "running");
+}
+
+/// Regression test for #697: full_job routines were immediately marked Ok
+/// on dispatch, so failures/completions were never synced back.
+#[test]
+fn test_job_state_to_run_status_mapping() {
+    use crate::context::JobState;
+
+    let map_state = |state: JobState, reason: Option<&str>| -> Option<(RunStatus, String)> {
+        let last_reason = reason.map(|s| s.to_string());
+        match state {
+            JobState::Completed | JobState::Submitted | JobState::Accepted => {
+                let summary =
+                    last_reason.unwrap_or_else(|| "Job completed successfully".to_string());
+                Some((RunStatus::Ok, summary))
+            }
+            JobState::Failed => {
+                let summary = last_reason
+                    .unwrap_or_else(|| "Job failed (no error message recorded)".to_string());
+                Some((RunStatus::Failed, summary))
+            }
+            JobState::Cancelled => Some((RunStatus::Failed, "Job was cancelled".to_string())),
+            JobState::Pending | JobState::InProgress | JobState::Stuck => None,
+        }
+    };
+
+    let (status, _) = map_state(JobState::Completed, None).unwrap();
+    assert_eq!(status, RunStatus::Ok);
+
+    let (status, _) = map_state(JobState::Failed, Some("OOM killed")).unwrap();
+    assert_eq!(status, RunStatus::Failed);
+    assert_eq!(summary, "OOM killed");
+
+    let (status, summary) = map_state(JobState::Failed, None).unwrap();
+    assert_eq!(status, RunStatus::Failed);
+    assert!(summary.contains("no error message"));
+
+    assert!(map_state(JobState::Pending, None).is_none());
+    assert!(map_state(JobState::InProgress, None).is_none());
+    assert!(map_state(JobState::Stuck, None).is_none());
+}
+```
+
+**Step 2: Run tests to verify they fail**
+
+```bash
+cargo test routine_engine::tests --all-features
+```
+
+Expected: compilation error since `sync_dispatched_runs` doesn't exist yet.
+
+**Step 3: Add import and sync methods**
+
+Add `use crate::context::JobState;` to the imports.
+
+Add `sync_dispatched_runs` and `complete_dispatched_run` methods to `impl RoutineEngine` (after `check_cron_triggers`). See PR #711 diff for exact implementation.
+
+Change `execute_full_job` return from:
+```rust
+Ok((RunStatus::Ok, Some(summary), None))
+```
+to:
+```rust
+Ok((RunStatus::Running, Some(summary), None))
+```
+
+Update the summary message to include "Status will be updated when the job completes."
+
+Add `engine.sync_dispatched_runs().await;` to the cron ticker loop in `spawn_cron_ticker`, after `check_cron_triggers`.
+
+**Step 4: Run tests**
+
+```bash
+cargo test routine_engine::tests --all-features
+```
+
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add src/agent/routine_engine.rs
+git commit -m "fix(routines): sync dispatched full_job runs with job completion (#697)"
+```
+
+---
+
+### Task 3: Fail fast when sandbox is unavailable at dispatch time
+
+This is the new work beyond PR #711. Thread sandbox availability into `RoutineEngine` so `execute_full_job` can fail immediately with a clear error instead of dispatching a doomed job.
+
+**Files:**
+- Modify: `src/agent/routine_engine.rs`
+- Modify: `src/agent/agent_loop.rs`
+
+**Step 1: Write the failing test**
+
+Add to `mod tests` in `routine_engine.rs`:
+
+```rust
+#[test]
+fn test_sandbox_unavailable_error_message() {
+    let err = RoutineError::JobDispatchFailed {
+        reason: "Sandbox is enabled but Docker is not available. \
+                 Install Docker or set SANDBOX_ENABLED=false to run full_job routines."
+            .to_string(),
+    };
+    let msg = err.to_string();
+    assert!(msg.contains("Docker is not available"));
+    assert!(msg.contains("SANDBOX_ENABLED"));
+}
+```
+
+**Step 2: Run test to verify it passes (this one is a unit test for the error variant)**
+
+```bash
+cargo test routine_engine::tests::test_sandbox_unavailable_error_message --all-features
+```
+
+Expected: PASS (error variant already exists, we're just testing the message).
+
+**Step 3: Add `sandbox_available` field to `RoutineEngine`**
+
+In `src/agent/routine_engine.rs`, add a field to the `RoutineEngine` struct:
+
+```rust
+/// Whether sandbox/Docker infrastructure is available for full_job execution.
+sandbox_available: bool,
+```
+
+Update `RoutineEngine::new` to accept and store it:
+
+```rust
+pub fn new(
+    config: RoutineConfig,
+    store: Arc<dyn Database>,
+    llm: Arc<dyn LlmProvider>,
+    workspace: Arc<Workspace>,
+    notify_tx: mpsc::Sender<OutgoingResponse>,
+    scheduler: Option<Arc<Scheduler>>,
+    sandbox_available: bool,
+) -> Self {
+    Self {
+        config,
+        store,
+        llm,
+        workspace,
+        notify_tx,
+        running_count: Arc::new(AtomicUsize::new(0)),
+        event_cache: Arc::new(RwLock::new(Vec::new())),
+        scheduler,
+        sandbox_available,
+    }
+}
+```
+
+**Step 4: Add sandbox check in `execute_full_job`**
+
+At the top of `execute_full_job`, before the scheduler check, add a sandbox availability check. This requires passing `sandbox_available` through `EngineContext`.
+
+Add `sandbox_available: bool` to `EngineContext`.
+
+Update `spawn_fire` and `fire_manual` to pass `self.sandbox_available` into `EngineContext`.
+
+In `execute_full_job`, add before the scheduler check:
+
+```rust
+if !ctx.sandbox_available {
+    return Err(RoutineError::JobDispatchFailed {
+        reason: "Sandbox is enabled but Docker is not available. \
+                 Install Docker or set SANDBOX_ENABLED=false to run full_job routines."
+            .to_string(),
+    });
+}
+```
+
+**Step 5: Update call site in `agent_loop.rs`**
+
+In `src/agent/agent_loop.rs`, where `RoutineEngine::new` is called (~line 442), pass the sandbox availability. The `Agent` struct needs to know Docker status. The simplest approach:
+
+Add a `sandbox_available: bool` field to `Agent` (or to `AgentDeps`). Set it during construction based on the `docker_status` from `main.rs`. The value flows: `main.rs` detects Docker -> passes `sandbox_available` bool through `AppComponents` or `AgentDeps` -> `Agent` passes it to `RoutineEngine::new`.
+
+Look at how `main.rs` passes config to `Agent`. The `docker_status` is computed in `main.rs`. The cleanest path:
+- Add `sandbox_available: bool` to `AppComponents` (set in `main.rs`)
+- Thread it through to `AgentDeps` -> `Agent` -> `RoutineEngine::new`
+
+Alternatively, since `config.sandbox.enabled` is already available in the agent, just add one more bool. Check the existing flow and pick the minimal path.
+
+**Step 6: Verify compilation**
+
+```bash
+cargo check --all-features
+cargo check --no-default-features --features libsql
+```
+
+**Step 7: Run tests**
+
+```bash
+cargo test routine_engine::tests --all-features
+```
+
+**Step 8: Commit**
+
+```bash
+git add src/agent/routine_engine.rs src/agent/agent_loop.rs src/main.rs src/app.rs
+git commit -m "fix(routines): fail fast when sandbox unavailable at dispatch time (#697)"
+```
+
+---
+
+### Task 4: Surface sandbox unavailability to user via notification channel
+
+Currently the Docker detection warning only goes to `tracing::warn` (logs). Users on TUI/web never see it. Send a user-visible notification after channels are set up.
+
+**Files:**
+- Modify: `src/main.rs`
+
+**Step 1: Write the test**
+
+This is a startup behavior change, so the test is an integration-level assertion. Add a unit test for the notification message formatting:
+
+In `src/agent/routine_engine.rs` tests (or a new test in main.rs tests if they exist):
+
+```rust
+#[test]
+fn test_sandbox_warning_message_format() {
+    let msg = format!(
+        "Sandbox is enabled but Docker is not available -- full_job routines will fail. {}",
+        "Install Docker Desktop from https://docker.com/get-started"
+    );
+    assert!(msg.contains("full_job routines will fail"));
+    assert!(msg.contains("Docker"));
+}
+```
+
+**Step 2: Add startup notification in `main.rs`**
+
+After the channel manager is set up and the agent is running, if `config.sandbox.enabled && !docker_status.is_ok()`, send a warning message through the channel manager. The pattern already exists for heartbeat/routine notifications.
+
+The exact location: after `channels` is fully initialized (after all channels are added), but before the agent run loop. Find where `channels.broadcast_all` is accessible.
+
+The simplest approach: after the agent starts (`agent.run()` is typically the last call), but since that blocks, the notification should be sent *before* `agent.run()` is called, using a spawned task or inline send.
+
+Look at where heartbeat startup notifications go. Mirror that pattern:
+
+```rust
+if config.sandbox.enabled && !docker_status.is_ok() {
+    let warning = format!(
+        "Warning: Sandbox is enabled but Docker is not available -- \
+         full_job routines will fail until Docker is running. {}",
+        docker_status_detection.platform.install_hint()
+    );
+    let response = OutgoingResponse {
+        content: warning,
+        thread_id: None,
+        attachments: Vec::new(),
+        metadata: serde_json::json!({
+            "source": "system",
+            "type": "warning",
+        }),
+    };
+    let channels_clone = channels.clone();
+    tokio::spawn(async move {
+        // Small delay to let channels finish connecting
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+        let _ = channels_clone.broadcast_all("default", response).await;
+    });
+}
+```
+
+Note: we need to preserve the `detection` struct (not just `docker_status`) to access `platform.install_hint()`. Adjust the variable binding in the Docker detection block to keep it available.
+
+**Step 3: Verify compilation**
+
+```bash
+cargo check --all-features
+```
+
+**Step 4: Commit**
+
+```bash
+git add src/main.rs
+git commit -m "feat(startup): notify user when sandbox unavailable (#697)"
+```
+
+---
+
+### Task 5: Final verification and cleanup
+
+**Step 1: Run full test suite**
+
+```bash
+cargo fmt
+cargo clippy --all --benches --tests --examples --all-features
+cargo test --all-features
+```
+
+**Step 2: Verify both feature configurations compile**
+
+```bash
+cargo check --no-default-features --features libsql
+cargo check
+```
+
+**Step 3: Run pre-commit safety checks**
+
+```bash
+grep -rnE '\.unwrap\(|\.expect\(' src/agent/routine_engine.rs src/main.rs
+```
+
+Expect: no hits in production code (test code is fine).
+
+**Step 4: Create final commit if any formatting/clippy fixes needed**
+
+```bash
+git add -A
+git commit -m "style: formatting and clippy fixes (#697)"
+```
+
+---
+
+## Summary of Changes
+
+| What | Where | Why |
+|------|-------|-----|
+| `list_dispatched_routine_runs` DB method | `db/mod.rs`, postgres, libsql, store | Query for running routine runs with linked jobs |
+| `sync_dispatched_runs()` engine method | `routine_engine.rs` | Periodically sync job completion back to routine runs |
+| `RunStatus::Running` on dispatch | `routine_engine.rs` | Don't mark as Ok before job actually completes |
+| `sandbox_available` flag | `RoutineEngine`, `EngineContext` | Fail fast at dispatch when Docker missing |
+| Startup notification | `main.rs` | Warn user visibly when sandbox is disabled |
+
+## PR Scope
+
+This PR supersedes PR #711 by incorporating its changes plus the additional fail-fast and startup notification work. PR #711 can be closed after this merges.
@@ -0,0 +1,82 @@
+# Security Merge Train Status Board
+
+Date opened: 2026-03-11
+Last updated: 2026-03-12
+Base branch: `staging`
+Current `staging` head: `acea1143cf70f7fa593c077620c979d5aa260de9`
+
+This board started as the security merge train plan and now tracks the live status of the approved-PR merge effort.
+
+## Current Branch Health
+
+- Full staging batch for `acea1143cf70f7fa593c077620c979d5aa260de9` completed green.
+- E2E, Linux tests, Windows builds, Docker build, WASM WIT compatibility, staging gate, and summary all passed.
+- Current gating problem is no longer branch regressions. It is fresh review requirements on replacement PRs.
+
+## Merged Into `staging`
+
+| PR | Title | Outcome |
+|---|---|---|
+| #510 | fix(security): add DOMPurify and sanitize rendered markdown | Merged |
+| #518 | fix(security): resolve DNS once and reuse for SSRF validation | Merged |
+| #520 | fix(security): harden auth token env overlay usage / WASM metadata loading hardening | Merged |
+| #949 | fix(setup): drain residual events and filter key kind in onboard prompts | Merged |
+| #935 | fix(mcp): stdio/unix transports skip initialize handshake | Merged |
+| #760 | fix(agent): block thread_id-based context pollution across users | Merged |
+| #752 | fix(mcp): header safety validation and Authorization conflict bug from #704 | Merged |
+| #735 | fix: drain tunnel pipes to prevent zombie process | Merged |
+| #684 | fix(setup): validate channel credentials during setup | Merged |
+| #850 | docs: add Russian localization (README.ru.md) | Merged |
+| #851 | feat(setup): display ASCII art banner during onboarding | Merged |
+| #964 | fix(ci): disambiguate WASM bundle filenames to prevent tool/channel collision | Merged |
+| #839 | fix(test): stabilize openai compat oversized-body regression | Merged |
+| #472 | Fix systemctl unit | Merged |
+
+## Security Replacement Queue
+
+These supersede the originally approved but dirty security PRs.
+
+| Replacement PR | Supersedes | CI | Auto-merge | Merge blocker | Notes |
+|---|---|---|---|---|---|
+| #966 | #514 | Green | Enabled | `REVIEW_REQUIRED` | CSP replacement; includes E2E coverage |
+| #967 | #516 | Green | Enabled | `REVIEW_REQUIRED` | FullAccess policy guard |
+| #968 | #522 | Green | Enabled | `REVIEW_REQUIRED` | Safe env overlay / set_var invariants |
+| #970 | #513 | Green | Enabled | `REVIEW_REQUIRED` | Webhook HMAC migration |
+
+## General Replacement Queue
+
+These supersede other approved dirty PRs that were still worth carrying forward.
+
+| Replacement PR | Supersedes | CI | Auto-merge | Merge blocker | Notes |
+|---|---|---|---|---|---|
+| #986 | #793 | Green | Enabled | `REVIEW_REQUIRED` | Non-OAuth HTTP MCP clients now carry session manager |
+| #987 | #679 | In progress / early checks green | Enabled | `REVIEW_REQUIRED` | Preserves `selected_model` when re-running setup on the same backend |
+
+## Approved Originals Still Open
+
+| PR | Title | Current state | Recommended action | Notes |
+|---|---|---|---|---|
+| #514 | fix(security): add Content-Security-Policy header to web gateway | Dirty | Ignore in favor of #966 | Replacement path is active |
+| #516 | fix(security): require explicit `SANDBOX_ALLOW_FULL_ACCESS` to enable FullAccess policy | Dirty | Ignore in favor of #967 | Replacement path is active |
+| #522 | fix(security): make unsafe `env::set_var` calls safe with explicit invariants | Dirty | Ignore in favor of #968 | Replacement path is active |
+| #513 | fix(security): migrate webhook auth to HMAC-SHA256 signature header | Dirty | Ignore in favor of #970 | Replacement path is active |
+| #793 | fix(mcp): set session manager on non-OAuth HTTP MCP clients | Dirty | Ignore in favor of #986 | Replacement path is active |
+| #679 | fix(setup): preserve model selection on provider re-run | Dirty | Ignore in favor of #987 | Replacement path is active |
+| #737 | 汉化v0.1.0 | Dirty | Do not open a faithful replacement | `staging` already has a divergent i18n implementation |
+| #831 | refactor(orchestrator/api): use `test_secrets_store()` helper in credentials test | Dirty + draft | Do not rescue as-is | Current diff has drifted far beyond the title / intended scope |
+| #934 | fix(memory): reject absolute filesystem paths with corrective routing | Unstable | Do not merge as-is | Default-branch workflow change would break staging promotion in this repo |
+| #616 | feat: adds context-llm tool support | Unstable | Separate review pass needed | Too large for the safe merge train |
+
+## Practical Merge Order From Here
+
+1. Get fresh approval on `#966`, `#967`, `#968`, `#970`, `#986`, `#987`.
+2. Let auto-merge land them as checks clear.
+3. Re-run full staging CI after each actual merge to `staging`.
+4. Treat `#934`, `#737`, `#831`, and `#616` as separate workstreams, not part of the current safe merge train.
+
+## Key Findings
+
+- The repo token used here cannot bypass the required-review ruleset, even with `gh pr merge --admin`.
+- Direct pushes to `staging` are blocked by repo rules (`GH013`).
+- The replacement-PR path is the workable route for approved dirty PRs.
+- `#934` is not merely stale. Its workflow change is unsafe here because this repository's default branch is `staging`, not `main`.
@@ -0,0 +1,184 @@
+# Engine v2 Acceptance Criteria
+
+**Date:** 2026-03-22
+**Status:** Active
+**Author:** Zaki Manian
+**Goal:** Define the merge bar for replacing the v1 agent loop with the v2 engine (`crates/ironclaw_engine/`). Phase 6 is not done until every criterion below is met.
+
+---
+
+## Overview
+
+The v2 engine replaces ~10 v1 abstractions (Session, Job, Routine, Channel, Tool, Skill, Hook, Observer, Extension, LoopDelegate) with 5 primitives (Thread, Step, Capability, MemoryDoc, Project). Phases 1-5 are complete: types, execution loop, CodeAct/Monty, budget controls, and conversation surface.
+
+Phase 6 delivers the bridge adapters (`LlmBridgeAdapter`, `StoreBridgeAdapter`, `EffectBridgeAdapter`) that connect the engine to existing IronClaw infrastructure. The acceptance criteria below define what "ready to replace v1" means. Nothing merges to `staging` until all pass.
+
+---
+
+## Acceptance Criteria
+
+### 1. Behavioral Equivalence
+
+Every observable behavior of v1 must be reproduced by v2 running through bridge adapters.
+
+| # | Criterion | Verification |
+|---|-----------|-------------|
+| 1.1 | All existing E2E test fixtures pass through `EngineV2Delegate` | `cargo test --features integration -p ironclaw -- engine_v2` and `cd tests/e2e && pytest` with `ENGINE_V2=true` |
+| 1.2 | Tool dispatch produces identical outputs for identical inputs | Add property test: for each built-in tool, run same `(name, params)` through v1 `execute_tool_with_safety()` and v2 `EffectBridgeAdapter::execute_action()`, assert outputs match |
+| 1.3 | Error handling is equivalent: no silent failures where v1 errors, no errors where v1 succeeds | Diff test: run full E2E trace fixtures through both paths, compare `LoopOutcome` variants. Specifically test: invalid tool name, malformed params, timeout, policy deny |
+| 1.4 | Approval flows work identically | Test sequence: tool with `requires_approval` -> pause -> user approves -> resume -> completion. Must produce same SSE events (`approval_needed`, `approval_resolved`) |
+| 1.5 | System commands (`/help`, `/model`, `/status`, `/skills`, `/job`) produce equivalent responses | Command parity test: submit each system command through v2 conversation surface, compare output structure |
+| 1.6 | Compaction produces equivalent context reduction | Run a 50-turn conversation through both engines, trigger compaction, compare resulting context window token count (must be within 5%) |
+
+**Blocking:** 1.1, 1.2, 1.3, 1.4 are hard blockers. 1.5 and 1.6 may be deferred to Phase 7 with written justification.
+
+### 2. Performance
+
+No performance regressions. Improvements expected from context-as-variables but not required.
+
+| # | Criterion | Target | Verification |
+|---|-----------|--------|-------------|
+| 2.1 | P50 step latency | Within +10% of v1 | Benchmark harness: `cargo bench -p ironclaw --bench step_latency` with mock LLM (fixed 50ms response). Run 1000 steps, compare distributions. Harness must test both engines in the same binary. |
+| 2.2 | P95 step latency | Within +10% of v1 | Same harness as 2.1 |
+| 2.3 | P99 step latency | Within +15% of v1 | Same harness as 2.1 (wider margin for tail latency) |
+| 2.4 | Monty VM startup | < 1ms (verify the 0.06ms claim) | Dedicated microbenchmark: `cargo bench -p ironclaw_engine --bench monty_startup`. Time `MontyVm::new()` over 10,000 iterations, report P50/P99. Must include independent measurement, not self-reported. |
+| 2.5 | Token efficiency | Neutral or improved | Measure total tokens (prompt + completion) for the same 10-turn conversation fixture through both engines. v2 must not use more tokens than v1. Context-as-variables should reduce prompt tokens by 10-30% on conversations with tool output > 4KB. |
+| 2.6 | Memory per thread | No regression | Measure RSS delta when spawning 100 threads with mock LLM. v2 must not exceed v1 by more than 10%. |
+
+**Blocking:** 2.1, 2.2, 2.3 are hard blockers. 2.4, 2.5, 2.6 are soft blockers (documented regressions acceptable with mitigation plan).
+
+### 3. Safety and Security
+
+The engine itself contains no safety logic by design. Safety is enforced at the bridge boundary (`EffectBridgeAdapter`). This must be airtight.
+
+| # | Criterion | Verification |
+|---|-----------|-------------|
+| 3.1 | `SafetyLayer` (prompt injection, leak detection, content validation) is applied on every action execution through `EffectBridgeAdapter` | Unit test: mock `EffectExecutor` that logs calls, verify `SafetyLayer::validate_tool_input()` and `SafetyLayer::sanitize_tool_output()` are called for every `execute_action()` invocation. No code path bypasses this. |
+| 3.2 | Policy engine enforces `Deny > RequireApproval > Allow` with zero bypasses | Test matrix: for each `EffectType` variant (ReadLocal, ReadExternal, WriteLocal, WriteExternal, CredentialedNetwork, Compute, Financial), create conflicting rules and verify Deny always wins, RequireApproval wins over Allow. Cover the case where a single action triggers multiple effect types. |
+| 3.3 | Thread tree is acyclic with bounded depth | `ThreadTree::attach()` must reject cycles (test: A->B->C->A). `ThreadConfig::max_depth` must be enforced (test: exceed depth limit, verify `ThreadError::DepthExceeded`). Default max depth: 8. |
+| 3.4 | Capability leases are checked before every action execution | Audit `ExecutionLoop::run()` and `execute_action_calls()`: no path from LLM response to `EffectExecutor::execute_action()` that skips `LeaseManager::check_lease()`. Verify with test: expired lease -> action denied, revoked lease -> action denied, exhausted `max_uses` -> action denied. |
+| 3.5 | Monty VM panics cannot crash the host | Test: inject Python code that triggers a Monty panic (e.g., stack overflow, infinite allocation). Verify the step completes with `StepStatus::Failed`, thread continues or fails gracefully, no process abort. Specifically test all resource limits: 30s timeout, 64MB memory, 1M allocations. |
+| 3.6 | No new attack surfaces | Review checklist (manual, documented in PR): (a) lease forgery: `LeaseId` cannot be guessed or constructed outside `LeaseManager::grant()`, (b) policy bypass: no public method on `ExecutionLoop` that executes actions without policy check, (c) effect escalation: action's declared `EffectType` cannot be changed after capability registration, (d) cross-thread lease usage: lease bound to `thread_id` is enforced. |
+
+**Blocking:** All items are hard blockers. 3.6 is a manual review checklist that must be signed off in the merge PR.
+
+### 4. Persistence and Migration
+
+Production requires durable state. `InMemoryStore` is for tests only.
+
+| # | Criterion | Verification |
+|---|-----------|-------------|
+| 4.1 | `StoreBridgeAdapter` implements the full `Store` trait (18 methods) for both PostgreSQL and libSQL | Integration test per backend: create thread -> add steps -> append events -> save leases -> restart process -> load thread -> verify all data intact. Run with `cargo test --features integration` (postgres) and default (libSQL). |
+| 4.2 | Database migrations create all required tables | Migration V14+ creates: `engine_threads`, `engine_steps`, `engine_events`, `engine_projects`, `engine_memory_docs`, `engine_capability_leases`. Test: run migrations on empty database, verify tables exist with correct schemas. Both backends. |
+| 4.3 | Thread state survives process restart | Integration test: start thread -> execute 3 steps -> kill process -> restart -> resume thread -> verify step count is 3, thread state is correct, events are intact. |
+| 4.4 | In-flight v1 sessions continue working when v2 is enabled | Test: create v1 session with active thread -> enable `ENGINE_V2=true` -> new messages on the existing session use v1 path (not v2). Only new threads use v2. Verify with assertion on delegate type. |
+| 4.5 | Data migration path is documented | `docs/plans/` must contain a migration guide covering: (a) which v1 tables map to which v2 tables, (b) whether historical data is migrated or v2 starts fresh, (c) rollback procedure if migration fails. |
+
+**Blocking:** 4.1, 4.2, 4.3, 4.4 are hard blockers. 4.5 is required documentation but may ship as a separate document in the same milestone.
+
+### 5. Observability
+
+The engine must emit enough telemetry to debug production issues without attaching a debugger.
+
+| # | Criterion | Verification |
+|---|-----------|-------------|
+| 5.1 | Step execution duration is recorded | Each `Step` must have `started_at` and `completed_at` timestamps. Verify via unit test: execute a step, assert both fields are set and `completed_at > started_at`. |
+| 5.2 | Token usage is tracked per step and per thread | `Step::token_usage` must be populated from `LlmOutput`. Thread-level aggregation: `thread.steps.iter().map(|s| s.token_usage).sum()`. Verify: run 5 steps with known token counts from mock LLM, assert thread total matches. |
+| 5.3 | Policy decision counters | `PolicyEngine` must expose counts of `Allow`, `Deny`, and `RequireApproval` decisions. Verify: run 10 actions with mixed policies, assert counters match expected values. These must be queryable (not just logged). |
+| 5.4 | Active lease gauge | `LeaseManager` must expose current active lease count. Verify: grant 5 leases, revoke 2, expire 1, assert gauge reads 2. |
+| 5.5 | Event sourcing query performance | `Store::load_events(thread_id)` must return within 100ms for a thread with 1000 events. Benchmark test with both backends. |
+| 5.6 | Structured logging for execution loop | Each step must emit `tracing` spans with: `thread_id`, `step_index`, `execution_tier`, `duration_ms`, `token_count`. Verify by capturing tracing output in test and asserting field presence. |
+
+**Blocking:** 5.1, 5.2, 5.6 are hard blockers. 5.3, 5.4, 5.5 are soft blockers (must be filed as issues if deferred).
+
+### 6. Rollout Strategy
+
+No big-bang cutover. Gradual rollout with rollback capability.
+
+| # | Criterion | Verification |
+|---|-----------|-------------|
+| 6.1 | Feature flag `ENGINE_V2` controls engine selection | When `ENGINE_V2=true`: new threads use `EngineV2Delegate`. When `ENGINE_V2=false` (default): all threads use v1. Verify: start with flag off, create thread (v1), set flag on, create thread (v2), both work. |
+| 6.2 | Existing threads continue on their original engine | A thread started on v1 must remain on v1 even when `ENGINE_V2=true`. Thread metadata must record which engine version created it. Verify: create v1 thread, enable v2, send message to v1 thread, assert v1 delegate is used. |
+| 6.3 | Rollback path: disable flag, no data loss | Enable v2, create threads, disable v2. v2 threads become read-only (no new messages accepted) but their data persists. New threads use v1. No data corruption in either direction. |
+| 6.4 | Percentage-based rollout support | `ENGINE_V2_ROLLOUT_PERCENT=10` routes 10% of new threads to v2 (hash of thread_id mod 100). This enables canary deployment. Verify: create 100 threads with rollout at 10%, assert approximately 10 use v2. |
+| 6.5 | Canary validation period | Before full rollout, v2 must run on >= 10% of new threads for at least 1 week with no P0/P1 incidents. This is a process gate, not a code test. Document the canary checklist in the rollout runbook. |
+
+**Blocking:** 6.1, 6.2, 6.3 are hard blockers. 6.4 is a soft blocker. 6.5 is a process requirement.
+
+---
+
+## Non-Goals for Phase 6
+
+These are explicitly out of scope. Do not implement them as part of Phase 6 acceptance.
+
+- **Full reflection pipeline** (Phase 7) -- thread post-mortem analysis and lesson extraction
+- **WASM/Docker thread isolation** (Phase 8) -- running threads in sandboxed containers
+- **Performance optimization beyond parity** -- v2 should match v1, not beat it (improvements are welcome but not required)
+- **Mission system** -- `Mission` type is defined but not wired up
+- **Provenance tracking / taint analysis** -- structs exist but enforcement is Phase 7
+- **Two-phase commit for Financial effects** -- design is documented in Phase 6 spec, but implementation may defer to Phase 7 if no Financial-effect tools exist yet
+- **Dual model routing** -- `LlmBridgeAdapter` should support it structurally but it is not a Phase 6 acceptance criterion
+
+---
+
+## Verification Plan
+
+### Automated Tests (CI-blocking)
+
+```bash
+# 1. Engine unit tests (existing)
+cargo test -p ironclaw_engine
+
+# 2. Bridge adapter tests (new)
+cargo test -p ironclaw -- bridge
+
+# 3. Integration tests with both backends
+cargo test --features integration -- engine_v2
+cargo test -- engine_v2  # libSQL path
+
+# 4. E2E tests with v2 engine
+cd tests/e2e && ENGINE_V2=true pytest
+
+# 5. Behavioral equivalence diff tests
+cargo test -- behavioral_equivalence
+
+# 6. Performance benchmarks (CI-reported, not CI-blocking)
+cargo bench -p ironclaw --bench step_latency
+cargo bench -p ironclaw_engine --bench monty_startup
+```
+
+### Manual Review (PR-blocking)
+
+- [ ] Security audit checklist (criterion 3.6) signed off by reviewer
+- [ ] Migration documentation (criterion 4.5) exists and reviewed
+- [ ] Canary runbook (criterion 6.5) exists
+
+### Test Fixtures Required
+
+| Fixture | Purpose | Location |
+|---------|---------|----------|
+| `trace_basic_conversation.json` | Multi-turn chat with tool calls | `tests/fixtures/engine_v2/` |
+| `trace_approval_flow.json` | Tool requiring approval -> approve -> complete | `tests/fixtures/engine_v2/` |
+| `trace_error_handling.json` | Invalid tool, malformed params, timeout | `tests/fixtures/engine_v2/` |
+| `trace_compaction.json` | 50-turn conversation triggering compaction | `tests/fixtures/engine_v2/` |
+| `trace_codeact.json` | CodeAct/Monty execution with tool dispatch | `tests/fixtures/engine_v2/` |
+
+### Benchmark Harness Requirements
+
+The step latency benchmark must:
+1. Use the same mock LLM (fixed response, configurable latency) for both engines
+2. Run in the same binary to eliminate process-level variance
+3. Report P50/P95/P99 with confidence intervals
+4. Run at least 1000 iterations per engine
+5. Warm up with 100 iterations before measurement
+6. Be added to CI as a reporting job (not a gate) with regression alerts at +15%
+
+### Definition of Done
+
+Phase 6 is complete when:
+1. All hard-blocker criteria pass in CI
+2. All soft-blocker criteria either pass or have filed issues with mitigation plans
+3. Security review checklist is signed off
+4. Migration documentation exists
+5. Canary runbook exists
+6. PR is approved by at least one reviewer who has read this document
@@ -2,7 +2,7 @@
  "name": "feishu",
  "display_name": "Feishu / Lark Channel",
  "kind": "channel",
-  "version": "0.1.3",
+  "version": "0.1.1",
  "wit_version": "0.3.0",
  "description": "Talk to your agent through a Feishu or Lark bot",
  "keywords": [
@@ -19,8 +19,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "sha256": "a66ff0dafb67d2216d8161bb7e96e724a94acb0ab993b85d2782d30412f8fe94",
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/channel-feishu-0.1.3-wasm32-wasip2.tar.gz"
+      "sha256": "5fca74022264d1c8e78a0853766276f7ffa3cf0d8065b2f51ca10985acad4714",
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.19.0/channel-feishu-0.1.1-wasm32-wasip2.tar.gz"
    }
  },
  "auth_summary": {
@@ -18,8 +18,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/v0.20.0/channel-telegram-0.2.5-wasm32-wasip2.tar.gz",
-      "sha256": "1ef20a538f55b379e049356e4d6758006251846bc3365ceaa1c87eba8379a329"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.19.0/channel-telegram-0.2.4-wasm32-wasip2.tar.gz",
+      "sha256": "a7cb300ec1c946831cfceaa95c1dc8f30d0f42a3924f3cb5de8098821573f4b8"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "github",
  "display_name": "GitHub",
  "kind": "tool",
-  "version": "0.2.2",
+  "version": "0.2.1",
  "wit_version": "0.3.0",
  "description": "GitHub integration for issues, PRs, repos, and code search",
  "keywords": [
@@ -19,8 +19,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-github-0.2.2-wasm32-wasip2.tar.gz",
-      "sha256": "70b55af593193d8fa495c0f702ea23284d83a624124f8a5f7564916ec5032c3f"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.19.0/tool-github-0.2.1-wasm32-wasip2.tar.gz",
+      "sha256": "92c530b3ad172e2372d819744b5233f1d8f65768e26eb5a6c213eba3ce1de758"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "gmail",
  "display_name": "Gmail",
  "kind": "tool",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "wit_version": "0.3.0",
  "description": "Read, send, and manage Gmail messages and threads",
  "keywords": [
@@ -18,8 +18,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-gmail-0.2.1-wasm32-wasip2.tar.gz",
-      "sha256": "79025b40ee70ce1120acc4320bae50da095d7afb0ef67bd56d99b064b72ea779"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.18.0/gmail-0.2.0-wasm32-wasip2.tar.gz",
+      "sha256": "ee9574e02e92bc1d481f1310eb88afd99ee52bf6971074ab33bd76bf99b34b1d"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "google-calendar",
  "display_name": "Google Calendar",
  "kind": "tool",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "wit_version": "0.3.0",
  "description": "Create, read, update, and delete Google Calendar events",
  "keywords": [
@@ -18,8 +18,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-google-calendar-0.2.1-wasm32-wasip2.tar.gz",
-      "sha256": "86bcc075010b08f5ab2f98f504cec1c6c9e0ca144857d185cbecf72a11f504bf"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.18.0/google-calendar-0.2.0-wasm32-wasip2.tar.gz",
+      "sha256": "2fa47150ea222e787c122182ad6f4dfa2ffaf5fe490d05e8de887a76445f8d2d"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "google-docs",
  "display_name": "Google Docs",
  "kind": "tool",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "wit_version": "0.3.0",
  "description": "Create and edit Google Docs documents",
  "keywords": [
@@ -18,8 +18,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-google-docs-0.2.1-wasm32-wasip2.tar.gz",
-      "sha256": "39d476029764949498a53a6a223f9952b5f4df151be7b8b19bf3fe4d401a57cd"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.18.0/google-docs-0.2.0-wasm32-wasip2.tar.gz",
+      "sha256": "40e134a1c1564f832ca861c3396895d4e33ec67b99313fc1f97baf8d971423a9"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "google-drive",
  "display_name": "Google Drive",
  "kind": "tool",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "wit_version": "0.3.0",
  "description": "Upload, download, search, and manage Google Drive files and folders",
  "keywords": [
@@ -18,8 +18,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-google-drive-0.2.1-wasm32-wasip2.tar.gz",
-      "sha256": "6e9a700fab93865c852af718666af64c5b534ad6a419fb4b736e07740188f494"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.18.0/google-drive-0.2.0-wasm32-wasip2.tar.gz",
+      "sha256": "002a341a1d58125563a7c69561b26fbc2629b04ea723cade744102bdc0fbb71f"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "google-sheets",
  "display_name": "Google Sheets",
  "kind": "tool",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "wit_version": "0.3.0",
  "description": "Read and write Google Sheets spreadsheet data",
  "keywords": [
@@ -18,8 +18,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-google-sheets-0.2.1-wasm32-wasip2.tar.gz",
-      "sha256": "1f8c381799a916be83263cac9d497d52946e21b1b588592a3a42ca94a73b7051"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.18.0/google-sheets-0.2.0-wasm32-wasip2.tar.gz",
+      "sha256": "8aa2c9d52f033edea3a6c2311b0ec694ccb6d0a54ef07e94d72bf8be1ce8009a"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "google-slides",
  "display_name": "Google Slides",
  "kind": "tool",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "wit_version": "0.3.0",
  "description": "Create and edit Google Slides presentations",
  "keywords": [
@@ -17,8 +17,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-google-slides-0.2.1-wasm32-wasip2.tar.gz",
-      "sha256": "e2528be5da02f1b8cfc8ee9b0cdd849516c53d412e2f75c6175b3bded7f512cb"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.18.0/google-slides-0.2.0-wasm32-wasip2.tar.gz",
+      "sha256": "e931a97d4fd0b0b938e464dc7c7f2be6ea6b4d1508f5ea3cd931d44db23f05f5"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "llm-context",
  "display_name": "LLM Context",
  "kind": "tool",
-  "version": "0.1.1",
+  "version": "0.1.0",
  "wit_version": "0.3.0",
  "description": "Fetch pre-extracted web content from Brave Search for grounding LLM answers (RAG, fact-checking)",
  "keywords": [
@@ -21,8 +21,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-llm-context-0.1.1-wasm32-wasip2.tar.gz",
-      "sha256": "9b19e2fd05dbbbe3c8bd55309a91db09124e8415eb0f767828b6e10b55771e63"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.19.0/tool-llm-context-0.1.0-wasm32-wasip2.tar.gz",
+      "sha256": "d9ced2b1226b879135891e0ee40e072c7c95412e1b2462925a23853e1f92497e"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "slack-tool",
  "display_name": "Slack Tool",
  "kind": "tool",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "wit_version": "0.3.0",
  "description": "Your agent uses Slack to post and read messages in your workspace",
  "keywords": [
@@ -17,8 +17,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-slack-0.2.1-wasm32-wasip2.tar.gz",
-      "sha256": "927519e5b7734beeb022d3b8bbd152e0e6b9f67c9452a8ad47809d3c4221a137"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.19.0/tool-slack-0.2.0-wasm32-wasip2.tar.gz",
+      "sha256": "ccfb0415d7a04f9497726c712d15216de36e86f498b849101283c017f5ab4efb"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "telegram-mtproto",
  "display_name": "Telegram Tool",
  "kind": "tool",
-  "version": "0.2.1",
+  "version": "0.2.0",
  "wit_version": "0.3.0",
  "description": "Your agent uses your Telegram account to read and send messages",
  "keywords": [
@@ -18,8 +18,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-telegram-0.2.1-wasm32-wasip2.tar.gz",
-      "sha256": "1e57d0755fc9c7b3ec013d079f30168898b484a6919f9edd105f0cd80131c1cd"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.19.0/tool-telegram-0.2.0-wasm32-wasip2.tar.gz",
+      "sha256": "c17065ca41fae5f2a7c43b36144686718cd310a2f22442313bb1aa82bbad0ae4"
    }
  },
  "auth_summary": {
@@ -2,7 +2,7 @@
  "name": "web-search",
  "display_name": "Web Search",
  "kind": "tool",
-  "version": "0.2.2",
+  "version": "0.2.1",
  "wit_version": "0.3.0",
  "description": "Search the web using Brave Search API",
  "keywords": [
@@ -18,8 +18,8 @@
  },
  "artifacts": {
    "wasm32-wasip2": {
-      "url": "https://github.com/nearai/ironclaw/releases/download/ironclaw-v0.22.0/tool-web-search-0.2.2-wasm32-wasip2.tar.gz",
-      "sha256": "47382b50c1ea7525b20d59dc02fab04e336d018665826c2f24710bdf460779ae"
+      "url": "https://github.com/nearai/ironclaw/releases/download/v0.19.0/tool-web-search-0.2.1-wasm32-wasip2.tar.gz",
+      "sha256": "bad275ca4ec314adea5241d6b92c44ccf9cebcbca8e30ba2493cc0bcb4b57218"
    }
  },
  "auth_summary": {
@@ -1,2 +1,7 @@
 [workspace]
 git_release_enable = false
+
+[[package]]
+name = "ironclaw_safety"
+publish = false
+release = false
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+    cat <<'EOF'
+Usage: scripts/monitor-prs.sh [--repo owner/name] [--author login]
+
+Shows open PRs for the author with:
+- review decision
+- latest review summary
+- failing or pending checks
+
+Defaults:
+- repo: current gitHub repo from `gh repo view`
+- author: currently authenticated GitHub user from `gh api user`
+EOF
+}
+
+repo=""
+author=""
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --repo)
+            repo="${2:-}"
+            shift 2
+            ;;
+        --author)
+            author="${2:-}"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown argument: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+done
+
+if ! command -v gh >/dev/null 2>&1; then
+    echo "gh CLI is required" >&2
+    exit 1
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+    echo "jq is required" >&2
+    exit 1
+fi
+
+if [ -z "$repo" ]; then
+    repo="$(gh repo view --json nameWithOwner -q .nameWithOwner)"
+fi
+
+if [ -z "$author" ]; then
+    author="$(gh api user -q .login)"
+fi
+
+json_fields="number,title,url,headRefName,reviewDecision,latestReviews,statusCheckRollup"
+prs="$(gh pr list --repo "$repo" --author "$author" --state open --limit 100 --json "$json_fields")"
+
+count="$(printf '%s' "$prs" | jq 'length')"
+echo "Open PRs for $author in $repo: $count"
+echo
+
+if [ "$count" -eq 0 ]; then
+    exit 0
+fi
+
+printf '%s' "$prs" | jq -r '
+  def check_name:
+    .name // .context // .workflowName // "unknown-check";
+
+  def failing_checks:
+    [.statusCheckRollup[]?
+      | select(.status == "COMPLETED" and (.conclusion // .state // "") != "SUCCESS")
+      | {
+          name: check_name,
+          workflow: (.workflowName // ""),
+          url: (.detailsUrl // "")
+        }];
+
+  def pending_checks:
+    [.statusCheckRollup[]?
+      | select(.status != "COMPLETED")
+      | {
+          name: check_name,
+          workflow: (.workflowName // ""),
+          url: (.detailsUrl // "")
+        }];
+
+  .[]
+  | . as $pr
+  | failing_checks as $failing
+  | pending_checks as $pending
+  | [
+      ("#" + (.number | tostring) + " " + .title),
+      ("  Branch: " + .headRefName),
+      ("  URL: " + .url),
+      ("  Review: " + (.reviewDecision // "UNKNOWN")),
+      (
+        if (.latestReviews | length) > 0 then
+          "  Latest review: "
+          + .latestReviews[0].state
+          + " by "
+          + .latestReviews[0].author.login
+          + " at "
+          + .latestReviews[0].submittedAt
+        else
+          "  Latest review: none"
+        end
+      ),
+      ("  Checks: " + ($failing | length | tostring) + " failing, "
+        + ($pending | length | tostring) + " pending"),
+      (
+        if ($failing | length) > 0 then
+          ($failing[] | "    FAIL: " + .name
+            + (if .workflow != "" then " [" + .workflow + "]" else "" end)
+            + (if .url != "" then " -> " + .url else "" end))
+        else
+          "    FAIL: none"
+        end
+      ),
+      (
+        if ($pending | length) > 0 then
+          ($pending[] | "    PENDING: " + .name
+            + (if .workflow != "" then " [" + .workflow + "]" else "" end)
+            + (if .url != "" then " -> " + .url else "" end))
+        else
+          "    PENDING: none"
+        end
+      )
+    ]
+  | .[]
+  , ""
+'
@@ -13,10 +13,9 @@ use futures::StreamExt;
 use uuid::Uuid;

 use crate::agent::context_monitor::ContextMonitor;
-use crate::agent::heartbeat::{spawn_heartbeat, spawn_multi_user_heartbeat};
+use crate::agent::heartbeat::spawn_heartbeat;
 use crate::agent::routine_engine::{RoutineEngine, spawn_cron_ticker};
 use crate::agent::self_repair::{DefaultSelfRepair, RepairResult, SelfRepair};
-use crate::agent::session::ThreadState;
 use crate::agent::session_manager::SessionManager;
 use crate::agent::submission::{Submission, SubmissionParser, SubmissionResult};
 use crate::agent::{HeartbeatConfig as AgentHeartbeatConfig, Router, Scheduler, SchedulerDeps};
@@ -85,15 +84,6 @@ fn resolve_owner_scope_notification_user(
    trimmed_option(explicit_user).or_else(|| trimmed_option(owner_fallback))
 }

-fn is_single_message_repl(message: &IncomingMessage) -> bool {
-    message.channel == "repl"
-        && message
-            .metadata
-            .get("single_message_mode")
-            .and_then(|value| value.as_bool())
-            .unwrap_or(false)
-}
-
 async fn resolve_channel_notification_user(
    extension_manager: Option<&Arc<ExtensionManager>>,
    channel: Option<&str>,
@@ -167,8 +157,8 @@ pub struct AgentDeps {
    pub hooks: Arc<HookRegistry>,
    /// Cost enforcement guardrails (daily budget, hourly rate limits).
    pub cost_guard: Arc<crate::agent::cost_guard::CostGuard>,
-    /// SSE manager for live job event streaming to the web gateway.
-    pub sse_tx: Option<Arc<crate::channels::web::sse::SseManager>>,
+    /// SSE broadcast sender for live job event streaming to the web gateway.
+    pub sse_tx: Option<tokio::sync::broadcast::Sender<crate::channels::web::types::SseEvent>>,
    /// HTTP interceptor for trace recording/replay.
    pub http_interceptor: Option<Arc<dyn crate::llm::recording::HttpInterceptor>>,
    /// Audio transcription middleware for voice messages.
@@ -179,11 +169,6 @@ pub struct AgentDeps {
    pub sandbox_readiness: crate::agent::routine_engine::SandboxReadiness,
    /// Software builder for self-repair tool rebuilding.
    pub builder: Option<Arc<dyn crate::tools::SoftwareBuilder>>,
-    /// Resolved LLM backend identifier (e.g., "nearai", "openai", "groq").
-    /// Used by `/model` persistence to determine which env var to update.
-    pub llm_backend: String,
-    /// Per-tenant rate limiting registry (lazily creates rate state per user).
-    pub tenant_rates: Arc<crate::tenant::TenantRateRegistry>,
 }

 /// The main agent that coordinates all components.
@@ -246,15 +231,12 @@ impl Agent {
            SchedulerDeps {
                tools: deps.tools.clone(),
                extension_manager: deps.extension_manager.clone(),
-                store: deps
-                    .store
-                    .as_ref()
-                    .map(|db| crate::tenant::AdminScope::new(Arc::clone(db))),
+                store: deps.store.clone(),
                hooks: deps.hooks.clone(),
            },
        );
-        if let Some(ref sse) = deps.sse_tx {
-            scheduler.set_sse_sender(Arc::clone(sse));
+        if let Some(ref tx) = deps.sse_tx {
+            scheduler.set_sse_sender(tx.clone());
        }
        if let Some(ref interceptor) = deps.http_interceptor {
            scheduler.set_http_interceptor(Arc::clone(interceptor));
@@ -330,50 +312,6 @@ impl Agent {
        &self.deps.cost_guard
    }

-    /// Build a tenant-scoped execution context for the given user.
-    ///
-    /// This is the standard entry point for per-user operations. The returned
-    /// [`TenantCtx`] provides a [`TenantScope`] that auto-binds `user_id` on
-    /// every database operation and a per-user rate limiter.
-    pub(super) async fn tenant_ctx(&self, user_id: &str) -> crate::tenant::TenantCtx {
-        let rate = self.deps.tenant_rates.get_or_create(user_id).await;
-
-        let store = self
-            .deps
-            .store
-            .as_ref()
-            .map(|db| crate::tenant::TenantScope::new(user_id, Arc::clone(db)));
-
-        // Reuse the owner workspace if user matches, otherwise create per-user.
-        let workspace = match &self.deps.workspace {
-            Some(ws) if ws.user_id() == user_id => Some(Arc::clone(ws)),
-            _ => self
-                .deps
-                .store
-                .as_ref()
-                .map(|db| Arc::new(Workspace::new_with_db(user_id, Arc::clone(db)))),
-        };
-
-        crate::tenant::TenantCtx::new(
-            user_id,
-            store,
-            workspace,
-            Arc::clone(&self.deps.cost_guard),
-            rate,
-        )
-    }
-
-    /// Get an admin-scoped database accessor for cross-tenant operations.
-    ///
-    /// Only for system-level components (heartbeat, routine engine, self-repair,
-    /// scheduler). Handler code should use [`tenant_ctx()`](Self::tenant_ctx) instead.
-    pub(super) fn admin_store(&self) -> Option<crate::tenant::AdminScope> {
-        self.deps
-            .store
-            .as_ref()
-            .map(|db| crate::tenant::AdminScope::new(Arc::clone(db)))
-    }
-
    pub(super) fn skill_registry(&self) -> Option<&Arc<std::sync::RwLock<SkillRegistry>>> {
        self.deps.skill_registry.as_ref()
    }
@@ -459,8 +397,8 @@ impl Agent {
            self.config.stuck_threshold,
            self.config.max_repair_attempts,
        );
-        if let Some(admin) = self.admin_store() {
-            self_repair = self_repair.with_store(admin);
+        if let Some(ref store) = self.deps.store {
+            self_repair = self_repair.with_store(Arc::clone(store));
        }
        if let Some(ref builder) = self.deps.builder {
            self_repair = self_repair.with_builder(Arc::clone(builder), Arc::clone(self.tools()));
@@ -567,7 +505,6 @@ impl Agent {
                        .with_interval(std::time::Duration::from_secs(hb_config.interval_secs));
                    config.quiet_hours_start = hb_config.quiet_hours_start;
                    config.quiet_hours_end = hb_config.quiet_hours_end;
-                    config.multi_tenant = hb_config.multi_tenant;
                    config.timezone = hb_config
                        .timezone
                        .clone()
@@ -597,52 +534,30 @@ impl Agent {
                    .await;
                    let notify_user = heartbeat_notify_user;
                    let channels = self.channels.clone();
-                    let is_multi_tenant = hb_config.multi_tenant;
                    tokio::spawn(async move {
                        while let Some(response) = notify_rx.recv().await {
-                            // In multi-tenant mode, extract the owning user_id from
-                            // the response metadata so notifications reach the
-                            // correct user rather than the agent's owner.
-                            // This intentionally overrides the configured notify_target
-                            // because each user's heartbeat should notify that user.
-                            let effective_user = if is_multi_tenant {
-                                response
-                                    .metadata
-                                    .get("owner_id")
-                                    .and_then(|v| v.as_str())
-                                    .map(String::from)
-                            } else {
-                                None
-                            };
-
                            // Try the configured channel first, fall back to
                            // broadcasting on all channels.
-                            let targeted_ok = if let Some(ref channel) = notify_channel {
-                                let target = effective_user.as_deref().or(notify_target.as_deref());
-                                if let Some(user) = target {
-                                    channels
-                                        .broadcast(channel, user, response.clone())
-                                        .await
-                                        .is_ok()
-                                } else {
-                                    false
-                                }
+                            let targeted_ok = if let Some(ref channel) = notify_channel
+                                && let Some(ref user) = notify_target
+                            {
+                                channels
+                                    .broadcast(channel, user, response.clone())
+                                    .await
+                                    .is_ok()
                            } else {
                                false
                            };

-                            if !targeted_ok {
-                                let fallback = effective_user.as_deref().or(notify_user.as_deref());
-                                if let Some(user) = fallback {
-                                    let results = channels.broadcast_all(user, response).await;
-                                    for (ch, result) in results {
-                                        if let Err(e) = result {
-                                            tracing::warn!(
-                                                "Failed to broadcast heartbeat to {}: {}",
-                                                ch,
-                                                e
-                                            );
-                                        }
+                            if !targeted_ok && let Some(ref user) = notify_user {
+                                let results = channels.broadcast_all(user, response).await;
+                                for (ch, result) in results {
+                                    if let Err(e) = result {
+                                        tracing::warn!(
+                                            "Failed to broadcast heartbeat to {}: {}",
+                                            ch,
+                                            e
+                                        );
                                    }
                                }
                            }
@@ -655,29 +570,14 @@ impl Agent {
                        .map(|h| h.to_workspace_config())
                        .unwrap_or_default();

-                    if config.multi_tenant {
-                        if let Some(admin) = self.admin_store() {
-                            Some(spawn_multi_user_heartbeat(
-                                config,
-                                hygiene,
-                                self.cheap_llm().clone(),
-                                Some(notify_tx),
-                                admin,
-                            ))
-                        } else {
-                            tracing::warn!("Multi-tenant heartbeat requires a database store");
-                            None
-                        }
-                    } else {
-                        Some(spawn_heartbeat(
-                            config,
-                            hygiene,
-                            workspace.clone(),
-                            self.cheap_llm().clone(),
-                            Some(notify_tx),
-                            self.admin_store(),
-                        ))
-                    }
+                    Some(spawn_heartbeat(
+                        config,
+                        hygiene,
+                        workspace.clone(),
+                        self.cheap_llm().clone(),
+                        Some(notify_tx),
+                        self.store().map(Arc::clone),
+                    ))
                } else {
                    tracing::warn!("Heartbeat enabled but no workspace available");
                    None
@@ -699,7 +599,7 @@ impl Agent {

                    let engine = Arc::new(RoutineEngine::new(
                        rt_config.clone(),
-                        crate::tenant::AdminScope::new(Arc::clone(store)),
+                        Arc::clone(store),
                        self.llm().clone(),
                        Arc::clone(workspace),
                        notify_tx,
@@ -831,7 +731,7 @@ impl Agent {
            {
                use crate::agent::session::Thread;
                let mut sess = session.lock().await;
-                let thread = Thread::with_id(id, sess.id);
+                let thread = Thread::with_id(id, sess.id, None);
                sess.active_thread = Some(id);
                sess.threads.entry(id).or_insert(thread);
            }
@@ -1152,11 +1052,10 @@ impl Agent {
            } else {
                drop(sess);
                self.session_manager
-                    .resolve_thread_with_parsed_uuid(
+                    .resolve_thread(
                        &message.user_id,
                        &message.channel,
                        message.conversation_scope(),
-                        approval_thread_uuid,
                    )
                    .await
            }
@@ -1237,14 +1136,9 @@ impl Agent {
            && let Submission::UserInput { ref content } = submission
            && let Some(engine) = self.routine_engine().await
        {
-            let single_message_repl = is_single_message_repl(message);
-            // Use post-hook content so that BeforeInbound hooks that rewrite
-            // input are respected by event trigger matching.
-            let fired = if single_message_repl {
-                engine.check_event_triggers_and_wait(message, content).await
-            } else {
-                engine.check_event_triggers(message, content).await
-            };
+            let fired = engine
+                .check_event_triggers(&message.user_id, &message.channel, content)
+                .await;
            if fired > 0 {
                tracing::debug!(
                    channel = %message.channel,
@@ -1252,30 +1146,15 @@ impl Agent {
                    fired,
                    "Consumed inbound user message with matching event-triggered routine(s)"
                );
-                return if single_message_repl {
-                    Ok(None)
-                } else {
-                    Ok(Some(String::new()))
-                };
+                return Ok(Some(String::new()));
            }
        }

-        // Build per-tenant execution context once; threaded through all handlers.
-        let tenant = self.tenant_ctx(&message.user_id).await;
-
-        let session_for_empty_exit = Arc::clone(&session);
-
        // Process based on submission type
        let result = match submission {
            Submission::UserInput { content } => {
                let mut result = self
-                    .process_user_input(
-                        message,
-                        tenant.clone(),
-                        session.clone(),
-                        thread_id,
-                        &content,
-                    )
+                    .process_user_input(message, session.clone(), thread_id, &content)
                    .await;

                // Drain any messages queued during processing.
@@ -1342,13 +1221,7 @@ impl Agent {
                    let mut queued_msg = message.clone();
                    queued_msg.attachments.clear();
                    result = self
-                        .process_user_input(
-                            &queued_msg,
-                            tenant.clone(),
-                            session.clone(),
-                            thread_id,
-                            &next_content,
-                        )
+                        .process_user_input(&queued_msg, session.clone(), thread_id, &next_content)
                        .await;

                    // If processing failed, re-queue the drained content so it
@@ -1373,30 +1246,8 @@ impl Agent {
                    command,
                    message.channel
                );
-                // /reasoning is special-cased here (not in handle_system_command)
-                // because it needs the session + thread_id to read turn reasoning
-                // data, which handle_system_command's signature doesn't provide.
-                if command == "reasoning" {
-                    let result = self
-                        .handle_reasoning_command(&args, &session, thread_id)
-                        .await;
-                    return match result {
-                        SubmissionResult::Response { content } => Ok(Some(content)),
-                        SubmissionResult::Ok { message } => Ok(message),
-                        SubmissionResult::Error { message } => {
-                            Ok(Some(format!("Error: {}", message)))
-                        }
-                        _ => {
-                            if is_single_message_repl(message) {
-                                Ok(None)
-                            } else {
-                                Ok(Some(String::new()))
-                            }
-                        }
-                    };
-                }
                // Authorization checks (including restart channel check) are enforced in handle_system_command
-                self.handle_system_command(&command, &args, &message.channel, &tenant)
+                self.handle_system_command(&command, &args, &message.channel)
                    .await
            }
            Submission::Undo => self.process_undo(session, thread_id).await,
@@ -1409,9 +1260,12 @@ impl Agent {
            Submission::Summarize => self.process_summarize(session, thread_id).await,
            Submission::Suggest => self.process_suggest(session, thread_id).await,
            Submission::JobStatus { job_id } => {
-                self.process_job_status(&tenant, job_id.as_deref()).await
+                self.process_job_status(&message.user_id, job_id.as_deref())
+                    .await
+            }
+            Submission::JobCancel { job_id } => {
+                self.process_job_cancel(&message.user_id, &job_id).await
            }
-            Submission::JobCancel { job_id } => self.process_job_cancel(&tenant, &job_id).await,
            Submission::Quit => return Ok(None),
            Submission::SwitchThread { thread_id: target } => {
                self.process_switch_thread(message, target).await
@@ -1451,26 +1305,7 @@ impl Agent {
                    Ok(Some(content))
                }
            }
-            SubmissionResult::Ok {
-                message: output_message,
-            } => {
-                let should_exit =
-                    if output_message.as_deref() == Some("") && is_single_message_repl(message) {
-                        let sess = session_for_empty_exit.lock().await;
-                        sess.threads
-                            .get(&thread_id)
-                            .map(|thread| thread.state != ThreadState::AwaitingApproval)
-                            .unwrap_or(true)
-                    } else {
-                        false
-                    };
-
-                if should_exit {
-                    Ok(None)
-                } else {
-                    Ok(output_message)
-                }
-            }
+            SubmissionResult::Ok { message } => Ok(message),
            SubmissionResult::Error { message } => Ok(Some(format!("Error: {}", message))),
            SubmissionResult::Interrupted => Ok(Some("Interrupted.".into())),
            SubmissionResult::NeedApproval { .. } => {
@@ -1486,7 +1321,7 @@ impl Agent {
 #[cfg(test)]
 mod tests {
    use super::{
-        chat_tool_execution_metadata, is_single_message_repl, resolve_routine_notification_user,
+        chat_tool_execution_metadata, resolve_routine_notification_user,
        should_fallback_routine_notification, truncate_for_preview,
    };
    use crate::channels::IncomingMessage;
@@ -1648,17 +1483,4 @@ mod tests {

        assert!(should_fallback_routine_notification(&error)); // safety: test-only assertion
    }
-
-    #[test]
-    fn single_message_repl_detection_requires_repl_channel_and_metadata_flag() {
-        let repl = IncomingMessage::new("repl", "owner-scope", "hello")
-            .with_metadata(serde_json::json!({ "single_message_mode": true }));
-        let gateway = IncomingMessage::new("gateway", "owner-scope", "hello")
-            .with_metadata(serde_json::json!({ "single_message_mode": true }));
-        let plain_repl = IncomingMessage::new("repl", "owner-scope", "hello");
-
-        assert!(is_single_message_repl(&repl)); // safety: test-only assertion
-        assert!(!is_single_message_repl(&gateway)); // safety: test-only assertion
-        assert!(!is_single_message_repl(&plain_repl)); // safety: test-only assertion
-    }
 }
@@ -10,7 +10,7 @@ use std::borrow::Cow;

 use crate::agent::session::PendingApproval;
 use crate::error::Error;
-use crate::llm::{ChatMessage, FinishReason, Reasoning, ReasoningContext, RespondResult};
+use crate::llm::{ChatMessage, Reasoning, ReasoningContext, RespondResult};

