P0: make agent DMs reply and remove leaked synthetic live-proof data

[jusso-dev]

Live defect

The homelab instance accepts messages in Alfie/Jessie/Parker direct rooms but does not invoke the addressed agent or post a reply. It also contains synthetic live-proof/demo records from delivery validation, including enabled Alfie watchlists that repeatedly fail.

Observed on immutable image ghcr.io/jusso-dev/muster:sha-a37ea88:

• Agent gateway is ready, Codex subscription authentication is present, and services are healthy.
• Human messages in agent direct rooms persist successfully but create no message_mentions, agent_runs, or replies.
• The message POST route only invokes Jessie's explicit mention workflow; direct agent rooms are otherwise inert.
• Generic terminal agent runs do not project success/failure into room messages.
• Two synthetic Alfie schedules repeatedly fail with Research source is not allowlisted.
• Homelab Compose does not pass MUSTER_RESEARCH_ALLOWED_FEED_ORIGINS to the worker.
• Production contains unmistakable synthetic tasks, rooms, connectors, evidence, research runs, reports, and agent runs from live validation.
• Audit-chain verification reports an existing event-hash mismatch at sequence 136. Historical audit events must not be silently rewritten or deleted.

Immediate containment completed:

• Full PostgreSQL custom-format backup captured before mutation.
• Both exact synthetic watchlists disabled in one transaction.
• Each disable wrote an append-only audit event and outbox event.
• No new worker errors appeared after containment.

Required implementation

Direct-room agent invocation

• A new human text message in a direct room with exactly one active agent queues that agent exactly once.
• Require agents.invoke; enforce organisation, membership, allowed room, active definition, and kill switch server-side.
• Persist message, run, event, audit, and outbox state transactionally or use a durable idempotent handoff without losing the accepted message.
• Derive invocation idempotency from the persisted message.
• Keep long-running work in the agent gateway, outside the HTTP handler.
• Treat message content as untrusted evidence.
• Non-agent rooms retain explicit mention/workflow behavior.

Visible terminal results

• Every direct-room run posts exactly one append-only agent-authored result message on completion.
• Every terminal failure posts one redacted, actionable status message. Do not expose secrets, raw prompts, stack traces, or external content.
• Scheduled Alfie research posts a terminal status for final failure and for successful zero-finding runs; never one message per retry.
• Result messages link to the source message/run and write a room outbox event in the same transaction.
• Replays/restarts cannot duplicate runs or replies.

Homelab configuration

• Pass MUSTER_RESEARCH_ALLOWED_FEED_ORIGINS through Compose without adding mock or unsafe defaults.
• Document approved-origin configuration and failure behavior.

Synthetic-data cleanup

• Preserve user account/auth state and the four genuine human agent-DM messages.
• Preserve bootstrap organisation, administrator, three agents, system actor, SOC room, and three agent direct rooms.
• Remove only records proven synthetic/demo/live-proof by immutable IDs, explicit synthetic names/idempotency keys, mock flags, and related run provenance.
• Preserve append-only audit/outbox history. Do not cascade-delete historical audit evidence.
• Delete corresponding synthetic object-storage objects after database commit.
• Capture before/after counts and a second backup; verify service health and real login afterward.
• Do not seed production during live proof. Future production E2E must self-clean or use an isolated Compose project/volume.

Audit integrity

• Diagnose the existing hash mismatch at sequence 136.
• Do not rewrite history merely to make verification green.
• Add an operator-visible integrity result and an explicit recovery/attestation procedure if the historical event cannot be proven/reconstructed.
• Add regression coverage for the integration-action audit path that created the mismatching event class.

Acceptance

• hello in each Alfie/Jessie/Parker direct room creates one run and one eventual agent reply.
• Duplicate POST/replay creates neither duplicate run nor duplicate reply.
• Kill switch, capability denial, cross-org room, ambiguous/no-agent direct room, and inactive agent fail closed.
• Completion, runtime failure, cancellation, and timeout create safe terminal room status.
• Research final failure and zero-finding success are visible exactly once.
• Homelab worker receives an explicitly configured approved-origin allowlist.
• Visible synthetic tasks, rooms, runs, research, reports, connectors, evidence, and seeded demo actors are removed while genuine messages/auth/bootstrap remain.
• Before/after database counts and backup digests are recorded.
• PostgreSQL, Redis, MinIO, web, worker, and gateway remain healthy after cleanup and restart.
• Authenticated live proof confirms all three agents reply using the real Codex subscription runtime.
• Audit-chain mismatch is truthfully diagnosed and documented; no audit/outbox history is silently deleted.
• CI, security, container, isolated clean-install, and homelab regression checks pass.