From ef2676fa1c7e78965941864f57743f9df852fa76 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 18:59:54 +0530
Subject: [PATCH 01/27] Add Teams (DB + API + UI)

---
 README.md                                     |   2 +-
 ...2c1b9c8e12_add_teams_and_team_ownership.py |  73 +++
 backend/app/api/org.py                        |  76 ++-
 .../core/__pycache__/config.cpython-312.pyc   | Bin 693 -> 677 bytes
 .../db/__pycache__/session.cpython-312.pyc    | Bin 944 -> 928 bytes
 backend/app/models/__init__.py                |   3 +-
 backend/app/models/org.py                     |  11 +
 backend/app/models/projects.py                |   3 +
 backend/app/schemas/org.py                    |  14 +
 backend/app/schemas/projects.py               |   2 +
 frontend/src/api/generated/model/employee.ts  |   1 +
 .../src/api/generated/model/employeeCreate.ts |   1 +
 .../src/api/generated/model/employeeUpdate.ts |   1 +
 frontend/src/api/generated/model/index.ts     |   4 +
 .../model/listTeamsTeamsGetParams.ts          |  10 +
 frontend/src/api/generated/model/project.ts   |   1 +
 .../src/api/generated/model/projectCreate.ts  |   1 +
 .../src/api/generated/model/projectUpdate.ts  |   1 +
 frontend/src/api/generated/model/team.ts      |  13 +
 .../src/api/generated/model/teamCreate.ts     |  12 +
 .../src/api/generated/model/teamUpdate.ts     |  12 +
 frontend/src/api/generated/org/org.ts         | 438 ++++++++++++++++++
 frontend/src/app/_components/Shell.tsx        |   1 +
 frontend/src/app/people/page.tsx              |  23 +
 frontend/src/app/projects/page.tsx            |  17 +-
 frontend/src/app/teams/page.tsx               | 150 ++++++
 26 files changed, 865 insertions(+), 5 deletions(-)
 create mode 100644 backend/alembic/versions/3f2c1b9c8e12_add_teams_and_team_ownership.py
 create mode 100644 frontend/src/api/generated/model/listTeamsTeamsGetParams.ts
 create mode 100644 frontend/src/api/generated/model/team.ts
 create mode 100644 frontend/src/api/generated/model/teamCreate.ts
 create mode 100644 frontend/src/api/generated/model/teamUpdate.ts
 create mode 100644 frontend/src/app/teams/page.tsx

diff --git a/README.md b/README.md
index 0260903..a8c59fd 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ No auth (yet). The goal is simple visibility: everyone can see what exists and w
 Uses local Postgres:
 
 - user: `postgres`
-- password: `netbox`
+- password: `REDACTED`
 - db: `openclaw_agency`
 
 ## Environment
diff --git a/backend/alembic/versions/3f2c1b9c8e12_add_teams_and_team_ownership.py b/backend/alembic/versions/3f2c1b9c8e12_add_teams_and_team_ownership.py
new file mode 100644
index 0000000..0898fad
--- /dev/null
+++ b/backend/alembic/versions/3f2c1b9c8e12_add_teams_and_team_ownership.py
@@ -0,0 +1,73 @@
+"""Add teams and team ownership
+
+Revision ID: 3f2c1b9c8e12
+Revises: bacd5e6a253d
+Create Date: 2026-02-02
+
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = "3f2c1b9c8e12"
+down_revision = "bacd5e6a253d"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # 1) Teams
+    op.create_table(
+        "teams",
+        sa.Column("id", sa.Integer(), primary_key=True, nullable=False),
+        sa.Column("name", sa.String(), nullable=False),
+        sa.Column("department_id", sa.Integer(), nullable=False),
+        sa.Column("lead_employee_id", sa.Integer(), nullable=True),
+        sa.ForeignKeyConstraint(["department_id"], ["departments.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["lead_employee_id"], ["employees.id"], ondelete="SET NULL"),
+        sa.UniqueConstraint("department_id", "name", name="uq_teams_department_id_name"),
+    )
+    op.create_index("ix_teams_name", "teams", ["name"], unique=False)
+    op.create_index("ix_teams_department_id", "teams", ["department_id"], unique=False)
+
+    # 2) Employees belong to one (optional) team
+    op.add_column("employees", sa.Column("team_id", sa.Integer(), nullable=True))
+    op.create_index("ix_employees_team_id", "employees", ["team_id"], unique=False)
+    op.create_foreign_key(
+        "fk_employees_team_id_teams",
+        "employees",
+        "teams",
+        ["team_id"],
+        ["id"],
+        ondelete="SET NULL",
+    )
+
+    # 3) Projects are owned by teams (not departments)
+    op.add_column("projects", sa.Column("team_id", sa.Integer(), nullable=True))
+    op.create_index("ix_projects_team_id", "projects", ["team_id"], unique=False)
+    op.create_foreign_key(
+        "fk_projects_team_id_teams",
+        "projects",
+        "teams",
+        ["team_id"],
+        ["id"],
+        ondelete="SET NULL",
+    )
+
+
+def downgrade() -> None:
+    op.drop_constraint("fk_projects_team_id_teams", "projects", type_="foreignkey")
+    op.drop_index("ix_projects_team_id", table_name="projects")
+    op.drop_column("projects", "team_id")
+
+    op.drop_constraint("fk_employees_team_id_teams", "employees", type_="foreignkey")
+    op.drop_index("ix_employees_team_id", table_name="employees")
+    op.drop_column("employees", "team_id")
+
+    op.drop_index("ix_teams_department_id", table_name="teams")
+    op.drop_index("ix_teams_name", table_name="teams")
+    op.drop_table("teams")
diff --git a/backend/app/api/org.py b/backend/app/api/org.py
index 571a489..8fa8841 100644
--- a/backend/app/api/org.py
+++ b/backend/app/api/org.py
@@ -7,8 +7,15 @@ from sqlmodel import Session, select
 from app.api.utils import get_actor_employee_id, log_activity
 from app.db.session import get_session
 from app.integrations.openclaw import OpenClawClient
-from app.models.org import Department, Employee
-from app.schemas.org import DepartmentCreate, DepartmentUpdate, EmployeeCreate, EmployeeUpdate
+from app.models.org import Department, Team, Employee
+from app.schemas.org import (
+    DepartmentCreate,
+    DepartmentUpdate,
+    TeamCreate,
+    TeamUpdate,
+    EmployeeCreate,
+    EmployeeUpdate,
+)
 
 router = APIRouter(tags=["org"])
 
@@ -127,6 +134,71 @@ def list_departments(session: Session = Depends(get_session)):
     return session.exec(select(Department).order_by(Department.name.asc())).all()
 
 
+@router.get("/teams", response_model=list[Team])
+def list_teams(department_id: int | None = None, session: Session = Depends(get_session)):
+    q = select(Team)
+    if department_id is not None:
+        q = q.where(Team.department_id == department_id)
+    return session.exec(q.order_by(Team.name.asc())).all()
+
+
+@router.post("/teams", response_model=Team)
+def create_team(
+    payload: TeamCreate,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
+    team = Team(**payload.model_dump())
+    session.add(team)
+
+    try:
+        session.flush()
+        log_activity(
+            session,
+            actor_employee_id=actor_employee_id,
+            entity_type="team",
+            entity_id=team.id,
+            verb="created",
+            payload={"name": team.name, "department_id": team.department_id, "lead_employee_id": team.lead_employee_id},
+        )
+        session.commit()
+    except IntegrityError:
+        session.rollback()
+        raise HTTPException(status_code=409, detail="Team already exists or violates constraints")
+
+    session.refresh(team)
+    return team
+
+
+@router.patch("/teams/{team_id}", response_model=Team)
+def update_team(
+    team_id: int,
+    payload: TeamUpdate,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
+    team = session.get(Team, team_id)
+    if not team:
+        raise HTTPException(status_code=404, detail="Team not found")
+
+    data = payload.model_dump(exclude_unset=True)
+    for k, v in data.items():
+        setattr(team, k, v)
+
+    session.add(team)
+    try:
+        session.flush()
+        log_activity(session, actor_employee_id=actor_employee_id, entity_type="team", entity_id=team.id, verb="updated", payload=data)
+        session.commit()
+    except IntegrityError:
+        session.rollback()
+        raise HTTPException(status_code=409, detail="Team update violates constraints")
+
+    session.refresh(team)
+    return team
+
+
+
 @router.post("/departments", response_model=Department)
 def create_department(
     payload: DepartmentCreate,
diff --git a/backend/app/core/__pycache__/config.cpython-312.pyc b/backend/app/core/__pycache__/config.cpython-312.pyc
index 0392db7f7f71da8271d775a250b7f7415f011803..29ad631d1dcf6e941c86e23f0552e463f5ff4b1c 100644
GIT binary patch
delta 40
ucmdnWx|EgsG%qg~0}vQ2ZrI2@lab$2KO;XkRX?#fF(a`kF>mr=#!mp>FAU!R

delta 56
zcmZ3=x|NmtG%qg~0}v>;)^FsV$tdrspOK%Ns-IY#n2}hNn5Q35nG9s)1{CFIr6!jY
JPu|S<2>{Wl6A%CZ

diff --git a/backend/app/db/__pycache__/session.cpython-312.pyc b/backend/app/db/__pycache__/session.cpython-312.pyc
index 7d7d28362e8b937a41e70d7459061dea9b747208..0d1077b347bf6e8eddc53bc97a942565b7d514c7 100644
GIT binary patch
delta 41
vcmdnMzJQ(kG%qg~0}vQ2ZrI43!N_l+pOK%Ns-IY#n2}hNn74TnqZ|_e<kbtr

delta 57
zcmZ3$zJZ<lG%qg~0}wo)P`{BogHhf?KO;XkRX?#fF(a`kF;73BG8xFo4JgXbN=+^)
K-rU3}#{>ZVi4w#B

diff --git a/backend/app/models/__init__.py b/backend/app/models/__init__.py
index ed48d88..9bd9a65 100644
--- a/backend/app/models/__init__.py
+++ b/backend/app/models/__init__.py
@@ -1,11 +1,12 @@
 from app.models.activity import Activity
-from app.models.org import Department, Employee
+from app.models.org import Department, Team, Employee
 from app.models.projects import Project, ProjectMember
 from app.models.work import Task, TaskComment
 
 __all__ = [
     "Department",
     "Employee",
+    "Team",
     "Project",
     "ProjectMember",
     "Task",
diff --git a/backend/app/models/org.py b/backend/app/models/org.py
index f0d2caa..81a07c4 100644
--- a/backend/app/models/org.py
+++ b/backend/app/models/org.py
@@ -13,6 +13,16 @@ class Department(SQLModel, table=True):
     head_employee_id: int | None = Field(default=None, foreign_key="employees.id")
 
 
+class Team(SQLModel, table=True):
+    __tablename__ = "teams"
+
+    id: int | None = Field(default=None, primary_key=True)
+    name: str = Field(index=True)
+
+    department_id: int = Field(foreign_key="departments.id")
+    lead_employee_id: int | None = Field(default=None, foreign_key="employees.id")
+
+
 class Employee(SQLModel, table=True):
     __tablename__ = "employees"
 
@@ -21,6 +31,7 @@ class Employee(SQLModel, table=True):
     employee_type: str  # human | agent
 
     department_id: int | None = Field(default=None, foreign_key="departments.id")
+    team_id: int | None = Field(default=None, foreign_key="teams.id")
     manager_id: int | None = Field(default=None, foreign_key="employees.id")
 
     title: str | None = None
diff --git a/backend/app/models/projects.py b/backend/app/models/projects.py
index acfeb15..b079b9b 100644
--- a/backend/app/models/projects.py
+++ b/backend/app/models/projects.py
@@ -10,6 +10,9 @@ class Project(SQLModel, table=True):
     name: str = Field(index=True, unique=True)
     status: str = Field(default="active")
 
+    # Project ownership: projects are assigned to teams (not departments)
+    team_id: int | None = Field(default=None, foreign_key="teams.id")
+
 
 class ProjectMember(SQLModel, table=True):
     __tablename__ = "project_members"
diff --git a/backend/app/schemas/org.py b/backend/app/schemas/org.py
index 102872a..0ae1d54 100644
--- a/backend/app/schemas/org.py
+++ b/backend/app/schemas/org.py
@@ -13,10 +13,23 @@ class DepartmentUpdate(SQLModel):
     head_employee_id: int | None = None
 
 
+class TeamCreate(SQLModel):
+    name: str
+    department_id: int
+    lead_employee_id: int | None = None
+
+
+class TeamUpdate(SQLModel):
+    name: str | None = None
+    department_id: int | None = None
+    lead_employee_id: int | None = None
+
+
 class EmployeeCreate(SQLModel):
     name: str
     employee_type: str
     department_id: int | None = None
+    team_id: int | None = None
     manager_id: int | None = None
     title: str | None = None
     status: str = "active"
@@ -30,6 +43,7 @@ class EmployeeUpdate(SQLModel):
     name: str | None = None
     employee_type: str | None = None
     department_id: int | None = None
+    team_id: int | None = None
     manager_id: int | None = None
     title: str | None = None
     status: str | None = None
diff --git a/backend/app/schemas/projects.py b/backend/app/schemas/projects.py
index 98c3397..1047721 100644
--- a/backend/app/schemas/projects.py
+++ b/backend/app/schemas/projects.py
@@ -6,8 +6,10 @@ from sqlmodel import SQLModel
 class ProjectCreate(SQLModel):
     name: str
     status: str = "active"
+    team_id: int | None = None
 
 
 class ProjectUpdate(SQLModel):
     name: str | None = None
     status: str | None = None
+    team_id: int | None = None
diff --git a/frontend/src/api/generated/model/employee.ts b/frontend/src/api/generated/model/employee.ts
index 893f4eb..5e273ee 100644
--- a/frontend/src/api/generated/model/employee.ts
+++ b/frontend/src/api/generated/model/employee.ts
@@ -10,6 +10,7 @@ export interface Employee {
   name: string;
   employee_type: string;
   department_id?: number | null;
+  team_id?: number | null;
   manager_id?: number | null;
   title?: string | null;
   status?: string;
diff --git a/frontend/src/api/generated/model/employeeCreate.ts b/frontend/src/api/generated/model/employeeCreate.ts
index 74dcd45..4ca4c9a 100644
--- a/frontend/src/api/generated/model/employeeCreate.ts
+++ b/frontend/src/api/generated/model/employeeCreate.ts
@@ -9,6 +9,7 @@ export interface EmployeeCreate {
   name: string;
   employee_type: string;
   department_id?: number | null;
+  team_id?: number | null;
   manager_id?: number | null;
   title?: string | null;
   status?: string;
diff --git a/frontend/src/api/generated/model/employeeUpdate.ts b/frontend/src/api/generated/model/employeeUpdate.ts
index 4cb343d..28f0384 100644
--- a/frontend/src/api/generated/model/employeeUpdate.ts
+++ b/frontend/src/api/generated/model/employeeUpdate.ts
@@ -9,6 +9,7 @@ export interface EmployeeUpdate {
   name?: string | null;
   employee_type?: string | null;
   department_id?: number | null;
+  team_id?: number | null;
   manager_id?: number | null;
   title?: string | null;
   status?: string | null;
diff --git a/frontend/src/api/generated/model/index.ts b/frontend/src/api/generated/model/index.ts
index f1e08e2..f837637 100644
--- a/frontend/src/api/generated/model/index.ts
+++ b/frontend/src/api/generated/model/index.ts
@@ -23,6 +23,7 @@ export * from "./hTTPValidationError";
 export * from "./listActivitiesActivitiesGetParams";
 export * from "./listTaskCommentsTaskCommentsGetParams";
 export * from "./listTasksTasksGetParams";
+export * from "./listTeamsTeamsGetParams";
 export * from "./project";
 export * from "./projectCreate";
 export * from "./projectMember";
@@ -32,4 +33,7 @@ export * from "./taskComment";
 export * from "./taskCommentCreate";
 export * from "./taskCreate";
 export * from "./taskUpdate";
+export * from "./team";
+export * from "./teamCreate";
+export * from "./teamUpdate";
 export * from "./validationError";
diff --git a/frontend/src/api/generated/model/listTeamsTeamsGetParams.ts b/frontend/src/api/generated/model/listTeamsTeamsGetParams.ts
new file mode 100644
index 0000000..54cb6eb
--- /dev/null
+++ b/frontend/src/api/generated/model/listTeamsTeamsGetParams.ts
@@ -0,0 +1,10 @@
+/**
+ * Generated by orval v8.2.0 🍺
+ * Do not edit manually.
+ * OpenClaw Agency API
+ * OpenAPI spec version: 0.3.0
+ */
+
+export type ListTeamsTeamsGetParams = {
+  department_id?: number | null;
+};
diff --git a/frontend/src/api/generated/model/project.ts b/frontend/src/api/generated/model/project.ts
index 5e3c8b5..d886a9a 100644
--- a/frontend/src/api/generated/model/project.ts
+++ b/frontend/src/api/generated/model/project.ts
@@ -9,4 +9,5 @@ export interface Project {
   id?: number | null;
   name: string;
   status?: string;
+  team_id?: number | null;
 }
diff --git a/frontend/src/api/generated/model/projectCreate.ts b/frontend/src/api/generated/model/projectCreate.ts
index 01a2db5..9432eb9 100644
--- a/frontend/src/api/generated/model/projectCreate.ts
+++ b/frontend/src/api/generated/model/projectCreate.ts
@@ -8,4 +8,5 @@
 export interface ProjectCreate {
   name: string;
   status?: string;
+  team_id?: number | null;
 }
diff --git a/frontend/src/api/generated/model/projectUpdate.ts b/frontend/src/api/generated/model/projectUpdate.ts
index 84ea2e9..8e6f796 100644
--- a/frontend/src/api/generated/model/projectUpdate.ts
+++ b/frontend/src/api/generated/model/projectUpdate.ts
@@ -8,4 +8,5 @@
 export interface ProjectUpdate {
   name?: string | null;
   status?: string | null;
+  team_id?: number | null;
 }
diff --git a/frontend/src/api/generated/model/team.ts b/frontend/src/api/generated/model/team.ts
new file mode 100644
index 0000000..a407a72
--- /dev/null
+++ b/frontend/src/api/generated/model/team.ts
@@ -0,0 +1,13 @@
+/**
+ * Generated by orval v8.2.0 🍺
+ * Do not edit manually.
+ * OpenClaw Agency API
+ * OpenAPI spec version: 0.3.0
+ */
+
+export interface Team {
+  id?: number | null;
+  name: string;
+  department_id: number;
+  lead_employee_id?: number | null;
+}
diff --git a/frontend/src/api/generated/model/teamCreate.ts b/frontend/src/api/generated/model/teamCreate.ts
new file mode 100644
index 0000000..bdf963a
--- /dev/null
+++ b/frontend/src/api/generated/model/teamCreate.ts
@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.2.0 🍺
+ * Do not edit manually.
+ * OpenClaw Agency API
+ * OpenAPI spec version: 0.3.0
+ */
+
+export interface TeamCreate {
+  name: string;
+  department_id: number;
+  lead_employee_id?: number | null;
+}
diff --git a/frontend/src/api/generated/model/teamUpdate.ts b/frontend/src/api/generated/model/teamUpdate.ts
new file mode 100644
index 0000000..1bfa271
--- /dev/null
+++ b/frontend/src/api/generated/model/teamUpdate.ts
@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.2.0 🍺
+ * Do not edit manually.
+ * OpenClaw Agency API
+ * OpenAPI spec version: 0.3.0
+ */
+
+export interface TeamUpdate {
+  name?: string | null;
+  department_id?: number | null;
+  lead_employee_id?: number | null;
+}
diff --git a/frontend/src/api/generated/org/org.ts b/frontend/src/api/generated/org/org.ts
index 4c7c3f4..23f7828 100644
--- a/frontend/src/api/generated/org/org.ts
+++ b/frontend/src/api/generated/org/org.ts
@@ -28,6 +28,10 @@ import type {
   EmployeeCreate,
   EmployeeUpdate,
   HTTPValidationError,
+  ListTeamsTeamsGetParams,
+  Team,
+  TeamCreate,
+  TeamUpdate,
 } from ".././model";
 