 /// Signal from the delegate indicating how the loop should proceed.
 pub enum LoopSignal {
@@ -134,9 +134,6 @@ pub async fn run_agentic_loop(
    config: &AgenticLoopConfig,
 ) -> Result<LoopOutcome, Error> {
    let mut consecutive_tool_intent_nudges: u32 = 0;
-    // Accumulates across all iterations (not reset by text responses) so
-    // non-consecutive truncations still escalate to force_text.
-    let mut truncation_count: u32 = 0;

    for iteration in 1..=config.max_iterations {
        // Check for external signals (stop, cancellation, user messages)
@@ -218,35 +215,7 @@ pub async fn run_agentic_loop(
                tool_calls,
                content,
            } => {
-                // If the response was truncated, tool call parameters are likely
-                // incomplete. Discard them and tell the LLM to try a different
-                // approach rather than executing malformed tool calls.
-                if output.finish_reason == FinishReason::Length {
-                    truncation_count += 1;
-                    let names: Vec<&str> = tool_calls.iter().map(|tc| tc.name.as_str()).collect();
-                    tracing::warn!(
-                        iteration,
-                        tools = ?names,
-                        truncation_count,
-                        "Discarding truncated tool calls (finish_reason=Length)"
-                    );
-                    if let Some(ref text) = content {
-                        reason_ctx.messages.push(ChatMessage::assistant(text));
-                    }
-                    reason_ctx
-                        .messages
-                        .push(ChatMessage::user(crate::llm::TRUNCATED_TOOL_CALL_NOTICE));
-                    // After repeated truncations, force text-only mode so the LLM
-                    // stops attempting tool calls it can't fit in the output budget.
-                    if truncation_count >= 3 {
-                        reason_ctx.force_text = true;
-                    }
-                    delegate.after_iteration(iteration).await;
-                    continue;
-                }
-
                consecutive_tool_intent_nudges = 0;
-                truncation_count = 0;

                if let Some(outcome) = delegate
                    .execute_tool_calls(tool_calls, content, reason_ctx)
@@ -302,7 +271,6 @@ mod tests {
        RespondOutput {
            result: RespondResult::Text(text.to_string()),
            usage: zero_usage(),
-            finish_reason: FinishReason::Stop,
        }
    }

@@ -313,7 +281,6 @@ mod tests {
                content: None,
            },
            usage: zero_usage(),
-            finish_reason: FinishReason::ToolUse,
        }
    }

@@ -447,7 +414,6 @@ mod tests {
            id: "call_1".to_string(),
            name: "echo".to_string(),
            arguments: serde_json::json!({}),
-            reasoning: None,
        };
        let delegate = MockDelegate::new(vec![
            tool_calls_output(vec![tool_call]),
@@ -655,95 +621,4 @@ mod tests {
        let result = truncate_for_preview("café", 4);
        assert_eq!(result, "caf...");
    }
-
-    #[tokio::test]
-    async fn test_truncated_tool_calls_discarded_on_length() {
-        let truncated_tool_call = ToolCall {
-            id: "call_1".to_string(),
-            name: "memory_write".to_string(),
-            arguments: serde_json::json!({}), // empty — truncated
-            reasoning: None,
-        };
-        let truncated_output = RespondOutput {
-            result: RespondResult::ToolCalls {
-                tool_calls: vec![truncated_tool_call],
-                content: Some("I'll write the report.".to_string()),
-            },
-            usage: zero_usage(),
-            finish_reason: FinishReason::Length, // response was truncated
-        };
-        let delegate = MockDelegate::new(vec![truncated_output, text_output("Summarized it.")]);
-        let reasoning = stub_reasoning();
-        let mut ctx = ReasoningContext::new();
-        let config = AgenticLoopConfig {
-            max_iterations: 5,
-            ..Default::default()
-        };
-
-        let outcome = run_agentic_loop(&delegate, &reasoning, &mut ctx, &config)
-            .await
-            .unwrap();
-
-        // Tool calls should NOT have been executed
-        assert_eq!(delegate.tool_exec_count.load(Ordering::SeqCst), 0);
-        // The loop should have continued and returned the text response
-        assert!(matches!(outcome, LoopOutcome::Response(ref t) if t == "Summarized it."));
-        // A truncation notice should have been injected into context
-        assert!(
-            ctx.messages
-                .iter()
-                .any(|m| m.role == crate::llm::Role::User && m.content.contains("truncated")),
-            "Should inject truncation notice into context"
-        );
-        // The partial assistant content should have been preserved
-        assert!(
-            ctx.messages
-                .iter()
-                .any(|m| m.role == crate::llm::Role::Assistant
-                    && m.content.contains("write the report")),
-            "Should preserve partial assistant content"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_repeated_truncations_force_text_mode() {
-        let make_truncated = || RespondOutput {
-            result: RespondResult::ToolCalls {
-                tool_calls: vec![ToolCall {
-                    id: "call_1".to_string(),
-                    name: "memory_write".to_string(),
-                    arguments: serde_json::json!({}),
-                    reasoning: None,
-                }],
-                content: None,
-            },
-            usage: zero_usage(),
-            finish_reason: FinishReason::Length,
-        };
-        // Three truncated responses, then a text response
-        let delegate = MockDelegate::new(vec![
-            make_truncated(),
-            make_truncated(),
-            make_truncated(),
-            text_output("Gave up on tool calls."),
-        ]);
-        let reasoning = stub_reasoning();
-        let mut ctx = ReasoningContext::new();
-        let config = AgenticLoopConfig {
-            max_iterations: 5,
-            ..Default::default()
-        };
-
-        let outcome = run_agentic_loop(&delegate, &reasoning, &mut ctx, &config)
-            .await
-            .unwrap();
-
-        assert!(matches!(outcome, LoopOutcome::Response(_)));
-        assert_eq!(delegate.tool_exec_count.load(Ordering::SeqCst), 0);
-        // After 3 truncations, force_text should be set
-        assert!(
-            ctx.force_text,
-            "Should escalate to force_text after repeated truncations"
-        );
-    }
 }
@@ -33,7 +33,6 @@ impl Agent {
        &self,
        intent: MessageIntent,
        message: &IncomingMessage,
-        tenant: &crate::tenant::TenantCtx,
    ) -> Result<SubmissionResult, Error> {
        // Send thinking status for non-trivial operations
        if let MessageIntent::CreateJob { .. } = &intent {
@@ -53,18 +52,24 @@ impl Agent {
                description,
                category,
            } => {
-                self.handle_create_job(tenant, title, description, category)
+                self.handle_create_job(&message.user_id, title, description, category)
                    .await?
            }
            MessageIntent::CheckJobStatus { job_id } => {
-                self.handle_check_status(tenant, job_id).await?
+                self.handle_check_status(&message.user_id, job_id).await?
+            }
+            MessageIntent::CancelJob { job_id } => {
+                self.handle_cancel_job(&message.user_id, &job_id).await?
+            }
+            MessageIntent::ListJobs { filter } => {
+                self.handle_list_jobs(&message.user_id, filter).await?
+            }
+            MessageIntent::HelpJob { job_id } => {
+                self.handle_help_job(&message.user_id, &job_id).await?
            }
-            MessageIntent::CancelJob { job_id } => self.handle_cancel_job(tenant, &job_id).await?,
-            MessageIntent::ListJobs { filter } => self.handle_list_jobs(tenant, filter).await?,
-            MessageIntent::HelpJob { job_id } => self.handle_help_job(tenant, &job_id).await?,
            MessageIntent::Command { command, args } => {
                match self
-                    .handle_command(&command, &args, &message.channel, tenant)
+                    .handle_command(&command, &args, &message.channel)
                    .await?
                {
                    Some(s) => s,
@@ -78,14 +83,14 @@ impl Agent {

    async fn handle_create_job(
        &self,
-        tenant: &crate::tenant::TenantCtx,
+        user_id: &str,
        title: String,
        description: String,
        category: Option<String>,
    ) -> Result<String, Error> {
        let job_id = self
            .scheduler
-            .dispatch_job(tenant.user_id(), &title, &description, None)
+            .dispatch_job(user_id, &title, &description, None)
            .await?;

        // Set the dedicated category field (not stored in metadata)
@@ -108,7 +113,7 @@ impl Agent {

    async fn handle_check_status(
        &self,
-        tenant: &crate::tenant::TenantCtx,
+        user_id: &str,
        job_id: Option<String>,
    ) -> Result<String, Error> {
        match job_id {
@@ -117,8 +122,7 @@ impl Agent {
                    .map_err(|_| crate::error::JobError::NotFound { id: Uuid::nil() })?;

                // Try DB first for persistent state, fall back to ContextManager.
-                // TenantScope.get_job() auto-filters by ownership — no manual check needed.
-                if let Some(store) = tenant.store()
+                if let Some(store) = self.store()
                    && let Ok(Some(ctx)) = store.get_job(uuid).await
                {
                    return Ok(format!(
@@ -134,7 +138,7 @@ impl Agent {
                }

                let ctx = self.context_manager.get_context(uuid).await?;
-                if ctx.user_id != tenant.user_id() {
+                if ctx.user_id != user_id {
                    return Err(crate::error::JobError::NotFound { id: uuid }.into());
                }

@@ -151,8 +155,7 @@ impl Agent {
            }
            None => {
                // Show summary from DB for consistency with Jobs tab.
-                // TenantScope methods auto-scope to user — no user_id parameter needed.
-                if let Some(store) = tenant.store() {
+                if let Some(store) = self.store() {
                    let mut total = 0;
                    let mut in_progress = 0;
                    let mut completed = 0;
@@ -180,7 +183,7 @@ impl Agent {
                }

                // Fallback to ContextManager if no DB.
-                let summary = self.context_manager.summary_for(tenant.user_id()).await;
+                let summary = self.context_manager.summary_for(user_id).await;
                Ok(format!(
                    "Jobs summary: Total: {} In Progress: {} Completed: {} Failed: {} Stuck: {}",
                    summary.total,
@@ -193,24 +196,19 @@ impl Agent {
        }
    }

-    async fn handle_cancel_job(
-        &self,
-        tenant: &crate::tenant::TenantCtx,
-        job_id: &str,
-    ) -> Result<String, Error> {
+    async fn handle_cancel_job(&self, user_id: &str, job_id: &str) -> Result<String, Error> {
        let uuid = Uuid::parse_str(job_id)
            .map_err(|_| crate::error::JobError::NotFound { id: Uuid::nil() })?;

        let ctx = self.context_manager.get_context(uuid).await?;
-        if ctx.user_id != tenant.user_id() {
+        if ctx.user_id != user_id {
            return Err(crate::error::JobError::NotFound { id: uuid }.into());
        }

        self.scheduler.stop(uuid).await?;

        // Also update DB so the Jobs tab reflects cancellation immediately.
-        // Use TenantScope — ownership already verified above.
-        if let Some(store) = tenant.store()
+        if let Some(store) = self.store()
            && let Err(e) = store
                .update_job_status(uuid, JobState::Cancelled, Some("Cancelled by user"))
                .await
@@ -223,12 +221,11 @@ impl Agent {

    async fn handle_list_jobs(
        &self,
-        tenant: &crate::tenant::TenantCtx,
+        user_id: &str,
        _filter: Option<String>,
    ) -> Result<String, Error> {
        // List from DB for consistency with Jobs tab.
-        // TenantScope methods auto-scope to user.
-        if let Some(store) = tenant.store() {
+        if let Some(store) = self.store() {
            let agent_jobs = match store.list_agent_jobs().await {
                Ok(jobs) => jobs,
                Err(e) => {
@@ -259,7 +256,7 @@ impl Agent {
        }

        // Fallback to ContextManager if no DB.
-        let jobs = self.context_manager.all_jobs_for(tenant.user_id()).await;
+        let jobs = self.context_manager.all_jobs_for(user_id).await;
        if jobs.is_empty() {
            return Ok("No jobs found.".to_string());
        }
@@ -273,16 +270,12 @@ impl Agent {
        Ok(output)
    }

-    async fn handle_help_job(
-        &self,
-        tenant: &crate::tenant::TenantCtx,
-        job_id: &str,
-    ) -> Result<String, Error> {
+    async fn handle_help_job(&self, user_id: &str, job_id: &str) -> Result<String, Error> {
        let uuid = Uuid::parse_str(job_id)
            .map_err(|_| crate::error::JobError::NotFound { id: Uuid::nil() })?;

        let ctx = self.context_manager.get_context(uuid).await?;
-        if ctx.user_id != tenant.user_id() {
+        if ctx.user_id != user_id {
            return Err(crate::error::JobError::NotFound { id: uuid }.into());
        }

@@ -315,11 +308,11 @@ impl Agent {
    /// Show job status inline — either all jobs (no id) or a specific job.
    pub(super) async fn process_job_status(
        &self,
-        tenant: &crate::tenant::TenantCtx,
+        user_id: &str,
        job_id: Option<&str>,
    ) -> Result<SubmissionResult, Error> {
        match self
-            .handle_check_status(tenant, job_id.map(|s| s.to_string()))
+            .handle_check_status(user_id, job_id.map(|s| s.to_string()))
            .await
        {
            Ok(text) => Ok(SubmissionResult::response(text)),
@@ -330,10 +323,10 @@ impl Agent {
    /// Cancel a job by ID.
    pub(super) async fn process_job_cancel(
        &self,
-        tenant: &crate::tenant::TenantCtx,
+        user_id: &str,
        job_id: &str,
    ) -> Result<SubmissionResult, Error> {
-        match self.handle_cancel_job(tenant, job_id).await {
+        match self.handle_cancel_job(user_id, job_id).await {
            Ok(text) => Ok(SubmissionResult::response(text)),
            Err(e) => Ok(SubmissionResult::error(format!("Cancel error: {}", e))),
        }
@@ -472,101 +465,12 @@ impl Agent {
        }
    }

-    /// Handle `/reasoning [N|all]` — show reasoning history for the active thread.
-    pub(super) async fn handle_reasoning_command(
-        &self,
-        args: &[String],
-        session: &Arc<Mutex<Session>>,
-        thread_id: Uuid,
-    ) -> SubmissionResult {
-        // Clone the turn data we need, then drop the session lock.
-        let turns_snapshot: Vec<(
-            usize,
-            Option<String>,
-            Vec<crate::agent::session::TurnToolCall>,
-        )>;
-        {
-            let sess = session.lock().await;
-            let thread = match sess.threads.get(&thread_id) {
-                Some(t) => t,
-                None => return SubmissionResult::error("No active thread."),
-            };
-
-            if thread.turns.is_empty() {
-                return SubmissionResult::ok_with_message("No turns yet.");
-            }
-
-            // Parse argument: default=last turn, "all"=all turns, N=specific turn (1-based).
-            let selected: Vec<&crate::agent::session::Turn> = match args.first().map(|s| s.as_str())
-            {
-                Some("all") => thread.turns.iter().collect(),
-                Some(n) => match n.parse::<usize>() {
-                    Ok(0) => return SubmissionResult::error("Turn numbers start at 1."),
-                    Ok(num) if num > thread.turns.len() => {
-                        return SubmissionResult::error(format!(
-                            "Turn {} does not exist (max: {}).",
-                            num,
-                            thread.turns.len()
-                        ));
-                    }
-                    Ok(num) => vec![&thread.turns[num - 1]],
-                    Err(_) => return SubmissionResult::error("Usage: /reasoning [N|all]"),
-                },
-                None => {
-                    // Default: last turn that has tool calls
-                    match thread.turns.iter().rev().find(|t| !t.tool_calls.is_empty()) {
-                        Some(t) => vec![t],
-                        None => {
-                            return SubmissionResult::ok_with_message("No turns with tool calls.");
-                        }
-                    }
-                }
-            };
-
-            turns_snapshot = selected
-                .into_iter()
-                .map(|t| (t.turn_number, t.narrative.clone(), t.tool_calls.clone()))
-                .collect();
-        }
-        // Session lock is now dropped — format output without holding it.
-
-        let mut output = String::new();
-        for (turn_number, narrative, tool_calls) in &turns_snapshot {
-            output.push_str(&format!("--- Turn {} ---\n", turn_number + 1));
-            if let Some(narrative) = narrative {
-                output.push_str(&format!("Reasoning: {}\n", narrative));
-            }
-            if tool_calls.is_empty() {
-                output.push_str("  (no tool calls)\n");
-            } else {
-                for tc in tool_calls {
-                    let status = if tc.error.is_some() {
-                        "error"
-                    } else if tc.result.is_some() {
-                        "ok"
-                    } else {
-                        "pending"
-                    };
-                    output.push_str(&format!("  {} [{}]", tc.name, status));
-                    if let Some(ref rationale) = tc.rationale {
-                        output.push_str(&format!(" — {}", rationale));
-                    }
-                    output.push('\n');
-                }
-            }
-            output.push('\n');
-        }
-
-        SubmissionResult::response(output.trim_end())
-    }
-
    /// Handle system commands that bypass thread-state checks entirely.
    pub(super) async fn handle_system_command(
        &self,
        command: &str,
        args: &[String],
        channel: &str,
-        tenant: &crate::tenant::TenantCtx,
    ) -> Result<SubmissionResult, Error> {
        match command {
            "help" => Ok(SubmissionResult::response(concat!(
@@ -576,7 +480,6 @@ impl Agent {
                "  /version          Show version info\n",
                "  /tools            List available tools\n",
                "  /debug            Toggle debug mode\n",
-                "  /reasoning [N|all] Show agent reasoning for turns\n",
                "  /ping             Connectivity check\n",
                "\n",
                "Jobs:\n",
@@ -760,32 +663,19 @@ impl Agent {
                        }
                    }

-                    if self.config.multi_tenant {
-                        // Multi-tenant: only persist to per-user DB settings.
-                        // Do NOT call set_model() on the shared provider — that
-                        // would change the default for all users. The per-request
-                        // model_override in the dispatcher reads from the same
-                        // "selected_model" setting and applies it per-user.
-                        self.persist_selected_model(tenant, requested).await;
-                        Ok(SubmissionResult::response(format!(
-                            "Model preference set to: {} (per-user)",
-                            requested
-                        )))
-                    } else {
-                        match self.llm().set_model(requested) {
-                            Ok(()) => {
-                                // Persist the model choice so it survives restarts.
-                                self.persist_selected_model(tenant, requested).await;
-                                Ok(SubmissionResult::response(format!(
-                                    "Switched model to: {}",
-                                    requested
-                                )))
-                            }
-                            Err(e) => Ok(SubmissionResult::error(format!(
-                                "Failed to switch model: {}",
-                                e
-                            ))),
+                    match self.llm().set_model(requested) {
+                        Ok(()) => {
+                            // Persist the model choice so it survives restarts.
+                            self.persist_selected_model(requested).await;
+                            Ok(SubmissionResult::response(format!(
+                                "Switched model to: {}",
+                                requested
+                            )))
                        }
+                        Err(e) => Ok(SubmissionResult::error(format!(
+                            "Failed to switch model: {}",
+                            e
+                        ))),
                    }
                }
            }
@@ -927,14 +817,10 @@ impl Agent {
        command: &str,
        args: &[String],
        channel: &str,
-        tenant: &crate::tenant::TenantCtx,
    ) -> Result<Option<String>, Error> {
        // System commands are now handled directly via Submission::SystemCommand,
        // but the router may still send us unknown /commands.
-        match self
-            .handle_system_command(command, args, channel, tenant)
-            .await?
-        {
+        match self.handle_system_command(command, args, channel).await? {
            SubmissionResult::Response { content } => Ok(Some(content)),
            SubmissionResult::Ok { message } => Ok(message),
            SubmissionResult::Error { message } => Ok(Some(format!("Error: {}", message))),
@@ -946,69 +832,21 @@ impl Agent {
    ///
    /// Best-effort: logs warnings on failure but does not propagate errors,
    /// since the in-memory model switch already succeeded.
-    ///
-    /// In multi-tenant mode, only the per-user DB setting is written — global
-    /// .env and TOML files are shared across users and must not be mutated.
-    async fn persist_selected_model(&self, tenant: &crate::tenant::TenantCtx, model: &str) {
-        // 1. Persist to DB if available (per-user scoped via TenantScope).
-        if let Some(store) = tenant.store() {
+    async fn persist_selected_model(&self, model: &str) {
+        // 1. Persist to DB if available.
+        if let Some(store) = self.store() {
            let value = serde_json::Value::String(model.to_string());
-            if let Err(e) = store.set_setting("selected_model", &value).await {
+            if let Err(e) = store
+                .set_setting(self.owner_id(), "selected_model", &value)
+                .await
+            {
                tracing::warn!("Failed to persist model to DB: {}", e);
-            } else {
-                tracing::debug!(
-                    user_id = tenant.user_id(),
-                    "Persisted selected_model to DB: {}",
-                    model
-                );
            }
-        } else {
-            tracing::warn!("No database store available — model choice will not persist to DB");
        }

-        // 2. In multi-tenant mode, skip .env/TOML writes — these are global
-        // files shared by all users. The per-user DB setting is sufficient.
-        if self.config.multi_tenant {
-            return;
-        }
-
-        // 3. Update .env and TOML config file (sync I/O in spawn_blocking).
+        // 2. Update TOML config file if it exists (sync I/O in spawn_blocking).
        let model_owned = model.to_string();
-        let backend = self.deps.llm_backend.clone();
        if let Err(e) = tokio::task::spawn_blocking(move || {
-            // 2a. Update the backend-specific model env var in ~/.ironclaw/.env.
-            //
-            // Env vars have the HIGHEST priority in LlmConfig::resolve_model()
-            // (env var > TOML > DB > default). If the .env file has e.g.
-            // NEARAI_MODEL=old-model, it shadows everything else. We must
-            // update this var or the /model change is invisible on restart.
-            let registry = crate::llm::ProviderRegistry::load();
-            let model_env = registry.model_env_var(&backend);
-            let env_var_prefix = format!("{}=", model_env);
-
-            // Only update the .env file if the var is actually set there
-            // (avoid injecting new vars the user never configured).
-            let env_path = crate::bootstrap::ironclaw_env_path();
-            let env_has_var = std::fs::read_to_string(&env_path)
-                .ok()
-                .is_some_and(|content| {
-                    content.lines().any(|line| {
-                        let trimmed = line.trim_start();
-                        !trimmed.starts_with('#') && trimmed.starts_with(&env_var_prefix)
-                    })
-                });
-            if env_has_var {
-                if let Err(e) = crate::bootstrap::upsert_bootstrap_var(model_env, &model_owned) {
-                    tracing::warn!("Failed to update {} in .env: {}", model_env, e);
-                } else {
-                    tracing::debug!("Updated {} in .env to {}", model_env, model_owned);
-                }
-            }
-
-            // 2b. Update (or create) the TOML config file.
-            //
-            // The TOML overlay has higher priority than DB settings on
-            // startup, so it MUST stay in sync with the DB.
            let toml_path = crate::settings::Settings::default_toml_path();
            match crate::settings::Settings::load_toml(&toml_path) {
                Ok(Some(mut settings)) => {
@@ -1018,15 +856,7 @@ impl Agent {
                    }
                }
                Ok(None) => {
-                    // No config file yet — create one so the model choice
-                    // survives restarts even when the DB is unavailable.
-                    let settings = crate::settings::Settings {
-                        selected_model: Some(model_owned),
-                        ..Default::default()
-                    };
-                    if let Err(e) = settings.save_toml(&toml_path) {
-                        tracing::warn!("Failed to create config.toml for model persistence: {}", e);
-                    }
+                    // No config file on disk; nothing to update.
                }
                Err(e) => {
                    tracing::warn!("Failed to load config.toml for model persistence: {}", e);
@@ -1035,7 +865,7 @@ impl Agent {
        })
        .await
        {
-            tracing::warn!("Model persistence task failed: {}", e);
+            tracing::warn!("Model TOML persistence task failed: {}", e);
        }
    }
 }
@@ -319,7 +319,7 @@ mod tests {

    #[test]
    fn test_format_turns() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        thread.start_turn("Hello");
        thread.complete_turn("Hi there");
        thread.start_turn("How are you?");
@@ -351,7 +351,7 @@ mod tests {
    /// Helper: build a thread with `n` completed turns.
    /// Turn `i` has user_input "msg-{i}" and response "resp-{i}".
    fn make_thread(n: usize) -> Thread {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        for i in 0..n {
            thread.start_turn(format!("msg-{}", i));
            thread.complete_turn(format!("resp-{}", i));
@@ -457,7 +457,7 @@ mod tests {
    async fn test_compact_truncate_empty_turns() {
        let llm = Arc::new(StubLlm::new("unused"));
        let compactor = make_compactor(llm);
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        assert!(thread.turns.is_empty());

        let result = compactor
@@ -698,7 +698,7 @@ mod tests {

    #[test]
    fn test_format_turns_for_storage_with_tool_calls() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        thread.start_turn("Search for X");
        // Record a tool call on the current turn
        if let Some(turn) = thread.turns.last_mut() {
@@ -719,7 +719,7 @@ mod tests {

    #[test]
    fn test_format_turns_for_storage_incomplete_turn() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        thread.start_turn("In progress message");
        // Don't complete the turn

@@ -21,9 +21,6 @@ pub struct CostGuardConfig {
    pub max_cost_per_day_cents: Option<u64>,
    /// Maximum LLM calls per hour. None = unlimited.
    pub max_actions_per_hour: Option<u64>,
-    /// Maximum spend per user per day in cents. None = unlimited.
-    /// Applied independently per user alongside the global budget.
-    pub max_cost_per_user_per_day_cents: Option<u64>,
 }

 /// Error returned when a cost limit is exceeded.
@@ -33,12 +30,6 @@ pub enum CostLimitExceeded {
    DailyBudget { spent_cents: u64, limit_cents: u64 },
    /// Hourly action rate limit reached.
    HourlyRate { actions: u64, limit: u64 },
-    /// Per-user daily spending cap reached.
-    UserDailyBudget {
-        user_id: String,
-        spent_cents: u64,
-        limit_cents: u64,
-    },
 }

 impl std::fmt::Display for CostLimitExceeded {
@@ -58,17 +49,6 @@ impl std::fmt::Display for CostLimitExceeded {
                "Hourly action limit exceeded: {} actions of {} allowed per hour",
                actions, limit
            ),
-            Self::UserDailyBudget {
-                user_id,
-                spent_cents,
-                limit_cents,
-            } => write!(
-                f,
-                "User '{}' daily cost limit exceeded: spent ${:.2} of ${:.2} allowed",
-                user_id,
-                *spent_cents as f64 / 100.0,
-                *limit_cents as f64 / 100.0
-            ),
        }
    }
 }
@@ -98,9 +78,6 @@ pub struct CostGuard {

    /// Per-model token usage since startup.
    model_tokens: Mutex<HashMap<String, ModelTokens>>,
-
-    /// Per-user daily cost tracking. Each entry resets independently at midnight UTC.
-    per_user_daily_cost: Mutex<HashMap<String, DailyCost>>,
 }

 struct DailyCost {
@@ -120,7 +97,6 @@ impl CostGuard {
            action_window: Mutex::new(VecDeque::new()),
            budget_exceeded: AtomicBool::new(false),
            model_tokens: Mutex::new(HashMap::new()),
-            per_user_daily_cost: Mutex::new(HashMap::new()),
        }
    }

@@ -227,11 +203,6 @@ impl CostGuard {
                daily.reset_date = today;
                self.budget_exceeded.store(false, Ordering::Relaxed);
                tracing::info!("Cost guard: daily counter reset for {}", today);
-
-                // Prune per-user entries from previous days to prevent
-                // unbounded HashMap growth in long-lived deployments.
-                let mut per_user = self.per_user_daily_cost.lock().await;
-                per_user.retain(|_, entry| entry.reset_date == today);
            }
            daily.total += cost;

@@ -277,85 +248,6 @@ impl CostGuard {
        cost
    }

-    /// Record an LLM call with per-user attribution.
-    ///
-    /// Delegates to `record_llm_call` for global tracking, then additionally
-    /// records the cost against the user's daily budget.
-    #[allow(clippy::too_many_arguments)]
-    pub async fn record_llm_call_for_user(
-        &self,
-        user_id: &str,
-        model: &str,
-        input_tokens: u32,
-        output_tokens: u32,
-        cache_read_input_tokens: u32,
-        cache_creation_input_tokens: u32,
-        cache_read_discount: Decimal,
-        cache_write_multiplier: Decimal,
-        cost_per_token: Option<(Decimal, Decimal)>,
-    ) -> Decimal {
-        let cost = self
-            .record_llm_call(
-                model,
-                input_tokens,
-                output_tokens,
-                cache_read_input_tokens,
-                cache_creation_input_tokens,
-                cache_read_discount,
-                cache_write_multiplier,
-                cost_per_token,
-            )
-            .await;
-
-        // Track per-user daily cost
-        {
-            let today = chrono::Utc::now().date_naive();
-            let mut per_user = self.per_user_daily_cost.lock().await;
-            let entry = per_user
-                .entry(user_id.to_string())
-                .or_insert_with(|| DailyCost {
-                    total: Decimal::ZERO,
-                    reset_date: today,
-                });
-            if today != entry.reset_date {
-                entry.total = Decimal::ZERO;
-                entry.reset_date = today;
-            }
-            entry.total += cost;
-        }
-
-        cost
-    }
-
-    /// Check whether the next action is allowed for a specific user.
-    ///
-    /// Checks the global limits first (via `check_allowed`), then additionally
-    /// checks the per-user daily budget if configured.
-    pub async fn check_allowed_for_user(&self, user_id: &str) -> Result<(), CostLimitExceeded> {
-        // Check global limits first
-        self.check_allowed().await?;
-
-        // Check per-user daily budget
-        if let Some(limit_cents) = self.config.max_cost_per_user_per_day_cents {
-            let today = chrono::Utc::now().date_naive();
-            let per_user = self.per_user_daily_cost.lock().await;
-            if let Some(entry) = per_user.get(user_id)
-                && entry.reset_date == today
-            {
-                let spent_cents = to_cents(entry.total);
-                if spent_cents >= limit_cents {
-                    return Err(CostLimitExceeded::UserDailyBudget {
-                        user_id: user_id.to_string(),
-                        spent_cents,
-                        limit_cents,
-                    });
-                }
-            }
-        }
-
-        Ok(())
-    }
-
    /// Current daily spend in USD (as Decimal).
    pub async fn daily_spend(&self) -> Decimal {
        let daily = self.daily_cost.lock().await;
@@ -367,16 +259,6 @@ impl CostGuard {
        }
    }

-    /// Current daily spend for a specific user in USD (as Decimal).
-    pub async fn daily_spend_for_user(&self, user_id: &str) -> Decimal {
-        let today = chrono::Utc::now().date_naive();
-        let per_user = self.per_user_daily_cost.lock().await;
-        match per_user.get(user_id) {
-            Some(entry) if entry.reset_date == today => entry.total,
-            _ => Decimal::ZERO,
-        }
-    }
-
    /// Number of actions in the current hourly window.
    pub async fn actions_this_hour(&self) -> u64 {
        let mut window = self.action_window.lock().await;
@@ -432,7 +314,7 @@ mod tests {
    async fn test_daily_budget_enforcement() {
        let guard = CostGuard::new(CostGuardConfig {
            max_cost_per_day_cents: Some(1), // $0.01 limit
-            ..CostGuardConfig::default()
+            max_actions_per_hour: None,
        });

        // First call allowed
@@ -468,8 +350,8 @@ mod tests {
    #[tokio::test]
    async fn test_hourly_rate_enforcement() {
        let guard = CostGuard::new(CostGuardConfig {
+            max_cost_per_day_cents: None,
            max_actions_per_hour: Some(3),
-            ..CostGuardConfig::default()
        });

        // First 3 actions allowed
@@ -751,8 +633,8 @@ mod tests {
        // A fresh CostGuard with rate limits should not panic even if
        // checked_sub returns None (simulating short uptime).
        let guard = CostGuard::new(CostGuardConfig {
+            max_cost_per_day_cents: None,
            max_actions_per_hour: Some(100),
-            ..CostGuardConfig::default()
        });

        // These must not panic regardless of system uptime
@@ -774,119 +656,4 @@ mod tests {
        let result = Instant::now().checked_sub(std::time::Duration::MAX);
        assert!(result.is_none());
    }
-
-    #[tokio::test]
-    async fn test_per_user_daily_budget_enforcement() {
-        let guard = CostGuard::new(CostGuardConfig {
-            max_cost_per_day_cents: None,
-            max_actions_per_hour: None,
-            max_cost_per_user_per_day_cents: Some(1), // $0.01 per user
-        });
-
-        // Both users initially allowed
-        assert!(guard.check_allowed_for_user("alice").await.is_ok());
-        assert!(guard.check_allowed_for_user("bob").await.is_ok());
-
-        // Alice makes an expensive call
-        guard
-            .record_llm_call_for_user(
-                "alice",
-                "gpt-4o",
-                10_000,
-                10_000,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
-            .await;
-
-        // Alice should be blocked, Bob should still be allowed
-        let result = guard.check_allowed_for_user("alice").await;
-        assert!(result.is_err());
-        match result.unwrap_err() {
-            CostLimitExceeded::UserDailyBudget {
-                user_id,
-                limit_cents,
-                ..
-            } => {
-                assert_eq!(user_id, "alice");
-                assert_eq!(limit_cents, 1);
-            }
-            other => panic!("Expected UserDailyBudget, got {:?}", other),
-        }
-        assert!(guard.check_allowed_for_user("bob").await.is_ok());
-    }
-
-    #[tokio::test]
-    async fn test_per_user_daily_spend_tracking() {
-        let guard = CostGuard::new(CostGuardConfig::default());
-
-        assert_eq!(guard.daily_spend_for_user("alice").await, Decimal::ZERO);
-        assert_eq!(guard.daily_spend_for_user("bob").await, Decimal::ZERO);
-
-        let cost = guard
-            .record_llm_call_for_user(
-                "alice",
-                "gpt-4o",
-                1000,
-                500,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
-            .await;
-
-        assert_eq!(guard.daily_spend_for_user("alice").await, cost);
-        assert_eq!(guard.daily_spend_for_user("bob").await, Decimal::ZERO);
-        // Global spend should also be tracked
-        assert_eq!(guard.daily_spend().await, cost);
-    }
-
-    #[tokio::test]
-    async fn test_per_user_budget_independent_of_global() {
-        let guard = CostGuard::new(CostGuardConfig {
-            max_cost_per_day_cents: Some(100_000), // $1000 global limit
-            max_actions_per_hour: None,
-            max_cost_per_user_per_day_cents: Some(1), // $0.01 per user
-        });
-
-        // User hits their personal limit
-        guard
-            .record_llm_call_for_user(
-                "alice",
-                "gpt-4o",
-                10_000,
-                10_000,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
-            .await;
-
-        // Alice blocked by per-user limit, not global
-        assert!(guard.check_allowed_for_user("alice").await.is_err());
-        // Global limit is far from reached
-        assert!(guard.check_allowed().await.is_ok());
-        // Bob is unaffected
-        assert!(guard.check_allowed_for_user("bob").await.is_ok());
-    }
-
-    #[test]
-    fn test_user_cost_limit_display() {
-        let limit = CostLimitExceeded::UserDailyBudget {
-            user_id: "alice".to_string(),
-            spent_cents: 150,
-            limit_cents: 100,
-        };
-        let msg = limit.to_string();
-        assert!(msg.contains("alice"));
-        assert!(msg.contains("$1.50"));
-        assert!(msg.contains("$1.00"));
-    }
 }
@@ -42,7 +42,6 @@ impl Agent {
    pub(super) async fn run_agentic_loop(
        &self,
        message: &IncomingMessage,
-        tenant: crate::tenant::TenantCtx,
        session: Arc<Mutex<Session>>,
        thread_id: Uuid,
        initial_messages: Vec<ChatMessage>,
@@ -64,12 +63,7 @@ impl Agent {
        );

        let system_prompt = if let Some(ws) = self.workspace() {
-            let scoped_workspace = if ws.user_id() == message.user_id {
-                Arc::clone(ws)
-            } else {
-                Arc::new(ws.scoped_to_user(&message.user_id))
-            };
-            match scoped_workspace
+            match ws
                .system_prompt_for_context_tz(is_group_chat, user_tz)
                .await
            {
@@ -169,7 +163,6 @@ impl Agent {

        let delegate = ChatDelegate {
            agent: self,
-            tenant,
            session: session.clone(),
            thread_id,
            message,
@@ -242,7 +235,6 @@ impl Agent {
 /// auth intercept, and cost tracking.
 struct ChatDelegate<'a> {
    agent: &'a Agent,
-    tenant: crate::tenant::TenantCtx,
    session: Arc<Mutex<Session>>,
    thread_id: Uuid,
    message: &'a IncomingMessage,
@@ -306,8 +298,6 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {

        // Update context for this iteration
        reason_ctx.available_tools = tool_defs;
-        // Preserve force_text if already set (e.g. by truncation escalation).
-        let force_text = force_text || reason_ctx.force_text;
        reason_ctx.system_prompt = Some(if force_text {
            self.cached_prompt_no_tools.clone()
        } else {
@@ -341,8 +331,8 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
        reason_ctx: &mut ReasoningContext,
        iteration: usize,
    ) -> Result<crate::llm::RespondOutput, Error> {
-        // Enforce cost guardrails before the LLM call (global + per-user)
-        if let Err(limit) = self.tenant.check_cost_allowed().await {
+        // Enforce cost guardrails before the LLM call
+        if let Err(limit) = self.agent.cost_guard().check_allowed().await {
            return Err(crate::error::LlmError::InvalidResponse {
                provider: "agent".to_string(),
                reason: limit.to_string(),
@@ -350,21 +340,6 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
            .into());
        }

-        // Apply per-user model override from settings (first iteration only
-        // to avoid repeated DB lookups within the same agentic loop).
-        // Uses "selected_model" — the same key the /model command persists to
-        // via SettingsStore (per-user scoped via TenantScope).
-        if iteration == 0
-            && let Some(store) = self.tenant.store()
-            && let Ok(Some(value)) = store.get_setting("selected_model").await
-            && let Some(model) = value.as_str()
-        {
-            let model = model.trim();
-            if !model.is_empty() {
-                reason_ctx.model_override = Some(model.to_string());
-            }
-        }
-
        let output = match reasoning.respond_with_tools(reason_ctx).await {
            Ok(output) => output,
            Err(crate::error::LlmError::ContextLengthExceeded { used, limit }) => {
@@ -399,22 +374,13 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
            Err(e) => return Err(e.into()),
        };

-        // Record cost and track token usage (global + per-user).
-        // When a model override is active, use the override name for attribution
-        // and let CostGuard look up pricing via costs::model_cost() instead of
-        // using the default provider's cost_per_token (which reflects the wrong model).
-        let (model_name, cost_per_token) = if let Some(ref ovr) = reason_ctx.model_override {
-            (ovr.clone(), None)
-        } else {
-            (
-                self.agent.llm().active_model_name(),
-                Some(self.agent.llm().cost_per_token()),
-            )
-        };
+        // Record cost and track token usage
+        let model_name = self.agent.llm().active_model_name();
        let read_discount = self.agent.llm().cache_read_discount();
        let write_multiplier = self.agent.llm().cache_write_multiplier();
        let call_cost = self
-            .tenant
+            .agent
+            .cost_guard()
            .record_llm_call(
                &model_name,
                output.usage.input_tokens,
@@ -423,7 +389,7 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
                output.usage.cache_creation_input_tokens,
                read_discount,
                write_multiplier,
-                cost_per_token,
+                Some(self.agent.llm().cost_per_token()),
            )
            .await;
        tracing::debug!(
@@ -454,19 +420,6 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
        content: Option<String>,
        reason_ctx: &mut ReasoningContext,
    ) -> Result<Option<LoopOutcome>, Error> {
-        // Extract and sanitize the narrative before consuming `content`.
-        let narrative = content
-            .as_deref()
-            .filter(|c| !c.trim().is_empty())
-            .map(|c| {
-                let sanitized = self
-                    .agent
-                    .safety()
-                    .sanitize_tool_output("agent_narrative", c);
-                sanitized.content
-            })
-            .filter(|c| !c.trim().is_empty());
-
        // Add the assistant message with tool_calls to context.
        // OpenAI protocol requires this before tool-result messages.
        reason_ctx
@@ -487,41 +440,6 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
            )
            .await;

-        // Build per-tool decisions for the reasoning update.
-        // Sanitize each rationale through SafetyLayer (parity with JobDelegate).
-        let decisions: Vec<crate::channels::ToolDecision> = tool_calls
-            .iter()
-            .filter_map(|tc| {
-                tc.reasoning.as_ref().map(|r| {
-                    let sanitized = self
-                        .agent
-                        .safety()
-                        .sanitize_tool_output("tool_rationale", r)
-                        .content;
-                    crate::channels::ToolDecision {
-                        tool_name: tc.name.clone(),
-                        rationale: sanitized,
-                    }
-                })
-            })
-            .collect();
-
-        // Emit reasoning update to channels.
-        if narrative.is_some() || !decisions.is_empty() {
-            let _ = self
-                .agent
-                .channels
-                .send_status(
-                    &self.message.channel,
-                    StatusUpdate::ReasoningUpdate {
-                        narrative: narrative.clone().unwrap_or_default(),
-                        decisions: decisions.clone(),
-                    },
-                    &self.message.metadata,
-                )
-                .await;
-        }
-
        // Record tool calls in the thread with sensitive params redacted.
        {
            let mut redacted_args: Vec<serde_json::Value> = Vec::with_capacity(tool_calls.len());
@@ -537,23 +455,8 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
            if let Some(thread) = sess.threads.get_mut(&self.thread_id)
                && let Some(turn) = thread.last_turn_mut()
            {
-                // Set turn-level narrative.
-                if turn.narrative.is_none() {
-                    turn.narrative = narrative;
-                }
                for (tc, safe_args) in tool_calls.iter().zip(redacted_args) {
-                    let sanitized_rationale = tc.reasoning.as_ref().map(|r| {
-                        self.agent
-                            .safety()
-                            .sanitize_tool_output("tool_rationale", r)
-                            .content
-                    });
-                    turn.record_tool_call_with_reasoning(
-                        &tc.name,
-                        safe_args,
-                        sanitized_rationale,
-                        Some(tc.id.clone()),
-                    );
+                    turn.record_tool_call(&tc.name, safe_args);
                }
            }
        }
@@ -823,7 +726,7 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
                        if let Some(thread) = sess.threads.get_mut(&self.thread_id)
                            && let Some(turn) = thread.last_turn_mut()
                        {
-                            turn.record_tool_error_for(&tc.id, error_msg.clone());
+                            turn.record_tool_error(error_msg.clone());
                        }
                    }
                    reason_ctx
@@ -949,19 +852,16 @@ impl<'a> LoopDelegate for ChatDelegate<'a> {
                        Err(e) => format!("Tool '{}' failed: {}", tc.name, e),
                    };

-                    // Record sanitized result in thread (identity-based matching).
+                    // Record sanitized result in thread
                    {
                        let mut sess = self.session.lock().await;
                        if let Some(thread) = sess.threads.get_mut(&self.thread_id)
                            && let Some(turn) = thread.last_turn_mut()
                        {
                            if is_tool_error {
-                                turn.record_tool_error_for(&tc.id, result_content.clone());
+                                turn.record_tool_error(result_content.clone());
                            } else {
-                                turn.record_tool_result_for(
-                                    &tc.id,
-                                    serde_json::json!(result_content),
-                                );
+                                turn.record_tool_result(serde_json::json!(result_content));
                            }
                        }
                    }
@@ -1198,23 +1098,15 @@ pub(crate) fn extract_suggestions(text: &str) -> (String, Vec<String>) {
        Regex::new(r"(?s)<suggestions>\s*(.*?)\s*</suggestions>").expect("valid regex") // safety: constant pattern
    });

-    // Build a sorted list of code fence positions to determine open/close pairing.
-    // A position is "inside" a fenced block when it falls between an odd-numbered
-    // fence (opening) and the next even-numbered fence (closing).
-    let fence_positions: Vec<usize> = text.match_indices("```").map(|(pos, _)| pos).collect();
+    // Find the position of the last closing code fence to avoid matching inside code blocks
+    let last_code_fence = text.rfind("```").unwrap_or(0);

-    let is_inside_fence = |pos: usize| -> bool {
-        // Count how many fences appear before `pos`. If odd, we're inside a fence.
-        let count = fence_positions.iter().take_while(|&&fp| fp <= pos).count();
-        count % 2 == 1
-    };
-
-    // Find all matches, take the last one that's outside any code fence
+    // Find all matches, take the last one that's after the last code fence
    let mut best_match: Option<regex::Match<'_>> = None;
    let mut best_capture: Option<String> = None;
    for caps in RE.captures_iter(text) {
        if let (Some(full), Some(inner)) = (caps.get(0), caps.get(1))
-            && !is_inside_fence(full.start())
+            && full.start() >= last_code_fence
        {
            best_match = Some(full);
            best_capture = Some(inner.as_str().to_string());
@@ -1333,8 +1225,6 @@ mod tests {
            document_extraction: None,
            sandbox_readiness: crate::agent::routine_engine::SandboxReadiness::DisabledByConfig,
            builder: None,
-            llm_backend: "nearai".to_string(),
-            tenant_rates: Arc::new(crate::tenant::TenantRateRegistry::new(4, 3)),
        };

        Agent::new(
@@ -1350,14 +1240,10 @@ mod tests {
                allow_local_tools: false,
                max_cost_per_day_cents: None,
                max_actions_per_hour: None,
-                max_cost_per_user_per_day_cents: None,
                max_tool_iterations: 50,
                auto_approve_tools: false,
                default_timezone: "UTC".to_string(),
                max_tokens_per_job: 0,
-                multi_tenant: false,
-                max_llm_concurrent_per_user: None,
-                max_jobs_concurrent_per_user: None,
            },
            deps,
            Arc::new(ChannelManager::new()),
@@ -1567,13 +1453,11 @@ mod tests {
                    id: "call_2".to_string(),
                    name: "http".to_string(),
                    arguments: serde_json::json!({"url": "https://example.com"}),
-                    reasoning: None,
                },
                ToolCall {
                    id: "call_3".to_string(),
                    name: "echo".to_string(),
                    arguments: serde_json::json!({"message": "done"}),
-                    reasoning: None,
                },
            ],
            user_timezone: None,
@@ -1759,7 +1643,6 @@ mod tests {
                    id: "call_1".to_string(),
                    name: "echo".to_string(),
                    arguments: serde_json::json!({"message": "hi"}),
-                    reasoning: None,
                }],
            ),
            ChatMessage::tool_result("call_1", "echo", "hi"),
@@ -1852,13 +1735,11 @@ mod tests {
                        id: "c1".to_string(),
                        name: "http".to_string(),
                        arguments: serde_json::json!({}),
-                        reasoning: None,
                    },
                    ToolCall {
                        id: "c2".to_string(),
                        name: "echo".to_string(),
                        arguments: serde_json::json!({}),
-                        reasoning: None,
                    },
                ],
            ),
@@ -1892,7 +1773,6 @@ mod tests {
                    id: "c1".to_string(),
                    name: "echo".to_string(),
                    arguments: serde_json::json!({}),
-                    reasoning: None,
                }],
            ),
            ChatMessage::tool_result("c1", "echo", "done"),
@@ -2023,7 +1903,6 @@ mod tests {
                    id: crate::llm::generate_tool_call_id(0, 0),
                    name: "echo".to_string(),
                    arguments: serde_json::json!({"message": "looping"}),
-                    reasoning: None,
                }],
                input_tokens: 0,
                output_tokens: 5,
@@ -2177,7 +2056,6 @@ mod tests {
                    id: crate::llm::generate_tool_call_id(0, 0),
                    name: "nonexistent_tool".to_string(),
                    arguments: serde_json::json!({}),
-                    reasoning: None,
                }],
                input_tokens: 0,
                output_tokens: 5,
@@ -2214,8 +2092,6 @@ mod tests {
            document_extraction: None,
            sandbox_readiness: crate::agent::routine_engine::SandboxReadiness::DisabledByConfig,
            builder: None,
-            llm_backend: "nearai".to_string(),
-            tenant_rates: Arc::new(crate::tenant::TenantRateRegistry::new(4, 3)),
        };

        Agent::new(
@@ -2231,14 +2107,10 @@ mod tests {
                allow_local_tools: false,
                max_cost_per_day_cents: None,
                max_actions_per_hour: None,
-                max_cost_per_user_per_day_cents: None,
                max_tool_iterations,
                auto_approve_tools: true,
                default_timezone: "UTC".to_string(),
                max_tokens_per_job: 0,
-                multi_tenant: false,
-                max_llm_concurrent_per_user: None,
-                max_jobs_concurrent_per_user: None,
            },
            deps,
            Arc::new(ChannelManager::new()),
@@ -2268,19 +2140,18 @@ mod tests {
        // Initialize a thread in the session so the loop can record tool calls.
        let thread_id = {
            let mut sess = session.lock().await;
-            sess.create_thread().id
+            sess.create_thread("test").id
        };

        let message = IncomingMessage::new("test", "test-user", "do something");
        let initial_messages = vec![ChatMessage::user("do something")];
-        let tenant = agent.tenant_ctx("test-user").await;

        // The dispatcher must terminate within 5 seconds. If there is an
        // infinite loop bug (e.g., index not advancing on tool failure), the
        // timeout will fire and the test will fail.
        let result = tokio::time::timeout(
            Duration::from_secs(5),
-            agent.run_agentic_loop(&message, tenant, session, thread_id, initial_messages),
+            agent.run_agentic_loop(&message, session, thread_id, initial_messages),
        )
        .await;

@@ -2341,8 +2212,6 @@ mod tests {
                document_extraction: None,
                sandbox_readiness: crate::agent::routine_engine::SandboxReadiness::DisabledByConfig,
                builder: None,
-                llm_backend: "nearai".to_string(),
-                tenant_rates: Arc::new(crate::tenant::TenantRateRegistry::new(4, 3)),
            };

            Agent::new(
@@ -2358,14 +2227,10 @@ mod tests {
                    allow_local_tools: false,
                    max_cost_per_day_cents: None,
                    max_actions_per_hour: None,
-                    max_cost_per_user_per_day_cents: None,
                    max_tool_iterations: max_iter,
                    auto_approve_tools: true,
                    default_timezone: "UTC".to_string(),
                    max_tokens_per_job: 0,
-                    multi_tenant: false,
-                    max_llm_concurrent_per_user: None,
-                    max_jobs_concurrent_per_user: None,
                },
                deps,
                Arc::new(ChannelManager::new()),
@@ -2380,19 +2245,18 @@ mod tests {
        let session = Arc::new(Mutex::new(Session::new("test-user")));
        let thread_id = {
            let mut sess = session.lock().await;
-            sess.create_thread().id
+            sess.create_thread("test").id
        };

        let message = IncomingMessage::new("test", "test-user", "keep calling tools");
        let initial_messages = vec![ChatMessage::user("keep calling tools")];
-        let tenant = agent.tenant_ctx("test-user").await;

        // Even with an LLM that always wants to call tools, the dispatcher
        // must terminate within the timeout thanks to force_text at
        // max_tool_iterations.
        let result = tokio::time::timeout(
            Duration::from_secs(5),
-            agent.run_agentic_loop(&message, tenant, session, thread_id, initial_messages),
+            agent.run_agentic_loop(&message, session, thread_id, initial_messages),
        )
        .await;

@@ -2481,16 +2345,6 @@ mod tests {
        assert!(suggestions.is_empty()); // safety: test
    }

-    #[test]
-    fn test_extract_suggestions_inside_unclosed_code_fence() {
-        // Regression: odd number of fences (unclosed fence) must still be
-        // treated as "inside a code block".
-        let input = "```\ncode\n<suggestions>[\"bar\"]</suggestions>";
-        let (text, suggestions) = super::extract_suggestions(input);
-        assert_eq!(text, input); // safety: test
-        assert!(suggestions.is_empty()); // safety: test
-    }
-
    #[test]
    fn test_extract_suggestions_after_code_fence() {
        let input = "```\ncode\n```\nAnswer.\n<suggestions>[\"foo\"]</suggestions>";
@@ -31,8 +31,8 @@ use chrono_tz::Tz;
 use tokio::sync::mpsc;

 use crate::channels::OutgoingResponse;
+use crate::db::Database;
 use crate::llm::{ChatMessage, CompletionRequest, LlmProvider, Reasoning};
-use crate::tenant::AdminScope;
 use crate::workspace::Workspace;
 use crate::workspace::hygiene::HygieneConfig;

@@ -57,9 +57,6 @@ pub struct HeartbeatConfig {
    pub quiet_hours_end: Option<u32>,
    /// Timezone for fire_at and quiet hours evaluation (IANA name).
    pub timezone: Option<String>,
-    /// When true, cycle through all users with routines instead of
-    /// running heartbeat for a single user. Requires a database store.
-    pub multi_tenant: bool,
 }

 impl Default for HeartbeatConfig {
@@ -74,7 +71,6 @@ impl Default for HeartbeatConfig {
            quiet_hours_start: None,
            quiet_hours_end: None,
            timezone: None,
-            multi_tenant: false,
        }
    }
 }
@@ -182,7 +178,7 @@ pub struct HeartbeatRunner {
    workspace: Arc<Workspace>,
    llm: Arc<dyn LlmProvider>,
    response_tx: Option<mpsc::Sender<OutgoingResponse>>,
-    store: Option<AdminScope>,
+    store: Option<Arc<dyn Database>>,
    consecutive_failures: u32,
 }

@@ -211,8 +207,8 @@ impl HeartbeatRunner {
        self
    }

-    /// Set the admin-scoped database store for persistent heartbeat conversations.
-    pub fn with_store(mut self, store: AdminScope) -> Self {
+    /// Set the database store for persistent heartbeat conversations.
+    pub fn with_store(mut self, store: Arc<dyn Database>) -> Self {
        self.store = Some(store);
        self
    }
@@ -400,7 +396,7 @@ impl HeartbeatRunner {
    }

    /// Send a notification about heartbeat findings.
-    pub(crate) async fn send_notification(&self, message: &str) {
+    async fn send_notification(&self, message: &str) {
        let Some(ref tx) = self.response_tx else {
            tracing::debug!("No response channel configured for heartbeat notifications");
            return;
@@ -497,7 +493,7 @@ pub fn spawn_heartbeat(
    workspace: Arc<Workspace>,
    llm: Arc<dyn LlmProvider>,
    response_tx: Option<mpsc::Sender<OutgoingResponse>>,
-    store: Option<AdminScope>,
+    store: Option<Arc<dyn Database>>,
 ) -> tokio::task::JoinHandle<()> {
    let mut runner = HeartbeatRunner::new(config, hygiene_config, workspace, llm);
    if let Some(tx) = response_tx {
@@ -512,179 +508,6 @@ pub fn spawn_heartbeat(
    })
 }

-/// Spawn a multi-user heartbeat runner that cycles through all users that
-/// own routines (enabled or not). Each tick, it queries the DB for distinct
-/// user_ids, creates a per-user workspace, and runs a heartbeat check for
-/// each user concurrently. Per-user failure counts are tracked independently.
-pub fn spawn_multi_user_heartbeat(
-    config: HeartbeatConfig,
-    hygiene_config: HygieneConfig,
-    llm: Arc<dyn LlmProvider>,
-    response_tx: Option<mpsc::Sender<OutgoingResponse>>,
-    store: AdminScope,
-) -> tokio::task::JoinHandle<()> {
-    tokio::spawn(async move {
-        if !config.enabled {
-            tracing::info!("Multi-user heartbeat is disabled");
-            return;
-        }
-
-        let mut tick_interval = if config.fire_at.is_none() {
-            let mut iv = tokio::time::interval(config.interval);
-            iv.tick().await; // skip immediate tick
-            Some(iv)
-        } else {
-            None
-        };
-
-        // Track consecutive failures per user so we can disable heartbeat
-        // for persistently-failing users (same semantics as single-user mode).
-        let mut user_failures: std::collections::HashMap<String, u32> =
-            std::collections::HashMap::new();
-
-        tracing::info!("Starting multi-user heartbeat loop");
-
-        loop {
-            if let Some(fire_at) = config.fire_at {
-                let sleep_dur = duration_until_next_fire(fire_at, config.resolved_tz());
-                tokio::time::sleep(sleep_dur).await;
-            } else if let Some(ref mut iv) = tick_interval {
-                iv.tick().await;
-            }
-
-            if config.is_quiet_hours() {
-                continue;
-            }
-
-            // Get distinct user_ids from routines
-            let user_ids = match store.list_all_routines().await {
-                Ok(routines) => {
-                    let mut ids: Vec<String> = routines
-                        .iter()
-                        .map(|r| r.user_id.clone())
-                        .collect::<std::collections::HashSet<_>>()
-                        .into_iter()
-                        .collect();
-                    ids.sort();
-                    ids
-                }
-                Err(e) => {
-                    tracing::error!("Multi-user heartbeat: failed to list routines: {}", e);
-                    continue;
-                }
-            };
-
-            // Run user heartbeats concurrently so one slow LLM call doesn't
-            // block others. Cap concurrency to avoid flooding the LLM provider.
-            const MAX_CONCURRENT_HEARTBEATS: usize = 8;
-            let mut join_set = tokio::task::JoinSet::new();
-
-            for user_id in &user_ids {
-                // Skip users that have exceeded max_failures
-                let failures = user_failures.get(user_id).copied().unwrap_or(0);
-                if failures >= config.max_failures {
-                    continue;
-                }
-
-                let workspace = Arc::new(Workspace::new_with_db(user_id, Arc::clone(store.db())));
-
-                // Run memory hygiene per user (same as single-user heartbeat).
-                let hygiene_ws = Arc::clone(&workspace);
-                let hygiene_cfg = hygiene_config.clone();
-                let hygiene_user = user_id.clone();
-                tokio::spawn(async move {
-                    let report =
-                        crate::workspace::hygiene::run_if_due(&hygiene_ws, &hygiene_cfg).await;
-                    if report.had_work() {
-                        tracing::info!(
-                            user_id = hygiene_user,
-                            daily_logs_deleted = report.daily_logs_deleted,
-                            conversation_docs_deleted = report.conversation_docs_deleted,
-                            "multi-user heartbeat: memory hygiene deleted stale documents"
-                        );
-                    }
-                });
-
-                // Drain completed tasks to stay within the concurrency cap.
-                while join_set.len() >= MAX_CONCURRENT_HEARTBEATS {
-                    if let Some(join_result) = join_set.join_next().await {
-                        collect_heartbeat_result(join_result, &mut user_failures, &config);
-                    }
-                }
-
-                let uid = user_id.clone();
-                let cfg = config.clone();
-                let hyg = hygiene_config.clone();
-                let llm_clone = llm.clone();
-                let tx = response_tx.clone();
-                let admin = store.clone();
-
-                join_set.spawn(async move {
-                    let mut runner = HeartbeatRunner::new(cfg, hyg, workspace, llm_clone);
-                    if let Some(tx) = tx {
-                        runner = runner.with_response_channel(tx);
-                    }
-                    runner = runner.with_store(admin);
-
-                    let result = runner.check_heartbeat().await;
-                    if let HeartbeatResult::NeedsAttention(msg) = &result {
-                        runner.send_notification(msg).await;
-                    }
-                    (uid, result)
-                });
-            }
-
-            // Collect remaining results and update failure counts
-            while let Some(join_result) = join_set.join_next().await {
-                collect_heartbeat_result(join_result, &mut user_failures, &config);
-            }
-        }
-    })
-}
-
-/// Process a single JoinSet result from the multi-user heartbeat loop.
-fn collect_heartbeat_result(
-    join_result: Result<(String, HeartbeatResult), tokio::task::JoinError>,
-    user_failures: &mut std::collections::HashMap<String, u32>,
-    config: &HeartbeatConfig,
-) {
-    let (uid, result) = match join_result {
-        Ok(pair) => pair,
-        Err(e) => {
-            tracing::error!("Multi-user heartbeat task panicked: {}", e);
-            return;
-        }
-    };
-    match result {
-        HeartbeatResult::Ok => {
-            tracing::trace!(user_id = uid, "Multi-user heartbeat OK");
-            user_failures.remove(&uid);
-        }
-        HeartbeatResult::NeedsAttention(_) => {
-            tracing::info!(user_id = uid, "Multi-user heartbeat needs attention");
-            user_failures.remove(&uid);
-        }
-        HeartbeatResult::Skipped => {}
-        HeartbeatResult::Failed(err) => {
-            let count = user_failures.entry(uid.clone()).or_insert(0);
-            *count += 1;
-            tracing::error!(
-                user_id = uid,
-                consecutive_failures = *count,
-                "Multi-user heartbeat failed: {}",
-                err
-            );
-            if *count >= config.max_failures {
-                tracing::error!(
-                    user_id = uid,
-                    "Multi-user heartbeat disabled for user after {} consecutive failures",
-                    count
-                );
-            }
-        }
-    }
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -903,7 +726,7 @@ mod tests {
            Arc<crate::workspace::Workspace>,
            Arc<dyn crate::llm::LlmProvider>,
            Option<tokio::sync::mpsc::Sender<crate::channels::OutgoingResponse>>,
-            Option<AdminScope>,
+            Option<Arc<dyn crate::db::Database>>,
        ) -> tokio::task::JoinHandle<()> = spawn_heartbeat;
        let _ = _fn_ptr;
    }
@@ -21,8 +21,8 @@ use tokio::task::JoinHandle;
 use uuid::Uuid;

 use crate::channels::IncomingMessage;
+use crate::channels::web::types::SseEvent;
 use crate::context::{ContextManager, JobState};
-use ironclaw_common::AppEvent;

