feat(executor): per-task agent MCP server + token registry (Phase 2)

Adds the agent-facing MCP transport foundation: a Registry that mints a
per-task bearer token bound to a freshly built MCP server exposing the four
agent tools (ask_user, report_summary, spawn_subtask, record_progress), and
an HTTP handler (StreamableHTTP) that resolves the token to that server. The
server never trusts an agent-supplied task ID — context comes from the token.

The default storeChannel now buffers summary and question signals under a
mutex (an MCP tool call lands on an HTTP-handler goroutine mid-run), exposing
ReportedSummary/PendingQuestion. The pool flushes the buffered summary onto
the execution after the run, replacing the runner's direct exec.Summary write
and keeping the read race-free.

ask_user follows the record-and-resume model: it buffers the question, returns
ErrAgentBlocked, and the tool tells the agent to end its turn; the run blocks
and resumes later via claude --resume (no live slot held).

Tests cover registry lifecycle, in-memory tool dispatch, and HTTP end-to-end
with bearer auth (valid token dispatches; invalid token rejected).

Not yet wired into the runners or mounted on the API server — next increment.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39

11 files changed, 531 insertions, 61 deletions

diff --git a/go.mod b/go.mod
index 54d5b32..fb2828c 100644
--- a/go.mod
+++ b/go.mod
@@ -3,27 +3,33 @@ module github.com/thepeterstone/claudomator
 go 1.25.3
 
 require (
+	github.com/BurntSushi/toml v1.6.0
+	github.com/SherClockHolmes/webpush-go v1.4.0
 	github.com/google/uuid v1.6.0
 	github.com/mattn/go-sqlite3 v1.14.33
+	github.com/modelcontextprotocol/go-sdk v1.6.1
 	github.com/spf13/cobra v1.10.2
 	golang.org/x/net v0.49.0
 	gopkg.in/yaml.v3 v3.0.1
+	modernc.org/sqlite v1.47.0
 )
 