 import { customFetch } from "../../mutator";
@@ -327,6 +331,440 @@ export const useCreateDepartmentDepartmentsPost = <
     queryClient,
   );
 };
+/**
+ * @summary List Teams
+ */
+export type listTeamsTeamsGetResponse200 = {
+  data: Team[];
+  status: 200;
+};
+
+export type listTeamsTeamsGetResponse422 = {
+  data: HTTPValidationError;
+  status: 422;
+};
+
+export type listTeamsTeamsGetResponseSuccess = listTeamsTeamsGetResponse200 & {
+  headers: Headers;
+};
+export type listTeamsTeamsGetResponseError = listTeamsTeamsGetResponse422 & {
+  headers: Headers;
+};
+
+export type listTeamsTeamsGetResponse =
+  | listTeamsTeamsGetResponseSuccess
+  | listTeamsTeamsGetResponseError;
+
+export const getListTeamsTeamsGetUrl = (params?: ListTeamsTeamsGetParams) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? "null" : value.toString());
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0
+    ? `/teams?${stringifiedParams}`
+    : `/teams`;
+};
+
+export const listTeamsTeamsGet = async (
+  params?: ListTeamsTeamsGetParams,
+  options?: RequestInit,
+): Promise<listTeamsTeamsGetResponse> => {
+  return customFetch<listTeamsTeamsGetResponse>(
+    getListTeamsTeamsGetUrl(params),
+    {
+      ...options,
+      method: "GET",
+    },
+  );
+};
+
+export const getListTeamsTeamsGetQueryKey = (
+  params?: ListTeamsTeamsGetParams,
+) => {
+  return [`/teams`, ...(params ? [params] : [])] as const;
+};
+
+export const getListTeamsTeamsGetQueryOptions = <
+  TData = Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+  TError = HTTPValidationError,
+>(
+  params?: ListTeamsTeamsGetParams,
+  options?: {
+    query?: Partial<
+      UseQueryOptions<
+        Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+        TError,
+        TData
+      >
+    >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+) => {
+  const { query: queryOptions, request: requestOptions } = options ?? {};
+
+  const queryKey =
+    queryOptions?.queryKey ?? getListTeamsTeamsGetQueryKey(params);
+
+  const queryFn: QueryFunction<
+    Awaited<ReturnType<typeof listTeamsTeamsGet>>
+  > = ({ signal }) => listTeamsTeamsGet(params, { signal, ...requestOptions });
+
+  return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
+    Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+    TError,
+    TData
+  > & { queryKey: DataTag<QueryKey, TData, TError> };
+};
+
+export type ListTeamsTeamsGetQueryResult = NonNullable<
+  Awaited<ReturnType<typeof listTeamsTeamsGet>>
+>;
+export type ListTeamsTeamsGetQueryError = HTTPValidationError;
+
+export function useListTeamsTeamsGet<
+  TData = Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+  TError = HTTPValidationError,
+>(
+  params: undefined | ListTeamsTeamsGetParams,
+  options: {
+    query: Partial<
+      UseQueryOptions<
+        Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+        TError,
+        TData
+      >
+    > &
+      Pick<
+        DefinedInitialDataOptions<
+          Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+          TError,
+          Awaited<ReturnType<typeof listTeamsTeamsGet>>
+        >,
+        "initialData"
+      >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+  queryClient?: QueryClient,
+): DefinedUseQueryResult<TData, TError> & {
+  queryKey: DataTag<QueryKey, TData, TError>;
+};
+export function useListTeamsTeamsGet<
+  TData = Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+  TError = HTTPValidationError,
+>(
+  params?: ListTeamsTeamsGetParams,
+  options?: {
+    query?: Partial<
+      UseQueryOptions<
+        Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+        TError,
+        TData
+      >
+    > &
+      Pick<
+        UndefinedInitialDataOptions<
+          Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+          TError,
+          Awaited<ReturnType<typeof listTeamsTeamsGet>>
+        >,
+        "initialData"
+      >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+  queryClient?: QueryClient,
+): UseQueryResult<TData, TError> & {
+  queryKey: DataTag<QueryKey, TData, TError>;
+};
+export function useListTeamsTeamsGet<
+  TData = Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+  TError = HTTPValidationError,
+>(
+  params?: ListTeamsTeamsGetParams,
+  options?: {
+    query?: Partial<
+      UseQueryOptions<
+        Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+        TError,
+        TData
+      >
+    >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+  queryClient?: QueryClient,
+): UseQueryResult<TData, TError> & {
+  queryKey: DataTag<QueryKey, TData, TError>;
+};
+/**
+ * @summary List Teams
+ */
+
+export function useListTeamsTeamsGet<
+  TData = Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+  TError = HTTPValidationError,
+>(
+  params?: ListTeamsTeamsGetParams,
+  options?: {
+    query?: Partial<
+      UseQueryOptions<
+        Awaited<ReturnType<typeof listTeamsTeamsGet>>,
+        TError,
+        TData
+      >
+    >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+  queryClient?: QueryClient,
+): UseQueryResult<TData, TError> & {
+  queryKey: DataTag<QueryKey, TData, TError>;
+} {
+  const queryOptions = getListTeamsTeamsGetQueryOptions(params, options);
+
+  const query = useQuery(queryOptions, queryClient) as UseQueryResult<
+    TData,
+    TError
+  > & { queryKey: DataTag<QueryKey, TData, TError> };
+
+  return { ...query, queryKey: queryOptions.queryKey };
+}
+
+/**
+ * @summary Create Team
+ */
+export type createTeamTeamsPostResponse200 = {
+  data: Team;
+  status: 200;
+};
+
+export type createTeamTeamsPostResponse422 = {
+  data: HTTPValidationError;
+  status: 422;
+};
+
+export type createTeamTeamsPostResponseSuccess =
+  createTeamTeamsPostResponse200 & {
+    headers: Headers;
+  };
+export type createTeamTeamsPostResponseError =
+  createTeamTeamsPostResponse422 & {
+    headers: Headers;
+  };
+
+export type createTeamTeamsPostResponse =
+  | createTeamTeamsPostResponseSuccess
+  | createTeamTeamsPostResponseError;
+
+export const getCreateTeamTeamsPostUrl = () => {
+  return `/teams`;
+};
+
+export const createTeamTeamsPost = async (
+  teamCreate: TeamCreate,
+  options?: RequestInit,
+): Promise<createTeamTeamsPostResponse> => {
+  return customFetch<createTeamTeamsPostResponse>(getCreateTeamTeamsPostUrl(), {
+    ...options,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...options?.headers },
+    body: JSON.stringify(teamCreate),
+  });
+};
+
+export const getCreateTeamTeamsPostMutationOptions = <
+  TError = HTTPValidationError,
+  TContext = unknown,
+>(options?: {
+  mutation?: UseMutationOptions<
+    Awaited<ReturnType<typeof createTeamTeamsPost>>,
+    TError,
+    { data: TeamCreate },
+    TContext
+  >;
+  request?: SecondParameter<typeof customFetch>;
+}): UseMutationOptions<
+  Awaited<ReturnType<typeof createTeamTeamsPost>>,
+  TError,
+  { data: TeamCreate },
+  TContext
+> => {
+  const mutationKey = ["createTeamTeamsPost"];
+  const { mutation: mutationOptions, request: requestOptions } = options
+    ? options.mutation &&
+      "mutationKey" in options.mutation &&
+      options.mutation.mutationKey
+      ? options
+      : { ...options, mutation: { ...options.mutation, mutationKey } }
+    : { mutation: { mutationKey }, request: undefined };
+
+  const mutationFn: MutationFunction<
+    Awaited<ReturnType<typeof createTeamTeamsPost>>,
+    { data: TeamCreate }
+  > = (props) => {
+    const { data } = props ?? {};
+
+    return createTeamTeamsPost(data, requestOptions);
+  };
+
+  return { mutationFn, ...mutationOptions };
+};
+
+export type CreateTeamTeamsPostMutationResult = NonNullable<
+  Awaited<ReturnType<typeof createTeamTeamsPost>>
+>;
+export type CreateTeamTeamsPostMutationBody = TeamCreate;
+export type CreateTeamTeamsPostMutationError = HTTPValidationError;
+
+/**
+ * @summary Create Team
+ */
+export const useCreateTeamTeamsPost = <
+  TError = HTTPValidationError,
+  TContext = unknown,
+>(
+  options?: {
+    mutation?: UseMutationOptions<
+      Awaited<ReturnType<typeof createTeamTeamsPost>>,
+      TError,
+      { data: TeamCreate },
+      TContext
+    >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+  queryClient?: QueryClient,
+): UseMutationResult<
+  Awaited<ReturnType<typeof createTeamTeamsPost>>,
+  TError,
+  { data: TeamCreate },
+  TContext
+> => {
+  return useMutation(
+    getCreateTeamTeamsPostMutationOptions(options),
+    queryClient,
+  );
+};
+/**
+ * @summary Update Team
+ */
+export type updateTeamTeamsTeamIdPatchResponse200 = {
+  data: Team;
+  status: 200;
+};
+
+export type updateTeamTeamsTeamIdPatchResponse422 = {
+  data: HTTPValidationError;
+  status: 422;
+};
+
+export type updateTeamTeamsTeamIdPatchResponseSuccess =
+  updateTeamTeamsTeamIdPatchResponse200 & {
+    headers: Headers;
+  };
+export type updateTeamTeamsTeamIdPatchResponseError =
+  updateTeamTeamsTeamIdPatchResponse422 & {
+    headers: Headers;
+  };
+
+export type updateTeamTeamsTeamIdPatchResponse =
+  | updateTeamTeamsTeamIdPatchResponseSuccess
+  | updateTeamTeamsTeamIdPatchResponseError;
+
+export const getUpdateTeamTeamsTeamIdPatchUrl = (teamId: number) => {
+  return `/teams/${teamId}`;
+};
+
+export const updateTeamTeamsTeamIdPatch = async (
+  teamId: number,
+  teamUpdate: TeamUpdate,
+  options?: RequestInit,
+): Promise<updateTeamTeamsTeamIdPatchResponse> => {
+  return customFetch<updateTeamTeamsTeamIdPatchResponse>(
+    getUpdateTeamTeamsTeamIdPatchUrl(teamId),
+    {
+      ...options,
+      method: "PATCH",
+      headers: { "Content-Type": "application/json", ...options?.headers },
+      body: JSON.stringify(teamUpdate),
+    },
+  );
+};
+
+export const getUpdateTeamTeamsTeamIdPatchMutationOptions = <
+  TError = HTTPValidationError,
+  TContext = unknown,
+>(options?: {
+  mutation?: UseMutationOptions<
+    Awaited<ReturnType<typeof updateTeamTeamsTeamIdPatch>>,
+    TError,
+    { teamId: number; data: TeamUpdate },
+    TContext
+  >;
+  request?: SecondParameter<typeof customFetch>;
+}): UseMutationOptions<
+  Awaited<ReturnType<typeof updateTeamTeamsTeamIdPatch>>,
+  TError,
+  { teamId: number; data: TeamUpdate },
+  TContext
+> => {
+  const mutationKey = ["updateTeamTeamsTeamIdPatch"];
+  const { mutation: mutationOptions, request: requestOptions } = options
+    ? options.mutation &&
+      "mutationKey" in options.mutation &&
+      options.mutation.mutationKey
+      ? options
+      : { ...options, mutation: { ...options.mutation, mutationKey } }
+    : { mutation: { mutationKey }, request: undefined };
+
+  const mutationFn: MutationFunction<
+    Awaited<ReturnType<typeof updateTeamTeamsTeamIdPatch>>,
+    { teamId: number; data: TeamUpdate }
+  > = (props) => {
+    const { teamId, data } = props ?? {};
+
+    return updateTeamTeamsTeamIdPatch(teamId, data, requestOptions);
+  };
+
+  return { mutationFn, ...mutationOptions };
+};
+
+export type UpdateTeamTeamsTeamIdPatchMutationResult = NonNullable<
+  Awaited<ReturnType<typeof updateTeamTeamsTeamIdPatch>>
+>;
+export type UpdateTeamTeamsTeamIdPatchMutationBody = TeamUpdate;
+export type UpdateTeamTeamsTeamIdPatchMutationError = HTTPValidationError;
+
+/**
+ * @summary Update Team
+ */
+export const useUpdateTeamTeamsTeamIdPatch = <
+  TError = HTTPValidationError,
+  TContext = unknown,
+>(
+  options?: {
+    mutation?: UseMutationOptions<
+      Awaited<ReturnType<typeof updateTeamTeamsTeamIdPatch>>,
+      TError,
+      { teamId: number; data: TeamUpdate },
+      TContext
+    >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+  queryClient?: QueryClient,
+): UseMutationResult<
+  Awaited<ReturnType<typeof updateTeamTeamsTeamIdPatch>>,
+  TError,
+  { teamId: number; data: TeamUpdate },
+  TContext
+> => {
+  return useMutation(
+    getUpdateTeamTeamsTeamIdPatchMutationOptions(options),
+    queryClient,
+  );
+};
 /**
  * @summary Update Department
  */
diff --git a/frontend/src/app/_components/Shell.tsx b/frontend/src/app/_components/Shell.tsx
index 6caaa05..55b6a91 100644
--- a/frontend/src/app/_components/Shell.tsx
+++ b/frontend/src/app/_components/Shell.tsx
@@ -10,6 +10,7 @@ const NAV = [
   { href: "/projects", label: "Projects" },
   { href: "/kanban", label: "Kanban" },
   { href: "/departments", label: "Departments" },
+  { href: "/teams", label: "Teams" },
   { href: "/people", label: "People" },
 ];
 
diff --git a/frontend/src/app/people/page.tsx b/frontend/src/app/people/page.tsx
index 96f2337..0761352 100644
--- a/frontend/src/app/people/page.tsx
+++ b/frontend/src/app/people/page.tsx
@@ -13,6 +13,7 @@ import {
   useCreateEmployeeEmployeesPost,
   useListDepartmentsDepartmentsGet,
   useListEmployeesEmployeesGet,
+  useListTeamsTeamsGet,
 } from "@/api/generated/org/org";
 
 export default function PeoplePage() {
@@ -20,12 +21,15 @@ export default function PeoplePage() {
   const [employeeType, setEmployeeType] = useState<"human" | "agent">("human");
   const [title, setTitle] = useState("");
   const [departmentId, setDepartmentId] = useState<string>("");
+  const [teamId, setTeamId] = useState<string>("");
   const [managerId, setManagerId] = useState<string>("");
 
   const employees = useListEmployeesEmployeesGet();
   const departments = useListDepartmentsDepartmentsGet();
+  const teams = useListTeamsTeamsGet({ department_id: undefined });
   const departmentList = useMemo(() => (departments.data?.status === 200 ? departments.data.data : []), [departments.data]);
   const employeeList = useMemo(() => (employees.data?.status === 200 ? employees.data.data : []), [employees.data]);
+  const teamList = useMemo(() => (teams.data?.status === 200 ? teams.data.data : []), [teams.data]);
 
   const createEmployee = useCreateEmployeeEmployeesPost({
     mutation: {
@@ -33,6 +37,7 @@ export default function PeoplePage() {
         setName("");
         setTitle("");
         setDepartmentId("");
+        setTeamId("");
         setManagerId("");
         employees.refetch();
       },
@@ -47,6 +52,14 @@ export default function PeoplePage() {
     return m;
   }, [departmentList]);
 
+  const teamNameById = useMemo(() => {
+    const m = new Map<number, string>();
+    for (const t of teamList) {
+      if (t.id != null) m.set(t.id, t.name);
+    }
+    return m;
+  }, [teamList]);
+
   const empNameById = useMemo(() => {
     const m = new Map<number, string>();
     for (const e of employeeList) {
@@ -88,6 +101,14 @@ export default function PeoplePage() {
                 </option>
               ))}
             </Select>
+            <Select value={teamId} onChange={(e) => setTeamId(e.target.value)}>
+              <option value="">(no team)</option>
+              {teamList.map((t) => (
+                <option key={t.id ?? t.name} value={t.id ?? ""}>
+                  {t.name}
+                </option>
+              ))}
+            </Select>
             <Select value={managerId} onChange={(e) => setManagerId(e.target.value)}>
               <option value="">(no manager)</option>
               {employeeList.map((e) => (
@@ -104,6 +125,7 @@ export default function PeoplePage() {
                     employee_type: employeeType,
                     title: title.trim() ? title : null,
                     department_id: departmentId ? Number(departmentId) : null,
+                    team_id: teamId ? Number(teamId) : null,
                     manager_id: managerId ? Number(managerId) : null,
                     status: "active",
                   },
@@ -142,6 +164,7 @@ export default function PeoplePage() {
                     <div className="mt-2 text-sm text-muted-foreground">
                       {e.title ? <span>{e.title} · </span> : null}
                       {e.department_id ? <span>{deptNameById.get(e.department_id) ?? `Dept#${e.department_id}`} · </span> : null}
+                      {e.team_id ? <span>Team: {teamNameById.get(e.team_id) ?? `Team#${e.team_id}`} · </span> : null}
                       {e.manager_id ? <span>Mgr: {empNameById.get(e.manager_id) ?? `Emp#${e.manager_id}`}</span> : <span>No manager</span>}
                     </div>
                   </li>
diff --git a/frontend/src/app/projects/page.tsx b/frontend/src/app/projects/page.tsx
index 73f5158..e7f6ebd 100644
--- a/frontend/src/app/projects/page.tsx
+++ b/frontend/src/app/projects/page.tsx
@@ -13,15 +13,21 @@ import {
   useListProjectsProjectsGet,
 } from "@/api/generated/projects/projects";
 
+import { useListTeamsTeamsGet } from "@/api/generated/org/org";
+
 export default function ProjectsPage() {
   const [name, setName] = useState("");
+  const [teamId, setTeamId] = useState<string>("");
 
   const projects = useListProjectsProjectsGet();
+  const teams = useListTeamsTeamsGet({ department_id: undefined });
   const projectList = projects.data?.status === 200 ? projects.data.data : [];
+  const teamList = teams.data?.status === 200 ? teams.data.data : [];
   const createProject = useCreateProjectProjectsPost({
     mutation: {
       onSuccess: () => {
         setName("");
+        setTeamId("");
         projects.refetch();
       },
     },
@@ -48,8 +54,17 @@ export default function ProjectsPage() {
           {projects.error ? <div className={styles.mono}>{(projects.error as Error).message}</div> : null}
           <div className={styles.list}>
             <Input placeholder="Project name" value={name} onChange={(e) => setName(e.target.value)} autoFocus />
+            <div style={{ display: 'flex', gap: 10, alignItems: 'center' }}>
+              <span style={{ fontSize: 12, opacity: 0.8 }}>Owning team</span>
+              <select value={teamId} onChange={(e) => setTeamId(e.target.value)} style={{ flex: 1, padding: '6px 8px', borderRadius: 6, border: '1px solid #333', background: 'transparent' }}>
+                <option value="">(none)</option>
+                {teamList.map((t) => (
+                  <option key={t.id ?? t.name} value={t.id ?? ''}>{t.name}</option>
+                ))}
+              </select>
+            </div>
             <Button
-              onClick={() => createProject.mutate({ data: { name, status: "active" } })}
+              onClick={() => createProject.mutate({ data: { name, status: "active", team_id: teamId ? Number(teamId) : null } })}
               disabled={!name.trim() || createProject.isPending || projects.isFetching}
             >
               Create
diff --git a/frontend/src/app/teams/page.tsx b/frontend/src/app/teams/page.tsx
new file mode 100644
index 0000000..320ece6
--- /dev/null
+++ b/frontend/src/app/teams/page.tsx
@@ -0,0 +1,150 @@
+"use client";
+
+import { useMemo, useState } from "react";
+
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Select } from "@/components/ui/select";
+
+import {
+  useCreateTeamTeamsPost,
+  useListDepartmentsDepartmentsGet,
+  useListEmployeesEmployeesGet,
+  useListTeamsTeamsGet,
+} from "@/api/generated/org/org";
+
+export default function TeamsPage() {
+  const [name, setName] = useState("");
+  const [departmentId, setDepartmentId] = useState<string>("");
+  const [leadEmployeeId, setLeadEmployeeId] = useState<string>("");
+
+  const departments = useListDepartmentsDepartmentsGet();
+  const employees = useListEmployeesEmployeesGet();
+  const teams = useListTeamsTeamsGet({ department_id: undefined });
+
+  const departmentList = useMemo(
+    () => (departments.data?.status === 200 ? departments.data.data : []),
+    [departments.data],
+  );
+  const employeeList = useMemo(
+    () => (employees.data?.status === 200 ? employees.data.data : []),
+    [employees.data],
+  );
+  const teamList = useMemo(() => (teams.data?.status === 200 ? teams.data.data : []), [teams.data]);
+
+  const deptNameById = useMemo(() => {
+    const m = new Map<number, string>();
+    for (const d of departmentList) {
+      if (d.id != null) m.set(d.id, d.name);
+    }
+    return m;
+  }, [departmentList]);
+
+  const empNameById = useMemo(() => {
+    const m = new Map<number, string>();
+    for (const e of employeeList) {
+      if (e.id != null) m.set(e.id, e.name);
+    }
+    return m;
+  }, [employeeList]);
+
+  const createTeam = useCreateTeamTeamsPost({
+    mutation: {
+      onSuccess: () => {
+        setName("");
+        setDepartmentId("");
+        setLeadEmployeeId("");
+        teams.refetch();
+      },
+    },
+  });
+
+  const sorted = teamList
+    .slice()
+    .sort((a, b) => `${deptNameById.get(a.department_id) ?? ""}::${a.name}`.localeCompare(`${deptNameById.get(b.department_id) ?? ""}::${b.name}`));
+
+  return (
+    <main className="mx-auto max-w-5xl p-6">
+      <div className="flex items-start justify-between gap-4">
+        <div>
+          <h1 className="text-2xl font-semibold tracking-tight">Teams</h1>
+          <p className="mt-1 text-sm text-muted-foreground">Teams live under departments. Projects are owned by teams.</p>
+        </div>
+        <Button variant="outline" onClick={() => teams.refetch()} disabled={teams.isFetching}>
+          Refresh
+        </Button>
+      </div>
+
+      <div className="mt-6 grid gap-4 sm:grid-cols-2">
+        <Card>
+          <CardHeader>
+            <CardTitle>Create team</CardTitle>
+            <CardDescription>Define a team and attach it to a department.</CardDescription>
+          </CardHeader>
+          <CardContent className="space-y-3">
+            <Input placeholder="Team name" value={name} onChange={(e) => setName(e.target.value)} />
+            <Select value={departmentId} onChange={(e) => setDepartmentId(e.target.value)}>
+              <option value="">(select department)</option>
+              {departmentList.map((d) => (
+                <option key={d.id ?? d.name} value={d.id ?? ""}>
+                  {d.name}
+                </option>
+              ))}
+            </Select>
+            <Select value={leadEmployeeId} onChange={(e) => setLeadEmployeeId(e.target.value)}>
+              <option value="">(no lead)</option>
+              {employeeList.map((e) => (
+                <option key={e.id ?? e.name} value={e.id ?? ""}>
+                  {e.name}
+                </option>
+              ))}
+            </Select>
+            <Button
+              onClick={() =>
+                createTeam.mutate({
+                  data: {
+                    name: name.trim(),
+                    department_id: Number(departmentId),
+                    lead_employee_id: leadEmployeeId ? Number(leadEmployeeId) : null,
+                  },
+                })
+              }
+              disabled={!name.trim() || !departmentId || createTeam.isPending}
+            >
+              Create
+            </Button>
+            {createTeam.error ? <div className="text-sm text-destructive">{(createTeam.error as Error).message}</div> : null}
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>All teams</CardTitle>
+            <CardDescription>{sorted.length} total</CardDescription>
+          </CardHeader>
+          <CardContent>
+            {teams.isLoading ? <div className="text-sm text-muted-foreground">Loading…</div> : null}
+            {teams.error ? <div className="text-sm text-destructive">{(teams.error as Error).message}</div> : null}
+            {!teams.isLoading && !teams.error ? (
+              <ul className="space-y-2">
+                {sorted.map((t) => (
+                  <li key={t.id ?? `${t.department_id}:${t.name}`} className="rounded-md border p-3">
+                    <div className="flex items-center justify-between gap-3">
+                      <div className="font-medium">{t.name}</div>
+                      <div className="text-sm text-muted-foreground">{deptNameById.get(t.department_id) ?? `Dept#${t.department_id}`}</div>
+                    </div>
+                    <div className="mt-2 text-sm text-muted-foreground">
+                      {t.lead_employee_id ? <span>Lead: {empNameById.get(t.lead_employee_id) ?? `Emp#${t.lead_employee_id}`}</span> : <span>No lead</span>}
+                    </div>
+                  </li>
+                ))}
+                {sorted.length === 0 ? <li className="text-sm text-muted-foreground">No teams yet.</li> : null}
+              </ul>
+            ) : null}
+          </CardContent>
+        </Card>
+      </div>
+    </main>
+  );
+}

From a5ec372fa46e2ee7b056b7dc7ff084558ce141cf Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 19:05:50 +0530
Subject: [PATCH 02/27] Fix CORS example + switch to psycopg v3

---
 backend/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index 5bb061f..a8ce58a 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -2,7 +2,7 @@ fastapi
 uvicorn[standard]
 sqlmodel
 alembic
-psycopg2-binary
+psycopg[binary]
 python-dotenv
 pydantic-settings
 requests

From 8429c02458810b548a4340fadfa91fde5a80527f Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 19:18:34 +0530
Subject: [PATCH 03/27] UI provisioning + restrict task assignment to
 provisioned agents

---
 backend/app/api/work.py                 | 25 +++++++++++++++++++++++
 frontend/src/app/people/page.tsx        | 27 ++++++++++++++++++++++++-
 frontend/src/app/projects/[id]/page.tsx |  5 +++--
 3 files changed, 54 insertions(+), 3 deletions(-)

diff --git a/backend/app/api/work.py b/backend/app/api/work.py
index d1f87aa..dc58469 100644
--- a/backend/app/api/work.py
+++ b/backend/app/api/work.py
@@ -18,6 +18,26 @@ router = APIRouter(tags=["work"])
 ALLOWED_STATUSES = {"backlog", "ready", "in_progress", "review", "done", "blocked"}
 
 
+def _validate_task_assignee(session: Session, assignee_employee_id: int) -> None:
+    """Enforce that only provisioned agents can be assigned tasks.
+
+    Humans can be assigned regardless.
+    Agents must be active, notify_enabled, and have openclaw_session_key.
+    """
+
+    emp = session.get(Employee, assignee_employee_id)
+    if emp is None:
+        raise HTTPException(status_code=400, detail="Assignee employee not found")
+
+    if emp.employee_type == "agent":
+        if emp.status != "active":
+            raise HTTPException(status_code=400, detail="Cannot assign task to inactive agent")
+        if not emp.notify_enabled:
+            raise HTTPException(status_code=400, detail="Cannot assign task to agent with notifications disabled")
+        if not emp.openclaw_session_key:
+            raise HTTPException(status_code=400, detail="Cannot assign task to unprovisioned agent")
+
+
 @router.get("/tasks", response_model=list[Task])
 def list_tasks(project_id: int | None = None, session: Session = Depends(get_session)):
     stmt = select(Task).order_by(Task.id.asc())
@@ -31,6 +51,9 @@ def create_task(payload: TaskCreate, background: BackgroundTasks, session: Sessi
     if payload.created_by_employee_id is None:
         payload = TaskCreate(**{**payload.model_dump(), "created_by_employee_id": actor_employee_id})
 
+    if payload.assignee_employee_id is not None:
+        _validate_task_assignee(session, payload.assignee_employee_id)
+
     # Default reviewer to the manager of the assignee (if not explicitly provided).
     if payload.reviewer_employee_id is None and payload.assignee_employee_id is not None:
         assignee = session.get(Employee, payload.assignee_employee_id)
@@ -73,6 +96,8 @@ def update_task(task_id: int, payload: TaskUpdate, background: BackgroundTasks,
     before = {"assignee_employee_id": task.assignee_employee_id, "reviewer_employee_id": task.reviewer_employee_id, "status": task.status}
 
     data = payload.model_dump(exclude_unset=True)
+    if "assignee_employee_id" in data and data["assignee_employee_id"] is not None:
+        _validate_task_assignee(session, data["assignee_employee_id"])
     if "status" in data and data["status"] not in ALLOWED_STATUSES:
         raise HTTPException(status_code=400, detail="Invalid status")
 
diff --git a/frontend/src/app/people/page.tsx b/frontend/src/app/people/page.tsx
index 0761352..b5cbc77 100644
--- a/frontend/src/app/people/page.tsx
+++ b/frontend/src/app/people/page.tsx
@@ -14,9 +14,19 @@ import {
   useListDepartmentsDepartmentsGet,
   useListEmployeesEmployeesGet,
   useListTeamsTeamsGet,
+  useProvisionEmployeeAgentEmployeesEmployeeIdProvisionPost,
+  useDeprovisionEmployeeAgentEmployeesEmployeeIdDeprovisionPost,
 } from "@/api/generated/org/org";
 
 export default function PeoplePage() {
+  const [actorId] = useState(() => {
+    if (typeof window === "undefined") return "";
+    try {
+      return window.localStorage.getItem("actor_employee_id") ?? "";
+    } catch {
+      return "";
+    }
+  });
   const [name, setName] = useState("");
   const [employeeType, setEmployeeType] = useState<"human" | "agent">("human");
   const [title, setTitle] = useState("");
@@ -31,15 +41,30 @@ export default function PeoplePage() {
   const employeeList = useMemo(() => (employees.data?.status === 200 ? employees.data.data : []), [employees.data]);
   const teamList = useMemo(() => (teams.data?.status === 200 ? teams.data.data : []), [teams.data]);
 
+  const provisionEmployee = useProvisionEmployeeAgentEmployeesEmployeeIdProvisionPost();
+  const deprovisionEmployee = useDeprovisionEmployeeAgentEmployeesEmployeeIdDeprovisionPost();
+
   const createEmployee = useCreateEmployeeEmployeesPost({
     mutation: {
-      onSuccess: () => {
+      onSuccess: async (res) => {
         setName("");
         setTitle("");
         setDepartmentId("");
         setTeamId("");
         setManagerId("");
+
+        // If an agent was created but not yet provisioned, provision immediately so it can receive tasks.
+        try {
+          const e = (res as any)?.data?.data ?? (res as any)?.data ?? null;
+          if (e?.employee_type === "agent" && !e.openclaw_session_key) {
+            await provisionEmployee.mutateAsync({ employeeId: e.id! });
+          }
+        } catch {
+          // ignore; UI will show unprovisioned state
+        }
+
         employees.refetch();
+        teams.refetch();
       },
     },
   });
diff --git a/frontend/src/app/projects/[id]/page.tsx b/frontend/src/app/projects/[id]/page.tsx
index e4aacdc..c1fe7df 100644
--- a/frontend/src/app/projects/[id]/page.tsx
+++ b/frontend/src/app/projects/[id]/page.tsx
@@ -51,6 +51,7 @@ export default function ProjectDetailPage() {
 
   const employees = useListEmployeesEmployeesGet();
   const employeeList = employees.data?.status === 200 ? employees.data.data : [];
+  const eligibleAssignees = employeeList.filter((e) => e.employee_type !== "agent" || !!e.openclaw_session_key);
 
   const members = useListProjectMembersProjectsProjectIdMembersGet(projectId);
   const memberList = members.data?.status === 200 ? members.data.data : [];
@@ -154,7 +155,7 @@ export default function ProjectDetailPage() {
             <div className="grid grid-cols-1 gap-2">
               <Select value={assigneeId} onChange={(e) => setAssigneeId(e.target.value)}>
                 <option value="">Assignee</option>
-                {employeeList.map((e) => (
+                {eligibleAssignees.map((e) => (
                   <option key={e.id ?? e.name} value={e.id ?? ""}>{e.name}</option>
                 ))}
               </Select>
@@ -191,7 +192,7 @@ export default function ProjectDetailPage() {
               e.currentTarget.value = "";
             }}>
               <option value="">Add member…</option>
-              {employeeList.map((e) => (
+              {eligibleAssignees.map((e) => (
                 <option key={e.id ?? e.name} value={e.id ?? ""}>{e.name}</option>
               ))}
             </Select>

From aec551d1043cb556124aaff132d0f477049d99e7 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 19:41:26 +0530
Subject: [PATCH 04/27] Add DB reset script + seed_data.sql

