tic: run per-user under a system-agent scheduler, with a run log

Reframe TIC from an ownerless global loop into a per-user system agent.
The events it reads live in each user's own encrypted mcp_events, the
connectors that produced them run in that user's container, and the
notifications go to that user's hub — so the previous design (built
against the ownerless Conversation bundle, writing into system.db and
notifying a hub with no subscribers) was inert by construction.

Core changes
- TicManager owns no timer and no user list. It now exposes
  run_for(user_id, pool, sessions, hub): one tick for one user, over
  deps unpacked from that user's UserContext. Removed from the
  Conversation bundle; Skald::tic_manager() is gone.
- New spawn_system_agents in wiring.rs: one instance-wide loop, spawned
  post-construction with a Weak<Skald> (like spawn_user_lifecycle).
  Each pass walks the directory and runs TIC for one user at a time —
  sequential, because a pass is N container round-trips and N LLM calls
  nobody is waiting on. A ConfigKeyUpdated on the interval key cuts the
  current wait short; enabled is re-read per pass.
- A user whose database is still locked is skipped (normal, not an
  error): the pool is the unlock token, so a user who hasn't logged in
  since restart has no readable events and nowhere to record a skip.
- The configured tic.security_group is re-checked per user through
  run_context::reconcile_group_for_user — a restricted member never
  gets a tool set their role wouldn't grant; unconfigured starts from
  role_default_run_context, never None (None = catch-all = wider).
- New system_agent_runs owner table (no user_id column — the file is
  the owner): start/finish split so a crash leaves a visible 'running'
  row, swept to 'failed' by the next start; safe because the scheduler
  is sequential and single-instance. An idle tick writes nothing.
- counting_notify wraps the notify tool so the run log can report
  notifications emitted without the tool knowing it's counted.
- The session's event channel is drained by a spawned task instead of
  a dropped receiver — the translator awaits its sends and would wedge
  at capacity.

EventLog::{Persist,Discard} on McpManager::new
- mcp_events is an owner table and its only reader (TIC) is per-user,
  so an event is something that happened to someone. The per-user
  runtime gets Persist; the ownerless global runtime gets Discard (its
  pool is system.db, rows would be unattributable and unread).

API + UI
- GET /api/system-agents/runs: the caller's own run history, scoped
  through require_context with no admin override (same promise as the
  rest of the private pool).
- web/components/system-agents.js replaces tic-sessions.js. The old
  #tic debug page inferred runs from leftover ephemeral sessions; the
  new #system-agents page (sidebar group 'extensions', visible to
  everyone — the data is the caller's own) reads the real run log.
- i18n: tic.* keys replaced with system_agents.* in en/it/fr.

Docs
- New docs/system-agents.md (user-facing: what TIC does, why it runs
  per person, why a run can be missing). Updated docs/settings.md and
  docs/index.md.
- agents/tic/AGENT.md reframed per-user: events are that person's,
  memory is user-memory/ (private) — never shared-memory/.
- CLAUDE.md records the system-agents design and the EventLog seam.

crates/skald-core/src/skald/accessors.rs

@@ -38,7 +38,6 @@ use crate::provider::ProviderRegistry;
 use crate::run_context::RunContextManager;
 use crate::secrets::SecretsStore;
 use crate::session::manager::ChatSessionManager;
-use crate::tic::TicManager;
 use crate::tool_catalog::ToolCatalog;
 use crate::tools::ToolRegistry;
 use crate::transcribe::TranscribeManager;
@@ -293,7 +292,6 @@ impl Skald {
     pub fn manager(&self) -> &Arc<ChatSessionManager> { &self.conversation.manager }
     pub fn chat_hub(&self) -> &Arc<ChatHub> { &self.conversation.chat_hub }
     pub fn run_context_manager(&self) -> &Arc<RunContextManager> { &self.conversation.run_context_manager }
-    pub fn tic_manager(&self) -> &Arc<TicManager> { &self.conversation.tic_manager }
 
     // Interaction
     pub fn approval(&self) -> &Arc<ApprovalManager> { &self.interaction.approval }

crates/skald-core/src/skald/bundles.rs

@@ -35,7 +35,6 @@ use crate::run_context::RunContextManager;
 use crate::secrets::SecretsStore;
 use crate::session::handler::{DEFAULT_MAX_PARALLEL_SUBAGENTS, DEFAULT_MAX_TOOL_ROUNDS};
 use crate::session::manager::ChatSessionManager;
-use crate::tic::TicManager;
 use crate::tool_catalog::ToolCatalog;
 use crate::tool_discovery::ToolDiscovery;
 use crate::tools::ToolRegistry;
@@ -160,7 +159,14 @@ impl Integrations {
     /// after the elicitation handler is wired) and the plugin manager (plugins are
     /// injected by `main.rs`; `start_enabled()` runs later, from `WebFrontend`).
     pub(super) fn build(rt: &Runtime, plugins: Vec<Arc<dyn Plugin>>) -> Self {
-        let mcp = Arc::new(McpManager::new(Arc::clone(&rt.db), rt.shutdown_token.clone(), "data"));
+        // The global runtime has no owner, so its notifications are not persisted:
+        // `mcp_events` is per-user and its only reader (TIC) runs per-user.
+        let mcp = Arc::new(McpManager::new(
+            Arc::clone(&rt.db),
+            rt.shutdown_token.clone(),
+            "data",
+            crate::mcp::EventLog::Discard,
+        ));
 
         let mut plugin_manager = PluginManager::new(Arc::clone(&rt.db));
         for plugin in plugins {
@@ -297,16 +303,12 @@ impl Interaction {
     }
 }
 