 /// Route context for forwarding job monitor events back to the user's channel.
 #[derive(Debug, Clone)]
@@ -36,15 +36,15 @@ pub struct JobMonitorRoute {
 /// injects assistant messages into the agent loop.
 ///
 /// The monitor forwards:
-/// - `AppEvent::JobMessage` (assistant role): injected as incoming messages so
+/// - `SseEvent::JobMessage` (assistant role): injected as incoming messages so
 ///   the main agent can read and relay to the user.
-/// - `AppEvent::JobResult`: injected as a completion notice, then the task exits.
+/// - `SseEvent::JobResult`: injected as a completion notice, then the task exits.
 ///
 /// Tool use/result and status events are intentionally skipped (too noisy for
 /// the main agent's context window).
 pub fn spawn_job_monitor(
    job_id: Uuid,
-    event_rx: broadcast::Receiver<(Uuid, String, AppEvent)>,
+    event_rx: broadcast::Receiver<(Uuid, SseEvent)>,
    inject_tx: mpsc::Sender<IncomingMessage>,
    route: JobMonitorRoute,
 ) -> JoinHandle<()> {
@@ -56,7 +56,7 @@ pub fn spawn_job_monitor(
 /// jobs don't stay `InProgress` forever in the `ContextManager`.
 pub fn spawn_job_monitor_with_context(
    job_id: Uuid,
-    mut event_rx: broadcast::Receiver<(Uuid, String, AppEvent)>,
+    mut event_rx: broadcast::Receiver<(Uuid, SseEvent)>,
    inject_tx: mpsc::Sender<IncomingMessage>,
    route: JobMonitorRoute,
    context_manager: Option<Arc<ContextManager>>,
@@ -68,13 +68,13 @@ pub fn spawn_job_monitor_with_context(

        loop {
            match event_rx.recv().await {
-                Ok((ev_job_id, _user_id, event)) => {
+                Ok((ev_job_id, event)) => {
                    if ev_job_id != job_id {
                        continue;
                    }

                    match event {
-                        AppEvent::JobMessage { role, content, .. } if role == "assistant" => {
+                        SseEvent::JobMessage { role, content, .. } if role == "assistant" => {
                            let mut msg = IncomingMessage::new(
                                route.channel.clone(),
                                route.user_id.clone(),
@@ -92,7 +92,7 @@ pub fn spawn_job_monitor_with_context(
                                break;
                            }
                        }
-                        AppEvent::JobResult { status, .. } => {
+                        SseEvent::JobResult { status, .. } => {
                            // Transition in-memory state so the job frees its
                            // max_jobs slot and query tools show the final state.
                            if let Some(ref cm) = context_manager {
@@ -162,7 +162,7 @@ pub fn spawn_job_monitor_with_context(
 /// inject messages into) but we still need to free the `max_jobs` slot.
 pub fn spawn_completion_watcher(
    job_id: Uuid,
-    mut event_rx: broadcast::Receiver<(Uuid, String, AppEvent)>,
+    mut event_rx: broadcast::Receiver<(Uuid, SseEvent)>,
    context_manager: Arc<ContextManager>,
 ) -> JoinHandle<()> {
    let short_id = job_id.to_string()[..8].to_string();
@@ -170,9 +170,7 @@ pub fn spawn_completion_watcher(
    tokio::spawn(async move {
        loop {
            match event_rx.recv().await {
-                Ok((ev_job_id, _user_id, AppEvent::JobResult { status, .. }))
-                    if ev_job_id == job_id =>
-                {
+                Ok((ev_job_id, SseEvent::JobResult { status, .. })) if ev_job_id == job_id => {
                    let target = if status == "completed" {
                        JobState::Completed
                    } else {
@@ -229,7 +227,7 @@ mod tests {

    #[tokio::test]
    async fn test_monitor_forwards_assistant_messages() {
-        let (event_tx, _) = broadcast::channel::<(Uuid, String, AppEvent)>(16);
+        let (event_tx, _) = broadcast::channel::<(Uuid, SseEvent)>(16);
        let (inject_tx, mut inject_rx) = mpsc::channel::<IncomingMessage>(16);

        let job_id = Uuid::new_v4();
@@ -239,8 +237,7 @@ mod tests {
        event_tx
            .send((
                job_id,
-                "test-user".to_string(),
-                AppEvent::JobMessage {
+                SseEvent::JobMessage {
                    job_id: job_id.to_string(),
                    role: "assistant".to_string(),
                    content: "I found a bug".to_string(),
@@ -262,7 +259,7 @@ mod tests {

    #[tokio::test]
    async fn test_monitor_ignores_other_jobs() {
-        let (event_tx, _) = broadcast::channel::<(Uuid, String, AppEvent)>(16);
+        let (event_tx, _) = broadcast::channel::<(Uuid, SseEvent)>(16);
        let (inject_tx, mut inject_rx) = mpsc::channel::<IncomingMessage>(16);

        let job_id = Uuid::new_v4();
@@ -273,8 +270,7 @@ mod tests {
        event_tx
            .send((
                other_job_id,
-                "test-user".to_string(),
-                AppEvent::JobMessage {
+                SseEvent::JobMessage {
                    job_id: other_job_id.to_string(),
                    role: "assistant".to_string(),
                    content: "wrong job".to_string(),
@@ -293,7 +289,7 @@ mod tests {

    #[tokio::test]
    async fn test_monitor_exits_on_job_result() {
-        let (event_tx, _) = broadcast::channel::<(Uuid, String, AppEvent)>(16);
+        let (event_tx, _) = broadcast::channel::<(Uuid, SseEvent)>(16);
        let (inject_tx, mut inject_rx) = mpsc::channel::<IncomingMessage>(16);

        let job_id = Uuid::new_v4();
@@ -303,8 +299,7 @@ mod tests {
        event_tx
            .send((
                job_id,
-                "test-user".to_string(),
-                AppEvent::JobResult {
+                SseEvent::JobResult {
                    job_id: job_id.to_string(),
                    status: "completed".to_string(),
                    session_id: None,
@@ -329,7 +324,7 @@ mod tests {

    #[tokio::test]
    async fn test_monitor_skips_tool_events() {
-        let (event_tx, _) = broadcast::channel::<(Uuid, String, AppEvent)>(16);
+        let (event_tx, _) = broadcast::channel::<(Uuid, SseEvent)>(16);
        let (inject_tx, mut inject_rx) = mpsc::channel::<IncomingMessage>(16);

        let job_id = Uuid::new_v4();
@@ -339,8 +334,7 @@ mod tests {
        event_tx
            .send((
                job_id,
-                "test-user".to_string(),
-                AppEvent::JobToolUse {
+                SseEvent::JobToolUse {
                    job_id: job_id.to_string(),
                    tool_name: "shell".to_string(),
                    input: serde_json::json!({"command": "ls"}),
@@ -352,8 +346,7 @@ mod tests {
        event_tx
            .send((
                job_id,
-                "test-user".to_string(),
-                AppEvent::JobMessage {
+                SseEvent::JobMessage {
                    job_id: job_id.to_string(),
                    role: "user".to_string(),
                    content: "user prompt".to_string(),
@@ -409,7 +402,7 @@ mod tests {
            .await
            .unwrap();

-        let (event_tx, _) = broadcast::channel::<(Uuid, String, AppEvent)>(16);
+        let (event_tx, _) = broadcast::channel::<(Uuid, SseEvent)>(16);
        let (inject_tx, mut inject_rx) = mpsc::channel::<IncomingMessage>(16);

        let handle = spawn_job_monitor_with_context(
@@ -424,8 +417,7 @@ mod tests {
        event_tx
            .send((
                job_id,
-                "test-user".to_string(),
-                AppEvent::JobResult {
+                SseEvent::JobResult {
                    job_id: job_id.to_string(),
                    status: "completed".to_string(),
                    session_id: None,
@@ -458,7 +450,7 @@ mod tests {
            .await
            .unwrap();

-        let (event_tx, _) = broadcast::channel::<(Uuid, String, AppEvent)>(16);
+        let (event_tx, _) = broadcast::channel::<(Uuid, SseEvent)>(16);
        let (inject_tx, mut inject_rx) = mpsc::channel::<IncomingMessage>(16);

        let handle = spawn_job_monitor_with_context(
@@ -473,8 +465,7 @@ mod tests {
        event_tx
            .send((
                job_id,
-                "test-user".to_string(),
-                AppEvent::JobResult {
+                SseEvent::JobResult {
                    job_id: job_id.to_string(),
                    status: "failed".to_string(),
                    session_id: None,
@@ -507,14 +498,13 @@ mod tests {
            .await
            .unwrap();

-        let (event_tx, _) = broadcast::channel::<(Uuid, String, AppEvent)>(16);
+        let (event_tx, _) = broadcast::channel::<(Uuid, SseEvent)>(16);
        let handle = spawn_completion_watcher(job_id, event_tx.subscribe(), Arc::clone(&cm));

        event_tx
            .send((
                job_id,
-                "test-user".to_string(),
-                AppEvent::JobResult {
+                SseEvent::JobResult {
                    job_id: job_id.to_string(),
                    status: "completed".to_string(),
                    session_id: None,
@@ -36,9 +36,7 @@ pub(crate) use agent_loop::truncate_for_preview;
 pub use agent_loop::{Agent, AgentDeps};
 pub use compaction::{CompactionResult, ContextCompactor};
 pub use context_monitor::{CompactionStrategy, ContextBreakdown, ContextMonitor};
-pub use heartbeat::{
-    HeartbeatConfig, HeartbeatResult, HeartbeatRunner, spawn_heartbeat, spawn_multi_user_heartbeat,
-};
+pub use heartbeat::{HeartbeatConfig, HeartbeatResult, HeartbeatRunner, spawn_heartbeat};
 pub use router::{MessageIntent, Router};
 pub use routine::{Routine, RoutineAction, RoutineRun, Trigger};
 pub use routine_engine::{RoutineEngine, SandboxReadiness};
@@ -18,22 +18,21 @@ use std::time::Duration;
 use chrono::Utc;
 use regex::Regex;
 use tokio::sync::{RwLock, mpsc};
-use tokio::task::JoinHandle;
 use uuid::Uuid;

 use crate::agent::Scheduler;
 use crate::agent::routine::{
    NotifyConfig, Routine, RoutineAction, RoutineRun, RunStatus, Trigger, next_cron_fire,
 };
-use crate::channels::{IncomingMessage, OutgoingResponse};
+use crate::channels::OutgoingResponse;
 use crate::config::RoutineConfig;
 use crate::context::{JobContext, JobState};
+use crate::db::Database;
 use crate::error::RoutineError;
 use crate::extensions::ExtensionManager;
 use crate::llm::{
    ChatMessage, CompletionRequest, FinishReason, LlmProvider, ToolCall, ToolCompletionRequest,
 };
-use crate::tenant::AdminScope;
 use crate::tools::{
    ToolError, ToolRegistry, autonomous_allowed_tool_names, autonomous_unavailable_message,
    prepare_tool_params,
@@ -46,11 +45,6 @@ enum EventMatcher {
    System { routine: Routine },
 }

-struct TriggeredRoutine {
-    routine: Routine,
-    detail: String,
-}
-
 /// Distinguishes why sandbox is unavailable so error messages are accurate.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum SandboxReadiness {
@@ -62,44 +56,10 @@ pub enum SandboxReadiness {
    DockerUnavailable,
 }

-/// Check whether an event-triggered routine's user/channel filters match an
-/// incoming message.
-///
-/// Returns `true` if:
-/// - The routine has an `Event` trigger (non-Event routines always return `false`)
-/// - The routine's `user_id` matches the message's user scope
-/// - The routine's channel filter (if any) matches the message channel
-///   case-insensitively
-///
-/// This is a pure function extracted from `check_event_triggers` so the
-/// filter logic can be unit-tested without async infrastructure.
-pub(crate) fn routine_matches_message(routine: &Routine, message: &IncomingMessage) -> bool {
-    // Only Event-triggered routines can match incoming messages.
-    if !matches!(routine.trigger, Trigger::Event { .. }) {
-        return false;
-    }
-
-    // User ownership filter — only fire routines scoped to this user.
-    if routine.user_id != message.user_id {
-        return false;
-    }
-
-    // Channel filter (case-insensitive, matching emit_system_event behavior)
-    if let Trigger::Event {
-        channel: Some(ch), ..
-    } = &routine.trigger
-        && !ch.eq_ignore_ascii_case(&message.channel)
-    {
-        return false;
-    }
-
-    true
-}
-
 /// The routine execution engine.
 pub struct RoutineEngine {
    config: RoutineConfig,
-    store: AdminScope,
+    store: Arc<dyn Database>,
    llm: Arc<dyn LlmProvider>,
    workspace: Arc<Workspace>,
    /// Sender for notifications (routed to channel manager).
@@ -128,7 +88,7 @@ impl RoutineEngine {
    #[allow(clippy::too_many_arguments)]
    pub fn new(
        config: RoutineConfig,
-        store: AdminScope,
+        store: Arc<dyn Database>,
        llm: Arc<dyn LlmProvider>,
        workspace: Arc<Workspace>,
        notify_tx: mpsc::Sender<OutgoingResponse>,
@@ -207,45 +167,10 @@ impl RoutineEngine {
    }

    /// Check incoming message against event triggers. Returns number of routines fired.
-    pub async fn check_event_triggers(&self, message: &IncomingMessage, content: &str) -> usize {
-        let triggered = self.matching_event_triggers(message, content).await;
-        let fired = triggered.len();
-        for triggered in triggered {
-            std::mem::drop(self.spawn_fire(triggered.routine, "event", Some(triggered.detail)));
-        }
-        fired
-    }
-
-    /// Fire matching event-triggered routines and wait for them to complete.
    ///
-    /// Used by single-message REPL mode so the process does not exit before
-    /// background event-triggered routines finish.
-    pub async fn check_event_triggers_and_wait(
-        &self,
-        message: &IncomingMessage,
-        content: &str,
-    ) -> usize {
-        let triggered = self.matching_event_triggers(message, content).await;
-        let fired = triggered.len();
-        let handles: Vec<JoinHandle<()>> = triggered
-            .into_iter()
-            .map(|triggered| self.spawn_fire(triggered.routine, "event", Some(triggered.detail)))
-            .collect();
-
-        for handle in handles {
-            if let Err(e) = handle.await {
-                tracing::warn!(error = %e, "Event-triggered routine task failed");
-            }
-        }
-
-        fired
-    }
-
-    async fn matching_event_triggers(
-        &self,
-        message: &IncomingMessage,
-        content: &str,
-    ) -> Vec<TriggeredRoutine> {
+    /// Accepts only the three fields needed for matching (user scope, channel,
+    /// message content) so callers never need to clone a full `IncomingMessage`.
+    pub async fn check_event_triggers(&self, user_id: &str, channel: &str, content: &str) -> usize {
        let cache = self.event_cache.read().await;

        // Early return if there are no message matchers at all.
@@ -253,9 +178,10 @@ impl RoutineEngine {
            .iter()
            .any(|m| matches!(m, EventMatcher::Message { .. }))
        {
-            return Vec::new();
+            return 0;
        }
-        let mut triggered = Vec::new();
+
+        let mut fired = 0;

        // Collect routine IDs for batch query
        let routine_ids: Vec<Uuid> = cache
@@ -267,13 +193,13 @@ impl RoutineEngine {
            .collect();

        if routine_ids.is_empty() {
-            return Vec::new();
+            return 0;
        }

        // Single batch query instead of N queries
        let concurrent_counts = match self.batch_concurrent_counts(&routine_ids).await {
            Some(counts) => counts,
-            None => return Vec::new(),
+            None => return 0,
        };

        for matcher in cache.iter() {
@@ -282,24 +208,16 @@ impl RoutineEngine {
                EventMatcher::System { .. } => continue,
            };

-            // User ownership + channel filter (extracted for testability).
-            if !routine_matches_message(routine, message) {
-                // User mismatch is expected for multi-user setups — keep at
-                // trace to avoid one log per routine per inbound message.
-                if routine.user_id != message.user_id {
-                    tracing::trace!(
-                        routine = %routine.name,
-                        routine_user = %routine.user_id,
-                        message_user = %message.user_id,
-                        "Skipped: user scope mismatch"
-                    );
-                } else {
-                    tracing::debug!(
-                        routine = %routine.name,
-                        channel = %message.channel,
-                        "Skipped: channel mismatch"
-                    );
-                }
+            if routine.user_id != user_id {
+                continue;
+            }
+
+            // Channel filter
+            if let Trigger::Event {
+                channel: Some(ch), ..
+            } = &routine.trigger
+                && ch != channel
+            {
                continue;
            }

@@ -310,14 +228,14 @@ impl RoutineEngine {

            // Cooldown check
            if !self.check_cooldown(routine) {
-                tracing::debug!(routine = %routine.name, "Skipped: cooldown active");
+                tracing::trace!(routine = %routine.name, "Skipped: cooldown active");
                continue;
            }

            // Concurrent run check (using batch-loaded counts)
            let running_count = concurrent_counts.get(&routine.id).copied().unwrap_or(0);
            if running_count >= routine.guardrails.max_concurrent as i64 {
-                tracing::debug!(routine = %routine.name, "Skipped: max concurrent reached");
+                tracing::trace!(routine = %routine.name, "Skipped: max concurrent reached");
                continue;
            }

@@ -328,13 +246,11 @@ impl RoutineEngine {
            }

            let detail = truncate(content, 200);
-            triggered.push(TriggeredRoutine {
-                routine: routine.clone(),
-                detail,
-            });
+            self.spawn_fire(routine.clone(), "event", Some(detail));
+            fired += 1;
        }

-        triggered
+        fired
    }

    /// Emit a structured event to system-event routines.
@@ -782,22 +698,12 @@ impl RoutineEngine {
            });
        }

-        // Per-user workspace (same pattern as spawn_fire).
-        let routine_workspace = if routine.user_id == self.workspace.user_id() {
-            self.workspace.clone()
-        } else {
-            Arc::new(Workspace::new_with_db(
-                &routine.user_id,
-                Arc::clone(self.store.db()),
-            ))
-        };
-
        // Execute inline for manual triggers (caller wants to wait)
        let engine = EngineContext {
            config: self.config.clone(),
            store: self.store.clone(),
            llm: self.llm.clone(),
-            workspace: routine_workspace,
+            workspace: self.workspace.clone(),
            notify_tx: self.notify_tx.clone(),
            running_count: self.running_count.clone(),
            scheduler: self.scheduler.clone(),
@@ -900,12 +806,7 @@ impl RoutineEngine {
    }

    /// Spawn a fire in a background task.
-    fn spawn_fire(
-        &self,
-        routine: Routine,
-        trigger_type: &str,
-        trigger_detail: Option<String>,
-    ) -> JoinHandle<()> {
+    fn spawn_fire(&self, routine: Routine, trigger_type: &str, trigger_detail: Option<String>) {
        let run = RoutineRun {
            id: Uuid::new_v4(),
            routine_id: routine.id,
@@ -920,23 +821,11 @@ impl RoutineEngine {
            created_at: Utc::now(),
        };

-        // Use per-user workspace so each routine executes in the correct
-        // user's context. Fall back to the engine-wide workspace when the
-        // routine belongs to the same user (avoids unnecessary allocation).
-        let routine_workspace = if routine.user_id == self.workspace.user_id() {
-            self.workspace.clone()
-        } else {
-            Arc::new(Workspace::new_with_db(
-                &routine.user_id,
-                Arc::clone(self.store.db()),
-            ))
-        };
-
        let engine = EngineContext {
            config: self.config.clone(),
            store: self.store.clone(),
            llm: self.llm.clone(),
-            workspace: routine_workspace,
+            workspace: self.workspace.clone(),
            notify_tx: self.notify_tx.clone(),
            running_count: self.running_count.clone(),
            scheduler: self.scheduler.clone(),
@@ -954,7 +843,7 @@ impl RoutineEngine {
                return;
            }
            execute_routine(engine, routine, run).await;
-        })
+        });
    }

    fn check_cooldown(&self, routine: &Routine) -> bool {
@@ -989,7 +878,7 @@ impl RoutineEngine {
 /// an active state (Pending/InProgress/Stuck). Maps the final `JobState` to
 /// a `RunStatus` for the routine run.
 struct FullJobWatcher {
-    store: AdminScope,
+    store: Arc<dyn Database>,
    job_id: Uuid,
    routine_name: String,
 }
@@ -1000,7 +889,7 @@ impl FullJobWatcher {
    /// Safety ceiling: 24 hours, derived from POLL_INTERVAL.
    const MAX_POLLS: u32 = (24 * 60 * 60) / Self::POLL_INTERVAL.as_secs() as u32;

-    fn new(store: AdminScope, job_id: Uuid, routine_name: String) -> Self {
+    fn new(store: Arc<dyn Database>, job_id: Uuid, routine_name: String) -> Self {
        Self {
            store,
            job_id,
@@ -1072,7 +961,7 @@ impl FullJobWatcher {
 /// Shared context passed to the execution function.
 struct EngineContext {
    config: RoutineConfig,
-    store: AdminScope,
+    store: Arc<dyn Database>,
    llm: Arc<dyn LlmProvider>,
    workspace: Arc<Workspace>,
    notify_tx: mpsc::Sender<OutgoingResponse>,
@@ -1416,19 +1305,6 @@ async fn execute_lightweight(
    }
 }

-/// Sanitize a user-controlled string before interpolation into an LLM prompt.
-/// Strips newlines (which could break prompt structure) and truncates to a
-/// reasonable length to limit abuse surface.
-fn sanitize_prompt_field(value: &str) -> String {
-    const MAX_LEN: usize = 128;
-    value
-        .chars()
-        .filter(|&c| c != '\n' && c != '\r')
-        .take(MAX_LEN)
-        .map(|c| if c == '`' { '\'' } else { c })
-        .collect()
-}
-
 fn build_lightweight_prompt(
    prompt: &str,
    context_parts: &[String],
@@ -1447,16 +1323,14 @@ fn build_lightweight_prompt(
        );

        if let Some(channel) = notify.channel.as_deref() {
-            let sanitized = sanitize_prompt_field(channel);
            full_prompt.push_str(&format!(
-                "The configured delivery channel for this routine is `{sanitized}`.\n"
+                "The configured delivery channel for this routine is `{channel}`.\n"
            ));
        }

        if let Some(user) = notify.user.as_deref() {
-            let sanitized = sanitize_prompt_field(user);
            full_prompt.push_str(&format!(
-                "The configured delivery target for this routine is `{sanitized}`.\n"
+                "The configured delivery target for this routine is `{user}`.\n"
            ));
        }

@@ -1566,7 +1440,6 @@ fn handle_text_response(
 /// This is a simplified version of the full dispatcher loop:
 /// - Max 3-5 iterations (configurable)
 /// - Sequential tool execution (not parallel)
-/// - Uses the owner's live autonomous tool scope when lightweight tools are enabled
 /// - Auto-approval of non-Always tools
 /// - No hooks or approval dialogs
 async fn execute_lightweight_with_tools(
@@ -1613,10 +1486,7 @@ async fn execute_lightweight_with_tools(
        let force_text = iteration >= max_iterations;

        if force_text {
-            // Final iteration: no tools, just get text response.
-            // Claude 4.6 rejects assistant prefill; NEAR AI rejects any non-user-ending
-            // conversation. Ensure the last message is user-role.
-            crate::util::ensure_ends_with_user_message(&mut messages);
+            // Final iteration: no tools, just get text response
            let request = CompletionRequest::new(messages)
                .with_max_tokens(effective_max_tokens)
                .with_temperature(0.3);
@@ -1895,13 +1765,6 @@ pub fn spawn_cron_ticker(
        engine.check_cron_triggers().await;

        let mut ticker = tokio::time::interval(interval);
-        ticker.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
-        // Periodic event cache refresh so web/CLI mutations are picked up
-        // without requiring tool-path code to call refresh_event_cache().
-        // Uses wall-clock elapsed time so the refresh cadence is stable
-        // regardless of the cron tick interval configuration.
-        let refresh_interval = Duration::from_secs(60);
-        let mut last_refresh = tokio::time::Instant::now();

        loop {
            ticker.tick().await;
@@ -1909,11 +1772,7 @@ pub fn spawn_cron_ticker(
            // never races with FullJobWatcher instances from this process.
            engine.sync_dispatched_runs().await;
            engine.check_cron_triggers().await;
-
-            if last_refresh.elapsed() >= refresh_interval {
-                engine.refresh_event_cache().await;
-                last_refresh = tokio::time::Instant::now();
-            }
+            engine.sync_dispatched_runs().await;
        }
    })
 }
@@ -1979,13 +1838,7 @@ fn strip_html_tags(s: &str) -> String {

 #[cfg(test)]
 mod tests {
-    use chrono::Utc;
-    use uuid::Uuid;
-
-    use crate::agent::routine::{
-        NotifyConfig, Routine, RoutineAction, RoutineGuardrails, RunStatus, Trigger,
-    };
-    use crate::channels::IncomingMessage;
+    use crate::agent::routine::{NotifyConfig, RunStatus};
    use crate::config::RoutineConfig;

    #[test]
@@ -2183,117 +2036,6 @@ mod tests {
        }
    }

-    /// Helper to build a test routine with the given user_id and trigger.
-    fn make_routine(user_id: &str, trigger: Trigger) -> Routine {
-        Routine {
-            id: Uuid::new_v4(),
-            name: "test".to_string(),
-            description: String::new(),
-            user_id: user_id.to_string(),
-            enabled: true,
-            trigger,
-            action: RoutineAction::Lightweight {
-                prompt: String::new(),
-                context_paths: vec![],
-                max_tokens: 1000,
-                use_tools: false,
-                max_tool_rounds: 0,
-            },
-            guardrails: RoutineGuardrails::default(),
-            notify: Default::default(),
-            last_run_at: None,
-            next_fire_at: None,
-            run_count: 0,
-            consecutive_failures: 0,
-            state: serde_json::Value::Null,
-            created_at: Utc::now(),
-            updated_at: Utc::now(),
-        }
-    }
-
-    /// Helper to build a test IncomingMessage.
-    fn make_message(user_id: &str, channel: &str, content: &str) -> IncomingMessage {
-        IncomingMessage {
-            id: Uuid::new_v4(),
-            channel: channel.to_string(),
-            user_id: user_id.to_string(),
-            owner_id: user_id.to_string(),
-            sender_id: user_id.to_string(),
-            user_name: None,
-            content: content.to_string(),
-            thread_id: None,
-            conversation_scope_id: None,
-            received_at: Utc::now(),
-            metadata: serde_json::Value::Null,
-            timezone: None,
-            attachments: vec![],
-            is_internal: false,
-        }
-    }
-
-    /// Regression test for issue #1051: event triggers used case-sensitive
-    /// channel comparison, so "Telegram" != "telegram" caused silent mismatch.
-    /// Tests the actual `routine_matches_message` function used in `check_event_triggers`.
-    #[test]
-    fn test_channel_filter_is_case_insensitive() {
-        let routine = make_routine(
-            "user1",
-            Trigger::Event {
-                pattern: ".*".to_string(),
-                channel: Some("Telegram".to_string()),
-            },
-        );
-        let msg = make_message("user1", "telegram", "hello");
-
-        // Case-insensitive channel match must succeed
-        assert!(super::routine_matches_message(&routine, &msg));
-
-        // Exact case must also work
-        let msg_exact = make_message("user1", "Telegram", "hello");
-        assert!(super::routine_matches_message(&routine, &msg_exact));
-
-        // Different channel must not match
-        let msg_wrong = make_message("user1", "discord", "hello");
-        assert!(!super::routine_matches_message(&routine, &msg_wrong));
-    }
-
-    /// Regression test for issue #1051: event triggers did not filter by
-    /// user_id, so routines from user A could fire on messages from user B.
-    /// Tests the actual `routine_matches_message` function used in `check_event_triggers`.
-    #[test]
-    fn test_event_trigger_requires_user_match() {
-        let routine = make_routine(
-            "alice",
-            Trigger::Event {
-                pattern: ".*".to_string(),
-                channel: None,
-            },
-        );
-
-        // Different user must not match
-        let msg_bob = make_message("bob", "telegram", "hello");
-        assert!(!super::routine_matches_message(&routine, &msg_bob));
-
-        // Same user must match
-        let msg_alice = make_message("alice", "telegram", "hello");
-        assert!(super::routine_matches_message(&routine, &msg_alice));
-    }
-
-    /// When no channel filter is set, any channel should match (given user matches).
-    #[test]
-    fn test_no_channel_filter_matches_any_channel() {
-        let routine = make_routine(
-            "user1",
-            Trigger::Event {
-                pattern: ".*".to_string(),
-                channel: None,
-            },
-        );
-
-        let msg = make_message("user1", "whatever_channel", "hello");
-        assert!(super::routine_matches_message(&routine, &msg));
-    }
-
    #[test]
    fn test_routine_tool_denylist_blocks_self_management_tools() {
        let denylisted = vec![
@@ -9,14 +9,15 @@ use tokio::task::JoinHandle;
 use uuid::Uuid;

 use crate::agent::task::{Task, TaskContext, TaskOutput};
+use crate::channels::web::types::SseEvent;
 use crate::config::AgentConfig;
 use crate::context::{ContextManager, JobContext, JobState};
+use crate::db::Database;
 use crate::error::{Error, JobError};
 use crate::extensions::ExtensionManager;
 use crate::hooks::HookRegistry;
 use crate::llm::LlmProvider;
 use crate::safety::SafetyLayer;
-use crate::tenant::AdminScope;
 use crate::tools::{
    ApprovalContext, ToolRegistry, autonomous_allowed_tool_names, autonomous_unavailable_error,
    prepare_tool_params,
@@ -52,7 +53,7 @@ struct ScheduledSubtask {
 pub struct SchedulerDeps {
    pub tools: Arc<ToolRegistry>,
    pub extension_manager: Option<Arc<ExtensionManager>>,
-    pub store: Option<AdminScope>,
+    pub store: Option<Arc<dyn Database>>,
    pub hooks: Arc<HookRegistry>,
 }

@@ -64,10 +65,10 @@ pub struct Scheduler {
    safety: Arc<SafetyLayer>,
    tools: Arc<ToolRegistry>,
    extension_manager: Option<Arc<ExtensionManager>>,
-    store: Option<AdminScope>,
+    store: Option<Arc<dyn Database>>,
    hooks: Arc<HookRegistry>,
-    /// SSE manager for live job event streaming.
-    sse_tx: Option<Arc<crate::channels::web::sse::SseManager>>,
+    /// SSE broadcast sender for live job event streaming.
+    sse_tx: Option<tokio::sync::broadcast::Sender<SseEvent>>,
    /// HTTP interceptor for trace recording/replay (propagated to workers).
    http_interceptor: Option<Arc<dyn crate::llm::recording::HttpInterceptor>>,
    /// Running jobs (main LLM-driven jobs).
@@ -101,9 +102,9 @@ impl Scheduler {
        }
    }

-    /// Set the SSE manager for live job event streaming.
-    pub fn set_sse_sender(&mut self, sse: Arc<crate::channels::web::sse::SseManager>) {
-        self.sse_tx = Some(sse);
+    /// Set the SSE broadcast sender for live job event streaming.
+    pub fn set_sse_sender(&mut self, tx: tokio::sync::broadcast::Sender<SseEvent>) {
+        self.sse_tx = Some(tx);
    }

    /// Set the HTTP interceptor for trace recording/replay.
@@ -780,14 +781,10 @@ mod tests {
            allow_local_tools: true,
            max_cost_per_day_cents: None,
            max_actions_per_hour: None,
-            max_cost_per_user_per_day_cents: None,
            max_tool_iterations: 10,
            auto_approve_tools: true,
            default_timezone: "UTC".to_string(),
            max_tokens_per_job,
-            multi_tenant: false,
-            max_llm_concurrent_per_user: None,
-            max_jobs_concurrent_per_user: None,
        };
        let cm = Arc::new(ContextManager::new(5));
        let llm: Arc<dyn LlmProvider> = Arc::new(StubLlm);
@@ -8,8 +8,8 @@ use chrono::{DateTime, Utc};
 use uuid::Uuid;

 use crate::context::{ContextManager, JobState};
+use crate::db::Database;
 use crate::error::RepairError;
-use crate::tenant::AdminScope;
 use crate::tools::{BuildRequirement, Language, SoftwareBuilder, SoftwareType, ToolRegistry};

 /// A job that has been detected as stuck.
@@ -69,7 +69,7 @@ pub struct DefaultSelfRepair {
    /// Jobs in `InProgress` longer than this are treated as stuck.
    stuck_threshold: Duration,
    max_repair_attempts: u32,
-    store: Option<AdminScope>,
+    store: Option<Arc<dyn Database>>,
    builder: Option<Arc<dyn SoftwareBuilder>>,
    tools: Option<Arc<ToolRegistry>>,
 }
@@ -91,8 +91,8 @@ impl DefaultSelfRepair {
        }
    }

-    /// Add an admin-scoped store for tool failure tracking.
-    pub fn with_store(mut self, store: AdminScope) -> Self {
+    /// Add a Store for tool failure tracking.
+    pub fn with_store(mut self, store: Arc<dyn Database>) -> Self {
        self.store = Some(store);
        self
    }
@@ -806,7 +806,7 @@ mod tests {
        // Create self-repair with zero threshold (detect immediately),
        // wired with store, builder, and tools.
        let repair = DefaultSelfRepair::new(Arc::clone(&cm), Duration::from_secs(0), 3)
-            .with_store(crate::tenant::AdminScope::new(Arc::clone(&db)))
+            .with_store(Arc::clone(&db))
            .with_builder(
                Arc::clone(&builder) as Arc<dyn crate::tools::SoftwareBuilder>,
                tools,
@@ -16,8 +16,8 @@ use chrono::{DateTime, TimeDelta, Utc};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;

+use crate::channels::web::util::truncate_preview;
 use crate::llm::{ChatMessage, ToolCall, generate_tool_call_id};
-use ironclaw_common::truncate_preview;

 /// A session containing one or more threads.
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -68,8 +68,8 @@ impl Session {
    }

    /// Create a new thread in this session.
-    pub fn create_thread(&mut self) -> &mut Thread {
-        let thread = Thread::new(self.id);
+    pub fn create_thread(&mut self, channel: &str) -> &mut Thread {
+        let thread = Thread::new(self.id, Some(channel));
        let thread_id = thread.id;
        self.active_thread = Some(thread_id);
        self.last_active_at = Utc::now();
@@ -87,9 +87,9 @@ impl Session {
    }

    /// Get or create the active thread.
-    pub fn get_or_create_thread(&mut self) -> &mut Thread {
+    pub fn get_or_create_thread(&mut self, channel: &str) -> &mut Thread {
        match self.active_thread {
-            None => self.create_thread(),
+            None => self.create_thread(channel),
            Some(id) => {
                if self.threads.contains_key(&id) {
                    // Entry existence confirmed by contains_key above.
@@ -100,7 +100,7 @@ impl Session {
                } else {
                    // Stale active_thread ID: create a new thread, which
                    // updates self.active_thread to the new thread's ID.
-                    self.create_thread()
+                    self.create_thread(channel)
                }
            }
        }
@@ -225,6 +225,9 @@ pub struct Thread {
    /// Messages queued while the thread was processing a turn.
    #[serde(default, skip_serializing_if = "VecDeque::is_empty")]
    pub pending_messages: VecDeque<String>,
+    /// Channel that created this thread (for approval authorization).
+    #[serde(default)]
+    pub source_channel: Option<String>,
 }

 /// Maximum number of messages that can be queued while a thread is processing.
@@ -235,7 +238,7 @@ pub const MAX_PENDING_MESSAGES: usize = 10;

 impl Thread {
    /// Create a new thread.
-    pub fn new(session_id: Uuid) -> Self {
+    pub fn new(session_id: Uuid, source_channel: Option<&str>) -> Self {
        let now = Utc::now();
        Self {
            id: Uuid::new_v4(),
@@ -248,11 +251,12 @@ impl Thread {
            pending_approval: None,
            pending_auth: None,
            pending_messages: VecDeque::new(),
+            source_channel: source_channel.map(String::from),
        }
    }

    /// Create a thread with a specific ID (for DB hydration).
-    pub fn with_id(id: Uuid, session_id: Uuid) -> Self {
+    pub fn with_id(id: Uuid, session_id: Uuid, source_channel: Option<&str>) -> Self {
        let now = Utc::now();
        Self {
            id,
@@ -265,6 +269,7 @@ impl Thread {
            pending_approval: None,
            pending_auth: None,
            pending_messages: VecDeque::new(),
+            source_channel: source_channel.map(String::from),
        }
    }

@@ -449,7 +454,6 @@ impl Thread {
                        id: call_id.clone(),
                        name: tc.name.clone(),
                        arguments: tc.parameters.clone(),
-                        reasoning: None,
                    })
                    .collect();

@@ -523,12 +527,7 @@ impl Thread {
                            && let Some(ref tcs) = assistant_msg.tool_calls
                        {
                            for tc in tcs {
-                                turn.record_tool_call_with_reasoning(
-                                    &tc.name,
-                                    tc.arguments.clone(),
-                                    tc.reasoning.clone(),
-                                    Some(tc.id.clone()),
-                                );
+                                turn.record_tool_call(&tc.name, tc.arguments.clone());
                            }
                        }

@@ -608,10 +607,6 @@ pub struct Turn {
    pub completed_at: Option<DateTime<Utc>>,
    /// Error message (if failed).
    pub error: Option<String>,
-    /// Agent's reasoning narrative for this turn.
-    /// Cleaned via `clean_response` and sanitized through `SafetyLayer` before storage.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub narrative: Option<String>,
    /// Transient image content parts for multimodal LLM input.
    /// Not serialized — images are only needed for the current LLM call.
    /// The text description in `user_input` persists for compaction/context.
@@ -631,7 +626,6 @@ impl Turn {
            started_at: Utc::now(),
            completed_at: None,
            error: None,
-            narrative: None,
            image_content_parts: Vec::new(),
        }
    }
@@ -667,26 +661,6 @@ impl Turn {
            parameters: params,
            result: None,
            error: None,
-            rationale: None,
-            tool_call_id: None,
-        });
-    }
-
-    /// Record a tool call with reasoning context.
-    pub fn record_tool_call_with_reasoning(
-        &mut self,
-        name: impl Into<String>,
-        params: serde_json::Value,
-        rationale: Option<String>,
-        tool_call_id: Option<String>,
-    ) {
-        self.tool_calls.push(TurnToolCall {
-            name: name.into(),
-            parameters: params,
-            result: None,
-            error: None,
-            rationale,
-            tool_call_id,
        });
    }

@@ -703,60 +677,6 @@ impl Turn {
            call.error = Some(error.into());
        }
    }
-
-    /// Record a tool result by tool_call_id, with fallback to first pending call.
-    pub fn record_tool_result_for(&mut self, tool_call_id: &str, result: serde_json::Value) {
-        if let Some(call) = self
-            .tool_calls
-            .iter_mut()
-            .find(|c| c.tool_call_id.as_deref() == Some(tool_call_id))
-        {
-            call.result = Some(result);
-        } else if let Some(call) = self
-            .tool_calls
-            .iter_mut()
-            .find(|c| c.result.is_none() && c.error.is_none())
-        {
-            tracing::debug!(
-                tool_call_id = %tool_call_id,
-                fallback_tool = %call.name,
-                "tool_call_id not found, falling back to first pending call"
-            );
-            call.result = Some(result);
-        } else {
-            tracing::warn!(
-                tool_call_id = %tool_call_id,
-                "Tool result dropped: no matching or pending tool call"
-            );
-        }
-    }
-
-    /// Record a tool error by tool_call_id, with fallback to first pending call.
-    pub fn record_tool_error_for(&mut self, tool_call_id: &str, error: impl Into<String>) {
-        if let Some(call) = self
-            .tool_calls
-            .iter_mut()
-            .find(|c| c.tool_call_id.as_deref() == Some(tool_call_id))
-        {
-            call.error = Some(error.into());
-        } else if let Some(call) = self
-            .tool_calls
-            .iter_mut()
-            .find(|c| c.result.is_none() && c.error.is_none())
-        {
-            tracing::debug!(
-                tool_call_id = %tool_call_id,
-                fallback_tool = %call.name,
-                "tool_call_id not found, falling back to first pending call"
-            );
-            call.error = Some(error.into());
-        } else {
-            tracing::warn!(
-                tool_call_id = %tool_call_id,
-                "Tool error dropped: no matching or pending tool call"
-            );
-        }
-    }
 }

 /// Record of a tool call made during a turn.
@@ -770,12 +690,6 @@ pub struct TurnToolCall {
    pub result: Option<serde_json::Value>,
    /// Error from the tool (if failed).
    pub error: Option<String>,
-    /// Agent's reasoning for choosing this tool.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub rationale: Option<String>,
-    /// The tool_call_id from the LLM, for identity-based result matching.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tool_call_id: Option<String>,
 }

 #[cfg(test)]
@@ -787,13 +701,13 @@ mod tests {
        let mut session = Session::new("user-123");
        assert!(session.active_thread.is_none());

-        session.create_thread();
+        session.create_thread("test");
        assert!(session.active_thread.is_some());
    }

    #[test]
    fn test_thread_turns() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("Hello");
        assert_eq!(thread.state, ThreadState::Processing);
@@ -806,7 +720,7 @@ mod tests {

    #[test]
    fn test_thread_messages() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("First message");
        thread.complete_turn("First response");
@@ -829,7 +743,7 @@ mod tests {

    #[test]
    fn test_restore_from_messages() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // First add some turns
        thread.start_turn("Original message");
@@ -855,7 +769,7 @@ mod tests {

    #[test]
    fn test_restore_from_messages_incomplete_turn() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Messages with incomplete last turn (no assistant response)
        let messages = vec![
@@ -874,7 +788,7 @@ mod tests {
    #[test]
    fn test_enter_auth_mode() {
        let before = Utc::now();
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        assert!(thread.pending_auth.is_none());

        thread.enter_auth_mode("telegram".to_string());
@@ -887,7 +801,7 @@ mod tests {

    #[test]
    fn test_take_pending_auth() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        thread.enter_auth_mode("notion".to_string());

        let pending = thread.take_pending_auth();
@@ -902,7 +816,7 @@ mod tests {

    #[test]
    fn test_pending_auth_serialization() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        thread.enter_auth_mode("openai".to_string());

        let json = serde_json::to_string(&thread).expect("should serialize");
@@ -932,7 +846,7 @@ mod tests {
    #[test]
    fn test_pending_auth_default_none() {
        // Deserialization of old data without pending_auth should default to None
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        thread.pending_auth = None;
        let json = serde_json::to_string(&thread).expect("serialize");

@@ -946,7 +860,7 @@ mod tests {
    fn test_thread_with_id() {
        let specific_id = Uuid::new_v4();
        let session_id = Uuid::new_v4();
-        let thread = Thread::with_id(specific_id, session_id);
+        let thread = Thread::with_id(specific_id, session_id, None);

        assert_eq!(thread.id, specific_id);
        assert_eq!(thread.session_id, session_id);
@@ -958,7 +872,7 @@ mod tests {
    fn test_thread_with_id_restore_messages() {
        let thread_id = Uuid::new_v4();
        let session_id = Uuid::new_v4();
-        let mut thread = Thread::with_id(thread_id, session_id);
+        let mut thread = Thread::with_id(thread_id, session_id, None);

        let messages = vec![
            ChatMessage::user("Hello from DB"),
@@ -977,7 +891,7 @@ mod tests {

    #[test]
    fn test_restore_from_messages_empty() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Add a turn first, then restore with empty vec
        thread.start_turn("hello");
@@ -993,7 +907,7 @@ mod tests {

    #[test]
    fn test_restore_from_messages_only_assistant_messages() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Only assistant messages (no user messages to anchor turns)
        let messages = vec![
@@ -1010,7 +924,7 @@ mod tests {

    #[test]
    fn test_restore_from_messages_multiple_user_messages_in_a_row() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Two user messages with no assistant response between them
        let messages = vec![
@@ -1037,8 +951,8 @@ mod tests {
    fn test_thread_switch() {
        let mut session = Session::new("user-1");

-        let t1_id = session.create_thread().id;
-        let t2_id = session.create_thread().id;
+        let t1_id = session.create_thread("test").id;
+        let t2_id = session.create_thread("test").id;

        // After creating two threads, active should be the last one
        assert_eq!(session.active_thread, Some(t2_id));
@@ -1058,8 +972,8 @@ mod tests {
    fn test_get_or_create_thread_idempotent() {
        let mut session = Session::new("user-1");

-        let tid1 = session.get_or_create_thread().id;
-        let tid2 = session.get_or_create_thread().id;
+        let tid1 = session.get_or_create_thread("test").id;
+        let tid2 = session.get_or_create_thread("test").id;

        // Should return the same thread (not create a new one each time)
        assert_eq!(tid1, tid2);
@@ -1068,7 +982,7 @@ mod tests {

    #[test]
    fn test_truncate_turns() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        for i in 0..5 {
            thread.start_turn(format!("msg-{}", i));
@@ -1092,7 +1006,7 @@ mod tests {

    #[test]
    fn test_truncate_turns_noop_when_fewer() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("only one");
        thread.complete_turn("response");
@@ -1104,7 +1018,7 @@ mod tests {

    #[test]
    fn test_thread_interrupt_and_resume() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("do something");
        assert_eq!(thread.state, ThreadState::Processing);
@@ -1122,7 +1036,7 @@ mod tests {

    #[test]
    fn test_resume_only_from_interrupted() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Idle thread: resume should be a no-op
        assert_eq!(thread.state, ThreadState::Idle);
@@ -1138,7 +1052,7 @@ mod tests {

    #[test]
    fn test_turn_fail() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("risky operation");
        thread.fail_turn("connection timed out");
@@ -1154,7 +1068,7 @@ mod tests {

    #[test]
    fn test_messages_with_incomplete_last_turn() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("first");
        thread.complete_turn("first reply");
@@ -1170,7 +1084,7 @@ mod tests {

    #[test]
    fn test_thread_serialization_round_trip() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("hello");
        thread.complete_turn("world");
@@ -1188,7 +1102,7 @@ mod tests {
    #[test]
    fn test_session_serialization_round_trip() {
        let mut session = Session::new("user-ser");
-        session.create_thread();
+        session.create_thread("test");
        session.auto_approve_tool("echo");

        let json = serde_json::to_string(&session).unwrap();
@@ -1226,7 +1140,7 @@ mod tests {

    #[test]
    fn test_turn_number_increments() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Before any turns, turn_number() is 1 (1-indexed for display)
        assert_eq!(thread.turn_number(), 1);
@@ -1241,7 +1155,7 @@ mod tests {

    #[test]
    fn test_complete_turn_on_empty_thread() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Completing a turn when there are no turns should be a safe no-op
        thread.complete_turn("phantom response");
@@ -1251,7 +1165,7 @@ mod tests {

    #[test]
    fn test_fail_turn_on_empty_thread() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Failing a turn when there are no turns should be a safe no-op
        thread.fail_turn("phantom error");
@@ -1261,7 +1175,7 @@ mod tests {

    #[test]
    fn test_pending_approval_flow() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        let approval = PendingApproval {
            request_id: Uuid::new_v4(),
@@ -1288,7 +1202,7 @@ mod tests {

    #[test]
    fn test_clear_pending_approval() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        let approval = PendingApproval {
            request_id: Uuid::new_v4(),
@@ -1317,7 +1231,7 @@ mod tests {
        assert!(session.active_thread().is_none());
        assert!(session.active_thread_mut().is_none());

-        let tid = session.create_thread().id;
+        let tid = session.create_thread("test").id;

        assert!(session.active_thread().is_some());
        assert_eq!(session.active_thread().unwrap().id, tid);
@@ -1334,7 +1248,7 @@ mod tests {

    #[test]
    fn test_messages_includes_tool_calls() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("Search for X");
        {
@@ -1366,7 +1280,7 @@ mod tests {

    #[test]
    fn test_messages_multiple_tool_calls_per_turn() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("Do two things");
        {
@@ -1393,14 +1307,13 @@ mod tests {

    #[test]
    fn test_restore_from_messages_with_tool_calls() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        // Build a message sequence with tool calls
        let tc = ToolCall {
            id: "call_0".to_string(),
            name: "search".to_string(),
            arguments: serde_json::json!({"q": "test"}),
-            reasoning: None,
        };
        let messages = vec![
            ChatMessage::user("Find test"),
@@ -1425,13 +1338,12 @@ mod tests {

    #[test]
    fn test_restore_from_messages_with_tool_error() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        let tc = ToolCall {
            id: "call_0".to_string(),
            name: "http".to_string(),
            arguments: serde_json::json!({}),
-            reasoning: None,
        };
        let messages = vec![
            ChatMessage::user("Fetch URL"),
@@ -1456,7 +1368,7 @@ mod tests {
    fn test_messages_round_trip_with_tools() {
        // Build a thread with tool calls, get messages(), restore, get messages() again
        // The two message sequences should be equivalent.
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("Do search");
        {
@@ -1469,7 +1381,7 @@ mod tests {
        let messages_original = thread.messages();

        // Restore into a new thread
-        let mut thread2 = Thread::new(Uuid::new_v4());
+        let mut thread2 = Thread::new(Uuid::new_v4(), None);
        thread2.restore_from_messages(messages_original.clone());

        let messages_restored = thread2.messages();
@@ -1491,19 +1403,17 @@ mod tests {

    #[test]
    fn test_restore_multi_stage_tool_calls() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        let tc1 = ToolCall {
            id: "call_a".to_string(),
            name: "search".to_string(),
            arguments: serde_json::json!({"q": "data"}),
-            reasoning: None,
        };
        let tc2 = ToolCall {
            id: "call_b".to_string(),
            name: "write".to_string(),
            arguments: serde_json::json!({"path": "out.txt"}),
-            reasoning: None,
        };
        let messages = vec![
            ChatMessage::user("Find and save"),
@@ -1534,7 +1444,7 @@ mod tests {

    #[test]
    fn test_messages_truncates_large_tool_results() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

        thread.start_turn("Read big file");
        {
@@ -1557,13 +1467,11 @@ mod tests {

    #[test]
    fn test_thread_message_queue() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

-        // Queue is initially empty
        assert!(thread.pending_messages.is_empty());
        assert!(thread.take_pending_message().is_none());

-        // Queue messages and verify FIFO ordering
        assert!(thread.queue_message("first".to_string()));
        assert!(thread.queue_message("second".to_string()));
        assert!(thread.queue_message("third".to_string()));
@@ -1574,17 +1482,14 @@ mod tests {
        assert_eq!(thread.take_pending_message(), Some("third".to_string()));
        assert!(thread.take_pending_message().is_none());

-        // Fill to capacity — all 10 should succeed
        for i in 0..MAX_PENDING_MESSAGES {
            assert!(thread.queue_message(format!("msg-{}", i)));
        }
        assert_eq!(thread.pending_messages.len(), MAX_PENDING_MESSAGES);

-        // 11th message rejected by queue_message itself
        assert!(!thread.queue_message("overflow".to_string()));
        assert_eq!(thread.pending_messages.len(), MAX_PENDING_MESSAGES);

-        // Drain and verify order
        for i in 0..MAX_PENDING_MESSAGES {
            assert_eq!(thread.take_pending_message(), Some(format!("msg-{}", i)));
        }
@@ -1593,13 +1498,11 @@ mod tests {

    #[test]
    fn test_thread_message_queue_serialization() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

-        // Empty queue should not appear in serialization (skip_serializing_if)
        let json = serde_json::to_string(&thread).unwrap();
        assert!(!json.contains("pending_messages"));

-        // Non-empty queue should serialize and deserialize
        thread.queue_message("queued msg".to_string());
        let json = serde_json::to_string(&thread).unwrap();
        assert!(json.contains("pending_messages"));
@@ -1612,11 +1515,9 @@ mod tests {

    #[test]
    fn test_thread_message_queue_default_on_old_data() {
-        // Deserialization of old data without pending_messages should default to empty
-        let thread = Thread::new(Uuid::new_v4());
+        let thread = Thread::new(Uuid::new_v4(), None);
        let json = serde_json::to_string(&thread).unwrap();

-        // The field is absent (skip_serializing_if), simulating old data
        assert!(!json.contains("pending_messages"));
        let restored: Thread = serde_json::from_str(&json).unwrap();
        assert!(restored.pending_messages.is_empty());
@@ -1624,18 +1525,15 @@ mod tests {

    #[test]
    fn test_interrupt_clears_pending_messages() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

-        // Start a turn so there's something to interrupt
        thread.start_turn("initial input");

-        // Queue several messages while "processing"
        thread.queue_message("queued-1".to_string());
        thread.queue_message("queued-2".to_string());
        thread.queue_message("queued-3".to_string());
        assert_eq!(thread.pending_messages.len(), 3);

-        // Interrupt should clear the queue
        thread.interrupt();
        assert!(thread.pending_messages.is_empty());
        assert_eq!(thread.state, ThreadState::Interrupted);
@@ -1643,27 +1541,22 @@ mod tests {

    #[test]
    fn test_thread_state_idle_after_full_drain() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

-        // Simulate a full drain cycle: start turn, queue messages, complete turn,
-        // then drain all queued messages as a single merged turn (#259).
        thread.start_turn("turn 1");
        assert_eq!(thread.state, ThreadState::Processing);

        thread.queue_message("queued-a".to_string());
        thread.queue_message("queued-b".to_string());

-        // Complete the turn (simulates process_user_input finishing)
        thread.complete_turn("response 1");
        assert_eq!(thread.state, ThreadState::Idle);

-        // Drain: merge all queued messages and process as a single turn
        let merged = thread.drain_pending_messages().unwrap();
        assert_eq!(merged, "queued-a\nqueued-b");
        thread.start_turn(&merged);
        thread.complete_turn("response for merged");

-        // Queue is fully drained, thread is idle
        assert!(thread.drain_pending_messages().is_none());
        assert!(thread.pending_messages.is_empty());
        assert_eq!(thread.state, ThreadState::Idle);
@@ -1671,12 +1564,10 @@ mod tests {

    #[test]
    fn test_drain_pending_messages_merges_with_newlines() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

-        // Empty queue returns None
        assert!(thread.drain_pending_messages().is_none());

-        // Single message returned as-is (no trailing newline)
        thread.queue_message("only one".to_string());
        assert_eq!(
            thread.drain_pending_messages(),
@@ -1684,7 +1575,6 @@ mod tests {
        );
        assert!(thread.pending_messages.is_empty());

-        // Multiple messages joined with newlines
        thread.queue_message("hey".to_string());
        thread.queue_message("can you check the server".to_string());
        thread.queue_message("it started 10 min ago".to_string());
@@ -1694,121 +1584,62 @@ mod tests {
        );
        assert!(thread.pending_messages.is_empty());

-        // Queue is empty after drain
        assert!(thread.drain_pending_messages().is_none());
    }

    #[test]
    fn test_requeue_drained_preserves_content_at_front() {
-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);

-        // Re-queue into empty queue
        thread.requeue_drained("failed batch".to_string());
        assert_eq!(thread.pending_messages.len(), 1);
        assert_eq!(thread.pending_messages[0], "failed batch");

-        // New messages go behind the re-queued content
        thread.queue_message("new msg".to_string());
        assert_eq!(thread.pending_messages.len(), 2);

-        // Drain should return re-queued content first (front of queue)
        let merged = thread.drain_pending_messages().unwrap();
        assert_eq!(merged, "failed batch\nnew msg");
    }

    #[test]
-    fn test_record_tool_result_for_by_id() {
-        let mut turn = Turn::new(0, "test");
-        turn.record_tool_call_with_reasoning(
-            "tool_a",
-            serde_json::json!({}),
-            None,
-            Some("id_a".into()),
-        );
-        turn.record_tool_call_with_reasoning(
-            "tool_b",
-            serde_json::json!({}),
-            None,
-            Some("id_b".into()),
-        );
-
-        // Record result for second tool by ID
-        turn.record_tool_result_for("id_b", serde_json::json!("result_b"));
-        assert!(turn.tool_calls[0].result.is_none());
-        assert_eq!(
-            turn.tool_calls[1].result.as_ref().unwrap(),
-            &serde_json::json!("result_b")
-        );
+    fn test_thread_new_stores_source_channel() {
+        let thread = Thread::new(Uuid::new_v4(), Some("gateway"));
+        assert_eq!(thread.source_channel.as_deref(), Some("gateway"));
    }

    #[test]
-    fn test_record_tool_error_for_by_id() {
-        let mut turn = Turn::new(0, "test");
-        turn.record_tool_call_with_reasoning(
-            "tool_a",
-            serde_json::json!({}),
-            None,
-            Some("id_a".into()),
-        );
-        turn.record_tool_call_with_reasoning(
-            "tool_b",
-            serde_json::json!({}),
-            None,
-            Some("id_b".into()),
-        );
-
-        turn.record_tool_error_for("id_a", "failed");
-        assert_eq!(turn.tool_calls[0].error.as_deref(), Some("failed"));
-        assert!(turn.tool_calls[1].error.is_none());
+    fn test_thread_new_none_channel() {
+        let thread = Thread::new(Uuid::new_v4(), None);
+        assert!(thread.source_channel.is_none());
    }

