Jobs on their own machine, and a ledger it can read

• A job runs on its own machine. External jobs run on demand in digest-pinned worker images on Kubernetes, behind a shared dispatcher that keeps run ids and verdicts across restarts, serializes requested against scheduled work, and refuses to start the same body twice. A failed run posts its failure and a redacted excerpt to the report destination and to the conversation that asked, so nobody has to know to go looking; the full redacted output stays behind operator-only job diagnostics for seven days.
• Ask what the week actually held — or hear that it can't say. team_status checks search access and each repository's ledger separately, and team_sessions answers only once credential access, repository identity, ledger availability, and a refresh inside five minutes have all been verified. Missing or stale data is refused instead of arriving as an empty week that looks like a quiet one.
• What's been moving lately. team_recent returns work updates and session activity newest first over an explicit window — 72 hours by default, seven days at most, 20 results — and says so when it truncated rather than trailing off.
• The same question, asked of the code. code_insights joins the most-changed files, recent commits, and open pull requests and issues from the read-only checkout the coworker already has. A repository with nothing indexed reports unknown, not none, so "no open pull requests" and "never looked" stop reading the same.
• The ledger stays fresh without a daemon. A team brain's ledgerSync entries name the repositories and HTTPS remotes the gateway should clone and refresh, reusing Git credentials already mounted. It never starts an ox daemon and never pushes, and an authentication failure waits for the mounted credential to change rather than retrying against a token already known to be dead.
• A sibling coworker can't park your kill switch. The gateway is the only thing that ever saw who sent a message, so it now hands the turn's author to the switch: a park is refused when it comes from a recognized coworker the manifest doesn't name. It narrows rather than seals — a surface that can't identify a coworker still admits the park, because refusing those would refuse a person's park too.

The Helm chart moves to 0.12.0. Before upgrading, add top-level killSwitchParkBy to every agent.yaml with a job that declares a killSwitch — [] to refuse every recognized coworker, or the ids whose park this coworker honours — because a manifest without it will not load. Existing coworkers opt into the new tools by re-running sageox-agent memory add team, sageox-agent repos add <url>, and sageox-agent mcp add jobs. External jobs need Kubernetes 1.34 or newer and their own worker setup; all of it leads the v0.4.0 release.