fix(036): wire emit_terminal, register_draft via API, RBAC, payloadHash

agent/src/ss_tools/agent/_run_tracker.py

@@ -148,7 +148,28 @@ class RunTracker:
         sha256: str,
         validation_status: str = "pending",
     ) -> None:
-        """Register a draft artifact — emitted as progress event so frontend can update."""
+        """Register a draft artifact via backend API, then emit progress event."""
+        if self._run_id is None:
+            raise RuntimeError("Must call create() before emit_draft()")
+        client = await self._ensure_client()
+        try:
+            resp = await client.post(
+                f"{self._base_url}/api/agent/runs/{self._run_id}/drafts",
+                json={
+                    "kind": kind,
+                    "name": name,
+                    "intended_path": intended_path,
+                    "sha256": sha256,
+                    "validation_status": validation_status,
+                },
+            )
+            resp.raise_for_status()
+            draft_data = resp.json()
+            logger.reason("Draft registered", {"draft_id": draft_data.get("id"), "name": name})
+        except httpx.HTTPStatusError as exc:
+            logger.explore("Failed to register draft", {"name": name, "status": exc.response.status_code})
+            raise
+        # Also emit as event so frontend can update
         await self.append_event(
             event_type="drafts_updated",
             payload={
@@ -157,6 +178,7 @@ class RunTracker:
                 "intended_path": intended_path,
                 "sha256": sha256,
                 "validation_status": validation_status,
+                "draft_id": draft_data.get("id"),
             },
         )
 

agent/src/ss_tools/agent/app.py

@@ -922,6 +922,13 @@ async def agent_handler(  # noqa: C901 — intentionally complex C4 orchestratio
                 attempts=_attempts_used or None,
                 error_code=_request_error_code,
             )
+        # ── 036: Emit terminal run event ────────────────────
+        if run_tracker:
+            try:
+                status = {"completed": "COMPLETED", "failed": "FAILED"}.get(_request_result, "COMPLETED")
+                await run_tracker.emit_terminal(status, error_code=_request_error_code)
+            except Exception:
+                pass
         _user_locks[user_id] = False
         if conv_id and conv_id in _conv_locks:
             _conv_locks[conv_id].set()