    #[test]
-    fn test_record_tool_result_for_fallback_to_pending() {
-        let mut turn = Turn::new(0, "test");
-        turn.record_tool_call_with_reasoning(
-            "tool_a",
-            serde_json::json!({}),
-            None,
-            Some("id_a".into()),
-        );
-        turn.record_tool_call_with_reasoning(
-            "tool_b",
-            serde_json::json!({}),
-            None,
-            Some("id_b".into()),
-        );
-
-        // First tool already has a result
-        turn.tool_calls[0].result = Some(serde_json::json!("done"));
-
-        // Unknown ID should fall back to first pending (tool_b)
-        turn.record_tool_result_for("unknown_id", serde_json::json!("fallback"));
-        assert_eq!(
-            turn.tool_calls[0].result.as_ref().unwrap(),
-            &serde_json::json!("done")
-        );
-        assert_eq!(
-            turn.tool_calls[1].result.as_ref().unwrap(),
-            &serde_json::json!("fallback")
-        );
+    fn test_thread_with_id_stores_source_channel() {
+        let thread = Thread::with_id(Uuid::new_v4(), Uuid::new_v4(), Some("http"));
+        assert_eq!(thread.source_channel.as_deref(), Some("http"));
    }

    #[test]
-    fn test_record_tool_result_for_no_pending_is_noop() {
-        let mut turn = Turn::new(0, "test");
-        turn.record_tool_call_with_reasoning(
-            "tool_a",
-            serde_json::json!({}),
-            None,
-            Some("id_a".into()),
-        );
-        turn.tool_calls[0].result = Some(serde_json::json!("done"));
+    fn test_create_thread_sets_source_channel() {
+        let mut session = Session::new("user-chan");
+        let thread_id = session.create_thread("gateway").id;
+        let thread = session.threads.get(&thread_id).unwrap();
+        assert_eq!(thread.source_channel.as_deref(), Some("gateway"));
+    }

-        // No pending calls, unknown ID — should be a no-op
-        turn.record_tool_result_for("unknown_id", serde_json::json!("lost"));
-        assert_eq!(
-            turn.tool_calls[0].result.as_ref().unwrap(),
-            &serde_json::json!("done")
-        );
+    #[test]
+    fn test_source_channel_serde_backcompat() {
+        let json = r#"{
+            "id": "00000000-0000-0000-0000-000000000001",
+            "session_id": "00000000-0000-0000-0000-000000000002",
+            "state": "Idle",
+            "turns": [],
+            "created_at": "2025-01-01T00:00:00Z",
+            "updated_at": "2025-01-01T00:00:00Z",
+            "metadata": null
+        }"#;
+        let thread: Thread = serde_json::from_str(json).unwrap();
+        assert!(thread.source_channel.is_none());
    }
 }
@@ -102,30 +102,11 @@ impl SessionManager {
    /// Resolve an external thread ID to an internal thread.
    ///
    /// Returns the session and thread ID. Creates both if they don't exist.
-    /// Delegates to [`resolve_thread_with_parsed_uuid`](Self::resolve_thread_with_parsed_uuid)
-    /// with `parsed_uuid: None`.
    pub async fn resolve_thread(
        &self,
        user_id: &str,
        channel: &str,
        external_thread_id: Option<&str>,
-    ) -> (Arc<Mutex<Session>>, Uuid) {
-        self.resolve_thread_with_parsed_uuid(user_id, channel, external_thread_id, None)
-            .await
-    }
-
-    /// Like [`resolve_thread`](Self::resolve_thread), but accepts a pre-parsed
-    /// UUID to skip redundant parsing when the caller has already validated
-    /// the external thread ID as a UUID (e.g. the approval routing path).
-    ///
-    /// Uses a single read-lock acquisition for both the key lookup and the UUID
-    /// adoption check to reduce contention under concurrent approval load.
-    pub async fn resolve_thread_with_parsed_uuid(
-        &self,
-        user_id: &str,
-        channel: &str,
-        external_thread_id: Option<&str>,
-        parsed_uuid: Option<Uuid>,
    ) -> (Arc<Mutex<Session>>, Uuid) {
        let session = self.get_or_create_session(user_id).await;

@@ -135,72 +116,58 @@ impl SessionManager {
            external_thread_id: external_thread_id.map(String::from),
        };

-        // Use pre-parsed UUID if available, otherwise parse from string.
-        let ext_uuid = parsed_uuid
-            .or_else(|| external_thread_id.and_then(|ext_tid| Uuid::parse_str(ext_tid).ok()));
-
-        // Validate that parsed_uuid (if provided) is consistent with external_thread_id.
-        #[cfg(debug_assertions)]
-        if let (Some(parsed), Some(ext_tid)) = (&parsed_uuid, external_thread_id) {
-            debug_assert_eq!(
-                Uuid::parse_str(ext_tid).ok().as_ref(),
-                Some(parsed),
-                "parsed_uuid must be the parsed form of external_thread_id"
-            );
-        }
-
-        // Single read lock for both the key lookup and UUID adoption check
-        let adoptable_uuid = {
+        // Check if we have a mapping
+        {
            let thread_map = self.thread_map.read().await;
-
-            // Fast path: exact key match
            if let Some(&thread_id) = thread_map.get(&key) {
+                // Verify thread still exists in session
                let sess = session.lock().await;
                if sess.threads.contains_key(&thread_id) {
                    return (Arc::clone(&session), thread_id);
                }
            }
+        }

-            // UUID adoption check (still under the same read lock).
-            // If external_thread_id is a valid UUID not mapped elsewhere,
-            // it may be a thread created by chat_new_thread_handler or
-            // hydrated from DB that we can adopt.
-            // Only attempt adoption when external_thread_id is Some, preserving
-            // the invariant that None external_thread_id never triggers adoption.
-            if external_thread_id.is_some() {
-                ext_uuid.filter(|&uuid| !thread_map.values().any(|&v| v == uuid))
-            } else {
-                None
-            }
-        }; // Single read lock dropped here
+        // Check if external_thread_id is itself a known thread UUID that
+        // exists in the session but was never registered in the thread_map
+        // (e.g. created by chat_new_thread_handler or hydrated from DB).
+        // We only adopt it if no thread_map entry maps to this UUID —
+        // otherwise it belongs to a different channel scope.
+        if let Some(ext_tid) = external_thread_id
+            && let Ok(ext_uuid) = Uuid::parse_str(ext_tid)
+        {
+            let thread_map = self.thread_map.read().await;
+            let mapped_elsewhere = thread_map.values().any(|&v| v == ext_uuid);
+            drop(thread_map);

-        // If we found an adoptable UUID, verify it exists in session and acquire write lock
-        if let Some(ext_uuid) = adoptable_uuid {
-            let sess = session.lock().await;
-            if sess.threads.contains_key(&ext_uuid) {
-                drop(sess);
+            if !mapped_elsewhere {
+                let sess = session.lock().await;
+                if sess.threads.contains_key(&ext_uuid) {
+                    drop(sess);

-                let mut thread_map = self.thread_map.write().await;
-                // Re-check after acquiring write lock to prevent race condition
-                // where another task mapped this UUID between our read and write.
-                if !thread_map.values().any(|&v| v == ext_uuid) {
-                    thread_map.insert(key, ext_uuid);
-                    drop(thread_map);
-                    // Ensure undo manager exists
-                    let mut undo_managers = self.undo_managers.write().await;
-                    undo_managers
-                        .entry(ext_uuid)
-                        .or_insert_with(|| Arc::new(Mutex::new(UndoManager::new())));
-                    return (session, ext_uuid);
+                    let mut thread_map = self.thread_map.write().await;
+                    // Re-check after acquiring write lock to prevent race condition
+                    // where another task mapped this UUID between our read and write.
+                    if !thread_map.values().any(|&v| v == ext_uuid) {
+                        thread_map.insert(key, ext_uuid);
+                        drop(thread_map);
+                        // Ensure undo manager exists
+                        let mut undo_managers = self.undo_managers.write().await;
+                        undo_managers
+                            .entry(ext_uuid)
+                            .or_insert_with(|| Arc::new(Mutex::new(UndoManager::new())));
+                        return (session, ext_uuid);
+                    }
+                    // If it was mapped elsewhere while we were unlocked, fall through
+                    // to create a new thread, preserving channel isolation.
                }
-                // If mapped elsewhere while unlocked, fall through to create new thread
            }
        }

        // Create new thread (always create a new one for a new key)
        let thread_id = {
            let mut sess = session.lock().await;
-            let thread = sess.create_thread();
+            let thread = sess.create_thread(channel);
            thread.id
        };

@@ -476,7 +443,7 @@ mod tests {
        let session = Arc::new(Mutex::new(Session::new("user-hydrate")));
        {
            let mut sess = session.lock().await;
-            let thread = Thread::with_id(thread_id, sess.id);
+            let thread = Thread::with_id(thread_id, sess.id, None);
            sess.threads.insert(thread_id, thread);
            sess.active_thread = Some(thread_id);
        }
@@ -600,7 +567,7 @@ mod tests {
        // Simulate hydration: create thread with a known UUID
        {
            let mut sess = session.lock().await;
-            let thread = Thread::with_id(known_uuid, session_id);
+            let thread = Thread::with_id(known_uuid, session_id, None);
            sess.threads.insert(known_uuid, thread);
        }

@@ -627,7 +594,7 @@ mod tests {
        let session = Arc::new(Mutex::new(Session::new("user-idem")));
        {
            let mut sess = session.lock().await;
-            let thread = Thread::with_id(tid, sess.id);
+            let thread = Thread::with_id(tid, sess.id, None);
            sess.threads.insert(tid, thread);
        }

@@ -656,7 +623,7 @@ mod tests {
        let session = Arc::new(Mutex::new(Session::new("user-undo")));
        {
            let mut sess = session.lock().await;
-            let thread = Thread::with_id(tid, sess.id);
+            let thread = Thread::with_id(tid, sess.id, None);
            sess.threads.insert(tid, thread);
        }

@@ -680,7 +647,7 @@ mod tests {
        let session = Arc::new(Mutex::new(Session::new("user-new")));
        {
            let mut sess = session.lock().await;
-            let thread = Thread::with_id(tid, sess.id);
+            let thread = Thread::with_id(tid, sess.id, None);
            sess.threads.insert(tid, thread);
        }

@@ -788,7 +755,7 @@ mod tests {
        let session = Arc::new(Mutex::new(Session::new("user-cross")));
        {
            let mut sess = session.lock().await;
-            let thread = Thread::with_id(tid, sess.id);
+            let thread = Thread::with_id(tid, sess.id, None);
            sess.threads.insert(tid, thread);
        }

@@ -815,7 +782,7 @@ mod tests {
        let session = Arc::new(Mutex::new(Session::new("user-cross")));
        {
            let mut sess = session.lock().await;
-            let thread = Thread::with_id(tid, sess.id);
+            let thread = Thread::with_id(tid, sess.id, None);
            sess.threads.insert(tid, thread);
        }

@@ -942,44 +909,6 @@ mod tests {
        }
    }

-    #[tokio::test]
-    async fn test_resolve_thread_consolidates_read_path() {
-        // Verify that resolve_thread still correctly handles:
-        // 1. Fast path: key exists in thread_map
-        // 2. UUID adoption: external_thread_id is a UUID in session but not in map
-        // 3. New thread: neither path matches
-        use crate::agent::session::Thread;
-
-        let manager = SessionManager::new();
-
-        // Case 1: Normal resolution creates thread and maps it
-        let (session1, tid1) = manager
-            .resolve_thread("user1", "chan1", Some("ext-1"))
-            .await;
-        // Resolving again with same key should return same thread (fast path)
-        let (_, tid1_again) = manager
-            .resolve_thread("user1", "chan1", Some("ext-1"))
-            .await;
-        assert_eq!(tid1, tid1_again);
-
-        // Case 2: UUID adoption - insert a thread directly into session
-        let adopted_id = Uuid::new_v4();
-        {
-            let mut sess = session1.lock().await;
-            let thread = Thread::with_id(adopted_id, sess.id);
-            sess.threads.insert(adopted_id, thread);
-        }
-        // Resolve with the UUID as external_thread_id -- should adopt it
-        let (_, resolved) = manager
-            .resolve_thread("user1", "chan1", Some(&adopted_id.to_string()))
-            .await;
-        assert_eq!(resolved, adopted_id);
-
-        // Case 3: Different channel gets different thread
-        let (_, tid2) = manager.resolve_thread("user1", "chan2", None).await;
-        assert_ne!(tid1, tid2);
-    }
-
    #[tokio::test]
    async fn test_resolve_thread_finds_existing_session_thread_by_uuid() {
        use crate::agent::session::{Session, Thread};
@@ -992,7 +921,7 @@ mod tests {
        let session = Arc::new(Mutex::new(Session::new("user-direct")));
        {
            let mut sess = session.lock().await;
-            let thread = Thread::with_id(tid, sess.id);
+            let thread = Thread::with_id(tid, sess.id, None);
            sess.threads.insert(tid, thread);
        }
        {
@@ -1020,86 +949,21 @@ mod tests {
    }

    #[tokio::test]
-    async fn test_resolve_thread_with_pre_parsed_uuid_adopts_thread() {
-        use crate::agent::session::Thread;
-
+    async fn test_thread_stores_source_channel() {
        let manager = SessionManager::new();
-        let (session, _) = manager.resolve_thread("user1", "chan1", None).await;
-
-        // Manually insert a thread with a known UUID
-        let known_id = Uuid::new_v4();
-        {
-            let mut sess = session.lock().await;
-            let thread = Thread::with_id(known_id, sess.id);
-            sess.threads.insert(known_id, thread);
-        }
-
-        // Resolve with pre-parsed UUID -- should adopt it without re-parsing
-        let (_, resolved) = manager
-            .resolve_thread_with_parsed_uuid(
-                "user1",
-                "chan1",
-                Some(&known_id.to_string()),
-                Some(known_id),
-            )
+        let (session, thread_id) = manager
+            .resolve_thread("user1", "gateway", Some("ext-1"))
            .await;
-        assert_eq!(resolved, known_id);
+        let sess = session.lock().await;
+        let thread = sess.threads.get(&thread_id).unwrap();
+        assert_eq!(thread.source_channel.as_deref(), Some("gateway"));
    }

    #[tokio::test]
-    async fn test_resolve_thread_with_parsed_uuid_none_delegates_to_parse() {
-        use crate::agent::session::Thread;
-
+    async fn test_different_channels_get_different_threads() {
        let manager = SessionManager::new();
-        let (session, _) = manager.resolve_thread("user2", "chan2", None).await;
-
-        // Insert a thread with a known UUID
-        let known_id = Uuid::new_v4();
-        {
-            let mut sess = session.lock().await;
-            let thread = Thread::with_id(known_id, sess.id);
-            sess.threads.insert(known_id, thread);
-        }
-
-        // Resolve with parsed_uuid=None but a valid UUID string -- should
-        // fall back to parsing the string and still adopt the thread
-        let (_, resolved) = manager
-            .resolve_thread_with_parsed_uuid("user2", "chan2", Some(&known_id.to_string()), None)
-            .await;
-        assert_eq!(resolved, known_id);
-    }
-
-    #[tokio::test]
-    async fn test_resolve_thread_with_none_external_thread_id_does_not_adopt() {
-        use crate::agent::session::Thread;
-
-        let manager = SessionManager::new();
-        let (session, default_tid) = manager.resolve_thread("user3", "chan3", None).await;
-
-        // Manually insert a thread with a known UUID (simulating a thread
-        // created by chat_new_thread_handler)
-        let known_id = Uuid::new_v4();
-        {
-            let mut sess = session.lock().await;
-            let thread = Thread::with_id(known_id, sess.id);
-            sess.threads.insert(known_id, thread);
-        }
-
-        // Resolve with external_thread_id=None but parsed_uuid=Some.
-        // This should NOT adopt the UUID — the old code prevented adoption
-        // when external_thread_id was None, and we preserve that invariant.
-        let (_, resolved) = manager
-            .resolve_thread_with_parsed_uuid("user3", "chan3", None, Some(known_id))
-            .await;
-
-        // Should return the existing default thread, not the injected UUID
-        assert_eq!(
-            resolved, default_tid,
-            "should return existing default thread when external_thread_id is None"
-        );
-        assert_ne!(
-            resolved, known_id,
-            "should NOT adopt UUID when external_thread_id is None"
-        );
+        let (_, tid1) = manager.resolve_thread("user1", "gateway", None).await;
+        let (_, tid2) = manager.resolve_thread("user1", "web", None).await;
+        assert_ne!(tid1, tid2);
    }
 }
@@ -92,17 +92,6 @@ impl SubmissionParser {
                args: vec![],
            };
        }
-        if lower == "/reasoning" || lower.starts_with("/reasoning ") {
-            let args: Vec<String> = trimmed
-                .split_whitespace()
-                .skip(1)
-                .map(|s| s.to_string())
-                .collect();
-            return Submission::SystemCommand {
-                command: "reasoning".to_string(),
-                args,
-            };
-        }
        if lower == "/restart" {
            tracing::debug!("[SubmissionParser::parse] Recognized /restart command");
            return Submission::SystemCommand {
@@ -16,12 +16,12 @@ use crate::agent::dispatcher::{
 };
 use crate::agent::session::{MAX_PENDING_MESSAGES, PendingApproval, Session, ThreadState};
 use crate::agent::submission::SubmissionResult;
+use crate::channels::web::util::truncate_preview;
 use crate::channels::{IncomingMessage, StatusUpdate};
 use crate::context::JobContext;
 use crate::error::Error;
 use crate::llm::{ChatMessage, ToolCall};
 use crate::tools::redact_params;
-use ironclaw_common::truncate_preview;

 const FORGED_THREAD_ID_ERROR: &str = "Invalid or unauthorized thread ID.";

@@ -141,7 +141,8 @@ impl Agent {
            sess.id
        };

-        let mut thread = crate::agent::session::Thread::with_id(thread_uuid, session_id);
+        let mut thread =
+            crate::agent::session::Thread::with_id(thread_uuid, session_id, Some(&message.channel));
        if !chat_messages.is_empty() {
            thread.restore_from_messages(chat_messages);
        }
@@ -175,7 +176,6 @@ impl Agent {
    pub(super) async fn process_user_input(
        &self,
        message: &IncomingMessage,
-        tenant: crate::tenant::TenantCtx,
        session: Arc<Mutex<Session>>,
        thread_id: Uuid,
        content: &str,
@@ -352,7 +352,7 @@ impl Agent {

        if let Some(intent) = self.router.route_command(&temp_message) {
            // Explicit command like /status, /job, /list - handle directly
-            return self.handle_job_or_command(intent, message, &tenant).await;
+            return self.handle_job_or_command(intent, message).await;
        }

        // Natural language goes through the agentic loop
@@ -463,7 +463,7 @@ impl Agent {

        // Run the agentic tool execution loop
        let result = self
-            .run_agentic_loop(message, tenant, session.clone(), thread_id, turn_messages)
+            .run_agentic_loop(message, session.clone(), thread_id, turn_messages)
            .await;

        // Re-acquire lock and check if interrupted
@@ -514,10 +514,10 @@ impl Agent {
                };

                thread.complete_turn(&response);
-                let (turn_number, tool_calls, narrative) = thread
+                let (turn_number, tool_calls) = thread
                    .turns
                    .last()
-                    .map(|t| (t.turn_number, t.tool_calls.clone(), t.narrative.clone()))
+                    .map(|t| (t.turn_number, t.tool_calls.clone()))
                    .unwrap_or_default();
                let _ = self
                    .channels
@@ -535,7 +535,6 @@ impl Agent {
                    &message.user_id,
                    turn_number,
                    &tool_calls,
-                    narrative.as_deref(),
                )
                .await;
                self.persist_assistant_response(
@@ -727,9 +726,7 @@ impl Agent {
    ///
    /// Stored between the user and assistant messages so that
    /// `build_turns_from_db_messages` can reconstruct the tool call history.
-    /// Content is a JSON object: `{ "calls": [...], "narrative": "..." }`.
-    /// The `calls` array contains tool call summaries with optional `rationale`
-    /// and `tool_call_id` fields. Legacy rows may be plain JSON arrays.
+    /// Content is a JSON array of tool call summaries.
    pub(super) async fn persist_tool_calls(
        &self,
        thread_id: Uuid,
@@ -737,7 +734,6 @@ impl Agent {
        user_id: &str,
        turn_number: usize,
        tool_calls: &[crate::agent::session::TurnToolCall],
-        narrative: Option<&str>,
    ) {
        if tool_calls.is_empty() {
            return;
@@ -772,30 +768,11 @@ impl Agent {
                if let Some(ref error) = tc.error {
                    obj["error"] = serde_json::Value::String(truncate_preview(error, 200));
                }
-                if let Some(ref rationale) = tc.rationale {
-                    obj["rationale"] = serde_json::Value::String(truncate_preview(rationale, 500));
-                }
-                if let Some(ref tool_call_id) = tc.tool_call_id {
-                    obj["tool_call_id"] =
-                        serde_json::Value::String(truncate_preview(tool_call_id, 128));
-                }
                obj
            })
            .collect();

-        // Wrap in an object with optional narrative so it can be reconstructed.
-        // safety: no byte-index slicing here; comment describes JSON shape
-        let wrapper = if let Some(n) = narrative {
-            serde_json::json!({
-                "narrative": truncate_preview(n, 1000),
-                "calls": summaries,
-            })
-        } else {
-            serde_json::json!({
-                "calls": summaries,
-            })
-        };
-        let content = match serde_json::to_string(&wrapper) {
+        let content = match serde_json::to_string(&summaries) {
            Ok(c) => c,
            Err(e) => {
                tracing::warn!("Failed to serialize tool calls: {}", e);
@@ -978,6 +955,29 @@ impl Agent {
        approved: bool,
        always: bool,
    ) -> Result<SubmissionResult, Error> {
+        // Verify channel authorization: the approving channel must match the
+        // thread's source channel, OR be the web gateway (trusted approval UI).
+        {
+            let sess = session.lock().await;
+            if let Some(thread) = sess.threads.get(&thread_id) {
+                let authorized = thread
+                    .source_channel
+                    .as_ref()
+                    .is_none_or(|src| src == &message.channel || message.channel == "web");
+                if !authorized {
+                    tracing::warn!(
+                        %thread_id,
+                        source_channel = ?thread.source_channel,
+                        approval_channel = %message.channel,
+                        "Blocked cross-channel approval attempt"
+                    );
+                    return Ok(SubmissionResult::error(
+                        "approval not authorized for this channel",
+                    ));
+                }
+            }
+        }
+
        // Get pending approval for this thread
        let pending = {
            let mut sess = session.lock().await;
@@ -1128,12 +1128,9 @@ impl Agent {
                    && let Some(turn) = thread.last_turn_mut()
                {
                    if is_tool_error {
-                        turn.record_tool_error_for(&pending.tool_call_id, result_content.clone());
+                        turn.record_tool_error(result_content.clone());
                    } else {
-                        turn.record_tool_result_for(
-                            &pending.tool_call_id,
-                            serde_json::json!(result_content),
-                        );
+                        turn.record_tool_result(serde_json::json!(result_content));
                    }
                }
            }
@@ -1385,12 +1382,9 @@ impl Agent {
                        && let Some(turn) = thread.last_turn_mut()
                    {
                        if is_deferred_error {
-                            turn.record_tool_error_for(&tc.id, deferred_content.clone());
+                            turn.record_tool_error(deferred_content.clone());
                        } else {
-                            turn.record_tool_result_for(
-                                &tc.id,
-                                serde_json::json!(deferred_content),
-                            );
+                            turn.record_tool_result(serde_json::json!(deferred_content));
                        }
                    }
                }
@@ -1474,13 +1468,7 @@ impl Agent {

            // Continue the agentic loop (a tool was already executed this turn)
            let result = self
-                .run_agentic_loop(
-                    message,
-                    self.tenant_ctx(&message.user_id).await,
-                    session.clone(),
-                    thread_id,
-                    context_messages,
-                )
+                .run_agentic_loop(message, session.clone(), thread_id, context_messages)
                .await;

            // Handle the result
@@ -1495,10 +1483,10 @@ impl Agent {
                    let (response, suggestions) =
                        crate::agent::dispatcher::extract_suggestions(&response);
                    thread.complete_turn(&response);
-                    let (turn_number, tool_calls, narrative) = thread
+                    let (turn_number, tool_calls) = thread
                        .turns
                        .last()
-                        .map(|t| (t.turn_number, t.tool_calls.clone(), t.narrative.clone()))
+                        .map(|t| (t.turn_number, t.tool_calls.clone()))
                        .unwrap_or_default();
                    // User message already persisted at turn start; save tool calls then assistant response
                    self.persist_tool_calls(
@@ -1507,7 +1495,6 @@ impl Agent {
                        &message.user_id,
                        turn_number,
                        &tool_calls,
-                        narrative.as_deref(),
                    )
                    .await;
                    self.persist_assistant_response(
@@ -1683,7 +1670,7 @@ impl Agent {
        };

        match ext_mgr
-            .configure_token(&pending.extension_name, token, &message.user_id)
+            .configure_token(&pending.extension_name, token)
            .await
        {
            Ok(result) if result.activated => {
@@ -1781,7 +1768,7 @@ impl Agent {
            .get_or_create_session(&message.user_id)
            .await;
        let mut sess = session.lock().await;
-        let thread = sess.create_thread();
+        let thread = sess.create_thread(&message.channel);
        let thread_id = thread.id;
        Ok(SubmissionResult::ok_with_message(format!(
            "New thread: {}",
@@ -1853,20 +1840,7 @@ fn rebuild_chat_messages_from_db(
            "assistant" => result.push(ChatMessage::assistant(&msg.content)),
            "tool_calls" => {
                // Try to parse the enriched JSON and rebuild tool messages.
-                // Supports two formats:
-                // - Old: plain JSON array of tool call summaries
-                // - New: wrapped object { "calls": [...], "narrative": "..." }
-                let calls: Vec<serde_json::Value> =
-                    match serde_json::from_str::<serde_json::Value>(&msg.content) {
-                        Ok(serde_json::Value::Array(arr)) => arr,
-                        Ok(serde_json::Value::Object(obj)) => obj
-                            .get("calls")
-                            .and_then(|v| v.as_array())
-                            .cloned()
-                            .unwrap_or_default(),
-                        _ => Vec::new(),
-                    };
-                {
+                if let Ok(calls) = serde_json::from_str::<Vec<serde_json::Value>>(&msg.content) {
                    if calls.is_empty() {
                        continue;
                    }
@@ -1889,10 +1863,6 @@ fn rebuild_chat_messages_from_db(
                                    .get("parameters")
                                    .cloned()
                                    .unwrap_or(serde_json::json!({})),
-                                reasoning: c
-                                    .get("rationale")
-                                    .and_then(|v| v.as_str())
-                                    .map(String::from),
                            })
                            .collect();

@@ -2089,7 +2059,7 @@ mod tests {

        let session_id = Uuid::new_v4();
        let thread_id = Uuid::new_v4();
-        let mut thread = Thread::with_id(thread_id, session_id);
+        let mut thread = Thread::with_id(thread_id, session_id, None);

        // Set thread to AwaitingApproval with a pending tool approval
        let pending = PendingApproval {
@@ -2157,7 +2127,7 @@ mod tests {
        use crate::agent::session::{MAX_PENDING_MESSAGES, Thread, ThreadState};
        use uuid::Uuid;

-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        thread.start_turn("processing something");
        assert_eq!(thread.state, ThreadState::Processing);

@@ -2183,7 +2153,7 @@ mod tests {
        use crate::agent::session::{Thread, ThreadState};
        use uuid::Uuid;

-        let mut thread = Thread::new(Uuid::new_v4());
+        let mut thread = Thread::new(Uuid::new_v4(), None);
        thread.start_turn("processing");

        thread.queue_message("pending-1".to_string());
@@ -2213,7 +2183,7 @@ mod tests {

        let thread_id = Uuid::new_v4();
        let session_id = Uuid::new_v4();
-        let mut thread = Thread::with_id(thread_id, session_id);
+        let mut thread = Thread::with_id(thread_id, session_id, None);
        thread.start_turn("working");
        assert_eq!(thread.state, ThreadState::Processing);

@@ -2240,7 +2210,7 @@ mod tests {

        let thread_id = Uuid::new_v4();
        let session_id = Uuid::new_v4();
-        let mut thread = Thread::with_id(thread_id, session_id);
+        let mut thread = Thread::with_id(thread_id, session_id, None);
        thread.start_turn("working");
        assert_eq!(thread.state, ThreadState::Processing);

@@ -312,7 +312,13 @@ impl AppBuilder {
            .create_provider(&self.config.llm.nearai.base_url, self.session.clone());

        // Register memory tools if database is available
-        let workspace_user_id = self.config.owner_id.as_str();
+        let workspace_user_id = self
+            .config
+            .channels
+            .gateway
+            .as_ref()
+            .map(|gw| gw.user_id.as_str())
+            .unwrap_or("default");
        let workspace = if let Some(ref db) = self.db {
            let emb_cache_config = EmbeddingCacheConfig {
                max_entries: self.config.embeddings.cache_size,
@@ -321,7 +327,7 @@ impl AppBuilder {
                .with_search_config(&self.config.search);

            if let Some(ref emb) = embeddings {
-                ws = ws.with_embeddings_cached(emb.clone(), emb_cache_config.clone());
+                ws = ws.with_embeddings_cached(emb.clone(), emb_cache_config);
            }

            // Wire workspace-level settings (read scopes, memory layers)
@@ -335,35 +341,7 @@ impl AppBuilder {
            }
            ws = ws.with_memory_layers(self.config.workspace.memory_layers.clone());
            let ws = Arc::new(ws);
-
-            // Detect multi-tenant mode: when GATEWAY_USER_TOKENS is configured,
-            // each authenticated user needs their own workspace scope. Use
-            // WorkspacePool (which implements WorkspaceResolver) to create
-            // per-user workspaces on demand instead of sharing the startup
-            // workspace across all users.
-            let is_multi_tenant = self
-                .config
-                .channels
-                .gateway
-                .as_ref()
-                .is_some_and(|gw| gw.user_tokens.is_some());
-
-            if is_multi_tenant {
-                let pool = Arc::new(crate::channels::web::server::WorkspacePool::new(
-                    Arc::clone(db),
-                    embeddings.clone(),
-                    emb_cache_config,
-                    self.config.search.clone(),
-                    self.config.workspace.clone(),
-                ));
-                tools.register_memory_tools_with_resolver(pool);
-                tracing::info!(
-                    "Memory tools configured with per-user workspace resolver (multi-tenant mode)"
-                );
-            } else {
-                tools.register_memory_tools(Arc::clone(&ws));
-            }
-
+            tools.register_memory_tools(Arc::clone(&ws));
            Some(ws)
        } else {
            None
@@ -880,7 +858,6 @@ impl AppBuilder {
            crate::agent::cost_guard::CostGuardConfig {
                max_cost_per_day_cents: self.config.agent.max_cost_per_day_cents,
                max_actions_per_hour: self.config.agent.max_actions_per_hour,
-                max_cost_per_user_per_day_cents: self.config.agent.max_cost_per_user_per_day_cents,
            },
        ));

@@ -265,15 +265,6 @@ impl OutgoingResponse {
    }
 }

-/// A single tool decision within a reasoning update.
-#[derive(Debug, Clone)]
-pub struct ToolDecision {
-    /// Tool name.
-    pub tool_name: String,
-    /// Agent's reasoning for choosing this tool.
-    pub rationale: String,
-}
-
 /// Status update types for showing agent activity.
 #[derive(Debug, Clone)]
 pub enum StatusUpdate {
@@ -342,13 +333,6 @@ pub enum StatusUpdate {
    },
    /// Suggested follow-up messages for the user.
    Suggestions { suggestions: Vec<String> },
-    /// Agent reasoning update (why it chose specific tools).
-    ReasoningUpdate {
-        /// Human-readable summary of the agent's decision.
-        narrative: String,
-        /// Per-tool decisions.
-        decisions: Vec<ToolDecision>,
-    },
    /// Per-turn token usage and cost summary (shown as subtle metadata).
    TurnCost {
        input_tokens: u64,
@@ -39,7 +39,7 @@ mod webhook_server;

 pub use channel::{
    AttachmentKind, Channel, ChannelSecretUpdater, IncomingAttachment, IncomingMessage,
-    MessageStream, OutgoingResponse, StatusUpdate, ToolDecision, routing_target_from_metadata,
+    MessageStream, OutgoingResponse, StatusUpdate, routing_target_from_metadata,
 };
 pub use http::{HttpChannel, HttpChannelState};
 pub use manager::ChannelManager;
@@ -122,32 +122,18 @@ impl RelayClient {
    /// instance_url in chat-api. IronClaw only passes an optional CSRF nonce
    /// for validating the callback — no URLs.
    pub async fn initiate_oauth(&self, state_nonce: Option<&str>) -> Result<String, RelayError> {
-        let url = format!("{}/oauth/slack/auth", self.base_url);
-        tracing::debug!(relay_url = %url, "RelayClient::initiate_oauth: sending request");
        let mut query: Vec<(&str, &str)> = vec![];
        if let Some(nonce) = state_nonce {
            query.push(("state_nonce", nonce));
        }
        let resp = self
            .http
-            .get(&url)
+            .get(format!("{}/oauth/slack/auth", self.base_url))
            .bearer_auth(self.api_key.expose_secret())
            .query(&query)
            .send()
            .await
-            .map_err(|e| {
-                tracing::warn!(
-                    relay_url = %url,
-                    error = %e,
-                    "RelayClient::initiate_oauth: network request failed"
-                );
-                RelayError::Network(e.to_string())
-            })?;
-        tracing::debug!(
-            relay_url = %url,
-            status = %resp.status(),
-            "RelayClient::initiate_oauth: received response"
-        );
+            .map_err(|e| RelayError::Network(e.to_string()))?;

        let status = resp.status();
        if status.is_redirection() {
@@ -238,39 +224,20 @@ impl RelayClient {
        method: &str,
        body: serde_json::Value,
    ) -> Result<serde_json::Value, RelayError> {
-        let url = format!("{}/proxy/{}/{}", self.base_url, provider, method);
-        tracing::debug!(
-            relay_url = %url,
-            provider = %provider,
-            method = %method,
-            "RelayClient::proxy_provider: sending request"
-        );
        let query: Vec<(&str, &str)> = vec![("team_id", team_id)];
        let resp = self
            .http
-            .post(&url)
+            .post(format!("{}/proxy/{}/{}", self.base_url, provider, method))
            .bearer_auth(self.api_key.expose_secret())
            .query(&query)
            .json(&body)
            .send()
            .await
-            .map_err(|e| {
-                tracing::warn!(
-                    relay_url = %url,
-                    error = %e,
-                    "RelayClient::proxy_provider: network request failed"
-                );
-                RelayError::Network(e.to_string())
-            })?;
+            .map_err(|e| RelayError::Network(e.to_string()))?;

        if !resp.status().is_success() {
            let status = resp.status().as_u16();
            let body = resp.text().await.unwrap_or_default();
-            tracing::warn!(
-                relay_url = %url,
-                status = status,
-                "RelayClient::proxy_provider: channel-relay returned error"
-            );
            return Err(RelayError::Api {
                status,
                message: body,
@@ -288,45 +255,23 @@ impl RelayClient {
    /// 32-byte secret. Called once at activation time; the result is cached in the
    /// extension manager so subsequent calls to `relay_signing_secret()` use it.
    pub async fn get_signing_secret(&self, team_id: &str) -> Result<Vec<u8>, RelayError> {
-        let url = format!("{}/relay/signing-secret", self.base_url);
-        tracing::debug!(
-            relay_url = %url,
-            "RelayClient::get_signing_secret: fetching signing secret"
-        );
        let resp = self
            .http
-            .get(&url)
+            .get(format!("{}/relay/signing-secret", self.base_url))
            .bearer_auth(self.api_key.expose_secret())
            .query(&[("team_id", team_id)])
            .send()
            .await
-            .map_err(|e| {
-                tracing::warn!(
-                    relay_url = %url,
-                    error = %e,
-                    "RelayClient::get_signing_secret: network request failed"
-                );
-                RelayError::Network(e.to_string())
-            })?;
+            .map_err(|e| RelayError::Network(e.to_string()))?;

        if !resp.status().is_success() {
            let status = resp.status().as_u16();
            let body = resp.text().await.unwrap_or_default();
-            tracing::warn!(
-                relay_url = %url,
-                status = status,
-                body = %body,
-                "RelayClient::get_signing_secret: channel-relay returned error"
-            );
            return Err(RelayError::Api {
                status,
                message: body,
            });
        }
-        tracing::debug!(
-            relay_url = %url,
-            "RelayClient::get_signing_secret: received successful response"
-        );

        let body: serde_json::Value = resp
            .json()
@@ -75,7 +75,6 @@ const SLASH_COMMANDS: &[&str] = &[
    "/suggest",
    "/thread",
    "/resume",
-    "/reasoning",
 ];

 /// Rustyline helper for slash-command tab completion.
@@ -431,18 +430,6 @@ impl ReplChannel {
            let _ = execute!(stderr, terminal::Clear(terminal::ClearType::FromCursorDown));
        }
    }
-
-    async fn finish_single_message_turn(&self) {
-        if self.single_message.is_none() {
-            return;
-        }
-
-        let tx = self.msg_tx.lock().ok().and_then(|mut guard| guard.take());
-        if let Some(tx) = tx {
-            let msg = IncomingMessage::new("repl", &self.user_id, "/quit");
-            let _ = tx.send(msg).await;
-        }
-    }
 }

 impl Default for ReplChannel {
@@ -492,9 +479,7 @@ impl Channel for ReplChannel {

    async fn start(&self) -> Result<MessageStream, ChannelError> {
        let (tx, rx) = mpsc::channel(32);
-        // Approval prompts inject responses back through this sender.
-        // In single-message mode we keep it until the turn finishes, then
-        // drop it after enqueuing /quit so the receiver stream can close.
+        // Store tx so send_status can inject approval responses directly
        if let Ok(mut guard) = self.msg_tx.lock() {
            *guard = Some(tx.clone());
        }
@@ -510,10 +495,11 @@ impl Channel for ReplChannel {

            // Single message mode: send it and return
            if let Some(msg) = single_message {
-                let incoming = IncomingMessage::new("repl", &user_id, &msg)
-                    .with_metadata(serde_json::json!({ "single_message_mode": true }))
-                    .with_timezone(&sys_tz);
+                let incoming = IncomingMessage::new("repl", &user_id, &msg).with_timezone(&sys_tz);
                let _ = tx.blocking_send(incoming);
+                // Ensure the agent exits after handling exactly one turn in -m mode,
+                // even when other channels (gateway/http) are enabled.
+                let _ = tx.blocking_send(IncomingMessage::new("repl", &user_id, "/quit"));
                return;
            }

@@ -676,7 +662,6 @@ impl Channel for ReplChannel {
            println!();
            println!();
            self.stdin_locked.store(false, Ordering::Relaxed);
-            self.finish_single_message_turn().await;
            return Ok(());
        }

@@ -695,7 +680,6 @@ impl Channel for ReplChannel {
        println!();
        // Unlock stdin so readline can resume
        self.stdin_locked.store(false, Ordering::Relaxed);
-        self.finish_single_message_turn().await;
        Ok(())
    }

@@ -795,7 +779,6 @@ impl Channel for ReplChannel {
                let msg_tx = Arc::clone(&self.msg_tx);
                let user_id = self.user_id.clone();
                let lock_flag = Arc::clone(&self.stdin_locked);
-                let single_message_mode = self.single_message.is_some();
                tokio::task::spawn_blocking(move || {
                    let action = run_approval_selector(allow_always).unwrap_or("n");
                    // Unlock stdin so readline can resume after approval
@@ -804,12 +787,7 @@ impl Channel for ReplChannel {
                        return;
                    };
                    if let Some(tx) = guard.as_ref() {
-                        let msg = if single_message_mode {
-                            IncomingMessage::new("repl", &user_id, action)
-                                .with_metadata(serde_json::json!({ "single_message_mode": true }))
-                        } else {
-                            IncomingMessage::new("repl", &user_id, action)
-                        };
+                        let msg = IncomingMessage::new("repl", &user_id, action);
                        let _ = tx.blocking_send(msg);
                    }
                });
@@ -863,19 +841,6 @@ impl Channel for ReplChannel {
            StatusUpdate::Suggestions { .. } => {
                // Suggestions are only rendered by the web gateway
            }
-            StatusUpdate::ReasoningUpdate {
-                narrative,
-                decisions,
-            } => {
-                if !narrative.is_empty() {
-                    let display = truncate_for_preview(&narrative, CLI_STATUS_MAX);
-                    eprintln!("  \x1b[94m\u{25B6} {display}\x1b[0m");
-                }
-                for d in &decisions {
-                    let display = truncate_for_preview(&d.rationale, CLI_STATUS_MAX);
-                    eprintln!("    \x1b[90m\u{2192} {}: {display}\x1b[0m", d.tool_name);
-                }
-            }
            StatusUpdate::TurnCost { .. } => {
                // Cost display is handled by the TUI channel
            }
@@ -910,7 +875,6 @@ impl Channel for ReplChannel {
 #[cfg(test)]
 mod tests {
    use futures::StreamExt;
-    use tokio::time::{Duration, timeout};

    use super::*;

@@ -919,36 +883,16 @@ mod tests {
        let repl = ReplChannel::with_message("hi".to_string());
        let mut stream = repl.start().await.expect("repl start should succeed");

-        let first = timeout(Duration::from_secs(1), stream.next())
-            .await
-            .expect("timed out waiting for first message")
-            .expect("first message missing");
+        let first = stream.next().await.expect("first message missing");
        assert_eq!(first.channel, "repl");
        assert_eq!(first.content, "hi");

-        assert!(
-            timeout(Duration::from_millis(100), stream.next())
-                .await
-                .is_err(),
-            "single-message mode should wait for the turn to finish before quitting"
-        );
-
-        repl.respond(&first, OutgoingResponse::text("done"))
-            .await
-            .expect("respond should succeed");
-
-        let second = timeout(Duration::from_secs(1), stream.next())
-            .await
-            .expect("timed out waiting for quit message")
-            .expect("quit message missing");
+        let second = stream.next().await.expect("quit message missing");
        assert_eq!(second.channel, "repl");
        assert_eq!(second.content, "/quit");

        assert!(
-            timeout(Duration::from_secs(1), stream.next())
-                .await
-                .expect("timed out waiting for stream to close")
-                .is_none(),
+            stream.next().await.is_none(),
            "stream should end after /quit"
        );
    }
@@ -333,9 +333,6 @@ async fn webhook_handler(

    let channel_name = channel.channel_name();

-    // Track whether any authentication was performed and passed.
-    let mut did_authenticate = false;
-
    // Check if secret is required
    if state.router.requires_secret(channel_name).await {
        // Get the secret header name for this channel (from capabilities or default)
@@ -385,7 +382,6 @@ async fn webhook_handler(
                    );
                }
                tracing::debug!(channel = %channel_name, "Webhook secret validated");
-                did_authenticate = true;
            }
            None => {
                tracing::warn!(
@@ -437,7 +433,6 @@ async fn webhook_handler(
                    );
                }
                tracing::debug!(channel = %channel_name, "Ed25519 signature verified");
-                did_authenticate = true;
            }
            _ => {
                tracing::warn!(
@@ -489,7 +484,6 @@ async fn webhook_handler(
                    );
                }
                tracing::debug!(channel = %channel_name, "HMAC-SHA256 signature verified");
-                did_authenticate = true;
            }
            _ => {
                tracing::warn!(
@@ -516,9 +510,8 @@ async fn webhook_handler(
        })
        .collect();

-    // Call the WASM channel. `did_authenticate` was set above by whichever
-    // auth guard (secret / Ed25519 / HMAC) successfully validated the request.
-    let secret_validated = did_authenticate;
+    // Call the WASM channel
+    let secret_validated = state.router.requires_secret(channel_name).await;

    tracing::info!(
        channel = %channel_name,
@@ -3061,20 +3061,6 @@ fn status_to_wit(
        },
        // Suggestions and turn cost are web-gateway-only; skip for WASM channels
        StatusUpdate::Suggestions { .. } | StatusUpdate::TurnCost { .. } => return None,
-        StatusUpdate::ReasoningUpdate {
-            narrative,
-            decisions,
-        } => {
-            let mut msg = narrative.clone();
-            for d in decisions {
-                msg.push_str(&format!("\n  → {}: {}", d.tool_name, d.rationale));
-            }
-            wit_channel::StatusUpdate {
-                status: wit_channel::StatusType::Status,
-                message: msg,
-                metadata_json,
-            }
-        }
    })
 }

@@ -1,133 +1,17 @@
 //! Bearer token authentication middleware for the web gateway.
-//!
-//! Supports multi-user mode: each token maps to a `UserIdentity` that carries
-//! the user_id. The identity is inserted into request extensions so downstream
-//! handlers can extract it via `AuthenticatedUser`.
-
-use std::collections::HashMap;

 use axum::{
-    extract::{FromRequestParts, Request, State},
-    http::{HeaderMap, Method, StatusCode, request::Parts},
+    extract::{Request, State},
+    http::{HeaderMap, Method, StatusCode},
    middleware::Next,
    response::{IntoResponse, Response},
 };
-use sha2::{Digest, Sha256};
 use subtle::ConstantTimeEq;

-/// Identity resolved from a bearer token.
-#[derive(Debug, Clone)]
-pub struct UserIdentity {
-    pub user_id: String,
-    /// Additional user scopes this identity can read from.
-    pub workspace_read_scopes: Vec<String>,
-}
-
-/// Hash a token with SHA-256 for constant-size, timing-safe storage.
-fn hash_token(token: &str) -> [u8; 32] {
-    let mut hasher = Sha256::new();
-    hasher.update(token.as_bytes());
-    hasher.finalize().into()
-}
-
-/// Multi-user auth state: maps token hashes to user identities.
-///
-/// Tokens are SHA-256 hashed on construction so they are never stored in
-/// plaintext. Authentication compares fixed-size (32-byte) digests using
-/// constant-time comparison, eliminating both length-oracle timing leaks
-/// and accidental token exposure in memory dumps.
-///
-/// In single-user mode (the default), contains exactly one entry.
+/// Shared auth state injected via axum middleware state.
 #[derive(Clone)]
-pub struct MultiAuthState {
-    /// Maps SHA-256(token) → identity. Tokens are never stored in cleartext.
-    hashed_tokens: Vec<([u8; 32], UserIdentity)>,
-    /// Original first token kept only for single-user startup printing.
-    /// Not used for authentication.
-    display_token: Option<String>,
-}
-
-impl MultiAuthState {
-    /// Create a single-user auth state (backwards compatible).
-    pub fn single(token: String, user_id: String) -> Self {
-        let hash = hash_token(&token);
-        Self {
-            hashed_tokens: vec![(
-                hash,
-                UserIdentity {
-                    user_id,
-                    workspace_read_scopes: Vec::new(),
-                },
-            )],
-            display_token: Some(token),
-        }
-    }
-
-    /// Create a multi-user auth state from a map of tokens to identities.
-    pub fn multi(tokens: HashMap<String, UserIdentity>) -> Self {
-        let hashed_tokens: Vec<([u8; 32], UserIdentity)> = tokens
-            .into_iter()
-            .map(|(tok, identity)| (hash_token(&tok), identity))
-            .collect();
-        Self {
-            hashed_tokens,
-            display_token: None,
-        }
-    }
-
-    /// Authenticate a token, returning the associated identity if valid.
-    ///
-    /// Uses SHA-256 hashing + constant-time comparison (`subtle::ConstantTimeEq`)
-    /// to prevent timing side-channels. Both the candidate and stored tokens are
-    /// hashed to 32-byte digests, eliminating length-oracle leaks. Iterates all
-    /// entries regardless of match to avoid early-exit timing differences.
-    /// O(n) in the number of configured users — negligible for typical
-    /// deployments (< 10 users).
-    pub fn authenticate(&self, candidate: &str) -> Option<&UserIdentity> {
-        let candidate_hash = hash_token(candidate);
-        let mut matched: Option<&UserIdentity> = None;
-        for (stored_hash, identity) in &self.hashed_tokens {
-            if bool::from(candidate_hash.ct_eq(stored_hash)) {
-                matched = Some(identity);
-            }
-        }
-        matched
-    }
-
-    /// Get the first token for backwards-compatible printing at startup.
-    ///
-    /// Only available in single-user mode; returns `None` in multi-user mode
-    /// to avoid exposing tokens.
-    pub fn first_token(&self) -> Option<&str> {
-        self.display_token.as_deref()
-    }
-
-    /// Get the first user identity (for single-user fallback).
-    pub fn first_identity(&self) -> Option<&UserIdentity> {
-        self.hashed_tokens.first().map(|(_, id)| id)
-    }
-}
-
-/// Axum extractor that provides the authenticated user identity.
-///
-/// Only available on routes behind `auth_middleware`. Extracts the
-/// `UserIdentity` that the middleware inserted into request extensions.
-pub struct AuthenticatedUser(pub UserIdentity);
-
-impl<S> FromRequestParts<S> for AuthenticatedUser
-where
-    S: Send + Sync,
-{
-    type Rejection = (StatusCode, &'static str);
-
-    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
-        parts
-            .extensions
-            .get::<UserIdentity>()
-            .cloned()
-            .map(AuthenticatedUser)
-            .ok_or((StatusCode::UNAUTHORIZED, "Not authenticated"))
-    }
+pub struct AuthState {
+    pub token: String,
 }

 /// Whether query-string token auth is allowed for this request.
@@ -167,34 +51,29 @@ fn query_token(request: &Request) -> Option<String> {
 /// Auth middleware that validates bearer token from header or query param.
 ///
 /// SSE connections can't set headers from `EventSource`, so we also accept
-/// `?token=xxx` as a query parameter, but only on SSE/WS endpoints.
-///
-/// On successful authentication, inserts the matching `UserIdentity` into
-/// request extensions for downstream extraction via `AuthenticatedUser`.
+/// `?token=xxx` as a query parameter, but only on SSE endpoints.
 pub async fn auth_middleware(
-    State(auth): State<MultiAuthState>,
+    State(auth): State<AuthState>,
    headers: HeaderMap,
-    mut request: Request,
+    request: Request,
    next: Next,
 ) -> Response {
-    // Try Authorization header first.
+    // Try Authorization header first (constant-time comparison).
    // RFC 6750 Section 2.1: auth-scheme comparison is case-insensitive.
    if let Some(auth_header) = headers.get("authorization")
        && let Ok(value) = auth_header.to_str()
        && value.len() > 7
        && value[..7].eq_ignore_ascii_case("Bearer ")
-        && let Some(identity) = auth.authenticate(&value[7..])
+        && bool::from(value.as_bytes()[7..].ct_eq(auth.token.as_bytes()))
    {
-        request.extensions_mut().insert(identity.clone());
        return next.run(request).await;
    }

-    // Fall back to query parameter, but only for SSE/WS endpoints.
+    // Fall back to query parameter, but only for SSE endpoints (constant-time comparison).
    if allows_query_token_auth(&request)
        && let Some(token) = query_token(&request)
-        && let Some(identity) = auth.authenticate(&token)
+        && bool::from(token.as_bytes().ct_eq(auth.token.as_bytes()))
    {
-        request.extensions_mut().insert(identity.clone());
        return next.run(request).await;
    }

@@ -204,61 +83,15 @@ pub async fn auth_middleware(
 #[cfg(test)]
 mod tests {
    use super::*;
-    use crate::testing::credentials::TEST_AUTH_SECRET_TOKEN;
+    use crate::testing::credentials::{TEST_AUTH_SECRET_TOKEN, TEST_BEARER_TOKEN};

    #[test]
-    fn test_multi_auth_state_single() {
-        let state = MultiAuthState::single("tok-123".to_string(), "alice".to_string());
-        let identity = state.authenticate("tok-123");
-        assert!(identity.is_some());
-        assert_eq!(identity.unwrap().user_id, "alice");
-    }
-
-    #[test]
-    fn test_multi_auth_state_reject_wrong_token() {
-        let state = MultiAuthState::single("tok-123".to_string(), "alice".to_string());
-        assert!(state.authenticate("wrong-token").is_none());
-    }
-
-    #[test]
-    fn test_multi_auth_state_multi_users() {
-        let mut tokens = HashMap::new();
-        tokens.insert(
-            "tok-alice".to_string(),
-            UserIdentity {
-                user_id: "alice".to_string(),
-                workspace_read_scopes: Vec::new(),
-            },
-        );
-        tokens.insert(
-            "tok-bob".to_string(),
-            UserIdentity {
-                user_id: "bob".to_string(),
-                workspace_read_scopes: Vec::new(),
-            },
-        );
-        let state = MultiAuthState::multi(tokens);
-
-        let alice = state.authenticate("tok-alice").unwrap();
-        assert_eq!(alice.user_id, "alice");
-
-        let bob = state.authenticate("tok-bob").unwrap();
-        assert_eq!(bob.user_id, "bob");
-
-        assert!(state.authenticate("tok-charlie").is_none());
-    }
-
-    #[test]
-    fn test_multi_auth_state_first_token() {
-        let state = MultiAuthState::single("my-token".to_string(), "user1".to_string());
-        assert_eq!(state.first_token(), Some("my-token"));
-    }
-
-    #[test]
-    fn test_multi_auth_state_first_identity() {
-        let state = MultiAuthState::single("my-token".to_string(), "user1".to_string());
-        let identity = state.first_identity().unwrap();
-        assert_eq!(identity.user_id, "user1");
+    fn test_auth_state_clone() {
+        let state = AuthState {
+            token: TEST_BEARER_TOKEN.to_string(),
+        };
+        let cloned = state.clone();
+        assert_eq!(cloned.token, TEST_BEARER_TOKEN);
    }

    use axum::Router;
@@ -274,7 +107,9 @@ mod tests {
    /// Router with streaming endpoints (query auth allowed) and regular
    /// endpoints (query auth rejected).
    fn test_app(token: &str) -> Router {
-        let state = MultiAuthState::single(token.to_string(), "test-user".to_string());
+        let state = AuthState {
+            token: token.to_string(),
+        };
        Router::new()
            .route("/api/chat/events", get(dummy_handler))
            .route("/api/logs/events", get(dummy_handler))
@@ -471,200 +306,4 @@ mod tests {
        let resp = app.oneshot(req).await.unwrap();
        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
    }
-
-    // --- Multi-tenant auth integration tests ---
-
-    /// Handler that extracts `AuthenticatedUser` and returns the resolved user_id.
-    async fn identity_handler(AuthenticatedUser(identity): AuthenticatedUser) -> String {
-        identity.user_id
-    }
-
-    /// Handler that extracts `AuthenticatedUser` and returns workspace_read_scopes as JSON.
-    async fn scopes_handler(AuthenticatedUser(identity): AuthenticatedUser) -> String {
-        serde_json::to_string(&identity.workspace_read_scopes).unwrap()
-    }
-
-    /// Build a multi-user router where each token maps to a distinct identity.
-    fn multi_user_app(tokens: HashMap<String, UserIdentity>) -> Router {
-        let state = MultiAuthState::multi(tokens);
-        Router::new()
-            .route("/api/chat/events", get(identity_handler))
-            .route("/api/chat/send", post(identity_handler))
-            .route("/api/scopes", get(scopes_handler))
-            .layer(middleware::from_fn_with_state(state, auth_middleware))
-    }
-
-    fn two_user_tokens() -> HashMap<String, UserIdentity> {
-        let mut tokens = HashMap::new();
-        tokens.insert(
-            "tok-alice".to_string(),
-            UserIdentity {
-                user_id: "alice".to_string(),
-                workspace_read_scopes: vec!["shared".to_string()],
-            },
-        );
-        tokens.insert(
-            "tok-bob".to_string(),
-            UserIdentity {
-                user_id: "bob".to_string(),
-                workspace_read_scopes: vec!["shared".to_string(), "alice".to_string()],
-            },
-        );
-        tokens
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_alice_token_resolves_to_alice() {
-        let app = multi_user_app(two_user_tokens());
-        let req = Request::builder()
-            .uri("/api/chat/events")
-            .header("Authorization", "Bearer tok-alice")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        assert_eq!(body, "alice");
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_bob_token_resolves_to_bob() {
-        let app = multi_user_app(two_user_tokens());
-        let req = Request::builder()
-            .uri("/api/chat/events")
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        assert_eq!(body, "bob");
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_sequential_tokens_resolve_independently() {
-        // Send both alice and bob tokens sequentially and verify each gets
-        // the correct identity — guards against token map corruption.
-        let tokens = two_user_tokens();
-
-        let app1 = multi_user_app(tokens.clone());
-        let req = Request::builder()
-            .uri("/api/chat/events")
-            .header("Authorization", "Bearer tok-alice")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app1.oneshot(req).await.unwrap();
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        assert_eq!(body, "alice");
-
-        let app2 = multi_user_app(tokens);
-        let req = Request::builder()
-            .uri("/api/chat/events")
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app2.oneshot(req).await.unwrap();
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        assert_eq!(body, "bob");
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_unknown_token_rejected() {
-        let app = multi_user_app(two_user_tokens());
-        let req = Request::builder()
-            .uri("/api/chat/events")
-            .header("Authorization", "Bearer tok-charlie")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_workspace_read_scopes_propagated() {
-        let app = multi_user_app(two_user_tokens());
-
-        // Alice has ["shared"]
-        let req = Request::builder()
-            .uri("/api/scopes")
-            .header("Authorization", "Bearer tok-alice")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        let scopes: Vec<String> = serde_json::from_slice(&body).unwrap();
-        assert_eq!(scopes, vec!["shared"]);
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_bob_has_two_scopes() {
-        let app = multi_user_app(two_user_tokens());
-
-        // Bob has ["shared", "alice"]
-        let req = Request::builder()
-            .uri("/api/scopes")
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        let scopes: Vec<String> = serde_json::from_slice(&body).unwrap();
-        assert_eq!(scopes, vec!["shared", "alice"]);
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_query_param_resolves_correct_identity() {
-        let app = multi_user_app(two_user_tokens());
-        let req = Request::builder()
-            .uri("/api/chat/events?token=tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        assert_eq!(body, "bob");
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_post_with_bearer_resolves_identity() {
-        let app = multi_user_app(two_user_tokens());
-        let req = Request::builder()
-            .method(Method::POST)
-            .uri("/api/chat/send")
-            .header("Authorization", "Bearer tok-alice")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        assert_eq!(body, "alice");
-    }
-
-    #[tokio::test]
-    async fn test_multi_user_empty_scopes_for_single_user() {
-        // Single-user mode creates identity with empty workspace_read_scopes.
-        let state = MultiAuthState::single("tok-only".to_string(), "solo".to_string());
-        let app = Router::new()
-            .route("/api/scopes", get(scopes_handler))
-            .layer(middleware::from_fn_with_state(state, auth_middleware));
-        let req = Request::builder()
-            .uri("/api/scopes")
-            .header("Authorization", "Bearer tok-only")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        let scopes: Vec<String> = serde_json::from_slice(&body).unwrap();
-        assert!(scopes.is_empty());
-    }
-
-    #[tokio::test]
-    async fn test_prefix_and_extension_tokens_rejected() {
-        // Verifies that prefix/suffix variants of valid tokens are rejected.
-        // Note: the constant-time property is enforced structurally by use of
-        // subtle::ConstantTimeEq and cannot be verified via outcome testing.
-        let state = MultiAuthState::single("long-secret-token".to_string(), "user".to_string());
-        assert!(state.authenticate("long-secret").is_none());
-        assert!(state.authenticate("long-secret-token-extra").is_none());
-    }
 }
@@ -12,24 +12,22 @@ use serde::Deserialize;
 use uuid::Uuid;

 use crate::channels::IncomingMessage;
-use crate::channels::web::auth::AuthenticatedUser;
 use crate::channels::web::server::GatewayState;
 use crate::channels::web::types::*;
 use crate::channels::web::util::{build_turns_from_db_messages, truncate_preview};

 pub async fn chat_send_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(identity): AuthenticatedUser,
    Json(req): Json<SendMessageRequest>,
 ) -> Result<(StatusCode, Json<SendMessageResponse>), (StatusCode, String)> {
-    if !state.chat_rate_limiter.check(&identity.user_id) {
+    if !state.chat_rate_limiter.check() {
        return Err((
            StatusCode::TOO_MANY_REQUESTS,
            "Rate limit exceeded. Try again shortly.".to_string(),
        ));
    }