 require (
-	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/SherClockHolmes/webpush-go v1.4.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/google/jsonschema-go v0.4.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/segmentio/asm v1.1.3 // indirect
+	github.com/segmentio/encoding v0.5.4 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	golang.org/x/crypto v0.47.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	modernc.org/libc v1.70.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.47.0 // indirect
 )
diff --git a/go.sum b/go.sum
index a202d97..e4d2f97 100644
--- a/go.sum
+++ b/go.sum
@@ -5,26 +5,43 @@ github.com/SherClockHolmes/webpush-go v1.4.0/go.mod h1:XSq8pKX11vNV8MJEMwjrlTkxh
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
 github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0=
+github.com/google/jsonschema-go v0.4.3/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-sqlite3 v1.14.33 h1:A5blZ5ulQo2AtayQ9/limgHEkFreKj1Dv226a1K73s0=
 github.com/mattn/go-sqlite3 v1.14.33/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/modelcontextprotocol/go-sdk v1.6.1 h1:0zOSupjKUxPKSocPT1Wtago+mUHU2/uZ4xSOY0FGReU=
+github.com/modelcontextprotocol/go-sdk v1.6.1/go.mod h1:kzm3kzFL1/+AziGOE0nUs3gvPoNxMCvkxokMkuFapXQ=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/segmentio/asm v1.1.3 h1:WM03sfUOENvvKexOLp+pCqgb/WDjsi7EK8gIsICtzhc=
+github.com/segmentio/asm v1.1.3/go.mod h1:Ld3L4ZXGNcSLRg4JBsZ3//1+f/TjYl0Mzen/DQy1EJg=
+github.com/segmentio/encoding v0.5.4 h1:OW1VRern8Nw6ITAtwSZ7Idrl3MXCFwXHPgqESYfvNt0=
+github.com/segmentio/encoding v0.5.4/go.mod h1:HS1ZKa3kSN32ZHVZ7ZLPLXWvOVIiZtyJnO1gPH1sKt0=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -40,6 +57,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -50,6 +69,8 @@ golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
 golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -57,6 +78,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -95,16 +118,38 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
+modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
 modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
 modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
 modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
 modernc.org/sqlite v1.47.0 h1:R1XyaNpoW4Et9yly+I2EeX7pBza/w+pmYee/0HJDyKk=
 modernc.org/sqlite v1.47.0/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
diff --git a/internal/executor/agentmcp.go b/internal/executor/agentmcp.go
new file mode 100644
index 0000000..4368031
--- /dev/null
+++ b/internal/executor/agentmcp.go
@@ -0,0 +1,160 @@
+package executor
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+
+// Registry maps per-task MCP bearer tokens to a built agent MCP server. A token
+// is minted when a runner spawns an agent subprocess and revoked when it exits,
+// so the server resolves task context from the token alone and never trusts an
+// agent-supplied task ID.
+type Registry struct {
+	mu      sync.RWMutex
+	servers map[string]*mcp.Server
+}
+
+func NewRegistry() *Registry {
+	return &Registry{servers: make(map[string]*mcp.Server)}
+}
+
+// Mint creates a token bound to a freshly built MCP server for ch.
+func (r *Registry) Mint(ch AgentChannel) (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	token := hex.EncodeToString(buf)
+	r.mu.Lock()
+	r.servers[token] = newAgentServer(ch)
+	r.mu.Unlock()
+	return token, nil
+}
+
+func (r *Registry) server(token string) (*mcp.Server, bool) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	s, ok := r.servers[token]
+	return s, ok
+}
+
+func (r *Registry) Revoke(token string) {
+	r.mu.Lock()
+	delete(r.servers, token)
+	r.mu.Unlock()
+}
+
+type askUserInput struct {
+	Question string   `json:"question" jsonschema:"the question to ask the user; phrase it as a real question ending with a question mark"`
+	Options  []string `json:"options,omitempty" jsonschema:"optional list of suggested answer choices"`
+}
+
+type reportSummaryInput struct {
+	Summary string `json:"summary" jsonschema:"a 2-5 sentence summary of what you did and the outcome"`
+}
+
+type spawnSubtaskInput struct {
+	Name         string  `json:"name" jsonschema:"short descriptive name for the subtask"`
+	Instructions string  `json:"instructions" jsonschema:"complete instructions for the subtask agent"`
+	Model        string  `json:"model,omitempty" jsonschema:"optional model override, e.g. sonnet or opus"`
+	MaxBudgetUSD float64 `json:"max_budget_usd,omitempty" jsonschema:"optional budget cap in USD"`
+}
+
+type recordProgressInput struct {
+	Message string `json:"message" jsonschema:"a short progress note describing what you are doing"`
+}
+
+func textResult(text string) *mcp.CallToolResult {
+	return &mcp.CallToolResult{Content: []mcp.Content{&mcp.TextContent{Text: text}}}
+}
+
+// newAgentServer builds an MCP server exposing the four agent tools bound to ch.
+func newAgentServer(ch AgentChannel) *mcp.Server {
+	s := mcp.NewServer(&mcp.Implementation{Name: "claudomator", Version: "1"}, nil)