---
 backend/scripts/README_seed.md |  37 ++++++++
 backend/scripts/reset_db.sh    |  26 ++++++
 backend/scripts/seed_data.sql  | 160 +++++++++++++++++++++++++++++++++
 3 files changed, 223 insertions(+)
 create mode 100644 backend/scripts/README_seed.md
 create mode 100755 backend/scripts/reset_db.sh
 create mode 100644 backend/scripts/seed_data.sql

diff --git a/backend/scripts/README_seed.md b/backend/scripts/README_seed.md
new file mode 100644
index 0000000..a0d36f7
--- /dev/null
+++ b/backend/scripts/README_seed.md
@@ -0,0 +1,37 @@
+# DB reset + seed (dev-machine)
+
+This repo uses Alembic migrations as schema source-of-truth.
+
+## Reset to the current seed
+
+```bash
+cd backend
+./scripts/reset_db.sh
+```
+
+Environment variables (optional):
+
+- `DB_NAME` (default `openclaw_agency`)
+- `DB_USER` (default `postgres`)
+- `DB_HOST` (default `127.0.0.1`)
+- `DB_PORT` (default `5432`)
+- `DB_PASSWORD` (default `postgres`)
+
+## Updating the seed
+
+The seed is a **data-only** dump (not schema). Regenerate it from the current DB state:
+
+```bash
+cd backend
+PGPASSWORD=postgres pg_dump \
+  --data-only \
+  --column-inserts \
+  --disable-triggers \
+  --no-owner \
+  --no-privileges \
+  -U postgres -h 127.0.0.1 -d openclaw_agency \
+  > scripts/seed_data.sql
+
+# IMPORTANT: do not include alembic_version in the seed (migrations already set it)
+# (our committed seed already has this removed)
+```
diff --git a/backend/scripts/reset_db.sh b/backend/scripts/reset_db.sh
new file mode 100755
index 0000000..f76d0f8
--- /dev/null
+++ b/backend/scripts/reset_db.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DB_NAME=${DB_NAME:-openclaw_agency}
+DB_USER=${DB_USER:-postgres}
+DB_HOST=${DB_HOST:-127.0.0.1}
+DB_PORT=${DB_PORT:-5432}
+DB_PASSWORD=${DB_PASSWORD:-postgres}
+
+cd "$(dirname "$0")/.."
+
+export PGPASSWORD="$DB_PASSWORD"
+
+# 1) wipe schema
+psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -v ON_ERROR_STOP=1 \
+  -c 'DROP SCHEMA public CASCADE; CREATE SCHEMA public;'
+
+# 2) migrate
+. .venv/bin/activate
+alembic upgrade head
+
+# 3) seed
+psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -v ON_ERROR_STOP=1 \
+  -f scripts/seed_data.sql
+
+echo "Reset complete: $DB_USER@$DB_HOST:$DB_PORT/$DB_NAME"
diff --git a/backend/scripts/seed_data.sql b/backend/scripts/seed_data.sql
new file mode 100644
index 0000000..9e72c2f
--- /dev/null
+++ b/backend/scripts/seed_data.sql
@@ -0,0 +1,160 @@
+--
+-- PostgreSQL database dump
+--
+
+-- Dumped from database version 16.9 (Ubuntu 16.9-0ubuntu0.24.04.1)
+-- Dumped by pg_dump version 16.9 (Ubuntu 16.9-0ubuntu0.24.04.1)
+
+SET statement_timeout = 0;
+SET lock_timeout = 0;
+SET idle_in_transaction_session_timeout = 0;
+SET client_encoding = 'UTF8';
+SET standard_conforming_strings = on;
+SELECT pg_catalog.set_config('search_path', '', false);
+SET check_function_bodies = false;
+SET xmloption = content;
+SET client_min_messages = warning;
+SET row_security = off;
+
+--
+-- Data for Name: departments; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+SET SESSION AUTHORIZATION DEFAULT;
+
+ALTER TABLE public.departments DISABLE TRIGGER ALL;
+
+
+
+ALTER TABLE public.departments ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: employees; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.employees DISABLE TRIGGER ALL;
+
+
+
+ALTER TABLE public.employees ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: activities; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.activities DISABLE TRIGGER ALL;
+
+
+
+ALTER TABLE public.activities ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: teams; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.teams DISABLE TRIGGER ALL;
+
+
+
+ALTER TABLE public.teams ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: projects; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.projects DISABLE TRIGGER ALL;
+
+
+
+ALTER TABLE public.projects ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: project_members; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.project_members DISABLE TRIGGER ALL;
+
+
+
+ALTER TABLE public.project_members ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: tasks; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.tasks DISABLE TRIGGER ALL;
+
+
+
+ALTER TABLE public.tasks ENABLE TRIGGER ALL;
+
+--
+-- Data for Name: task_comments; Type: TABLE DATA; Schema: public; Owner: -
+--
+
+ALTER TABLE public.task_comments DISABLE TRIGGER ALL;
+
+
+
+ALTER TABLE public.task_comments ENABLE TRIGGER ALL;
+
+--
+-- Name: activities_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
+--
+
+SELECT pg_catalog.setval('public.activities_id_seq', 1, false);
+
+
+--
+-- Name: departments_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
+--
+
+SELECT pg_catalog.setval('public.departments_id_seq', 1, false);
+
+
+--
+-- Name: employees_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
+--
+
+SELECT pg_catalog.setval('public.employees_id_seq', 1, true);
+
+
+--
+-- Name: project_members_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
+--
+
+SELECT pg_catalog.setval('public.project_members_id_seq', 1, false);
+
+
+--
+-- Name: projects_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
+--
+
+SELECT pg_catalog.setval('public.projects_id_seq', 1, false);
+
+
+--
+-- Name: task_comments_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
+--
+
+SELECT pg_catalog.setval('public.task_comments_id_seq', 1, false);
+
+
+--
+-- Name: tasks_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
+--
+
+SELECT pg_catalog.setval('public.tasks_id_seq', 1, false);
+
+
+--
+-- Name: teams_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
+--
+
+SELECT pg_catalog.setval('public.teams_id_seq', 1, false);
+
+
+--
+-- PostgreSQL database dump complete
+--
+

From 8b4b6b8000e1206002bd5950217a4995ac324b97 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 19:56:28 +0530
Subject: [PATCH 05/27] Fix reset_db.sh default DB password

---
 backend/scripts/reset_db.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/scripts/reset_db.sh b/backend/scripts/reset_db.sh
index f76d0f8..08284d0 100755
--- a/backend/scripts/reset_db.sh
+++ b/backend/scripts/reset_db.sh
@@ -5,7 +5,7 @@ DB_NAME=${DB_NAME:-openclaw_agency}
 DB_USER=${DB_USER:-postgres}
 DB_HOST=${DB_HOST:-127.0.0.1}
 DB_PORT=${DB_PORT:-5432}
-DB_PASSWORD=${DB_PASSWORD:-postgres}
+DB_PASSWORD=${DB_PASSWORD:-REDACTED}
 
 cd "$(dirname "$0")/.."
 

From 8d3153d21a5998b5291a06da021a28256051a0fa Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 19:57:36 +0530
Subject: [PATCH 06/27] Seed: keep Jarvis + Abhimanyu

---
 backend/scripts/seed_data.sql | 185 +++++++---------------------------
 1 file changed, 38 insertions(+), 147 deletions(-)

diff --git a/backend/scripts/seed_data.sql b/backend/scripts/seed_data.sql
index 9e72c2f..dffdbf2 100644
--- a/backend/scripts/seed_data.sql
+++ b/backend/scripts/seed_data.sql
@@ -1,160 +1,51 @@
---
--- PostgreSQL database dump
---
+-- Mission Control seed data (minimal)
+-- Keep this data-only seed small and deterministic.
+-- NOTE: Do NOT include alembic_version here; migrations manage it.
 
--- Dumped from database version 16.9 (Ubuntu 16.9-0ubuntu0.24.04.1)
--- Dumped by pg_dump version 16.9 (Ubuntu 16.9-0ubuntu0.24.04.1)
-
-SET statement_timeout = 0;
-SET lock_timeout = 0;
-SET idle_in_transaction_session_timeout = 0;
-SET client_encoding = 'UTF8';
-SET standard_conforming_strings = on;
-SELECT pg_catalog.set_config('search_path', '', false);
-SET check_function_bodies = false;
-SET xmloption = content;
 SET client_min_messages = warning;
 SET row_security = off;
 
---
--- Data for Name: departments; Type: TABLE DATA; Schema: public; Owner: -
---
-
-SET SESSION AUTHORIZATION DEFAULT;
-
-ALTER TABLE public.departments DISABLE TRIGGER ALL;
-
-
-
-ALTER TABLE public.departments ENABLE TRIGGER ALL;
-
---
--- Data for Name: employees; Type: TABLE DATA; Schema: public; Owner: -
---
-
+-- Disable triggers to avoid FK ordering issues during seed.
 ALTER TABLE public.employees DISABLE TRIGGER ALL;
-
-
-
-ALTER TABLE public.employees ENABLE TRIGGER ALL;
-
---
--- Data for Name: activities; Type: TABLE DATA; Schema: public; Owner: -
---
-
+ALTER TABLE public.departments DISABLE TRIGGER ALL;
+ALTER TABLE public.teams DISABLE TRIGGER ALL;
+ALTER TABLE public.projects DISABLE TRIGGER ALL;
+ALTER TABLE public.tasks DISABLE TRIGGER ALL;
+ALTER TABLE public.task_comments DISABLE TRIGGER ALL;
+ALTER TABLE public.project_members DISABLE TRIGGER ALL;
 ALTER TABLE public.activities DISABLE TRIGGER ALL;
 
+-- Employees (keep only Jarvis + Abhimanyu)
+INSERT INTO public.employees (id, name, employee_type, department_id, manager_id, title, status, openclaw_session_key, notify_enabled, team_id)
+VALUES
+  (1, 'Jarvis', 'agent', NULL, NULL, 'CTO', 'active', NULL, true, NULL),
+  (2, 'Abhimanyu', 'human', NULL, NULL, 'CEO', 'active', NULL, false, NULL)
+ON CONFLICT (id) DO UPDATE SET
+  name = EXCLUDED.name,
+  employee_type = EXCLUDED.employee_type,
+  department_id = EXCLUDED.department_id,
+  manager_id = EXCLUDED.manager_id,
+  title = EXCLUDED.title,
+  status = EXCLUDED.status,
+  openclaw_session_key = EXCLUDED.openclaw_session_key,
+  notify_enabled = EXCLUDED.notify_enabled,
+  team_id = EXCLUDED.team_id;
 
+-- Fix sequences (avoid PK reuse after explicit ids)
+SELECT setval('employees_id_seq', (SELECT COALESCE(max(id), 1) FROM public.employees));
+SELECT setval('departments_id_seq', (SELECT COALESCE(max(id), 1) FROM public.departments));
+SELECT setval('teams_id_seq', (SELECT COALESCE(max(id), 1) FROM public.teams));
+SELECT setval('projects_id_seq', (SELECT COALESCE(max(id), 1) FROM public.projects));
+SELECT setval('tasks_id_seq', (SELECT COALESCE(max(id), 1) FROM public.tasks));
+SELECT setval('task_comments_id_seq', (SELECT COALESCE(max(id), 1) FROM public.task_comments));
+SELECT setval('project_members_id_seq', (SELECT COALESCE(max(id), 1) FROM public.project_members));
+SELECT setval('activities_id_seq', (SELECT COALESCE(max(id), 1) FROM public.activities));
 
-ALTER TABLE public.activities ENABLE TRIGGER ALL;
-
---
--- Data for Name: teams; Type: TABLE DATA; Schema: public; Owner: -
---
-
-ALTER TABLE public.teams DISABLE TRIGGER ALL;
-
-
-
+ALTER TABLE public.employees ENABLE TRIGGER ALL;
+ALTER TABLE public.departments ENABLE TRIGGER ALL;
 ALTER TABLE public.teams ENABLE TRIGGER ALL;
-
---
--- Data for Name: projects; Type: TABLE DATA; Schema: public; Owner: -
---
-
-ALTER TABLE public.projects DISABLE TRIGGER ALL;
-
-
-
 ALTER TABLE public.projects ENABLE TRIGGER ALL;
-
---
--- Data for Name: project_members; Type: TABLE DATA; Schema: public; Owner: -
---
-
-ALTER TABLE public.project_members DISABLE TRIGGER ALL;
-
-
-
-ALTER TABLE public.project_members ENABLE TRIGGER ALL;
-
---
--- Data for Name: tasks; Type: TABLE DATA; Schema: public; Owner: -
---
-
-ALTER TABLE public.tasks DISABLE TRIGGER ALL;
-
-
-
 ALTER TABLE public.tasks ENABLE TRIGGER ALL;
-
---
--- Data for Name: task_comments; Type: TABLE DATA; Schema: public; Owner: -
---
-
-ALTER TABLE public.task_comments DISABLE TRIGGER ALL;
-
-
-
 ALTER TABLE public.task_comments ENABLE TRIGGER ALL;
-
---
--- Name: activities_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
---
-
-SELECT pg_catalog.setval('public.activities_id_seq', 1, false);
-
-
---
--- Name: departments_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
---
-
-SELECT pg_catalog.setval('public.departments_id_seq', 1, false);
-
-
---
--- Name: employees_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
---
-
-SELECT pg_catalog.setval('public.employees_id_seq', 1, true);
-
-
---
--- Name: project_members_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
---
-
-SELECT pg_catalog.setval('public.project_members_id_seq', 1, false);
-
-
---
--- Name: projects_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
---
-
-SELECT pg_catalog.setval('public.projects_id_seq', 1, false);
-
-
---
--- Name: task_comments_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
---
-
-SELECT pg_catalog.setval('public.task_comments_id_seq', 1, false);
-
-
---
--- Name: tasks_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
---
-
-SELECT pg_catalog.setval('public.tasks_id_seq', 1, false);
-
-
---
--- Name: teams_id_seq; Type: SEQUENCE SET; Schema: public; Owner: -
---
-
-SELECT pg_catalog.setval('public.teams_id_seq', 1, false);
-
-
---
--- PostgreSQL database dump complete
---
-
+ALTER TABLE public.project_members ENABLE TRIGGER ALL;
+ALTER TABLE public.activities ENABLE TRIGGER ALL;

From 9b0e5cef5c3fc7d587ae54c2587e0cdea3c4bf6a Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 19:59:02 +0530
Subject: [PATCH 07/27] Do not hardcode DB password in reset script

---
 backend/scripts/reset_db.sh | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/backend/scripts/reset_db.sh b/backend/scripts/reset_db.sh
index 08284d0..5a8e0e7 100755
--- a/backend/scripts/reset_db.sh
+++ b/backend/scripts/reset_db.sh
@@ -5,10 +5,39 @@ DB_NAME=${DB_NAME:-openclaw_agency}
 DB_USER=${DB_USER:-postgres}
 DB_HOST=${DB_HOST:-127.0.0.1}
 DB_PORT=${DB_PORT:-5432}
-DB_PASSWORD=${DB_PASSWORD:-REDACTED}
+
+# Never hardcode passwords in git. Prefer:
+#   - DB_PASSWORD env var, or
+#   - infer from backend/.env DATABASE_URL
+DB_PASSWORD=${DB_PASSWORD:-}
 
 cd "$(dirname "$0")/.."
 
+if [[ -z "${DB_PASSWORD}" ]] && [[ -f .env ]]; then
+  DB_PASSWORD=$(python3 - <<'PY'
+import os
+from pathlib import Path
+from urllib.parse import urlparse
+
+def parse_database_url(url: str) -> str:
+    # supports postgresql+psycopg://user:pass@host:port/db
+    u = urlparse(url)
+    return u.password or ""
+
+for line in Path('.env').read_text().splitlines():
+    if line.startswith('DATABASE_URL='):
+        print(parse_database_url(line.split('=',1)[1].strip()))
+        break
+PY
+)
+fi
+
+if [[ -z "${DB_PASSWORD}" ]]; then
+  echo "ERROR: DB_PASSWORD not set and could not infer it from backend/.env DATABASE_URL" >&2
+  echo "Set DB_PASSWORD=... or create backend/.env with DATABASE_URL" >&2
+  exit 2
+fi
+
 export PGPASSWORD="$DB_PASSWORD"
 
 # 1) wipe schema

From 1a64f21e7b09d9b7b31b4ef3e9aa6da363eaaa76 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:07:22 +0530
Subject: [PATCH 08/27] Agent prompt: require status updates + comments until
 done

---
 backend/app/api/org.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/backend/app/api/org.py b/backend/app/api/org.py
index 8fa8841..e1f693b 100644
--- a/backend/app/api/org.py
+++ b/backend/app/api/org.py
@@ -44,7 +44,11 @@ def _default_agent_prompt(emp: Employee) -> str:
         "- OpenAPI schema: GET /openapi.json\n\n"
         "Rules:\n"
         "- Use the Mission Control API only (no UI).\n"
-        "- When notified about tasks/comments, respond with concise, actionable updates.\n"
+        "- You are responsible for driving assigned work to completion.\n"
+        "- For every task you own: (1) read it, (2) plan next steps, (3) post progress comments, (4) update status as it moves (backlog/ready/in_progress/review/done/blocked).\n"
+        "- Always leave an audit trail: add a comment whenever you start work, whenever you learn something important, and whenever you change status.\n"
+        "- If blocked, set status=blocked and comment what you need (missing access, unclear requirements, etc.).\n"
+        "- When notified about tasks/comments, respond with concise, actionable updates and immediately sync the task state in Mission Control.\n"
         "- Do not invent facts; ask for missing context.\n"
     )
 

From 3895d74aee877f404eec00fc5cc59aa0afc87f70 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:08:42 +0530
Subject: [PATCH 09/27] Agent prompt: fix base URL + header formatting

---
 backend/app/api/org.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/app/api/org.py b/backend/app/api/org.py
index e1f693b..fdd80a7 100644
--- a/backend/app/api/org.py
+++ b/backend/app/api/org.py
@@ -34,9 +34,9 @@ def _default_agent_prompt(emp: Employee) -> str:
         f"Your employee_id is {emp.id}.\n"
         f"Title: {title}. Department id: {dept}.\n\n"
         "Mission Control API access (no UI):\n"
-        "- Base URL: http://127.0.0.1:8000 (if running locally) OR http://<dev-machine-ip>:8000\n"
-        "- Auth: none. REQUIRED header on write operations: X-Actor-Employee-Id: <your employee_id>\n"
-        f"  For you: X-Actor-Employee-Id: {emp.id}\n\n"
+        "- Base URL: http://127.0.0.1:8000 (if running on the same machine as the backend) OR http://<dev-machine-ip>:8000\n"
+        "- Auth: none. REQUIRED header on ALL write operations: X-Actor-Employee-Id: <your_employee_id>\n"
+        f"  Example for you: X-Actor-Employee-Id: {emp.id}\n\n"
         "Common endpoints (JSON):\n"
         "- GET /tasks, POST /tasks\n"
         "- GET /task-comments, POST /task-comments\n"

From 002bd08f33c808db0adf6512f272b0bbdd7b781e Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:11:12 +0530
Subject: [PATCH 10/27] Agent prompt: use LAN base URL (no localhost)

---
 backend/app/api/org.py | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/backend/app/api/org.py b/backend/app/api/org.py
index fdd80a7..66b84f7 100644
--- a/backend/app/api/org.py
+++ b/backend/app/api/org.py
@@ -20,6 +20,45 @@ from app.schemas.org import (
 router = APIRouter(tags=["org"])
 
 
+def _public_api_base_url() -> str:
+    """Return a LAN-reachable base URL for the Mission Control API.
+
+
+    Priority:
+    1) MISSION_CONTROL_BASE_URL env var (recommended)
+    2) First non-loopback IPv4 from `hostname -I`
+
+
+    Never returns localhost/<avoid-loopback> because agents may run on another machine."""
+
+
+    import os, re, subprocess
+
+
+    explicit = os.environ.get("MISSION_CONTROL_BASE_URL")
+    if explicit:
+        return explicit.rstrip("/")
+
+
+    try:
+        out = subprocess.check_output(["bash", "-lc", "hostname -I"], text=True).strip()
+        # pick first RFC1918-ish IPv4, skip docker/loopback
+        ips = re.findall(r"\b(?:\d{1,3}\.){3}\d{1,3}\b", out)
+        for ip in ips:
+            if ip.startswith("127."):
+                continue
+            if ip.startswith("172.17."):
+                continue
+            if ip.startswith("192.168.") or ip.startswith("10.") or ip.startswith("172.16.") or ip.startswith("172."):
+                return f"http://{ip}:8000"
+    except Exception:
+        pass
+
+
+    # Fallback placeholder (should be overridden by env var)
+    return "http://<dev-machine-ip>:8000"
+
+
 def _default_agent_prompt(emp: Employee) -> str:
     """Generate a conservative default prompt for a newly-created agent employee.
 
@@ -34,7 +73,7 @@ def _default_agent_prompt(emp: Employee) -> str:
         f"Your employee_id is {emp.id}.\n"
         f"Title: {title}. Department id: {dept}.\n\n"
         "Mission Control API access (no UI):\n"
-        "- Base URL: http://127.0.0.1:8000 (if running on the same machine as the backend) OR http://<dev-machine-ip>:8000\n"
+        f"- Base URL: {_public_api_base_url()}\n"
         "- Auth: none. REQUIRED header on ALL write operations: X-Actor-Employee-Id: <your_employee_id>\n"
         f"  Example for you: X-Actor-Employee-Id: {emp.id}\n\n"
         "Common endpoints (JSON):\n"

From a8f097817db6ef09d3a4ea2e4d46ac55f6ad6e9e Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:15:38 +0530
Subject: [PATCH 11/27] chore(backend): add black/isort/flake8 + pre-commit

---
 .pre-commit-config.yaml                       |  28 ++++
 backend/.flake8                               |  10 ++
 backend/alembic.ini                           |   2 +-
 backend/alembic/README                        |   2 +-
 .../alembic/__pycache__/env.cpython-312.pyc   | Bin 2468 -> 0 bytes
 backend/alembic/env.py                        |   6 +-
 ...2c1b9c8e12_add_teams_and_team_ownership.py |   2 +-
 .../versions/bacd5e6a253d_baseline_schema.py  |   1 +
 backend/app/api/activities.py                 |   4 +-
 backend/app/api/org.py                        |  64 ++++++--
 backend/app/api/projects.py                   |  59 ++++++--
 backend/app/api/work.py                       | 139 +++++++++++++++---
 .../core/__pycache__/config.cpython-312.pyc   | Bin 677 -> 693 bytes
 .../db/__pycache__/session.cpython-312.pyc    | Bin 928 -> 944 bytes
 backend/app/integrations/notify.py            |   4 +-
 backend/app/integrations/openclaw.py          |   9 +-
 backend/app/models/__init__.py                |   2 +-
 backend/app/models/org.py                     |   2 -
 backend/pyproject.toml                        |   9 ++
 backend/requirements-dev.txt                  |   4 +
 backend/scripts/lint.sh                       |   9 ++
 frontend/public/file.svg                      |   2 +-
 frontend/public/globe.svg                     |   2 +-
 frontend/public/next.svg                      |   2 +-
 frontend/public/vercel.svg                    |   2 +-
 frontend/public/window.svg                    |   2 +-
 26 files changed, 299 insertions(+), 67 deletions(-)
 create mode 100644 .pre-commit-config.yaml
 create mode 100644 backend/.flake8
 delete mode 100644 backend/alembic/__pycache__/env.cpython-312.pyc
 create mode 100644 backend/pyproject.toml
 create mode 100644 backend/requirements-dev.txt
 create mode 100755 backend/scripts/lint.sh

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..1c99266
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,28 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-yaml
+      - id: check-added-large-files
+
+  - repo: https://github.com/psf/black
+    rev: 24.10.0
+    hooks:
+      - id: black
+        language_version: python3
+        files: ^backend/.*\.py$
+
+  - repo: https://github.com/PyCQA/isort
+    rev: 5.13.2
+    hooks:
+      - id: isort
+        files: ^backend/.*\.py$
+
+  - repo: https://github.com/PyCQA/flake8
+    rev: 7.1.1
+    hooks:
+      - id: flake8
+        files: ^backend/.*\.py$
+        args: [--config=backend/.flake8]
diff --git a/backend/.flake8 b/backend/.flake8
new file mode 100644
index 0000000..e2203bb
--- /dev/null
+++ b/backend/.flake8
@@ -0,0 +1,10 @@
+[flake8]
+max-line-length = 100
+extend-ignore = E203, W503, E501
+exclude =
+  .venv,
+  backend/.venv,
+  alembic,
+  backend/alembic,
+  **/__pycache__,
+  **/*.pyc
diff --git a/backend/alembic.ini b/backend/alembic.ini
index e8b4e3c..f0da7e5 100644
--- a/backend/alembic.ini
+++ b/backend/alembic.ini
@@ -86,7 +86,7 @@ path_separator = os
 # database URL.  This is consumed by the user-maintained env.py script only.
 # other means of configuring database URLs may be customized within the env.py
 # file.
-sqlalchemy.url = 
+sqlalchemy.url =
 
