@agent-native/core 0.203.0 → 0.203.1-nightly-20261007183952

package/dist/server/index.d.ts

@@ -24,7 +24,7 @@ export { verifyCaptcha, type CaptchaVerifyResult } from "./captcha.js";
 export { getLocaleInitScript, parseAcceptLanguage, resolveLocaleFromRequest, type LocaleInitScriptOptions, type ResolveLocaleFromRequestOptions, type ResolvedRequestLocale, } from "../localization/server.js";
 export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type DefaultAgentActionSurface, type AgentActionSurfaceResolution, type AgentActionSurfaceDetails, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, type AgentChatReference, type MentionProvider, type MentionItemMedia, type MentionProviderItem, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "../agent/index.js";
 export type { AgentActionScope } from "../agent/types.js";
-export { actionsToEngineTools, executeAgentToolCall, getJevContextCredentials, getOwnerActiveApiKey, getOwnerApiKeyForEngine, getOwnerJevApiKey, resolveOwnerEngineApiKey, runAgentLoop, type AgentToolCallExecutionResult, type ExecuteAgentToolCallOptions, type JevContextCredentials, type ResolvedOwnerApiKey, } from "../agent/production-agent.js";
+export { actionsToEngineTools, executeAgentToolCall, filterInitialEngineTools, getJevContextCredentials, getOwnerActiveApiKey, getOwnerApiKeyForEngine, getOwnerJevApiKey, resolveOwnerEngineApiKey, runAgentLoop, type AgentToolCallExecutionResult, type ExecuteAgentToolCallOptions, type JevContextCredentials, type ResolvedOwnerApiKey, } from "../agent/production-agent.js";
 export { isJevEnabled, requestJevThroughBuilder, type JevResponse, } from "../agent/jev-tool-prefetch.js";
 export { getRunStatus, getRunTurnRef } from "../agent/run-store.js";
 export { getActiveRunForThreadAsync } from "../agent/run-manager.js";
@@ -48,7 +48,7 @@ export { createContextXrayPlugin, defaultContextXrayPlugin, } from "../agent/con
 export { createObservationalMemoryPlugin, defaultObservationalMemoryPlugin, } from "../agent/observational-memory/plugin.js";
 export { createGoogleAuthPlugin, type GoogleAuthPluginOptions, } from "./google-auth-plugin.js";
 export type { GoogleAuthMode } from "./google-auth-mode.js";
-export { createAgentChatPlugin, defaultAgentChatPlugin, type AgentChatPluginOptions, } from "./agent-chat-plugin.js";
+export { createAgentChatPlugin, defaultAgentChatPlugin, loadResourcesForPrompt, type AgentChatPluginOptions, } from "./agent-chat-plugin.js";
 export { refreshMcpManagerForPrincipal } from "./agent-chat/mcp-glue.js";
 export { AGENT_CHAT_STREAM_PATH, AGENT_CHAT_STREAM_TOKEN_SUFFIX, AGENT_CHAT_STREAM_TOKEN_TTL_SECONDS, createAgentChatStreamToken, isAgentChatStreamingRuntime, readAgentChatStreamBearerToken, verifyAgentChatStreamToken, type AgentChatStreamPrincipal, } from "./agent-chat-stream.js";
 export type { AgentChatMcpIcon, AgentChatMcpOptions, } from "./agent-chat/mcp-options.js";
@@ -77,7 +77,7 @@ export { extractBearerToken as extractInternalBearerToken, verifyInternalToken,
 export { autoDiscoverActions, autoDiscoverScripts, loadActionsFromStaticRegistry, mergeCoreSharingActions, registerPackageActions, } from "./action-discovery.js";
 export { attachToolSearch, createToolSearchEntry, searchToolRegistry, TOOL_SEARCH_ACTION_NAME, } from "../agent/tool-search.js";
 export { filterFrameworkToolGroups, frameworkGroupEnabled, resolveFrameworkTools, FRAMEWORK_TOOL_GROUPS, type FrameworkToolGroup, type FrameworkToolsConfig, type FrameworkToolsOption, type ResolvedFrameworkTools, } from "../framework-tools.js";
-export { registerPromptContextProvider, type PromptContextProvider, type PromptContextProviderContext, type PromptContextProviderContribution, } from "./agent-chat/prompt-resources.js";
+export { buildCompactSkillsSummary, registerPromptContextProvider, type PromptContextProvider, type PromptContextProviderContext, type PromptContextProviderContribution, } from "./agent-chat/prompt-resources.js";
 export { mountActionRoutes, type MountActionRoutesOptions, type ActionRouteAuthAdapter, type ActionRouteResolvedCaller, } from "./action-routes.js";
 export { AGENT_RUN_OWNER_CONTEXT_KEY, seedAgentRunOwnerContext, type AgentRunOwnerContext, } from "./agent-run-context.js";
 export { runWithRequestContext, hasRequestContext, hasRequestBoundary, getRequestContext, getRequestUserEmail, getRequestUserName, getRequestOrgId, getAmbientUserEmail, getAmbientOrgId, getRequestTimezone, getRequestRunContext, getCredentialContext, isIntegrationCallerRequest, type RequestContext, type RequestRunContext, } from "./request-context.js";