-// ── Conversation: session manager + chat hub + run context + TIC ────────────
+// ── Conversation: session manager + chat hub + run context ──────────────────
 
 pub(super) struct Conversation {
     pub(super) manager:             Arc<ChatSessionManager>,
     pub(super) chat_hub:            Arc<ChatHub>,
     pub(super) run_context_manager: Arc<RunContextManager>,
-    /// TIC lives here (rather than in `Tasks`) because it is constructed from and
-    /// drives the conversation stack (session manager + chat hub + run context);
-    /// this keeps every bundle a single-shot `build()` with no two-phase init.
-    pub(super) tic_manager:         Arc<TicManager>,
 }
 
 impl Conversation {
@@ -395,17 +397,12 @@ impl Conversation {
         chat_hub.register("web").await;
         chat_hub.register("talk").await;
 
-        let tic_manager = TicManager::new(
-            Arc::clone(&rt.db),
-            Arc::clone(&manager),
-            Arc::clone(&chat_hub),
-            config.tic.clone(),
-            Arc::clone(&rt.config),
-            Arc::clone(&run_context_manager),
-            Arc::clone(&rt.system_bus),
-        );
+        // TIC is deliberately absent: it is a system agent that runs *per user*,
+        // over that user's own events, sessions and hub. Building it here would
+        // bind it to the ownerless stack above (§19) — which is precisely the bug
+        // that made it inert. It is constructed by `wiring::spawn_system_agents`.
 
-        Ok(Conversation { manager, chat_hub, run_context_manager, tic_manager })
+        Ok(Conversation { manager, chat_hub, run_context_manager })
     }
 }
 

crates/skald-core/src/skald/mod.rs

@@ -31,7 +31,7 @@ use bundles::{Conversation, Infra, Integrations, Interaction, Media, Models, Tas
 use runtime::Runtime;
 use user_context::{UserContextFactory, UserContextRegistry};
 pub use user_context::UserContext;
-use wiring::{spawn_background, spawn_user_lifecycle, wire};
+use wiring::{spawn_background, spawn_system_agents, spawn_user_lifecycle, wire};
 
 pub struct Skald {
     rt:           Runtime,
@@ -111,6 +111,10 @@ impl Skald {
         // can only be spawned once the instance exists (blueprint §6).
         spawn_user_lifecycle(&skald);
 
+        // Likewise the system-agent scheduler: it resolves a per-user runtime for
+        // each user it runs an agent for (blueprint §13).
+        spawn_system_agents(&skald, config.tic.clone());
+
         Ok(skald)
     }
 

crates/skald-core/src/skald/user_context.rs

@@ -241,6 +241,9 @@ impl UserContextFactory {
             Arc::clone(&pool),
             user_shutdown.clone(),
             "data",
+            // This user's connectors push into this user's `mcp_events`, which is
+            // what TIC reads on their behalf.
+            crate::mcp::EventLog::Persist,
         ));
         // NOTE: per-user MCP elicitation (interactive connector login, §15) is
         // deferred — api-key connectors don't need it. Wire the user's

crates/skald-core/src/skald/wiring.rs

@@ -2,19 +2,22 @@
 //! spawns, each concentrated in one readable place instead of being scattered
 //! through the constructor.
 //!
-//! Owner-bound background loops (cron, session-cancel, ticket-listener, tic) have
+//! Owner-bound background loops (cron, session-cancel, ticket-listener) have
 //! moved per-user into `UserContextFactory::build`. What remains here are the
 //! instance-wide tasks: LLM-log cleanup on the registry pool, MCP server
-//! initialization, and the user-lifecycle reconciler (which needs the finished
-//! `Arc<Skald>` and is therefore spawned separately, after construction).
+//! initialization, and the two that need the finished `Arc<Skald>` and are
+//! therefore spawned separately, after construction — the user-lifecycle
+//! reconciler and the system-agent scheduler.
 
 use std::sync::Arc;
+use std::time::Duration;
 
 use core_api::system_bus::{RecvError, SystemEvent};
 use tracing::{info, warn};
 
-use crate::config::CoreConfig;
+use crate::config::{CoreConfig, TicConfig};
 use crate::elicitation::ElicitationBridge;
+use crate::tic::{TicManager, TIC_INTERVAL_MINUTES_KEY};
 
 use super::bundles::{Conversation, Integrations, Interaction, Tasks};
 use super::runtime::Runtime;
@@ -41,10 +44,11 @@ pub(super) fn wire(
 