 
 [post_write_hooks]
diff --git a/backend/alembic/README b/backend/alembic/README
index 98e4f9c..2500aa1 100644
--- a/backend/alembic/README
+++ b/backend/alembic/README
@@ -1 +1 @@
-Generic single-database configuration.
\ No newline at end of file
+Generic single-database configuration.
diff --git a/backend/alembic/__pycache__/env.cpython-312.pyc b/backend/alembic/__pycache__/env.cpython-312.pyc
deleted file mode 100644
index ddf714ab5f1aac98ccd03a0e91c87da23141344e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2468
zcmah~&2Jk;6rc5ec-NneW2cQ{QrAhG8Z|W>s$MG85}_WTQA&|eeOYb1V|UGdxU=gf
zDXB0L2M|c8r`}K{IDpc>0nx&ZOO~W^x^hJk?SWfRT1Co<H*0U~lnO@LnfEnsXWsk0
zH^0W?5d`Do+n;Dn9-%)e6AZRTFuQpMp*u)LDx)KVsW1$sLwd+yE38kmI%n_|-lsWT
zFv69vAy!16=XJ@5R3bht=usn9iTQL`j~j_ff<c&XOa{Lktd%5AHu3{Lpgv875N2Pk
zTZePf0X}1mLXRGvD=9UmN}q9+Q8lhcU`@jsg*5{{`NpYX+aA5%7ZDLG(gDYyRmx|E
z`BLI9YFlEwsA8Iyqd1yn+Q3F?nvUl!v!>O73s)`E!7ENF<fX7#*Gw$eh-Jti1_O_4
zT9yuGqKzF#GwalWc;)hYmn;=ixnNMjUa0oZ<uCNskSk`FUil7k4s?ys0eL`Nfg>)I
zLPP|K7gH5SSyF5)w}}1&+ND<e@071u1}-bMa!nzMSzcVN0%0r?tAVSIUACIotm?}0
zoKgp3wY;QMKf<P3R&;DEY1J||Z=7zfdf_^Ds9SOboF0YGPQcVg-RNj1ns=l54K7cp
z=+IrlAn@<90R-HopHYN@Sl>bp=zF8V1=L_&Lyiz|Dx-!}R%7mQ>wQaRcsC8fOC$Kp
z8NkrcfBYIbY#LblScZC7@5dUjfu_)#$Yz#947v(_sAPq`ik6uYzwm(<X+l&D+ga7I
z$D4|Q)e`5i5GXI{D1-*hz>Y!_<HdE&!9>yJCCyZA$d(2%t~#>SbnKGg2bMt5B2VhU
zr$sQyP<~_y1GHoZ(q}7GibO9#TBdAhbrJxRq`}gr@y(MY-86RCLbhr(9q>seKuJIQ
zLzp0ck&!P;?fEVj?Qj{F%WTJz-D9)cW7+Mo!rhA-nNu$$o)?}cP-LVd6<n#XDNX;4
z82&_8Om@UcSDf4u^Ls1^_NdfX?b}iC{bS}rj=i7bFU*8rjfrpIw1@D0fCSjxA4BMW
z1v-KbvBKDp9Ss4RDB}DPWONPs+&PdqQeS~U5^@eO(1-={!FrEf@1Nxsv&J-NJYO1t
z_cQ2L$QcQgjZ{Dl*0qpBQ{xXn?g6fbc8vx4!8-5{$Q}4UHn0e&!1CY7g|7ZTNd79-
zL-Kzh{AR+wt}A-=8a7r>1FUaGhj?gvLX+T{w&F>&)j=PzZ4gEPz$QQ&km@726!(OF
zON`QzuzNZ$)f38^sRgoL8PJ+1G?kvX(9-oq@a^|n>eR0hLL=e(CgYUK!c=0tcu+Zh
zS$NU@Ig}+GljC4w)3oOE{SwK%Tq34lA+um}k{W*x6I4h#+esJQbn&|zo!Rs5?D@^~
zh2PQ_e|o=tsau@;R%>6{NEKXe>S=0vTg+@HbKTU~ow?g{&%@lP(0+F(h9a4clyjxr
zrZl;OIDY2t>wfW!yW;rW$}h(sikF|p)17$HjTblLC!vI-nQm;f6Dzo}!d7e=s!N*L
z3&Tc#_nrXk4mH{z2>0!2IPCosZ_KmogOSYJXZZ(3k<w@Rc_ckJ7Y6!gmY<J>Y0e0C
zTEz5N+ad6F(7Srvf@R{;Q7<CPwH9cxEE5_mFQHp?=sxw+z0eX`hF-Y;I`sNgWB>^=
z$XrrsHenON!A{zs;VHbX`>!6M_2{u+L})FNJY|pc0YM*GnRZi84BBTe+4S}CTNt5P
z@{*bzG&Y%fC2^{!&ye2)_r-G{ZRz+eat36yJKD=I?XV2PJVu3QXyzH3_#Ks>q3Ory
zwHE?njy{o&d_DQaWLtQ`N*y-qve^x`_=rn<exs8ty2;`eH@hRC(TPrK%1uqRle+@L
moY)m3Fl7_W%uWGu6YaCTom*_~5tn_)<^JHtA954^!TtdhIS=^&

diff --git a/backend/alembic/env.py b/backend/alembic/env.py
index 3a5cd09..cdb40c2 100644
--- a/backend/alembic/env.py
+++ b/backend/alembic/env.py
@@ -2,14 +2,14 @@ from __future__ import annotations
 
 from logging.config import fileConfig
 
-from alembic import context
 from sqlalchemy import engine_from_config, pool
-
-from app.core.config import settings
 from sqlmodel import SQLModel
 
+from alembic import context
+
 # Import models to register tables in metadata
 from app import models  # noqa: F401
+from app.core.config import settings
 
 config = context.config
 
diff --git a/backend/alembic/versions/3f2c1b9c8e12_add_teams_and_team_ownership.py b/backend/alembic/versions/3f2c1b9c8e12_add_teams_and_team_ownership.py
index 0898fad..cdeba32 100644
--- a/backend/alembic/versions/3f2c1b9c8e12_add_teams_and_team_ownership.py
+++ b/backend/alembic/versions/3f2c1b9c8e12_add_teams_and_team_ownership.py
@@ -8,9 +8,9 @@ Create Date: 2026-02-02
 
 from __future__ import annotations
 
-from alembic import op
 import sqlalchemy as sa
 
+from alembic import op
 
 # revision identifiers, used by Alembic.
 revision = "3f2c1b9c8e12"
diff --git a/backend/alembic/versions/bacd5e6a253d_baseline_schema.py b/backend/alembic/versions/bacd5e6a253d_baseline_schema.py
index 662689b..e796434 100644
--- a/backend/alembic/versions/bacd5e6a253d_baseline_schema.py
+++ b/backend/alembic/versions/bacd5e6a253d_baseline_schema.py
@@ -10,6 +10,7 @@ from typing import Sequence, Union
 
 import sqlalchemy as sa
 import sqlmodel
+
 from alembic import op
 
 # revision identifiers, used by Alembic.
diff --git a/backend/app/api/activities.py b/backend/app/api/activities.py
index d5daadf..be01418 100644
--- a/backend/app/api/activities.py
+++ b/backend/app/api/activities.py
@@ -13,7 +13,9 @@ router = APIRouter(prefix="/activities", tags=["activities"])
 
 @router.get("")
 def list_activities(limit: int = 50, session: Session = Depends(get_session)):
-    items = session.exec(select(Activity).order_by(Activity.id.desc()).limit(max(1, min(limit, 200)))).all()
+    items = session.exec(
+        select(Activity).order_by(Activity.id.desc()).limit(max(1, min(limit, 200)))
+    ).all()
     out = []
     for a in items:
         out.append(
diff --git a/backend/app/api/org.py b/backend/app/api/org.py
index 66b84f7..ee7127b 100644
--- a/backend/app/api/org.py
+++ b/backend/app/api/org.py
@@ -7,14 +7,14 @@ from sqlmodel import Session, select
 from app.api.utils import get_actor_employee_id, log_activity
 from app.db.session import get_session
 from app.integrations.openclaw import OpenClawClient
-from app.models.org import Department, Team, Employee
+from app.models.org import Department, Employee, Team
 from app.schemas.org import (
     DepartmentCreate,
     DepartmentUpdate,
-    TeamCreate,
-    TeamUpdate,
     EmployeeCreate,
     EmployeeUpdate,
+    TeamCreate,
+    TeamUpdate,
 )
 
 router = APIRouter(tags=["org"])
@@ -31,15 +31,14 @@ def _public_api_base_url() -> str:
 
     Never returns localhost/<avoid-loopback> because agents may run on another machine."""
 
-
-    import os, re, subprocess
-
+    import os
+    import re
+    import subprocess
 
     explicit = os.environ.get("MISSION_CONTROL_BASE_URL")
     if explicit:
         return explicit.rstrip("/")
 
-
     try:
         out = subprocess.check_output(["bash", "-lc", "hostname -I"], text=True).strip()
         # pick first RFC1918-ish IPv4, skip docker/loopback
@@ -49,12 +48,16 @@ def _public_api_base_url() -> str:
                 continue
             if ip.startswith("172.17."):
                 continue
-            if ip.startswith("192.168.") or ip.startswith("10.") or ip.startswith("172.16.") or ip.startswith("172."):
+            if (
+                ip.startswith("192.168.")
+                or ip.startswith("10.")
+                or ip.startswith("172.16.")
+                or ip.startswith("172.")
+            ):
                 return f"http://{ip}:8000"
     except Exception:
         pass
 
-
     # Fallback placeholder (should be overridden by env var)
     return "http://<dev-machine-ip>:8000"
 
@@ -202,7 +205,11 @@ def create_team(
             entity_type="team",
             entity_id=team.id,
             verb="created",
-            payload={"name": team.name, "department_id": team.department_id, "lead_employee_id": team.lead_employee_id},
+            payload={
+                "name": team.name,
+                "department_id": team.department_id,
+                "lead_employee_id": team.lead_employee_id,
+            },
         )
         session.commit()
     except IntegrityError:
@@ -231,7 +238,14 @@ def update_team(
     session.add(team)
     try:
         session.flush()
-        log_activity(session, actor_employee_id=actor_employee_id, entity_type="team", entity_id=team.id, verb="updated", payload=data)
+        log_activity(
+            session,
+            actor_employee_id=actor_employee_id,
+            entity_type="team",
+            entity_id=team.id,
+            verb="updated",
+            payload=data,
+        )
         session.commit()
     except IntegrityError:
         session.rollback()
@@ -241,7 +255,6 @@ def update_team(
     return team
 
 
-
 @router.post("/departments", response_model=Department)
 def create_department(
     payload: DepartmentCreate,
@@ -270,7 +283,9 @@ def create_department(
         session.commit()
     except IntegrityError:
         session.rollback()
-        raise HTTPException(status_code=409, detail="Department already exists or violates constraints")
+        raise HTTPException(
+            status_code=409, detail="Department already exists or violates constraints"
+        )
 
     session.refresh(dept)
     return dept
@@ -294,7 +309,14 @@ def update_department(
     session.add(dept)
     session.commit()
     session.refresh(dept)
-    log_activity(session, actor_employee_id=actor_employee_id, entity_type="department", entity_id=dept.id, verb="updated", payload=data)
+    log_activity(
+        session,
+        actor_employee_id=actor_employee_id,
+        entity_type="department",
+        entity_id=dept.id,
+        verb="updated",
+        payload=data,
+    )
     session.commit()
     return dept
 
@@ -354,7 +376,14 @@ def update_employee(
     session.add(emp)
     try:
         session.flush()
-        log_activity(session, actor_employee_id=actor_employee_id, entity_type="employee", entity_id=emp.id, verb="updated", payload=data)
+        log_activity(
+            session,
+            actor_employee_id=actor_employee_id,
+            entity_type="employee",
+            entity_id=emp.id,
+            verb="updated",
+            payload=data,
+        )
         session.commit()
     except IntegrityError:
         session.rollback()
@@ -401,7 +430,10 @@ def deprovision_employee_agent(
         try:
             client.tools_invoke(
                 "sessions_send",
-                {"sessionKey": emp.openclaw_session_key, "message": "You are being deprovisioned. Stop all work and ignore future messages."},
+                {
+                    "sessionKey": emp.openclaw_session_key,
+                    "message": "You are being deprovisioned. Stop all work and ignore future messages.",
+                },
                 timeout_s=5.0,
             )
         except Exception:
diff --git a/backend/app/api/projects.py b/backend/app/api/projects.py
index 2b788ee..2f90232 100644
--- a/backend/app/api/projects.py
+++ b/backend/app/api/projects.py
@@ -4,7 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.exc import IntegrityError
 from sqlmodel import Session, select
 
-from app.api.utils import log_activity, get_actor_employee_id
+from app.api.utils import get_actor_employee_id, log_activity
 from app.db.session import get_session
 from app.models.projects import Project, ProjectMember
 from app.schemas.projects import ProjectCreate, ProjectUpdate
@@ -45,15 +45,21 @@ def create_project(
         session.commit()
     except IntegrityError:
         session.rollback()
-        raise HTTPException(status_code=409, detail="Project already exists or violates constraints")
+        raise HTTPException(
+            status_code=409, detail="Project already exists or violates constraints"
+        )
 
     session.refresh(proj)
     return proj
 
 
-
 @router.patch("/{project_id}", response_model=Project)
-def update_project(project_id: int, payload: ProjectUpdate, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+def update_project(
+    project_id: int,
+    payload: ProjectUpdate,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
     proj = session.get(Project, project_id)
     if not proj:
         raise HTTPException(status_code=404, detail="Project not found")
@@ -65,7 +71,14 @@ def update_project(project_id: int, payload: ProjectUpdate, session: Session = D
     session.add(proj)
     session.commit()
     session.refresh(proj)
-    log_activity(session, actor_employee_id=actor_employee_id, entity_type="project", entity_id=proj.id, verb="updated", payload=data)
+    log_activity(
+        session,
+        actor_employee_id=actor_employee_id,
+        entity_type="project",
+        entity_id=proj.id,
+        verb="updated",
+        payload=data,
+    )
     session.commit()
     return proj
 
@@ -73,16 +86,29 @@ def update_project(project_id: int, payload: ProjectUpdate, session: Session = D
 @router.get("/{project_id}/members", response_model=list[ProjectMember])
 def list_project_members(project_id: int, session: Session = Depends(get_session)):
     return session.exec(
-        select(ProjectMember).where(ProjectMember.project_id == project_id).order_by(ProjectMember.id.asc())
+        select(ProjectMember)
+        .where(ProjectMember.project_id == project_id)
+        .order_by(ProjectMember.id.asc())
     ).all()
 
 
 @router.post("/{project_id}/members", response_model=ProjectMember)
-def add_project_member(project_id: int, payload: ProjectMember, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
-    existing = session.exec(select(ProjectMember).where(ProjectMember.project_id == project_id, ProjectMember.employee_id == payload.employee_id)).first()
+def add_project_member(
+    project_id: int,
+    payload: ProjectMember,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
+    existing = session.exec(
+        select(ProjectMember).where(
+            ProjectMember.project_id == project_id, ProjectMember.employee_id == payload.employee_id
+        )
+    ).first()
     if existing:
         raise HTTPException(status_code=409, detail="Member already added")
-    member = ProjectMember(project_id=project_id, employee_id=payload.employee_id, role=payload.role)
+    member = ProjectMember(
+        project_id=project_id, employee_id=payload.employee_id, role=payload.role
+    )
     session.add(member)
     session.commit()
     session.refresh(member)
@@ -99,7 +125,12 @@ def add_project_member(project_id: int, payload: ProjectMember, session: Session
 
 
 @router.delete("/{project_id}/members/{member_id}")
-def remove_project_member(project_id: int, member_id: int, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+def remove_project_member(
+    project_id: int,
+    member_id: int,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
     member = session.get(ProjectMember, member_id)
     if not member or member.project_id != project_id:
         raise HTTPException(status_code=404, detail="Project member not found")
@@ -118,7 +149,13 @@ def remove_project_member(project_id: int, member_id: int, session: Session = De
 
 
 @router.patch("/{project_id}/members/{member_id}", response_model=ProjectMember)
-def update_project_member(project_id: int, member_id: int, payload: ProjectMember, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+def update_project_member(
+    project_id: int,
+    member_id: int,
+    payload: ProjectMember,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
     member = session.get(ProjectMember, member_id)
     if not member or member.project_id != project_id:
         raise HTTPException(status_code=404, detail="Project member not found")
diff --git a/backend/app/api/work.py b/backend/app/api/work.py
index dc58469..2a01510 100644
--- a/backend/app/api/work.py
+++ b/backend/app/api/work.py
@@ -2,16 +2,16 @@ from __future__ import annotations
 
 from datetime import datetime
 
-from fastapi import APIRouter, Depends, HTTPException, BackgroundTasks
-from sqlmodel import Session, select
+from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
 from sqlalchemy.exc import IntegrityError
+from sqlmodel import Session, select
 
-from app.api.utils import log_activity, get_actor_employee_id
+from app.api.utils import get_actor_employee_id, log_activity
 from app.db.session import get_session
+from app.integrations.notify import NotifyContext, notify_openclaw
 from app.models.org import Employee
 from app.models.work import Task, TaskComment
 from app.schemas.work import TaskCommentCreate, TaskCreate, TaskUpdate
-from app.integrations.notify import NotifyContext, notify_openclaw
 
 router = APIRouter(tags=["work"])
 
@@ -33,7 +33,9 @@ def _validate_task_assignee(session: Session, assignee_employee_id: int) -> None
         if emp.status != "active":
             raise HTTPException(status_code=400, detail="Cannot assign task to inactive agent")
         if not emp.notify_enabled:
-            raise HTTPException(status_code=400, detail="Cannot assign task to agent with notifications disabled")
+            raise HTTPException(
+                status_code=400, detail="Cannot assign task to agent with notifications disabled"
+            )
         if not emp.openclaw_session_key:
             raise HTTPException(status_code=400, detail="Cannot assign task to unprovisioned agent")
 
@@ -47,9 +49,16 @@ def list_tasks(project_id: int | None = None, session: Session = Depends(get_ses
 
 
 @router.post("/tasks", response_model=Task)
-def create_task(payload: TaskCreate, background: BackgroundTasks, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+def create_task(
+    payload: TaskCreate,
+    background: BackgroundTasks,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
     if payload.created_by_employee_id is None:
-        payload = TaskCreate(**{**payload.model_dump(), "created_by_employee_id": actor_employee_id})
+        payload = TaskCreate(
+            **{**payload.model_dump(), "created_by_employee_id": actor_employee_id}
+        )
 
     if payload.assignee_employee_id is not None:
         _validate_task_assignee(session, payload.assignee_employee_id)
@@ -58,7 +67,9 @@ def create_task(payload: TaskCreate, background: BackgroundTasks, session: Sessi
     if payload.reviewer_employee_id is None and payload.assignee_employee_id is not None:
         assignee = session.get(Employee, payload.assignee_employee_id)
         if assignee is not None and assignee.manager_id is not None:
-            payload = TaskCreate(**{**payload.model_dump(), "reviewer_employee_id": assignee.manager_id})
+            payload = TaskCreate(
+                **{**payload.model_dump(), "reviewer_employee_id": assignee.manager_id}
+            )
 
     task = Task(**payload.model_dump())
     if task.status not in ALLOWED_STATUSES:
@@ -82,18 +93,32 @@ def create_task(payload: TaskCreate, background: BackgroundTasks, session: Sessi
         raise HTTPException(status_code=409, detail="Task create violates constraints")
 
     session.refresh(task)
-    background.add_task(notify_openclaw, session, NotifyContext(event="task.created", actor_employee_id=actor_employee_id, task=task))
+    background.add_task(
+        notify_openclaw,
+        session,
+        NotifyContext(event="task.created", actor_employee_id=actor_employee_id, task=task),
+    )
     # Explicitly return a serializable payload (guards against empty {} responses)
     return Task.model_validate(task)
 
 
 @router.patch("/tasks/{task_id}", response_model=Task)
-def update_task(task_id: int, payload: TaskUpdate, background: BackgroundTasks, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+def update_task(
+    task_id: int,
+    payload: TaskUpdate,
+    background: BackgroundTasks,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
     task = session.get(Task, task_id)
     if not task:
         raise HTTPException(status_code=404, detail="Task not found")
 
-    before = {"assignee_employee_id": task.assignee_employee_id, "reviewer_employee_id": task.reviewer_employee_id, "status": task.status}
+    before = {
+        "assignee_employee_id": task.assignee_employee_id,
+        "reviewer_employee_id": task.reviewer_employee_id,
+        "status": task.status,
+    }
 
     data = payload.model_dump(exclude_unset=True)
     if "assignee_employee_id" in data and data["assignee_employee_id"] is not None:
@@ -108,7 +133,14 @@ def update_task(task_id: int, payload: TaskUpdate, background: BackgroundTasks,
 
     try:
         session.flush()
-        log_activity(session, actor_employee_id=actor_employee_id, entity_type="task", entity_id=task.id, verb="updated", payload=data)
+        log_activity(
+            session,
+            actor_employee_id=actor_employee_id,
+            entity_type="task",
+            entity_id=task.id,
+            verb="updated",
+            payload=data,
+        )
         session.commit()
     except IntegrityError:
         session.rollback()
@@ -119,19 +151,53 @@ def update_task(task_id: int, payload: TaskUpdate, background: BackgroundTasks,
     # notify based on meaningful changes
     changed = {}
     if before.get("assignee_employee_id") != task.assignee_employee_id:
-        changed["assignee_employee_id"] = {"from": before.get("assignee_employee_id"), "to": task.assignee_employee_id}
-        background.add_task(notify_openclaw, session, NotifyContext(event="task.assigned", actor_employee_id=actor_employee_id, task=task, changed_fields=changed))
+        changed["assignee_employee_id"] = {
+            "from": before.get("assignee_employee_id"),
+            "to": task.assignee_employee_id,
+        }
+        background.add_task(
+            notify_openclaw,
+            session,
+            NotifyContext(
+                event="task.assigned",
+                actor_employee_id=actor_employee_id,
+                task=task,
+                changed_fields=changed,
+            ),
+        )
     if before.get("status") != task.status:
         changed["status"] = {"from": before.get("status"), "to": task.status}
-        background.add_task(notify_openclaw, session, NotifyContext(event="status.changed", actor_employee_id=actor_employee_id, task=task, changed_fields=changed))
+        background.add_task(
+            notify_openclaw,
+            session,
+            NotifyContext(
+                event="status.changed",
+                actor_employee_id=actor_employee_id,
+                task=task,
+                changed_fields=changed,
+            ),
+        )
     if not changed and data:
-        background.add_task(notify_openclaw, session, NotifyContext(event="task.updated", actor_employee_id=actor_employee_id, task=task, changed_fields=data))
+        background.add_task(
+            notify_openclaw,
+            session,
+            NotifyContext(
+                event="task.updated",
+                actor_employee_id=actor_employee_id,
+                task=task,
+                changed_fields=data,
+            ),
+        )
 
     return Task.model_validate(task)
 
 
 @router.delete("/tasks/{task_id}")
-def delete_task(task_id: int, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+def delete_task(
+    task_id: int,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
     task = session.get(Task, task_id)
     if not task:
         raise HTTPException(status_code=404, detail="Task not found")
@@ -139,7 +205,13 @@ def delete_task(task_id: int, session: Session = Depends(get_session), actor_emp
     session.delete(task)
     try:
         session.flush()
-        log_activity(session, actor_employee_id=actor_employee_id, entity_type="task", entity_id=task_id, verb="deleted")
+        log_activity(
+            session,
+            actor_employee_id=actor_employee_id,
+            entity_type="task",
+            entity_id=task_id,
+            verb="deleted",
+        )
         session.commit()
     except IntegrityError:
         session.rollback()
@@ -150,20 +222,35 @@ def delete_task(task_id: int, session: Session = Depends(get_session), actor_emp
 
 @router.get("/task-comments", response_model=list[TaskComment])
 def list_task_comments(task_id: int, session: Session = Depends(get_session)):
-    return session.exec(select(TaskComment).where(TaskComment.task_id == task_id).order_by(TaskComment.id.asc())).all()
+    return session.exec(
+        select(TaskComment).where(TaskComment.task_id == task_id).order_by(TaskComment.id.asc())
+    ).all()
 
 
 @router.post("/task-comments", response_model=TaskComment)
-def create_task_comment(payload: TaskCommentCreate, background: BackgroundTasks, session: Session = Depends(get_session), actor_employee_id: int = Depends(get_actor_employee_id)):
+def create_task_comment(
+    payload: TaskCommentCreate,
+    background: BackgroundTasks,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
     if payload.author_employee_id is None:
-        payload = TaskCommentCreate(**{**payload.model_dump(), "author_employee_id": actor_employee_id})
+        payload = TaskCommentCreate(
+            **{**payload.model_dump(), "author_employee_id": actor_employee_id}
+        )
 
     c = TaskComment(**payload.model_dump())
     session.add(c)
 
     try:
         session.flush()
-        log_activity(session, actor_employee_id=actor_employee_id, entity_type="task", entity_id=c.task_id, verb="commented")
+        log_activity(
+            session,
+            actor_employee_id=actor_employee_id,
+            entity_type="task",
+            entity_id=c.task_id,
+            verb="commented",
+        )
         session.commit()
     except IntegrityError:
         session.rollback()
@@ -172,5 +259,11 @@ def create_task_comment(payload: TaskCommentCreate, background: BackgroundTasks,
     session.refresh(c)
     task = session.get(Task, c.task_id)
     if task is not None:
-        background.add_task(notify_openclaw, session, NotifyContext(event="comment.created", actor_employee_id=actor_employee_id, task=task, comment=c))
+        background.add_task(
+            notify_openclaw,
+            session,
+            NotifyContext(
+                event="comment.created", actor_employee_id=actor_employee_id, task=task, comment=c
+            ),
+        )
     return TaskComment.model_validate(c)
diff --git a/backend/app/core/__pycache__/config.cpython-312.pyc b/backend/app/core/__pycache__/config.cpython-312.pyc
index 29ad631d1dcf6e941c86e23f0552e463f5ff4b1c..2695f548abf0cb8749b2d3ea767d4064a5ca15d4 100644
GIT binary patch
delta 55
zcmZ3=x|NmdG%qg~0}$|U-N-eIQQlKOBR@A)Ke0G5Be5tkPd}hC8OX>DD9X=DO)e>(
IyqWP60KR_`tN;K2

delta 39
tcmdnWx|EgcG%qg~0}vQ2-pDnJk>653BR@A)Ke0G5Be5tkZ}MTrPXNzZ3|;^L

diff --git a/backend/app/db/__pycache__/session.cpython-312.pyc b/backend/app/db/__pycache__/session.cpython-312.pyc
index 0d1077b347bf6e8eddc53bc97a942565b7d514c7..7d7d28362e8b937a41e70d7459061dea9b747208 100644
GIT binary patch
delta 57
zcmZ3$zJZ<lG%qg~0}wo)P`{BogHhf?KO;XkRX?#fF(a`kF;73BG8xFo4JgXbN=+^)
K-rU3}#{>ZVi4w#B

delta 41
vcmdnMzJQ(kG%qg~0}vQ2ZrI43!N_l+pOK%Ns-IY#n2}hNn74TnqZ|_e<kbtr

diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index 712d1f6..5f44c32 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -100,7 +100,9 @@ def build_message(ctx: NotifyContext) -> str:
             if len(snippet) > 180:
                 snippet = snippet[:177] + "..."
             snippet = f"\nComment: {snippet}"
-        return f"New comment on {base}.{snippet}\nWork ONE task only; reply/update in Mission Control."
+        return (
+            f"New comment on {base}.{snippet}\nWork ONE task only; reply/update in Mission Control."
+        )
 
     if ctx.event == "status.changed":
         return f"Status changed on {base} → {t.status}.\nWork ONE task only; update Mission Control with next step."
diff --git a/backend/app/integrations/openclaw.py b/backend/app/integrations/openclaw.py
index 26fba7d..b530112 100644
--- a/backend/app/integrations/openclaw.py
+++ b/backend/app/integrations/openclaw.py
@@ -19,7 +19,14 @@ class OpenClawClient:
             return None
         return cls(url, token)
 