-    let mut msg = IncomingMessage::new("gateway", &identity.user_id, &req.content);
+    let mut msg = IncomingMessage::new("gateway", &state.user_id, &req.content);

    if let Some(ref thread_id) = req.thread_id {
        msg = msg.with_thread(thread_id);
@@ -76,7 +74,6 @@ pub async fn chat_send_handler(

 pub async fn chat_approval_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(identity): AuthenticatedUser,
    Json(req): Json<ApprovalRequest>,
 ) -> Result<(StatusCode, Json<SendMessageResponse>), (StatusCode, String)> {
    let (approved, always) = match req.action.as_str() {
@@ -112,7 +109,7 @@ pub async fn chat_approval_handler(
        )
    })?;

-    let mut msg = IncomingMessage::new("gateway", &identity.user_id, content);
+    let mut msg = IncomingMessage::new("gateway", &state.user_id, content);

    if let Some(ref thread_id) = req.thread_id {
        msg = msg.with_thread(thread_id);
@@ -153,7 +150,6 @@ pub async fn chat_approval_handler(
 /// The token never touches the LLM, chat history, or SSE stream.
 pub async fn chat_auth_token_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Json(req): Json<AuthTokenRequest>,
 ) -> Result<Json<ActionResponse>, (StatusCode, String)> {
    let ext_mgr = state.extension_manager.as_ref().ok_or((
@@ -162,7 +158,7 @@ pub async fn chat_auth_token_handler(
    ))?;

    match ext_mgr
-        .configure_token(&req.extension_name, &req.token, &user.user_id)
+        .configure_token(&req.extension_name, &req.token)
        .await
    {
        Ok(result) => {
@@ -173,26 +169,20 @@ pub async fn chat_auth_token_handler(
            resp.instructions = result.verification.as_ref().map(|v| v.instructions.clone());

            if result.verification.is_some() {
-                state.sse.broadcast_for_user(
-                    &user.user_id,
-                    AppEvent::AuthRequired {
-                        extension_name: req.extension_name.clone(),
-                        instructions: Some(result.message),
-                        auth_url: None,
-                        setup_url: None,
-                    },
-                );
+                state.sse.broadcast(SseEvent::AuthRequired {
+                    extension_name: req.extension_name.clone(),
+                    instructions: Some(result.message),
+                    auth_url: None,
+                    setup_url: None,
+                });
            } else {
-                clear_auth_mode(&state, &user.user_id).await;
+                clear_auth_mode(&state).await;

-                state.sse.broadcast_for_user(
-                    &user.user_id,
-                    AppEvent::AuthCompleted {
-                        extension_name: req.extension_name.clone(),
-                        success: true,
-                        message: result.message,
-                    },
-                );
+                state.sse.broadcast(SseEvent::AuthCompleted {
+                    extension_name: req.extension_name.clone(),
+                    success: true,
+                    message: result.message,
+                });
            }

            Ok(Json(resp))
@@ -200,15 +190,12 @@ pub async fn chat_auth_token_handler(
        Err(e) => {
            let msg = e.to_string();
            if matches!(e, crate::extensions::ExtensionError::ValidationFailed(_)) {
-                state.sse.broadcast_for_user(
-                    &user.user_id,
-                    AppEvent::AuthRequired {
-                        extension_name: req.extension_name.clone(),
-                        instructions: Some(msg.clone()),
-                        auth_url: None,
-                        setup_url: None,
-                    },
-                );
+                state.sse.broadcast(SseEvent::AuthRequired {
+                    extension_name: req.extension_name.clone(),
+                    instructions: Some(msg.clone()),
+                    auth_url: None,
+                    setup_url: None,
+                });
            }
            Ok(Json(ActionResponse::fail(msg)))
        }
@@ -218,17 +205,16 @@ pub async fn chat_auth_token_handler(
 /// Cancel an in-progress auth flow.
 pub async fn chat_auth_cancel_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(identity): AuthenticatedUser,
    Json(_req): Json<AuthCancelRequest>,
 ) -> Result<Json<ActionResponse>, (StatusCode, String)> {
-    clear_auth_mode(&state, &identity.user_id).await;
+    clear_auth_mode(&state).await;
    Ok(Json(ActionResponse::ok("Auth cancelled")))
 }

 /// Clear pending auth mode on the active thread.
-pub async fn clear_auth_mode(state: &GatewayState, user_id: &str) {
+pub async fn clear_auth_mode(state: &GatewayState) {
    if let Some(ref sm) = state.session_manager {
-        let session = sm.get_or_create_session(user_id).await;
+        let session = sm.get_or_create_session(&state.user_id).await;
        let mut sess = session.lock().await;
        if let Some(thread_id) = sess.active_thread
            && let Some(thread) = sess.threads.get_mut(&thread_id)
@@ -240,9 +226,8 @@ pub async fn clear_auth_mode(state: &GatewayState, user_id: &str) {

 pub async fn chat_events_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
-    state.sse.subscribe(Some(user.user_id)).ok_or((
+    state.sse.subscribe().ok_or((
        StatusCode::SERVICE_UNAVAILABLE,
        "Too many connections".to_string(),
    ))
@@ -252,7 +237,6 @@ pub async fn chat_ws_handler(
    headers: axum::http::HeaderMap,
    ws: WebSocketUpgrade,
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(identity): AuthenticatedUser,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
    // Validate Origin header to prevent cross-site WebSocket hijacking.
    let origin = headers
@@ -278,9 +262,7 @@ pub async fn chat_ws_handler(
            "WebSocket origin not allowed".to_string(),
        ));
    }
-    Ok(ws.on_upgrade(move |socket| {
-        crate::channels::web::ws::handle_ws_connection(socket, state, identity)
-    }))
+    Ok(ws.on_upgrade(move |socket| crate::channels::web::ws::handle_ws_connection(socket, state)))
 }

 #[derive(Deserialize)]
@@ -292,7 +274,6 @@ pub struct HistoryQuery {

 pub async fn chat_history_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(identity): AuthenticatedUser,
    Query(query): Query<HistoryQuery>,
 ) -> Result<Json<HistoryResponse>, (StatusCode, String)> {
    let session_manager = state.session_manager.as_ref().ok_or((
@@ -300,9 +281,7 @@ pub async fn chat_history_handler(
        "Session manager not available".to_string(),
    ))?;

-    let session = session_manager
-        .get_or_create_session(&identity.user_id)
-        .await;
+    let session = session_manager.get_or_create_session(&state.user_id).await;

    let limit = query.limit.unwrap_or(50);
    let before_cursor = query
@@ -335,7 +314,7 @@ pub async fn chat_history_handler(
        && let Some(ref store) = state.store
    {
        let owned = store
-            .conversation_belongs_to_user(thread_id, &identity.user_id)
+            .conversation_belongs_to_user(thread_id, &state.user_id)
            .await
            .unwrap_or(false);
        if !owned {
@@ -398,10 +377,8 @@ pub async fn chat_history_handler(
                                truncate_preview(&s, 500)
                            }),
                            error: tc.error.clone(),
-                            rationale: tc.rationale.clone(),
                        })
                        .collect(),
-                    narrative: t.narrative.clone(),
                })
                .collect();

@@ -457,27 +434,24 @@ pub async fn chat_history_handler(

 pub async fn chat_threads_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(identity): AuthenticatedUser,
 ) -> Result<Json<ThreadListResponse>, (StatusCode, String)> {
    let session_manager = state.session_manager.as_ref().ok_or((
        StatusCode::SERVICE_UNAVAILABLE,
        "Session manager not available".to_string(),
    ))?;

-    let session = session_manager
-        .get_or_create_session(&identity.user_id)
-        .await;
+    let session = session_manager.get_or_create_session(&state.user_id).await;

    // Try DB first for persistent thread list
    if let Some(ref store) = state.store {
        // Auto-create assistant thread if it doesn't exist
        let assistant_id = store
-            .get_or_create_assistant_conversation(&identity.user_id, "gateway")
+            .get_or_create_assistant_conversation(&state.user_id, "gateway")
            .await
            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

        if let Ok(summaries) = store
-            .list_conversations_all_channels(&identity.user_id, 50)
+            .list_conversations_all_channels(&state.user_id, 50)
            .await
        {
            let mut assistant_thread = None;
@@ -560,19 +534,16 @@ pub async fn chat_threads_handler(

 pub async fn chat_new_thread_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(identity): AuthenticatedUser,
 ) -> Result<Json<ThreadInfo>, (StatusCode, String)> {
    let session_manager = state.session_manager.as_ref().ok_or((
        StatusCode::SERVICE_UNAVAILABLE,
        "Session manager not available".to_string(),
    ))?;

-    let session = session_manager
-        .get_or_create_session(&identity.user_id)
-        .await;
+    let session = session_manager.get_or_create_session(&state.user_id).await;
    let (thread_id, info) = {
        let mut sess = session.lock().await;
-        let thread = sess.create_thread();
+        let thread = sess.create_thread("web");
        let id = thread.id;
        let info = ThreadInfo {
            id: thread.id,
@@ -591,12 +562,12 @@ pub async fn chat_new_thread_handler(
    // so that the subsequent loadThreads() call from the frontend sees it.
    if let Some(ref store) = state.store {
        match store
-            .ensure_conversation(thread_id, "gateway", &identity.user_id, None)
+            .ensure_conversation(thread_id, "gateway", &state.user_id, None)
            .await
        {
            Ok(true) => {}
            Ok(false) => tracing::warn!(
-                user = %identity.user_id,
+                user = %state.user_id,
                thread_id = %thread_id,
                "Skipped persisting new thread due to ownership/channel conflict"
            ),
@@ -8,13 +8,11 @@ use axum::{
    http::StatusCode,
 };

-use crate::channels::web::auth::AuthenticatedUser;
 use crate::channels::web::server::GatewayState;
 use crate::channels::web::types::*;

 pub async fn extensions_list_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
 ) -> Result<Json<ExtensionListResponse>, (StatusCode, String)> {
    let ext_mgr = state.extension_manager.as_ref().ok_or((
        StatusCode::NOT_IMPLEMENTED,
@@ -22,7 +20,7 @@ pub async fn extensions_list_handler(
    ))?;

    let installed = ext_mgr
-        .list(None, false, &user.user_id)
+        .list(None, false)
        .await
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

@@ -82,7 +80,6 @@ pub async fn extensions_list_handler(

 pub async fn extensions_tools_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(_user): AuthenticatedUser,
 ) -> Result<Json<ToolListResponse>, (StatusCode, String)> {
    let registry = state.tool_registry.as_ref().ok_or((
        StatusCode::SERVICE_UNAVAILABLE,
@@ -103,7 +100,6 @@ pub async fn extensions_tools_handler(

 pub async fn extensions_install_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Json(req): Json<InstallExtensionRequest>,
 ) -> Result<Json<ActionResponse>, (StatusCode, String)> {
    let ext_mgr = state.extension_manager.as_ref().ok_or((
@@ -120,7 +116,7 @@ pub async fn extensions_install_handler(
    });

    match ext_mgr
-        .install(&req.name, req.url.as_deref(), kind_hint, &user.user_id)
+        .install(&req.name, req.url.as_deref(), kind_hint)
        .await
    {
        Ok(result) => Ok(Json(ActionResponse::ok(result.message))),
@@ -130,7 +126,6 @@ pub async fn extensions_install_handler(

 pub async fn extensions_remove_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(name): Path<String>,
 ) -> Result<Json<ActionResponse>, (StatusCode, String)> {
    let ext_mgr = state.extension_manager.as_ref().ok_or((
@@ -138,7 +133,7 @@ pub async fn extensions_remove_handler(
        "Extension manager not available (secrets store required)".to_string(),
    ))?;

-    match ext_mgr.remove(&name, &user.user_id).await {
+    match ext_mgr.remove(&name).await {
        Ok(message) => Ok(Json(ActionResponse::ok(message))),
        Err(e) => Ok(Json(ActionResponse::fail(e.to_string()))),
    }
@@ -11,13 +11,11 @@ use axum::{
 use serde::Deserialize;
 use uuid::Uuid;

-use crate::channels::web::auth::AuthenticatedUser;
 use crate::channels::web::server::GatewayState;
 use crate::channels::web::types::*;

 pub async fn jobs_list_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
 ) -> Result<Json<JobListResponse>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
        StatusCode::SERVICE_UNAVAILABLE,
@@ -27,8 +25,8 @@ pub async fn jobs_list_handler(
    let mut jobs: Vec<JobInfo> = Vec::new();
    let mut seen_ids: HashSet<Uuid> = HashSet::new();

-    // Fetch sandbox jobs scoped to this user.
-    match store.list_sandbox_jobs_for_user(&user.user_id).await {
+    // Fetch sandbox jobs from database.
+    match store.list_sandbox_jobs().await {
        Ok(sandbox_jobs) => {
            for j in &sandbox_jobs {
                let ui_state = match j.status.as_str() {
@@ -52,8 +50,8 @@ pub async fn jobs_list_handler(
        }
    }

-    // Fetch agent (non-sandbox) jobs scoped to this user, deduplicating by ID.
-    match store.list_agent_jobs_for_user(&user.user_id).await {
+    // Fetch agent (non-sandbox) jobs from database, deduplicating by ID.
+    match store.list_agent_jobs().await {
        Ok(agent_jobs) => {
            for j in &agent_jobs {
                if seen_ids.contains(&j.id) {
@@ -82,7 +80,6 @@ pub async fn jobs_list_handler(

 pub async fn jobs_summary_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
 ) -> Result<Json<JobSummaryResponse>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
        StatusCode::SERVICE_UNAVAILABLE,
@@ -96,8 +93,8 @@ pub async fn jobs_summary_handler(
    let mut failed = 0;
    let mut stuck = 0;

-    // Sandbox job counts scoped to this user.
-    match store.sandbox_job_summary_for_user(&user.user_id).await {
+    // Sandbox job counts.
+    match store.sandbox_job_summary().await {
        Ok(s) => {
            total += s.total;
            pending += s.creating;
@@ -110,8 +107,8 @@ pub async fn jobs_summary_handler(
        }
    }

-    // Agent job counts scoped to this user.
-    match store.agent_job_summary_for_user(&user.user_id).await {
+    // Agent job counts.
+    match store.agent_job_summary().await {
        Ok(s) => {
            total += s.total;
            pending += s.pending;
@@ -137,7 +134,6 @@ pub async fn jobs_summary_handler(

 pub async fn jobs_detail_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
 ) -> Result<Json<JobDetailResponse>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
@@ -149,213 +145,169 @@ pub async fn jobs_detail_handler(
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid job ID".to_string()))?;

    // Try sandbox job from DB first.
-    match store.get_sandbox_job(job_id).await {
-        Ok(Some(job)) => {
-            if job.user_id != user.user_id {
-                return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-            }
-            let browse_id = std::path::Path::new(&job.project_dir)
-                .file_name()
-                .map(|n| n.to_string_lossy().to_string())
-                .unwrap_or_else(|| job.id.to_string());
+    if let Ok(Some(job)) = store.get_sandbox_job(job_id).await {
+        let browse_id = std::path::Path::new(&job.project_dir)
+            .file_name()
+            .map(|n| n.to_string_lossy().to_string())
+            .unwrap_or_else(|| job.id.to_string());

-            let ui_state = match job.status.as_str() {
-                "creating" => "pending",
-                "running" => "in_progress",
-                s => s,
-            };
+        let ui_state = match job.status.as_str() {
+            "creating" => "pending",
+            "running" => "in_progress",
+            s => s,
+        };

-            let elapsed_secs = job.started_at.map(|start| {
-                let end = job.completed_at.unwrap_or_else(chrono::Utc::now);
-                (end - start).num_seconds().max(0) as u64
+        let elapsed_secs = job.started_at.map(|start| {
+            let end = job.completed_at.unwrap_or_else(chrono::Utc::now);
+            (end - start).num_seconds().max(0) as u64
+        });
+
+        // Synthesize transitions from timestamps.
+        let mut transitions = Vec::new();
+        if let Some(started) = job.started_at {
+            transitions.push(TransitionInfo {
+                from: "creating".to_string(),
+                to: "running".to_string(),
+                timestamp: started.to_rfc3339(),
+                reason: None,
            });
-
-            // Synthesize transitions from timestamps.
-            let mut transitions = Vec::new();
-            if let Some(started) = job.started_at {
-                transitions.push(TransitionInfo {
-                    from: "creating".to_string(),
-                    to: "running".to_string(),
-                    timestamp: started.to_rfc3339(),
-                    reason: None,
-                });
-            }
-            if let Some(completed) = job.completed_at {
-                transitions.push(TransitionInfo {
-                    from: "running".to_string(),
-                    to: job.status.clone(),
-                    timestamp: completed.to_rfc3339(),
-                    reason: job.failure_reason.clone(),
-                });
-            }
-
-            let mode = store.get_sandbox_job_mode(job.id).await.ok().flatten();
-            let is_claude_code = mode.as_deref() == Some("claude_code");
-
-            return Ok(Json(JobDetailResponse {
-                id: job.id,
-                title: job.task.clone(),
-                description: String::new(),
-                state: ui_state.to_string(),
-                user_id: job.user_id.clone(),
-                created_at: job.created_at.to_rfc3339(),
-                started_at: job.started_at.map(|dt| dt.to_rfc3339()),
-                completed_at: job.completed_at.map(|dt| dt.to_rfc3339()),
-                elapsed_secs,
-                project_dir: Some(job.project_dir.clone()),
-                browse_url: Some(format!("/projects/{}/", browse_id)),
-                job_mode: mode.filter(|m| m != "worker"),
-                transitions,
-                can_restart: state.job_manager.is_some(),
-                can_prompt: is_claude_code && state.prompt_queue.is_some(),
-                job_kind: Some("sandbox".to_string()),
-            }));
        }
-        Ok(None) => {}
-        Err(e) => {
-            return Err((
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {}", e),
-            ));
+        if let Some(completed) = job.completed_at {
+            transitions.push(TransitionInfo {
+                from: "running".to_string(),
+                to: job.status.clone(),
+                timestamp: completed.to_rfc3339(),
+                reason: job.failure_reason.clone(),
+            });
        }
+
+        let mode = store.get_sandbox_job_mode(job.id).await.ok().flatten();
+        let is_claude_code = mode.as_deref() == Some("claude_code");
+
+        return Ok(Json(JobDetailResponse {
+            id: job.id,
+            title: job.task.clone(),
+            description: String::new(),
+            state: ui_state.to_string(),
+            user_id: job.user_id.clone(),
+            created_at: job.created_at.to_rfc3339(),
+            started_at: job.started_at.map(|dt| dt.to_rfc3339()),
+            completed_at: job.completed_at.map(|dt| dt.to_rfc3339()),
+            elapsed_secs,
+            project_dir: Some(job.project_dir.clone()),
+            browse_url: Some(format!("/projects/{}/", browse_id)),
+            job_mode: mode.filter(|m| m != "worker"),
+            transitions,
+            can_restart: state.job_manager.is_some(),
+            can_prompt: is_claude_code && state.prompt_queue.is_some(),
+            job_kind: Some("sandbox".to_string()),
+        }));
    }

    // Fall back to agent job from DB.
-    match store.get_job(job_id).await {
-        Ok(Some(ctx)) => {
-            if ctx.user_id != user.user_id {
-                return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-            }
-            let elapsed_secs = ctx.started_at.map(|start| {
-                let end = ctx.completed_at.unwrap_or_else(chrono::Utc::now);
-                (end - start).num_seconds().max(0) as u64
-            });
+    if let Ok(Some(ctx)) = store.get_job(job_id).await {
+        let elapsed_secs = ctx.started_at.map(|start| {
+            let end = ctx.completed_at.unwrap_or_else(chrono::Utc::now);
+            (end - start).num_seconds().max(0) as u64
+        });

-            // Only show prompt bar for jobs that have a running worker (Pending/InProgress).
-            // Stuck jobs have no active worker loop, so messages would be silently dropped.
-            let is_promptable = matches!(
-                ctx.state,
-                crate::context::JobState::Pending | crate::context::JobState::InProgress
-            );
-            Ok(Json(JobDetailResponse {
-                id: ctx.job_id,
-                title: ctx.title.clone(),
-                description: ctx.description.clone(),
-                state: ctx.state.to_string(),
-                user_id: ctx.user_id.clone(),
-                created_at: ctx.created_at.to_rfc3339(),
-                started_at: ctx.started_at.map(|dt| dt.to_rfc3339()),
-                completed_at: ctx.completed_at.map(|dt| dt.to_rfc3339()),
-                elapsed_secs,
-                project_dir: None,
-                browse_url: None,
-                job_mode: None,
-                transitions: Vec::new(),
-                can_restart: state.scheduler.is_some(),
-                can_prompt: is_promptable && state.scheduler.is_some(),
-                job_kind: Some("agent".to_string()),
-            }))
-        }
-        Ok(None) => Err((StatusCode::NOT_FOUND, "Job not found".to_string())),
-        Err(e) => Err((
-            StatusCode::INTERNAL_SERVER_ERROR,
-            format!("Database error: {}", e),
-        )),
+        // Only show prompt bar for jobs that have a running worker (Pending/InProgress).
+        // Stuck jobs have no active worker loop, so messages would be silently dropped.
+        let is_promptable = matches!(
+            ctx.state,
+            crate::context::JobState::Pending | crate::context::JobState::InProgress
+        );
+        return Ok(Json(JobDetailResponse {
+            id: ctx.job_id,
+            title: ctx.title.clone(),
+            description: ctx.description.clone(),
+            state: ctx.state.to_string(),
+            user_id: ctx.user_id.clone(),
+            created_at: ctx.created_at.to_rfc3339(),
+            started_at: ctx.started_at.map(|dt| dt.to_rfc3339()),
+            completed_at: ctx.completed_at.map(|dt| dt.to_rfc3339()),
+            elapsed_secs,
+            project_dir: None,
+            browse_url: None,
+            job_mode: None,
+            transitions: Vec::new(),
+            can_restart: state.scheduler.is_some(),
+            can_prompt: is_promptable && state.scheduler.is_some(),
+            job_kind: Some("agent".to_string()),
+        }));
    }
+
+    Err((StatusCode::NOT_FOUND, "Job not found".to_string()))
 }

 pub async fn jobs_cancel_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
    let job_id = Uuid::parse_str(&id)
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid job ID".to_string()))?;

    // Try sandbox job cancellation.
-    if let Some(ref store) = state.store {
-        match store.get_sandbox_job(job_id).await {
-            Ok(Some(job)) => {
-                if job.user_id != user.user_id {
-                    return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-                }
-                if job.status == "running" || job.status == "creating" {
-                    if let Some(ref jm) = state.job_manager
-                        && let Err(e) = jm.stop_job(job_id).await
-                    {
-                        tracing::warn!(job_id = %job_id, error = %e, "Failed to stop container during cancellation");
-                    }
-                    store
-                        .update_sandbox_job_status(
-                            job_id,
-                            "failed",
-                            Some(false),
-                            Some("Cancelled by user"),
-                            None,
-                            Some(chrono::Utc::now()),
-                        )
-                        .await
-                        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-                }
-                return Ok(Json(serde_json::json!({
-                    "status": "cancelled",
-                    "job_id": job_id,
-                })));
-            }
-            Ok(None) => {}
-            Err(e) => {
-                return Err((
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("Database error: {}", e),
-                ));
+    if let Some(ref store) = state.store
+        && let Ok(Some(job)) = store.get_sandbox_job(job_id).await
+    {
+        if job.status == "running" || job.status == "creating" {
+            // Stop the container if we have a job manager.
+            if let Some(ref jm) = state.job_manager
+                && let Err(e) = jm.stop_job(job_id).await
+            {
+                tracing::warn!(job_id = %job_id, error = %e, "Failed to stop container during cancellation");
            }
+            store
+                .update_sandbox_job_status(
+                    job_id,
+                    "failed",
+                    Some(false),
+                    Some("Cancelled by user"),
+                    None,
+                    Some(chrono::Utc::now()),
+                )
+                .await
+                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
        }
+        return Ok(Json(serde_json::json!({
+            "status": "cancelled",
+            "job_id": job_id,
+        })));
    }

    // Fall back to agent job cancellation: stop the worker via the scheduler
    // (which updates the in-memory ContextManager AND aborts the task handle),
    // then persist the status to the DB as a fallback.
-    if let Some(ref store) = state.store {
-        match store.get_job(job_id).await {
-            Ok(Some(job)) => {
-                if job.user_id != user.user_id {
-                    return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-                }
-                if job.state.is_active() {
-                    // Try to stop via scheduler (aborts the worker task + updates
-                    // in-memory ContextManager). This is best-effort — the job may
-                    // not be in the scheduler map if it already finished.
-                    if let Some(ref slot) = state.scheduler
-                        && let Some(ref scheduler) = *slot.read().await
-                    {
-                        let _ = scheduler.stop(job_id).await;
-                    }
+    if let Some(ref store) = state.store
+        && let Ok(Some(job)) = store.get_job(job_id).await
+    {
+        if job.state.is_active() {
+            // Try to stop via scheduler (aborts the worker task + updates
+            // in-memory ContextManager). This is best-effort — the job may
+            // not be in the scheduler map if it already finished.
+            if let Some(ref slot) = state.scheduler
+                && let Some(ref scheduler) = *slot.read().await
+            {
+                let _ = scheduler.stop(job_id).await;
+            }

-                    // Always persist cancellation to the DB so the state is
-                    // consistent even if the scheduler wasn't available or the
-                    // job wasn't in its in-memory map.
-                    store
-                        .update_job_status(
-                            job_id,
-                            crate::context::JobState::Cancelled,
-                            Some("Cancelled by user"),
-                        )
-                        .await
-                        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-                }
-                return Ok(Json(serde_json::json!({
-                    "status": "cancelled",
-                    "job_id": job_id,
-                })));
-            }
-            Ok(None) => {}
-            Err(e) => {
-                return Err((
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("Database error: {}", e),
-                ));
-            }
+            // Always persist cancellation to the DB so the state is
+            // consistent even if the scheduler wasn't available or the
+            // job wasn't in its in-memory map.
+            store
+                .update_job_status(
+                    job_id,
+                    crate::context::JobState::Cancelled,
+                    Some("Cancelled by user"),
+                )
+                .await
+                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
        }
+        return Ok(Json(serde_json::json!({
+            "status": "cancelled",
+            "job_id": job_id,
+        })));
    }

    Err((StatusCode::NOT_FOUND, "Job not found".to_string()))
@@ -363,7 +315,6 @@ pub async fn jobs_cancel_handler(

 pub async fn jobs_restart_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
@@ -375,166 +326,146 @@ pub async fn jobs_restart_handler(
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid job ID".to_string()))?;

    // Try sandbox job restart first.
-    match store.get_sandbox_job(old_job_id).await {
-        Ok(Some(old_job)) => {
-            if old_job.user_id != user.user_id {
-                return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-            }
-            if old_job.status != "interrupted" && old_job.status != "failed" {
-                return Err((
-                    StatusCode::CONFLICT,
-                    format!("Cannot restart job in state '{}'", old_job.status),
-                ));
-            }
-
-            let jm = state.job_manager.as_ref().ok_or((
-                StatusCode::SERVICE_UNAVAILABLE,
-                "Sandbox not enabled".to_string(),
-            ))?;
-
-            // Enrich the task with failure context.
-            let task = if let Some(ref reason) = old_job.failure_reason {
-                format!(
-                    "Previous attempt failed: {}. Retry: {}",
-                    reason, old_job.task
-                )
-            } else {
-                old_job.task.clone()
-            };
-
-            let new_job_id = Uuid::new_v4();
-            let now = chrono::Utc::now();
-
-            let record = crate::history::SandboxJobRecord {
-                id: new_job_id,
-                task: task.clone(),
-                status: "creating".to_string(),
-                user_id: old_job.user_id.clone(),
-                project_dir: old_job.project_dir.clone(),
-                success: None,
-                failure_reason: None,
-                created_at: now,
-                started_at: None,
-                completed_at: None,
-                credential_grants_json: old_job.credential_grants_json.clone(),
-            };
-            store
-                .save_sandbox_job(&record)
-                .await
-                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-
-            let mode = match store.get_sandbox_job_mode(old_job_id).await {
-                Ok(Some(m)) if m == "claude_code" => {
-                    crate::orchestrator::job_manager::JobMode::ClaudeCode
-                }
-                _ => crate::orchestrator::job_manager::JobMode::Worker,
-            };
-
-            let credential_grants: Vec<crate::orchestrator::auth::CredentialGrant> =
-                serde_json::from_str(&old_job.credential_grants_json).unwrap_or_else(|e| {
-                    tracing::warn!(
-                        job_id = %old_job.id,
-                        "Failed to deserialize credential grants from stored job: {}. \
-                         Restarted job will have no credentials.",
-                        e
-                    );
-                    vec![]
-                });
-
-            let project_dir = std::path::PathBuf::from(&old_job.project_dir);
-            let _token = jm
-                .create_job(
-                    new_job_id,
-                    &task,
-                    Some(project_dir),
-                    mode,
-                    credential_grants,
-                )
-                .await
-                .map_err(|e| {
-                    (
-                        StatusCode::INTERNAL_SERVER_ERROR,
-                        format!("Failed to create container: {}", e),
-                    )
-                })?;
-
-            store
-                .update_sandbox_job_status(new_job_id, "running", None, None, Some(now), None)
-                .await
-                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-
-            return Ok(Json(serde_json::json!({
-                "status": "restarted",
-                "old_job_id": old_job_id,
-                "new_job_id": new_job_id,
-            })));
-        }
-        Ok(None) => {}
-        Err(e) => {
+    if let Ok(Some(old_job)) = store.get_sandbox_job(old_job_id).await {
+        if old_job.status != "interrupted" && old_job.status != "failed" {
            return Err((
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {}", e),
+                StatusCode::CONFLICT,
+                format!("Cannot restart job in state '{}'", old_job.status),
            ));
        }
+
+        let jm = state.job_manager.as_ref().ok_or((
+            StatusCode::SERVICE_UNAVAILABLE,
+            "Sandbox not enabled".to_string(),
+        ))?;
+
+        // Enrich the task with failure context.
+        let task = if let Some(ref reason) = old_job.failure_reason {
+            format!(
+                "Previous attempt failed: {}. Retry: {}",
+                reason, old_job.task
+            )
+        } else {
+            old_job.task.clone()
+        };
+
+        let new_job_id = Uuid::new_v4();
+        let now = chrono::Utc::now();
+
+        let record = crate::history::SandboxJobRecord {
+            id: new_job_id,
+            task: task.clone(),
+            status: "creating".to_string(),
+            user_id: old_job.user_id.clone(),
+            project_dir: old_job.project_dir.clone(),
+            success: None,
+            failure_reason: None,
+            created_at: now,
+            started_at: None,
+            completed_at: None,
+            credential_grants_json: old_job.credential_grants_json.clone(),
+        };
+        store
+            .save_sandbox_job(&record)
+            .await
+            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+        let mode = match store.get_sandbox_job_mode(old_job_id).await {
+            Ok(Some(m)) if m == "claude_code" => {
+                crate::orchestrator::job_manager::JobMode::ClaudeCode
+            }
+            _ => crate::orchestrator::job_manager::JobMode::Worker,
+        };
+
+        let credential_grants: Vec<crate::orchestrator::auth::CredentialGrant> =
+            serde_json::from_str(&old_job.credential_grants_json).unwrap_or_else(|e| {
+                tracing::warn!(
+                    job_id = %old_job.id,
+                    "Failed to deserialize credential grants from stored job: {}. \
+                     Restarted job will have no credentials.",
+                    e
+                );
+                vec![]
+            });
+
+        let project_dir = std::path::PathBuf::from(&old_job.project_dir);
+        let _token = jm
+            .create_job(
+                new_job_id,
+                &task,
+                Some(project_dir),
+                mode,
+                credential_grants,
+            )
+            .await
+            .map_err(|e| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("Failed to create container: {}", e),
+                )
+            })?;
+
+        store
+            .update_sandbox_job_status(new_job_id, "running", None, None, Some(now), None)
+            .await
+            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+        return Ok(Json(serde_json::json!({
+            "status": "restarted",
+            "old_job_id": old_job_id,
+            "new_job_id": new_job_id,
+        })));
    }

    // Try agent job restart: dispatch a new job via the scheduler.
-    match store.get_job(old_job_id).await {
-        Ok(Some(old_job)) => {
-            if old_job.user_id != user.user_id {
-                return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-            }
-            if old_job.state.is_active() {
-                return Err((
-                    StatusCode::CONFLICT,
-                    format!("Cannot restart job in state '{}'", old_job.state),
-                ));
-            }
-
-            let slot = state.scheduler.as_ref().ok_or((
-                StatusCode::SERVICE_UNAVAILABLE,
-                "Scheduler not available".to_string(),
-            ))?;
-            let scheduler_guard = slot.read().await;
-            let scheduler = scheduler_guard.as_ref().ok_or((
-                StatusCode::SERVICE_UNAVAILABLE,
-                "Agent not started yet".to_string(),
-            ))?;
-
-            // Look up failure reason (O(1) point lookup).
-            let failure_reason = store
-                .get_agent_job_failure_reason(old_job_id)
-                .await
-                .ok()
-                .flatten()
-                .unwrap_or_default();
-
-            let title = if !failure_reason.is_empty() {
-                format!(
-                    "Previous attempt failed: {}. Retry: {}",
-                    failure_reason, old_job.title
-                )
-            } else {
-                old_job.title.clone()
-            };
-
-            let new_job_id = scheduler
-                .dispatch_job(&old_job.user_id, &title, &old_job.description, None)
-                .await
-                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-
-            Ok(Json(serde_json::json!({
-                "status": "restarted",
-                "old_job_id": old_job_id,
-                "new_job_id": new_job_id,
-            })))
+    if let Ok(Some(old_job)) = store.get_job(old_job_id).await {
+        if old_job.state.is_active() {
+            return Err((
+                StatusCode::CONFLICT,
+                format!("Cannot restart job in state '{}'", old_job.state),
+            ));
        }
-        Ok(None) => Err((StatusCode::NOT_FOUND, "Job not found".to_string())),
-        Err(e) => Err((
-            StatusCode::INTERNAL_SERVER_ERROR,
-            format!("Database error: {}", e),
-        )),
+
+        let slot = state.scheduler.as_ref().ok_or((
+            StatusCode::SERVICE_UNAVAILABLE,
+            "Scheduler not available".to_string(),
+        ))?;
+        let scheduler_guard = slot.read().await;
+        let scheduler = scheduler_guard.as_ref().ok_or((
+            StatusCode::SERVICE_UNAVAILABLE,
+            "Agent not started yet".to_string(),
+        ))?;
+
+        // Look up failure reason (O(1) point lookup).
+        let failure_reason = store
+            .get_agent_job_failure_reason(old_job_id)
+            .await
+            .ok()
+            .flatten()
+            .unwrap_or_default();
+
+        let title = if !failure_reason.is_empty() {
+            format!(
+                "Previous attempt failed: {}. Retry: {}",
+                failure_reason, old_job.title
+            )
+        } else {
+            old_job.title.clone()
+        };
+
+        let new_job_id = scheduler
+            .dispatch_job(&old_job.user_id, &title, &old_job.description, None)
+            .await
+            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
+        return Ok(Json(serde_json::json!({
+            "status": "restarted",
+            "old_job_id": old_job_id,
+            "new_job_id": new_job_id,
+        })));
    }
+
+    Err((StatusCode::NOT_FOUND, "Job not found".to_string()))
 }

 /// Submit a follow-up prompt to a running job.
@@ -545,7 +476,6 @@ pub async fn jobs_restart_handler(
 /// - Worker-mode sandbox jobs → not supported (no mechanism to inject)
 pub async fn jobs_prompt_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
    Json(body): Json<serde_json::Value>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
@@ -564,15 +494,10 @@ pub async fn jobs_prompt_handler(

    let done = body.get("done").and_then(|v| v.as_bool()).unwrap_or(false);

-    // Try sandbox job path first: verify ownership, then route to Claude Code or reject.
+    // Try sandbox job path: check if we have a sandbox record for this ID.
    if let Some(ref s) = state.store
-        && let Ok(Some(sandbox_job)) = s.get_sandbox_job(job_id).await
+        && let Ok(Some(_)) = s.get_sandbox_job(job_id).await
    {
-        // Verify ownership.
-        if sandbox_job.user_id != user.user_id {
-            return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-        }
-
        // It's a sandbox job. Check if Claude Code mode.
        let mode = s.get_sandbox_job_mode(job_id).await.ok().flatten();
        if mode.as_deref() == Some("claude_code") {
@@ -597,26 +522,7 @@ pub async fn jobs_prompt_handler(
        }
    }

-    // Try agent job path: verify ownership, then send via scheduler.
-    if let Some(ref store) = state.store {
-        match store.get_job(job_id).await {
-            Ok(Some(agent_job)) => {
-                if agent_job.user_id != user.user_id {
-                    return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-                }
-            }
-            Ok(None) => {
-                return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-            }
-            Err(e) => {
-                return Err((
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("Database error: {}", e),
-                ));
-            }
-        }
-    }
-
+    // Try agent job path: send via scheduler.
    let slot = state.scheduler.as_ref().ok_or((
        StatusCode::NOT_IMPLEMENTED,
        "Agent job prompts require the scheduler to be configured".to_string(),
@@ -644,7 +550,6 @@ pub async fn jobs_prompt_handler(
 /// Load persisted job events for a job (for history replay on page open).
 pub async fn jobs_events_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
@@ -656,24 +561,6 @@ pub async fn jobs_events_handler(
        .parse()
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid job ID".to_string()))?;

-    // Verify ownership before returning events.
-    match store.get_sandbox_job(job_id).await {
-        Ok(Some(job)) => {
-            if job.user_id != user.user_id {
-                return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-            }
-        }
-        Ok(None) => {
-            return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-        }
-        Err(e) => {
-            return Err((
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {}", e),
-            ));
-        }
-    }
-
    let events = store
        .list_job_events(job_id, None)
        .await
@@ -706,7 +593,6 @@ pub struct FilePathQuery {

 pub async fn job_files_list_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
    Query(query): Query<FilePathQuery>,
 ) -> Result<Json<ProjectFilesResponse>, (StatusCode, String)> {
@@ -724,10 +610,6 @@ pub async fn job_files_list_handler(
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or((StatusCode::NOT_FOUND, "Job not found".to_string()))?;

-    if job.user_id != user.user_id {
-        return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-    }
-
    let base = std::path::PathBuf::from(&job.project_dir);
    let rel_path = query.path.as_deref().unwrap_or("");
    let target = base.join(rel_path);
@@ -774,7 +656,6 @@ pub async fn job_files_list_handler(

 pub async fn job_files_read_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
    Query(query): Query<FilePathQuery>,
 ) -> Result<Json<ProjectFileReadResponse>, (StatusCode, String)> {
@@ -792,10 +673,6 @@ pub async fn job_files_read_handler(
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or((StatusCode::NOT_FOUND, "Job not found".to_string()))?;

-    if job.user_id != user.user_id {
-        return Err((StatusCode::NOT_FOUND, "Job not found".to_string()));
-    }
-
    let path = query.path.as_deref().ok_or((
        StatusCode::BAD_REQUEST,
        "path parameter required".to_string(),
@@ -9,27 +9,8 @@ use axum::{
 };
 use serde::Deserialize;

-use crate::channels::web::auth::{AuthenticatedUser, UserIdentity};
 use crate::channels::web::server::GatewayState;
 use crate::channels::web::types::*;
-use crate::workspace::Workspace;
-
-/// Resolve the workspace for the authenticated user.
-///
-/// Prefers `workspace_pool` (multi-user mode) when available, falling back
-/// to the single-user `state.workspace`.
-pub(crate) async fn resolve_workspace(
-    state: &GatewayState,
-    user: &UserIdentity,
-) -> Result<Arc<Workspace>, (StatusCode, String)> {
-    if let Some(ref pool) = state.workspace_pool {
-        return Ok(pool.get_or_create(user).await);
-    }
-    state.workspace.as_ref().cloned().ok_or((
-        StatusCode::SERVICE_UNAVAILABLE,
-        "Workspace not available".to_string(),
-    ))
-}

 #[derive(Deserialize)]
 pub struct TreeQuery {
@@ -39,10 +20,12 @@ pub struct TreeQuery {

 pub async fn memory_tree_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Query(_query): Query<TreeQuery>,
 ) -> Result<Json<MemoryTreeResponse>, (StatusCode, String)> {
-    let workspace = resolve_workspace(&state, &user).await?;
+    let workspace = state.workspace.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "Workspace not available".to_string(),
+    ))?;

    // Build tree from list_all (flat list of all paths)
    let all_paths = workspace
@@ -85,10 +68,12 @@ pub struct ListQuery {

 pub async fn memory_list_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Query(query): Query<ListQuery>,
 ) -> Result<Json<MemoryListResponse>, (StatusCode, String)> {
-    let workspace = resolve_workspace(&state, &user).await?;
+    let workspace = state.workspace.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "Workspace not available".to_string(),
+    ))?;

    let path = query.path.as_deref().unwrap_or("");
    let entries = workspace
@@ -119,10 +104,12 @@ pub struct ReadQuery {

 pub async fn memory_read_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Query(query): Query<ReadQuery>,
 ) -> Result<Json<MemoryReadResponse>, (StatusCode, String)> {
-    let workspace = resolve_workspace(&state, &user).await?;
+    let workspace = state.workspace.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "Workspace not available".to_string(),
+    ))?;

    let doc = workspace
        .read(&query.path)
@@ -136,75 +123,17 @@ pub async fn memory_read_handler(
    }))
 }

-pub async fn memory_write_handler(
-    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
-    Json(req): Json<MemoryWriteRequest>,
-) -> Result<Json<MemoryWriteResponse>, (StatusCode, String)> {
-    let workspace = resolve_workspace(&state, &user).await?;
-
-    // Route through layer-aware methods when a layer is specified.
-    //
-    // Note: unlike MemoryWriteTool, this endpoint does NOT block writes to
-    // identity files (IDENTITY.md, SOUL.md, etc.). The HTTP API is an
-    // authenticated admin interface; the supervisor uses it to seed identity
-    // files at startup. Identity-file protection is enforced at the tool
-    // layer (LLM-facing) where the write originates from an untrusted agent.
-    if let Some(ref layer_name) = req.layer {
-        let result = if req.append {
-            workspace
-                .append_to_layer(layer_name, &req.path, &req.content, req.force)
-                .await
-        } else {
-            workspace
-                .write_to_layer(layer_name, &req.path, &req.content, req.force)
-                .await
-        }
-        .map_err(|e| {
-            use crate::error::WorkspaceError;
-            let status = match &e {
-                WorkspaceError::LayerNotFound { .. } => StatusCode::BAD_REQUEST,
-                WorkspaceError::LayerReadOnly { .. } => StatusCode::FORBIDDEN,
-                WorkspaceError::PrivacyRedirectFailed => StatusCode::UNPROCESSABLE_ENTITY,
-                _ => StatusCode::INTERNAL_SERVER_ERROR,
-            };
-            (status, e.to_string())
-        })?;
-        return Ok(Json(MemoryWriteResponse {
-            path: req.path,
-            status: "written",
-            redirected: Some(result.redirected),
-            actual_layer: Some(result.actual_layer),
-        }));
-    }
-
-    // Non-layer path: honor the append field
-    if req.append {
-        workspace
-            .append(&req.path, &req.content)
-            .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-    } else {
-        workspace
-            .write(&req.path, &req.content)
-            .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-    }
-
-    Ok(Json(MemoryWriteResponse {
-        path: req.path,
-        status: "written",
-        redirected: None,
-        actual_layer: None,
-    }))
-}
+// memory_write_handler lives in server.rs (layer-aware version with append,
+// privacy redirect, and proper error status codes).

 pub async fn memory_search_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Json(req): Json<MemorySearchRequest>,
 ) -> Result<Json<MemorySearchResponse>, (StatusCode, String)> {
-    let workspace = resolve_workspace(&state, &user).await?;
+    let workspace = state.workspace.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "Workspace not available".to_string(),
+    ))?;

    let limit = req.limit.unwrap_or(10);
    let results = workspace
@@ -213,10 +142,10 @@ pub async fn memory_search_handler(
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let hits: Vec<SearchHit> = results
-        .iter()
+        .into_iter()
        .map(|r| SearchHit {
-            path: r.document_id.to_string(),
-            content: r.content.clone(),
+            path: r.document_path,
+            content: r.content,
            score: r.score as f64,
        })
        .collect();
@@ -1,10 +1,13 @@
 //! Handler modules for the web gateway API.
 //!
 //! Each module groups related endpoint handlers by domain.
+//!
+//! # Migration status
+//!
+//! `skills` is the canonical implementation used by `server.rs`.
+//! The remaining modules are in-progress migrations from inline server.rs
+//! handlers; their functions are not yet wired up, hence the `dead_code` allow.

-pub mod jobs;
-pub mod memory;
-pub mod routines;
 pub mod skills;

 // Modules not yet wired into server.rs router -- suppress dead_code until
@@ -14,6 +17,12 @@ pub mod chat;
 #[allow(dead_code)]
 pub mod extensions;
 #[allow(dead_code)]
+pub mod jobs;
+#[allow(dead_code)]
+pub mod memory;
+#[allow(dead_code)]
+pub mod routines;
+#[allow(dead_code)]
 pub mod settings;
 #[allow(dead_code)]
 pub mod static_files;
@@ -11,14 +11,12 @@ use serde::Deserialize;
 use uuid::Uuid;

 use crate::agent::routine::{Trigger, next_cron_fire};
-use crate::channels::web::auth::AuthenticatedUser;
 use crate::channels::web::server::GatewayState;
 use crate::channels::web::types::*;
 use crate::error::RoutineError;

 pub async fn routines_list_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
 ) -> Result<Json<RoutineListResponse>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
        StatusCode::SERVICE_UNAVAILABLE,
@@ -26,7 +24,7 @@ pub async fn routines_list_handler(
    ))?;

    let routines = store
-        .list_routines(&user.user_id)
+        .list_all_routines()
        .await
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

@@ -37,7 +35,6 @@ pub async fn routines_list_handler(

 pub async fn routines_summary_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
 ) -> Result<Json<RoutineSummaryResponse>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
        StatusCode::SERVICE_UNAVAILABLE,
@@ -45,7 +42,7 @@ pub async fn routines_summary_handler(
    ))?;

    let routines = store
-        .list_routines(&user.user_id)
+        .list_all_routines()
        .await
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

@@ -81,7 +78,6 @@ pub async fn routines_summary_handler(

 pub async fn routines_detail_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
 ) -> Result<Json<RoutineDetailResponse>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
@@ -98,10 +94,6 @@ pub async fn routines_detail_handler(
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or((StatusCode::NOT_FOUND, "Routine not found".to_string()))?;

-    if routine.user_id != user.user_id {
-        return Err((StatusCode::NOT_FOUND, "Routine not found".to_string()));
-    }
-
    let runs = store
        .list_routine_runs(routine_id, 20)
        .await
@@ -114,7 +106,7 @@ pub async fn routines_detail_handler(
            trigger_type: run.trigger_type.clone(),
            started_at: run.started_at.to_rfc3339(),
            completed_at: run.completed_at.map(|dt| dt.to_rfc3339()),
-            status: run.status.to_string(),
+            status: format!("{:?}", run.status),
            result_summary: run.result_summary.clone(),
            tokens_used: run.tokens_used,
            job_id: run.job_id,
@@ -145,7 +137,6 @@ pub async fn routines_detail_handler(

 pub async fn routines_trigger_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
    // Clone the Arc out of the lock to avoid holding the RwLock across .await.
@@ -161,7 +152,7 @@ pub async fn routines_trigger_handler(
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid routine ID".to_string()))?;

    let run_id = engine
-        .fire_manual(routine_id, Some(&user.user_id))
+        .fire_manual(routine_id, Some(&state.user_id))
        .await
        .map_err(|e| (routine_error_status(&e), e.to_string()))?;

@@ -179,7 +170,6 @@ pub struct ToggleRequest {

 pub async fn routines_toggle_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
    body: Option<Json<ToggleRequest>>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
@@ -197,10 +187,6 @@ pub async fn routines_toggle_handler(
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or((StatusCode::NOT_FOUND, "Routine not found".to_string()))?;

-    if routine.user_id != user.user_id {
-        return Err((StatusCode::NOT_FOUND, "Routine not found".to_string()));
-    }
-
    let was_enabled = routine.enabled;
    // If a specific value was provided, use it; otherwise toggle.
    routine.enabled = match body {
@@ -244,7 +230,6 @@ pub async fn routines_toggle_handler(

 pub async fn routines_delete_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
@@ -255,17 +240,6 @@ pub async fn routines_delete_handler(
    let routine_id = Uuid::parse_str(&id)
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid routine ID".to_string()))?;

-    // Verify ownership before deleting.
-    let routine = store
-        .get_routine(routine_id)
-        .await
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
-        .ok_or((StatusCode::NOT_FOUND, "Routine not found".to_string()))?;
-
-    if routine.user_id != user.user_id {
-        return Err((StatusCode::NOT_FOUND, "Routine not found".to_string()));
-    }
-
    let deleted = store
        .delete_routine(routine_id)
        .await
@@ -287,10 +261,8 @@ pub async fn routines_delete_handler(
    }
 }

-#[allow(dead_code)] // Used by server.rs inline version; kept in sync here for future migration.
 pub async fn routines_runs_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
    let store = state.store.as_ref().ok_or((
@@ -301,17 +273,6 @@ pub async fn routines_runs_handler(
    let routine_id = Uuid::parse_str(&id)
        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid routine ID".to_string()))?;

-    // Verify ownership before listing runs.
-    let routine = store
-        .get_routine(routine_id)
-        .await
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
-        .ok_or((StatusCode::NOT_FOUND, "Routine not found".to_string()))?;
-
-    if routine.user_id != user.user_id {
-        return Err((StatusCode::NOT_FOUND, "Routine not found".to_string()));
-    }
-
    let runs = store
        .list_routine_runs(routine_id, 50)
        .await
@@ -324,7 +285,7 @@ pub async fn routines_runs_handler(
            trigger_type: run.trigger_type.clone(),
            started_at: run.started_at.to_rfc3339(),
            completed_at: run.completed_at.map(|dt| dt.to_rfc3339()),
-            status: run.status.to_string(),
+            status: format!("{:?}", run.status),
            result_summary: run.result_summary.clone(),
            tokens_used: run.tokens_used,
            job_id: run.job_id,
@@ -8,19 +8,17 @@ use axum::{
    http::StatusCode,
 };

-use crate::channels::web::auth::AuthenticatedUser;
 use crate::channels::web::server::GatewayState;
 use crate::channels::web::types::*;

 pub async fn settings_list_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
 ) -> Result<Json<SettingsListResponse>, StatusCode> {
    let store = state
        .store
        .as_ref()
        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
-    let rows = store.list_settings(&user.user_id).await.map_err(|e| {
+    let rows = store.list_settings(&state.user_id).await.map_err(|e| {
        tracing::error!("Failed to list settings: {}", e);
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
@@ -39,7 +37,6 @@ pub async fn settings_list_handler(

 pub async fn settings_get_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(key): Path<String>,
 ) -> Result<Json<SettingResponse>, StatusCode> {
    let store = state
@@ -47,7 +44,7 @@ pub async fn settings_get_handler(
        .as_ref()
        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
    let row = store
-        .get_setting_full(&user.user_id, &key)
+        .get_setting_full(&state.user_id, &key)
        .await
        .map_err(|e| {
            tracing::error!("Failed to get setting '{}': {}", key, e);
@@ -64,7 +61,6 @@ pub async fn settings_get_handler(

 pub async fn settings_set_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(key): Path<String>,
    Json(body): Json<SettingWriteRequest>,
 ) -> Result<StatusCode, StatusCode> {
@@ -73,7 +69,7 @@ pub async fn settings_set_handler(
        .as_ref()
        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
    store
-        .set_setting(&user.user_id, &key, &body.value)
+        .set_setting(&state.user_id, &key, &body.value)
        .await
        .map_err(|e| {
            tracing::error!("Failed to set setting '{}': {}", key, e);
@@ -85,7 +81,6 @@ pub async fn settings_set_handler(

 pub async fn settings_delete_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Path(key): Path<String>,
 ) -> Result<StatusCode, StatusCode> {
    let store = state
@@ -93,7 +88,7 @@ pub async fn settings_delete_handler(
        .as_ref()
        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
    store
-        .delete_setting(&user.user_id, &key)
+        .delete_setting(&state.user_id, &key)
        .await
        .map_err(|e| {
            tracing::error!("Failed to delete setting '{}': {}", key, e);
@@ -105,13 +100,12 @@ pub async fn settings_delete_handler(

 pub async fn settings_export_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
 ) -> Result<Json<SettingsExportResponse>, StatusCode> {
    let store = state
        .store
        .as_ref()
        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
-    let settings = store.get_all_settings(&user.user_id).await.map_err(|e| {
+    let settings = store.get_all_settings(&state.user_id).await.map_err(|e| {
        tracing::error!("Failed to export settings: {}", e);
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
@@ -121,7 +115,6 @@ pub async fn settings_export_handler(

 pub async fn settings_import_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    Json(body): Json<SettingsImportRequest>,
 ) -> Result<StatusCode, StatusCode> {
    let store = state
@@ -129,7 +122,7 @@ pub async fn settings_import_handler(
        .as_ref()
        .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
    store
-        .set_all_settings(&user.user_id, &body.settings)
+        .set_all_settings(&state.user_id, &body.settings)
        .await
        .map_err(|e| {
            tracing::error!("Failed to import settings: {}", e);
@@ -8,13 +8,11 @@ use axum::{
    http::StatusCode,
 };

-use crate::channels::web::auth::AuthenticatedUser;
 use crate::channels::web::server::GatewayState;
 use crate::channels::web::types::*;

 pub async fn skills_list_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(_user): AuthenticatedUser,
 ) -> Result<Json<SkillListResponse>, (StatusCode, String)> {
    let registry = state.skill_registry.as_ref().ok_or((
        StatusCode::NOT_IMPLEMENTED,
@@ -47,7 +45,6 @@ pub async fn skills_list_handler(

 pub async fn skills_search_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(_user): AuthenticatedUser,
    Json(req): Json<SkillSearchRequest>,
 ) -> Result<Json<SkillSearchResponse>, (StatusCode, String)> {
    let registry = state.skill_registry.as_ref().ok_or((
@@ -122,7 +119,6 @@ pub async fn skills_search_handler(

 pub async fn skills_install_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    headers: axum::http::HeaderMap,
    Json(req): Json<SkillInstallRequest>,
 ) -> Result<Json<ActionResponse>, (StatusCode, String)> {
@@ -139,8 +135,6 @@ pub async fn skills_install_handler(
        ));
    }

-    tracing::info!(user_id = %user.user_id, skill = %req.name, "skill install requested");
-
    let registry = state.skill_registry.as_ref().ok_or((
        StatusCode::NOT_IMPLEMENTED,
        "Skills system not enabled".to_string(),
@@ -225,7 +219,6 @@ pub async fn skills_install_handler(

 pub async fn skills_remove_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(user): AuthenticatedUser,
    headers: axum::http::HeaderMap,
    Path(name): Path<String>,
 ) -> Result<Json<ActionResponse>, (StatusCode, String)> {
@@ -241,8 +234,6 @@ pub async fn skills_remove_handler(
        ));
    }

-    tracing::info!(user_id = %user.user_id, skill = %name, "skill remove requested");
-
    let registry = state.skill_registry.as_ref().ok_or((
        StatusCode::NOT_IMPLEMENTED,
        "Skills system not enabled".to_string(),
@@ -7,7 +7,6 @@ use axum::{
 };

 use crate::bootstrap::ironclaw_base_dir;
-use crate::channels::web::auth::AuthenticatedUser;
 use crate::channels::web::types::*;

 // --- Static file handlers ---
@@ -114,7 +113,6 @@ use crate::channels::web::server::GatewayState;

 pub async fn logs_events_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(_user): AuthenticatedUser,
 ) -> Result<
    Sse<impl futures::Stream<Item = Result<Event, Infallible>> + Send + 'static>,
    (StatusCode, String),
@@ -154,7 +152,6 @@ pub async fn logs_events_handler(

 pub async fn gateway_status_handler(
    State(state): State<Arc<GatewayState>>,
-    AuthenticatedUser(_user): AuthenticatedUser,
 ) -> Json<GatewayStatusResponse> {
    let sse_connections = state.sse.connection_count();
    let ws_connections = state
@@ -54,37 +54,10 @@ fn validate_webhook_secret(
 ///
 /// This endpoint is **public** (no gateway auth token required) but protected
 /// by the per-routine webhook secret sent via the `X-Webhook-Secret` header.
-///
-/// **Single-user/backward-compatible**: looks up routines by path across all
-/// users. For multi-tenant isolation, use the user-scoped endpoint at
-/// `/api/webhooks/u/{user_id}/{path}` instead.
 pub async fn webhook_trigger_handler(
    State(state): State<Arc<GatewayState>>,
    Path(path): Path<String>,
    headers: HeaderMap,
-) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
-    fire_webhook_inner(state, &path, None, &headers).await
-}
-
-/// Handle incoming webhook POST to `/api/webhooks/u/{user_id}/{path}`.
-///
-/// User-scoped variant for multi-tenant deployments. The `user_id` in the URL
-/// restricts the routine lookup to that user only, preventing cross-user
-/// webhook triggering even when paths collide.
-pub async fn webhook_trigger_user_scoped_handler(
-    State(state): State<Arc<GatewayState>>,
-    Path((user_id, path)): Path<(String, String)>,
-    headers: HeaderMap,
-) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
-    fire_webhook_inner(state, &path, Some(&user_id), &headers).await
-}
-
-/// Shared webhook logic for both scoped and unscoped endpoints.
-async fn fire_webhook_inner(
-    state: Arc<GatewayState>,
-    path: &str,
-    user_id: Option<&str>,
-    headers: &HeaderMap,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
    // Rate limit check
    if !state.webhook_rate_limiter.check() {
@@ -99,9 +72,9 @@ async fn fire_webhook_inner(
        "Database not available".to_string(),
    ))?;

-    // Targeted query — when user_id is provided, restrict to that user's routines
+    // Targeted query instead of loading all routines
    let routine = store
-        .get_webhook_routine_by_path(path, user_id)
+        .get_webhook_routine_by_path(&path)
        .await
        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
        .ok_or((
@@ -126,7 +99,7 @@ async fn fire_webhook_inner(
        ))?
    };

-    let run_id = engine.fire_webhook(routine.id, path).await.map_err(|e| {
+    let run_id = engine.fire_webhook(routine.id, &path).await.map_err(|e| {
        let status = match &e {
            crate::error::RoutineError::NotFound { .. } => StatusCode::NOT_FOUND,
            crate::error::RoutineError::Disabled { .. }
@@ -31,9 +31,6 @@ pub mod ws;
 /// [`TestGatewayBuilder`](test_helpers::TestGatewayBuilder).
 pub mod test_helpers;

-#[cfg(test)]
-mod tests;
-
 use std::net::SocketAddr;
 use std::sync::Arc;

@@ -55,24 +52,22 @@ use crate::workspace::Workspace;

 use self::log_layer::{LogBroadcaster, LogLevelHandle};

-use self::auth::MultiAuthState;
 use self::server::GatewayState;
 use self::sse::SseManager;
-use self::types::AppEvent;
+use self::types::SseEvent;