+
+	mcp.AddTool(s, &mcp.Tool{
+		Name:        "ask_user",
+		Description: "Ask the user a question when you genuinely need a decision to proceed. Your turn ends after calling this; the task is resumed with the user's answer. Prefer making a reasonable decision and noting it in report_summary over asking.",
+	}, func(ctx context.Context, _ *mcp.CallToolRequest, in askUserInput) (*mcp.CallToolResult, any, error) {
+		q := map[string]any{"text": in.Question}
+		if len(in.Options) > 0 {
+			q["options"] = in.Options
+		}
+		payload, _ := json.Marshal(q)
+		ans, err := ch.AskUser(ctx, string(payload))
+		if errors.Is(err, ErrAgentBlocked) {
+			return textResult("Question recorded. End your turn now without calling any more tools; the task will be resumed once the user answers."), nil, nil
+		}
+		if err != nil {
+			return nil, nil, err
+		}
+		return textResult(ans), nil, nil
+	})
+
+	mcp.AddTool(s, &mcp.Tool{
+		Name:        "report_summary",
+		Description: "Record a concise summary of what you accomplished. Call this before finishing.",
+	}, func(ctx context.Context, _ *mcp.CallToolRequest, in reportSummaryInput) (*mcp.CallToolResult, any, error) {
+		if err := ch.ReportSummary(ctx, in.Summary); err != nil {
+			return nil, nil, err
+		}
+		return textResult("Summary recorded."), nil, nil
+	})
+
+	mcp.AddTool(s, &mcp.Tool{
+		Name:        "spawn_subtask",
+		Description: "Create a child task to be executed separately. Use this to break large work into focused pieces, then finish your turn.",
+	}, func(ctx context.Context, _ *mcp.CallToolRequest, in spawnSubtaskInput) (*mcp.CallToolResult, any, error) {
+		id, err := ch.SpawnSubtask(ctx, SubtaskSpec{
+			Name:         in.Name,
+			Instructions: in.Instructions,
+			Model:        in.Model,
+			MaxBudgetUSD: in.MaxBudgetUSD,
+		})
+		if err != nil {
+			return nil, nil, err
+		}
+		return textResult("Created subtask " + id), nil, nil
+	})
+
+	mcp.AddTool(s, &mcp.Tool{
+		Name:        "record_progress",
+		Description: "Record a short progress note that appears in the task timeline.",
+	}, func(ctx context.Context, _ *mcp.CallToolRequest, in recordProgressInput) (*mcp.CallToolResult, any, error) {
+		if err := ch.RecordProgress(ctx, in.Message); err != nil {
+			return nil, nil, err
+		}
+		return textResult("Noted."), nil, nil
+	})
+
+	return s
+}
+
+func bearerToken(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	if h == "" {
+		return ""
+	}
+	return strings.TrimSpace(strings.TrimPrefix(h, "Bearer "))
+}
+
+// NewAgentMCPHandler returns the HTTP handler for the per-task agent MCP server.
+// It resolves the request's bearer token to the server for that task's run;
+// unknown tokens yield a 400 from the underlying handler.
+func NewAgentMCPHandler(reg *Registry) http.Handler {
+	return mcp.NewStreamableHTTPHandler(func(r *http.Request) *mcp.Server {
+		s, ok := reg.server(bearerToken(r))
+		if !ok {
+			return nil
+		}
+		return s
+	}, nil)
+}
diff --git a/internal/executor/agentmcp_test.go b/internal/executor/agentmcp_test.go
new file mode 100644
index 0000000..3973af0
--- /dev/null
+++ b/internal/executor/agentmcp_test.go
@@ -0,0 +1,218 @@
+package executor
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+
+// recordingChannel is a fake AgentChannel that records tool invocations.
+type recordingChannel struct {
+	asked    string
+	summary  string
+	spawned  []SubtaskSpec
+	progress []string
+	spawnID  string
+}
+
+func (c *recordingChannel) AskUser(_ context.Context, q string) (string, error) {
+	c.asked = q
+	return "", ErrAgentBlocked
+}
+func (c *recordingChannel) ReportSummary(_ context.Context, s string) error {
+	c.summary = s
+	return nil
+}
+func (c *recordingChannel) SpawnSubtask(_ context.Context, spec SubtaskSpec) (string, error) {
+	c.spawned = append(c.spawned, spec)
+	return c.spawnID, nil
+}
+func (c *recordingChannel) RecordProgress(_ context.Context, m string) error {
+	c.progress = append(c.progress, m)
+	return nil
+}
+
+func resultText(t *testing.T, res *mcp.CallToolResult) string {
+	t.Helper()
+	if len(res.Content) == 0 {
+		t.Fatal("expected content in tool result")
+	}
+	tc, ok := res.Content[0].(*mcp.TextContent)
+	if !ok {
+		t.Fatalf("expected TextContent, got %T", res.Content[0])
+	}
+	return tc.Text
+}
+
+func TestRegistry_MintLookupRevoke(t *testing.T) {
+	reg := NewRegistry()
+	tok, err := reg.Mint(&recordingChannel{})
+	if err != nil {
+		t.Fatalf("Mint: %v", err)
+	}
+	if tok == "" {
+		t.Fatal("expected non-empty token")
+	}
+	if _, ok := reg.server(tok); !ok {
+		t.Error("expected server for minted token")
+	}
+	if _, ok := reg.server("nonsense"); ok {
+		t.Error("expected no server for unknown token")
+	}
+	reg.Revoke(tok)
+	if _, ok := reg.server(tok); ok {
+		t.Error("expected no server after revoke")
+	}
+}
+
+func TestRegistry_MintUniqueTokens(t *testing.T) {
+	reg := NewRegistry()
+	a, _ := reg.Mint(&recordingChannel{})
+	b, _ := reg.Mint(&recordingChannel{})
+	if a == b {
+		t.Error("expected unique tokens per mint")