-    def tools_invoke(self, tool: str, args: dict[str, Any], *, session_key: str | None = None, timeout_s: float = 5.0) -> dict[str, Any]:
+    def tools_invoke(
+        self,
+        tool: str,
+        args: dict[str, Any],
+        *,
+        session_key: str | None = None,
+        timeout_s: float = 5.0,
+    ) -> dict[str, Any]:
         payload: dict[str, Any] = {"tool": tool, "args": args}
         if session_key is not None:
             payload["sessionKey"] = session_key
diff --git a/backend/app/models/__init__.py b/backend/app/models/__init__.py
index 9bd9a65..85f0fd7 100644
--- a/backend/app/models/__init__.py
+++ b/backend/app/models/__init__.py
@@ -1,5 +1,5 @@
 from app.models.activity import Activity
-from app.models.org import Department, Team, Employee
+from app.models.org import Department, Employee, Team
 from app.models.projects import Project, ProjectMember
 from app.models.work import Task, TaskComment
 
diff --git a/backend/app/models/org.py b/backend/app/models/org.py
index 81a07c4..826841d 100644
--- a/backend/app/models/org.py
+++ b/backend/app/models/org.py
@@ -1,7 +1,5 @@
 from __future__ import annotations
 
-from typing import Optional
-
 from sqlmodel import Field, SQLModel
 
 
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
new file mode 100644
index 0000000..02f5b30
--- /dev/null
+++ b/backend/pyproject.toml
@@ -0,0 +1,9 @@
+[tool.black]
+line-length = 100
+target-version = ["py312"]
+extend-exclude = '(\.venv|alembic/versions)'
+
+[tool.isort]
+profile = "black"
+line_length = 100
+skip = [".venv", "alembic/versions"]
diff --git a/backend/requirements-dev.txt b/backend/requirements-dev.txt
new file mode 100644
index 0000000..4d45217
--- /dev/null
+++ b/backend/requirements-dev.txt
@@ -0,0 +1,4 @@
+black==24.10.0
+isort==5.13.2
+flake8==7.1.1
+pre-commit==4.1.0
diff --git a/backend/scripts/lint.sh b/backend/scripts/lint.sh
new file mode 100755
index 0000000..36a0808
--- /dev/null
+++ b/backend/scripts/lint.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+. .venv/bin/activate
+
+python -m black .
+python -m isort .
+python -m flake8 .
diff --git a/frontend/public/file.svg b/frontend/public/file.svg
index 004145c..16fe3d3 100644
--- a/frontend/public/file.svg
+++ b/frontend/public/file.svg
@@ -1 +1 @@
-<svg fill="none" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><path d="M14.5 13.5V5.41a1 1 0 0 0-.3-.7L9.8.29A1 1 0 0 0 9.08 0H1.5v13.5A2.5 2.5 0 0 0 4 16h8a2.5 2.5 0 0 0 2.5-2.5m-1.5 0v-7H8v-5H3v12a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1M9.5 5V2.12L12.38 5zM5.13 5h-.62v1.25h2.12V5zm-.62 3h7.12v1.25H4.5zm.62 3h-.62v1.25h7.12V11z" clip-rule="evenodd" fill="#666" fill-rule="evenodd"/></svg>
\ No newline at end of file
+<svg fill="none" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><path d="M14.5 13.5V5.41a1 1 0 0 0-.3-.7L9.8.29A1 1 0 0 0 9.08 0H1.5v13.5A2.5 2.5 0 0 0 4 16h8a2.5 2.5 0 0 0 2.5-2.5m-1.5 0v-7H8v-5H3v12a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1M9.5 5V2.12L12.38 5zM5.13 5h-.62v1.25h2.12V5zm-.62 3h7.12v1.25H4.5zm.62 3h-.62v1.25h7.12V11z" clip-rule="evenodd" fill="#666" fill-rule="evenodd"/></svg>
diff --git a/frontend/public/globe.svg b/frontend/public/globe.svg
index 567f17b..c7215fe 100644
--- a/frontend/public/globe.svg
+++ b/frontend/public/globe.svg
@@ -1 +1 @@
-<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><g clip-path="url(#a)"><path fill-rule="evenodd" clip-rule="evenodd" d="M10.27 14.1a6.5 6.5 0 0 0 3.67-3.45q-1.24.21-2.7.34-.31 1.83-.97 3.1M8 16A8 8 0 1 0 8 0a8 8 0 0 0 0 16m.48-1.52a7 7 0 0 1-.96 0H7.5a4 4 0 0 1-.84-1.32q-.38-.89-.63-2.08a40 40 0 0 0 3.92 0q-.25 1.2-.63 2.08a4 4 0 0 1-.84 1.31zm2.94-4.76q1.66-.15 2.95-.43a7 7 0 0 0 0-2.58q-1.3-.27-2.95-.43a18 18 0 0 1 0 3.44m-1.27-3.54a17 17 0 0 1 0 3.64 39 39 0 0 1-4.3 0 17 17 0 0 1 0-3.64 39 39 0 0 1 4.3 0m1.1-1.17q1.45.13 2.69.34a6.5 6.5 0 0 0-3.67-3.44q.65 1.26.98 3.1M8.48 1.5l.01.02q.41.37.84 1.31.38.89.63 2.08a40 40 0 0 0-3.92 0q.25-1.2.63-2.08a4 4 0 0 1 .85-1.32 7 7 0 0 1 .96 0m-2.75.4a6.5 6.5 0 0 0-3.67 3.44 29 29 0 0 1 2.7-.34q.31-1.83.97-3.1M4.58 6.28q-1.66.16-2.95.43a7 7 0 0 0 0 2.58q1.3.27 2.95.43a18 18 0 0 1 0-3.44m.17 4.71q-1.45-.12-2.69-.34a6.5 6.5 0 0 0 3.67 3.44q-.65-1.27-.98-3.1" fill="#666"/></g><defs><clipPath id="a"><path fill="#fff" d="M0 0h16v16H0z"/></clipPath></defs></svg>
\ No newline at end of file
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><g clip-path="url(#a)"><path fill-rule="evenodd" clip-rule="evenodd" d="M10.27 14.1a6.5 6.5 0 0 0 3.67-3.45q-1.24.21-2.7.34-.31 1.83-.97 3.1M8 16A8 8 0 1 0 8 0a8 8 0 0 0 0 16m.48-1.52a7 7 0 0 1-.96 0H7.5a4 4 0 0 1-.84-1.32q-.38-.89-.63-2.08a40 40 0 0 0 3.92 0q-.25 1.2-.63 2.08a4 4 0 0 1-.84 1.31zm2.94-4.76q1.66-.15 2.95-.43a7 7 0 0 0 0-2.58q-1.3-.27-2.95-.43a18 18 0 0 1 0 3.44m-1.27-3.54a17 17 0 0 1 0 3.64 39 39 0 0 1-4.3 0 17 17 0 0 1 0-3.64 39 39 0 0 1 4.3 0m1.1-1.17q1.45.13 2.69.34a6.5 6.5 0 0 0-3.67-3.44q.65 1.26.98 3.1M8.48 1.5l.01.02q.41.37.84 1.31.38.89.63 2.08a40 40 0 0 0-3.92 0q.25-1.2.63-2.08a4 4 0 0 1 .85-1.32 7 7 0 0 1 .96 0m-2.75.4a6.5 6.5 0 0 0-3.67 3.44 29 29 0 0 1 2.7-.34q.31-1.83.97-3.1M4.58 6.28q-1.66.16-2.95.43a7 7 0 0 0 0 2.58q1.3.27 2.95.43a18 18 0 0 1 0-3.44m.17 4.71q-1.45-.12-2.69-.34a6.5 6.5 0 0 0 3.67 3.44q-.65-1.27-.98-3.1" fill="#666"/></g><defs><clipPath id="a"><path fill="#fff" d="M0 0h16v16H0z"/></clipPath></defs></svg>
diff --git a/frontend/public/next.svg b/frontend/public/next.svg
index 5174b28..5bb00d4 100644
--- a/frontend/public/next.svg
+++ b/frontend/public/next.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>
diff --git a/frontend/public/vercel.svg b/frontend/public/vercel.svg
index 7705396..5215157 100644
--- a/frontend/public/vercel.svg
+++ b/frontend/public/vercel.svg
@@ -1 +1 @@
-<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1155 1000"><path d="m577.3 0 577.4 1000H0z" fill="#fff"/></svg>
\ No newline at end of file
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1155 1000"><path d="m577.3 0 577.4 1000H0z" fill="#fff"/></svg>
diff --git a/frontend/public/window.svg b/frontend/public/window.svg
index b2b2a44..d05e7a1 100644
--- a/frontend/public/window.svg
+++ b/frontend/public/window.svg
@@ -1 +1 @@
-<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path fill-rule="evenodd" clip-rule="evenodd" d="M1.5 2.5h13v10a1 1 0 0 1-1 1h-11a1 1 0 0 1-1-1zM0 1h16v11.5a2.5 2.5 0 0 1-2.5 2.5h-11A2.5 2.5 0 0 1 0 12.5zm3.75 4.5a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5M7 4.75a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0m1.75.75a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5" fill="#666"/></svg>
\ No newline at end of file
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path fill-rule="evenodd" clip-rule="evenodd" d="M1.5 2.5h13v10a1 1 0 0 1-1 1h-11a1 1 0 0 1-1-1zM0 1h16v11.5a2.5 2.5 0 0 1-2.5 2.5h-11A2.5 2.5 0 0 1 0 12.5zm3.75 4.5a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5M7 4.75a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0m1.75.75a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5" fill="#666"/></svg>

From 61aaee02141b9d4976876c70a0b107b120f07783 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:32:38 +0530
Subject: [PATCH 12/27] feat(notify): dispatch actionable instructions to
 assigned agents

---
 backend/app/integrations/notify.py | 59 +++++++++++++++++++++++-------
 1 file changed, 45 insertions(+), 14 deletions(-)

diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index 5f44c32..5bcd307 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -20,20 +20,19 @@ class NotifyContext:
     changed_fields: dict | None = None
 
 
-def _employee_session_keys(session: Session, employee_ids: Iterable[int]) -> list[str]:
+def _employees_with_session_keys(session: Session, employee_ids: Iterable[int]) -> list[Employee]:
     ids = sorted({i for i in employee_ids if i is not None})
     if not ids:
         return []
 
     emps = session.exec(select(Employee).where(Employee.id.in_(ids))).all()
-    keys: list[str] = []
+    out: list[Employee] = []
     for e in emps:
         if not getattr(e, "notify_enabled", True):
             continue
-        sk = getattr(e, "openclaw_session_key", None)
-        if sk:
-            keys.append(sk)
-    return sorted(set(keys))
+        if getattr(e, "openclaw_session_key", None):
+            out.append(e)
+    return out
 
 
 def _project_pm_employee_ids(session: Session, project_id: int) -> set[int]:
@@ -86,12 +85,35 @@ def resolve_recipients(session: Session, ctx: NotifyContext) -> set[int]:
     return recipients
 
 
-def build_message(ctx: NotifyContext) -> str:
+def build_message(ctx: NotifyContext, recipient: Employee) -> str:
     t = ctx.task
     base = f"Task #{t.id}: {t.title}" if t.id is not None else f"Task: {t.title}"
 
+    # Agent-specific dispatch instructions. These notifications should result in the agent
+    # taking concrete actions in Mission Control, not just acknowledging.
+    if ctx.event in {"task.created", "task.assigned"} and recipient.employee_type == "agent":
+        desc = (t.description or "").strip()
+        if len(desc) > 500:
+            desc = desc[:497] + "..."
+        desc_block = f"\n\nDescription:\n{desc}" if desc else ""
+
+        # Keep this deterministic: agents already have base URL + header guidance in their prompt.
+        return (
+            f"{base}\n\n"
+            "You are the assignee. Start NOW:\n"
+            f"1) PATCH /tasks/{t.id} → status=in_progress (use X-Actor-Employee-Id: {recipient.id})\n"
+            f"2) POST /task-comments → task_id={t.id} with a 1-2 line plan + next action\n"
+            "3) Do the work\n"
+            "4) POST /task-comments → progress updates\n"
+            f"5) When complete: PATCH /tasks/{t.id} → status=done and post a final summary comment"
+            f"{desc_block}"
+        )
+
     if ctx.event == "task.assigned":
-        return f"Assigned: {base}.\nWork ONE task only; update Mission Control with a comment when you make progress."
+        return (
+            f"Assigned: {base}.\n"
+            "Work ONE task only; update Mission Control with a comment when you make progress."
+        )
 
     if ctx.event == "comment.created":
         snippet = ""
@@ -105,10 +127,16 @@ def build_message(ctx: NotifyContext) -> str:
         )
 
     if ctx.event == "status.changed":
-        return f"Status changed on {base} → {t.status}.\nWork ONE task only; update Mission Control with next step."
+        return (
+            f"Status changed on {base} → {t.status}.\n"
+            "Work ONE task only; update Mission Control with next step."
+        )
 
     if ctx.event == "task.created":
-        return f"New task created: {base}.\nWork ONE task only; add acceptance criteria / next step in Mission Control."
+        return (
+            f"New task created: {base}.\n"
+            "Work ONE task only; add acceptance criteria / next step in Mission Control."
+        )
 
     return f"Update on {base}.\nWork ONE task only; update Mission Control."
 
@@ -119,13 +147,16 @@ def notify_openclaw(session: Session, ctx: NotifyContext) -> None:
         return
 
     recipient_ids = resolve_recipients(session, ctx)
-    session_keys = _employee_session_keys(session, recipient_ids)
-    if not session_keys:
+    recipients = _employees_with_session_keys(session, recipient_ids)
+    if not recipients:
         return
 
-    message = build_message(ctx)
+    for e in recipients:
+        sk = getattr(e, "openclaw_session_key", None)
+        if not sk:
+            continue
 
-    for sk in session_keys:
+        message = build_message(ctx, recipient=e)
         try:
             client.tools_invoke(
                 "sessions_send",

From 56dd0ee544d8efcb31aef12fc5b9bcdeb7619606 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:38:54 +0530
Subject: [PATCH 13/27] feat(ui): add Task Trigger button + backend dispatch
 endpoint

---
 backend/app/api/work.py                 |  26 +++
 frontend/src/api/generated/work/work.ts | 116 ++++++++++
 frontend/src/app/projects/[id]/page.tsx | 281 ++++++++++++++++++------
 3 files changed, 361 insertions(+), 62 deletions(-)

diff --git a/backend/app/api/work.py b/backend/app/api/work.py
index 2a01510..bb1de89 100644
--- a/backend/app/api/work.py
+++ b/backend/app/api/work.py
@@ -102,6 +102,32 @@ def create_task(
     return Task.model_validate(task)
 
 
+@router.post("/tasks/{task_id}/dispatch")
+def dispatch_task(
+    task_id: int,
+    background: BackgroundTasks,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
+    task = session.get(Task, task_id)
+    if not task:
+        raise HTTPException(status_code=404, detail="Task not found")
+
+    if task.assignee_employee_id is None:
+        raise HTTPException(status_code=400, detail="Task has no assignee")
+
+    _validate_task_assignee(session, task.assignee_employee_id)
+
+    # Best-effort: enqueue an agent dispatch. This does not mutate the task.
+    background.add_task(
+        notify_openclaw,
+        session,
+        NotifyContext(event="task.assigned", actor_employee_id=actor_employee_id, task=task),
+    )
+
+    return {"ok": True}
+
+
 @router.patch("/tasks/{task_id}", response_model=Task)
 def update_task(
     task_id: int,
diff --git a/frontend/src/api/generated/work/work.ts b/frontend/src/api/generated/work/work.ts
index 6ad2a47..505d893 100644
--- a/frontend/src/api/generated/work/work.ts
+++ b/frontend/src/api/generated/work/work.ts
@@ -351,6 +351,122 @@ export const useCreateTaskTasksPost = <
     queryClient,
   );
 };
+/**
+ * @summary Dispatch Task
+ */
+export type dispatchTaskTasksTaskIdDispatchPostResponse200 = {
+  data: unknown;
+  status: 200;
+};
+
+export type dispatchTaskTasksTaskIdDispatchPostResponse422 = {
+  data: HTTPValidationError;
+  status: 422;
+};
+
+export type dispatchTaskTasksTaskIdDispatchPostResponseSuccess =
+  dispatchTaskTasksTaskIdDispatchPostResponse200 & {
+    headers: Headers;
+  };
+export type dispatchTaskTasksTaskIdDispatchPostResponseError =
+  dispatchTaskTasksTaskIdDispatchPostResponse422 & {
+    headers: Headers;
+  };
+
+export type dispatchTaskTasksTaskIdDispatchPostResponse =
+  | dispatchTaskTasksTaskIdDispatchPostResponseSuccess
+  | dispatchTaskTasksTaskIdDispatchPostResponseError;
+
+export const getDispatchTaskTasksTaskIdDispatchPostUrl = (taskId: number) => {
+  return `/tasks/${taskId}/dispatch`;
+};
+
+export const dispatchTaskTasksTaskIdDispatchPost = async (
+  taskId: number,
+  options?: RequestInit,
+): Promise<dispatchTaskTasksTaskIdDispatchPostResponse> => {
+  return customFetch<dispatchTaskTasksTaskIdDispatchPostResponse>(
+    getDispatchTaskTasksTaskIdDispatchPostUrl(taskId),
+    {
+      ...options,
+      method: "POST",
+    },
+  );
+};
+
+export const getDispatchTaskTasksTaskIdDispatchPostMutationOptions = <
+  TError = HTTPValidationError,
+  TContext = unknown,
+>(options?: {
+  mutation?: UseMutationOptions<
+    Awaited<ReturnType<typeof dispatchTaskTasksTaskIdDispatchPost>>,
+    TError,
+    { taskId: number },
+    TContext
+  >;
+  request?: SecondParameter<typeof customFetch>;
+}): UseMutationOptions<
+  Awaited<ReturnType<typeof dispatchTaskTasksTaskIdDispatchPost>>,
+  TError,
+  { taskId: number },
+  TContext
+> => {
+  const mutationKey = ["dispatchTaskTasksTaskIdDispatchPost"];
+  const { mutation: mutationOptions, request: requestOptions } = options
+    ? options.mutation &&
+      "mutationKey" in options.mutation &&
+      options.mutation.mutationKey
+      ? options
+      : { ...options, mutation: { ...options.mutation, mutationKey } }
+    : { mutation: { mutationKey }, request: undefined };
+
+  const mutationFn: MutationFunction<
+    Awaited<ReturnType<typeof dispatchTaskTasksTaskIdDispatchPost>>,
+    { taskId: number }
+  > = (props) => {
+    const { taskId } = props ?? {};
+
+    return dispatchTaskTasksTaskIdDispatchPost(taskId, requestOptions);
+  };
+
+  return { mutationFn, ...mutationOptions };
+};
+
+export type DispatchTaskTasksTaskIdDispatchPostMutationResult = NonNullable<
+  Awaited<ReturnType<typeof dispatchTaskTasksTaskIdDispatchPost>>
+>;
+
+export type DispatchTaskTasksTaskIdDispatchPostMutationError =
+  HTTPValidationError;
+
+/**
+ * @summary Dispatch Task
+ */
+export const useDispatchTaskTasksTaskIdDispatchPost = <
+  TError = HTTPValidationError,
+  TContext = unknown,
+>(
+  options?: {
+    mutation?: UseMutationOptions<
+      Awaited<ReturnType<typeof dispatchTaskTasksTaskIdDispatchPost>>,
+      TError,
+      { taskId: number },
+      TContext
+    >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+  queryClient?: QueryClient,
+): UseMutationResult<
+  Awaited<ReturnType<typeof dispatchTaskTasksTaskIdDispatchPost>>,
+  TError,
+  { taskId: number },
+  TContext
+> => {
+  return useMutation(
+    getDispatchTaskTasksTaskIdDispatchPostMutationOptions(options),
+    queryClient,
+  );
+};
 /**
  * @summary Update Task
  */
diff --git a/frontend/src/app/projects/[id]/page.tsx b/frontend/src/app/projects/[id]/page.tsx
index c1fe7df..253faeb 100644
--- a/frontend/src/app/projects/[id]/page.tsx
+++ b/frontend/src/app/projects/[id]/page.tsx
@@ -4,7 +4,13 @@ import { useState } from "react";
 import { useParams } from "next/navigation";
 
 import { Button } from "@/components/ui/button";
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card";
 import { Input } from "@/components/ui/input";
 
 import { Select } from "@/components/ui/select";
@@ -14,15 +20,16 @@ import { useListProjectsProjectsGet } from "@/api/generated/projects/projects";
 import { useListEmployeesEmployeesGet } from "@/api/generated/org/org";
 import {
   useCreateTaskTasksPost,
+  useDeleteTaskTasksTaskIdDelete,
+  useDispatchTaskTasksTaskIdDispatchPost,
+  useListTaskCommentsTaskCommentsGet,
   useListTasksTasksGet,
   useUpdateTaskTasksTaskIdPatch,
-  useDeleteTaskTasksTaskIdDelete,
   useCreateTaskCommentTaskCommentsPost,
-  useListTaskCommentsTaskCommentsGet,
 } from "@/api/generated/work/work";
 import {
-  useListProjectMembersProjectsProjectIdMembersGet,
   useAddProjectMemberProjectsProjectIdMembersPost,
+  useListProjectMembersProjectsProjectIdMembersGet,
   useRemoveProjectMemberProjectsProjectIdMembersMemberIdDelete,
   useUpdateProjectMemberProjectsProjectIdMembersMemberIdPatch,
 } from "@/api/generated/projects/projects";
@@ -51,7 +58,10 @@ export default function ProjectDetailPage() {
 
   const employees = useListEmployeesEmployeesGet();
   const employeeList = employees.data?.status === 200 ? employees.data.data : [];
-  const eligibleAssignees = employeeList.filter((e) => e.employee_type !== "agent" || !!e.openclaw_session_key);
+
+  const eligibleAssignees = employeeList.filter(
+    (e) => e.employee_type !== "agent" || !!e.openclaw_session_key,
+  );
 
   const members = useListProjectMembersProjectsProjectIdMembersGet(projectId);
   const memberList = members.data?.status === 200 ? members.data.data : [];
@@ -76,6 +86,11 @@ export default function ProjectDetailPage() {
   const deleteTask = useDeleteTaskTasksTaskIdDelete({
     mutation: { onSuccess: () => tasks.refetch() },
   });
+  const dispatchTask = useDispatchTaskTasksTaskIdDispatchPost({
+    mutation: {
+      onSuccess: () => tasks.refetch(),
+    },
+  });
 
   const [title, setTitle] = useState("");
   const [description, setDescription] = useState("");
@@ -110,6 +125,11 @@ export default function ProjectDetailPage() {
     return map;
   })();
 
+  const employeeById = new Map<number, (typeof employeeList)[number]>();
+  for (const e of employeeList) {
+    if (e.id != null) employeeById.set(Number(e.id), e);
+  }
+
   const employeeName = (id: number | null | undefined) =>
     employeeList.find((e) => e.id === id)?.name ?? "—";
 