 /// Web gateway channel implementing the Channel trait.
 pub struct GatewayChannel {
    config: GatewayConfig,
    state: Arc<GatewayState>,
-    /// Multi-user auth state (replaces bare auth_token).
-    auth: MultiAuthState,
+    /// The actual auth token in use (generated or from config).
+    auth_token: String,
 }

 impl GatewayChannel {
    /// Create a new gateway channel.
    ///
    /// If no auth token is configured, generates a random one and prints it.
-    /// Builds a single-user `MultiAuthState` from the config.
    pub fn new(config: GatewayConfig) -> Self {
        let auth_token = config.auth_token.clone().unwrap_or_else(|| {
            use rand::RngCore;
@@ -82,13 +77,10 @@ impl GatewayChannel {
            bytes.iter().map(|b| format!("{b:02x}")).collect()
        });

-        let auth = MultiAuthState::single(auth_token, config.user_id.clone());
-
        let state = Arc::new(GatewayState {
            msg_tx: tokio::sync::RwLock::new(None),
-            sse: Arc::new(SseManager::new()),
+            sse: SseManager::new(),
            workspace: None,
-            workspace_pool: None,
            session_manager: None,
            log_broadcaster: None,
            log_level_handle: None,
@@ -98,14 +90,13 @@ impl GatewayChannel {
            job_manager: None,
            prompt_queue: None,
            scheduler: None,
-            owner_id: config.user_id.clone(),
-            default_sender_id: config.user_id.clone(),
+            user_id: config.user_id.clone(),
            shutdown_tx: tokio::sync::RwLock::new(None),
            ws_tracker: Some(Arc::new(ws::WsConnectionTracker::new())),
            llm_provider: None,
            skill_registry: None,
            skill_catalog: None,
-            chat_rate_limiter: server::PerUserRateLimiter::new(30, 60),
+            chat_rate_limiter: server::RateLimiter::new(30, 60),
            oauth_rate_limiter: server::RateLimiter::new(10, 60),
            webhook_rate_limiter: server::RateLimiter::new(10, 60),
            registry_entries: Vec::new(),
@@ -118,63 +109,7 @@ impl GatewayChannel {
        Self {
            config,
            state,
-            auth,
-        }
-    }
-
-    /// Rebind the single-user auth identity to the durable owner scope while
-    /// preserving the configured gateway sender/routing identity.
-    pub fn with_owner_scope(mut self, owner_id: impl Into<String>) -> Self {
-        let owner_id = owner_id.into();
-        let single_user_token = if self.config.user_tokens.is_none() {
-            self.auth.first_token().map(ToOwned::to_owned)
-        } else {
-            None
-        };
-        if let Some(token) = single_user_token {
-            self.auth = MultiAuthState::single(token, owner_id.clone());
-        }
-        self.rebuild_state(|s| s.owner_id = owner_id);
-        self
-    }
-
-    /// Create a gateway channel with a pre-built multi-user auth state.
-    pub fn new_multi_auth(config: GatewayConfig, auth: MultiAuthState) -> Self {
-        let state = Arc::new(GatewayState {
-            msg_tx: tokio::sync::RwLock::new(None),
-            sse: Arc::new(SseManager::new()),
-            workspace: None,
-            workspace_pool: None,
-            session_manager: None,
-            log_broadcaster: None,
-            log_level_handle: None,
-            extension_manager: None,
-            tool_registry: None,
-            store: None,
-            job_manager: None,
-            prompt_queue: None,
-            scheduler: None,
-            owner_id: config.user_id.clone(),
-            default_sender_id: config.user_id.clone(),
-            shutdown_tx: tokio::sync::RwLock::new(None),
-            ws_tracker: Some(Arc::new(ws::WsConnectionTracker::new())),
-            llm_provider: None,
-            skill_registry: None,
-            skill_catalog: None,
-            chat_rate_limiter: server::PerUserRateLimiter::new(30, 60),
-            oauth_rate_limiter: server::RateLimiter::new(10, 60),
-            registry_entries: Vec::new(),
-            cost_guard: None,
-            routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
-            startup_time: std::time::Instant::now(),
-            webhook_rate_limiter: server::RateLimiter::new(10, 60),
-            active_config: server::ActiveConfigSnapshot::default(),
-        });
-
-        Self {
-            config,
-            state,
-            auth,
+            auth_token,
        }
    }

@@ -183,9 +118,8 @@ impl GatewayChannel {
        let mut new_state = GatewayState {
            msg_tx: tokio::sync::RwLock::new(None),
            // Preserve the existing broadcast channel so sender handles remain valid.
-            sse: Arc::new(SseManager::from_sender(self.state.sse.sender())),
+            sse: SseManager::from_sender(self.state.sse.sender()),
            workspace: self.state.workspace.clone(),
-            workspace_pool: self.state.workspace_pool.clone(),
            session_manager: self.state.session_manager.clone(),
            log_broadcaster: self.state.log_broadcaster.clone(),
            log_level_handle: self.state.log_level_handle.clone(),
@@ -195,14 +129,13 @@ impl GatewayChannel {
            job_manager: self.state.job_manager.clone(),
            prompt_queue: self.state.prompt_queue.clone(),
            scheduler: self.state.scheduler.clone(),
-            owner_id: self.state.owner_id.clone(),
-            default_sender_id: self.state.default_sender_id.clone(),
+            user_id: self.state.user_id.clone(),
            shutdown_tx: tokio::sync::RwLock::new(None),
            ws_tracker: self.state.ws_tracker.clone(),
            llm_provider: self.state.llm_provider.clone(),
            skill_registry: self.state.skill_registry.clone(),
            skill_catalog: self.state.skill_catalog.clone(),
-            chat_rate_limiter: server::PerUserRateLimiter::new(30, 60),
+            chat_rate_limiter: server::RateLimiter::new(30, 60),
            oauth_rate_limiter: server::RateLimiter::new(10, 60),
            webhook_rate_limiter: server::RateLimiter::new(10, 60),
            registry_entries: self.state.registry_entries.clone(),
@@ -327,15 +260,9 @@ impl GatewayChannel {
        self
    }

-    /// Inject the per-user workspace pool for multi-user mode.
-    pub fn with_workspace_pool(mut self, pool: Arc<server::WorkspacePool>) -> Self {
-        self.rebuild_state(|s| s.workspace_pool = Some(pool));
-        self
-    }
-
-    /// Get the first auth token (for printing to console on startup).
+    /// Get the auth token (for printing to console on startup).
    pub fn auth_token(&self) -> &str {
-        self.auth.first_token().unwrap_or("")
+        &self.auth_token
    }

    /// Get a reference to the shared gateway state (for the agent to push SSE events).
@@ -364,7 +291,7 @@ impl Channel for GatewayChannel {
                ),
            })?;

-        server::start_server(addr, self.state.clone(), self.auth.clone()).await?;
+        server::start_server(addr, self.state.clone(), self.auth_token.clone()).await?;

        Ok(Box::pin(ReceiverStream::new(rx)))
    }
@@ -384,13 +311,10 @@ impl Channel for GatewayChannel {
            }
        };

-        self.state.sse.broadcast_for_user(
-            &msg.user_id,
-            AppEvent::Response {
-                content: response.content,
-                thread_id,
-            },
-        );
+        self.state.sse.broadcast(SseEvent::Response {
+            content: response.content,
+            thread_id,
+        });

        Ok(())
    }
@@ -405,11 +329,11 @@ impl Channel for GatewayChannel {
            .and_then(|v| v.as_str())
            .map(String::from);
        let event = match status {
-            StatusUpdate::Thinking(msg) => AppEvent::Thinking {
+            StatusUpdate::Thinking(msg) => SseEvent::Thinking {
                message: msg,
                thread_id: thread_id.clone(),
            },
-            StatusUpdate::ToolStarted { name } => AppEvent::ToolStarted {
+            StatusUpdate::ToolStarted { name } => SseEvent::ToolStarted {
                name,
                thread_id: thread_id.clone(),
            },
@@ -418,23 +342,23 @@ impl Channel for GatewayChannel {
                success,
                error,
                parameters,
-            } => AppEvent::ToolCompleted {
+            } => SseEvent::ToolCompleted {
                name,
                success,
                error,
                parameters,
                thread_id: thread_id.clone(),
            },
-            StatusUpdate::ToolResult { name, preview } => AppEvent::ToolResult {
+            StatusUpdate::ToolResult { name, preview } => SseEvent::ToolResult {
                name,
                preview,
                thread_id: thread_id.clone(),
            },
-            StatusUpdate::StreamChunk(content) => AppEvent::StreamChunk {
+            StatusUpdate::StreamChunk(content) => SseEvent::StreamChunk {
                content,
                thread_id: thread_id.clone(),
            },
-            StatusUpdate::Status(msg) => AppEvent::Status {
+            StatusUpdate::Status(msg) => SseEvent::Status {
                message: msg,
                thread_id: thread_id.clone(),
            },
@@ -442,7 +366,7 @@ impl Channel for GatewayChannel {
                job_id,
                title,
                browse_url,
-            } => AppEvent::JobStarted {
+            } => SseEvent::JobStarted {
                job_id,
                title,
                browse_url,
@@ -453,7 +377,7 @@ impl Channel for GatewayChannel {
                description,
                parameters,
                allow_always,
-            } => AppEvent::ApprovalNeeded {
+            } => SseEvent::ApprovalNeeded {
                request_id,
                tool_name,
                description,
@@ -467,7 +391,7 @@ impl Channel for GatewayChannel {
                instructions,
                auth_url,
                setup_url,
-            } => AppEvent::AuthRequired {
+            } => SseEvent::AuthRequired {
                extension_name,
                instructions,
                auth_url,
@@ -477,39 +401,25 @@ impl Channel for GatewayChannel {
                extension_name,
                success,
                message,
-            } => AppEvent::AuthCompleted {
+            } => SseEvent::AuthCompleted {
                extension_name,
                success,
                message,
            },
-            StatusUpdate::ImageGenerated { data_url, path } => AppEvent::ImageGenerated {
+            StatusUpdate::ImageGenerated { data_url, path } => SseEvent::ImageGenerated {
                data_url,
                path,
                thread_id: thread_id.clone(),
            },
-            StatusUpdate::Suggestions { suggestions } => AppEvent::Suggestions {
+            StatusUpdate::Suggestions { suggestions } => SseEvent::Suggestions {
                suggestions,
-                thread_id: thread_id.clone(),
-            },
-            StatusUpdate::ReasoningUpdate {
-                narrative,
-                decisions,
-            } => AppEvent::ReasoningUpdate {
-                narrative,
-                decisions: decisions
-                    .into_iter()
-                    .map(|d| crate::channels::web::types::ToolDecisionDto {
-                        tool_name: d.tool_name,
-                        rationale: d.rationale,
-                    })
-                    .collect(),
                thread_id,
            },
            StatusUpdate::TurnCost {
                input_tokens,
                output_tokens,
                cost_usd,
-            } => AppEvent::TurnCost {
+            } => SseEvent::TurnCost {
                input_tokens,
                output_tokens,
                cost_usd,
@@ -517,21 +427,13 @@ impl Channel for GatewayChannel {
            },
        };

-        // Scope events to the user when user_id is available in metadata.
-        // When user_id is missing (heartbeat, routines), events go to all
-        // subscribers. In multi-tenant mode this leaks status across users.
-        if let Some(uid) = metadata.get("user_id").and_then(|v| v.as_str()) {
-            self.state.sse.broadcast_for_user(uid, event);
-        } else {
-            tracing::debug!("Status event missing user_id in metadata; broadcasting globally");
-            self.state.sse.broadcast(event);
-        }
+        self.state.sse.broadcast(event);
        Ok(())
    }

    async fn broadcast(
        &self,
-        user_id: &str,
+        _user_id: &str,
        response: OutgoingResponse,
    ) -> Result<(), ChannelError> {
        let thread_id = match response.thread_id {
@@ -543,13 +445,10 @@ impl Channel for GatewayChannel {
                return Ok(());
            }
        };
-        self.state.sse.broadcast_for_user(
-            user_id,
-            AppEvent::Response {
-                content: response.content,
-                thread_id,
-            },
-        );
+        self.state.sse.broadcast(SseEvent::Response {
+            content: response.content,
+            thread_id,
+        });
        Ok(())
    }

@@ -231,7 +231,6 @@ pub fn convert_messages(messages: &[OpenAiMessage]) -> Result<Vec<ChatMessage>,
                                name: tc.function.name.clone(),
                                arguments: serde_json::from_str(&tc.function.arguments)
                                    .unwrap_or(serde_json::Value::Object(Default::default())),
-                                reasoning: None,
                            })
                            .collect();
                        Ok(ChatMessage::assistant_with_tool_calls(
@@ -464,10 +463,9 @@ fn build_tool_request(

 pub async fn chat_completions_handler(
    State(state): State<Arc<GatewayState>>,
-    super::auth::AuthenticatedUser(user): super::auth::AuthenticatedUser,
    Json(req): Json<OpenAiChatRequest>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<OpenAiErrorResponse>)> {
-    if !state.chat_rate_limiter.check(&user.user_id) {
+    if !state.chat_rate_limiter.check() {
        return Err(openai_error(
            StatusCode::TOO_MANY_REQUESTS,
            "Rate limit exceeded. Please try again later.",
@@ -955,7 +953,6 @@ mod tests {
            id: "call_abc".to_string(),
            name: "search".to_string(),
            arguments: serde_json::json!({"query": "rust"}),
-            reasoning: None,
        }];

        let converted = convert_tool_calls_to_openai(&calls);
@@ -11,31 +11,15 @@ use tokio::sync::broadcast;
 use tokio_stream::StreamExt;
 use tokio_stream::wrappers::BroadcastStream;

-use crate::channels::web::types::AppEvent;
+use crate::channels::web::types::SseEvent;

 /// Maximum number of concurrent SSE/WebSocket connections.
 /// Prevents resource exhaustion from connection flooding.
 const MAX_CONNECTIONS: u64 = 100;

-/// Envelope for broadcast events: carries an optional user scope.
-///
-/// `user_id = None` means the event is global (e.g. Heartbeat) and delivered
-/// to all subscribers. `user_id = Some(id)` means the event is only delivered
-/// to subscribers that match that user_id.
-#[derive(Debug, Clone)]
-pub(crate) struct ScopedEvent {
-    pub(crate) user_id: Option<String>,
-    pub(crate) event: AppEvent,
-}
-
 /// Manages SSE broadcast to all connected browser tabs.
-///
-/// In multi-user mode, events are scoped by user_id so that each subscriber
-/// only receives events intended for their user (plus global events like
-/// Heartbeat). In single-user mode, all events are delivered to all subscribers
-/// (backwards compatible).
 pub struct SseManager {
-    tx: broadcast::Sender<ScopedEvent>,
+    tx: broadcast::Sender<SseEvent>,
    connection_count: Arc<AtomicU64>,
    max_connections: u64,
 }
@@ -61,7 +45,7 @@ impl SseManager {
    /// only be called before the server starts accepting connections (i.e.,
    /// during startup wiring). Calling it after connections are established
    /// will break connection tracking and allow exceeding `MAX_CONNECTIONS`.
-    pub(crate) fn from_sender(tx: broadcast::Sender<ScopedEvent>) -> Self {
+    pub fn from_sender(tx: broadcast::Sender<SseEvent>) -> Self {
        Self {
            tx,
            connection_count: Arc::new(AtomicU64::new(0)),
@@ -69,30 +53,17 @@ impl SseManager {
        }
    }

+    /// Broadcast an event to all connected clients.
+    pub fn broadcast(&self, event: SseEvent) {
+        // Ignore send errors (no receivers is fine)
+        let _ = self.tx.send(event);
+    }
+
    /// Get a clone of the broadcast sender for use by other components.
-    pub(crate) fn sender(&self) -> broadcast::Sender<ScopedEvent> {
+    pub fn sender(&self) -> broadcast::Sender<SseEvent> {
        self.tx.clone()
    }

-    /// Broadcast an event to all connected clients (global/unscoped).
-    pub fn broadcast(&self, event: AppEvent) {
-        let _ = self.tx.send(ScopedEvent {
-            user_id: None,
-            event,
-        });
-    }
-
-    /// Broadcast an event scoped to a specific user.
-    ///
-    /// Only subscribers for this user_id (or unscoped subscribers) will
-    /// receive the event.
-    pub fn broadcast_for_user(&self, user_id: &str, event: AppEvent) {
-        let _ = self.tx.send(ScopedEvent {
-            user_id: Some(user_id.to_string()),
-            event,
-        });
-    }
-
    /// Get current number of active connections.
    pub fn connection_count(&self) -> u64 {
        self.connection_count.load(Ordering::Relaxed)
@@ -100,15 +71,11 @@ impl SseManager {

    /// Create a raw broadcast subscription for non-SSE consumers (e.g. WebSocket).
    ///
-    /// When `user_id` is `Some`, only events scoped to that user (or global
-    /// events) are delivered. When `None`, all events are delivered (single-user
-    /// backwards compatibility).
+    /// Returns a stream of `SseEvent` values and increments/decrements the
+    /// connection counter on creation/drop, just like `subscribe()` does for SSE.
    ///
    /// Returns `None` if the maximum connection limit has been reached.
-    pub fn subscribe_raw(
-        &self,
-        user_id: Option<String>,
-    ) -> Option<impl Stream<Item = AppEvent> + Send + 'static + use<>> {
+    pub fn subscribe_raw(&self) -> Option<impl Stream<Item = SseEvent> + Send + 'static + use<>> {
        // Atomically increment only if below the limit. This prevents
        // concurrent callers from overshooting max_connections.
        let counter = Arc::clone(&self.connection_count);
@@ -124,19 +91,7 @@ impl SseManager {
            .ok()?;
        let rx = self.tx.subscribe();

-        let stream = BroadcastStream::new(rx).filter_map(move |result| match result {
-            Ok(scoped) => {
-                // Global events (user_id=None) always pass through.
-                // Scoped events only pass if the subscriber matches (or subscriber is unscoped).
-                match (&user_id, &scoped.user_id) {
-                    (_, None) => Some(scoped.event), // global -> all
-                    (None, _) => Some(scoped.event), // unscoped subscriber -> all
-                    (Some(sub), Some(ev)) if sub == ev => Some(scoped.event), // match
-                    _ => None,                       // different user -> skip
-                }
-            }
-            Err(_) => None,
-        });
+        let stream = BroadcastStream::new(rx).filter_map(|result| result.ok());

        Some(CountedStream {
            inner: stream,
@@ -146,13 +101,9 @@ impl SseManager {

    /// Create a new SSE stream for a client connection.
    ///
-    /// When `user_id` is `Some`, only events for that user (or global events)
-    /// are delivered. When `None`, all events are delivered.
-    ///
    /// Returns `None` if the maximum connection limit has been reached.
    pub fn subscribe(
        &self,
-        user_id: Option<String>,
    ) -> Option<Sse<impl Stream<Item = Result<Event, Infallible>> + Send + 'static + use<>>> {
        // Atomically increment only if below the limit.
        let counter = Arc::clone(&self.connection_count);
@@ -169,25 +120,34 @@ impl SseManager {
        let rx = self.tx.subscribe();

        let stream = BroadcastStream::new(rx)
-            .filter_map(move |result| match result {
-                Ok(scoped) => match (&user_id, &scoped.user_id) {
-                    (_, None) => Some(scoped.event),
-                    (None, _) => Some(scoped.event),
-                    (Some(sub), Some(ev)) if sub == ev => Some(scoped.event),
-                    _ => None,
-                },
-                Err(_) => None,
-            })
-            .filter_map(|event| {
-                let data = match serde_json::to_string(&event) {
-                    Ok(s) => s,
-                    Err(e) => {
-                        tracing::warn!("Failed to serialize SSE event: {}", e);
-                        return None;
-                    }
+            .filter_map(|result| result.ok())
+            .map(|event| {
+                let data = serde_json::to_string(&event).unwrap_or_default();
+                let event_type = match &event {
+                    SseEvent::Response { .. } => "response",
+                    SseEvent::Thinking { .. } => "thinking",
+                    SseEvent::ToolStarted { .. } => "tool_started",
+                    SseEvent::ToolCompleted { .. } => "tool_completed",
+                    SseEvent::ToolResult { .. } => "tool_result",
+                    SseEvent::StreamChunk { .. } => "stream_chunk",
+                    SseEvent::Status { .. } => "status",
+                    SseEvent::ApprovalNeeded { .. } => "approval_needed",
+                    SseEvent::AuthRequired { .. } => "auth_required",
+                    SseEvent::AuthCompleted { .. } => "auth_completed",
+                    SseEvent::Error { .. } => "error",
+                    SseEvent::JobStarted { .. } => "job_started",
+                    SseEvent::JobMessage { .. } => "job_message",
+                    SseEvent::JobToolUse { .. } => "job_tool_use",
+                    SseEvent::JobToolResult { .. } => "job_tool_result",
+                    SseEvent::JobStatus { .. } => "job_status",
+                    SseEvent::JobResult { .. } => "job_result",
+                    SseEvent::Heartbeat => "heartbeat",
+                    SseEvent::ImageGenerated { .. } => "image_generated",
+                    SseEvent::Suggestions { .. } => "suggestions",
+                    SseEvent::TurnCost { .. } => "turn_cost",
+                    SseEvent::ExtensionStatus { .. } => "extension_status",
                };
-                let event_type = event.event_type();
-                Some(Ok(Event::default().event(event_type).data(data)))
+                Ok(Event::default().event(event_type).data(data))
            });

        // Wrap in a stream that decrements on drop
@@ -249,22 +209,24 @@ mod tests {
    fn test_broadcast_without_receivers() {
        let manager = SseManager::new();
        // Should not panic even with no receivers
-        manager.broadcast(AppEvent::Heartbeat);
+        manager.broadcast(SseEvent::Heartbeat);
    }

    #[tokio::test]
    async fn test_broadcast_to_receiver() {
        let manager = SseManager::new();
-        let mut stream = Box::pin(manager.subscribe_raw(None).expect("should subscribe"));
+        let mut rx = BroadcastStream::new(manager.tx.subscribe());

-        manager.broadcast(AppEvent::Status {
+        manager.broadcast(SseEvent::Status {
            message: "test".to_string(),
            thread_id: None,
        });

-        let event = stream.next().await.unwrap();
+        let event = rx.next().await;
+        assert!(event.is_some());
+        let event = event.unwrap().unwrap();
        match event {
-            AppEvent::Status { message, .. } => assert_eq!(message, "test"),
+            SseEvent::Status { message, .. } => assert_eq!(message, "test"),
            _ => panic!("unexpected event type"),
        }
    }
@@ -272,18 +234,18 @@ mod tests {
    #[tokio::test]
    async fn test_subscribe_raw_receives_events() {
        let manager = SseManager::new();
-        let mut stream = Box::pin(manager.subscribe_raw(None).expect("should subscribe"));
+        let mut stream = Box::pin(manager.subscribe_raw().expect("should subscribe"));

        assert_eq!(manager.connection_count(), 1);

-        manager.broadcast(AppEvent::Thinking {
+        manager.broadcast(SseEvent::Thinking {
            message: "working".to_string(),
            thread_id: None,
        });

        let event = stream.next().await.unwrap();
        match event {
-            AppEvent::Thinking { message, .. } => assert_eq!(message, "working"),
+            SseEvent::Thinking { message, .. } => assert_eq!(message, "working"),
            _ => panic!("Expected Thinking event"),
        }
    }
@@ -292,7 +254,7 @@ mod tests {
    async fn test_subscribe_raw_decrements_on_drop() {
        let manager = SseManager::new();
        {
-            let _stream = Box::pin(manager.subscribe_raw(None).expect("should subscribe"));
+            let _stream = Box::pin(manager.subscribe_raw().expect("should subscribe"));
            assert_eq!(manager.connection_count(), 1);
        }
        // Stream dropped, counter should decrement
@@ -302,16 +264,16 @@ mod tests {
    #[tokio::test]
    async fn test_subscribe_raw_multiple_subscribers() {
        let manager = SseManager::new();
-        let mut s1 = Box::pin(manager.subscribe_raw(None).expect("should subscribe"));
-        let mut s2 = Box::pin(manager.subscribe_raw(None).expect("should subscribe"));
+        let mut s1 = Box::pin(manager.subscribe_raw().expect("should subscribe"));
+        let mut s2 = Box::pin(manager.subscribe_raw().expect("should subscribe"));
        assert_eq!(manager.connection_count(), 2);

-        manager.broadcast(AppEvent::Heartbeat);
+        manager.broadcast(SseEvent::Heartbeat);

        let e1 = s1.next().await.unwrap();
        let e2 = s2.next().await.unwrap();
-        assert!(matches!(e1, AppEvent::Heartbeat));
-        assert!(matches!(e2, AppEvent::Heartbeat));
+        assert!(matches!(e1, SseEvent::Heartbeat));
+        assert!(matches!(e2, SseEvent::Heartbeat));

        drop(s1);
        assert_eq!(manager.connection_count(), 1);
@@ -324,51 +286,12 @@ mod tests {
        let mut manager = SseManager::new();
        manager.max_connections = 2; // Low limit for testing

-        let _s1 = Box::pin(manager.subscribe_raw(None).expect("first should succeed"));
-        let _s2 = Box::pin(manager.subscribe_raw(None).expect("second should succeed"));
+        let _s1 = Box::pin(manager.subscribe_raw().expect("first should succeed"));
+        let _s2 = Box::pin(manager.subscribe_raw().expect("second should succeed"));
        assert_eq!(manager.connection_count(), 2);

        // Third should be rejected
-        assert!(manager.subscribe_raw(None).is_none());
-        assert!(manager.subscribe(None).is_none());
-    }
-
-    #[tokio::test]
-    async fn test_scoped_events_filtered_by_user() {
-        let manager = SseManager::new();
-        let mut alice = Box::pin(
-            manager
-                .subscribe_raw(Some("alice".to_string()))
-                .expect("subscribe"),
-        );
-        let mut bob = Box::pin(
-            manager
-                .subscribe_raw(Some("bob".to_string()))
-                .expect("subscribe"),
-        );
-
-        // Send event scoped to alice
-        manager.broadcast_for_user(
-            "alice",
-            AppEvent::Status {
-                message: "alice only".to_string(),
-                thread_id: None,
-            },
-        );
-
-        // Send global event
-        manager.broadcast(AppEvent::Heartbeat);
-
-        // Alice gets her scoped event
-        let e = alice.next().await.unwrap();
-        assert!(matches!(e, AppEvent::Status { .. }));
-
-        // Alice also gets the global heartbeat
-        let e = alice.next().await.unwrap();
-        assert!(matches!(e, AppEvent::Heartbeat));
-
-        // Bob only gets the global heartbeat (alice's event was filtered)
-        let e = bob.next().await.unwrap(); // safety: test-only
-        assert!(matches!(e, AppEvent::Heartbeat)); // safety: test assertion
+        assert!(manager.subscribe_raw().is_none());
+        assert!(manager.subscribe().is_none());
    }
 }
@@ -4265,9 +4265,9 @@ function renderRoutineDetail(routine) {
      + '<th>Trigger</th><th>Started</th><th>Completed</th><th>Status</th><th>Summary</th><th>Tokens</th>'
      + '</tr></thead><tbody>';
    for (const run of routine.recent_runs) {
-      const runStatusClass = run.status === 'ok' ? 'completed'
-        : run.status === 'failed' ? 'failed'
-        : run.status === 'attention' ? 'stuck'
+      const runStatusClass = run.status === 'Ok' ? 'completed'
+        : run.status === 'Failed' ? 'failed'
+        : run.status === 'Attention' ? 'stuck'
        : 'in_progress';
      html += '<tr>'
        + '<td>' + escapeHtml(run.trigger_type) + '</td>'
@@ -10,8 +10,7 @@ use std::sync::Arc;
 use tokio::sync::mpsc;

 use crate::channels::IncomingMessage;
-use crate::channels::web::auth::MultiAuthState;
-use crate::channels::web::server::{GatewayState, PerUserRateLimiter, RateLimiter, start_server};
+use crate::channels::web::server::{GatewayState, RateLimiter, start_server};
 use crate::channels::web::sse::SseManager;
 use crate::channels::web::ws::WsConnectionTracker;

@@ -65,9 +64,8 @@ impl TestGatewayBuilder {
    pub fn build(self) -> Arc<GatewayState> {
        Arc::new(GatewayState {
            msg_tx: tokio::sync::RwLock::new(self.msg_tx),
-            sse: Arc::new(SseManager::new()),
+            sse: SseManager::new(),
            workspace: None,
-            workspace_pool: None,
            session_manager: None,
            log_broadcaster: None,
            log_level_handle: None,
@@ -76,15 +74,14 @@ impl TestGatewayBuilder {
            store: None,
            job_manager: None,
            prompt_queue: None,
-            owner_id: self.user_id.clone(),
-            default_sender_id: self.user_id,
+            user_id: self.user_id,
            shutdown_tx: tokio::sync::RwLock::new(None),
            ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
            llm_provider: self.llm_provider,
            skill_registry: None,
            skill_catalog: None,
            scheduler: None,
-            chat_rate_limiter: PerUserRateLimiter::new(30, 60),
+            chat_rate_limiter: RateLimiter::new(30, 60),
            oauth_rate_limiter: RateLimiter::new(10, 60),
            webhook_rate_limiter: RateLimiter::new(10, 60),
            registry_entries: Vec::new(),
@@ -101,26 +98,11 @@ impl TestGatewayBuilder {
        self,
        auth_token: &str,
    ) -> Result<(SocketAddr, Arc<GatewayState>), crate::error::ChannelError> {
-        let auth = MultiAuthState::single(auth_token.to_string(), "test-user".to_string());
        let state = self.build();
        let addr: SocketAddr = "127.0.0.1:0"
            .parse()
-            .expect("hard-coded address must parse"); // safety: constant literal
-        let bound = start_server(addr, state.clone(), auth).await?;
-        Ok((bound, state))
-    }
-
-    /// Build the state and start a gateway server with multi-user auth.
-    /// Returns the bound address and the shared state.
-    pub async fn start_multi(
-        self,
-        auth: MultiAuthState,
-    ) -> Result<(SocketAddr, Arc<GatewayState>), crate::error::ChannelError> {
-        let state = self.build();
-        let addr: SocketAddr = "127.0.0.1:0"
-            .parse()
-            .expect("hard-coded address must parse"); // safety: constant literal
-        let bound = start_server(addr, state.clone(), auth).await?;
+            .expect("hard-coded address must parse");
+        let bound = start_server(addr, state.clone(), auth_token.to_string()).await?;
        Ok((bound, state))
    }
 }
@@ -1,3 +0,0 @@
-//! Integration tests for the web gateway module.
-
-mod multi_tenant;
@@ -1,833 +0,0 @@
-//! Multi-tenant isolation tests for the web gateway.
-//!
-//! Tests cover workspace pool scoping, job handler isolation, and auth
-//! enforcement on protected endpoints. Uses `LibSqlBackend::new_local()`
-//! with a temporary directory for a real (but ephemeral) database.
-
-use std::collections::HashMap;
-use std::sync::Arc;
-use std::time::Duration;
-
-use axum::Router;
-use axum::body::Body;
-use axum::http::{Method, Request, StatusCode};
-use axum::middleware;
-use axum::routing::{delete, get, post};
-use tower::ServiceExt;
-use uuid::Uuid;
-
-use crate::channels::web::GatewayChannel;
-use crate::channels::web::auth::{
-    AuthenticatedUser, MultiAuthState, UserIdentity, auth_middleware,
-};
-use crate::channels::web::server::{
-    ActiveConfigSnapshot, GatewayState, PerUserRateLimiter, PromptQueue, RateLimiter, WorkspacePool,
-};
-use crate::channels::web::sse::SseManager;
-use crate::config::GatewayConfig;
-
-// ── Helpers ────────────────────────────────────────────────────────────
-
-/// Create a two-user `MultiAuthState` for alice and bob.
-fn two_user_auth() -> MultiAuthState {
-    let mut tokens = HashMap::new();
-    tokens.insert(
-        "tok-alice".to_string(),
-        UserIdentity {
-            user_id: "alice".to_string(),
-            workspace_read_scopes: vec!["shared".to_string()],
-        },
-    );
-    tokens.insert(
-        "tok-bob".to_string(),
-        UserIdentity {
-            user_id: "bob".to_string(),
-            workspace_read_scopes: vec!["shared".to_string(), "alice".to_string()],
-        },
-    );
-    MultiAuthState::multi(tokens)
-}
-
-/// Build a `GatewayState` with configurable store and prompt queue.
-fn build_state(
-    store: Option<Arc<dyn crate::db::Database>>,
-    prompt_queue: Option<PromptQueue>,
-) -> Arc<GatewayState> {
-    Arc::new(GatewayState {
-        msg_tx: tokio::sync::RwLock::new(None),
-        sse: Arc::new(SseManager::new()),
-        workspace: None,
-        workspace_pool: None,
-        session_manager: None,
-        log_broadcaster: None,
-        log_level_handle: None,
-        extension_manager: None,
-        tool_registry: None,
-        store,
-        job_manager: None,
-        prompt_queue,
-        owner_id: "test".to_string(),
-        default_sender_id: "test".to_string(),
-        shutdown_tx: tokio::sync::RwLock::new(None),
-        ws_tracker: None,
-        llm_provider: None,
-        skill_registry: None,
-        skill_catalog: None,
-        scheduler: None,
-        chat_rate_limiter: PerUserRateLimiter::new(30, 60),
-        oauth_rate_limiter: RateLimiter::new(10, 60),
-        webhook_rate_limiter: RateLimiter::new(10, 60),
-        registry_entries: Vec::new(),
-        cost_guard: None,
-        routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
-        startup_time: std::time::Instant::now(),
-        active_config: ActiveConfigSnapshot::default(),
-    })
-}
-
-fn gateway_config() -> GatewayConfig {
-    GatewayConfig {
-        host: "127.0.0.1".to_string(),
-        port: 3000,
-        auth_token: Some("gateway-auth".to_string()),
-        user_id: "gateway-sender".to_string(),
-        workspace_read_scopes: Vec::new(),
-        memory_layers: Vec::new(),
-        user_tokens: None,
-    }
-}
-
-#[test]
-fn with_owner_scope_updates_gateway_owner_scope_in_multi_user_mode() {
-    let mut gateway = GatewayChannel::new(gateway_config());
-    gateway.auth = two_user_auth();
-    gateway.config.user_tokens = Some(HashMap::new());
-    let gateway = gateway.with_owner_scope("owner-scope");
-
-    assert_eq!(gateway.state.owner_id, "owner-scope");
-    assert_eq!(gateway.state.default_sender_id, "gateway-sender");
-
-    let alice = gateway
-        .auth
-        .authenticate("tok-alice")
-        .expect("alice token should remain valid");
-    let bob = gateway
-        .auth
-        .authenticate("tok-bob")
-        .expect("bob token should remain valid");
-    assert_eq!(alice.user_id, "alice");
-    assert_eq!(bob.user_id, "bob");
-}
-
-/// Create a libSQL-backed test database in a temporary directory.
-///
-/// Returns the database and a `TempDir` guard — the database file is
-/// deleted when the guard is dropped.
-#[cfg(feature = "libsql")]
-async fn test_db() -> (Arc<dyn crate::db::Database>, tempfile::TempDir) {
-    use crate::db::Database;
-    let dir = tempfile::tempdir().expect("failed to create temp dir"); // safety: test-only
-    let path = dir.path().join("test.db");
-    let backend = crate::db::libsql::LibSqlBackend::new_local(&path)
-        .await
-        .expect("failed to create test LibSqlBackend"); // safety: test-only
-    backend
-        .run_migrations()
-        .await
-        .expect("failed to run migrations"); // safety: test-only
-    (Arc::new(backend) as Arc<dyn crate::db::Database>, dir)
-}
-
-/// Build a minimal Routine for testing.
-fn make_routine(user_id: &str, name: &str) -> crate::agent::routine::Routine {
-    let now = chrono::Utc::now();
-    crate::agent::routine::Routine {
-        id: Uuid::new_v4(),
-        name: name.to_string(),
-        description: format!("Test routine: {name}"),
-        user_id: user_id.to_string(),
-        enabled: true,
-        trigger: crate::agent::routine::Trigger::Cron {
-            schedule: "0 9 * * *".to_string(),
-            timezone: None,
-        },
-        action: crate::agent::routine::RoutineAction::Lightweight {
-            prompt: "hello".to_string(),
-            context_paths: vec![],
-            max_tokens: 1024,
-            use_tools: false,
-            max_tool_rounds: 3,
-        },
-        guardrails: crate::agent::routine::RoutineGuardrails {
-            cooldown: Duration::from_secs(60),
-            max_concurrent: 1,
-            dedup_window: None,
-        },
-        notify: crate::agent::routine::NotifyConfig {
-            channel: None,
-            user: None,
-            on_success: false,
-            on_failure: true,
-            on_attention: true,
-        },
-        last_run_at: None,
-        next_fire_at: None,
-        run_count: 0,
-        consecutive_failures: 0,
-        state: serde_json::json!({}),
-        created_at: now,
-        updated_at: now,
-    }
-}
-
-/// Build a minimal SandboxJobRecord for testing.
-fn make_sandbox_job(user_id: &str, task: &str) -> crate::history::SandboxJobRecord {
-    let now = chrono::Utc::now();
-    crate::history::SandboxJobRecord {
-        id: Uuid::new_v4(),
-        task: task.to_string(),
-        status: "completed".to_string(),
-        user_id: user_id.to_string(),
-        project_dir: format!("/tmp/test-{}", Uuid::new_v4()),
-        success: Some(true),
-        failure_reason: None,
-        created_at: now,
-        started_at: Some(now),
-        completed_at: Some(now),
-        credential_grants_json: "[]".to_string(),
-    }
-}
-
-// ═══════════════════════════════════════════════════════════════════════
-// WorkspacePool Tests
-// ═══════════════════════════════════════════════════════════════════════
-
-#[cfg(feature = "libsql")]
-mod workspace_pool {
-    use super::*;
-    use crate::config::{WorkspaceConfig, WorkspaceSearchConfig};
-    use crate::workspace::EmbeddingCacheConfig;
-    use crate::workspace::layer::MemoryLayer;
-
-    #[tokio::test]
-    async fn test_workspace_pool_applies_search_config() {
-        let (db, _dir) = test_db().await;
-        let search_config = WorkspaceSearchConfig {
-            rrf_k: 42,
-            ..Default::default()
-        };
-        let pool = WorkspacePool::new(
-            db,
-            None,
-            EmbeddingCacheConfig::default(),
-            search_config,
-            WorkspaceConfig::default(),
-        );
-        let identity = UserIdentity {
-            user_id: "alice".to_string(),
-            workspace_read_scopes: vec![],
-        };
-        let ws = pool.get_or_create(&identity).await;
-        assert_eq!(ws.user_id(), "alice");
-    }
-
-    #[tokio::test]
-    async fn test_workspace_pool_applies_memory_layers() {
-        let (db, _dir) = test_db().await;
-        let layers = vec![MemoryLayer {
-            name: "shared-layer".to_string(),
-            scope: "shared".to_string(),
-            writable: false,
-            sensitivity: Default::default(),
-        }];
-        let ws_config = WorkspaceConfig {
-            memory_layers: layers,
-            read_scopes: vec![],
-        };
-        let pool = WorkspacePool::new(
-            db,
-            None,
-            EmbeddingCacheConfig::default(),
-            WorkspaceSearchConfig::default(),
-            ws_config,
-        );
-        let identity = UserIdentity {
-            user_id: "alice".to_string(),
-            workspace_read_scopes: vec![],
-        };
-        let ws = pool.get_or_create(&identity).await;
-        // Memory layer scope "shared" should appear in read_user_ids.
-        assert!(
-            ws.read_user_ids().contains(&"shared".to_string()),
-            "expected 'shared' in read_user_ids, got {:?}",
-            ws.read_user_ids()
-        );
-    }
-
-    #[tokio::test]
-    async fn test_workspace_pool_applies_identity_read_scopes() {
-        let (db, _dir) = test_db().await;
-        let pool = WorkspacePool::new(
-            db,
-            None,
-            EmbeddingCacheConfig::default(),
-            WorkspaceSearchConfig::default(),
-            WorkspaceConfig::default(),
-        );
-        let identity = UserIdentity {
-            user_id: "bob".to_string(),
-            workspace_read_scopes: vec!["alice".to_string(), "shared".to_string()],
-        };
-        let ws = pool.get_or_create(&identity).await;
-        assert_eq!(ws.user_id(), "bob");
-        assert!(
-            ws.read_user_ids().contains(&"alice".to_string()),
-            "expected 'alice' in read_user_ids from identity scopes"
-        );
-        assert!(
-            ws.read_user_ids().contains(&"shared".to_string()),
-            "expected 'shared' in read_user_ids from identity scopes"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_workspace_pool_caches_per_user() {
-        let (db, _dir) = test_db().await;
-        let pool = WorkspacePool::new(
-            db,
-            None,
-            EmbeddingCacheConfig::default(),
-            WorkspaceSearchConfig::default(),
-            WorkspaceConfig::default(),
-        );
-        let alice_id = UserIdentity {
-            user_id: "alice".to_string(),
-            workspace_read_scopes: vec![],
-        };
-        let bob_id = UserIdentity {
-            user_id: "bob".to_string(),
-            workspace_read_scopes: vec![],
-        };
-
-        let alice_ws1 = pool.get_or_create(&alice_id).await;
-        let alice_ws2 = pool.get_or_create(&alice_id).await;
-        let bob_ws = pool.get_or_create(&bob_id).await;
-
-        // Same user gets the same Arc.
-        assert!(Arc::ptr_eq(&alice_ws1, &alice_ws2));
-        // Different users get different instances.
-        assert!(!Arc::ptr_eq(&alice_ws1, &bob_ws));
-        assert_eq!(alice_ws1.user_id(), "alice");
-        assert_eq!(bob_ws.user_id(), "bob");
-    }
-
-    #[tokio::test]
-    async fn test_workspace_pool_combines_global_and_identity_scopes() {
-        let (db, _dir) = test_db().await;
-        let ws_config = WorkspaceConfig {
-            memory_layers: vec![],
-            read_scopes: vec!["global-shared".to_string()],
-        };
-        let pool = WorkspacePool::new(
-            db,
-            None,
-            EmbeddingCacheConfig::default(),
-            WorkspaceSearchConfig::default(),
-            ws_config,
-        );
-        let identity = UserIdentity {
-            user_id: "alice".to_string(),
-            workspace_read_scopes: vec!["token-scope".to_string()],
-        };
-        let ws = pool.get_or_create(&identity).await;
-        let scopes = ws.read_user_ids();
-        // Primary scope
-        assert!(scopes.contains(&"alice".to_string()));
-        // Global config scope
-        assert!(
-            scopes.contains(&"global-shared".to_string()),
-            "expected global scope 'global-shared', got {:?}",
-            scopes
-        );
-        // Token identity scope
-        assert!(
-            scopes.contains(&"token-scope".to_string()),
-            "expected token scope 'token-scope', got {:?}",
-            scopes
-        );
-    }
-}
-
-// ═══════════════════════════════════════════════════════════════════════
-// Jobs Handler Isolation Tests
-// ═══════════════════════════════════════════════════════════════════════
-
-#[cfg(feature = "libsql")]
-mod jobs_isolation {
-    use super::*;
-    use crate::channels::web::handlers::jobs::{
-        jobs_cancel_handler, jobs_prompt_handler, jobs_restart_handler, jobs_summary_handler,
-    };
-    // SandboxStore methods are accessed through the Database supertrait.
-
-    /// Build a router with job endpoints behind multi-user auth.
-    fn jobs_router(state: Arc<GatewayState>, auth: MultiAuthState) -> Router {
-        Router::new()
-            .route("/api/jobs/summary", get(jobs_summary_handler))
-            .route("/api/jobs/{id}/cancel", post(jobs_cancel_handler))
-            .route("/api/jobs/{id}/restart", post(jobs_restart_handler))
-            .route("/api/jobs/{id}/prompt", post(jobs_prompt_handler))
-            .layer(middleware::from_fn_with_state(auth, auth_middleware))
-            .with_state(state)
-    }
-
-    #[tokio::test]
-    async fn test_jobs_summary_scoped_to_user() {
-        let (db, _dir) = test_db().await;
-
-        // Insert sandbox jobs for alice and bob.
-        let alice_job = make_sandbox_job("alice", "alice task");
-        let bob_job = make_sandbox_job("bob", "bob task");
-        db.save_sandbox_job(&alice_job).await.unwrap();
-        db.save_sandbox_job(&bob_job).await.unwrap();
-
-        let state = build_state(Some(db), None);
-        let auth = two_user_auth();
-        let app = jobs_router(state, auth);
-
-        // Alice should see 1 job.
-        let req = Request::builder()
-            .uri("/api/jobs/summary")
-            .header("Authorization", "Bearer tok-alice")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.clone().oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body: serde_json::Value =
-            serde_json::from_slice(&axum::body::to_bytes(resp.into_body(), 4096).await.unwrap())
-                .unwrap();
-        assert_eq!(body["total"], 1, "alice should see only her own jobs");
-
-        // Bob should see 1 job.
-        let req = Request::builder()
-            .uri("/api/jobs/summary")
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body: serde_json::Value =
-            serde_json::from_slice(&axum::body::to_bytes(resp.into_body(), 4096).await.unwrap())
-                .unwrap();
-        assert_eq!(body["total"], 1, "bob should see only his own jobs");
-    }
-
-    #[tokio::test]
-    async fn test_jobs_restart_rejects_other_user() {
-        let (db, _dir) = test_db().await;
-
-        // Insert a failed sandbox job owned by alice.
-        let mut alice_job = make_sandbox_job("alice", "alice task");
-        alice_job.status = "failed".to_string();
-        alice_job.success = Some(false);
-        db.save_sandbox_job(&alice_job).await.unwrap();
-
-        let state = build_state(Some(db), None);
-        let auth = two_user_auth();
-        let app = jobs_router(state, auth);
-
-        // Bob tries to restart alice's job.
-        let req = Request::builder()
-            .method(Method::POST)
-            .uri(format!("/api/jobs/{}/restart", alice_job.id))
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::NOT_FOUND,
-            "bob should not be able to restart alice's job"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_jobs_prompt_works_for_agent_jobs() {
-        let (db, _dir) = test_db().await;
-
-        // Insert a running sandbox job owned by alice in claude_code mode.
-        let mut alice_job = make_sandbox_job("alice", "prompt test");
-        alice_job.status = "running".to_string();
-        alice_job.success = None;
-        alice_job.completed_at = None;
-        db.save_sandbox_job(&alice_job).await.unwrap();
-        db.update_sandbox_job_mode(alice_job.id, "claude_code")
-            .await
-            .unwrap();
-
-        let prompt_queue: PromptQueue =
-            Arc::new(tokio::sync::Mutex::new(std::collections::HashMap::new()));
-        let state = build_state(Some(db), Some(prompt_queue.clone()));
-        let auth = two_user_auth();
-        let app = jobs_router(state, auth);
-
-        // Alice prompts her own job.
-        let req = Request::builder()
-            .method(Method::POST)
-            .uri(format!("/api/jobs/{}/prompt", alice_job.id))
-            .header("Authorization", "Bearer tok-alice")
-            .header("Content-Type", "application/json")
-            .body(Body::from(
-                serde_json::to_string(&serde_json::json!({"content": "hello"})).unwrap(),
-            ))
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::OK,
-            "alice should be able to prompt her own job"
-        );
-
-        // Verify prompt was enqueued.
-        let queue = prompt_queue.lock().await;
-        assert!(
-            queue.contains_key(&alice_job.id),
-            "prompt queue should contain alice's job"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_jobs_prompt_rejects_other_user() {
-        let (db, _dir) = test_db().await;
-
-        let mut alice_job = make_sandbox_job("alice", "alice task");
-        alice_job.status = "running".to_string();
-        alice_job.success = None;
-        alice_job.completed_at = None;
-        db.save_sandbox_job(&alice_job).await.unwrap();
-        db.update_sandbox_job_mode(alice_job.id, "claude_code")
-            .await
-            .unwrap();
-
-        let prompt_queue: PromptQueue =
-            Arc::new(tokio::sync::Mutex::new(std::collections::HashMap::new()));
-        let state = build_state(Some(db), Some(prompt_queue));
-        let auth = two_user_auth();
-        let app = jobs_router(state, auth);
-
-        // Bob tries to prompt alice's job.
-        let req = Request::builder()
-            .method(Method::POST)
-            .uri(format!("/api/jobs/{}/prompt", alice_job.id))
-            .header("Authorization", "Bearer tok-bob")
-            .header("Content-Type", "application/json")
-            .body(Body::from(
-                serde_json::to_string(&serde_json::json!({"content": "sneaky"})).unwrap(),
-            ))
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::NOT_FOUND,
-            "bob should not be able to prompt alice's job"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_jobs_cancel_rejects_other_user() {
-        let (db, _dir) = test_db().await;
-
-        let mut alice_job = make_sandbox_job("alice", "alice running");
-        alice_job.status = "running".to_string();
-        alice_job.success = None;
-        alice_job.completed_at = None;
-        db.save_sandbox_job(&alice_job).await.unwrap();
-
-        let state = build_state(Some(db), None);
-        let auth = two_user_auth();
-        let app = jobs_router(state, auth);
-
-        // Bob tries to cancel alice's job.
-        let req = Request::builder()
-            .method(Method::POST)
-            .uri(format!("/api/jobs/{}/cancel", alice_job.id))
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::NOT_FOUND,
-            "bob should not be able to cancel alice's job"
-        );
-    }
-}
-
-// ═══════════════════════════════════════════════════════════════════════
-// Routines Isolation Tests
-// ═══════════════════════════════════════════════════════════════════════
-
-#[cfg(feature = "libsql")]
-mod routines_isolation {
-    use super::*;
-    use crate::channels::web::handlers::routines::{
-        routines_delete_handler, routines_detail_handler, routines_list_handler,
-        routines_summary_handler, routines_toggle_handler,
-    };
-    // RoutineStore methods are accessed through the Database supertrait.
-
-    fn routines_router(state: Arc<GatewayState>, auth: MultiAuthState) -> Router {
-        Router::new()
-            .route("/api/routines", get(routines_list_handler))
-            .route("/api/routines/summary", get(routines_summary_handler))
-            .route("/api/routines/{id}", get(routines_detail_handler))
-            .route("/api/routines/{id}/toggle", post(routines_toggle_handler))
-            .route("/api/routines/{id}", delete(routines_delete_handler))
-            .layer(middleware::from_fn_with_state(auth, auth_middleware))
-            .with_state(state)
-    }
-
-    #[tokio::test]
-    async fn test_routines_isolation() {
-        let (db, _dir) = test_db().await;
-
-        // Create routines for alice and bob.
-        let alice_routine = make_routine("alice", "alice-daily");
-        let bob_routine = make_routine("bob", "bob-daily");
-        db.create_routine(&alice_routine).await.unwrap();
-        db.create_routine(&bob_routine).await.unwrap();
-
-        let state = build_state(Some(db), None);
-        let auth = two_user_auth();
-        let app = routines_router(state, auth);
-
-        // Alice sees only her routine in the list.
-        let req = Request::builder()
-            .uri("/api/routines")
-            .header("Authorization", "Bearer tok-alice")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.clone().oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body: serde_json::Value =
-            serde_json::from_slice(&axum::body::to_bytes(resp.into_body(), 8192).await.unwrap())
-                .unwrap();
-        let routines = body["routines"].as_array().unwrap();
-        assert_eq!(routines.len(), 1, "alice should see only her routines");
-        assert_eq!(routines[0]["name"], "alice-daily");
-
-        // Bob sees only his routine.
-        let req = Request::builder()
-            .uri("/api/routines")
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.clone().oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body: serde_json::Value =
-            serde_json::from_slice(&axum::body::to_bytes(resp.into_body(), 8192).await.unwrap())
-                .unwrap();
-        let routines = body["routines"].as_array().unwrap();
-        assert_eq!(routines.len(), 1, "bob should see only his routines");
-        assert_eq!(routines[0]["name"], "bob-daily");
-
-        // Bob cannot view alice's routine detail.
-        let req = Request::builder()
-            .uri(format!("/api/routines/{}", alice_routine.id))
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.clone().oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::NOT_FOUND,
-            "bob should not see alice's routine detail"
-        );
-
-        // Bob cannot toggle alice's routine.
-        let req = Request::builder()
-            .method(Method::POST)
-            .uri(format!("/api/routines/{}/toggle", alice_routine.id))
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.clone().oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::NOT_FOUND,
-            "bob should not toggle alice's routine"
-        );
-
-        // Bob cannot delete alice's routine.
-        let req = Request::builder()
-            .method(Method::DELETE)
-            .uri(format!("/api/routines/{}", alice_routine.id))
-            .header("Authorization", "Bearer tok-bob")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::NOT_FOUND,
-            "bob should not delete alice's routine"
-        );
-    }
-}
-
-// ═══════════════════════════════════════════════════════════════════════
-// Handler Auth Enforcement Tests
-// ═══════════════════════════════════════════════════════════════════════
-
-mod auth_enforcement {
-    use super::*;
-
-    /// Dummy handler that extracts `AuthenticatedUser` — if the auth middleware
-    /// rejects the request, this handler is never reached.
-    async fn authed_handler(AuthenticatedUser(_user): AuthenticatedUser) -> &'static str {
-        "ok"
-    }
-
-    /// Build a router with the real auth middleware and dummy handlers at all
-    /// the paths we want to verify require authentication.
-    fn auth_test_router(auth: MultiAuthState) -> Router {
-        let state = build_state(None, None);
-        Router::new()
-            // Routines
-            .route("/api/routines", get(authed_handler))
-            .route("/api/routines/summary", get(authed_handler))
-            .route("/api/routines/{id}", get(authed_handler))
-            .route("/api/routines/{id}/toggle", post(authed_handler))
-            .route("/api/routines/{id}", delete(authed_handler))
-            // Skills
-            .route("/api/skills", get(authed_handler))
-            .route("/api/skills/search", post(authed_handler))
-            .route("/api/skills/install", post(authed_handler))
-            .route("/api/skills/{name}", delete(authed_handler))
-            // Logs
-            .route("/api/logs/events", get(authed_handler))
-            .route("/api/logs/level", get(authed_handler).put(authed_handler))
-            // Gateway status
-            .route("/api/gateway/status", get(authed_handler))
-            .layer(middleware::from_fn_with_state(auth, auth_middleware))
-            .with_state(state)
-    }
-
-    /// Send a request without auth and assert it returns UNAUTHORIZED.
-    async fn assert_requires_auth(app: &Router, method: Method, uri: &str) {
-        let req = Request::builder()
-            .method(method.clone())
-            .uri(uri)
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.clone().oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::UNAUTHORIZED,
-            "{} {} should require auth",
-            method,
-            uri
-        );
-    }
-
-    /// Send a request with a valid token and assert it succeeds.
-    async fn assert_passes_with_token(app: &Router, method: Method, uri: &str, token: &str) {
-        let req = Request::builder()
-            .method(method.clone())
-            .uri(uri)
-            .header("Authorization", format!("Bearer {token}"))
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.clone().oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::OK,
-            "{} {} should pass with valid token",
-            method,
-            uri
-        );
-    }
-
-    #[tokio::test]
-    async fn test_routines_handlers_require_auth() {
-        let auth = MultiAuthState::single("secret-tok".to_string(), "user".to_string());
-        let app = auth_test_router(auth);
-        let id = Uuid::new_v4();
-
-        assert_requires_auth(&app, Method::GET, "/api/routines").await;
-        assert_requires_auth(&app, Method::GET, "/api/routines/summary").await;
-        assert_requires_auth(&app, Method::GET, &format!("/api/routines/{id}")).await;
-        assert_requires_auth(&app, Method::POST, &format!("/api/routines/{id}/toggle")).await;
-        assert_requires_auth(&app, Method::DELETE, &format!("/api/routines/{id}")).await;
-    }
-
-    #[tokio::test]
-    async fn test_skills_handlers_require_auth() {
-        let auth = MultiAuthState::single("secret-tok".to_string(), "user".to_string());
-        let app = auth_test_router(auth);
-
-        assert_requires_auth(&app, Method::GET, "/api/skills").await;
-        assert_requires_auth(&app, Method::POST, "/api/skills/search").await;
-        assert_requires_auth(&app, Method::POST, "/api/skills/install").await;
-        assert_requires_auth(&app, Method::DELETE, "/api/skills/test-skill").await;
-    }
-
-    #[tokio::test]
-    async fn test_logs_handlers_require_auth() {
-        let auth = MultiAuthState::single("secret-tok".to_string(), "user".to_string());
-        let app = auth_test_router(auth);
-
-        assert_requires_auth(&app, Method::GET, "/api/logs/events").await;
-        assert_requires_auth(&app, Method::GET, "/api/logs/level").await;
-        assert_requires_auth(&app, Method::PUT, "/api/logs/level").await;
-    }
-
-    #[tokio::test]
-    async fn test_gateway_status_requires_auth() {
-        let auth = MultiAuthState::single("secret-tok".to_string(), "user".to_string());
-        let app = auth_test_router(auth);
-
-        assert_requires_auth(&app, Method::GET, "/api/gateway/status").await;
-    }
-
-    #[tokio::test]
-    async fn test_valid_token_passes_all_endpoints() {
-        let auth = MultiAuthState::single("secret-tok".to_string(), "user".to_string());
-        let app = auth_test_router(auth);
-        let id = Uuid::new_v4();
-
-        assert_passes_with_token(&app, Method::GET, "/api/routines", "secret-tok").await;
-        assert_passes_with_token(&app, Method::GET, "/api/skills", "secret-tok").await;
-        assert_passes_with_token(&app, Method::GET, "/api/logs/events", "secret-tok").await;
-        assert_passes_with_token(&app, Method::GET, "/api/gateway/status", "secret-tok").await;
-        assert_passes_with_token(
-            &app,
-            Method::GET,
-            &format!("/api/routines/{id}"),
-            "secret-tok",
-        )
-        .await;
-    }
-
-    #[tokio::test]
-    async fn test_wrong_token_rejected_on_all_endpoints() {
-        let auth = MultiAuthState::single("secret-tok".to_string(), "user".to_string());
-        let app = auth_test_router(auth);
-
-        // Wrong token should be rejected.
-        let req = Request::builder()
-            .uri("/api/routines")
-            .header("Authorization", "Bearer wrong-tok")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.clone().oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-
-        let req = Request::builder()
-            .uri("/api/gateway/status")
-            .header("Authorization", "Bearer wrong-tok")
-            .body(Body::empty())
-            .unwrap();
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-    }
-}
@@ -63,9 +63,6 @@ pub struct TurnInfo {
    pub started_at: String,
    pub completed_at: Option<String>,
    pub tool_calls: Vec<ToolCallInfo>,
-    /// Agent's reasoning narrative for this turn.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub narrative: Option<String>,
 }

 #[derive(Debug, Serialize)]
@@ -77,9 +74,6 @@ pub struct ToolCallInfo {
    pub result_preview: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub error: Option<String>,
-    /// Agent's reasoning for choosing this tool.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub rationale: Option<String>,
 }

 #[derive(Debug, Serialize)]
@@ -120,9 +114,165 @@ pub struct ApprovalRequest {
    pub thread_id: Option<String>,
 }

-// --- App Event (re-exported from ironclaw_common) ---
+// --- SSE Event Types ---