package/dist/server/index.js

@@ -23,7 +23,7 @@ export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } fro
 export { verifyCaptcha } from "./captcha.js";
 export { getLocaleInitScript, parseAcceptLanguage, resolveLocaleFromRequest, } from "../localization/server.js";
 export { createProductionAgentHandler, } from "../agent/index.js";
-export { actionsToEngineTools, executeAgentToolCall, getJevContextCredentials, getOwnerActiveApiKey, getOwnerApiKeyForEngine, getOwnerJevApiKey, resolveOwnerEngineApiKey, runAgentLoop, } from "../agent/production-agent.js";
+export { actionsToEngineTools, executeAgentToolCall, filterInitialEngineTools, getJevContextCredentials, getOwnerActiveApiKey, getOwnerApiKeyForEngine, getOwnerJevApiKey, resolveOwnerEngineApiKey, runAgentLoop, } from "../agent/production-agent.js";
 export { isJevEnabled, requestJevThroughBuilder, } from "../agent/jev-tool-prefetch.js";
 export { getRunStatus, getRunTurnRef } from "../agent/run-store.js";
 export { getActiveRunForThreadAsync } from "../agent/run-manager.js";
@@ -46,7 +46,7 @@ export { createExperimentsPlugin } from "../experiments/server.js";
 export { createContextXrayPlugin, defaultContextXrayPlugin, } from "../agent/context-xray/plugin.js";
 export { createObservationalMemoryPlugin, defaultObservationalMemoryPlugin, } from "../agent/observational-memory/plugin.js";
 export { createGoogleAuthPlugin, } from "./google-auth-plugin.js";
-export { createAgentChatPlugin, defaultAgentChatPlugin, } from "./agent-chat-plugin.js";
+export { createAgentChatPlugin, defaultAgentChatPlugin, loadResourcesForPrompt, } from "./agent-chat-plugin.js";
 export { refreshMcpManagerForPrincipal } from "./agent-chat/mcp-glue.js";
 export { AGENT_CHAT_STREAM_PATH, AGENT_CHAT_STREAM_TOKEN_SUFFIX, AGENT_CHAT_STREAM_TOKEN_TTL_SECONDS, createAgentChatStreamToken, isAgentChatStreamingRuntime, readAgentChatStreamBearerToken, verifyAgentChatStreamToken, } from "./agent-chat-stream.js";
 export { configureAgentNativeEmbeddedEnvironment, createAgentNativeEmbeddedAuthOptions, createAgentNativeEmbeddedPlugin, mountAgentNativeEmbedded, normalizeAgentNativeEmbeddedSession, } from "./embedded.js";
@@ -72,7 +72,7 @@ export { extractBearerToken as extractInternalBearerToken, verifyInternalToken,
 export { autoDiscoverActions, autoDiscoverScripts, loadActionsFromStaticRegistry, mergeCoreSharingActions, registerPackageActions, } from "./action-discovery.js";
 export { attachToolSearch, createToolSearchEntry, searchToolRegistry, TOOL_SEARCH_ACTION_NAME, } from "../agent/tool-search.js";
 export { filterFrameworkToolGroups, frameworkGroupEnabled, resolveFrameworkTools, FRAMEWORK_TOOL_GROUPS, } from "../framework-tools.js";
-export { registerPromptContextProvider, } from "./agent-chat/prompt-resources.js";
+export { buildCompactSkillsSummary, registerPromptContextProvider, } from "./agent-chat/prompt-resources.js";
 export { mountActionRoutes, } from "./action-routes.js";
 export { AGENT_RUN_OWNER_CONTEXT_KEY, seedAgentRunOwnerContext, } from "./agent-run-context.js";
 export { runWithRequestContext, hasRequestContext, hasRequestBoundary, getRequestContext, getRequestUserEmail, getRequestUserName, getRequestOrgId, getAmbientUserEmail, getAmbientOrgId, getRequestTimezone, getRequestRunContext, getCredentialContext, isIntegrationCallerRequest, } from "./request-context.js";