@@ -128,16 +148,40 @@ export default function ProjectDetailPage() {
       {projects.isLoading || employees.isLoading || members.isLoading || tasks.isLoading ? (
         <div className="mb-4 text-sm text-muted-foreground">Loading…</div>
       ) : null}
-      {projects.error ? <div className="mb-4 text-sm text-destructive">{(projects.error as Error).message}</div> : null}
-      {employees.error ? <div className="mb-4 text-sm text-destructive">{(employees.error as Error).message}</div> : null}
-      {members.error ? <div className="mb-4 text-sm text-destructive">{(members.error as Error).message}</div> : null}
-      {tasks.error ? <div className="mb-4 text-sm text-destructive">{(tasks.error as Error).message}</div> : null}
+      {projects.error ? (
+        <div className="mb-4 text-sm text-destructive">
+          {(projects.error as Error).message}
+        </div>
+      ) : null}
+      {employees.error ? (
+        <div className="mb-4 text-sm text-destructive">
+          {(employees.error as Error).message}
+        </div>
+      ) : null}
+      {members.error ? (
+        <div className="mb-4 text-sm text-destructive">{(members.error as Error).message}</div>
+      ) : null}
+      {tasks.error ? (
+        <div className="mb-4 text-sm text-destructive">{(tasks.error as Error).message}</div>
+      ) : null}
+
       <div className="flex items-start justify-between gap-4">
         <div>
-          <h1 className="text-2xl font-semibold tracking-tight">{project?.name ?? `Project #${projectId}`}</h1>
-          <p className="mt-1 text-sm text-muted-foreground">Project detail: staffing + tasks.</p>
+          <h1 className="text-2xl font-semibold tracking-tight">
+            {project?.name ?? `Project #${projectId}`}
+          </h1>
+          <p className="mt-1 text-sm text-muted-foreground">
+            Project detail: staffing + tasks.
+          </p>
         </div>
-        <Button variant="outline" onClick={() => { tasks.refetch(); members.refetch(); }} disabled={tasks.isFetching || members.isFetching}>
+        <Button
+          variant="outline"
+          onClick={() => {
+            tasks.refetch();
+            members.refetch();
+          }}
+          disabled={tasks.isFetching || members.isFetching}
+        >
           Refresh
         </Button>
       </div>
@@ -149,14 +193,31 @@ export default function ProjectDetailPage() {
             <CardDescription>Project-scoped tasks</CardDescription>
           </CardHeader>
           <CardContent className="space-y-3">
-            {createTask.error ? <div className="text-sm text-destructive">{(createTask.error as Error).message}</div> : null}
-            <Input placeholder="Title" value={title} onChange={(e) => setTitle(e.target.value)} />
-            <Textarea placeholder="Description" value={description} onChange={(e) => setDescription(e.target.value)} />
+            {createTask.error ? (
+              <div className="text-sm text-destructive">
+                {(createTask.error as Error).message}
+              </div>
+            ) : null}
+            <Input
+              placeholder="Title"
+              value={title}
+              onChange={(e) => setTitle(e.target.value)}
+            />
+            <Textarea
+              placeholder="Description"
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+            />
             <div className="grid grid-cols-1 gap-2">
-              <Select value={assigneeId} onChange={(e) => setAssigneeId(e.target.value)}>
+              <Select
+                value={assigneeId}
+                onChange={(e) => setAssigneeId(e.target.value)}
+              >
                 <option value="">Assignee</option>
                 {eligibleAssignees.map((e) => (
-                  <option key={e.id ?? e.name} value={e.id ?? ""}>{e.name}</option>
+                  <option key={e.id ?? e.name} value={e.id ?? ""}>
+                    {e.name}
+                  </option>
                 ))}
               </Select>
             </div>
@@ -185,28 +246,43 @@ export default function ProjectDetailPage() {
             <CardDescription>Project members</CardDescription>
           </CardHeader>
           <CardContent className="space-y-2">
-            <Select onChange={(e) => {
-              const empId = e.target.value;
-              if (!empId) return;
-              addMember.mutate({ projectId, data: { project_id: projectId, employee_id: Number(empId), role: "member" } });
-              e.currentTarget.value = "";
-            }}>
+            <Select
+              onChange={(e) => {
+                const empId = e.target.value;
+                if (!empId) return;
+                addMember.mutate({
+                  projectId,
+                  data: { project_id: projectId, employee_id: Number(empId), role: "member" },
+                });
+                e.currentTarget.value = "";
+              }}
+            >
               <option value="">Add member…</option>
               {eligibleAssignees.map((e) => (
-                <option key={e.id ?? e.name} value={e.id ?? ""}>{e.name}</option>
+                <option key={e.id ?? e.name} value={e.id ?? ""}>
+                  {e.name}
+                </option>
               ))}
             </Select>
             {addMember.error ? (
-              <div className="text-xs text-destructive">{(addMember.error as Error).message}</div>
+              <div className="text-xs text-destructive">
+                {(addMember.error as Error).message}
+              </div>
             ) : null}
             <ul className="space-y-2">
               {projectMembers.map((m) => (
-                <li key={m.id ?? `${m.project_id}-${m.employee_id}`} className="rounded-md border p-2 text-sm">
+                <li
+                  key={m.id ?? `${m.project_id}-${m.employee_id}`}
+                  className="rounded-md border p-2 text-sm"
+                >
                   <div className="flex items-center justify-between gap-2">
                     <div>{employeeName(m.employee_id)}</div>
                     <Button
                       variant="outline"
-                      onClick={() => { if (m.id == null) return; removeMember.mutate({ projectId, memberId: Number(m.id) }); }}
+                      onClick={() => {
+                        if (m.id == null) return;
+                        removeMember.mutate({ projectId, memberId: Number(m.id) });
+                      }}
                     >
                       Remove
                     </Button>
@@ -216,17 +292,25 @@ export default function ProjectDetailPage() {
                       placeholder="Role (e.g., PM, QA, Dev)"
                       defaultValue={m.role ?? ""}
                       onBlur={(e) =>
-                        m.id == null ? undefined : updateMember.mutate({
-                          projectId,
-                          memberId: Number(m.id),
-                          data: { project_id: projectId, employee_id: m.employee_id, role: e.currentTarget.value || null },
-                        })
+                        m.id == null
+                          ? undefined
+                          : updateMember.mutate({
+                              projectId,
+                              memberId: Number(m.id),
+                              data: {
+                                project_id: projectId,
+                                employee_id: m.employee_id,
+                                role: e.currentTarget.value || null,
+                              },
+                            })
                       }
                     />
                   </div>
                 </li>
               ))}
-              {projectMembers.length === 0 ? <li className="text-sm text-muted-foreground">No members yet.</li> : null}
+              {projectMembers.length === 0 ? (
+                <li className="text-sm text-muted-foreground">No members yet.</li>
+              ) : null}
             </ul>
           </CardContent>
         </Card>
@@ -237,36 +321,93 @@ export default function ProjectDetailPage() {
           {STATUSES.map((s) => (
             <Card key={s}>
               <CardHeader>
-                <CardTitle className="text-sm uppercase tracking-wide">{s.replace("_", " ")}</CardTitle>
+                <CardTitle className="text-sm uppercase tracking-wide">
+                  {s.replace("_", " ")}
+                </CardTitle>
                 <CardDescription>{tasksByStatus.get(s)?.length ?? 0} tasks</CardDescription>
               </CardHeader>
               <CardContent className="space-y-2">
-                {(tasksByStatus.get(s) ?? []).map((t) => (
-                  <div key={t.id ?? t.title} className="rounded-md border p-2 text-sm">
-                    <div className="font-medium">{t.title}</div>
-                    <div className="text-xs text-muted-foreground">Assignee: {employeeName(t.assignee_employee_id)}</div>
-                    <div className="mt-2 flex flex-wrap gap-1">
-                      {STATUSES.filter((x) => x !== s).map((x) => (
+                {(tasksByStatus.get(s) ?? []).map((t) => {
+                  const assignee =
+                    t.assignee_employee_id != null
+                      ? employeeById.get(Number(t.assignee_employee_id))
+                      : undefined;
+
+                  const canTrigger = Boolean(
+                    t.id != null &&
+                      assignee &&
+                      assignee.employee_type === "agent" &&
+                      assignee.openclaw_session_key,
+                  );
+
+                  return (
+                    <div key={t.id ?? t.title} className="rounded-md border p-2 text-sm">
+                      <div className="font-medium">{t.title}</div>
+                      <div className="text-xs text-muted-foreground">
+                        Assignee: {employeeName(t.assignee_employee_id)}
+                      </div>
+
+                      <div className="mt-2 flex flex-wrap gap-1">
+                        {STATUSES.filter((x) => x !== s).map((x) => (
+                          <Button
+                            key={x}
+                            variant="outline"
+                            size="sm"
+                            onClick={() =>
+                              updateTask.mutate({
+                                taskId: Number(t.id),
+                                data: { status: x },
+                              })
+                            }
+                          >
+                            {x}
+                          </Button>
+                        ))}
+                      </div>
+
+                      <div className="mt-2 flex flex-wrap gap-2">
                         <Button
-                          key={x}
                           variant="outline"
                           size="sm"
-                          onClick={() => updateTask.mutate({ taskId: Number(t.id), data: { status: x } })}
+                          onClick={() => {
+                            setCommentTaskId(Number(t.id));
+                            setReplyToCommentId(null);
+                          }}
                         >
-                          {x}
+                          Comments
                         </Button>
-                      ))}
+
+                        <Button
+                          variant="outline"
+                          size="sm"
+                          onClick={() => dispatchTask.mutate({ taskId: Number(t.id) })}
+                          disabled={!canTrigger || dispatchTask.isPending}
+                          title={
+                            canTrigger
+                              ? "Send a dispatch message to the assigned agent"
+                              : "Only available when the assignee is a provisioned agent"
+                          }
+                        >
+                          Trigger
+                        </Button>
+
+                        <Button
+                          variant="destructive"
+                          size="sm"
+                          onClick={() => deleteTask.mutate({ taskId: Number(t.id) })}
+                        >
+                          Delete
+                        </Button>
+                      </div>
+
+                      {dispatchTask.error ? (
+                        <div className="mt-2 text-xs text-destructive">
+                          {(dispatchTask.error as Error).message}
+                        </div>
+                      ) : null}
                     </div>
-                    <div className="mt-2 flex gap-2">
-                      <Button variant="outline" size="sm" onClick={() => { setCommentTaskId(Number(t.id)); setReplyToCommentId(null); }}>
-                        Comments
-                      </Button>
-                      <Button variant="destructive" size="sm" onClick={() => deleteTask.mutate({ taskId: Number(t.id) })}>
-                        Delete
-                      </Button>
-                    </div>
-                  </div>
-                ))}
+                  );
+                })}
                 {(tasksByStatus.get(s) ?? []).length === 0 ? (
                   <div className="text-xs text-muted-foreground">No tasks</div>
                 ) : null}
@@ -283,12 +424,20 @@ export default function ProjectDetailPage() {
             <CardDescription>{commentTaskId ? `Task #${commentTaskId}` : "Select a task"}</CardDescription>
           </CardHeader>
           <CardContent className="space-y-3">
-            {addComment.error ? <div className="text-sm text-destructive">{(addComment.error as Error).message}</div> : null}
+            {addComment.error ? (
+              <div className="text-sm text-destructive">{(addComment.error as Error).message}</div>
+            ) : null}
             {replyToCommentId ? (
               <div className="rounded-md border bg-muted/40 p-2 text-sm">
                 <div className="flex items-center justify-between gap-2">
-                  <div className="text-xs text-muted-foreground">Replying to comment #{replyToCommentId}</div>
-                  <Button variant="outline" size="sm" onClick={() => setReplyToCommentId(null)}>
+                  <div className="text-xs text-muted-foreground">
+                    Replying to comment #{replyToCommentId}
+                  </div>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    onClick={() => setReplyToCommentId(null)}
+                  >
                     Cancel reply
                   </Button>
                 </div>
@@ -324,17 +473,25 @@ export default function ProjectDetailPage() {
                   <div className="flex items-start justify-between gap-2">
                     <div>
                       <div className="font-medium">{employeeName(c.author_employee_id)}</div>
-                      <div className="text-xs text-muted-foreground">{(c.created_at ? new Date(c.created_at).toLocaleString() : "—")}</div>
+                      <div className="text-xs text-muted-foreground">
+                        {c.created_at ? new Date(c.created_at).toLocaleString() : "—"}
+                      </div>
                     </div>
-                    <Button variant="outline" size="sm" onClick={() => setReplyToCommentId(Number(c.id))}>
+                    <Button
+                      variant="outline"
+                      size="sm"
+                      onClick={() => setReplyToCommentId(Number(c.id))}
+                    >
                       Reply
                     </Button>
                   </div>
-                  {(c.reply_to_comment_id ? (
+                  {c.reply_to_comment_id ? (
                     <div className="mt-2 rounded-md border bg-muted/40 p-2 text-xs">
-                      <div className="text-muted-foreground">Replying to #{c.reply_to_comment_id}: {commentById.get(Number(c.reply_to_comment_id))?.body ?? "—"}</div>
+                      <div className="text-muted-foreground">
+                        Replying to #{c.reply_to_comment_id}: {commentById.get(Number(c.reply_to_comment_id))?.body ?? "—"}
+                      </div>
                     </div>
-                  ) : null)}
+                  ) : null}
                   <div className="mt-2">{c.body}</div>
                 </li>
               ))}

From dcf6dde009da951e37aec8186863c085c98e80f7 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:39:04 +0530
Subject: [PATCH 14/27] chore: remove stray __pycache__

---
 backend/app/db/__pycache__/base.cpython-312.pyc   | Bin 396 -> 0 bytes
 .../app/db/__pycache__/session.cpython-312.pyc    | Bin 944 -> 0 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 backend/app/db/__pycache__/base.cpython-312.pyc
 delete mode 100644 backend/app/db/__pycache__/session.cpython-312.pyc

diff --git a/backend/app/db/__pycache__/base.cpython-312.pyc b/backend/app/db/__pycache__/base.cpython-312.pyc
deleted file mode 100644
index 57ba8e71a4512a4cdaa9201ea3c31ca827dd2799..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 396
zcmXw#u};G<5QguP6s4twg*QM#3KI1TAdnD<4OL?6V!5$J3UQL!EhrO9k$8hX1L9G5
z0ThXei47^RbmE*84|m^h|7YL%Z7}Eot^KFR={4m~C;nGw1N8yH3M5EOLE{(^Jh%ku
zEkXJUU;WlM_R1jYd^r(ewR^7OR2VUz-m5cVRot4|h#OJ&309zBj1s6GBd-da`zrFQ
zkn>Dv#d+1^T<3C;I_`5mTZpthd4by9w7y_Tt`!qjB=ls)MrBN(M<%~j@!Yb!P#Jae
za3pRBN;VPkoysH=MZx5Rq*cSBG;ZJ~1O(QpCA<frabMKzyS8@hEEQ>-C|wS7qm7%s
ot?W8#yxT<U@VIUI#0*Hfk?kIZZyymq;P7V)vHN`b3zV9wKi6Sg;s5{u

diff --git a/backend/app/db/__pycache__/session.cpython-312.pyc b/backend/app/db/__pycache__/session.cpython-312.pyc
deleted file mode 100644
index 7d7d28362e8b937a41e70d7459061dea9b747208..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 944
zcmY*X&1(}u6o0dyN!qj(Y<louupYXQcJYvdARblJmP$`ugk`cjO_T0NoY{~D6pQqv
zmm*?3deB3ug8zr7fKplXAR^UUC5KA!;G2B3Ixug4@6FDe_xru~KA+D4u7jP2wM7E(
zO**5c4FKt_A?Sb)J_#Ts4j~dNffA~Y8fuOf>W<!zseuuij!8fPrZclXHA;2*^|d$p
zo-**Ate^FbZOzH~<~BHE?TnTCDUU3Yj?pNJ6PncGNLXrWt}r1Gr<s*Iw-;ld1!>;n
zj3&%wQMDE^ypj<tNorA5Tti1=-g@kvz6+qDgPZhjBIrPJa#kOfa}q#M*Z=hfI59@C
zJ(Nl=0&UnOOP0pv?`bAv3H510)7-E&8U(2^C~y~g^2+fIdp!=BO$A-2oJRI?+d~j8
z^SI8uMA&hIMP5K#^R$YfZC9wb!6M(LjfU-4Y%$Pbq0vswT2xD1zrxR8UfD)bK(hs(
zwefvzx~om^YsIcsd{y|U&GAV*`cDo?W>(5^7r`y0f|3kr0VF4qjHs630o;e@N@vi0
zoPbdmr3kZd2?S{=1XeMVjBKi_&?0Zu7U8lqOW|^ycwS<XnnM~wzF6dPPSUX|OWa|c
zpT)=oZZU`E2mD4>*{NrRC+81==!F;8KTS+O&L63Wk7VGNG=GG=^=PU@p6W%llP!^#
zx@EpLOV}YLH8@L}JW92t7^h`C&AIMc6C=!Zxf~4~pL;<lCu>lt>?oHarIRTAf){g!
zCR(dixhbRLve6YPnA_w*pI5&R{mQv4y)Sv6+HvLzCT<4oDnEw@lCzjcbEpzRzQBb8
mD0iX!9WH*&7IrrGXG-0f(!279?By+^XAolbG72g5)BOczL(pXa


From 6b4773130cb6f07dce10a1775fe96068e3860bd9 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:42:55 +0530
Subject: [PATCH 15/27] feat(review): notify manager on review + UI
 approve/request changes

---
 backend/app/api/work.py                 | 11 +++++++++
 frontend/src/app/projects/[id]/page.tsx | 32 +++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/backend/app/api/work.py b/backend/app/api/work.py
index bb1de89..817c9b9 100644
--- a/backend/app/api/work.py
+++ b/backend/app/api/work.py
@@ -152,6 +152,17 @@ def update_task(
     if "status" in data and data["status"] not in ALLOWED_STATUSES:
         raise HTTPException(status_code=400, detail="Invalid status")
 
+    # If a task is sent to review and no reviewer is set, default reviewer to assignee's manager.
+    if (
+        data.get("status") in {"review", "ready_for_review"}
+        and data.get("reviewer_employee_id") is None
+    ):
+        assignee_id = data.get("assignee_employee_id", task.assignee_employee_id)
+        if assignee_id is not None:
+            assignee = session.get(Employee, assignee_id)
+            if assignee is not None and assignee.manager_id is not None:
+                data["reviewer_employee_id"] = assignee.manager_id
+
     for k, v in data.items():
         setattr(task, k, v)
     task.updated_at = datetime.utcnow()
diff --git a/frontend/src/app/projects/[id]/page.tsx b/frontend/src/app/projects/[id]/page.tsx
index 253faeb..b1b918e 100644
--- a/frontend/src/app/projects/[id]/page.tsx
+++ b/frontend/src/app/projects/[id]/page.tsx
@@ -340,6 +340,10 @@ export default function ProjectDetailPage() {
                       assignee.openclaw_session_key,
                   );
 
+                  const actorId = getActorEmployeeId();
+                  const isReviewer = Boolean(actorId && t.reviewer_employee_id && Number(t.reviewer_employee_id) === actorId);
+                  const canReviewActions = Boolean(t.id != null && isReviewer && (t.status ?? "") === "review");
+
                   return (
                     <div key={t.id ?? t.title} className="rounded-md border p-2 text-sm">
                       <div className="font-medium">{t.title}</div>
@@ -391,6 +395,34 @@ export default function ProjectDetailPage() {
                           Trigger
                         </Button>
 
+                        {canReviewActions ? (
+                          <>
+                            <Button
+                              variant="outline"
+                              size="sm"
+                              onClick={() =>
+                                updateTask.mutate({
+                                  taskId: Number(t.id),
+                                  data: { status: "done" },
+                                })
+                              }
+                            >
+                              Approve
+                            </Button>
+                            <Button
+                              variant="outline"
+                              size="sm"
+                              onClick={() => {
+                                setCommentTaskId(Number(t.id));
+                                setReplyToCommentId(null);
+                              }}
+                              title="Leave a comment asking for changes, then move status back to in_progress"
+                            >
+                              Request changes
+                            </Button>
+                          </>
+                        ) : null}
+
                         <Button
                           variant="destructive"
                           size="sm"

From 0caaaa1cb47fa5ed7a5049a2b32c3744a37ca5ab Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:47:06 +0530
Subject: [PATCH 16/27] fix(dispatch): return 503 when OpenClaw gateway env
 missing

---
 backend/app/api/work.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/backend/app/api/work.py b/backend/app/api/work.py
index 817c9b9..f3979d3 100644
--- a/backend/app/api/work.py
+++ b/backend/app/api/work.py
@@ -9,6 +9,7 @@ from sqlmodel import Session, select
 from app.api.utils import get_actor_employee_id, log_activity
 from app.db.session import get_session
 from app.integrations.notify import NotifyContext, notify_openclaw
+from app.integrations.openclaw import OpenClawClient
 from app.models.org import Employee
 from app.models.work import Task, TaskComment
 from app.schemas.work import TaskCommentCreate, TaskCreate, TaskUpdate
@@ -118,6 +119,12 @@ def dispatch_task(
 
     _validate_task_assignee(session, task.assignee_employee_id)
 
+    if OpenClawClient.from_env() is None:
+        raise HTTPException(
+            status_code=503,
+            detail="OpenClaw gateway is not configured (set OPENCLAW_GATEWAY_URL/TOKEN)",
+        )
+
     # Best-effort: enqueue an agent dispatch. This does not mutate the task.
     background.add_task(
         notify_openclaw,

From 8cd32124cde64e003b04c515d7c6b290ad4fe8ee Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 20:51:08 +0530
Subject: [PATCH 17/27] chore(logging): stream backend logs to console +
 instrument dispatch/notify

---
 backend/app/api/work.py              | 18 +++++++++-
 backend/app/core/logging.py          | 54 ++++++++++++++++++++++++++++
 backend/app/integrations/notify.py   | 25 +++++++++++++
 backend/app/integrations/openclaw.py |  7 ++++
 backend/app/main.py                  |  3 ++
 5 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 backend/app/core/logging.py

diff --git a/backend/app/api/work.py b/backend/app/api/work.py
index f3979d3..4b54a53 100644
--- a/backend/app/api/work.py
+++ b/backend/app/api/work.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import logging
 from datetime import datetime
 
 from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
@@ -14,6 +15,8 @@ from app.models.org import Employee
 from app.models.work import Task, TaskComment
 from app.schemas.work import TaskCommentCreate, TaskCreate, TaskUpdate
 
+logger = logging.getLogger("app.work")
+
 router = APIRouter(tags=["work"])
 
 ALLOWED_STATUSES = {"backlog", "ready", "in_progress", "review", "done", "blocked"}
@@ -110,16 +113,27 @@ def dispatch_task(
     session: Session = Depends(get_session),
     actor_employee_id: int = Depends(get_actor_employee_id),
 ):
+    logger.info("dispatch_task: called", extra={"task_id": task_id, "actor": actor_employee_id})
     task = session.get(Task, task_id)
     if not task:
         raise HTTPException(status_code=404, detail="Task not found")
 
+    logger.info(
+        "dispatch_task: loaded",
+        extra={
+            "task_id": getattr(task, "id", None),
+            "assignee_employee_id": getattr(task, "assignee_employee_id", None),
+        },
+    )
+
     if task.assignee_employee_id is None:
         raise HTTPException(status_code=400, detail="Task has no assignee")
 
     _validate_task_assignee(session, task.assignee_employee_id)
 
-    if OpenClawClient.from_env() is None:
+    client = OpenClawClient.from_env()
+    if client is None:
+        logger.warning("dispatch_task: missing OpenClaw env")
         raise HTTPException(
             status_code=503,
             detail="OpenClaw gateway is not configured (set OPENCLAW_GATEWAY_URL/TOKEN)",
@@ -143,6 +157,7 @@ def update_task(
     session: Session = Depends(get_session),
     actor_employee_id: int = Depends(get_actor_employee_id),
 ):
+    logger.info("dispatch_task: called", extra={"task_id": task_id, "actor": actor_employee_id})
     task = session.get(Task, task_id)
     if not task:
         raise HTTPException(status_code=404, detail="Task not found")
@@ -242,6 +257,7 @@ def delete_task(
     session: Session = Depends(get_session),
     actor_employee_id: int = Depends(get_actor_employee_id),
 ):
+    logger.info("dispatch_task: called", extra={"task_id": task_id, "actor": actor_employee_id})
     task = session.get(Task, task_id)
     if not task:
         raise HTTPException(status_code=404, detail="Task not found")
diff --git a/backend/app/core/logging.py b/backend/app/core/logging.py
new file mode 100644
index 0000000..4513bb0
--- /dev/null
+++ b/backend/app/core/logging.py
@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+import logging
+import os
+import sys
+from typing import Any
+
+
+def _level() -> str:
+    return (os.environ.get("LOG_LEVEL") or os.environ.get("UVICORN_LOG_LEVEL") or "INFO").upper()
+
+
+def configure_logging() -> None:
+    """Configure app logging to stream to stdout.
+
+    Uvicorn already logs requests, but we want our app/integrations logs to be visible
+    in the same console stream.
+    """
+
+    level = getattr(logging, _level(), logging.INFO)
+
+    root = logging.getLogger()
+    root.setLevel(level)
+
+    # Avoid duplicate handlers (e.g., when autoreload imports twice)
+    if not any(isinstance(h, logging.StreamHandler) for h in root.handlers):
+        handler = logging.StreamHandler(sys.stdout)
+        handler.setLevel(level)
+        formatter = logging.Formatter(
+            fmt="%(asctime)s | %(levelname)s | %(name)s | %(message)s",
+            datefmt="%Y-%m-%dT%H:%M:%SZ",
+        )
+        handler.setFormatter(formatter)
+        root.addHandler(handler)
+
+    # Make common noisy loggers respect our level
+    for name in [
+        "uvicorn",
+        "uvicorn.error",
+        "uvicorn.access",
+        "sqlalchemy.engine",
+        "httpx",
+        "requests",
+    ]:
+        logging.getLogger(name).setLevel(level)
+
+
+def log_kv(logger: logging.Logger, msg: str, **kv: Any) -> None:
+    # Lightweight key-value logging without requiring JSON logging.
+    if kv:
+        suffix = " ".join(f"{k}={v!r}" for k, v in kv.items())
+        logger.info(f"{msg} | {suffix}")
+    else:
+        logger.info(msg)
diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index 5bcd307..fc04735 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import logging
 from dataclasses import dataclass
 from typing import Iterable
 
@@ -10,6 +11,8 @@ from app.models.org import Employee
 from app.models.projects import ProjectMember
 from app.models.work import Task, TaskComment
 
+logger = logging.getLogger("app.notify")
+
 
 @dataclass(frozen=True)
 class NotifyContext:
@@ -143,15 +146,36 @@ def build_message(ctx: NotifyContext, recipient: Employee) -> str:
 
 def notify_openclaw(session: Session, ctx: NotifyContext) -> None:
     client = OpenClawClient.from_env()
+    logger.info(
+        "notify_openclaw: start",
+        extra={
+            "event": ctx.event,
+            "task_id": getattr(ctx.task, "id", None),
+            "actor": ctx.actor_employee_id,
+        },
+    )
     if client is None:
+        logger.warning("notify_openclaw: skipped (missing OpenClaw env)")
         return
 
     recipient_ids = resolve_recipients(session, ctx)
+    logger.info(
+        "notify_openclaw: recipients resolved", extra={"recipient_ids": sorted(recipient_ids)}
+    )
     recipients = _employees_with_session_keys(session, recipient_ids)
     if not recipients:
+        logger.info("notify_openclaw: no recipients with session keys")
         return
 
     for e in recipients:
+        logger.info(
+            "notify_openclaw: sending",
+            extra={
+                "to_employee_id": getattr(e, "id", None),
+                "session_key": getattr(e, "openclaw_session_key", None),
+                "event": ctx.event,
+            },
+        )
         sk = getattr(e, "openclaw_session_key", None)
         if not sk:
             continue
@@ -164,5 +188,6 @@ def notify_openclaw(session: Session, ctx: NotifyContext) -> None:
                 timeout_s=3.0,
             )
         except Exception:
+            logger.exception("notify_openclaw: sessions_send failed")
             # best-effort; never break Mission Control writes
             continue
diff --git a/backend/app/integrations/openclaw.py b/backend/app/integrations/openclaw.py
index b530112..780533d 100644
--- a/backend/app/integrations/openclaw.py
+++ b/backend/app/integrations/openclaw.py
@@ -1,10 +1,13 @@
 from __future__ import annotations
 
+import logging
 import os
 from typing import Any
 
 import requests
 
+logger = logging.getLogger("app.openclaw")
+
 
 class OpenClawClient:
     def __init__(self, base_url: str, token: str):
@@ -28,6 +31,9 @@ class OpenClawClient:
         timeout_s: float = 5.0,
     ) -> dict[str, Any]:
         payload: dict[str, Any] = {"tool": tool, "args": args}
+        logger.info(
+            "openclaw.tools_invoke", extra={"tool": tool, "has_session_key": bool(session_key)}
+        )
         if session_key is not None:
             payload["sessionKey"] = session_key
 
@@ -38,4 +44,5 @@ class OpenClawClient:
             timeout=timeout_s,
         )
         r.raise_for_status()
+        logger.info("openclaw.tools_invoke: ok", extra={"tool": tool, "status": r.status_code})
         return r.json()
diff --git a/backend/app/main.py b/backend/app/main.py
index f383bdf..4442bd6 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -8,8 +8,11 @@ from app.api.org import router as org_router
 from app.api.projects import router as projects_router
 from app.api.work import router as work_router
 from app.core.config import settings
+from app.core.logging import configure_logging
 from app.db.session import init_db
 