-pub use ironclaw_common::{AppEvent, ToolDecisionDto};
+#[derive(Debug, Clone, Serialize)]
+#[serde(tag = "type")]
+pub enum SseEvent {
+    #[serde(rename = "response")]
+    Response { content: String, thread_id: String },
+    #[serde(rename = "thinking")]
+    Thinking {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "tool_started")]
+    ToolStarted {
+        name: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "tool_completed")]
+    ToolCompleted {
+        name: String,
+        success: bool,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        error: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        parameters: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "tool_result")]
+    ToolResult {
+        name: String,
+        preview: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "stream_chunk")]
+    StreamChunk {
+        content: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "status")]
+    Status {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "job_started")]
+    JobStarted {
+        job_id: String,
+        title: String,
+        browse_url: String,
+    },
+    #[serde(rename = "approval_needed")]
+    ApprovalNeeded {
+        request_id: String,
+        tool_name: String,
+        description: String,
+        parameters: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+        /// Whether the "always" auto-approve option should be shown.
+        allow_always: bool,
+    },
+    #[serde(rename = "auth_required")]
+    AuthRequired {
+        extension_name: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        instructions: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        auth_url: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        setup_url: Option<String>,
+    },
+    #[serde(rename = "auth_completed")]
+    AuthCompleted {
+        extension_name: String,
+        success: bool,
+        message: String,
+    },
+    #[serde(rename = "error")]
+    Error {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "heartbeat")]
+    Heartbeat,
+
+    // Sandbox job streaming events (worker + Claude Code bridge)
+    #[serde(rename = "job_message")]
+    JobMessage {
+        job_id: String,
+        role: String,
+        content: String,
+    },
+    #[serde(rename = "job_tool_use")]
+    JobToolUse {
+        job_id: String,
+        tool_name: String,
+        input: serde_json::Value,
+    },
+    #[serde(rename = "job_tool_result")]
+    JobToolResult {
+        job_id: String,
+        tool_name: String,
+        output: String,
+    },
+    #[serde(rename = "job_status")]
+    JobStatus { job_id: String, message: String },
+    #[serde(rename = "job_result")]
+    JobResult {
+        job_id: String,
+        status: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        session_id: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        fallback_deliverable: Option<serde_json::Value>,
+    },
+
+    /// An image was generated by a tool.
+    #[serde(rename = "image_generated")]
+    ImageGenerated {
+        data_url: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        path: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+
+    /// Suggested follow-up messages for the user.
+    #[serde(rename = "suggestions")]
+    Suggestions {
+        suggestions: Vec<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+
+    /// Per-turn token usage and cost summary.
+    #[serde(rename = "turn_cost")]
+    TurnCost {
+        input_tokens: u64,
+        output_tokens: u64,
+        cost_usd: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+
+    /// Extension activation status change (WASM channels).
+    #[serde(rename = "extension_status")]
+    ExtensionStatus {
+        extension_name: String,
+        status: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        message: Option<String>,
+    },
+}

 // --- Memory ---

@@ -634,9 +784,32 @@ pub enum WsServerMessage {
 }

 impl WsServerMessage {
-    /// Create a WsServerMessage from an AppEvent.
-    pub fn from_app_event(event: &AppEvent) -> Self {
-        let event_type = event.event_type();
+    /// Create a WsServerMessage from an SseEvent.
+    pub fn from_sse_event(event: &SseEvent) -> Self {
+        let event_type = match event {
+            SseEvent::Response { .. } => "response",
+            SseEvent::Thinking { .. } => "thinking",
+            SseEvent::ToolStarted { .. } => "tool_started",
+            SseEvent::ToolCompleted { .. } => "tool_completed",
+            SseEvent::ToolResult { .. } => "tool_result",
+            SseEvent::StreamChunk { .. } => "stream_chunk",
+            SseEvent::Status { .. } => "status",
+            SseEvent::JobStarted { .. } => "job_started",
+            SseEvent::ApprovalNeeded { .. } => "approval_needed",
+            SseEvent::AuthRequired { .. } => "auth_required",
+            SseEvent::AuthCompleted { .. } => "auth_completed",
+            SseEvent::Error { .. } => "error",
+            SseEvent::Heartbeat => "heartbeat",
+            SseEvent::JobMessage { .. } => "job_message",
+            SseEvent::JobToolUse { .. } => "job_tool_use",
+            SseEvent::JobToolResult { .. } => "job_tool_result",
+            SseEvent::JobStatus { .. } => "job_status",
+            SseEvent::JobResult { .. } => "job_result",
+            SseEvent::ImageGenerated { .. } => "image_generated",
+            SseEvent::Suggestions { .. } => "suggestions",
+            SseEvent::TurnCost { .. } => "turn_cost",
+            SseEvent::ExtensionStatus { .. } => "extension_status",
+        };
        let data = serde_json::to_value(event).unwrap_or(serde_json::Value::Null);
        WsServerMessage::Event {
            event_type: event_type.to_string(),
@@ -928,12 +1101,12 @@ mod tests {
    }

    #[test]
-    fn test_ws_server_from_app_event_response() {
-        let event = AppEvent::Response {
+    fn test_ws_server_from_sse_response() {
+        let sse = SseEvent::Response {
            content: "hello".to_string(),
            thread_id: "t1".to_string(),
        };
-        let ws = WsServerMessage::from_app_event(&event);
+        let ws = WsServerMessage::from_sse_event(&sse);
        match ws {
            WsServerMessage::Event { event_type, data } => {
                assert_eq!(event_type, "response");
@@ -945,12 +1118,12 @@ mod tests {
    }

    #[test]
-    fn test_ws_server_from_app_event_thinking() {
-        let event = AppEvent::Thinking {
+    fn test_ws_server_from_sse_thinking() {
+        let sse = SseEvent::Thinking {
            message: "reasoning...".to_string(),
            thread_id: None,
        };
-        let ws = WsServerMessage::from_app_event(&event);
+        let ws = WsServerMessage::from_sse_event(&sse);
        match ws {
            WsServerMessage::Event { event_type, data } => {
                assert_eq!(event_type, "thinking");
@@ -961,8 +1134,8 @@ mod tests {
    }

    #[test]
-    fn test_ws_server_from_app_event_approval_needed() {
-        let event = AppEvent::ApprovalNeeded {
+    fn test_ws_server_from_sse_approval_needed() {
+        let sse = SseEvent::ApprovalNeeded {
            request_id: "r1".to_string(),
            tool_name: "shell".to_string(),
            description: "Run ls".to_string(),
@@ -970,7 +1143,7 @@ mod tests {
            thread_id: Some("t1".to_string()),
            allow_always: true,
        };
-        let ws = WsServerMessage::from_app_event(&event);
+        let ws = WsServerMessage::from_sse_event(&sse);
        match ws {
            WsServerMessage::Event { event_type, data } => {
                assert_eq!(event_type, "approval_needed");
@@ -982,9 +1155,9 @@ mod tests {
    }

    #[test]
-    fn test_ws_server_from_app_event_heartbeat() {
-        let event = AppEvent::Heartbeat;
-        let ws = WsServerMessage::from_app_event(&event);
+    fn test_ws_server_from_sse_heartbeat() {
+        let sse = SseEvent::Heartbeat;
+        let ws = WsServerMessage::from_sse_event(&sse);
        match ws {
            WsServerMessage::Event { event_type, .. } => {
                assert_eq!(event_type, "heartbeat");
@@ -1024,8 +1197,8 @@ mod tests {
    }

    #[test]
-    fn test_app_event_auth_required_serialize() {
-        let event = AppEvent::AuthRequired {
+    fn test_sse_auth_required_serialize() {
+        let event = SseEvent::AuthRequired {
            extension_name: "notion".to_string(),
            instructions: Some("Get your token from...".to_string()),
            auth_url: None,
@@ -1041,8 +1214,8 @@ mod tests {
    }

    #[test]
-    fn test_app_event_auth_completed_serialize() {
-        let event = AppEvent::AuthCompleted {
+    fn test_sse_auth_completed_serialize() {
+        let event = SseEvent::AuthCompleted {
            extension_name: "notion".to_string(),
            success: true,
            message: "notion authenticated (3 tools loaded)".to_string(),
@@ -1055,14 +1228,14 @@ mod tests {
    }

    #[test]
-    fn test_ws_server_from_app_event_auth_required() {
-        let event = AppEvent::AuthRequired {
+    fn test_ws_server_from_sse_auth_required() {
+        let sse = SseEvent::AuthRequired {
            extension_name: "openai".to_string(),
            instructions: Some("Enter API key".to_string()),
            auth_url: None,
            setup_url: None,
        };
-        let ws = WsServerMessage::from_app_event(&event);
+        let ws = WsServerMessage::from_sse_event(&sse);
        match ws {
            WsServerMessage::Event { event_type, data } => {
                assert_eq!(event_type, "auth_required");
@@ -1073,13 +1246,13 @@ mod tests {
    }

    #[test]
-    fn test_ws_server_from_app_event_auth_completed() {
-        let event = AppEvent::AuthCompleted {
+    fn test_ws_server_from_sse_auth_completed() {
+        let sse = SseEvent::AuthCompleted {
            extension_name: "slack".to_string(),
            success: false,
            message: "Invalid token".to_string(),
        };
-        let ws = WsServerMessage::from_app_event(&event);
+        let ws = WsServerMessage::from_sse_event(&sse);
        match ws {
            WsServerMessage::Event { event_type, data } => {
                assert_eq!(event_type, "auth_completed");
@@ -2,21 +2,28 @@

 use crate::channels::web::types::{ToolCallInfo, TurnInfo};

-pub use ironclaw_common::truncate_preview;
+/// Truncate a string to at most `max_bytes` bytes at a char boundary, appending "...".
+///
+/// If the input is wrapped in `<tool_output …>…</tool_output>` and truncation
+/// removes the closing tag, the tag is re-appended so downstream XML parsers
+/// never see an unclosed element.
+pub fn truncate_preview(s: &str, max_bytes: usize) -> String {
+    if s.len() <= max_bytes {
+        return s.to_string();
+    }
+    // Walk backwards from max_bytes to find a valid char boundary
+    let mut end = max_bytes;
+    while end > 0 && !s.is_char_boundary(end) {
+        end -= 1;
+    }
+    let mut result = format!("{}...", &s[..end]);

-/// Parse tool call summary JSON objects into `ToolCallInfo` structs.
-fn parse_tool_call_infos(calls: &[serde_json::Value]) -> Vec<ToolCallInfo> {
-    calls
-        .iter()
-        .map(|c| ToolCallInfo {
-            name: c["name"].as_str().unwrap_or("unknown").to_string(),
-            has_result: c.get("result_preview").is_some_and(|v| !v.is_null()),
-            has_error: c.get("error").is_some_and(|v| !v.is_null()),
-            result_preview: c["result_preview"].as_str().map(String::from),
-            error: c["error"].as_str().map(String::from),
-            rationale: c["rationale"].as_str().map(String::from),
-        })
-        .collect()
+    // Re-close <tool_output> if truncation cut through the closing tag.
+    if s.starts_with("<tool_output") && !result.ends_with("</tool_output>") {
+        result.push_str("\n</tool_output>");
+    }
+
+    result
 }

 /// Build TurnInfo pairs from flat DB messages (user/tool_calls/assistant triples).
@@ -42,7 +49,6 @@ pub fn build_turns_from_db_messages(
                started_at: msg.created_at.to_rfc3339(),
                completed_at: None,
                tool_calls: Vec::new(),
-                narrative: None,
            };

            // Check if next message is a tool_calls record
@@ -50,28 +56,18 @@ pub fn build_turns_from_db_messages(
                && next.role == "tool_calls"
            {
                let tc_msg = iter.next().expect("peeked");
-                // Parse tool_calls JSON — supports two formats:
-                // safety: no byte-index slicing; comment describes JSON shape
-                match serde_json::from_str::<serde_json::Value>(&tc_msg.content) {
-                    Ok(serde_json::Value::Array(calls)) => {
-                        // Old format: plain array
-                        turn.tool_calls = parse_tool_call_infos(&calls);
-                    }
-                    Ok(serde_json::Value::Object(obj)) => {
-                        // New wrapped format with narrative
-                        turn.narrative = obj
-                            .get("narrative")
-                            .and_then(|v| v.as_str())
-                            .map(String::from);
-                        if let Some(serde_json::Value::Array(calls)) = obj.get("calls") {
-                            turn.tool_calls = parse_tool_call_infos(calls);
-                        }
-                    }
-                    Ok(_) => {
-                        tracing::warn!(
-                            message_id = %tc_msg.id,
-                            "Unexpected tool_calls JSON shape in DB, skipping"
-                        );
+                match serde_json::from_str::<Vec<serde_json::Value>>(&tc_msg.content) {
+                    Ok(calls) => {
+                        turn.tool_calls = calls
+                            .iter()
+                            .map(|c| ToolCallInfo {
+                                name: c["name"].as_str().unwrap_or("unknown").to_string(),
+                                has_result: c.get("result_preview").is_some(),
+                                has_error: c.get("error").is_some(),
+                                result_preview: c["result_preview"].as_str().map(String::from),
+                                error: c["error"].as_str().map(String::from),
+                            })
+                            .collect();
                    }
                    Err(e) => {
                        tracing::warn!(
@@ -109,7 +105,6 @@ pub fn build_turns_from_db_messages(
                started_at: msg.created_at.to_rfc3339(),
                completed_at: Some(msg.created_at.to_rfc3339()),
                tool_calls: Vec::new(),
-                narrative: None,
            });
            turn_number += 1;
        }
@@ -123,6 +118,88 @@ mod tests {
    use super::*;
    use uuid::Uuid;

+    // ---- truncate_preview tests ----
+
+    #[test]
+    fn test_truncate_preview_short_string() {
+        assert_eq!(truncate_preview("hello", 10), "hello");
+    }
+
+    #[test]
+    fn test_truncate_preview_exact_boundary() {
+        assert_eq!(truncate_preview("hello", 5), "hello");
+    }
+
+    #[test]
+    fn test_truncate_preview_truncates_ascii() {
+        assert_eq!(truncate_preview("hello world", 5), "hello...");
+    }
+
+    #[test]
+    fn test_truncate_preview_empty_string() {
+        assert_eq!(truncate_preview("", 10), "");
+    }
+
+    #[test]
+    fn test_truncate_preview_multibyte_char_boundary() {
+        // '€' is 3 bytes (E2 82 AC). "a€b" = [61, E2, 82, AC, 62] = 5 bytes
+        // Truncating at max_bytes=3 should not split the euro sign.
+        let s = "a€b";
+        let result = truncate_preview(s, 3);
+        // max_bytes=3 lands mid-€, so it walks back to byte 1 ("a")
+        assert_eq!(result, "a...");
+    }
+
+    #[test]
+    fn test_truncate_preview_emoji() {
+        // '🦀' is 4 bytes. "hi🦀" = 6 bytes
+        let s = "hi🦀";
+        let result = truncate_preview(s, 4);
+        // max_bytes=4 lands mid-🦀, walks back to byte 2 ("hi")
+        assert_eq!(result, "hi...");
+    }
+
+    #[test]
+    fn test_truncate_preview_cjk() {
+        // CJK characters are 3 bytes each. "你好世界" = 12 bytes
+        let s = "你好世界";
+        let result = truncate_preview(s, 7);
+        // max_bytes=7 lands mid-character (byte 7 is inside 世), walks back to 6 ("你好")
+        assert_eq!(result, "你好...");
+    }
+
+    #[test]
+    fn test_truncate_preview_zero_max_bytes() {
+        assert_eq!(truncate_preview("hello", 0), "...");
+    }
+
+    #[test]
+    fn test_truncate_preview_closes_tool_output_tag() {
+        let s = "<tool_output name=\"search\">\nSome very long content here\n</tool_output>";
+        // Truncate so it cuts before the closing tag
+        let result = truncate_preview(s, 60);
+        assert!(result.ends_with("</tool_output>"));
+        assert!(result.contains("..."));
+    }
+
+    #[test]
+    fn test_truncate_preview_no_extra_close_when_intact() {
+        let s = "<tool_output name=\"echo\">\nshort\n</tool_output>";
+        // The string is short enough not to be truncated
+        let result = truncate_preview(s, 500);
+        assert_eq!(result, s);
+        // Should not have a duplicate closing tag
+        assert_eq!(result.matches("</tool_output>").count(), 1);
+    }
+
+    #[test]
+    fn test_truncate_preview_non_xml_unaffected() {
+        let s = "Just a plain long string that gets truncated";
+        let result = truncate_preview(s, 10);
+        assert_eq!(result, "Just a pla...");
+        assert!(!result.contains("</tool_output>"));
+    }
+
    // ---- build_turns_from_db_messages tests ----

    fn make_msg(role: &str, content: &str, offset_ms: i64) -> crate::history::ConversationMessage {
@@ -228,52 +305,4 @@ mod tests {
        assert!(turns[0].tool_calls.is_empty());
        assert_eq!(turns[0].state, "Completed");
    }
-
-    #[test]
-    fn test_build_turns_with_wrapped_tool_calls_format() {
-        let tc_json = serde_json::json!({
-            "narrative": "Searching memory for context before proceeding.",
-            "calls": [
-                {"name": "memory_search", "result_preview": "found 3 items", "rationale": "consult prior context"},
-                {"name": "shell", "error": "permission denied"}
-            ]
-        });
-        let messages = vec![
-            make_msg("user", "Find info", 0),
-            make_msg("tool_calls", &tc_json.to_string(), 500),
-            make_msg("assistant", "Here's what I found", 1000),
-        ];
-        let turns = build_turns_from_db_messages(&messages);
-        assert_eq!(turns.len(), 1);
-        assert_eq!(
-            turns[0].narrative.as_deref(),
-            Some("Searching memory for context before proceeding.")
-        );
-        assert_eq!(turns[0].tool_calls.len(), 2);
-        assert_eq!(turns[0].tool_calls[0].name, "memory_search");
-        assert_eq!(
-            turns[0].tool_calls[0].rationale.as_deref(),
-            Some("consult prior context")
-        );
-        assert!(turns[0].tool_calls[0].has_result);
-        assert_eq!(turns[0].tool_calls[1].name, "shell");
-        assert!(turns[0].tool_calls[1].has_error);
-        assert_eq!(turns[0].response.as_deref(), Some("Here's what I found"));
-    }
-
-    #[test]
-    fn test_build_turns_wrapped_format_without_narrative() {
-        let tc_json = serde_json::json!({
-            "calls": [{"name": "echo", "result_preview": "hello"}]
-        });
-        let messages = vec![
-            make_msg("user", "Say hi", 0),
-            make_msg("tool_calls", &tc_json.to_string(), 500),
-            make_msg("assistant", "Done", 1000),
-        ];
-        let turns = build_turns_from_db_messages(&messages);
-        assert_eq!(turns.len(), 1);
-        assert!(turns[0].narrative.is_none());
-        assert_eq!(turns[0].tool_calls.len(), 1);
-    }
 }
@@ -62,11 +62,7 @@ impl Default for WsConnectionTracker {
 ///
 /// When either task ends (client disconnect or broadcast closed), both are
 /// cleaned up.
-pub async fn handle_ws_connection(
-    socket: WebSocket,
-    state: Arc<GatewayState>,
-    user: crate::channels::web::auth::UserIdentity,
-) {
+pub async fn handle_ws_connection(socket: WebSocket, state: Arc<GatewayState>) {
    let (mut ws_sink, mut ws_stream) = socket.split();

    // Track connection
@@ -75,9 +71,9 @@ pub async fn handle_ws_connection(
    }
    let tracker_for_drop = state.ws_tracker.clone();

-    // Subscribe to broadcast events (same source as SSE), scoped to this user.
+    // Subscribe to broadcast events (same source as SSE).
    // Reject if we've hit the connection limit.
-    let Some(raw_stream) = state.sse.subscribe_raw(Some(user.user_id.clone())) else {
+    let Some(raw_stream) = state.sse.subscribe_raw() else {
        tracing::warn!("WebSocket rejected: too many connections");
        // Decrement the WS tracker we already incremented above.
        if let Some(ref tracker) = tracker_for_drop {
@@ -97,7 +93,7 @@ pub async fn handle_ws_connection(
            let msg = tokio::select! {
                event = event_stream.next() => {
                    match event {
-                        Some(app_event) => WsServerMessage::from_app_event(&app_event),
+                        Some(sse_event) => WsServerMessage::from_sse_event(&sse_event),
                        None => break, // Broadcast channel closed
                    }
                }
@@ -121,7 +117,7 @@ pub async fn handle_ws_connection(
    });

    // Receiver task: read client frames and route to agent
-    let user_id = user.user_id;
+    let user_id = state.user_id.clone();
    while let Some(Ok(frame)) = ws_stream.next().await {
        match frame {
            Message::Text(text) => {
@@ -267,15 +263,11 @@ async fn handle_client_message(
            token,
        } => {
            if let Some(ref ext_mgr) = state.extension_manager {
-                match ext_mgr
-                    .configure_token(&extension_name, &token, user_id)
-                    .await
-                {
+                match ext_mgr.configure_token(&extension_name, &token).await {
                    Ok(result) => {
                        if result.verification.is_some() {
-                            state.sse.broadcast_for_user(
-                                user_id,
-                                crate::channels::web::types::AppEvent::AuthRequired {
+                            state.sse.broadcast(
+                                crate::channels::web::types::SseEvent::AuthRequired {
                                    extension_name: extension_name.clone(),
                                    instructions: Some(result.message),
                                    auth_url: None,
@@ -283,10 +275,9 @@ async fn handle_client_message(
                                },
                            );
                        } else {
-                            crate::channels::web::server::clear_auth_mode(state, user_id).await;
-                            state.sse.broadcast_for_user(
-                                user_id,
-                                crate::channels::web::types::AppEvent::AuthCompleted {
+                            crate::channels::web::server::clear_auth_mode(state).await;
+                            state.sse.broadcast(
+                                crate::channels::web::types::SseEvent::AuthCompleted {
                                    extension_name,
                                    success: true,
                                    message: result.message,
@@ -297,9 +288,8 @@ async fn handle_client_message(
                    Err(e) => {
                        let msg = format!("Auth failed: {}", e);
                        if matches!(e, crate::extensions::ExtensionError::ValidationFailed(_)) {
-                            state.sse.broadcast_for_user(
-                                user_id,
-                                crate::channels::web::types::AppEvent::AuthRequired {
+                            state.sse.broadcast(
+                                crate::channels::web::types::SseEvent::AuthRequired {
                                    extension_name: extension_name.clone(),
                                    instructions: Some(msg.clone()),
                                    auth_url: None,
@@ -321,7 +311,7 @@ async fn handle_client_message(
            }
        }
        WsClientMessage::AuthCancel { .. } => {
-            crate::channels::web::server::clear_auth_mode(state, user_id).await;
+            crate::channels::web::server::clear_auth_mode(state).await;
        }
        WsClientMessage::Ping => {
            let _ = direct_tx.send(WsServerMessage::Pong).await;
@@ -508,9 +498,8 @@ mod tests {

        GatewayState {
            msg_tx: tokio::sync::RwLock::new(msg_tx),
-            sse: Arc::new(SseManager::new()),
+            sse: SseManager::new(),
            workspace: None,
-            workspace_pool: None,
            session_manager: None,
            log_broadcaster: None,
            log_level_handle: None,
@@ -520,14 +509,13 @@ mod tests {
            job_manager: None,
            prompt_queue: None,
            scheduler: None,
-            owner_id: "test".to_string(),
-            default_sender_id: "test".to_string(),
+            user_id: "test".to_string(),
            shutdown_tx: tokio::sync::RwLock::new(None),
            ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
            llm_provider: None,
            skill_registry: None,
            skill_catalog: None,
-            chat_rate_limiter: crate::channels::web::server::PerUserRateLimiter::new(30, 60),
+            chat_rate_limiter: crate::channels::web::server::RateLimiter::new(30, 60),
            oauth_rate_limiter: crate::channels::web::server::RateLimiter::new(10, 60),
            webhook_rate_limiter: crate::channels::web::server::RateLimiter::new(10, 60),
            registry_entries: Vec::new(),
@@ -25,7 +25,6 @@ pub mod import;
 mod logs;
 mod mcp;
 pub mod memory;
-mod models;
 pub mod oauth_defaults;
 mod pairing;
 mod registry;
@@ -46,7 +45,6 @@ pub use logs::{LogsCommand, run_logs_command};
 pub use mcp::{McpCommand, run_mcp_command};
 pub use memory::MemoryCommand;
 pub use memory::run_memory_command_with_db;
-pub use models::{ModelsCommand, run_models_command};
 pub use pairing::{PairingCommand, run_pairing_command, run_pairing_command_with_store};
 pub use registry::{RegistryCommand, run_registry_command};
 pub use routines::{RoutinesCommand, run_routines_command};
@@ -219,14 +217,6 @@ pub enum Command {
    )]
    Hooks(HooksCommand),

-    /// Manage LLM providers and models
-    #[command(
-        subcommand,
-        about = "Manage LLM providers and models",
-        long_about = "List providers, view current configuration, and set active provider/model.\nExamples:\n  ironclaw models list\n  ironclaw models list openai --verbose\n  ironclaw models status\n  ironclaw models set gpt-4o\n  ironclaw models set-provider anthropic --model claude-sonnet-4-6-20250514"
-    )]
-    Models(ModelsCommand),
-
    /// Probe external dependencies and validate configuration
    #[command(
        about = "Run diagnostics",
@@ -1,864 +0,0 @@
-//! Models management CLI commands.
-//!
-//! Provides subcommands for listing providers, viewing current model
-//! configuration, and setting the active provider/model. Settings are
-//! persisted to both `config.toml` and `~/.ironclaw/.env` so changes
-//! take effect immediately (no DB connection required).
-
-use clap::Subcommand;
-use std::path::Path;
-
-use crate::llm::registry::ProviderRegistry;
-use crate::settings::Settings;
-
-#[derive(Subcommand, Debug, Clone)]
-pub enum ModelsCommand {
-    /// List providers (or available models for a specific provider)
-    List {
-        /// Show only a specific provider (by ID or alias)
-        provider: Option<String>,
-
-        /// Show detailed information (env vars, base URL, protocol)
-        #[arg(short, long)]
-        verbose: bool,
-
-        /// Output as JSON
-        #[arg(long)]
-        json: bool,
-    },
-
-    /// Show current model configuration
-    Status {
-        /// Output as JSON
-        #[arg(long)]
-        json: bool,
-    },
-
-    /// Set the default model
-    Set {
-        /// Model name (e.g., "gpt-5-mini", "claude-sonnet-4-6-20250514")
-        model: String,
-    },
-
-    /// Set the LLM provider
-    SetProvider {
-        /// Provider ID or alias (e.g., "openai", "anthropic", "ollama")
-        provider: String,
-
-        /// Also set the model (defaults to provider's default model)
-        #[arg(long)]
-        model: Option<String>,
-    },
-}
-
-/// Run the models CLI subcommand.
-pub async fn run_models_command(
-    cmd: ModelsCommand,
-    config_path: Option<&Path>,
-) -> anyhow::Result<()> {
-    match cmd {
-        ModelsCommand::List {
-            provider,
-            verbose,
-            json,
-        } => {
-            if let Some(ref id) = provider {
-                cmd_show_provider(id, verbose, json, config_path).await
-            } else {
-                cmd_list_providers(verbose, json, config_path).await
-            }
-        }
-        ModelsCommand::Status { json } => cmd_status(json, config_path),
-        ModelsCommand::Set { model } => cmd_set_model(&model, config_path),
-        ModelsCommand::SetProvider { provider, model } => {
-            cmd_set_provider(&provider, model.as_deref(), config_path)
-        }
-    }
-}
-
-// ─── Shared helpers ───────────────────────────────────────────────
-
-/// Resolve the currently active backend and model from env + settings.
-fn resolve_active(config_path: Option<&Path>) -> (String, String) {
-    let settings = load_settings(config_path);
-    resolve_active_from_settings(&settings)
-}
-
-/// Resolve active backend + model from a pre-loaded Settings.
-fn resolve_active_from_settings(settings: &Settings) -> (String, String) {
-    let backend = std::env::var("LLM_BACKEND")
-        .ok()
-        .or_else(|| settings.llm_backend.clone())
-        .unwrap_or_else(|| "nearai".to_string());
-
-    let registry = ProviderRegistry::load();
-
-    let canonical_backend = registry
-        .find(&backend)
-        .map(|d| d.id.clone())
-        .unwrap_or_else(|| backend.clone());
-
-    let model = if canonical_backend == "nearai" {
-        std::env::var("NEARAI_MODEL")
-            .ok()
-            .or_else(|| settings.selected_model.clone())
-            .unwrap_or_else(|| "qwen2.5-72b-instruct:free".to_string())
-    } else if let Some(def) = registry.find(&canonical_backend) {
-        std::env::var(&def.model_env)
-            .ok()
-            .or_else(|| settings.selected_model.clone())
-            .unwrap_or_else(|| def.default_model.clone())
-    } else {
-        settings
-            .selected_model
-            .clone()
-            .unwrap_or_else(|| "unknown".to_string())
-    };
-
-    (canonical_backend, model)
-}
-
-fn load_settings(config_path: Option<&Path>) -> Settings {
-    if let Some(path) = config_path {
-        Settings::load_toml(path).ok().flatten().unwrap_or_default()
-    } else {
-        let toml_path = config_toml_path();
-        if toml_path.exists() {
-            Settings::load_toml(&toml_path)
-                .ok()
-                .flatten()
-                .unwrap_or_default()
-        } else {
-            Settings::load()
-        }
-    }
-}
-
-fn save_settings(settings: &Settings, config_path: Option<&Path>) -> anyhow::Result<()> {
-    let path = config_path
-        .map(|p| p.to_path_buf())
-        .unwrap_or_else(config_toml_path);
-
-    settings
-        .save_toml(&path)
-        .map_err(|e| anyhow::anyhow!("{}", e))?;
-
-    Ok(())
-}
-
-fn config_toml_path() -> std::path::PathBuf {
-    crate::bootstrap::ironclaw_base_dir().join("config.toml")
-}
-
-/// Try to fetch the live model list from a provider.
-///
-/// Best-effort: returns `None` if config loading, provider creation, or the
-/// `list_models()` call fails (missing API key, network error, etc.).
-async fn try_fetch_models(provider_id: &str, config_path: Option<&Path>) -> Option<Vec<String>> {
-    let config = crate::config::Config::from_env_with_toml(config_path)
-        .await
-        .ok()?;
-
-    // Override backend to the requested provider so create_llm_provider
-    // constructs the right one.
-    let mut llm_config = config.llm.clone();
-    llm_config.backend = provider_id.to_string();
-
-    // For registry providers, resolve the RegistryProviderConfig if not
-    // already set for this backend.
-    if provider_id != "nearai" && provider_id != "bedrock" {
-        let registry = ProviderRegistry::load();
-        if let Some(def) = registry.find(provider_id)
-            && llm_config
-                .provider
-                .as_ref()
-                .is_none_or(|p| p.provider_id != def.id)
-        {
-            // Build a minimal RegistryProviderConfig from env + registry
-            let api_key = def
-                .api_key_env
-                .as_ref()
-                .and_then(|env| std::env::var(env).ok());
-            if def.api_key_required && api_key.is_none() {
-                return None;
-            }
-            let base_url = def.default_base_url.clone().unwrap_or_default();
-            llm_config.provider = Some(crate::llm::RegistryProviderConfig {
-                protocol: def.protocol,
-                provider_id: def.id.clone(),
-                model: def.default_model.clone(),
-                api_key: api_key.map(secrecy::SecretString::from),
-                base_url,
-                extra_headers: Vec::new(),
-                oauth_token: None,
-                is_codex_chatgpt: false,
-                refresh_token: None,
-                auth_path: None,
-                cache_retention: Default::default(),
-                unsupported_params: def.unsupported_params.clone(),
-            });
-        }
-    }
-
-    let session = crate::llm::create_session_manager(config.llm.session.clone()).await;
-    let provider = crate::llm::create_llm_provider(&llm_config, session)
-        .await
-        .ok()?;
-    provider.list_models().await.ok().filter(|m| !m.is_empty())
-}
-
-/// Print available models section (text output).
-fn print_model_list(models: &Option<Vec<String>>, active_model: Option<&String>) {
-    match models {
-        Some(models) => {
-            println!("\n  Available models ({}):", models.len());
-            for m in models {
-                let marker = active_model
-                    .filter(|a| a.as_str() == m)
-                    .map(|_| " (active)")
-                    .unwrap_or("");
-                println!("    {}{}", m, marker);
-            }
-        }
-        None => {
-            println!(
-                "\n  Could not fetch model list (missing credentials or provider unavailable)."
-            );
-        }
-    }
-}
-
-/// Also update `~/.ironclaw/.env` so changes take effect immediately.
-///
-/// Skipped when `config_path` is `Some` (custom `--config`), because the user
-/// is explicitly targeting a different config file and we must not pollute the
-/// default profile's `.env`.
-fn sync_to_dotenv(config_path: Option<&Path>, vars: &[(&str, &str)]) {
-    if config_path.is_some() {
-        return;
-    }
-    if let Err(e) = crate::bootstrap::upsert_bootstrap_vars(vars) {
-        eprintln!("Warning: failed to update .env: {}", e);
-    }
-}
-
-// ─── status ───────────────────────────────────────────────────────
-
-fn cmd_status(json: bool, config_path: Option<&Path>) -> anyhow::Result<()> {
-    let settings = load_settings(config_path);
-    let (backend, model) = resolve_active_from_settings(&settings);
-    let registry = ProviderRegistry::load();
-
-    let fallback = std::env::var("NEARAI_FALLBACK_MODEL").ok();
-    let cheap = std::env::var("NEARAI_CHEAP_MODEL").ok();
-
-    let description = if backend == "nearai" {
-        "NEAR AI inference (default)".to_string()
-    } else {
-        registry
-            .find(&backend)
-            .map(|d| d.description.clone())
-            .unwrap_or_default()
-    };
-
-    if json {
-        let v = serde_json::json!({
-            "provider": backend,
-            "model": model,
-            "description": description,
-            "fallback_model": fallback,
-            "cheap_model": cheap,
-        });
-        println!(
-            "{}",
-            serde_json::to_string_pretty(&v).unwrap_or_else(|_| "{}".to_string())
-        );
-        return Ok(());
-    }
-
-    println!("Provider: {} ({})", backend, description);
-    println!("Model:    {}", model);
-    if let Some(ref fb) = fallback {
-        println!("Fallback: {}", fb);
-    }
-    if let Some(ref ch) = cheap {
-        println!("Cheap:    {}", ch);
-    }
-
-    Ok(())
-}
-
-// ─── set ──────────────────────────────────────────────────────────
-
-fn cmd_set_model(model: &str, config_path: Option<&Path>) -> anyhow::Result<()> {
-    let trimmed = model.trim();
-    if trimmed.is_empty() {
-        anyhow::bail!("Model name cannot be empty");
-    }
-
-    let mut settings = load_settings(config_path);
-    let registry = ProviderRegistry::load();
-
-    // Warn if model name doesn't match any known provider's default model
-    let known_model = registry.all().iter().any(|d| d.default_model == trimmed)
-        || trimmed.contains("qwen")  // nearai models
-        || trimmed.contains("llama")
-        || trimmed.contains("gpt")
-        || trimmed.contains("claude")
-        || trimmed.contains("gemini")
-        || trimmed.contains("mistral");
-    if !known_model {
-        eprintln!(
-            "Warning: '{}' is not a recognized model name. Proceeding anyway.",
-            trimmed
-        );
-    }
-
-    settings.selected_model = Some(trimmed.to_string());
-    save_settings(&settings, config_path)?;
-
-    let backend = std::env::var("LLM_BACKEND")
-        .ok()
-        .or_else(|| settings.llm_backend.clone())
-        .unwrap_or_else(|| "nearai".to_string());
-
-    // Also write to .env so the change takes effect immediately
-    let model_env = if backend == "nearai" {
-        "NEARAI_MODEL".to_string()
-    } else {
-        registry
-            .find(&backend)
-            .map(|d| d.model_env.clone())
-            .unwrap_or_default()
-    };
-    if !model_env.is_empty() {
-        sync_to_dotenv(config_path, &[(&model_env, trimmed)]);
-    }
-
-    println!("Model set to '{}' (provider: {})", trimmed, backend);
-    println!(
-        "Saved to {}",
-        config_path
-            .map(|p| p.display().to_string())
-            .unwrap_or_else(|| config_toml_path().display().to_string())
-    );
-
-    Ok(())
-}
-
-// ─── set-provider ─────────────────────────────────────────────────
-
-fn cmd_set_provider(
-    provider: &str,
-    model: Option<&str>,
-    config_path: Option<&Path>,
-) -> anyhow::Result<()> {
-    let registry = ProviderRegistry::load();
-
-    // Validate and normalize provider
-    let canonical_id = if provider == "nearai" || provider == "near_ai" || provider == "near" {
-        "nearai".to_string()
-    } else {
-        let def = registry.find(provider).ok_or_else(|| {
-            let known: Vec<&str> = std::iter::once("nearai")
-                .chain(registry.all().iter().map(|d| d.id.as_str()))
-                .collect();
-            anyhow::anyhow!(
-                "Unknown provider '{}'. Known providers: {}",
-                provider,
-                known.join(", ")
-            )
-        })?;
-        def.id.clone()
-    };
-
-    // Resolve model: explicit > provider default
-    let resolved_model = if let Some(m) = model {
-        m.to_string()
-    } else if canonical_id == "nearai" {
-        "qwen2.5-72b-instruct:free".to_string()
-    } else if let Some(def) = registry.find(&canonical_id) {
-        def.default_model.clone()
-    } else {
-        "default".to_string()
-    };
-
-    let mut settings = load_settings(config_path);
-    settings.llm_backend = Some(canonical_id.clone());
-    settings.selected_model = Some(resolved_model.clone());
-    save_settings(&settings, config_path)?;
-
-    // Also write to .env so the change takes effect immediately
-    let model_env = if canonical_id == "nearai" {
-        "NEARAI_MODEL".to_string()
-    } else {
-        registry
-            .find(&canonical_id)
-            .map(|d| d.model_env.clone())
-            .unwrap_or_default()
-    };
-    let mut vars: Vec<(&str, &str)> = vec![("LLM_BACKEND", &canonical_id)];
-    if !model_env.is_empty() {
-        vars.push((&model_env, &resolved_model));
-    }
-    sync_to_dotenv(config_path, &vars);
-
-    println!(
-        "Provider set to '{}', model set to '{}'",
-        canonical_id, resolved_model
-    );
-    println!(
-        "Saved to {}",
-        config_path
-            .map(|p| p.display().to_string())
-            .unwrap_or_else(|| config_toml_path().display().to_string())
-    );
-
-    Ok(())
-}
-
-// ─── list ─────────────────────────────────────────────────────────
-
-/// List all providers with their default models.
-async fn cmd_list_providers(
-    verbose: bool,
-    json: bool,
-    config_path: Option<&Path>,
-) -> anyhow::Result<()> {
-    let registry = ProviderRegistry::load();
-    let (active_backend, active_model) = resolve_active(config_path);
-
-    if json {
-        let mut entries: Vec<serde_json::Value> = Vec::new();
-
-        // NEAR AI (not in registry)
-        let nearai_active = active_backend == "nearai";
-        entries.push(serde_json::json!({
-            "id": "nearai",
-            "description": "NEAR AI inference (default)",
-            "default_model": "qwen2.5-72b-instruct:free",
-            "active": nearai_active,
-            "active_model": if nearai_active { Some(&active_model) } else { None },
-        }));
-
-        for def in registry.all() {
-            let is_active = active_backend == def.id;
-            let mut v = serde_json::json!({
-                "id": def.id,
-                "description": def.description,
-                "default_model": def.default_model,
-                "protocol": format!("{:?}", def.protocol),
-                "active": is_active,
-            });
-            if is_active {
-                v["active_model"] = serde_json::json!(active_model);
-            }
-            if verbose {
-                v["aliases"] = serde_json::json!(def.aliases);
-                v["model_env"] = serde_json::json!(def.model_env);
-                v["api_key_env"] = serde_json::json!(def.api_key_env);
-                v["api_key_required"] = serde_json::json!(def.api_key_required);
-                if let Some(ref url) = def.default_base_url {
-                    v["base_url"] = serde_json::json!(url);
-                }
-                if let Some(ref setup) = def.setup {
-                    v["can_list_models"] = serde_json::json!(setup.can_list_models());
-                }
-            }
-            entries.push(v);
-        }
-
-        println!(
-            "{}",
-            serde_json::to_string_pretty(&entries).unwrap_or_else(|_| "[]".to_string())
-        );
-        return Ok(());
-    }
-
-    let providers = registry.all();
-
-    println!("Active: {} (model: {})\n", active_backend, active_model);
-    println!(
-        "{} provider(s) available:\n",
-        providers.len() + 1 // +1 for NEAR AI
-    );
-
-    // NEAR AI (not in registry)
-    let nearai_marker = if active_backend == "nearai" { " *" } else { "" };
-    if verbose {
-        println!("  nearai{}", nearai_marker);
-        println!("    Description:   NEAR AI inference (default)");
-        println!("    Default model: qwen2.5-72b-instruct:free");
-        println!("    Model env:     NEARAI_MODEL");
-        if active_backend == "nearai" {
-            println!("    Active model:  {}", active_model);
-        }
-        println!();
-    } else {
-        println!(
-            "  {:<22} {:<40} NEAR AI inference (default)",
-            format!("nearai{nearai_marker}"),
-            "qwen2.5-72b-instruct:free"
-        );
-    }
-
-    for def in providers {
-        let is_active = active_backend == def.id;
-        let marker = if is_active { " *" } else { "" };
-
-        if verbose {
-            println!("  {}{}", def.id, marker);
-            println!("    Description:   {}", def.description);
-            println!("    Default model: {}", def.default_model);
-            println!("    Protocol:      {:?}", def.protocol);
-            println!("    Model env:     {}", def.model_env);
-            if let Some(ref env) = def.api_key_env {
-                println!(
-                    "    API key env:   {} ({})",
-                    env,
-                    if def.api_key_required {
-                        "required"
-                    } else {
-                        "optional"
-                    }
-                );
-            }
-            if let Some(ref url) = def.default_base_url {
-                println!("    Base URL:      {}", url);
-            }
-            if !def.aliases.is_empty() {
-                println!("    Aliases:       {}", def.aliases.join(", "));
-            }
-            if is_active {
-                println!("    Active model:  {}", active_model);
-            }
-            println!();
-        } else {
-            let model_display = if is_active {
-                active_model.clone()
-            } else {
-                def.default_model.clone()
-            };
-            println!(
-                "  {:<22} {:<40} {}",
-                format!("{}{marker}", def.id),
-                model_display,
-                def.description,
-            );
-        }
-    }
-
-    if !verbose {
-        println!();
-        println!("* = active provider. Use --verbose for details.");
-    }
-
-    Ok(())
-}
-
-/// Show details for a specific provider.
-async fn cmd_show_provider(
-    id: &str,
-    verbose: bool,
-    json: bool,
-    config_path: Option<&Path>,
-) -> anyhow::Result<()> {
-    let registry = ProviderRegistry::load();
-    let (active_backend, active_model) = resolve_active(config_path);
-
-    // Resolve canonical ID for model fetching
-    let canonical_id = if id == "nearai" || id == "near_ai" || id == "near" {
-        "nearai".to_string()
-    } else {
-        registry
-            .find(id)
-            .map(|d| d.id.clone())
-            .unwrap_or_else(|| id.to_string())
-    };
-
-    // Try to fetch live model list from the provider
-    let live_models = try_fetch_models(&canonical_id, config_path).await;
-
-    // Check NEAR AI first (not in registry)
-    if id == "nearai" || id == "near_ai" || id == "near" {
-        let is_active = active_backend == "nearai";
-        if json {
-            let mut v = serde_json::json!({
-                "id": "nearai",
-                "description": "NEAR AI inference (default)",
-                "default_model": "qwen2.5-72b-instruct:free",
-                "model_env": "NEARAI_MODEL",
-                "active": is_active,
-            });
-            if is_active {
-                v["active_model"] = serde_json::json!(active_model);
-            }
-            if let Some(ref models) = live_models {
-                v["available_models"] = serde_json::json!(models);
-            }
-            println!(
-                "{}",
-                serde_json::to_string_pretty(&v).unwrap_or_else(|_| "{}".to_string())
-            );
-        } else {
-            println!("Provider: nearai");
-            println!("  Description:   NEAR AI inference (default)");
-            println!("  Default model: qwen2.5-72b-instruct:free");
-            println!("  Model env:     NEARAI_MODEL");
-            println!("  Active:        {}", if is_active { "yes" } else { "no" });
-            if is_active {
-                println!("  Active model:  {}", active_model);
-            }
-            print_model_list(&live_models, is_active.then_some(&active_model));
-        }
-        return Ok(());
-    }
-
-    let def = registry.find(id).ok_or_else(|| {
-        let known: Vec<&str> = std::iter::once("nearai")
-            .chain(registry.all().iter().map(|d| d.id.as_str()))
-            .collect();
-        anyhow::anyhow!(
-            "Unknown provider '{}'. Known providers: {}",
-            id,
-            known.join(", ")
-        )
-    })?;
-
-    let is_active = active_backend == def.id;
-
-    if json {
-        let mut v = serde_json::json!({
-            "id": def.id,
-            "description": def.description,
-            "protocol": format!("{:?}", def.protocol),
-            "default_model": def.default_model,
-            "model_env": def.model_env,
-            "api_key_env": def.api_key_env,
-            "api_key_required": def.api_key_required,
-            "aliases": def.aliases,
-            "active": is_active,
-        });
-        if let Some(ref url) = def.default_base_url {
-            v["base_url"] = serde_json::json!(url);
-        }
-        if let Some(ref setup) = def.setup {
-            v["can_list_models"] = serde_json::json!(setup.can_list_models());
-            v["display_name"] = serde_json::json!(setup.display_name());
-        }
-        if is_active {
-            v["active_model"] = serde_json::json!(active_model);
-        }
-        if verbose && !def.unsupported_params.is_empty() {
-            v["unsupported_params"] = serde_json::json!(def.unsupported_params);
-        }
-        if let Some(ref models) = live_models {
-            v["available_models"] = serde_json::json!(models);
-        }
-        println!(
-            "{}",
-            serde_json::to_string_pretty(&v).unwrap_or_else(|_| "{}".to_string())
-        );
-        return Ok(());
-    }
-
-    println!("Provider: {}", def.id);
-    println!("  Description:   {}", def.description);
-    println!("  Protocol:      {:?}", def.protocol);
-    println!("  Default model: {}", def.default_model);
-    println!("  Model env:     {}", def.model_env);
-    if let Some(ref env) = def.api_key_env {
-        println!(
-            "  API key env:   {} ({})",
-            env,
-            if def.api_key_required {
-                "required"
-            } else {
-                "optional"
-            }
-        );
-    }
-    if let Some(ref url) = def.default_base_url {
-        println!("  Base URL:      {}", url);
-    }
-    if !def.aliases.is_empty() {
-        println!("  Aliases:       {}", def.aliases.join(", "));
-    }
-    if let Some(ref setup) = def.setup {
-        println!(
-            "  List models:   {}",
-            if setup.can_list_models() {
-                "supported"
-            } else {
-                "not supported"
-            }
-        );
-        println!("  Display name:  {}", setup.display_name());
-    }
-    if !def.unsupported_params.is_empty() {
-        println!("  Unsupported:   {}", def.unsupported_params.join(", "));
-    }
-    println!("  Active:        {}", if is_active { "yes" } else { "no" });
-    if is_active {
-        println!("  Active model:  {}", active_model);
-    }
-    print_model_list(&live_models, is_active.then_some(&active_model));
-
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn resolve_active_defaults_to_nearai() {
-        let settings = Settings::default();
-        assert!(settings.llm_backend.is_none());
-        assert!(settings.selected_model.is_none());
-    }
-
-    #[test]
-    fn registry_loads_all_providers() {
-        let registry = ProviderRegistry::load();
-        let all = registry.all();
-        assert!(
-            all.len() >= 10,
-            "should have at least 10 built-in providers, got {}",
-            all.len()
-        );
-    }
-
-    #[test]
-    fn registry_find_by_alias() {
-        let registry = ProviderRegistry::load();
-        let def = registry
-            .find("claude")
-            .expect("claude alias should resolve");
-        assert_eq!(def.id, "anthropic");
-    }
-
-    #[test]
-    fn all_providers_have_description() {
-        let registry = ProviderRegistry::load();
-        for def in registry.all() {
-            assert!(
-                !def.description.is_empty(),
-                "provider {} should have a description",
-                def.id
-            );
-        }
-    }
-
-    #[test]
-    fn set_model_persists_to_toml() {
-        let dir = tempfile::tempdir().expect("create temp dir");
-        let toml_path = dir.path().join("config.toml");
-
-        cmd_set_model("gpt-5-mini", Some(&toml_path)).expect("set model");
-
-        let settings = Settings::load_toml(&toml_path)
-            .expect("read toml")
-            .expect("should have settings");
-        assert_eq!(settings.selected_model.as_deref(), Some("gpt-5-mini"));
-    }
-
-    #[test]
-    fn set_provider_validates_unknown() {
-        let dir = tempfile::tempdir().expect("create temp dir");
-        let toml_path = dir.path().join("config.toml");
-
-        let result = cmd_set_provider("nonexistent_provider", None, Some(&toml_path));
-        assert!(result.is_err());
-        let err = result.unwrap_err().to_string();
-        assert!(
-            err.contains("Unknown provider"),
-            "should mention unknown provider: {}",
-            err
-        );
-    }
-
-    #[test]
-    fn set_provider_persists_to_toml() {
-        let dir = tempfile::tempdir().expect("create temp dir");
-        let toml_path = dir.path().join("config.toml");
-
-        cmd_set_provider("groq", None, Some(&toml_path)).expect("set provider");
-
-        let settings = Settings::load_toml(&toml_path)
-            .expect("read toml")
-            .expect("should have settings");
-        assert_eq!(settings.llm_backend.as_deref(), Some("groq"));
-        assert_eq!(
-            settings.selected_model.as_deref(),
-            Some("llama-3.3-70b-versatile")
-        );
-    }
-
-    #[test]
-    fn set_provider_with_custom_model() {
-        let dir = tempfile::tempdir().expect("create temp dir");
-        let toml_path = dir.path().join("config.toml");
-
-        cmd_set_provider("anthropic", Some("claude-opus-4-6"), Some(&toml_path))
-            .expect("set provider with model");
-
-        let settings = Settings::load_toml(&toml_path)
-            .expect("read toml")
-            .expect("should have settings");
-        assert_eq!(settings.llm_backend.as_deref(), Some("anthropic"));
-        assert_eq!(settings.selected_model.as_deref(), Some("claude-opus-4-6"));
-    }
-
-    #[test]
-    fn custom_config_does_not_pollute_default_dotenv() {
-        let dir = tempfile::tempdir().expect("create temp dir");
-        let toml_path = dir.path().join("config.toml");
-
-        // With a custom config path, sync_to_dotenv should be a no-op
-        // (it returns early when config_path is Some).
-        // We verify by checking that cmd_set_provider succeeds without
-        // trying to write to the default ~/.ironclaw/.env.
-        cmd_set_provider("groq", None, Some(&toml_path)).expect("set provider with custom config");
-
-        let settings = Settings::load_toml(&toml_path)
-            .expect("read toml")
-            .expect("should have settings");
-        assert_eq!(settings.llm_backend.as_deref(), Some("groq"));
-        // The key assertion is that no error was thrown trying to write
-        // to the default .env — sync_to_dotenv skipped it.
-    }
-
-    #[test]
-    fn set_model_rejects_empty_name() {
-        let dir = tempfile::tempdir().expect("create temp dir");
-        let toml_path = dir.path().join("config.toml");
-
-        let result = cmd_set_model("", Some(&toml_path));
-        assert!(result.is_err());
-        assert!(
-            result.unwrap_err().to_string().contains("cannot be empty"),
-            "should reject empty model name"
-        );
-
-        let result2 = cmd_set_model("   ", Some(&toml_path));
-        assert!(result2.is_err());
-    }
-
-    #[test]
-    fn set_provider_normalizes_alias() {
-        let dir = tempfile::tempdir().expect("create temp dir");
-        let toml_path = dir.path().join("config.toml");
-
-        cmd_set_provider("claude", None, Some(&toml_path)).expect("set via alias");
-
-        let settings = Settings::load_toml(&toml_path)
-            .expect("read toml")
-            .expect("should have settings");
-        assert_eq!(
-            settings.llm_backend.as_deref(),
-            Some("anthropic"),
-            "alias should be normalized to canonical ID"
-        );
-    }
-}
@@ -62,30 +62,6 @@ pub fn builtin_client_id_override_env(secret_name: &str) -> Option<&'static str>
    }
 }

-/// Suppress the baked-in desktop OAuth client secret when a hosted proxy is configured.
-///
-/// In hosted deployments, IronClaw may resolve the platform Google client ID from
-/// environment variables while still falling back to the baked-in desktop secret.
-/// That client_id/client_secret mismatch breaks Google token exchange and refresh.
-///
-/// When the proxy is configured, the platform will inject the correct server-side
-/// secret for matching platform credentials, so the baked-in secret must be omitted.
-pub fn hosted_proxy_client_secret(
-    client_secret: &Option<String>,
-    builtin: Option<&OAuthCredentials>,
-    exchange_proxy_configured: bool,
-) -> Option<String> {
-    if !exchange_proxy_configured {
-        return client_secret.clone();
-    }
-
-    let builtin_secret = builtin.map(|credentials| credentials.client_secret);
-    match (client_secret, builtin_secret) {
-        (Some(resolved), Some(baked_in)) if resolved == baked_in => None,
-        _ => client_secret.clone(),
-    }
-}
-
 // ── Shared callback server ──────────────────────────────────────────────

 // Core OAuth callback infrastructure is defined in `crate::llm::oauth_helpers`
@@ -471,10 +447,9 @@ pub struct PendingOAuthFlow {
    pub user_id: String,
    /// Secrets store reference for token persistence.
    pub secrets: Arc<dyn SecretsStore + Send + Sync>,
-    /// SSE broadcast manager for notifying the web UI.
-    pub sse_manager: Option<Arc<crate::channels::web::sse::SseManager>>,
-    /// OAuth proxy auth token for authenticating with the hosted token exchange proxy.
-    /// Kept as `gateway_token` for public API compatibility.
+    /// SSE broadcast sender for notifying the web UI.
+    pub sse_sender: Option<tokio::sync::broadcast::Sender<crate::channels::web::types::SseEvent>>,
+    /// Gateway auth token for authenticating with the platform token exchange proxy.
    pub gateway_token: Option<String>,
    /// Additional form params for the token exchange request.
    /// Used for provider-specific requirements such as RFC 8707 `resource`.
@@ -497,12 +472,6 @@ impl std::fmt::Debug for PendingOAuthFlow {
    }
 }

-impl PendingOAuthFlow {
-    pub fn oauth_proxy_auth_token(&self) -> Option<&str> {
-        self.gateway_token.as_deref()
-    }
-}
-
 /// Thread-safe registry of pending OAuth flows, keyed by CSRF `state` parameter.
 pub type PendingOAuthRegistry = Arc<RwLock<HashMap<String, PendingOAuthFlow>>>;

@@ -536,22 +505,6 @@ pub fn exchange_proxy_url() -> Option<String> {
        .filter(|url| !url.is_empty())
 }

-/// Returns the configured OAuth proxy auth token, if any.
-///
-/// New hosted infra can inject a dedicated shared proxy secret via
-/// `IRONCLAW_OAUTH_PROXY_AUTH_TOKEN`. Existing hosted instances continue to
-/// work by falling back to `GATEWAY_AUTH_TOKEN`.
-pub fn oauth_proxy_auth_token() -> Option<String> {
-    fn normalized_env_value(key: &str) -> Option<String> {
-        crate::config::helpers::env_or_override(key)
-            .map(|value| value.trim().to_string())
-            .filter(|value| !value.is_empty())
-    }
-
-    normalized_env_value("IRONCLAW_OAUTH_PROXY_AUTH_TOKEN")
-        .or_else(|| normalized_env_value("GATEWAY_AUTH_TOKEN"))
-}
-
 /// Maximum age for pending OAuth flows (5 minutes, matching TCP listener timeout).
 pub const OAUTH_FLOW_EXPIRY: Duration = Duration::from_secs(300);

@@ -697,8 +650,6 @@ pub fn strip_instance_prefix(state: &str) -> &str {

 pub struct ProxyTokenExchangeRequest<'a> {
    pub proxy_url: &'a str,
-    /// OAuth proxy auth token.
-    /// Kept as `gateway_token` for public API compatibility.
    pub gateway_token: &'a str,
    pub token_url: &'a str,
    pub client_id: &'a str,
@@ -710,53 +661,9 @@ pub struct ProxyTokenExchangeRequest<'a> {
    pub extra_token_params: &'a HashMap<String, String>,
 }

-pub struct ProxyRefreshTokenRequest<'a> {
-    pub proxy_url: &'a str,
-    /// OAuth proxy auth token.
-    /// Kept as `gateway_token` for public API compatibility.
-    pub gateway_token: &'a str,
-    pub token_url: &'a str,
-    pub client_id: &'a str,
-    pub client_secret: Option<&'a str>,
-    pub refresh_token: &'a str,
-    pub provider: Option<&'a str>,
-}
-
-fn oauth_token_response_from_json(
-    token_data: serde_json::Value,
-    access_token_field: &str,
-) -> Result<OAuthTokenResponse, OAuthCallbackError> {
-    let access_token = token_data
-        .get(access_token_field)
-        .and_then(|v| v.as_str())
-        .ok_or_else(|| {
-            let fields: Vec<&str> = token_data
-                .as_object()
-                .map(|o| o.keys().map(|k| k.as_str()).collect())
-                .unwrap_or_default();
-            OAuthCallbackError::Io(format!(
-                "No '{}' field in proxy response (fields present: {:?})",
-                access_token_field, fields
-            ))
-        })?
-        .to_string();
-
-    let refresh_token = token_data
-        .get("refresh_token")
-        .and_then(|v| v.as_str())
-        .map(String::from);
-    let expires_in = token_data.get("expires_in").and_then(|v| v.as_u64());
-
-    Ok(OAuthTokenResponse {
-        access_token,
-        refresh_token,
-        expires_in,
-    })
-}
-
 /// Exchange an OAuth authorization code via the platform's token exchange proxy.
 ///
-/// Authenticated via an OAuth proxy auth token (Bearer header). The caller may
+/// Authenticated via the gateway auth token (Bearer header). The caller may
 /// either rely on proxy-side secret lookup or forward a `client_secret` when
 /// the provider requires it.
 ///
@@ -768,14 +675,13 @@ pub async fn exchange_via_proxy(
 ) -> Result<OAuthTokenResponse, OAuthCallbackError> {
    if request.gateway_token.is_empty() {
        return Err(OAuthCallbackError::Io(
-            "OAuth proxy auth token is required for proxy token exchange".to_string(),
+            "Gateway auth token is required for proxy token exchange".to_string(),
        ));
    }
    let exchange_url = format!("{}/oauth/exchange", request.proxy_url.trim_end_matches('/'));

    let client = reqwest::Client::builder()
        .timeout(Duration::from_secs(60))
-        .redirect(reqwest::redirect::Policy::none())
        .build()
        .map_err(|e| OAuthCallbackError::Io(format!("Failed to build HTTP client: {}", e)))?;
    let mut params = vec![
@@ -818,454 +724,41 @@ pub async fn exchange_via_proxy(
        .json()
        .await
        .map_err(|e| OAuthCallbackError::Io(format!("Failed to parse proxy response: {}", e)))?;
-    oauth_token_response_from_json(token_data, request.access_token_field)
-}

-/// Refresh an OAuth access token via the platform's token refresh proxy.
-///
-/// Authenticated via an OAuth proxy auth token (Bearer header). The caller may
-/// either rely on proxy-side secret lookup or forward a `client_secret` when
-/// the provider requires it.
-pub async fn refresh_token_via_proxy(
-    request: ProxyRefreshTokenRequest<'_>,
-) -> Result<OAuthTokenResponse, OAuthCallbackError> {
-    if request.gateway_token.is_empty() {
-        return Err(OAuthCallbackError::Io(
-            "OAuth proxy auth token is required for proxy token refresh".to_string(),
-        ));
-    }
+    let access_token = token_data
+        .get(request.access_token_field)
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| {
+            let fields: Vec<&str> = token_data
+                .as_object()
+                .map(|o| o.keys().map(|k| k.as_str()).collect())
+                .unwrap_or_default();
+            OAuthCallbackError::Io(format!(
+                "No '{}' field in proxy response (fields present: {:?})",
+                request.access_token_field, fields
+            ))
+        })?
+        .to_string();