 /// Spawns the instance-wide background tasks.
 ///
-/// Owner-bound loops (cron, session-cancel, ticket-listener, tic) are **not**
-/// spawned here — they run per-user inside `UserContext`. Session cancellation is
-/// handled directly by the API handlers (which have `AuthUser` and resolve the
-/// per-user context). TIC is deferred until connectors return (§13).
+/// Owner-bound loops (cron, session-cancel, ticket-listener) are **not** spawned
+/// here — they run per-user inside `UserContext`. Session cancellation is handled
+/// directly by the API handlers (which have `AuthUser` and resolve the per-user
+/// context). The system-agent scheduler needs the finished instance and lives in
+/// [`spawn_system_agents`].
 pub(super) fn spawn_background(
     rt: &Runtime,
     _tasks: &Tasks,
@@ -169,3 +173,107 @@ pub(super) fn spawn_user_lifecycle(skald: &Arc<super::Skald>) {
         info!("user-lifecycle: reconciler stopped");
     });
 }
+
+/// Spawns the **system-agent scheduler** — the instance-wide timer that runs the
+/// background agents nobody asked for (today: TIC).
+///
+/// One loop, not one per user. Every pass walks the user directory and runs the
+/// agent for each user **sequentially**: a pass means N container round-trips and
+/// N LLM calls, and doing them concurrently would spike the box every interval
+/// for no gain — nobody is waiting on a background tick.
+///
+/// A user whose database is still locked is **skipped**, and that is the normal
+/// case rather than an error: the pool is the unlock token (§9), so a user who
+/// has not logged in since the last restart has no readable events, no session
+/// store, and no place to record the skip. It is logged at INFO and the pass
+/// moves on; their events keep accumulating and are picked up by the first pass
+/// after they log in.
+///
+/// Spawned after `Skald` is fully built, like [`spawn_user_lifecycle`] and for
+/// the same reason: it resolves each user's runtime through `Skald::user_context`.
+/// The back-reference is [`std::sync::Weak`].
+pub(super) fn spawn_system_agents(skald: &Arc<super::Skald>, tic_config: TicConfig) {
+    let weak       = Arc::downgrade(skald);
+    let shutdown   = skald.rt.shutdown_token.clone();
+    let mut sys_rx = skald.rt.system_bus.subscribe();
+
+    let tic = TicManager::new(
+        tic_config,
+        Arc::clone(&skald.rt.config),
+        Arc::clone(&skald.rt.db),
+    );
+
+    skald.rt.supervisor.spawn("system-agents", async move {
+        info!("system-agents: scheduler started");
+
+        'outer: loop {
+            // Re-read the interval each pass so a Settings change lands without a
+            // restart; a live change also cuts the current wait short.
+            let wait = Duration::from_secs(tic.interval_secs().await);
+            let deadline = tokio::time::sleep(wait);
+            tokio::pin!(deadline);
+
+            loop {
+                tokio::select! {
+                    _ = shutdown.cancelled() => break 'outer,
+                    _ = &mut deadline       => break,
+                    ev = sys_rx.recv() => match ev {
+                        Ok(SystemEvent::ConfigKeyUpdated { key, .. })
+                            if key == TIC_INTERVAL_MINUTES_KEY =>
+                        {
+                            info!("system-agents: interval changed, rescheduling");
+                            continue 'outer;
+                        }
+                        Err(RecvError::Closed) => break 'outer,
+                        _ => {}
+                    },
+                }
+            }
+
+            let Some(skald) = weak.upgrade() else { break };
+            tic_pass(&skald, &tic).await;
+        }
+
+        info!("system-agents: scheduler stopped");
+    });
+}
+
+/// One TIC pass over the whole directory, one user at a time.
+async fn tic_pass(skald: &Arc<super::Skald>, tic: &Arc<TicManager>) {
+    if !tic.is_enabled().await {
+        return;
+    }
+
+    let users = match skald.users().list().await {
+        Ok(u) => u,
+        Err(e) => {
+            warn!(error = %e, "system-agents: cannot list users, skipping this pass");
+            return;
+        }
+    };
+
+    for user in users.into_iter().filter(|u| u.active) {
+        if skald.rt.shutdown_token.is_cancelled() {
+            break;
+        }
+
+        if !skald.users().is_unlocked(&user.id) {
+            info!(
+                user = %user.id, username = %user.username,
+                "TIC: skipped — the user's database is still encrypted (not logged in since the last restart)",
+            );
+            continue;
+        }
+
+        // Unlocked, so this resolves (and is normally already live from their login).
+        let Some(ctx) = skald.user_context(&user.id).await else {
+            warn!(user = %user.id, "TIC: skipped — could not resolve the user's runtime");
+            continue;
+        };
+
+        if let Err(e) = tic.run_for(&user.id, &ctx.pool, &ctx.sessions, &ctx.chat_hub).await {
+            // One user's failure must not end the pass for everyone after them.
+            warn!(user = %user.id, error = %e, "TIC: tick failed");
+        }
+    }
+}