+configure_logging()
+
 app = FastAPI(title="OpenClaw Agency API", version="0.3.0")
 
 origins = [o.strip() for o in settings.cors_origins.split(",") if o.strip()]

From 5877b4a17b129fc5d95608d378127e512437cc66 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 21:03:39 +0530
Subject: [PATCH 18/27] fix(notify): increase gateway timeouts + retry OpenClaw
 sends

---
 backend/app/integrations/notify.py   |  2 +-
 backend/app/integrations/openclaw.py | 61 +++++++++++++++++++++++-----
 2 files changed, 51 insertions(+), 12 deletions(-)

diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index fc04735..e56e0e0 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -185,7 +185,7 @@ def notify_openclaw(session: Session, ctx: NotifyContext) -> None:
             client.tools_invoke(
                 "sessions_send",
                 {"sessionKey": sk, "message": message},
-                timeout_s=3.0,
+                timeout_s=15.0,
             )
         except Exception:
             logger.exception("notify_openclaw: sessions_send failed")
diff --git a/backend/app/integrations/openclaw.py b/backend/app/integrations/openclaw.py
index 780533d..c793f9a 100644
--- a/backend/app/integrations/openclaw.py
+++ b/backend/app/integrations/openclaw.py
@@ -2,9 +2,11 @@ from __future__ import annotations
 
 import logging
 import os
+import time
 from typing import Any
 
 import requests
+from requests.exceptions import ReadTimeout, RequestException
 
 logger = logging.getLogger("app.openclaw")
 
@@ -16,6 +18,15 @@ class OpenClawClient:
 
     @classmethod
     def from_env(cls) -> "OpenClawClient | None":
+        # Ensure .env is loaded into os.environ (pydantic Settings reads env_file but
+        # does not automatically populate os.environ).
+        try:
+            from dotenv import load_dotenv
+
+            load_dotenv(override=False)
+        except Exception:
+            pass
+
         url = os.environ.get("OPENCLAW_GATEWAY_URL")
         token = os.environ.get("OPENCLAW_GATEWAY_TOKEN")
         if not url or not token:
@@ -28,21 +39,49 @@ class OpenClawClient:
         args: dict[str, Any],
         *,
         session_key: str | None = None,
-        timeout_s: float = 5.0,
+        timeout_s: float = 10.0,
     ) -> dict[str, Any]:
         payload: dict[str, Any] = {"tool": tool, "args": args}
         logger.info(
-            "openclaw.tools_invoke", extra={"tool": tool, "has_session_key": bool(session_key)}
+            "openclaw.tools_invoke",
+            extra={"tool": tool, "has_session_key": bool(session_key), "timeout_s": timeout_s},
         )
         if session_key is not None:
             payload["sessionKey"] = session_key
 
-        r = requests.post(
-            f"{self.base_url}/tools/invoke",
-            headers={"Authorization": f"Bearer {self.token}", "Content-Type": "application/json"},
-            json=payload,
-            timeout=timeout_s,
-        )
-        r.raise_for_status()
-        logger.info("openclaw.tools_invoke: ok", extra={"tool": tool, "status": r.status_code})
-        return r.json()
+        last_err: Exception | None = None
+        for attempt in range(2):
+            try:
+                r = requests.post(
+                    f"{self.base_url}/tools/invoke",
+                    headers={
+                        "Authorization": f"Bearer {self.token}",
+                        "Content-Type": "application/json",
+                    },
+                    json=payload,
+                    # connect timeout, read timeout
+                    timeout=(2.0, timeout_s),
+                )
+                r.raise_for_status()
+                logger.info(
+                    "openclaw.tools_invoke: ok",
+                    extra={"tool": tool, "status": r.status_code, "attempt": attempt + 1},
+                )
+                return r.json()
+            except ReadTimeout as e:
+                last_err = e
+                logger.warning(
+                    "openclaw.tools_invoke: timeout",
+                    extra={"tool": tool, "attempt": attempt + 1, "timeout_s": timeout_s},
+                )
+                time.sleep(0.2 * (attempt + 1))
+            except RequestException as e:
+                last_err = e
+                logger.warning(
+                    "openclaw.tools_invoke: request error",
+                    extra={"tool": tool, "attempt": attempt + 1, "error": str(e)},
+                )
+                time.sleep(0.2 * (attempt + 1))
+
+        assert last_err is not None
+        raise last_err

From 056fe83edf19c5f6ed743377b89aa432165c9eef Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 21:19:50 +0530
Subject: [PATCH 19/27] fix(agents): give agents executable curl instructions +
 shared base URL helper

---
 backend/app/api/org.py             | 51 +++++-------------------------
 backend/app/core/urls.py           | 35 ++++++++++++++++++++
 backend/app/integrations/notify.py | 21 +++++++++---
 3 files changed, 59 insertions(+), 48 deletions(-)
 create mode 100644 backend/app/core/urls.py

diff --git a/backend/app/api/org.py b/backend/app/api/org.py
index ee7127b..618dd75 100644
--- a/backend/app/api/org.py
+++ b/backend/app/api/org.py
@@ -5,6 +5,7 @@ from sqlalchemy.exc import IntegrityError
 from sqlmodel import Session, select
 
 from app.api.utils import get_actor_employee_id, log_activity
+from app.core.urls import public_api_base_url
 from app.db.session import get_session
 from app.integrations.openclaw import OpenClawClient
 from app.models.org import Department, Employee, Team
@@ -20,48 +21,6 @@ from app.schemas.org import (
 router = APIRouter(tags=["org"])
 
 
-def _public_api_base_url() -> str:
-    """Return a LAN-reachable base URL for the Mission Control API.
-
-
-    Priority:
-    1) MISSION_CONTROL_BASE_URL env var (recommended)
-    2) First non-loopback IPv4 from `hostname -I`
-
-
-    Never returns localhost/<avoid-loopback> because agents may run on another machine."""
-
-    import os
-    import re
-    import subprocess
-
-    explicit = os.environ.get("MISSION_CONTROL_BASE_URL")
-    if explicit:
-        return explicit.rstrip("/")
-
-    try:
-        out = subprocess.check_output(["bash", "-lc", "hostname -I"], text=True).strip()
-        # pick first RFC1918-ish IPv4, skip docker/loopback
-        ips = re.findall(r"\b(?:\d{1,3}\.){3}\d{1,3}\b", out)
-        for ip in ips:
-            if ip.startswith("127."):
-                continue
-            if ip.startswith("172.17."):
-                continue
-            if (
-                ip.startswith("192.168.")
-                or ip.startswith("10.")
-                or ip.startswith("172.16.")
-                or ip.startswith("172.")
-            ):
-                return f"http://{ip}:8000"
-    except Exception:
-        pass
-
-    # Fallback placeholder (should be overridden by env var)
-    return "http://<dev-machine-ip>:8000"
-
-
 def _default_agent_prompt(emp: Employee) -> str:
     """Generate a conservative default prompt for a newly-created agent employee.
 
@@ -76,9 +35,15 @@ def _default_agent_prompt(emp: Employee) -> str:
         f"Your employee_id is {emp.id}.\n"
         f"Title: {title}. Department id: {dept}.\n\n"
         "Mission Control API access (no UI):\n"
-        f"- Base URL: {_public_api_base_url()}\n"
+        f"- Base URL: {public_api_base_url()}\n"
         "- Auth: none. REQUIRED header on ALL write operations: X-Actor-Employee-Id: <your_employee_id>\n"
         f"  Example for you: X-Actor-Employee-Id: {emp.id}\n\n"
+        "How to execute writes from an OpenClaw agent (IMPORTANT):\n"
+        "- Use the exec tool to run curl against the Base URL above.\n"
+        "- Example: start a task\n"
+        "  curl -sS -X PATCH $BASE/tasks/<TASK_ID> -H 'X-Actor-Employee-Id: <your_employee_id>' -H 'Content-Type: application/json' -d '{\"status\":\"in_progress\"}'\n"
+        "- Example: add a progress comment\n"
+        "  curl -sS -X POST $BASE/task-comments -H 'X-Actor-Employee-Id: <your_employee_id>' -H 'Content-Type: application/json' -d '{\"task_id\":<TASK_ID>,\"body\":\"...\"}'\n\n"
         "Common endpoints (JSON):\n"
         "- GET /tasks, POST /tasks\n"
         "- GET /task-comments, POST /task-comments\n"
diff --git a/backend/app/core/urls.py b/backend/app/core/urls.py
new file mode 100644
index 0000000..f0cd852
--- /dev/null
+++ b/backend/app/core/urls.py
@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+
+def public_api_base_url() -> str:
+    """Return a LAN-reachable base URL for the Mission Control API.
+
+    Priority:
+    1) MISSION_CONTROL_BASE_URL env var (recommended)
+    2) First non-loopback IPv4 from `hostname -I`
+
+    Never returns localhost because agents may run on another machine.
+    """
+
+    import os
+    import re
+    import subprocess
+
+    explicit = os.environ.get("MISSION_CONTROL_BASE_URL")
+    if explicit:
+        return explicit.rstrip("/")
+
+    try:
+        out = subprocess.check_output(["bash", "-lc", "hostname -I"], text=True).strip()
+        ips = re.findall(r"\b(?:\d{1,3}\.){3}\d{1,3}\b", out)
+        for ip in ips:
+            if ip.startswith("127."):
+                continue
+            if ip.startswith("172.17."):
+                continue
+            if ip.startswith(("192.168.", "10.", "172.")):
+                return f"http://{ip}:8000"
+    except Exception:
+        pass
+
+    return "http://<dev-machine-ip>:8000"
diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index e56e0e0..de43e8c 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -101,14 +101,25 @@ def build_message(ctx: NotifyContext, recipient: Employee) -> str:
         desc_block = f"\n\nDescription:\n{desc}" if desc else ""
 
         # Keep this deterministic: agents already have base URL + header guidance in their prompt.
+        base_url = __import__(
+            "app.core.urls", fromlist=["public_api_base_url"]
+        ).public_api_base_url()
+
         return (
             f"{base}\n\n"
-            "You are the assignee. Start NOW:\n"
-            f"1) PATCH /tasks/{t.id} → status=in_progress (use X-Actor-Employee-Id: {recipient.id})\n"
-            f"2) POST /task-comments → task_id={t.id} with a 1-2 line plan + next action\n"
+            f"Set BASE={base_url}\n\n"
+            "You are the assignee. Start NOW (use the exec tool to run these curl commands):\n"
+            f"1) curl -sS -X PATCH $BASE/tasks/{t.id} -H 'X-Actor-Employee-Id: {recipient.id}' "
+            "-H 'Content-Type: application/json' -d '{\"status\":\"in_progress\"}'\n"
+            f"2) curl -sS -X POST $BASE/task-comments -H 'X-Actor-Employee-Id: {recipient.id}' "
+            f'-H \'Content-Type: application/json\' -d \'{{"task_id":{t.id},"body":"Plan: ... Next: ..."}}\'\n'
             "3) Do the work\n"
-            "4) POST /task-comments → progress updates\n"
-            f"5) When complete: PATCH /tasks/{t.id} → status=done and post a final summary comment"
+            f"4) Post progress updates via POST $BASE/task-comments (same headers)\n"
+            f"5) When complete: curl -sS -X PATCH $BASE/tasks/{t.id} -H 'X-Actor-Employee-Id: {recipient.id}' "
+            "-H 'Content-Type: application/json' -d '{\"status\":\"done\"}' and post a final summary comment"
+            f"-H 'X-Actor-Employee-Id: {recipient.id}' "
+            "-H 'Content-Type: application/json' "
+            '-d \'{"status":"done"}\' and post a final summary comment'
             f"{desc_block}"
         )
 

From 52b2797b1d2fa54f82a959dab2714f1be129fa2d Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 21:21:16 +0530
Subject: [PATCH 20/27] fix(notify): clean up agent dispatch message formatting

---
 backend/app/integrations/notify.py | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index de43e8c..f50f01d 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -117,9 +117,6 @@ def build_message(ctx: NotifyContext, recipient: Employee) -> str:
             f"4) Post progress updates via POST $BASE/task-comments (same headers)\n"
             f"5) When complete: curl -sS -X PATCH $BASE/tasks/{t.id} -H 'X-Actor-Employee-Id: {recipient.id}' "
             "-H 'Content-Type: application/json' -d '{\"status\":\"done\"}' and post a final summary comment"
-            f"-H 'X-Actor-Employee-Id: {recipient.id}' "
-            "-H 'Content-Type: application/json' "
-            '-d \'{"status":"done"}\' and post a final summary comment'
             f"{desc_block}"
         )
 

From b59a08f632bd309ae634d573c429a7c69007211b Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 21:33:22 +0530
Subject: [PATCH 21/27] feat(workflow): enforce review-only done for agent
 assignees + reviewer decision endpoint

---
 backend/app/api/work.py                       | 107 ++++++++++++++-
 backend/app/schemas/work.py                   |   5 +
 frontend/src/api/generated/model/index.ts     |   1 +
 .../api/generated/model/taskReviewDecision.ts |  11 ++
 frontend/src/api/generated/work/work.ts       | 125 ++++++++++++++++++
 5 files changed, 248 insertions(+), 1 deletion(-)
 create mode 100644 frontend/src/api/generated/model/taskReviewDecision.ts

diff --git a/backend/app/api/work.py b/backend/app/api/work.py
index 4b54a53..8f66cae 100644
--- a/backend/app/api/work.py
+++ b/backend/app/api/work.py
@@ -13,7 +13,7 @@ from app.integrations.notify import NotifyContext, notify_openclaw
 from app.integrations.openclaw import OpenClawClient
 from app.models.org import Employee
 from app.models.work import Task, TaskComment
-from app.schemas.work import TaskCommentCreate, TaskCreate, TaskUpdate
+from app.schemas.work import TaskCommentCreate, TaskCreate, TaskReviewDecision, TaskUpdate
 
 logger = logging.getLogger("app.work")
 
@@ -149,6 +149,97 @@ def dispatch_task(
     return {"ok": True}
 
 
+def _require_reviewer_comment(body: str | None) -> str:
+    if body is None or not body.strip():
+        raise HTTPException(status_code=400, detail="Reviewer must provide a comment for audit")
+    return body.strip()
+
+
+@router.post("/tasks/{task_id}/review", response_model=Task)
+def review_task(
+    task_id: int,
+    payload: TaskReviewDecision,
+    background: BackgroundTasks,
+    session: Session = Depends(get_session),
+    actor_employee_id: int = Depends(get_actor_employee_id),
+):
+    """Reviewer approves or requests changes.
+
+    - Approve => status=done
+    - Changes => status=in_progress
+
+    Always writes a TaskComment by the reviewer for audit.
+    """
+
+    task = session.get(Task, task_id)
+    if not task:
+        raise HTTPException(status_code=404, detail="Task not found")
+
+    if task.reviewer_employee_id is None:
+        raise HTTPException(status_code=400, detail="Task has no reviewer")
+
+    if actor_employee_id != task.reviewer_employee_id:
+        raise HTTPException(status_code=403, detail="Only the reviewer can approve/request changes")
+
+    decision = (payload.decision or "").strip().lower()
+    if decision not in {"approve", "changes"}:
+        raise HTTPException(status_code=400, detail="Invalid decision")
+
+    comment_body = _require_reviewer_comment(payload.comment_body)
+
+    new_status = "done" if decision == "approve" else "in_progress"
+
+    before_status = task.status
+    task.status = new_status
+    task.updated_at = datetime.utcnow()
+    session.add(task)
+
+    c = TaskComment(task_id=task.id, author_employee_id=actor_employee_id, body=comment_body)
+    session.add(c)
+
+    try:
+        session.flush()
+        log_activity(
+            session,
+            actor_employee_id=actor_employee_id,
+            entity_type="task",
+            entity_id=task.id,
+            verb="reviewed",
+            payload={"decision": decision, "status": new_status},
+        )
+        session.commit()
+    except IntegrityError:
+        session.rollback()
+        raise HTTPException(status_code=409, detail="Review action violates constraints")
+
+    session.refresh(task)
+    session.refresh(c)
+
+    # Notify assignee (comment.created will exclude author)
+    background.add_task(
+        notify_openclaw,
+        session,
+        NotifyContext(
+            event="comment.created", actor_employee_id=actor_employee_id, task=task, comment=c
+        ),
+    )
+
+    # Notify reviewer/PMs about status change
+    if before_status != task.status:
+        background.add_task(
+            notify_openclaw,
+            session,
+            NotifyContext(
+                event="status.changed",
+                actor_employee_id=actor_employee_id,
+                task=task,
+                changed_fields={"status": {"from": before_status, "to": task.status}},
+            ),
+        )
+
+    return Task.model_validate(task)
+
+
 @router.patch("/tasks/{task_id}", response_model=Task)
 def update_task(
     task_id: int,
@@ -174,6 +265,20 @@ def update_task(
     if "status" in data and data["status"] not in ALLOWED_STATUSES:
         raise HTTPException(status_code=400, detail="Invalid status")
 
+    # Enforce review workflow: agent assignees cannot mark tasks done directly.
+    if data.get("status") == "done":
+        assignee = (
+            session.get(Employee, task.assignee_employee_id) if task.assignee_employee_id else None
+        )
+        if assignee is not None and assignee.employee_type == "agent":
+            if actor_employee_id == task.assignee_employee_id:
+                raise HTTPException(
+                    status_code=403,
+                    detail="Assignee agents cannot mark tasks done; set status=review for manager approval",
+                )
+        if task.reviewer_employee_id is not None and actor_employee_id != task.reviewer_employee_id:
+            raise HTTPException(status_code=403, detail="Only the reviewer can mark a task done")
+
     # If a task is sent to review and no reviewer is set, default reviewer to assignee's manager.
     if (
         data.get("status") in {"review", "ready_for_review"}
diff --git a/backend/app/schemas/work.py b/backend/app/schemas/work.py
index 9d067d7..92b460c 100644
--- a/backend/app/schemas/work.py
+++ b/backend/app/schemas/work.py
@@ -26,3 +26,8 @@ class TaskCommentCreate(SQLModel):
     author_employee_id: int | None = None
     reply_to_comment_id: int | None = None
     body: str
+
+
+class TaskReviewDecision(SQLModel):
+    decision: str  # approve | changes
+    comment_body: str
diff --git a/frontend/src/api/generated/model/index.ts b/frontend/src/api/generated/model/index.ts
index f837637..3dbfd2a 100644
--- a/frontend/src/api/generated/model/index.ts
+++ b/frontend/src/api/generated/model/index.ts
@@ -32,6 +32,7 @@ export * from "./task";
 export * from "./taskComment";
 export * from "./taskCommentCreate";
 export * from "./taskCreate";
+export * from "./taskReviewDecision";
 export * from "./taskUpdate";
 export * from "./team";
 export * from "./teamCreate";
diff --git a/frontend/src/api/generated/model/taskReviewDecision.ts b/frontend/src/api/generated/model/taskReviewDecision.ts
new file mode 100644
index 0000000..ed64c20
--- /dev/null
+++ b/frontend/src/api/generated/model/taskReviewDecision.ts
@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.2.0 🍺
+ * Do not edit manually.
+ * OpenClaw Agency API
+ * OpenAPI spec version: 0.3.0
+ */
+
+export interface TaskReviewDecision {
+  decision: string;
+  comment_body: string;
+}
diff --git a/frontend/src/api/generated/work/work.ts b/frontend/src/api/generated/work/work.ts
index 505d893..64fb02c 100644
--- a/frontend/src/api/generated/work/work.ts
+++ b/frontend/src/api/generated/work/work.ts
@@ -28,6 +28,7 @@ import type {
   TaskComment,
   TaskCommentCreate,
   TaskCreate,
+  TaskReviewDecision,
   TaskUpdate,
 } from ".././model";
 
@@ -467,6 +468,130 @@ export const useDispatchTaskTasksTaskIdDispatchPost = <
     queryClient,
   );
 };
+/**
+ * Reviewer approves or requests changes.
+
+- Approve => status=done
+- Changes => status=in_progress
+
+Always writes a TaskComment by the reviewer for audit.
+ * @summary Review Task
+ */
+export type reviewTaskTasksTaskIdReviewPostResponse200 = {
+  data: Task;
+  status: 200;
+};
+
+export type reviewTaskTasksTaskIdReviewPostResponse422 = {
+  data: HTTPValidationError;
+  status: 422;
+};
+
+export type reviewTaskTasksTaskIdReviewPostResponseSuccess =
+  reviewTaskTasksTaskIdReviewPostResponse200 & {
+    headers: Headers;
+  };
+export type reviewTaskTasksTaskIdReviewPostResponseError =
+  reviewTaskTasksTaskIdReviewPostResponse422 & {
+    headers: Headers;
+  };
+
+export type reviewTaskTasksTaskIdReviewPostResponse =
+  | reviewTaskTasksTaskIdReviewPostResponseSuccess
+  | reviewTaskTasksTaskIdReviewPostResponseError;
+
+export const getReviewTaskTasksTaskIdReviewPostUrl = (taskId: number) => {
+  return `/tasks/${taskId}/review`;
+};
+
+export const reviewTaskTasksTaskIdReviewPost = async (
+  taskId: number,
+  taskReviewDecision: TaskReviewDecision,
+  options?: RequestInit,
+): Promise<reviewTaskTasksTaskIdReviewPostResponse> => {
+  return customFetch<reviewTaskTasksTaskIdReviewPostResponse>(
+    getReviewTaskTasksTaskIdReviewPostUrl(taskId),
+    {
+      ...options,
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...options?.headers },
+      body: JSON.stringify(taskReviewDecision),
+    },
+  );
+};
+
+export const getReviewTaskTasksTaskIdReviewPostMutationOptions = <
+  TError = HTTPValidationError,
+  TContext = unknown,
+>(options?: {
+  mutation?: UseMutationOptions<
+    Awaited<ReturnType<typeof reviewTaskTasksTaskIdReviewPost>>,
+    TError,
+    { taskId: number; data: TaskReviewDecision },
+    TContext
+  >;
+  request?: SecondParameter<typeof customFetch>;
+}): UseMutationOptions<
+  Awaited<ReturnType<typeof reviewTaskTasksTaskIdReviewPost>>,
+  TError,
+  { taskId: number; data: TaskReviewDecision },
+  TContext
+> => {
+  const mutationKey = ["reviewTaskTasksTaskIdReviewPost"];
+  const { mutation: mutationOptions, request: requestOptions } = options
+    ? options.mutation &&
+      "mutationKey" in options.mutation &&
+      options.mutation.mutationKey
+      ? options
+      : { ...options, mutation: { ...options.mutation, mutationKey } }
+    : { mutation: { mutationKey }, request: undefined };
+
+  const mutationFn: MutationFunction<
+    Awaited<ReturnType<typeof reviewTaskTasksTaskIdReviewPost>>,
+    { taskId: number; data: TaskReviewDecision }
+  > = (props) => {
+    const { taskId, data } = props ?? {};
+
+    return reviewTaskTasksTaskIdReviewPost(taskId, data, requestOptions);
+  };
+
+  return { mutationFn, ...mutationOptions };
+};
+
+export type ReviewTaskTasksTaskIdReviewPostMutationResult = NonNullable<
+  Awaited<ReturnType<typeof reviewTaskTasksTaskIdReviewPost>>
+>;
+export type ReviewTaskTasksTaskIdReviewPostMutationBody = TaskReviewDecision;
+export type ReviewTaskTasksTaskIdReviewPostMutationError = HTTPValidationError;
+
+/**
+ * @summary Review Task
+ */
+export const useReviewTaskTasksTaskIdReviewPost = <
+  TError = HTTPValidationError,
+  TContext = unknown,
+>(
+  options?: {
+    mutation?: UseMutationOptions<
+      Awaited<ReturnType<typeof reviewTaskTasksTaskIdReviewPost>>,
+      TError,
+      { taskId: number; data: TaskReviewDecision },
+      TContext
+    >;
+    request?: SecondParameter<typeof customFetch>;
+  },
+  queryClient?: QueryClient,
+): UseMutationResult<
+  Awaited<ReturnType<typeof reviewTaskTasksTaskIdReviewPost>>,
+  TError,
+  { taskId: number; data: TaskReviewDecision },
+  TContext
+> => {
+  return useMutation(
+    getReviewTaskTasksTaskIdReviewPostMutationOptions(options),
+    queryClient,
+  );
+};
 /**
  * @summary Update Task
  */

From 4b31b4ada87aa6c18e26882359254fa3c785598c Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 21:43:38 +0530
Subject: [PATCH 22/27] feat(notify): auto-provision reviewer session on review
 status so notifications deliver

---
 backend/app/integrations/notify.py | 55 ++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index f50f01d..2eef5a7 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -14,6 +14,53 @@ from app.models.work import Task, TaskComment
 logger = logging.getLogger("app.notify")
 
 
+def ensure_employee_provisioned(session: Session, employee_id: int) -> None:
+    """Best-effort provisioning of a reviewer/manager so notifications can be delivered."""
+
+    emp = session.get(Employee, employee_id)
+    if emp is None:
+        return
+    if not getattr(emp, "notify_enabled", True):
+        return
+    if getattr(emp, "openclaw_session_key", None):
+        return
+
+    client = OpenClawClient.from_env()
+    if client is None:
+        logger.warning(
+            "ensure_employee_provisioned: missing OpenClaw env", extra={"employee_id": employee_id}
+        )
+        return
+
+    # Deterministic minimal prompt; agents already have detailed guidance in their own provisioning prompt.
+    prompt = (
+        f"You are {emp.name} (employee_id={emp.id}).\n"
+        "You are a reviewer/manager in Mission Control.\n"
+        "When you get a review request, open Mission Control and approve or request changes.\n"
+    )
+
+    try:
+        res = client.tools_invoke(
+            "sessions_spawn",
+            {"task": prompt, "label": f"employee:{emp.id}:{emp.name}"},
+            timeout_s=20.0,
+        )
+        # Extract childSessionKey
+        details = (res.get("result") or {}).get("details") or {}
+        sk = details.get("childSessionKey") or details.get("sessionKey")
+        if sk:
+            emp.openclaw_session_key = sk
+            session.add(emp)
+            session.commit()
+            logger.info(
+                "ensure_employee_provisioned: provisioned",
+                extra={"employee_id": emp.id, "session_key": sk},
+            )
+    except Exception:
+        session.rollback()
+        logger.exception("ensure_employee_provisioned: failed", extra={"employee_id": employee_id})
+
+
 @dataclass(frozen=True)
 class NotifyContext:
     event: str  # task.created | task.updated | task.assigned | comment.created | status.changed
@@ -167,6 +214,14 @@ def notify_openclaw(session: Session, ctx: NotifyContext) -> None:
         return
 
     recipient_ids = resolve_recipients(session, ctx)
+    # If the event requires notifying the reviewer, ensure they are provisioned so the notification is deliverable.
+    if ctx.event == "status.changed":
+        new_status = (getattr(ctx.task, "status", None) or "").lower()
+        if new_status in {"review", "ready_for_review"} and getattr(
+            ctx.task, "reviewer_employee_id", None
+        ):
+            ensure_employee_provisioned(session, int(ctx.task.reviewer_employee_id))
+
     logger.info(
         "notify_openclaw: recipients resolved", extra={"recipient_ids": sorted(recipient_ids)}
     )

