[itsmihir]

What this changes

Moves Linear, GitHub and the HTTP API behind one Integration interface in the control plane, so a new task source plugs in with a registry entry instead of edits across core services.

• Outbound. Each integration implements deliver(ctx, target, message). Core labels harness events as a reply, progress or failure and routes them by the round's source; the integration decides where, or whether, each one shows up.
• Intake. Tasks and follow-ups are created only through TaskIntake (assign, restart, followUp). A re-delegation is compared with the stored one under the task's row lock, so concurrent webhooks restart a task at most once.
• Lifecycle hooks. onTaskStarted, onPrOpened, onRoundFinished and assignee run with timeouts; detached work is drained on shutdown.
• Registry. app.ts builds { linear, api, github }. Each integration has enabled, an optional webhook (mounted at its existing path) and status() (served at /api/integrations/:name).
• Reliability. A send that fails before anything went out (rate limit, connection refused, DNS, TLS, token fetch) holds the event and retries it instead of dropping it. Every send and hook is time-bounded, leases are renewed throughout long reconciles, and shutdown is bounded.

Behaviour changes

• A crashed GitHub comment or review round now posts ⚠️ Something went wrong while working on this. Mention @<bot> in a new comment to retry. instead of nothing. Crashed CI-fix rounds stay silent.
• Failure notices are posted only for rounds that were actually marked failed, after marking, so a late completion or a restart no longer gets a contradictory "task failed".
• A Linear token error while dead-lettering a task with a missing workspace no longer leaves its other rounds open and its lease held.
• The onboarding comment, PR assignee mirroring and the Linear run-archive upload happen once, also when events are replayed.
• GitHub and Linear sends that fail before going out are held and retried (honouring Retry-After, or the platform's rate-limit reset) instead of dropped. A task's later events wait behind a held one.
• On a Linear task, GitHub rounds no longer wait on a Linear outage.
• Task-key lookup is case-insensitive.
• A duplicate Linear delegation no longer refreshes title, URL and flags; a real re-delegation still does.
• Linear's "Sandbox provisioned" thought is removed.
• A disabled integration's messages and hooks are skipped instead of posted or held.
• Slack notifications are opted in per source with SLACK_NOTIFY_SOURCES (default linear, so nothing changes by default).
• /api/integrations/linear and /api/integrations/github keep their fields and gain holds: { heldTasks, oldestHoldAgeMs }; /api/integrations/api is new.
• If Linear's token can't be fetched as a PR opens, that PR isn't auto-assigned.

Upgrade notes

• Two migrations: a unique index on inbox (source, kind, external_id), then a case-insensitive unique index on tasks (lower(key)) that replaces tasks_key_uniq. They take brief locks; on a lock timeout the new pod restarts and retries while old pods keep serving. See docs/kubernetes/README.md (Upgrade, Database migrations).
• The control-plane shutdown grace period is a chart value, controlPlane.terminationGracePeriodSeconds (default 150), and Compose's stop_grace_period is 150s.
• Pods only claim tasks whose source they know, so rolling deploys and rollbacks stay safe.

How I tested it

• control-plane/: bun run typecheck, bun run biome:ci, and bun test --isolate against a throwaway Postgres 18: 1832 pass.
• cli/: bun test: 293 pass; tsc --noEmit clean.
• Chart: bun run test:chart: 164 pass.
• harness/: make lint clean; make test passes except test_distillation … component_bootstrap, which also fails on main on macOS (/private/var vs /var temp path).
• The first commits pin the existing behaviour with characterization tests before changing it; later commits add tests for holds, timeouts, hooks, concurrent re-delegation, migrations and the registry wiring.

🤖 Generated with Claude Code