+	}
+}
+
+// connectInMemory wires a client to a server over the SDK's in-memory transport.
+func connectInMemory(t *testing.T, srv *mcp.Server) *mcp.ClientSession {
+	t.Helper()
+	ctx := context.Background()
+	clientT, serverT := mcp.NewInMemoryTransports()
+	if _, err := srv.Connect(ctx, serverT, nil); err != nil {
+		t.Fatalf("server connect: %v", err)
+	}
+	client := mcp.NewClient(&mcp.Implementation{Name: "test", Version: "1"}, nil)
+	cs, err := client.Connect(ctx, clientT, nil)
+	if err != nil {
+		t.Fatalf("client connect: %v", err)
+	}
+	t.Cleanup(func() { _ = cs.Close() })
+	return cs
+}
+
+func TestAgentServer_AskUser_RecordsAndInstructsStop(t *testing.T) {
+	ch := &recordingChannel{}
+	cs := connectInMemory(t, newAgentServer(ch))
+	res, err := cs.CallTool(context.Background(), &mcp.CallToolParams{
+		Name:      "ask_user",
+		Arguments: map[string]any{"question": "Proceed?", "options": []string{"yes", "no"}},
+	})
+	if err != nil {
+		t.Fatalf("CallTool: %v", err)
+	}
+	if !strings.Contains(ch.asked, `"text":"Proceed?"`) || !strings.Contains(ch.asked, "yes") {
+		t.Errorf("channel did not receive question+options: %q", ch.asked)
+	}
+	if txt := resultText(t, res); !strings.Contains(strings.ToLower(txt), "recorded") {
+		t.Errorf("expected stop instruction, got %q", txt)
+	}
+}
+
+func TestAgentServer_ReportSummary(t *testing.T) {
+	ch := &recordingChannel{}
+	cs := connectInMemory(t, newAgentServer(ch))
+	if _, err := cs.CallTool(context.Background(), &mcp.CallToolParams{
+		Name:      "report_summary",
+		Arguments: map[string]any{"summary": "did the work"},
+	}); err != nil {
+		t.Fatalf("CallTool: %v", err)
+	}
+	if ch.summary != "did the work" {
+		t.Errorf("summary not recorded, got %q", ch.summary)
+	}
+}
+
+func TestAgentServer_SpawnSubtask(t *testing.T) {
+	ch := &recordingChannel{spawnID: "sub-1"}
+	cs := connectInMemory(t, newAgentServer(ch))
+	res, err := cs.CallTool(context.Background(), &mcp.CallToolParams{
+		Name:      "spawn_subtask",
+		Arguments: map[string]any{"name": "child", "instructions": "do it", "model": "sonnet"},
+	})
+	if err != nil {
+		t.Fatalf("CallTool: %v", err)
+	}
+	if len(ch.spawned) != 1 || ch.spawned[0].Name != "child" || ch.spawned[0].Instructions != "do it" || ch.spawned[0].Model != "sonnet" {
+		t.Errorf("subtask spec not propagated: %+v", ch.spawned)
+	}
+	if txt := resultText(t, res); !strings.Contains(txt, "sub-1") {
+		t.Errorf("expected returned subtask ID in result, got %q", txt)
+	}
+}
+
+func TestAgentServer_RecordProgress(t *testing.T) {
+	ch := &recordingChannel{}
+	cs := connectInMemory(t, newAgentServer(ch))
+	if _, err := cs.CallTool(context.Background(), &mcp.CallToolParams{
+		Name:      "record_progress",
+		Arguments: map[string]any{"message": "halfway"},
+	}); err != nil {
+		t.Fatalf("CallTool: %v", err)
+	}
+	if len(ch.progress) != 1 || ch.progress[0] != "halfway" {
+		t.Errorf("progress not recorded: %+v", ch.progress)
+	}
+}
+
+type bearerRT struct {
+	token string
+	base  http.RoundTripper
+}
+
+func (b bearerRT) RoundTrip(r *http.Request) (*http.Response, error) {
+	r = r.Clone(r.Context())
+	if b.token != "" {
+		r.Header.Set("Authorization", "Bearer "+b.token)
+	}
+	return b.base.RoundTrip(r)
+}
+
+func TestAgentMCPHandler_HTTP_AuthAndDispatch(t *testing.T) {
+	ch := &recordingChannel{}
+	reg := NewRegistry()
+	tok, _ := reg.Mint(ch)
+
+	httpSrv := httptest.NewServer(NewAgentMCPHandler(reg))
+	defer httpSrv.Close()
+
+	ctx := context.Background()
+	client := mcp.NewClient(&mcp.Implementation{Name: "test", Version: "1"}, nil)
+	cs, err := client.Connect(ctx, &mcp.StreamableClientTransport{
+		Endpoint:   httpSrv.URL,
+		HTTPClient: &http.Client{Transport: bearerRT{token: tok, base: http.DefaultTransport}},
+	}, nil)
+	if err != nil {
+		t.Fatalf("client connect with valid token: %v", err)
+	}
+	defer cs.Close()
+
+	if _, err := cs.CallTool(ctx, &mcp.CallToolParams{
+		Name:      "record_progress",
+		Arguments: map[string]any{"message": "over http"},
+	}); err != nil {
+		t.Fatalf("CallTool over HTTP: %v", err)
+	}
+	if len(ch.progress) != 1 || ch.progress[0] != "over http" {
+		t.Errorf("HTTP dispatch did not reach channel: %+v", ch.progress)
+	}
+}
+
+func TestAgentMCPHandler_HTTP_BadTokenRejected(t *testing.T) {
+	reg := NewRegistry()
+	httpSrv := httptest.NewServer(NewAgentMCPHandler(reg))
+	defer httpSrv.Close()
+
+	client := mcp.NewClient(&mcp.Implementation{Name: "test", Version: "1"}, nil)
+	_, err := client.Connect(context.Background(), &mcp.StreamableClientTransport{
+		Endpoint:   httpSrv.URL,
+		HTTPClient: &http.Client{Transport: bearerRT{token: "invalid", base: http.DefaultTransport}},
+	}, nil)
+	if err == nil {
+		t.Fatal("expected connect to fail with invalid token")
+	}
+}
diff --git a/internal/executor/channel.go b/internal/executor/channel.go
index 76df94f..541694b 100644
--- a/internal/executor/channel.go
+++ b/internal/executor/channel.go
@@ -4,10 +4,10 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"sync"
 	"time"
 
