From 2ce8bb5b77a129c2e794136c780b41c84bb1cede Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive>
Date: Sun, 31 May 2026 17:14:27 +0200
Subject: [PATCH] =?UTF-8?q?scheduled=5Fprompts:=20address=20argus=20?=
 =?UTF-8?q?=F0=9F=9F=A1=20on=20#849=20=E2=80=94=20submit=20paths=20section?=
 =?UTF-8?q?=20+=20persistence.md=20anchor=20fix?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/approvals.md                  |  9 +++++++++
 hive-c0re/src/scheduled_prompts.rs | 12 +++++++-----
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/docs/approvals.md b/docs/approvals.md
index c0abe68a..75ad859b 100644
--- a/docs/approvals.md
+++ b/docs/approvals.md
@@ -125,6 +125,15 @@ kind-specific payload carrier.
   inbox messages to each target at the scheduled time, recurring
   when `interval_seconds` is set.
 
+### Scheduled prompts (submit paths)
+
+Two ways a row lands in `scheduled_prompts`:
+
+- **Operator-direct** (`source = "operator"`): the operator adds a schedule through the dashboard form. Lands in the table immediately, no approval gate — operator action is already the trust boundary.
+- **Agent-requested** (`source = "approval:<id>"`): a sub-agent (or the manager) submits a `RequestSchedulePrompt` through the manager socket. An `ApprovalKind::SchedulePrompt` row is queued; on approve, hive-c0re inserts the schedule row with `source = approval:<id>` so the audit trail points back at the operator decision (above).
+
+No self-target shortcut: even agent-self schedules need approval. The existing `remind` MCP tool stays the quick self-wake path (no approval, lands directly in the agent's own inbox); this module is the bigger, multi-recipient, operator-visible thing.
+
 ### Scheduled prompt worker (catch-up clamp)
 
 When hive-c0re comes back from being down, the worker sees rows whose `next_fire_at_unix` is well in the past. For recurring rows that would mean firing N delayed pulses in a row — spammy and useless. Instead the worker fires **once** per row and bumps `next_fire_at_unix` to the next interval slot ≥ `now`, recording how many cycles were skipped in `last_result` (per-target). Operators see "fired late, caught up from 17 skipped" instead of 17 wake-up storms.
diff --git a/hive-c0re/src/scheduled_prompts.rs b/hive-c0re/src/scheduled_prompts.rs
index a3d75325..d4d83571 100644
--- a/hive-c0re/src/scheduled_prompts.rs
+++ b/hive-c0re/src/scheduled_prompts.rs
@@ -4,11 +4,13 @@
 //! `interval_seconds` and re-arm `next_fire_at` on delivery;
 //! one-shots are reaped.
 //!
-//! Schema + retention: `docs/persistence.md::scheduled_prompts /
-//! scheduled_prompt_targets`. Submit paths (operator vs
-//! `ApprovalKind::SchedulePrompt`), catch-up clamp on resume, and
-//! per-target tombstoning semantics: `docs/approvals.md::Scheduled
-//! prompt worker (catch-up clamp)`.
+//! Schema + retention: `docs/persistence.md::/var/lib/hyperhive/broker.sqlite`
+//! (the `scheduled_prompts` / `scheduled_prompt_targets` table bullets).
+//! Submit paths (operator-direct vs `ApprovalKind::SchedulePrompt`,
+//! plus why even agent-self schedules go through approval):
+//! `docs/approvals.md::Scheduled prompts (submit paths)`.
+//! Catch-up clamp on resume + per-target tombstoning:
+//! `docs/approvals.md::Scheduled prompt worker (catch-up clamp)`.
 
 use std::path::Path;
 use std::sync::Mutex;