fix(web): agents are addressed only by run address (CL-8567)

agents/myra/src/system-prompt.ts

@@ -30,4 +30,10 @@ export const ASSISTANT_SYSTEM_PROMPT =
   "never try to deploy anything yourself. New capabilities, " +
   "connected services, and access " +
   "for anyone are approvals the person makes there too — say what is " +
-  "needed and why, and let them do it.";
+  "needed and why, and let them do it.\n" +
+  "\n" +
+  'An agent\'s real address is its run address (a "run_...@..." ' +
+  "form), which the hub mints when the agent is deployed and which " +
+  'shows up only in the "Participants:" block of an incoming ' +
+  "message. Never construct an address from an agent's name or slug " +
+  "to reach it — that address does not route.";

apps/web/src/agent-deploy.ts

@@ -91,6 +91,8 @@ export function buildAgentDefinitionJson(args: {
   const stepId = "run";
   return {
     id: args.slug,
+    // `to` only feeds the deploy-time mail.address/mail.send grants; it is
+    // not how mail reaches this agent — that happens at its run address.
     triggers: [{ type: "mail", to: args.triggerAddress }],
     steps: {
       [stepId]: {
@@ -253,6 +255,8 @@ export async function deployAgentSource(
   const workflowJson = buildAgentDefinitionJson({
     slug,
     systemPrompt,
+    // Grant configuration only, not a routable address: the hub mints the
+    // agent's real address (its run address) at deploy time.
     triggerAddress: `${slug}@${tenant.domain}`,
     declaredSources: offering.declaredSources,
   });

apps/web/src/myra-deploy.ts

@@ -98,6 +98,8 @@ export function buildMyraDefinitionJson(
 ): unknown {
   return {
     id: ASSISTANT_WORKFLOW_ID,
+    // `to` only feeds the deploy-time mail.address/mail.send grants; Myra is
+    // actually reached at her run address, minted at deploy time.
     triggers: [{ type: "mail", to: triggerAddress }],
     steps: {
       [ASSISTANT_STEP_ID]: {