agentic-backend-readiness: per-agent secret isolation, dormant cortex, structured worker outcomes

src/agent.rs

@@ -12,9 +12,11 @@ pub mod cortex_chat;
 pub mod ingestion;
 #[cfg(test)]
 mod invariant_harness;
+pub mod maintenance;
 pub mod process_control;
 pub mod prompt_snapshot;
 pub mod status;
+pub mod wake;
 pub mod worker;
 
 pub(crate) fn panic_payload_to_string(panic_payload: &(dyn std::any::Any + Send)) -> String {

src/agent/branch.rs

@@ -247,7 +247,7 @@ impl Branch {
         // Layer 1: exact-match redaction of known secrets from the store.
         // Layer 2: regex-based redaction of unknown secret patterns.
         let conclusion = if let Some(store) = self.deps.runtime_config.secrets.load().as_ref() {
-            crate::secrets::scrub::scrub_with_store(&conclusion, store)
+            crate::secrets::scrub::scrub_with_store(&conclusion, store, &self.deps.agent_id)
         } else {
             conclusion
         };

src/agent/channel.rs

@@ -870,13 +870,17 @@ impl Channel {
             let has_links =
                 !crate::links::links_for_agent(&deps.links.load(), &deps.agent_id).is_empty();
             if has_links {
-                Some(crate::tools::SendAgentMessageTool::new(
+                let mut tool = crate::tools::SendAgentMessageTool::new(
                     deps.agent_id.clone(),
                     deps.links.clone(),
                     deps.agent_names.clone(),
                     deps.task_store.clone(),
                     ConversationLogger::new(deps.sqlite_pool.clone()),
-                ))
+                );
+                if let Some(wake_tx) = deps.wake_tx.clone() {
+                    tool = tool.with_wake_tx(wake_tx);
+                }
+                Some(tool)
             } else {
                 None
             }