package/dist/server/realtime-voice.js

@@ -2,7 +2,7 @@ import { defineEventHandler, getHeader, getMethod, readRawBody, setResponseHeade
 import { getBuilderGatewayRequestHeaders } from "../agent/engine/builder-gateway-headers.js";
 import { actionsToEngineTools, } from "../agent/production-agent.js";
 import { redactSensitiveFields, sanitizeToolErrorText, sanitizeToolErrorValue, } from "../agent/tool-error-redaction.js";
-import { TOOL_SEARCH_ACTION_NAME } from "../agent/tool-search.js";
+import { isTargetedToolSearch, TOOL_SEARCH_ACTION_NAME, } from "../agent/tool-search.js";
 import { parseAcceptLanguage } from "../localization/server.js";
 import { getSession } from "./auth.js";
 import { gatewayLaneUnavailableMessage, getBuilderGatewayBaseUrl, resolveBuilderGatewayAuth, resolveSecret, } from "./credential-provider.js";
@@ -275,11 +275,9 @@ function parseSuccessfulToolSearchNames(output) {
     }
 }
 function grantDiscoveredRealtimeTools(input) {
-    const query = input.request.args.query;
     if (input.request.name !== TOOL_SEARCH_ACTION_NAME ||
         input.result.status !== "completed" ||
-        typeof query !== "string" ||
-        !query.trim()) {
+        !isTargetedToolSearch(input.request.args)) {
         return [];
     }
     const candidates = parseSuccessfulToolSearchNames(input.result.output)

package/dist/shared/embed-auth.d.ts

@@ -3,6 +3,7 @@ export declare const EMBED_TOKEN_QUERY_PARAM = "__an_embed_token";
 export declare const EMBED_TARGET_QUERY_PARAM = "__an_embed_target";
 export declare const EMBED_MODE_QUERY_PARAM = "embedded";
 export declare const MCP_APP_CHAT_BRIDGE_QUERY_PARAM = "__an_mcp_chat_bridge";
+export declare const MCP_DIRECTORY_WIDGET_QUERY_PARAM = "__an_mcp_directory_widget";
 export declare const EMBED_SESSION_COOKIE = "an_embed_session";
 export declare const EMBED_TARGET_HEADER = "x-agent-native-embed-target";
 export declare const MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX = "capability:mcp-directory-widget-read:";

