fix: prod triage 2026-07-08 — MCP auth residue, gateway envelopes, verb-loop cap, A2A interjection, manual spawn UX (#334)

* fix(auth): pass agent UUID to CLI-arg MCP servers (optimal/docs/search)

The container token is HMAC-signed over the agent UUID (#314), but the
optimal/docs/search MCP servers received the slug as their CLI arg and
sent X-Agent-ID=<slug>, so every research/RAG/docs call 401ed with
signature mismatch under enforced auth. Pass the already-computed
agent_uuid in the three args lists instead.

* fix(gateway): include remediate in gateway.rejected audit details

Conventions-gate rejections carry the offending file:line listing only
in the envelope's remediate field, which the audit row dropped -- ops
logs showed just the violation count with no way to see what blocked.

* fix(gateway): return envelope on do/commit git failure

A GitError from the commit verb propagated to the generic middleware
handler, so agents got a raw error blob with no remediate/next. Catch
it and return an error envelope; 'no changes added to commit' with an
explicit files list now names the mismatch and the omit-files fallback.

* fix(agent-sdk): absolute rejection cap breaks slow-drip verb loops

The verb circuit breaker only counted rejections inside a 60s sliding
window, so an agent retrying i_am_done every 3-4 minutes looped for 30+
minutes without tripping it. Add a session-scoped cumulative per-(verb,
task) cap at 3x the windowed limit that trips regardless of pacing.

* feat(a2a): CEO chime-in interjects into the viewed conversation

Previously reply_as_ceo re-homed the message into a canonical CEO<->target
conversation with no panel surface, so a chime-in reported success but was
invisible and only opportunistically delivered. interject_as_ceo now inserts
the message into the conversation being viewed (from_agent=ceo, directed via
an @target content prefix), bumps that conversation's counters with the
unread ping keyed to the addressed participant, and both participants see it
in transcript and read_a2a.

* feat(panel): manual spawn carries task + message, surfaces refusals

The agent detail page spawned with no request body (task/message impossible),
the spawn button could double-fire (2.5ms double-POST seen live), and refusal
reasons never reached the UI: readiness refusals were generic 500s and the
already-running no-op looked like success. Detail page now uses
SpawnAgentDialog, a synchronous ref guard blocks re-entry, AgentReadinessError
maps to 409 with its reason shown, already_running is signalled and toasted,
and a task_id builds a task-aware prompt instructing the claim (task_id alone
never did), with the CEO's message appended as a note.

* test(panel): align a2a page test with the interjection footer copy

The chime-in rebuild changed the composer footer; the page-level test
asserting the old copy was outside the rebuild's scoped vitest run.

* fix(api): commit the request DB session before the response is sent

FastAPI unwinds yield-dependencies after the response bytes go out, so
get_db's post-yield commit raced the client's next request -- a verb
could return ok while its claim/status write was still uncommitted (the
e2e ok-without-effect flake family), and a failed commit was silently
lost behind an already-sent 200. DbCommitMiddleware (innermost, pure
ASGI) commits the session stashed by get_db_committed before forwarding
http.response.start; commit failure now surfaces as a 5xx. get_db is
untouched for its direct non-request callers.

* fix(db): invalidate, not rollback, the session on request cancellation

With the commit moved into the send path, the flow-verb timeout can
cancel mid-commit; rolling back then issues another command over an
asyncpg connection stranded mid-wire-protocol, and the poisoned
connection segfaults uvloop/asyncpg when a later checkout recycles it
(3/3 identical CI faulthandler dumps). On CancelledError discard the
connection via session.invalidate() -- SQLAlchemy's documented handling
for a timeout during commit -- and keep rollback for plain exceptions.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

roboco/services/a2a.py

@@ -1838,6 +1838,66 @@ class A2AService:
         )
         return msg
 
+    async def interject_as_ceo(
+        self,
+        conversation_id: UUID,
+        to_agent: str,
+        content: str,
+        skill: str | None = None,
+    ) -> A2AChatMessage:
+        """CEO interjection: post a message directly into an existing
+        agent<->agent conversation, addressed to one of its participants.
+
+        One-directional and NOT a participant send: unlike
+        ``send_chat_message`` (which requires the sender to be a party to
+        the conversation), the CEO here is watching and interjecting into
+        someone else's thread, not conversing in its own — so the
+        participant check on the sender is deliberately bypassed rather
+        than weakened for every other caller. ``to_agent`` still must be
+        one of the conversation's two real participants.
+
+        Only ``to_agent``'s unread counter is bumped (a ping to whoever
+        it's addressed to); the other participant still sees the row via
+        the shared transcript / ``read_a2a``, just without a ping.
+
+        Direction is encoded as an ``@{to_agent}: `` content prefix —
+        ponytail: no ``to_agent`` column yet; add one (and stop parsing
+        the prefix) if the panel ever needs to render/filter by recipient
+        directly instead.
+        """
+        conv = await self.session.get(A2AConversationTable, conversation_id)
+        if conv is None:
+            raise ValueError(f"Conversation not found: {conversation_id}")
+        if to_agent not in (conv.agent_a, conv.agent_b):
+            raise ValueError(
+                f"{to_agent} is not a participant in this conversation "
+                f"(participants: {conv.agent_a}, {conv.agent_b})"
+            )
+
+        msg = A2AMessageTable(
+            conversation_id=conversation_id,
+            from_agent="ceo",
+            content=f"@{to_agent}: {content}",
+            message_kind=A2AMessageKind.MESSAGE,
+            skill=skill,
+        )
+        self.session.add(msg)
+
+        conv.message_count += 1
+        conv.last_message_at = datetime.now(UTC)
+        if to_agent == conv.agent_a:
+            conv.unread_by_a += 1
+        else:
+            conv.unread_by_b += 1
+
+        await self.session.flush()
+        await self.session.refresh(msg)
+
+        model = self._msg_to_model(msg)
+        task_id = str(conv.task_id) if conv.task_id else None
+        await self._publish_a2a_message_sent(model, task_id, "ceo", to_agent, skill)
+        return model
+
     @staticmethod
     async def _publish_a2a_message_sent(
         msg: A2AChatMessage,