 	"github.com/thepeterstone/claudomator/internal/event"
-	"github.com/thepeterstone/claudomator/internal/storage"
 	"github.com/thepeterstone/claudomator/internal/task"
 	"github.com/google/uuid"
 )
@@ -50,37 +50,64 @@ type channelStore interface {
 	CreateEvent(e *event.Event) error
 }
 
-// storeChannel is the default AgentChannel backed by storage. Summary reports
-// are buffered onto the execution record so the pool persists them once (with
-// its extract/synthesize fallbacks); other signals are written immediately.
+// storeChannel is the default AgentChannel backed by storage. Summary and
+// question signals are buffered here under a mutex (they may arrive on an MCP
+// handler goroutine mid-run); the pool flushes the summary to the execution and
+// the runner reads the pending question to build a BlockedError after the
+// subprocess exits. SpawnSubtask/RecordProgress write immediately.
 type storeChannel struct {
 	store  channelStore
 	taskID string
-	exec   *storage.Execution
+
+	mu         sync.Mutex
+	summary    string
+	summarySet bool
+	question   string
+	blocked    bool
 }
 
 var _ AgentChannel = (*storeChannel)(nil)
 
-func newStoreChannel(store channelStore, taskID string, exec *storage.Execution) *storeChannel {
-	return &storeChannel{store: store, taskID: taskID, exec: exec}
+func newStoreChannel(store channelStore, taskID string) *storeChannel {
+	return &storeChannel{store: store, taskID: taskID}
 }
 
-// AskUser on the default (file-transport) channel cannot deliver an answer
-// in-session, so it always reports the run as blocked. Question persistence is
-// owned by the pool's BlockedError handling.
-func (c *storeChannel) AskUser(_ context.Context, _ string) (string, error) {
+// AskUser buffers the question and flags the run as blocked. The default
+// transport cannot deliver an answer in-session, so it returns ErrAgentBlocked;
+// the runner converts the buffered question into a BlockedError after exit, and
+// question persistence is owned by the pool's BlockedError handling.
+func (c *storeChannel) AskUser(_ context.Context, questionJSON string) (string, error) {
+	c.mu.Lock()
+	c.question = questionJSON
+	c.blocked = true
+	c.mu.Unlock()
 	return "", ErrAgentBlocked
 }
 
-// ReportSummary buffers the summary onto the execution record. The pool persists
-// it (preferring this value over its extract/synthesize fallbacks).
+// ReportSummary buffers the summary; the pool flushes it onto the execution
+// after the run (preferring it over its extract/synthesize fallbacks).
 func (c *storeChannel) ReportSummary(_ context.Context, summary string) error {
-	if c.exec != nil {
-		c.exec.Summary = summary
-	}
+	c.mu.Lock()
+	c.summary = summary
+	c.summarySet = true
+	c.mu.Unlock()
 	return nil
 }
 
+// ReportedSummary returns the buffered summary if report_summary was called.
+func (c *storeChannel) ReportedSummary() (string, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.summary, c.summarySet
+}
+
+// PendingQuestion returns the buffered ask_user question if the run is blocked.
+func (c *storeChannel) PendingQuestion() (string, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.question, c.blocked
+}
+
 func (c *storeChannel) SpawnSubtask(_ context.Context, spec SubtaskSpec) (string, error) {
 	now := time.Now().UTC()
 	child := &task.Task{
diff --git a/internal/executor/channel_test.go b/internal/executor/channel_test.go
index 822dd35..250e8eb 100644
--- a/internal/executor/channel_test.go
+++ b/internal/executor/channel_test.go
@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/thepeterstone/claudomator/internal/event"
-	"github.com/thepeterstone/claudomator/internal/storage"
 	"github.com/thepeterstone/claudomator/internal/task"
 )
 
@@ -29,8 +28,8 @@ func (f *fakeChannelStore) CreateEvent(e *event.Event) error {
 	return nil
 }
 
