Add fixed Agent health checks with durable result retries

README.md

@@ -163,3 +163,5 @@ Organization member invitations (UAT slice): [API, CLI, recovery and verificatio
 Direct channel guests (next UAT candidate): [isolated guest grants, CLI and acceptance](docs/channel-guests.md). `channel-invite` manages invitations; `guest-channel` opens only accepted channels without joining their organization. This initial path uses the existing user's in-app inbox, with no email delivery claim.
 
 Agent interaction contract and CLI: [Channel Agents](docs/channel-agents.md).
+
+- [Fixed Agent health-check request and local execution contract](docs/agent-health-check.md) — T3 continuation, UAT qualification pending.

apps/cli/lib/agent.ts

@@ -4,7 +4,7 @@ import { ClientError } from "../../../packages/contracts/instance.ts";
 import { parseAgentCredential } from "../../../packages/contracts/agent.ts";
 import { checkDiscovery, request, responseJson } from "../../../packages/client/connection.ts";
 
-export function readAgentFile(path: string) {
+export function readPrivateJson(path: string): unknown {
   if (!isAbsolute(path) || typeof process.getuid !== "function") throw new ClientError("PRIVATE_CREDENTIAL_FILE_REQUIRED");
   for (let p = resolve(path);; p = dirname(p)) {
     if (lstatSync(p).isSymbolicLink()) throw new ClientError("SYMLINK_REFUSED");
@@ -14,9 +14,10 @@ export function readAgentFile(path: string) {
   try {
     const s = fstatSync(fd);
     if (!s.isFile() || s.uid !== process.getuid() || (s.mode & 0o077) || s.size > 20000) throw new ClientError("PRIVATE_CREDENTIAL_FILE_REQUIRED");
-    return parseAgentCredential(JSON.parse(readFileSync(fd, "utf8")));
+    return JSON.parse(readFileSync(fd, "utf8"));
   } finally { closeSync(fd); }
 }
+export const readAgentFile = (path: string) => parseAgentCredential(readPrivateJson(path));
 export async function agentCommand(args: string[], signal?: AbortSignal) {
   const command = args[1]; const options: Record<string, string> = {};
   if (!["history", "send"].includes(command)) throw new ClientError("USAGE");

apps/cli/lib/commands.ts

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { agentCommand } from "./agent.ts";
+import { parseWorkInput } from "../../../packages/contracts/work.ts";
 import { setTimeout as sleep } from "node:timers/promises";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -28,6 +29,7 @@ export async function execute(args: string[], rt: Runtime): Promise<unknown> {
     for (const path of ["/healthz", "/readyz"]) { const r = await request(new URL(path, url).href); if (!r.ok) throw new ClientError("HEALTH_CHECK_FAILED"); outputs.push(await responseJson(r)); }
     return { health: outputs[0], readiness: outputs[1] };
   }
+  if (args[0] === "agent-health") return (await import("../../../packages/reference/health.ts")).healthCommand(args);
   if (args[0] === "agent-channel") return agentCommand(args, rt.signal);
   const store = new Store(rt.directory ?? join(homedir(), ".config/tob/cli"));
   if (args[0] === "instance" && args[1] === "import" && (args.length === 3 || (args.length === 4 && args[3] === "--replace"))) {
@@ -52,13 +54,14 @@ export async function execute(args: string[], rt: Runtime): Promise<unknown> {
   const isGuest = args[0] === "guest-channel";
   const isGuestInvite = args[0] === "channel-invite";
   const isAgent = args[0] === "agent";
-  const scoped = isAgent || isOrg || isChannel || isInvitation || isGuest || isGuestInvite;
+  const isWork = args[0] === "work";
+  const scoped = isWork || isAgent || isOrg || isChannel || isInvitation || isGuest || isGuestInvite;
   const orgCommand = scoped ? args[1] : undefined;
   const options: Record<string, string> = {};
   if (scoped) {
-    if (!(isAgent ? ["list", "create", "revoke"] : isOrg ? ["list", "create", "use", "show", "update"] : (isInvitation || isGuestInvite) ? ["inbox", "list", "send", "accept", "revoke"] : isGuest ? ["list", "show", "history", "send"] : ["list", "create", "show", "history", "send"]).includes(orgCommand ?? "")) throw new ClientError("USAGE");
+    if (!(isWork ? ["request"] : isAgent ? ["list", "create", "revoke"] : isOrg ? ["list", "create", "use", "show", "update"] : (isInvitation || isGuestInvite) ? ["inbox", "list", "send", "accept", "revoke"] : isGuest ? ["list", "show", "history", "send"] : ["list", "create", "show", "history", "send"]).includes(orgCommand ?? "")) throw new ClientError("USAGE");
     for (let n = 2; n < args.length; n += 2) {
-      if (!["--server", "--id", "--name", "--operation", "--description", "--version", "--after", "--org", "--text-file", "--email", "--channel"].includes(args[n]) || args[n+1] === undefined || options[args[n]] !== undefined) throw new ClientError("USAGE");
+      if (!["--server", "--id", "--name", "--operation", "--description", "--version", "--after", "--org", "--text-file", "--email", "--channel", "--agent", "--expires-at"].includes(args[n]) || args[n+1] === undefined || options[args[n]] !== undefined) throw new ClientError("USAGE");
       options[args[n]] = args[n+1];
     }
   }
@@ -149,6 +152,14 @@ export async function execute(args: string[], rt: Runtime): Promise<unknown> {
         }
         return value;
       };
+      if (isWork) {
+        const orgId = options["--org"] ?? i.organizationId;
+        const channel = options["--channel"];
+        if (!orgId || orgId !== i.organizationId) throw new ClientError("ORGANIZATION_TOKEN_REQUIRED");
+        if (!channel || !/^ch_[a-f0-9]{64}$/.test(channel) || !/^[A-Za-z0-9_-]{16,100}$/.test(options["--operation"] ?? "")) throw new ClientError("USAGE");
+        const input = parseWorkInput({ targetActorId: options["--agent"], capability: "health-check", expiresAt: options["--expires-at"] });
+        return call("/"+orgId+"/channels/"+channel+"/work-requests", { method:"POST",headers:{"Content-Type":"application/json","Idempotency-Key":options["--operation"]},body:JSON.stringify(input) });
+      }
       if (isAgent) {
         const orgId = options["--org"] ?? i.organizationId;
         const channelId = options["--channel"];

apps/service/db/channel/migrations/0003_steep_brood.sql

@@ -0,0 +1,12 @@
+CREATE TABLE `channel_work` (
+	`request_id` text PRIMARY KEY NOT NULL,
+	`sequence` integer NOT NULL,
+	`requester_membership_id` text NOT NULL,
+	`requester_user_id` text NOT NULL,
+	`target_actor_id` text NOT NULL,
+	`expires_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `channel_work_sequence_unique` ON `channel_work` (`sequence`);--> statement-breakpoint
+ALTER TABLE `channel_message` ADD `kind` text DEFAULT 'text' NOT NULL;--> statement-breakpoint
+ALTER TABLE `channel_message` ADD `payload` text;