-    let refresh_url = format!("{}/oauth/refresh", request.proxy_url.trim_end_matches('/'));
-    let client = reqwest::Client::builder()
-        .timeout(Duration::from_secs(15))
-        .redirect(reqwest::redirect::Policy::none())
-        .build()
-        .map_err(|e| OAuthCallbackError::Io(format!("Failed to build HTTP client: {}", e)))?;
+    let refresh_token = token_data
+        .get("refresh_token")
+        .and_then(|v| v.as_str())
+        .map(String::from);
+    let expires_in = token_data.get("expires_in").and_then(|v| v.as_u64());

-    let mut params = vec![
-        ("refresh_token", request.refresh_token.to_string()),
-        ("token_url", request.token_url.to_string()),
-        ("client_id", request.client_id.to_string()),
-    ];
-    if let Some(secret) = request.client_secret {
-        params.push(("client_secret", secret.to_string()));
-    }
-    if let Some(provider) = request.provider {
-        params.push(("provider", provider.to_string()));
-    }
-
-    let response = client
-        .post(&refresh_url)
-        .bearer_auth(request.gateway_token)
-        .form(&params)
-        .send()
-        .await
-        .map_err(|e| {
-            OAuthCallbackError::Io(format!("Token refresh proxy request failed: {}", e))
-        })?;
-
-    if !response.status().is_success() {
-        let status = response.status();
-        let body = response.text().await.unwrap_or_default();
-        return Err(OAuthCallbackError::Io(format!(
-            "Token refresh proxy failed: {} - {}",
-            status, body
-        )));
-    }
-
-    let token_data: serde_json::Value = response
-        .json()
-        .await
-        .map_err(|e| OAuthCallbackError::Io(format!("Failed to parse proxy response: {}", e)))?;
-
-    oauth_token_response_from_json(token_data, "access_token")
+    Ok(OAuthTokenResponse {
+        access_token,
+        refresh_token,
+        expires_in,
+    })
 }

 #[cfg(test)]
 mod tests {
-    use std::collections::HashMap;
-    use std::net::SocketAddr;
-    use std::sync::Arc;
-
-    use axum::extract::{Form, State};
-    use axum::http::HeaderMap;
-    use axum::response::Redirect;
-    use axum::routing::post;
-    use axum::{Json, Router};
-    use serde_json::json;
-    use tokio::net::TcpListener;
-    use tokio::sync::{Mutex, oneshot};
-
    use crate::cli::oauth_defaults::{
        builtin_credentials, callback_host, callback_url, is_loopback_host, landing_html,
    };
    use crate::config::helpers::lock_env;
-    use crate::testing::credentials::{TEST_OAUTH_CLIENT_ID, TEST_OAUTH_CLIENT_SECRET};
-
-    #[derive(Clone, Debug, PartialEq, Eq)]
-    struct RecordedProxyRequest {
-        authorization: Option<String>,
-        form: HashMap<String, String>,
-    }
-
-    #[derive(Clone)]
-    struct MockProxyState {
-        requests: Arc<Mutex<Vec<RecordedProxyRequest>>>,
-        exchange_redirect_target: String,
-        refresh_redirect_target: String,
-    }
-
-    struct MockProxyServer {
-        addr: SocketAddr,
-        requests: Arc<Mutex<Vec<RecordedProxyRequest>>>,
-        shutdown_tx: Option<oneshot::Sender<()>>,
-        server_task: Option<tokio::task::JoinHandle<()>>,
-    }
-
-    impl MockProxyServer {
-        async fn start() -> Self {
-            async fn exchange_handler(
-                State(state): State<MockProxyState>,
-                headers: HeaderMap,
-                Form(form): Form<HashMap<String, String>>,
-            ) -> Json<serde_json::Value> {
-                state.requests.lock().await.push(RecordedProxyRequest {
-                    authorization: headers
-                        .get(axum::http::header::AUTHORIZATION)
-                        .and_then(|value| value.to_str().ok())
-                        .map(str::to_string),
-                    form,
-                });
-                Json(json!({
-                    "access_token": "proxy-access-token",
-                    "refresh_token": "proxy-refresh-token",
-                    "expires_in": 7200
-                }))
-            }
-
-            async fn refresh_handler(
-                State(state): State<MockProxyState>,
-                headers: HeaderMap,
-                Form(form): Form<HashMap<String, String>>,
-            ) -> Json<serde_json::Value> {
-                state.requests.lock().await.push(RecordedProxyRequest {
-                    authorization: headers
-                        .get(axum::http::header::AUTHORIZATION)
-                        .and_then(|value| value.to_str().ok())
-                        .map(str::to_string),
-                    form,
-                });
-                Json(json!({
-                    "access_token": "proxy-access-token",
-                    "refresh_token": "proxy-refresh-token",
-                    "expires_in": 7200
-                }))
-            }
-
-            async fn exchange_redirect_handler(State(state): State<MockProxyState>) -> Redirect {
-                Redirect::temporary(&state.exchange_redirect_target)
-            }
-
-            async fn refresh_redirect_handler(State(state): State<MockProxyState>) -> Redirect {
-                Redirect::temporary(&state.refresh_redirect_target)
-            }
-
-            let requests = Arc::new(Mutex::new(Vec::new()));
-            let listener = TcpListener::bind("127.0.0.1:0")
-                .await
-                .expect("bind mock proxy");
-            let addr = listener.local_addr().expect("read mock proxy addr");
-            let exchange_redirect_target = format!("http://{addr}/oauth/exchange");
-            let refresh_redirect_target = format!("http://{addr}/oauth/refresh");
-            let app = Router::new()
-                .route("/oauth/exchange", post(exchange_handler))
-                .route("/oauth/refresh", post(refresh_handler))
-                .route("/redirect/oauth/exchange", post(exchange_redirect_handler))
-                .route("/redirect/oauth/refresh", post(refresh_redirect_handler))
-                .with_state(MockProxyState {
-                    requests: Arc::clone(&requests),
-                    exchange_redirect_target,
-                    refresh_redirect_target,
-                });
-            let (shutdown_tx, shutdown_rx) = oneshot::channel::<()>();
-            let server_task = tokio::spawn(async move {
-                let _ = axum::serve(listener, app)
-                    .with_graceful_shutdown(async {
-                        let _ = shutdown_rx.await;
-                    })
-                    .await;
-            });
-
-            Self {
-                addr,
-                requests,
-                shutdown_tx: Some(shutdown_tx),
-                server_task: Some(server_task),
-            }
-        }
-
-        fn base_url(&self) -> String {
-            format!("http://{}", self.addr)
-        }
-
-        fn redirecting_base_url(&self) -> String {
-            format!("{}/redirect", self.base_url())
-        }
-
-        async fn requests(&self) -> Vec<RecordedProxyRequest> {
-            self.requests.lock().await.clone()
-        }
-
-        async fn shutdown(mut self) {
-            if let Some(tx) = self.shutdown_tx.take() {
-                let _ = tx.send(());
-            }
-            if let Some(task) = self.server_task.take() {
-                let _ = task.await;
-            }
-        }
-    }
-
-    impl Drop for MockProxyServer {
-        fn drop(&mut self) {
-            if let Some(tx) = self.shutdown_tx.take() {
-                let _ = tx.send(());
-            }
-            if let Some(task) = self.server_task.take() {
-                task.abort();
-            }
-        }
-    }
-
-    struct EnvVarGuard {
-        key: &'static str,
-        original: Option<String>,
-    }
-
-    impl Drop for EnvVarGuard {
-        fn drop(&mut self) {
-            // SAFETY: Under ENV_MUTEX, no concurrent env access.
-            unsafe {
-                if let Some(ref value) = self.original {
-                    std::env::set_var(self.key, value);
-                } else {
-                    std::env::remove_var(self.key);
-                }
-            }
-        }
-    }
-
-    fn set_env_var(key: &'static str, value: Option<&str>) -> EnvVarGuard {
-        let original = std::env::var(key).ok();
-        // SAFETY: Under ENV_MUTEX, no concurrent env access.
-        unsafe {
-            if let Some(value) = value {
-                std::env::set_var(key, value);
-            } else {
-                std::env::remove_var(key);
-            }
-        }
-        EnvVarGuard { key, original }
-    }
-
-    #[test]
-    fn test_hosted_proxy_client_secret_suppresses_builtin_secret() {
-        let builtin = builtin_credentials("google_oauth_token").expect("google builtin creds");
-        let client_secret = Some(builtin.client_secret.to_string());
-
-        let result = super::hosted_proxy_client_secret(&client_secret, Some(&builtin), true);
-
-        assert_eq!(result, None);
-    }
-
-    #[test]
-    fn test_hosted_proxy_client_secret_preserves_explicit_secret() {
-        let builtin = builtin_credentials("google_oauth_token").expect("google builtin creds");
-        let client_secret = Some("hosted-server-secret".to_string());
-
-        let result = super::hosted_proxy_client_secret(&client_secret, Some(&builtin), true);
-
-        assert_eq!(result, client_secret);
-    }
-
-    #[tokio::test]
-    async fn test_exchange_via_proxy_sends_auth_and_form() {
-        let server = MockProxyServer::start().await;
-        let mut extra_token_params = HashMap::new();
-        extra_token_params.insert("resource".to_string(), "https://mcp.notion.com".to_string());
-
-        let response = super::exchange_via_proxy(super::ProxyTokenExchangeRequest {
-            proxy_url: &server.base_url(),
-            gateway_token: "shared-oauth-proxy-secret",
-            code: "auth-code-123",
-            redirect_uri: "https://oauth.example.com/oauth/callback",
-            token_url: "https://oauth2.googleapis.com/token",
-            client_id: TEST_OAUTH_CLIENT_ID,
-            client_secret: Some(TEST_OAUTH_CLIENT_SECRET),
-            access_token_field: "access_token",
-            code_verifier: Some("code-verifier-123"),
-            extra_token_params: &extra_token_params,
-        })
-        .await
-        .expect("proxy exchange succeeds");
-
-        assert_eq!(response.access_token, "proxy-access-token");
-        assert_eq!(
-            response.refresh_token.as_deref(),
-            Some("proxy-refresh-token")
-        );
-        assert_eq!(response.expires_in, Some(7200));
-
-        let requests = server.requests().await;
-        assert_eq!(requests.len(), 1);
-        assert_eq!(
-            requests[0].authorization.as_deref(),
-            Some("Bearer shared-oauth-proxy-secret")
-        );
-        assert_eq!(
-            requests[0].form.get("code").map(String::as_str),
-            Some("auth-code-123")
-        );
-        assert_eq!(
-            requests[0].form.get("redirect_uri").map(String::as_str),
-            Some("https://oauth.example.com/oauth/callback")
-        );
-        assert_eq!(
-            requests[0].form.get("token_url").map(String::as_str),
-            Some("https://oauth2.googleapis.com/token")
-        );
-        assert_eq!(
-            requests[0].form.get("client_id").map(String::as_str),
-            Some(TEST_OAUTH_CLIENT_ID)
-        );
-        assert_eq!(
-            requests[0].form.get("client_secret").map(String::as_str),
-            Some(TEST_OAUTH_CLIENT_SECRET)
-        );
-        assert_eq!(
-            requests[0]
-                .form
-                .get("access_token_field")
-                .map(String::as_str),
-            Some("access_token")
-        );
-        assert_eq!(
-            requests[0].form.get("code_verifier").map(String::as_str),
-            Some("code-verifier-123")
-        );
-        assert_eq!(
-            requests[0].form.get("resource").map(String::as_str),
-            Some("https://mcp.notion.com")
-        );
-
-        server.shutdown().await;
-    }
-
-    #[tokio::test]
-    async fn test_refresh_token_via_proxy_sends_auth_and_form() {
-        let server = MockProxyServer::start().await;
-
-        let response = super::refresh_token_via_proxy(super::ProxyRefreshTokenRequest {
-            proxy_url: &server.base_url(),
-            gateway_token: "gateway-test-token",
-            token_url: "https://oauth2.googleapis.com/token",
-            client_id: TEST_OAUTH_CLIENT_ID,
-            client_secret: Some(TEST_OAUTH_CLIENT_SECRET),
-            refresh_token: "refresh-token-123",
-            provider: Some("google"),
-        })
-        .await
-        .expect("proxy refresh succeeds");
-
-        assert_eq!(response.access_token, "proxy-access-token");
-        assert_eq!(
-            response.refresh_token.as_deref(),
-            Some("proxy-refresh-token")
-        );
-        assert_eq!(response.expires_in, Some(7200));
-
-        let requests = server.requests().await;
-        assert_eq!(requests.len(), 1);
-        assert_eq!(
-            requests[0].authorization.as_deref(),
-            Some("Bearer gateway-test-token")
-        );
-        assert_eq!(
-            requests[0].form.get("token_url").map(String::as_str),
-            Some("https://oauth2.googleapis.com/token")
-        );
-        assert_eq!(
-            requests[0].form.get("client_id").map(String::as_str),
-            Some(TEST_OAUTH_CLIENT_ID)
-        );
-        assert_eq!(
-            requests[0].form.get("client_secret").map(String::as_str),
-            Some(TEST_OAUTH_CLIENT_SECRET)
-        );
-        assert_eq!(
-            requests[0].form.get("refresh_token").map(String::as_str),
-            Some("refresh-token-123")
-        );
-        assert_eq!(
-            requests[0].form.get("provider").map(String::as_str),
-            Some("google")
-        );
-
-        server.shutdown().await;
-    }
-
-    #[tokio::test]
-    async fn test_exchange_via_proxy_does_not_follow_redirects() {
-        let server = MockProxyServer::start().await;
-
-        let error = match super::exchange_via_proxy(super::ProxyTokenExchangeRequest {
-            proxy_url: &server.redirecting_base_url(),
-            gateway_token: "gateway-test-token",
-            code: "auth-code-123",
-            redirect_uri: "http://localhost:3000/oauth/callback",
-            token_url: "https://oauth2.googleapis.com/token",
-            client_id: TEST_OAUTH_CLIENT_ID,
-            client_secret: Some(TEST_OAUTH_CLIENT_SECRET),
-            access_token_field: "access_token",
-            code_verifier: Some("code-verifier-123"),
-            extra_token_params: &HashMap::new(),
-        })
-        .await
-        {
-            Ok(_) => panic!("redirected proxy exchange should fail"),
-            Err(error) => error,
-        };
-
-        assert!(error.to_string().contains("307"));
-        assert!(server.requests().await.is_empty());
-
-        server.shutdown().await;
-    }
-
-    #[tokio::test]
-    async fn test_refresh_token_via_proxy_does_not_follow_redirects() {
-        let server = MockProxyServer::start().await;
-
-        let error = match super::refresh_token_via_proxy(super::ProxyRefreshTokenRequest {
-            proxy_url: &server.redirecting_base_url(),
-            gateway_token: "gateway-test-token",
-            token_url: "https://oauth2.googleapis.com/token",
-            client_id: TEST_OAUTH_CLIENT_ID,
-            client_secret: Some(TEST_OAUTH_CLIENT_SECRET),
-            refresh_token: "refresh-token-123",
-            provider: Some("google"),
-        })
-        .await
-        {
-            Ok(_) => panic!("redirected proxy refresh should fail"),
-            Err(error) => error,
-        };
-
-        assert!(error.to_string().contains("307"));
-        assert!(server.requests().await.is_empty());
-
-        server.shutdown().await;
-    }

    #[test]
    fn test_is_loopback_host() {
@@ -1666,54 +1159,6 @@ mod tests {
        }
    }

-    #[test]
-    fn test_oauth_proxy_auth_token_prefers_dedicated_env() {
-        let _guard = lock_env();
-        let _proxy_guard = set_env_var(
-            "IRONCLAW_OAUTH_PROXY_AUTH_TOKEN",
-            Some("shared-proxy-secret"),
-        );
-        let _gateway_guard = set_env_var("GATEWAY_AUTH_TOKEN", Some("gateway-token"));
-
-        assert_eq!(
-            crate::cli::oauth_defaults::oauth_proxy_auth_token().as_deref(),
-            Some("shared-proxy-secret")
-        );
-    }
-
-    #[test]
-    fn test_oauth_proxy_auth_token_falls_back_to_gateway_token() {
-        let _guard = lock_env();
-        let _proxy_guard = set_env_var("IRONCLAW_OAUTH_PROXY_AUTH_TOKEN", None);
-        let _gateway_guard = set_env_var("GATEWAY_AUTH_TOKEN", Some("gateway-token"));
-
-        assert_eq!(
-            crate::cli::oauth_defaults::oauth_proxy_auth_token().as_deref(),
-            Some("gateway-token")
-        );
-    }
-
-    #[test]
-    fn test_oauth_proxy_auth_token_whitespace_dedicated_env_falls_back_to_gateway_token() {
-        let _guard = lock_env();
-        let _proxy_guard = set_env_var("IRONCLAW_OAUTH_PROXY_AUTH_TOKEN", Some("   "));
-        let _gateway_guard = set_env_var("GATEWAY_AUTH_TOKEN", Some("gateway-token"));
-
-        assert_eq!(
-            crate::cli::oauth_defaults::oauth_proxy_auth_token().as_deref(),
-            Some("gateway-token")
-        );
-    }
-
-    #[test]
-    fn test_oauth_proxy_auth_token_returns_none_when_unset() {
-        let _guard = lock_env();
-        let _proxy_guard = set_env_var("IRONCLAW_OAUTH_PROXY_AUTH_TOKEN", None);
-        let _gateway_guard = set_env_var("GATEWAY_AUTH_TOKEN", None);
-
-        assert_eq!(crate::cli::oauth_defaults::oauth_proxy_auth_token(), None);
-    }
-
    #[test]
    fn test_strip_instance_prefix_with_colon() {
        use crate::cli::oauth_defaults::strip_instance_prefix;
@@ -10,7 +10,7 @@ use clap::Subcommand;
 use uuid::Uuid;

 use crate::agent::routine::{
-    NotifyConfig, Routine, RoutineAction, RoutineGuardrails, RunStatus, Trigger, next_cron_fire,
+    NotifyConfig, Routine, RoutineAction, RoutineGuardrails, Trigger, next_cron_fire,
 };
 use crate::db::Database;

@@ -251,26 +251,15 @@ async fn list(
    );
    println!("{}", "-".repeat(130));

-    // Fetch last-run status for all routines in a single batch query
-    let routine_ids: Vec<Uuid> = filtered.iter().map(|r| r.id).collect();
-    let last_run_results = db
-        .batch_get_last_run_status(&routine_ids)
-        .await
-        .unwrap_or_default();
-
    for r in &filtered {
-        let last_run_status = last_run_results.get(&r.id).copied();
-
-        let status = if !r.enabled {
-            "disabled".to_string()
-        } else if last_run_status == Some(RunStatus::Running) {
-            "running".to_string()
-        } else if r.consecutive_failures > 0 {
-            format!("err({})", r.consecutive_failures)
-        } else if last_run_status == Some(RunStatus::Attention) {
-            "attention".to_string()
+        let status = if r.enabled {
+            if r.consecutive_failures > 0 {
+                format!("err({})", r.consecutive_failures)
+            } else {
+                "active".to_string()
+            }
        } else {
-            "active".to_string()
+            "disabled".to_string()
        };

        let next_fire = r
@@ -351,8 +340,8 @@ async fn create(
            prompt: prompt.to_string(),
            context_paths: Vec::new(),
            max_tokens: 4096,
-            use_tools: true,
-            max_tool_rounds: 3,
+            use_tools: false,
+            max_tool_rounds: 0,
        },
        guardrails: RoutineGuardrails {
            cooldown: std::time::Duration::from_secs(cooldown_secs),
@@ -696,7 +685,6 @@ fn truncate(s: &str, max_chars: usize) -> String {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use crate::agent::routine::RoutineAction;

    #[test]
    fn format_relative_future() {
@@ -755,48 +743,4 @@ mod tests {
        assert!(notify.on_failure); // safety: test-only assertion
        assert!(!notify.on_success); // safety: test-only assertion
    }
-
-    #[cfg(feature = "libsql")]
-    #[tokio::test]
-    async fn cli_create_defaults_lightweight_routines_to_tools_enabled() {
-        let harness = crate::testing::TestHarnessBuilder::new().build().await;
-        let db = harness.db.clone();
-
-        run_routines_command(
-            RoutinesCommand::Create {
-                name: "cli-digest".to_string(),
-                schedule: "0 0 9 * * *".to_string(),
-                prompt: "Prepare the morning digest.".to_string(),
-                description: "CLI created routine".to_string(),
-                timezone: Some("UTC".to_string()),
-                cooldown: 300,
-                notify_channel: None,
-            },
-            db.clone(),
-            "user1",
-        )
-        .await
-        .expect("create routine");
-
-        let routine = db
-            .get_routine_by_name("user1", "cli-digest")
-            .await
-            .expect("get routine by name")
-            .expect("cli-digest should exist");
-
-        match routine.action {
-            RoutineAction::Lightweight {
-                use_tools,
-                max_tool_rounds,
-                ..
-            } => {
-                assert!(
-                    use_tools,
-                    "CLI-created lightweight routines should default to tools"
-                );
-                assert_eq!(max_tool_rounds, 3);
-            }
-            other => panic!("expected lightweight action, got {other:?}"),
-        }
-    }
 }
@@ -20,7 +20,6 @@ Commands:
  service     Manage OS service
  skills      Manage skills
  hooks       Manage lifecycle hooks
-  models      Manage LLM providers and models
  doctor      Run diagnostics
  logs        View and manage gateway logs
  status      Show system status
@@ -20,7 +20,6 @@ Commands:
  service     Manage OS service
  skills      Manage skills
  hooks       Manage lifecycle hooks
-  models      Manage LLM providers and models
  doctor      Run diagnostics
  logs        View and manage gateway logs
  status      Show system status
@@ -23,7 +23,6 @@ Commands:
  service     Manage OS service
  skills      Manage skills
  hooks       Manage lifecycle hooks
-  models      Manage LLM providers and models
  doctor      Run diagnostics
  logs        View and manage gateway logs
  status      Show system status
@@ -23,7 +23,6 @@ Commands:
  service     Manage OS service
  skills      Manage skills
  hooks       Manage lifecycle hooks
-  models      Manage LLM providers and models
  doctor      Run diagnostics
  logs        View and manage gateway logs
  status      Show system status
@@ -2,7 +2,6 @@
 //!
 //! Commands for installing, listing, removing, and authenticating WASM tools.

-use std::collections::{HashMap, HashSet};
 use std::io::Write;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -80,10 +79,6 @@ pub enum ToolCommand {
        /// Directory to look for tool (default: ~/.ironclaw/tools/)
        #[arg(short, long)]
        dir: Option<PathBuf>,
-
-        /// User ID for checking credential status (default: "default")
-        #[arg(short, long, default_value = "default")]
-        user: String,
    },

    /// Configure authentication for a tool
@@ -129,11 +124,7 @@ pub async fn run_tool_command(cmd: ToolCommand) -> anyhow::Result<()> {
        } => install_tool(path, name, capabilities, target, release, skip_build, force).await,
        ToolCommand::List { dir, verbose } => list_tools(dir, verbose).await,
        ToolCommand::Remove { name, dir } => remove_tool(name, dir).await,
-        ToolCommand::Info {
-            name_or_path,
-            dir,
-            user,
-        } => show_tool_info(name_or_path, dir, user).await,
+        ToolCommand::Info { name_or_path, dir } => show_tool_info(name_or_path, dir).await,
        ToolCommand::Auth { name, dir, user } => auth_tool(name, dir, user).await,
        ToolCommand::Setup { name, dir, user } => setup_tool(name, dir, user).await,
    }
@@ -397,11 +388,7 @@ async fn remove_tool(name: String, dir: Option<PathBuf>) -> anyhow::Result<()> {
 }

 /// Show information about a tool.
-async fn show_tool_info(
-    name_or_path: String,
-    dir: Option<PathBuf>,
-    user_id: String,
-) -> anyhow::Result<()> {
+async fn show_tool_info(name_or_path: String, dir: Option<PathBuf>) -> anyhow::Result<()> {
    let wasm_path = if name_or_path.ends_with(".wasm") {
        PathBuf::from(&name_or_path)
    } else {
@@ -436,37 +423,7 @@ async fn show_tool_info(
        println!("\nCapabilities ({}):", caps_path.display());
        let content = fs::read_to_string(&caps_path).await?;
        match CapabilitiesFile::from_json(&content) {
-            Ok(caps) => {
-                // Lazily init secrets store only when auth secrets need checking.
-                let has_auth = caps.auth.is_some()
-                    || caps
-                        .setup
-                        .as_ref()
-                        .is_some_and(|s| !s.required_secrets.is_empty())
-                    || caps
-                        .http
-                        .as_ref()
-                        .is_some_and(|h| !h.credentials.is_empty());
-                let secrets_store = if has_auth {
-                    match init_secrets_store().await {
-                        Ok(store) => Some(store),
-                        Err(e) => {
-                            eprintln!("  Warning: could not init secrets store: {}", e);
-                            None
-                        }
-                    }
-                } else {
-                    None
-                };
-                print_capabilities_detail(
-                    &caps,
-                    secrets_store
-                        .as_ref()
-                        .map(|s| s.as_ref() as &(dyn SecretsStore + Send + Sync)),
-                    &user_id,
-                )
-                .await;
-            }
+            Ok(caps) => print_capabilities_detail(&caps),
            Err(e) => println!("  Error parsing: {}", e),
        }
    } else {
@@ -519,89 +476,8 @@ fn print_capabilities_summary(caps: &CapabilitiesFile) {
    }
 }

-/// Per-secret info collected from all auth-related capability sections.
-struct AuthSecretInfo {
-    secret_name: String,
-    /// Human-readable label (from auth.display_name or setup prompt).
-    description: Option<String>,
-    /// Injection location (from http.credentials).
-    location: Option<String>,
-}
-
-/// Collected auth secrets and the set of secret names they cover.
-struct CollectedAuthSecrets {
-    secrets: Vec<AuthSecretInfo>,
-    /// Secret names present in `secrets`, for filtering the Secrets capability section.
-    seen_names: HashSet<String>,
-}
-
-/// Collect and deduplicate auth secrets from all auth-related capability sections.
-///
-/// Priority for the description label: auth.display_name > setup.required_secrets.prompt.
-/// Injection location is merged from http.credentials.
-fn collect_auth_secrets(caps: &CapabilitiesFile) -> CollectedAuthSecrets {
-    let mut secrets: Vec<AuthSecretInfo> = Vec::new();
-    let mut seen: HashMap<String, usize> = HashMap::new();
-
-    // auth.display_name is the best label — seed first.
-    if let Some(ref auth) = caps.auth {
-        let index = secrets.len();
-        seen.insert(auth.secret_name.clone(), index);
-        secrets.push(AuthSecretInfo {
-            secret_name: auth.secret_name.clone(),
-            description: auth.display_name.clone(),
-            location: None,
-        });
-    }
-
-    // setup.required_secrets.prompt is second-best label.
-    if let Some(ref setup) = caps.setup {
-        for secret in &setup.required_secrets {
-            if !seen.contains_key(&secret.name) {
-                let index = secrets.len();
-                seen.insert(secret.name.clone(), index);
-                secrets.push(AuthSecretInfo {
-                    secret_name: secret.name.clone(),
-                    description: Some(secret.prompt.clone()),
-                    location: None,
-                });
-            }
-        }
-    }
-
-    // Merge injection location from http.credentials.
-    if let Some(ref http) = caps.http {
-        for cred in http.credentials.values() {
-            let loc = format!("{:?}", cred.location);
-            if let Some(&index) = seen.get(&cred.secret_name) {
-                secrets[index].location = Some(loc);
-            } else {
-                let index = secrets.len();
-                seen.insert(cred.secret_name.clone(), index);
-                secrets.push(AuthSecretInfo {
-                    secret_name: cred.secret_name.clone(),
-                    description: None,
-                    location: Some(loc),
-                });
-            }
-        }
-    }
-
-    let seen_names = seen.into_keys().collect();
-    CollectedAuthSecrets {
-        secrets,
-        seen_names,
-    }
-}
-
 /// Print detailed capabilities.
-async fn print_capabilities_detail(
-    caps: &CapabilitiesFile,
-    secrets_store: Option<&(dyn SecretsStore + Send + Sync)>,
-    user_id: &str,
-) {
-    let mut collected = collect_auth_secrets(caps);
-
+fn print_capabilities_detail(caps: &CapabilitiesFile) {
    if let Some(ref http) = caps.http {
        println!("  HTTP:");
        for endpoint in &http.allowlist {
@@ -614,6 +490,13 @@ async fn print_capabilities_detail(
            println!("    {} {} {}", methods, endpoint.host, path);
        }

+        if !http.credentials.is_empty() {
+            println!("  Credentials:");
+            for (key, cred) in &http.credentials {
+                println!("    {}: {} -> {:?}", key, cred.secret_name, cred.location);
+            }
+        }
+
        if let Some(ref rate) = http.rate_limit {
            println!(
                "  Rate limit: {}/min, {}/hour",
@@ -622,24 +505,12 @@ async fn print_capabilities_detail(
        }
    }

-    // Filter secrets already covered by the auth section (always rendered when non-empty).
    if let Some(ref secrets) = caps.secrets
        && !secrets.allowed_names.is_empty()
    {
-        let extra: Vec<_> = if collected.secrets.is_empty() {
-            secrets.allowed_names.iter().collect()
-        } else {
-            secrets
-                .allowed_names
-                .iter()
-                .filter(|name| !collected.seen_names.contains(name.as_str()))
-                .collect()
-        };
-        if !extra.is_empty() {
-            println!("  Secrets (existence check only):");
-            for name in extra {
-                println!("    {}", name);
-            }
+        println!("  Secrets (existence check only):");
+        for name in &secrets.allowed_names {
+            println!("    {}", name);
        }
    }

@@ -660,38 +531,6 @@ async fn print_capabilities_detail(
            println!("    {}", prefix);
        }
    }
-
-    // Consolidated auth status — sorted by secret name for deterministic output.
-    if !collected.secrets.is_empty() {
-        collected
-            .secrets
-            .sort_by(|a, b| a.secret_name.cmp(&b.secret_name));
-        println!("  Auth:");
-        for info in &collected.secrets {
-            let (icon, label) = match secrets_store {
-                Some(store) => match store.exists(user_id, &info.secret_name).await {
-                    Ok(true) => ("\u{2713}", "configured"),
-                    Ok(false) => ("\u{2717}", "missing"),
-                    Err(e) => {
-                        eprintln!(
-                            "  Warning: failed to check secret `{}`: {}",
-                            info.secret_name, e
-                        );
-                        ("?", "unknown")
-                    }
-                },
-                None => ("?", "unknown"),
-            };
-            let mut parts = info.secret_name.clone();
-            if let Some(ref desc) = info.description {
-                parts = format!("{} ({})", parts, desc);
-            }
-            if let Some(ref loc) = info.location {
-                parts = format!("{} -> {}", parts, loc);
-            }
-            println!("    {}  {} {}", parts, icon, label);
-        }
-    }
 }

 /// Validate a tool name to prevent path traversal.
@@ -838,7 +677,8 @@ async fn combine_provider_scopes(
    secret_name: &str,
    base_oauth: &crate::tools::wasm::OAuthConfigSchema,
 ) -> crate::tools::wasm::OAuthConfigSchema {
-    let mut all_scopes: HashSet<String> = base_oauth.scopes.iter().cloned().collect();
+    let mut all_scopes: std::collections::HashSet<String> =
+        base_oauth.scopes.iter().cloned().collect();

    if let Ok(mut entries) = tokio::fs::read_dir(tools_dir).await {
        while let Ok(Some(entry)) = entries.next_entry().await {
@@ -1287,8 +1127,6 @@ async fn setup_tool(name: String, dir: Option<PathBuf>, user_id: String) -> anyh
 #[cfg(test)]
 mod tests {
    use super::*;
-    use crate::secrets::{CreateSecretParams, SecretsStore};
-    use crate::testing::credentials::test_secrets_store;

    #[test]
    fn test_format_size() {
@@ -1305,96 +1143,4 @@ mod tests {
        assert!(dir.to_string_lossy().contains(".ironclaw"));
        assert!(dir.to_string_lossy().contains("tools"));
    }
-
-    /// Verify that auth secrets are deduplicated across auth, setup, and http.credentials,
-    /// and that credential status is checked against the secrets store.
-    #[tokio::test]
-    async fn test_auth_secret_dedup_and_status() {
-        let caps = CapabilitiesFile::from_json(
-            r#"{
-                "auth": {
-                    "secret_name": "gh_token",
-                    "display_name": "GitHub"
-                },
-                "setup": {
-                    "required_secrets": [
-                        { "name": "gh_token", "prompt": "GitHub PAT" },
-                        { "name": "extra_key", "prompt": "Extra API Key" }
-                    ]
-                },
-                "http": {
-                    "allowlist": [{ "host": "api.github.com" }],
-                    "credentials": {
-                        "github": {
-                            "secret_name": "gh_token",
-                            "location": { "type": "bearer" },
-                            "host_patterns": ["api.github.com"]
-                        }
-                    }
-                },
-                "secrets": {
-                    "allowed_names": ["gh_token", "gh_*"]
-                }
-            }"#,
-        )
-        .unwrap();
-
-        let collected = collect_auth_secrets(&caps);
-
-        // gh_token should appear once (from auth), with location merged from credentials.
-        // extra_key should appear once (from setup).
-        assert_eq!(collected.secrets.len(), 2);
-        let gh = collected
-            .secrets
-            .iter()
-            .find(|s| s.secret_name == "gh_token")
-            .unwrap();
-        assert_eq!(gh.description.as_deref(), Some("GitHub"));
-        assert!(
-            gh.location.is_some(),
-            "location should be merged from http.credentials"
-        );
-
-        let extra = collected
-            .secrets
-            .iter()
-            .find(|s| s.secret_name == "extra_key")
-            .unwrap();
-        assert_eq!(extra.description.as_deref(), Some("Extra API Key"));
-        assert!(extra.location.is_none());
-
-        // Secrets section should filter gh_token (in seen_names) but keep gh_* (wildcard).
-        let secrets = caps.secrets.as_ref().unwrap();
-        let extra_secrets: Vec<_> = secrets
-            .allowed_names
-            .iter()
-            .filter(|name| !collected.seen_names.contains(name.as_str()))
-            .collect();
-        assert_eq!(extra_secrets, vec!["gh_*"]);
-
-        // Verify store check: missing secret -> exists returns false.
-        let store = test_secrets_store();
-        assert!(!store.exists("default", "gh_token").await.unwrap());
-
-        // Store gh_token and verify it's found.
-        store
-            .create(
-                "default",
-                CreateSecretParams::new("gh_token", "ghp_test123"),
-            )
-            .await
-            .unwrap();
-        assert!(store.exists("default", "gh_token").await.unwrap());
-        // extra_key still missing.
-        assert!(!store.exists("default", "extra_key").await.unwrap());
-    }
-
-    /// No auth sections → collect_auth_secrets returns empty.
-    #[test]
-    fn test_collect_auth_secrets_empty_caps() {
-        let caps = CapabilitiesFile::default();
-        let collected = collect_auth_secrets(&caps);
-        assert!(collected.secrets.is_empty());
-        assert!(collected.seen_names.is_empty());
-    }
 }
@@ -1,6 +1,6 @@
 use std::time::Duration;

-use crate::config::helpers::{optional_env, parse_bool_env, parse_option_env, parse_optional_env};
+use crate::config::helpers::{parse_bool_env, parse_option_env, parse_optional_env};
 use crate::error::ConfigError;
 use crate::settings::Settings;

@@ -23,8 +23,6 @@ pub struct AgentConfig {
    pub max_cost_per_day_cents: Option<u64>,
    /// Maximum LLM/tool actions per hour. None = unlimited.
    pub max_actions_per_hour: Option<u64>,
-    /// Maximum daily LLM spend per user in cents. None = unlimited.
-    pub max_cost_per_user_per_day_cents: Option<u64>,
    /// Maximum tool-call iterations per agentic loop invocation. Default 50.
    pub max_tool_iterations: usize,
    /// When true, skip tool approval checks entirely. For benchmarks/CI.
@@ -33,13 +31,6 @@ pub struct AgentConfig {
    pub default_timezone: String,
    /// Maximum tokens per job (0 = unlimited).
    pub max_tokens_per_job: u64,
-    /// Whether the deployment is multi-tenant (multiple users sharing one
-    /// instance). Auto-detected from GATEWAY_USER_TOKENS presence.
-    pub multi_tenant: bool,
-    /// Maximum concurrent LLM calls per user. None = use default (4).
-    pub max_llm_concurrent_per_user: Option<usize>,
-    /// Maximum concurrent jobs per user. None = use default (3).
-    pub max_jobs_concurrent_per_user: Option<usize>,
 }

 impl AgentConfig {
@@ -58,14 +49,10 @@ impl AgentConfig {
            allow_local_tools: true,
            max_cost_per_day_cents: None,
            max_actions_per_hour: None,
-            max_cost_per_user_per_day_cents: None,
            max_tool_iterations: 10,
            auto_approve_tools: true,
            default_timezone: "UTC".to_string(),
            max_tokens_per_job: 0,
-            multi_tenant: false,
-            max_llm_concurrent_per_user: None,
-            max_jobs_concurrent_per_user: None,
        }
    }

@@ -100,7 +87,6 @@ impl AgentConfig {
            allow_local_tools: parse_bool_env("ALLOW_LOCAL_TOOLS", false)?,
            max_cost_per_day_cents: parse_option_env("MAX_COST_PER_DAY_CENTS")?,
            max_actions_per_hour: parse_option_env("MAX_ACTIONS_PER_HOUR")?,
-            max_cost_per_user_per_day_cents: parse_option_env("MAX_COST_PER_USER_PER_DAY_CENTS")?,
            max_tool_iterations: parse_optional_env(
                "AGENT_MAX_TOOL_ITERATIONS",
                settings.agent.max_tool_iterations,
@@ -126,11 +112,6 @@ impl AgentConfig {
                "AGENT_MAX_TOKENS_PER_JOB",
                settings.agent.max_tokens_per_job,
            )?,
-            // Auto-detected from GATEWAY_USER_TOKENS presence. Not a separate
-            // knob — multi-tenant mode is always implied by configuring user tokens.
-            multi_tenant: optional_env("GATEWAY_USER_TOKENS")?.is_some(),
-            max_llm_concurrent_per_user: parse_option_env("TENANT_MAX_LLM_CONCURRENT")?,
-            max_jobs_concurrent_per_user: parse_option_env("TENANT_MAX_JOBS_CONCURRENT")?,
        })
    }
 }
@@ -2,7 +2,6 @@ use std::collections::HashMap;
 use std::path::PathBuf;

 use secrecy::SecretString;
-use serde::Deserialize;

 use crate::bootstrap::ironclaw_base_dir;
 use crate::config::helpers::{optional_env, parse_bool_env, parse_optional_env};
@@ -46,26 +45,6 @@ pub struct GatewayConfig {
    /// Bearer token for authentication. Random hex generated at startup if unset.
    pub auth_token: Option<String>,
    pub user_id: String,
-    /// Additional user scopes for workspace reads.
-    ///
-    /// When set, the workspace will be able to read (search, read, list) from
-    /// these additional user scopes while writes remain isolated to `user_id`.
-    /// Parsed from `WORKSPACE_READ_SCOPES` (comma-separated).
-    pub workspace_read_scopes: Vec<String>,
-    /// Memory layer definitions (JSON in env var, or from external config).
-    pub memory_layers: Vec<crate::workspace::layer::MemoryLayer>,
-    /// Multi-user token map. When set, each token maps to a user identity.
-    /// Parsed from `GATEWAY_USER_TOKENS` (JSON string). When absent, falls back
-    /// to single-user mode via `auth_token` + `user_id`.
-    pub user_tokens: Option<HashMap<String, UserTokenConfig>>,
-}
-
-/// Per-user token configuration for multi-user mode.
-#[derive(Debug, Clone, Deserialize)]
-pub struct UserTokenConfig {
-    pub user_id: String,
-    #[serde(default)]
-    pub workspace_read_scopes: Vec<String>,
 }

 /// Signal channel configuration (signal-cli daemon HTTP/JSON-RPC).
@@ -136,118 +115,6 @@ impl ChannelsConfig {
                .or_else(|| cs.gateway_user_id.clone())
                .unwrap_or_else(|| owner_id.to_string());

-            let memory_layers: Vec<crate::workspace::layer::MemoryLayer> =
-                match optional_env("MEMORY_LAYERS")? {
-                    Some(json_str) => {
-                        serde_json::from_str(&json_str).map_err(|e| ConfigError::InvalidValue {
-                            key: "MEMORY_LAYERS".to_string(),
-                            message: format!("must be valid JSON array of layer objects: {e}"),
-                        })?
-                    }
-                    None => crate::workspace::layer::MemoryLayer::default_for_user(&user_id),
-                };
-
-            // Validate layer names and scopes
-            for layer in &memory_layers {
-                if layer.name.trim().is_empty() {
-                    return Err(ConfigError::InvalidValue {
-                        key: "MEMORY_LAYERS".to_string(),
-                        message: "layer name must not be empty".to_string(),
-                    });
-                }
-                if layer.name.len() > 64 {
-                    return Err(ConfigError::InvalidValue {
-                        key: "MEMORY_LAYERS".to_string(),
-                        message: format!("layer name '{}' exceeds 64 characters", layer.name),
-                    });
-                }
-                if !layer
-                    .name
-                    .chars()
-                    .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
-                {
-                    return Err(ConfigError::InvalidValue {
-                        key: "MEMORY_LAYERS".to_string(),
-                        message: format!(
-                            "layer name '{}' contains invalid characters \
-                             (allowed: a-z, A-Z, 0-9, _, -)",
-                            layer.name
-                        ),
-                    });
-                }
-                if layer.scope.trim().is_empty() {
-                    return Err(ConfigError::InvalidValue {
-                        key: "MEMORY_LAYERS".to_string(),
-                        message: format!("layer '{}' has an empty scope", layer.name),
-                    });
-                }
-            }
-
-            // Check for duplicate layer names
-            {
-                let mut seen = std::collections::HashSet::new();
-                for layer in &memory_layers {
-                    if !seen.insert(&layer.name) {
-                        return Err(ConfigError::InvalidValue {
-                            key: "MEMORY_LAYERS".to_string(),
-                            message: format!("duplicate layer name '{}'", layer.name),
-                        });
-                    }
-                }
-            }
-
-            let user_tokens: Option<HashMap<String, UserTokenConfig>> =
-                match optional_env("GATEWAY_USER_TOKENS")? {
-                    Some(json_str) => {
-                        let tokens: HashMap<String, UserTokenConfig> = serde_json::from_str(
-                            &json_str,
-                        )
-                        .map_err(|e| ConfigError::InvalidValue {
-                            key: "GATEWAY_USER_TOKENS".to_string(),
-                            message: format!(
-                                "must be valid JSON object mapping tokens to user configs: {e}"
-                            ),
-                        })?;
-                        if tokens.is_empty() {
-                            return Err(ConfigError::InvalidValue {
-                            key: "GATEWAY_USER_TOKENS".to_string(),
-                            message:
-                                "token map is empty — remove the variable to use single-user mode"
-                                    .to_string(),
-                        });
-                        }
-                        for (tok, cfg) in &tokens {
-                            if cfg.user_id.trim().is_empty() {
-                                return Err(ConfigError::InvalidValue {
-                                    key: "GATEWAY_USER_TOKENS".to_string(),
-                                    message: format!(
-                                        "token '{}...' has an empty user_id",
-                                        &tok[..tok.len().min(8)]
-                                    ),
-                                });
-                            }
-                        }
-                        Some(tokens)
-                    }
-                    None => None,
-                };
-            let workspace_read_scopes: Vec<String> = optional_env("WORKSPACE_READ_SCOPES")?
-                .map(|s| {
-                    s.split(',')
-                        .map(|s| s.trim().to_string())
-                        .filter(|s| !s.is_empty())
-                        .collect()
-                })
-                .unwrap_or_default();
-
-            for scope in &workspace_read_scopes {
-                if scope.len() > 128 {
-                    return Err(ConfigError::InvalidValue {
-                        key: "WORKSPACE_READ_SCOPES".to_string(),
-                        message: format!("scope '{}...' exceeds 128 characters", &scope[..32]),
-                    });
-                }
-            }
            Some(GatewayConfig {
                host: optional_env("GATEWAY_HOST")?
                    .or_else(|| cs.gateway_host.clone())
@@ -259,9 +126,6 @@ impl ChannelsConfig {
                auth_token: optional_env("GATEWAY_AUTH_TOKEN")?
                    .or_else(|| cs.gateway_auth_token.clone()),
                user_id,
-                workspace_read_scopes,
-                memory_layers,
-                user_tokens,
            })
        } else {
            None
@@ -417,9 +281,6 @@ mod tests {
            port: 3000,
            auth_token: Some("tok-abc".to_string()),
            user_id: "default".to_string(),
-            workspace_read_scopes: vec![],
-            memory_layers: vec![],
-            user_tokens: None,
        };
        assert_eq!(cfg.host, "127.0.0.1");
        assert_eq!(cfg.port, 3000);
@@ -434,9 +295,6 @@ mod tests {
            port: 3001,
            auth_token: None,
            user_id: "anon".to_string(),
-            workspace_read_scopes: vec![],
-            memory_layers: vec![],
-            user_tokens: None,
        };
        assert!(cfg.auth_token.is_none());
    }
@@ -21,9 +21,6 @@ pub struct HeartbeatConfig {
    pub quiet_hours_end: Option<u32>,
    /// Timezone for fire_at and quiet hours evaluation (IANA name).
    pub timezone: Option<String>,
-    /// When true, cycle through all users with routines. Auto-detected from
-    /// GATEWAY_USER_TOKENS or set explicitly via HEARTBEAT_MULTI_TENANT.
-    pub multi_tenant: bool,
 }

 impl Default for HeartbeatConfig {
@@ -37,7 +34,6 @@ impl Default for HeartbeatConfig {
            quiet_hours_start: None,
            quiet_hours_end: None,
            timezone: None,
-            multi_tenant: false,
        }
    }
 }
@@ -105,12 +101,6 @@ impl HeartbeatConfig {
                }
                tz
            },
-            // Auto-detect multi-tenant mode from GATEWAY_USER_TOKENS presence,
-            // or allow explicit override via HEARTBEAT_MULTI_TENANT.
-            multi_tenant: parse_bool_env(
-                "HEARTBEAT_MULTI_TENANT",
-                optional_env("GATEWAY_USER_TOKENS")?.is_some(),
-            )?,
        })
    }
 }
@@ -406,7 +406,7 @@ impl LlmConfig {
        // Resolve extra headers
        let extra_headers = if let Some(env_var) = extra_headers_env {
            optional_env(env_var)?
-                .map(|val| parse_extra_headers_with_key(&val, env_var))
+                .map(|val| parse_extra_headers(&val))
                .transpose()?
                .unwrap_or_default()
        } else {
@@ -475,10 +475,7 @@ impl LlmConfig {
 ///
 /// Format: `Key1:Value1,Key2:Value2` (colon-separated, not `=`, because
 /// header values often contain `=`).
-fn parse_extra_headers_with_key(
-    val: &str,
-    env_var_name: &str,
-) -> Result<Vec<(String, String)>, ConfigError> {
+fn parse_extra_headers(val: &str) -> Result<Vec<(String, String)>, ConfigError> {
    if val.trim().is_empty() {
        return Ok(Vec::new());
    }
@@ -491,14 +488,14 @@ fn parse_extra_headers_with_key(
        }
        let Some((key, value)) = pair.split_once(':') else {
            return Err(ConfigError::InvalidValue {
-                key: env_var_name.to_string(),
+                key: "LLM_EXTRA_HEADERS".to_string(),
                message: format!("malformed header entry '{}', expected Key:Value", pair),
            });
        };
        let key = key.trim();
        if key.is_empty() {
            return Err(ConfigError::InvalidValue {
-                key: env_var_name.to_string(),
+                key: "LLM_EXTRA_HEADERS".to_string(),
                message: format!("empty header name in entry '{}'", pair),
            });
        }
@@ -539,11 +536,6 @@ mod tests {
    use crate::settings::Settings;
    use crate::testing::credentials::*;

-    /// Convenience wrapper for tests — uses "TEST_HEADERS" as the env var name.
-    fn parse_extra_headers(val: &str) -> Result<Vec<(String, String)>, ConfigError> {
-        parse_extra_headers_with_key(val, "TEST_HEADERS")
-    }
-
    /// Clear all openai-compatible-related env vars.
    fn clear_openai_compatible_env() {
        // SAFETY: Only called under ENV_MUTEX in tests.
@@ -312,11 +312,13 @@ impl Config {
        let tunnel = TunnelConfig::resolve(settings)?;
        let channels = ChannelsConfig::resolve(settings, &owner_id)?;

-        // Resolve the startup workspace against the durable owner scope. The
-        // gateway may expose a distinct sender identity, but the base runtime
-        // workspace stays owner-scoped and per-user gateway workspaces are
-        // handled separately by WorkspacePool.
-        let workspace = WorkspaceConfig::resolve(&owner_id)?;
+        // Resolve workspace config using the gateway user_id for default layers.
+        let workspace_user_id = channels
+            .gateway
+            .as_ref()
+            .map(|gw| gw.user_id.as_str())
+            .unwrap_or("default");
+        let workspace = WorkspaceConfig::resolve(workspace_user_id)?;

        Ok(Self {
            owner_id: owner_id.clone(),
@@ -192,9 +192,6 @@ pub struct JobContext {
    /// but subsequent tools (e.g., `json`) may need the full output. This
    /// stash stores the complete, unsanitized output so tools can reference
    /// previous results by ID via `$tool_call_id` parameter syntax.
-    ///
-    /// Also used for cross-tool implicit state (keys prefixed with `__`) such
-    /// as `__routine_last_name` for fallback recovery in routine tool chains.
    #[serde(skip)]
    pub tool_output_stash: Arc<tokio::sync::RwLock<HashMap<String, String>>>,
    /// User's preferred timezone (IANA name, e.g. "America/New_York"). Defaults to "UTC".
@@ -230,49 +230,6 @@ impl JobStore for LibSqlBackend {
        Ok(jobs)
    }

-    async fn list_agent_jobs_for_user(
-        &self,
-        user_id: &str,
-    ) -> Result<Vec<AgentJobRecord>, DatabaseError> {
-        let conn = self.connect().await?;
-        let mut rows = conn
-            .query(
-                r#"
-                SELECT id, title, status, user_id, failure_reason,
-                       created_at, started_at, completed_at
-                FROM agent_jobs WHERE source = 'direct' AND user_id = ?1
-                ORDER BY created_at DESC
-                "#,
-                params![user_id],
-            )
-            .await
-            .map_err(|e| DatabaseError::Query(e.to_string()))?;
-
-        let mut jobs = Vec::new();
-        while let Some(row) = rows
-            .next()
-            .await
-            .map_err(|e| DatabaseError::Query(e.to_string()))?
-        {
-            let id_str = get_text(&row, 0);
-            let Ok(id) = id_str.parse() else {
-                tracing::warn!("Skipping agent job with invalid UUID: {}", id_str);
-                continue;
-            };
-            jobs.push(AgentJobRecord {
-                id,
-                title: get_text(&row, 1),
-                status: get_text(&row, 2),
-                user_id: get_text(&row, 3),
-                failure_reason: get_opt_text(&row, 4),
-                created_at: get_ts(&row, 5),
-                started_at: get_opt_ts(&row, 6),
-                completed_at: get_opt_ts(&row, 7),
-            });
-        }
-        Ok(jobs)
-    }
-
    async fn get_agent_job_failure_reason(
        &self,
        id: Uuid,
@@ -320,32 +277,6 @@ impl JobStore for LibSqlBackend {
        Ok(summary)
    }

-    async fn agent_job_summary_for_user(
-        &self,
-        user_id: &str,
-    ) -> Result<AgentJobSummary, DatabaseError> {
-        let conn = self.connect().await?;
-        let mut rows = conn
-            .query(
-                "SELECT status, COUNT(*) as cnt FROM agent_jobs WHERE source = 'direct' AND user_id = ?1 GROUP BY status",
-                params![user_id],
-            )
-            .await
-            .map_err(|e| DatabaseError::Query(e.to_string()))?;
-
-        let mut summary = AgentJobSummary::default();
-        while let Some(row) = rows
-            .next()
-            .await
-            .map_err(|e| DatabaseError::Query(e.to_string()))?
-        {
-            let status = get_text(&row, 0);
-            let count = get_i64(&row, 1) as usize;
-            summary.add_count(&status, count);
-        }
-        Ok(summary)
-    }
-
    async fn save_action(&self, job_id: Uuid, action: &ActionRecord) -> Result<(), DatabaseError> {
        let conn = self.connect().await?;
        let duration_ms = action.duration.as_millis() as i64;
@@ -462,56 +462,6 @@ impl RoutineStore for LibSqlBackend {
        Ok(counts)
    }

-    async fn batch_get_last_run_status(
-        &self,
-        routine_ids: &[Uuid],
-    ) -> Result<HashMap<Uuid, RunStatus>, DatabaseError> {
-        if routine_ids.is_empty() {
-            return Ok(HashMap::new());
-        }
-
-        let conn = self.connect().await?;
-
-        // SQLite doesn't support ANY($1), so we query all latest runs and filter in memory.
-        // Uses a subquery to pick only the most recent run per routine.
-        let mut rows = conn
-            .query(
-                "SELECT routine_id, status FROM routine_runs r1
-                 WHERE started_at = (
-                     SELECT MAX(started_at) FROM routine_runs r2
-                     WHERE r2.routine_id = r1.routine_id
-                 )
-                 GROUP BY routine_id",
-                params![],
-            )
-            .await
-            .map_err(|e| {
-                DatabaseError::Query(format!("Failed to batch get last run status: {}", e))
-            })?;
-
-        let routine_id_set: HashSet<Uuid> = routine_ids.iter().copied().collect();
-        let mut statuses = HashMap::new();
-
-        while let Some(row) = rows
-            .next()
-            .await
-            .map_err(|e| DatabaseError::Query(e.to_string()))?
-        {
-            let id_str: String = get_text(&row, 0);
-            let id = Uuid::parse_str(&id_str)
-                .map_err(|e| DatabaseError::Query(format!("Invalid routine UUID: {}", e)))?;
-
-            if routine_id_set.contains(&id) {
-                let status_str: String = get_text(&row, 1);
-                if let std::result::Result::Ok(status) = status_str.parse::<RunStatus>() {
-                    statuses.insert(id, status);
-                }
-            }
-        }
-
-        Ok(statuses)
-    }
-
    async fn link_routine_run_to_job(
        &self,
        run_id: Uuid,
@@ -530,24 +480,10 @@ impl RoutineStore for LibSqlBackend {
    async fn get_webhook_routine_by_path(
        &self,
        path: &str,
-        user_id: Option<&str>,
    ) -> Result<Option<Routine>, DatabaseError> {
        let conn = self.connect().await?;
-        let mut rows = if let Some(uid) = user_id {
-            conn.query(
-                &format!(
-                    "SELECT {} FROM routines WHERE enabled = 1 AND trigger_type = 'webhook' \
-                     AND user_id = ?2 \
-                     AND (json_extract(trigger_config, '$.path') = ?1 \
-                     OR (json_extract(trigger_config, '$.path') IS NULL AND CAST(id AS TEXT) = ?1))",
-                    ROUTINE_COLUMNS
-                ),
-                params![path, uid],
-            )
-            .await
-            .map_err(|e| DatabaseError::Query(e.to_string()))?
-        } else {
-            conn.query(
+        let mut rows = conn
+            .query(
                &format!(
                    "SELECT {} FROM routines WHERE enabled = 1 AND trigger_type = 'webhook' \
                     AND (json_extract(trigger_config, '$.path') = ?1 \
@@ -557,8 +493,7 @@ impl RoutineStore for LibSqlBackend {
                params![path],
            )
            .await
-            .map_err(|e| DatabaseError::Query(e.to_string()))?
-        };
+            .map_err(|e| DatabaseError::Query(e.to_string()))?;

        match rows
            .next()
@@ -409,15 +409,7 @@ pub trait JobStore: Send + Sync {
    async fn mark_job_stuck(&self, id: Uuid) -> Result<(), DatabaseError>;
    async fn get_stuck_jobs(&self) -> Result<Vec<Uuid>, DatabaseError>;
    async fn list_agent_jobs(&self) -> Result<Vec<AgentJobRecord>, DatabaseError>;
-    async fn list_agent_jobs_for_user(
-        &self,
-        user_id: &str,
-    ) -> Result<Vec<AgentJobRecord>, DatabaseError>;
    async fn agent_job_summary(&self) -> Result<AgentJobSummary, DatabaseError>;
-    async fn agent_job_summary_for_user(
-        &self,
-        user_id: &str,
-    ) -> Result<AgentJobSummary, DatabaseError>;
    /// Get the failure reason for a single agent job (O(1) lookup).
    async fn get_agent_job_failure_reason(&self, id: Uuid)
    -> Result<Option<String>, DatabaseError>;
@@ -528,15 +520,6 @@ pub trait RoutineStore: Send + Sync {
        &self,
        routine_ids: &[Uuid],
    ) -> Result<HashMap<Uuid, i64>, DatabaseError>;
-
-    /// Fetch the last run status for multiple routines in a single query.
-    /// Returns a map from routine_id to its most recent RunStatus.
-    /// Routines with no runs are omitted from the result.
-    async fn batch_get_last_run_status(
-        &self,
-        routine_ids: &[Uuid],
-    ) -> Result<HashMap<Uuid, RunStatus>, DatabaseError>;
-
    async fn link_routine_run_to_job(
        &self,
        run_id: Uuid,
@@ -545,7 +528,6 @@ pub trait RoutineStore: Send + Sync {
    async fn get_webhook_routine_by_path(
        &self,
        path: &str,
-        user_id: Option<&str>,
    ) -> Result<Option<Routine>, DatabaseError>;

    /// List routine runs that were dispatched as full_job but have not yet
@@ -249,24 +249,10 @@ impl JobStore for PgBackend {
        self.store.list_agent_jobs().await
    }

-    async fn list_agent_jobs_for_user(
-        &self,
-        user_id: &str,
-    ) -> Result<Vec<AgentJobRecord>, DatabaseError> {
-        self.store.list_agent_jobs_for_user(user_id).await
-    }
-
    async fn agent_job_summary(&self) -> Result<AgentJobSummary, DatabaseError> {
        self.store.agent_job_summary().await
    }

-    async fn agent_job_summary_for_user(
-        &self,
-        user_id: &str,
-    ) -> Result<AgentJobSummary, DatabaseError> {
-        self.store.agent_job_summary_for_user(user_id).await
-    }
-
    async fn get_agent_job_failure_reason(
        &self,
        id: Uuid,
@@ -510,14 +496,6 @@ impl RoutineStore for PgBackend {
            .await
    }

-    async fn batch_get_last_run_status(
-        &self,
-        routine_ids: &[Uuid],
-    ) -> Result<std::collections::HashMap<Uuid, crate::agent::routine::RunStatus>, DatabaseError>
-    {
-        self.store.batch_get_last_run_status(routine_ids).await
-    }
-
    async fn link_routine_run_to_job(
        &self,
        run_id: Uuid,
@@ -529,9 +507,8 @@ impl RoutineStore for PgBackend {
    async fn get_webhook_routine_by_path(
        &self,
        path: &str,
-        user_id: Option<&str>,
    ) -> Result<Option<Routine>, DatabaseError> {
-        self.store.get_webhook_routine_by_path(path, user_id).await
+        self.store.get_webhook_routine_by_path(path).await
    }

    async fn list_dispatched_routine_runs(&self) -> Result<Vec<RoutineRun>, DatabaseError> {
--- a/Show More
+++ b/Show More