-func TestStoreChannel_AskUser_ReturnsBlocked(t *testing.T) {
-	ch := newStoreChannel(&fakeChannelStore{}, "task-1", &storage.Execution{})
+func TestStoreChannel_AskUser_BuffersAndBlocks(t *testing.T) {
+	ch := newStoreChannel(&fakeChannelStore{}, "task-1")
 	answer, err := ch.AskUser(context.Background(), `{"text":"q"}`)
 	if !errors.Is(err, ErrAgentBlocked) {
 		t.Errorf("expected ErrAgentBlocked, got %v", err)
@@ -38,29 +37,36 @@ func TestStoreChannel_AskUser_ReturnsBlocked(t *testing.T) {
 	if answer != "" {
 		t.Errorf("expected empty answer, got %q", answer)
 	}
+	q, blocked := ch.PendingQuestion()
+	if !blocked || q != `{"text":"q"}` {
+		t.Errorf("expected buffered question, got q=%q blocked=%v", q, blocked)
+	}
 }
 
-func TestStoreChannel_ReportSummary_BuffersOntoExec(t *testing.T) {
-	e := &storage.Execution{}
-	ch := newStoreChannel(&fakeChannelStore{}, "task-1", e)
-	if err := ch.ReportSummary(context.Background(), "did the thing"); err != nil {
-		t.Fatalf("ReportSummary: %v", err)
-	}
-	if e.Summary != "did the thing" {
-		t.Errorf("expected exec.Summary set, got %q", e.Summary)
+func TestStoreChannel_PendingQuestion_DefaultNotBlocked(t *testing.T) {
+	ch := newStoreChannel(&fakeChannelStore{}, "task-1")
+	if q, blocked := ch.PendingQuestion(); blocked || q != "" {
+		t.Errorf("expected no pending question, got q=%q blocked=%v", q, blocked)
 	}
 }
 
-func TestStoreChannel_ReportSummary_NilExec(t *testing.T) {
-	ch := newStoreChannel(&fakeChannelStore{}, "task-1", nil)
-	if err := ch.ReportSummary(context.Background(), "x"); err != nil {
-		t.Errorf("expected nil err with nil exec, got %v", err)
+func TestStoreChannel_ReportSummary_Buffers(t *testing.T) {
+	ch := newStoreChannel(&fakeChannelStore{}, "task-1")
+	if _, ok := ch.ReportedSummary(); ok {
+		t.Error("expected no summary before report")
+	}
+	if err := ch.ReportSummary(context.Background(), "did the thing"); err != nil {
+		t.Fatalf("ReportSummary: %v", err)
+	}
+	sum, ok := ch.ReportedSummary()
+	if !ok || sum != "did the thing" {
+		t.Errorf("expected buffered summary, got %q ok=%v", sum, ok)
 	}
 }
 
 func TestStoreChannel_SpawnSubtask_CreatesChildWithParent(t *testing.T) {
 	store := &fakeChannelStore{}
-	ch := newStoreChannel(store, "parent-1", &storage.Execution{})
+	ch := newStoreChannel(store, "parent-1")
 	id, err := ch.SpawnSubtask(context.Background(), SubtaskSpec{
 		Name:         "child",
 		Instructions: "do it",
@@ -93,7 +99,7 @@ func TestStoreChannel_SpawnSubtask_CreatesChildWithParent(t *testing.T) {
 
 func TestStoreChannel_SpawnSubtask_PropagatesError(t *testing.T) {
 	store := &fakeChannelStore{createTaskErr: errors.New("boom")}
-	ch := newStoreChannel(store, "parent-1", &storage.Execution{})
+	ch := newStoreChannel(store, "parent-1")
 	if _, err := ch.SpawnSubtask(context.Background(), SubtaskSpec{Name: "x"}); err == nil {
 		t.Error("expected error from CreateTask")
 	}
@@ -101,7 +107,7 @@ func TestStoreChannel_SpawnSubtask_PropagatesError(t *testing.T) {
 
 func TestStoreChannel_RecordProgress_EmitsAgentMessage(t *testing.T) {
 	store := &fakeChannelStore{}
-	ch := newStoreChannel(store, "task-1", &storage.Execution{})
+	ch := newStoreChannel(store, "task-1")
 	if err := ch.RecordProgress(context.Background(), "halfway done"); err != nil {
 		t.Fatalf("RecordProgress: %v", err)
 	}
diff --git a/internal/executor/claude_test.go b/internal/executor/claude_test.go
index 0e76260..414f6cf 100644
--- a/internal/executor/claude_test.go
+++ b/internal/executor/claude_test.go
@@ -259,7 +259,7 @@ func TestClaudeRunner_Run_ResumeSetsSessionIDFromResumeSession(t *testing.T) {
 	}
 
 	// Run completes successfully (binary is "true").
-	_ = r.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID, exec))
+	_ = r.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID))
 
 	// SessionID must be the original session (ResumeSessionID), not the new
 	// exec's own ID. If it were exec.ID, a second blocked-then-resumed cycle
@@ -284,7 +284,7 @@ func TestClaudeRunner_Run_InaccessibleWorkingDir_ReturnsError(t *testing.T) {
 	}
 	exec := &storage.Execution{ID: "test-exec"}
 
