fix(dispatch): carry inter-agent chain depth through loops, schedule triggers, session turns and events (#2973)

[obasilakis]

Summary

• Follow-up to bug: agent-to-agent chat chains have no depth guard — a runaway A→B→A bounce is bounded only by capacity parks and hop timeouts #2806. An agent near inter_agent_max_chain_depth could reset its depth to 0 by starting a loop, manually triggering a schedule, driving a chat-session turn, or emitting an event its subscription answers. All four now inherit the caller's depth and are refused at the max with the same named 403 inter_agent_depth_exceeded.
• Event depth travels as a signed chain_depth claim in the EVT-001 loopback JWT, so an emit on another agent's behalf and system agent.task.* completions (finished row's depth + 1) carry it too. _chain_caller falls back to vouched_source_agent.
• New per source→subscriber hourly event-dispatch budget (CSO 2026-09-29 Finding 3, from the issue thread): ops setting event_dispatch_max_fires_per_hour, default 120, one high-priority notification per window, fail-open on Redis errors.

Changes

• routers/{loops,schedules,sessions,event_subscriptions}.py — call enforce_inter_agent_depth; refusal propagates to the new app-level handler (error_handlers.inter_agent_depth_exceeded, registered in main.py).
• services/loop_service.py, db/loops.py + agent_loops.chain_depth (SQLite migration loop_chain_depth, Alembic 0084, schema.py, tables.py).
• src/scheduler/* — ExecutionOrigin.chain_depth (validated 1–1000), stamped on insert, kept on retry.
• services/event_dispatch_service.py — loopback claim, terminal-event depth, dispatch budget; dependencies.py / models.User.loopback_chain_depth; services/dispatch_admission_service.py — claim read before the root early-return.
• services/task_execution_service.execute_task(chain_depth=).
• services/monitoring_alerts.py — budget alert; config.py / settings_service.py — new ops setting.
• MCP: client.ts::depthRefusalFromError; run_agent_loop, trigger_agent_schedule, emit_event return the refusal as a non-retryable result.
• Docs: requirements/core-agent.md §9.1.1, requirements/mcp.md, architecture/{execution,database,api-endpoints}.md, feature flows, IA-04 gaps, learnings fragment, CSO diff report.

Test Plan

• cd tests && pytest unit/test_2973_depth_new_roots.py unit/test_2973_event_dispatch_budget.py -v — every path driven through its real route with a minted agent bearer and a non-default max (34 + 10 pass)
• Mutation: reverting each of 13 fix points turns at least one of those tests red; MCP helper reverted → 3 red in src/mcp-server/src/tools/depth-refusal.test.ts
• Related unit suites (bug: agent-to-agent chat chains have no depth guard — a runaway A→B→A bounce is bounded only by capacity parks and hop timeouts #2806, ent#614, feat: system-emitted agent.task.completed/failed events at execution terminal (async caller report-back) #1578, loops, scheduler origin, schema parity, sessions, execute_task) — 1895 + 459 pass; MCP node --test 600/600; tsc --noEmit clean
• check_alembic_heads.py single head; check_alembic_parity.py PASS
• Manual: agent at depth max starts a loop / emits to a self-subscription → named 403 in the MCP result

Deferred: webhook tokens, agent-created cron schedules and self-reminders still start a depth-0 root — #3116 (needs a design call on whether a stored trigger carries its creator's depth forever).

Fixes #2973

🤖 Generated with Claude Code

[vybe]

merge-train: this PR is on today's train with #3122, #3119 and #3085. The one Tier 1 blocker was the test_1920 allowlist, and your 5c0bc209d already fixes it.

Two gaps to consider. Neither blocks this train. Each was found by a mutation that stayed green:

• main.py handler registration isn't pinned. Deleting app.add_exception_handler(InterAgentDepthExceeded, …) (around main.py:1217) leaves all 48 new tests green, because they build their own app. In production, every depth refusal would then be a 500 instead of the named 403. One assertion covers it: InterAgentDepthExceeded in main.app.exception_handlers.
• The scheduler's manual-trigger hand-off isn't pinned. Changing chain_depth=origin.chain_depth in src/scheduler/main.py to None leaves 2973, 1968 and 1970 green. Extending the handler-driven test in test_1968 to send a chain_depth and assert it on the stored row would cover it.

Also worth a decision, from /cso --diff at low severity: anyone with shared access to agent X can use up X→S's hourly fire budget through POST /api/agents/X/emit-event. That silently skips X's real events for up to an hour. You could key that route's budget on the emitting principal, or record it in #3116.

This PR goes in ahead of #3085, and #3085 will re-parent onto your 0084_agent_loops_chain_depth.

[vybe]

merge-train: batch validated on train/20260930-1429 (#3126, all gates green)