From c0b0f26984384686c3adbf7a63968a4cef652e33 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 21:53:47 +0530
Subject: [PATCH 23/27] fix(notify): isolate background notifications in new DB
 session + reduce timeout spam

---
 backend/app/api/work.py            |  23 +--
 backend/app/integrations/notify.py | 315 +++++++++++++++--------------
 2 files changed, 170 insertions(+), 168 deletions(-)

diff --git a/backend/app/api/work.py b/backend/app/api/work.py
index 8f66cae..8f96936 100644
--- a/backend/app/api/work.py
+++ b/backend/app/api/work.py
@@ -99,8 +99,7 @@ def create_task(
     session.refresh(task)
     background.add_task(
         notify_openclaw,
-        session,
-        NotifyContext(event="task.created", actor_employee_id=actor_employee_id, task=task),
+        NotifyContext(event="task.created", actor_employee_id=actor_employee_id, task_id=task.id),
     )
     # Explicitly return a serializable payload (guards against empty {} responses)
     return Task.model_validate(task)
@@ -143,7 +142,7 @@ def dispatch_task(
     background.add_task(
         notify_openclaw,
         session,
-        NotifyContext(event="task.assigned", actor_employee_id=actor_employee_id, task=task),
+        NotifyContext(event="task.assigned", actor_employee_id=actor_employee_id, task_id=task.id),
     )
 
     return {"ok": True}
@@ -228,11 +227,10 @@ def review_task(
     if before_status != task.status:
         background.add_task(
             notify_openclaw,
-            session,
             NotifyContext(
                 event="status.changed",
                 actor_employee_id=actor_employee_id,
-                task=task,
+                task_id=task.id,
                 changed_fields={"status": {"from": before_status, "to": task.status}},
             ),
         )
@@ -321,11 +319,10 @@ def update_task(
         }
         background.add_task(
             notify_openclaw,
-            session,
             NotifyContext(
                 event="task.assigned",
                 actor_employee_id=actor_employee_id,
-                task=task,
+                task_id=task.id,
                 changed_fields=changed,
             ),
         )
@@ -333,22 +330,20 @@ def update_task(
         changed["status"] = {"from": before.get("status"), "to": task.status}
         background.add_task(
             notify_openclaw,
-            session,
             NotifyContext(
                 event="status.changed",
                 actor_employee_id=actor_employee_id,
-                task=task,
+                task_id=task.id,
                 changed_fields=changed,
             ),
         )
     if not changed and data:
         background.add_task(
             notify_openclaw,
-            session,
             NotifyContext(
                 event="task.updated",
                 actor_employee_id=actor_employee_id,
-                task=task,
+                task_id=task.id,
                 changed_fields=data,
             ),
         )
@@ -426,9 +421,11 @@ def create_task_comment(
     if task is not None:
         background.add_task(
             notify_openclaw,
-            session,
             NotifyContext(
-                event="comment.created", actor_employee_id=actor_employee_id, task=task, comment=c
+                event="comment.created",
+                actor_employee_id=actor_employee_id,
+                task_id=task.id,
+                comment_id=c.id,
             ),
         )
     return TaskComment.model_validate(c)
diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index 2eef5a7..2ee70c6 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -6,6 +6,7 @@ from typing import Iterable
 
 from sqlmodel import Session, select
 
+from app.db.session import engine
 from app.integrations.openclaw import OpenClawClient
 from app.models.org import Employee
 from app.models.projects import ProjectMember
@@ -14,6 +15,83 @@ from app.models.work import Task, TaskComment
 logger = logging.getLogger("app.notify")
 
 
+@dataclass(frozen=True)
+class NotifyContext:
+    """Notification context.
+
+    IMPORTANT: this is passed into FastAPI BackgroundTasks.
+    Do not store live SQLAlchemy/SQLModel objects here; only ids/primitive data.
+    """
+
+    event: str  # task.created | task.updated | task.assigned | comment.created | status.changed
+    actor_employee_id: int
+    task_id: int
+    comment_id: int | None = None
+    changed_fields: dict | None = None
+
+
+def _employees_with_session_keys(session: Session, employee_ids: Iterable[int]) -> list[Employee]:
+    ids = sorted({i for i in employee_ids if i is not None})
+    if not ids:
+        return []
+
+    emps = session.exec(select(Employee).where(Employee.id.in_(ids))).all()
+    out: list[Employee] = []
+    for e in emps:
+        if not getattr(e, "notify_enabled", True):
+            continue
+        if getattr(e, "openclaw_session_key", None):
+            out.append(e)
+    return out
+
+
+def _project_pm_employee_ids(session: Session, project_id: int) -> set[int]:
+    pms = session.exec(select(ProjectMember).where(ProjectMember.project_id == project_id)).all()
+    pm_ids: set[int] = set()
+    for m in pms:
+        role = (m.role or "").lower()
+        if role in {"pm", "product", "product_manager", "manager"}:
+            pm_ids.add(m.employee_id)
+    return pm_ids
+
+
+def resolve_recipients(
+    session: Session, ctx: NotifyContext, task: Task, comment: TaskComment | None
+) -> set[int]:
+    recipients: set[int] = set()
+
+    if ctx.event == "task.created":
+        if task.assignee_employee_id:
+            recipients.add(task.assignee_employee_id)
+        recipients |= _project_pm_employee_ids(session, task.project_id)
+
+    elif ctx.event == "task.assigned":
+        if task.assignee_employee_id:
+            recipients.add(task.assignee_employee_id)
+        recipients |= _project_pm_employee_ids(session, task.project_id)
+
+    elif ctx.event == "comment.created":
+        if task.assignee_employee_id:
+            recipients.add(task.assignee_employee_id)
+        if task.reviewer_employee_id:
+            recipients.add(task.reviewer_employee_id)
+        recipients |= _project_pm_employee_ids(session, task.project_id)
+        if comment and comment.author_employee_id:
+            recipients.discard(comment.author_employee_id)
+
+    elif ctx.event == "status.changed":
+        new_status = (getattr(task, "status", None) or "").lower()
+        if new_status in {"review", "ready_for_review"} and task.reviewer_employee_id:
+            recipients.add(task.reviewer_employee_id)
+        recipients |= _project_pm_employee_ids(session, task.project_id)
+
+    elif ctx.event == "task.updated":
+        recipients |= _project_pm_employee_ids(session, task.project_id)
+
+    recipients.discard(ctx.actor_employee_id)
+    return recipients
+
+
 def ensure_employee_provisioned(session: Session, employee_id: int) -> None:
     """Best-effort provisioning of a reviewer/manager so notifications can be delivered."""
 
@@ -32,7 +110,6 @@ def ensure_employee_provisioned(session: Session, employee_id: int) -> None:
         )
         return
 
-    # Deterministic minimal prompt; agents already have detailed guidance in their own provisioning prompt.
     prompt = (
         f"You are {emp.name} (employee_id={emp.id}).\n"
         "You are a reviewer/manager in Mission Control.\n"
@@ -45,7 +122,6 @@ def ensure_employee_provisioned(session: Session, employee_id: int) -> None:
             {"task": prompt, "label": f"employee:{emp.id}:{emp.name}"},
             timeout_s=20.0,
         )
-        # Extract childSessionKey
         details = (res.get("result") or {}).get("details") or {}
         sk = details.get("childSessionKey") or details.get("sessionKey")
         if sk:
@@ -61,196 +137,125 @@ def ensure_employee_provisioned(session: Session, employee_id: int) -> None:
         logger.exception("ensure_employee_provisioned: failed", extra={"employee_id": employee_id})
 
 
-@dataclass(frozen=True)
-class NotifyContext:
-    event: str  # task.created | task.updated | task.assigned | comment.created | status.changed
-    actor_employee_id: int
-    task: Task
-    comment: TaskComment | None = None
-    changed_fields: dict | None = None
+def build_message(
+    *,
+    ctx: NotifyContext,
+    task: Task,
+    comment: TaskComment | None,
+    recipient: Employee,
+    base_url: str,
+) -> str:
+    base = f"Task #{task.id}: {task.title}" if task.id is not None else f"Task: {task.title}"
 
-
-def _employees_with_session_keys(session: Session, employee_ids: Iterable[int]) -> list[Employee]:
-    ids = sorted({i for i in employee_ids if i is not None})
-    if not ids:
-        return []
-
-    emps = session.exec(select(Employee).where(Employee.id.in_(ids))).all()
-    out: list[Employee] = []
-    for e in emps:
-        if not getattr(e, "notify_enabled", True):
-            continue
-        if getattr(e, "openclaw_session_key", None):
-            out.append(e)
-    return out
-
-
-def _project_pm_employee_ids(session: Session, project_id: int) -> set[int]:
-    # Generic, data-driven: PMs are determined by project_members.role.
-    pms = session.exec(select(ProjectMember).where(ProjectMember.project_id == project_id)).all()
-    pm_ids: set[int] = set()
-    for m in pms:
-        role = (m.role or "").lower()
-        if role in {"pm", "product", "product_manager", "manager"}:
-            pm_ids.add(m.employee_id)
-    return pm_ids
-
-
-def resolve_recipients(session: Session, ctx: NotifyContext) -> set[int]:
-    t = ctx.task
-    recipients: set[int] = set()
-
-    if ctx.event == "task.created":
-        # notify assignee + PMs
-        if t.assignee_employee_id:
-            recipients.add(t.assignee_employee_id)
-        recipients |= _project_pm_employee_ids(session, t.project_id)
-
-    elif ctx.event == "task.assigned":
-        if t.assignee_employee_id:
-            recipients.add(t.assignee_employee_id)
-        recipients |= _project_pm_employee_ids(session, t.project_id)
-
-    elif ctx.event == "comment.created":
-        # notify assignee + reviewer + PMs, excluding author
-        if t.assignee_employee_id:
-            recipients.add(t.assignee_employee_id)
-        if t.reviewer_employee_id:
-            recipients.add(t.reviewer_employee_id)
-        recipients |= _project_pm_employee_ids(session, t.project_id)
-        if ctx.comment and ctx.comment.author_employee_id:
-            recipients.discard(ctx.comment.author_employee_id)
-
-    elif ctx.event == "status.changed":
-        new_status = (getattr(t, "status", None) or "").lower()
-        if new_status in {"review", "ready_for_review"} and t.reviewer_employee_id:
-            recipients.add(t.reviewer_employee_id)
-        recipients |= _project_pm_employee_ids(session, t.project_id)
-
-    elif ctx.event == "task.updated":
-        # conservative: PMs only
-        recipients |= _project_pm_employee_ids(session, t.project_id)
-
-    recipients.discard(ctx.actor_employee_id)
-    return recipients
-
-
-def build_message(ctx: NotifyContext, recipient: Employee) -> str:
-    t = ctx.task
-    base = f"Task #{t.id}: {t.title}" if t.id is not None else f"Task: {t.title}"
-
-    # Agent-specific dispatch instructions. These notifications should result in the agent
-    # taking concrete actions in Mission Control, not just acknowledging.
     if ctx.event in {"task.created", "task.assigned"} and recipient.employee_type == "agent":
-        desc = (t.description or "").strip()
+        desc = (task.description or "").strip()
         if len(desc) > 500:
             desc = desc[:497] + "..."
         desc_block = f"\n\nDescription:\n{desc}" if desc else ""
 
-        # Keep this deterministic: agents already have base URL + header guidance in their prompt.
-        base_url = __import__(
-            "app.core.urls", fromlist=["public_api_base_url"]
-        ).public_api_base_url()
-
         return (
             f"{base}\n\n"
             f"Set BASE={base_url}\n\n"
             "You are the assignee. Start NOW (use the exec tool to run these curl commands):\n"
-            f"1) curl -sS -X PATCH $BASE/tasks/{t.id} -H 'X-Actor-Employee-Id: {recipient.id}' "
-            "-H 'Content-Type: application/json' -d '{\"status\":\"in_progress\"}'\n"
-            f"2) curl -sS -X POST $BASE/task-comments -H 'X-Actor-Employee-Id: {recipient.id}' "
-            f'-H \'Content-Type: application/json\' -d \'{{"task_id":{t.id},"body":"Plan: ... Next: ..."}}\'\n'
+            f"1) curl -sS -X PATCH $BASE/tasks/{task.id} -H 'X-Actor-Employee-Id: {recipient.id}' -H 'Content-Type: application/json' -d '{{\"status\":\"in_progress\"}}'\n"
+            f"2) curl -sS -X POST $BASE/task-comments -H 'X-Actor-Employee-Id: {recipient.id}' -H 'Content-Type: application/json' -d '{{\"task_id\":{task.id},\"body\":\"Plan: ... Next: ...\"}}'\n"
             "3) Do the work\n"
-            f"4) Post progress updates via POST $BASE/task-comments (same headers)\n"
-            f"5) When complete: curl -sS -X PATCH $BASE/tasks/{t.id} -H 'X-Actor-Employee-Id: {recipient.id}' "
-            "-H 'Content-Type: application/json' -d '{\"status\":\"done\"}' and post a final summary comment"
+            "4) Post progress updates via POST $BASE/task-comments (same headers)\n"
+            f"5) When complete: set status=review (assignee cannot set done) and wait for manager approval\n"
             f"{desc_block}"
         )
 
-    if ctx.event == "task.assigned":
-        return (
-            f"Assigned: {base}.\n"
-            "Work ONE task only; update Mission Control with a comment when you make progress."
-        )
-
     if ctx.event == "comment.created":
         snippet = ""
-        if ctx.comment and ctx.comment.body:
-            snippet = ctx.comment.body.strip().replace("\n", " ")
+        if comment and comment.body:
+            snippet = comment.body.strip().replace("\n", " ")
             if len(snippet) > 180:
                 snippet = snippet[:177] + "..."
             snippet = f"\nComment: {snippet}"
-        return (
-            f"New comment on {base}.{snippet}\nWork ONE task only; reply/update in Mission Control."
-        )
+        return f"New comment on {base}.{snippet}\nPlease review and respond in Mission Control."
 
     if ctx.event == "status.changed":
-        return (
-            f"Status changed on {base} → {t.status}.\n"
-            "Work ONE task only; update Mission Control with next step."
-        )
+        return f"Status changed on {base} → {task.status}.\nPlease review and respond in Mission Control."
 
     if ctx.event == "task.created":
-        return (
-            f"New task created: {base}.\n"
-            "Work ONE task only; add acceptance criteria / next step in Mission Control."
-        )
+        return f"New task created: {base}.\nPlease review and respond in Mission Control."
 
-    return f"Update on {base}.\nWork ONE task only; update Mission Control."
+    if ctx.event == "task.assigned":
+        return f"Assigned: {base}.\nPlease review and respond in Mission Control."
+
+    return f"Update on {base}.\nPlease review and respond in Mission Control."
 
 
-def notify_openclaw(session: Session, ctx: NotifyContext) -> None:
+def notify_openclaw(ctx: NotifyContext) -> None:
+    """Send OpenClaw notifications.
+
+    Runs in BackgroundTasks; opens its own DB session for safety.
+    """
+
     client = OpenClawClient.from_env()
     logger.info(
         "notify_openclaw: start",
-        extra={
-            "event": ctx.event,
-            "task_id": getattr(ctx.task, "id", None),
-            "actor": ctx.actor_employee_id,
-        },
+        extra={"event": ctx.event, "task_id": ctx.task_id, "actor": ctx.actor_employee_id},
     )
     if client is None:
         logger.warning("notify_openclaw: skipped (missing OpenClaw env)")
         return
 
-    recipient_ids = resolve_recipients(session, ctx)
-    # If the event requires notifying the reviewer, ensure they are provisioned so the notification is deliverable.
-    if ctx.event == "status.changed":
-        new_status = (getattr(ctx.task, "status", None) or "").lower()
-        if new_status in {"review", "ready_for_review"} and getattr(
-            ctx.task, "reviewer_employee_id", None
-        ):
-            ensure_employee_provisioned(session, int(ctx.task.reviewer_employee_id))
+    with Session(engine) as session:
+        task = session.get(Task, ctx.task_id)
+        if task is None:
+            logger.warning("notify_openclaw: task not found", extra={"task_id": ctx.task_id})
+            return
 
-    logger.info(
-        "notify_openclaw: recipients resolved", extra={"recipient_ids": sorted(recipient_ids)}
-    )
-    recipients = _employees_with_session_keys(session, recipient_ids)
-    if not recipients:
-        logger.info("notify_openclaw: no recipients with session keys")
-        return
+        comment = session.get(TaskComment, ctx.comment_id) if ctx.comment_id else None
 
-    for e in recipients:
+        if ctx.event == "status.changed":
+            new_status = (getattr(task, "status", None) or "").lower()
+            if new_status in {"review", "ready_for_review"} and task.reviewer_employee_id:
+                ensure_employee_provisioned(session, int(task.reviewer_employee_id))
+
+        recipient_ids = resolve_recipients(session, ctx, task, comment)
         logger.info(
-            "notify_openclaw: sending",
-            extra={
-                "to_employee_id": getattr(e, "id", None),
-                "session_key": getattr(e, "openclaw_session_key", None),
-                "event": ctx.event,
-            },
+            "notify_openclaw: recipients resolved", extra={"recipient_ids": sorted(recipient_ids)}
         )
-        sk = getattr(e, "openclaw_session_key", None)
-        if not sk:
-            continue
+        recipients = _employees_with_session_keys(session, recipient_ids)
+        if not recipients:
+            logger.info("notify_openclaw: no recipients with session keys")
+            return
 
-        message = build_message(ctx, recipient=e)
-        try:
-            client.tools_invoke(
-                "sessions_send",
-                {"sessionKey": sk, "message": message},
-                timeout_s=15.0,
+        # base URL used in agent messages
+        base_url = __import__(
+            "app.core.urls", fromlist=["public_api_base_url"]
+        ).public_api_base_url()
+
+        for e in recipients:
+            sk = getattr(e, "openclaw_session_key", None)
+            if not sk:
+                continue
+
+            message = build_message(
+                ctx=ctx,
+                task=task,
+                comment=comment,
+                recipient=e,
+                base_url=base_url,
             )
-        except Exception:
-            logger.exception("notify_openclaw: sessions_send failed")
-            # best-effort; never break Mission Control writes
-            continue
+
+            try:
+                client.tools_invoke(
+                    "sessions_send",
+                    {"sessionKey": sk, "message": message},
+                    timeout_s=15.0,
+                )
+            except Exception:
+                # keep the log, but avoid giant stack spam unless debugging
+                logger.warning(
+                    "notify_openclaw: sessions_send failed",
+                    extra={
+                        "event": ctx.event,
+                        "task_id": ctx.task_id,
+                        "to_employee_id": getattr(e, "id", None),
+                        "session_key": sk,
+                    },
+                )
+                continue

From 521cf1efabc43d0af1f371a0d270473b9bec5d48 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 21:55:45 +0530
Subject: [PATCH 24/27] feat(review): improve reviewer notification with
 explicit expectations and review endpoint

---
 backend/app/integrations/notify.py | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index 2ee70c6..c1e97f1 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -175,7 +175,21 @@ def build_message(
         return f"New comment on {base}.{snippet}\nPlease review and respond in Mission Control."
 
     if ctx.event == "status.changed":
-        return f"Status changed on {base} → {task.status}.\nPlease review and respond in Mission Control."
+        new_status = (getattr(task, "status", None) or "").lower()
+        if new_status in {"review", "ready_for_review"}:
+            return (
+                f"Review requested for {base}.\n"
+                "As the reviewer/manager, you must:\n"
+                "1) Read the task + latest assignee comments\n"
+                "2) Decide: approve or request changes\n"
+                "3) Leave an audit comment explaining your decision (required)\n"
+                f"4) Submit decision via POST /tasks/{task.id}/review (decision=approve|changes)\n"
+                "Approve → task becomes done. Changes → task returns to in_progress and assignee is notified."
+            )
+        return (
+            f"Status changed on {base} → {task.status}.\n"
+            "Please review and respond in Mission Control."
+        )
 
     if ctx.event == "task.created":
         return f"New task created: {base}.\nPlease review and respond in Mission Control."

From 352eb27a5210529e89f647288d9ce5619b0cb21c Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 21:58:59 +0530
Subject: [PATCH 25/27] fix(notify): more resilient OpenClaw sends
 (retries/backoff + longer timeout)

---
 backend/app/integrations/notify.py   | 2 +-
 backend/app/integrations/openclaw.py | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/backend/app/integrations/notify.py b/backend/app/integrations/notify.py
index c1e97f1..d979901 100644
--- a/backend/app/integrations/notify.py
+++ b/backend/app/integrations/notify.py
@@ -259,7 +259,7 @@ def notify_openclaw(ctx: NotifyContext) -> None:
                 client.tools_invoke(
                     "sessions_send",
                     {"sessionKey": sk, "message": message},
-                    timeout_s=15.0,
+                    timeout_s=30.0,
                 )
             except Exception:
                 # keep the log, but avoid giant stack spam unless debugging
diff --git a/backend/app/integrations/openclaw.py b/backend/app/integrations/openclaw.py
index c793f9a..a39e6c0 100644
--- a/backend/app/integrations/openclaw.py
+++ b/backend/app/integrations/openclaw.py
@@ -50,7 +50,8 @@ class OpenClawClient:
             payload["sessionKey"] = session_key
 
         last_err: Exception | None = None
-        for attempt in range(2):
+        # Retry a few times; the gateway can be busy and respond slowly.
+        for attempt in range(4):
             try:
                 r = requests.post(
                     f"{self.base_url}/tools/invoke",
@@ -74,14 +75,14 @@ class OpenClawClient:
                     "openclaw.tools_invoke: timeout",
                     extra={"tool": tool, "attempt": attempt + 1, "timeout_s": timeout_s},
                 )
-                time.sleep(0.2 * (attempt + 1))
+                time.sleep(0.5 * (2**attempt))
             except RequestException as e:
                 last_err = e
                 logger.warning(
                     "openclaw.tools_invoke: request error",
                     extra={"tool": tool, "attempt": attempt + 1, "error": str(e)},
                 )
-                time.sleep(0.2 * (attempt + 1))
+                time.sleep(0.5 * (2**attempt))
 
         assert last_err is not None
         raise last_err

From a04448dbd94d4daf1f8e372130dc5aa9c9d7e98f Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 22:15:46 +0530
Subject: [PATCH 26/27] fix(authz): agents can only create/provision agents

---
 backend/app/api/org.py | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/backend/app/api/org.py b/backend/app/api/org.py
index 618dd75..4444d5a 100644
--- a/backend/app/api/org.py
+++ b/backend/app/api/org.py
@@ -21,6 +21,26 @@ from app.schemas.org import (
 router = APIRouter(tags=["org"])
 
 
+def _enforce_employee_create_policy(
+    session: Session, *, actor_employee_id: int, target_employee_type: str
+) -> None:
+    """Enforce: agents can only create/provision agents; humans can create humans + agents."""
+
+    actor = session.get(Employee, actor_employee_id)
+    if actor is None:
+        # Actor header is required; if it points to nothing, treat as invalid.
+        raise HTTPException(status_code=400, detail="Actor employee not found")
+
+    target = (target_employee_type or "").lower()
+    actor_type = (actor.employee_type or "").lower()
+
+    if actor_type == "agent" and target != "agent":
+        raise HTTPException(
+            status_code=403,
+            detail="Agent employees may only create/provision agent employees",
+        )
+
+
 def _default_agent_prompt(emp: Employee) -> str:
     """Generate a conservative default prompt for a newly-created agent employee.
 
@@ -67,6 +87,11 @@ def _maybe_auto_provision_agent(session: Session, *, emp: Employee, actor_employ
     we leave the employee as-is (openclaw_session_key stays null).
     """
 
+    # Enforce: agent actors may only provision agents (humans can provision agents).
+    _enforce_employee_create_policy(
+        session, actor_employee_id=actor_employee_id, target_employee_type=emp.employee_type
+    )
+
     if emp.employee_type != "agent":
         return
     if emp.status != "active":
@@ -297,6 +322,10 @@ def create_employee(
     session: Session = Depends(get_session),
     actor_employee_id: int = Depends(get_actor_employee_id),
 ):
+    _enforce_employee_create_policy(
+        session, actor_employee_id=actor_employee_id, target_employee_type=payload.employee_type
+    )
+
     emp = Employee(**payload.model_dump())
     session.add(emp)
 

From e0a2102778a66339f3254757c8192c2c5faeaff1 Mon Sep 17 00:00:00 2001
From: Abhimanyu Saharan <asaharan@onemindservices.com>
Date: Mon, 2 Feb 2026 22:19:03 +0530
Subject: [PATCH 27/27] chore(seed): remove seeded agent; keep only human

---
 backend/scripts/seed_data.sql | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/backend/scripts/seed_data.sql b/backend/scripts/seed_data.sql
index dffdbf2..9398dd4 100644
--- a/backend/scripts/seed_data.sql
+++ b/backend/scripts/seed_data.sql
@@ -15,10 +15,9 @@ ALTER TABLE public.task_comments DISABLE TRIGGER ALL;
 ALTER TABLE public.project_members DISABLE TRIGGER ALL;
 ALTER TABLE public.activities DISABLE TRIGGER ALL;
 
--- Employees (keep only Jarvis + Abhimanyu)
+-- Employees (keep only Abhimanyu)
 INSERT INTO public.employees (id, name, employee_type, department_id, manager_id, title, status, openclaw_session_key, notify_enabled, team_id)
 VALUES
-  (1, 'Jarvis', 'agent', NULL, NULL, 'CTO', 'active', NULL, true, NULL),
   (2, 'Abhimanyu', 'human', NULL, NULL, 'CEO', 'active', NULL, false, NULL)
 ON CONFLICT (id) DO UPDATE SET
   name = EXCLUDED.name,