-	err := r.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID, exec))
+	err := r.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID))
 
 	if err == nil {
 		t.Fatal("expected error for inaccessible working_dir, got nil")
@@ -732,7 +732,7 @@ func TestClaudeRunner_Run_ResumeUsesStoredSandboxDir(t *testing.T) {
 		SandboxDir:      sandboxDir,
 	}
 
-	_ = r.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID, exec))
+	_ = r.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID))
 
 	got, err := os.ReadFile(cwdFile)
 	if err != nil {
@@ -778,7 +778,7 @@ func TestClaudeRunner_Run_StaleSandboxDir_ClonesAfresh(t *testing.T) {
 		SandboxDir:      staleSandbox,
 	}
 
-	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e)); err != nil {
+	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID)); err != nil {
 		t.Fatalf("Run with stale sandbox: %v", err)
 	}
 
diff --git a/internal/executor/container_test.go b/internal/executor/container_test.go
index 5ee3a3c..9cd80dc 100644
--- a/internal/executor/container_test.go
+++ b/internal/executor/container_test.go
@@ -139,7 +139,7 @@ func TestContainerRunner_Run_PreservesWorkspaceOnFailure(t *testing.T) {
 	}
 	exec := &storage.Execution{ID: "test-exec", TaskID: "test-task"}
 
-	err := runner.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID, exec))
+	err := runner.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID))
 	if err == nil {
 		t.Fatal("expected error due to mocked docker failure")
 	}
@@ -378,7 +378,7 @@ func TestContainerRunner_MissingCredentials_FailsFast(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "test-exec", TaskID: "test-missing-creds"}
 
-	err := runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
+	err := runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID))
 	if err == nil {
 		t.Fatal("expected error due to missing credentials, got nil")
 	}
@@ -418,7 +418,7 @@ func TestContainerRunner_MissingSettings_FailsFast(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "test-exec-2", TaskID: "test-missing-settings"}
 
-	err := runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
+	err := runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID))
 	if err == nil {
 		t.Fatal("expected error due to missing settings, got nil")
 	}
@@ -504,7 +504,7 @@ func TestContainerRunner_AuthError_SyncsAndRetries(t *testing.T) {
 	e := &storage.Execution{ID: "auth-retry-exec", TaskID: "auth-retry-test"}
 
 	// Run — first attempt will fail with auth error, triggering sync+retry
-	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
+	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID))
 	// We don't check error strictly since second run may also fail (git push etc.)
 	// What we care about is that docker was called twice and sync was called
 	if callCount < 2 {
@@ -550,7 +550,7 @@ func TestContainerRunner_ClonesStoryBranch(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "exec-1", TaskID: "story-branch-test"}
 
-	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
+	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID))
 	os.RemoveAll(e.SandboxDir)
 
 	// Assert git checkout was called with the story branch name.
@@ -597,7 +597,7 @@ func TestContainerRunner_ClonesDefaultBranchWhenNoBranchName(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "exec-2", TaskID: "no-branch-test"}
 
-	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
+	runner.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID))
 	os.RemoveAll(e.SandboxDir)
 
 	for _, a := range cloneArgs {
diff --git a/internal/executor/executor.go b/internal/executor/executor.go
index 76e67b8..6d6c528 100644
--- a/internal/executor/executor.go
+++ b/internal/executor/executor.go
@@ -356,8 +356,12 @@ func (p *Pool) executeResume(ctx context.Context, t *task.Task, exec *storage.Ex
 		}
 	}
 
-	err = runner.Run(ctx, t, exec, newStoreChannel(p.store, t.ID, exec))
+	sc := newStoreChannel(p.store, t.ID)
+	err = runner.Run(ctx, t, exec, sc)
 	exec.EndTime = time.Now().UTC()
+	if sum, ok := sc.ReportedSummary(); ok {
+		exec.Summary = sum
+	}
 
 	p.decActiveAgent(agentType, &cleaned)
 	p.handleRunResult(ctx, t, exec, err, agentType)
@@ -1077,8 +1081,12 @@ func (p *Pool) execute(ctx context.Context, t *task.Task) {
 	}
 
 	// Run the task.
-	err = runner.Run(ctx, t, exec, newStoreChannel(p.store, t.ID, exec))
+	sc := newStoreChannel(p.store, t.ID)
+	err = runner.Run(ctx, t, exec, sc)
 	exec.EndTime = time.Now().UTC()
+	if sum, ok := sc.ReportedSummary(); ok {
+		exec.Summary = sum
+	}
 
 	p.decActiveAgent(agentType, &cleaned)
 	p.handleRunResult(ctx, t, exec, err, agentType)
diff --git a/internal/executor/gemini_test.go b/internal/executor/gemini_test.go
index c8f7422..a906f2c 100644
--- a/internal/executor/gemini_test.go
+++ b/internal/executor/gemini_test.go
@@ -125,7 +125,7 @@ func TestGeminiRunner_Run_InaccessibleProjectDir_ReturnsError(t *testing.T) {
 	}
 	exec := &storage.Execution{ID: "test-exec"}
 
-	err := r.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID, exec))
+	err := r.Run(context.Background(), tk, exec, newStoreChannel(nil, tk.ID))
 
 	if err == nil {
 		t.Fatal("expected error for inaccessible project_dir, got nil")
@@ -213,7 +213,7 @@ func TestGeminiRunner_Run_ProjectDir_RunsInSandbox(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "sandbox-exec", TaskID: "task-1"}
 
-	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e)); err != nil {
+	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID)); err != nil {
 		t.Fatalf("Run: %v", err)
 	}
 
@@ -261,7 +261,7 @@ fi
 	}
 	e := &storage.Execution{ID: "blocked-gemini-exec", TaskID: "task-1"}
 
-	err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
+	err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID))
 
 	var blocked *BlockedError
 	if !errors.As(err, &blocked) {
@@ -301,7 +301,7 @@ func TestGeminiRunner_Run_ExecError_PreservesSandbox(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "err-gemini-exec", TaskID: "task-1"}
 
-	err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e))
+	err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID))
 	if err == nil {
 		t.Fatal("expected error from failing gemini exit")
 	}
@@ -352,7 +352,7 @@ func TestGeminiRunner_Run_ResumeUsesStoredSandboxDir(t *testing.T) {
 		SandboxDir:      sandboxDir,
 	}
 
-	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e)); err != nil {
+	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID)); err != nil {
 		t.Fatalf("Run with preserved sandbox: %v", err)
 	}
 
@@ -400,7 +400,7 @@ func TestGeminiRunner_Run_StaleSandboxDir_ClonesAfresh(t *testing.T) {
 		SandboxDir:      staleSandbox,
 	}
 
-	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e)); err != nil {
+	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID)); err != nil {
 		t.Fatalf("Run with stale sandbox: %v", err)
 	}
 
@@ -438,7 +438,7 @@ func TestGeminiRunner_Run_NoProjectDir_SkipsSandbox(t *testing.T) {
 	}
 	e := &storage.Execution{ID: "no-pd-gemini", TaskID: "task-nopd"}
 
-	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID, e)); err != nil {
+	if err := r.Run(context.Background(), tk, e, newStoreChannel(nil, tk.ID)); err != nil {
 		t.Fatalf("Run without project_dir: %v", err)
 	}
 	if e.SandboxDir != "" {
diff --git a/internal/executor/local_test.go b/internal/executor/local_test.go
index 8aa8791..ffe87f9 100644
--- a/internal/executor/local_test.go
+++ b/internal/executor/local_test.go
@@ -72,7 +72,7 @@ func TestLocalRunner_Run_WritesStreamJSON(t *testing.T) {
 	}
 	exec := &storage.Execution{ID: uuid.New().String(), TaskID: tt.ID}
 
-	if err := r.Run(context.Background(), tt, exec, newStoreChannel(nil, tt.ID, exec)); err != nil {
+	if err := r.Run(context.Background(), tt, exec, newStoreChannel(nil, tt.ID)); err != nil {
 		t.Fatalf("Run: %v", err)
 	}
 
@@ -121,7 +121,7 @@ func TestLocalRunner_Run_NoClient_Errors(t *testing.T) {
 	r := &LocalRunner{LogDir: t.TempDir()}
 	tt := &task.Task{ID: "x", Agent: task.AgentConfig{Instructions: "hi"}}
 	exec := &storage.Execution{ID: "exec-x"}
-	err := r.Run(context.Background(), tt, exec, newStoreChannel(nil, tt.ID, exec))
+	err := r.Run(context.Background(), tt, exec, newStoreChannel(nil, tt.ID))
 	if err == nil || !strings.Contains(err.Error(), "no LLM client") {
 		t.Errorf("expected 'no LLM client' error, got %v", err)
 	}
@@ -134,7 +134,7 @@ func TestLocalRunner_Run_EmptyInstructions_Errors(t *testing.T) {
 	}
 	tt := &task.Task{ID: "x", Agent: task.AgentConfig{}}
 	exec := &storage.Execution{ID: "exec-x"}
-	err := r.Run(context.Background(), tt, exec, newStoreChannel(nil, tt.ID, exec))
+	err := r.Run(context.Background(), tt, exec, newStoreChannel(nil, tt.ID))
 	if err == nil || !strings.Contains(err.Error(), "empty instructions") {
 		t.Errorf("expected empty-instructions error, got %v", err)
 	}