package/dist/shared/embed-auth.js

@@ -3,6 +3,7 @@ export const EMBED_TOKEN_QUERY_PARAM = "__an_embed_token";
 export const EMBED_TARGET_QUERY_PARAM = "__an_embed_target";
 export const EMBED_MODE_QUERY_PARAM = "embedded";
 export const MCP_APP_CHAT_BRIDGE_QUERY_PARAM = "__an_mcp_chat_bridge";
+export const MCP_DIRECTORY_WIDGET_QUERY_PARAM = "__an_mcp_directory_widget";
 export const EMBED_SESSION_COOKIE = "an_embed_session";
 export const EMBED_TARGET_HEADER = "x-agent-native-embed-target";
 export const MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX = "capability:mcp-directory-widget-read:";

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -2,6 +2,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
 }, {
+    role?: undefined;
     ownerEmail: any;
     visibility: any;
     shares: any[];
@@ -11,7 +12,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
         supportsGroupShares?: boolean;
     };
     orgId?: undefined;
-    role?: undefined;
     agentReadable?: undefined;
 } | {
     ownerEmail: string;

package/dist/templates/chat/.agents/skills/actions/SKILL.md

@@ -107,6 +107,31 @@ An action that hands control back to the user (question form, intake dialog) set
 
 Reach for `outputSchema` (validate the return), `_agentImages` (attach images the agent can see), `authorize` (gate who may call it), or `needsApproval` (require human sign-off per call) only when the action needs that guarantee — examples in `references/action-fields.md`.
 
+### Write receipts
+
+A write action that can check its own effect returns a plain-object result with a reserved `_receipt`, so the final answer is reconciled with what the write did, not with the model's reading of a JSON string that may be truncated:
+
+```ts
+import type { WriteReceipt } from "@agent-native/core/action";
+
+const _receipt: WriteReceipt = {
+  changed: true,
+  verified: false,
+  summary: "Saved; panel 3 returned no rows.",
+  checks: [{ id: "panel-3", ok: false, detail: "0 rows" }],
+};
+return { id, _receipt };
+```
+
+`verified` is `true` (the effect was observed), `false` (checked and did not hold), or `"unverified"` (could not be checked); `checks` and `warnings` are optional. The agent loop reads the receipt before the result is stringified and truncated (summary 200 chars, 8 checks, 5 warnings):
+
+- `verified: false` or `changed: false` forces one honest-reconciliation retry per turn: the model must say what the receipt shows and may not call the change visible or working. If the retry is spent, the answer is prefixed with the receipt block.
+- `verified: "unverified"` only prefixes that note; no retry.
+- A receipt that is present but malformed counts as `unverified`, never clean. `changed: false` also records the call as `completedSideEffect: false`.
+- Set `subject` (the stable target, such as a dashboard id) so a later `changed: true, verified: true` receipt for the same subject can supersede an earlier flagged one in the same turn. When the earlier receipt had failing or unverified `checks`, the later receipts (from this action or another that writes the same subject) must carry an `ok: true` check with the same `id` for each; a receipt without checks never clears one that had them. A flagged receipt with no failing checks is superseded only by the same action. Receipts without a `subject` are never superseded.
+
+A receipt is not an error channel. A write that did not achieve the requested state throws (`fail()`); return `changed: false` only for a benign no-op, such as the record already being in the requested state.
+
 ## Frontend Hooks
 
 Import from focused `@agent-native/core/client/*` entry points; the broad

package/dist/templates/default/.agents/skills/actions/SKILL.md

@@ -107,6 +107,31 @@ An action that hands control back to the user (question form, intake dialog) set
 
 Reach for `outputSchema` (validate the return), `_agentImages` (attach images the agent can see), `authorize` (gate who may call it), or `needsApproval` (require human sign-off per call) only when the action needs that guarantee — examples in `references/action-fields.md`.
 
+### Write receipts
+
+A write action that can check its own effect returns a plain-object result with a reserved `_receipt`, so the final answer is reconciled with what the write did, not with the model's reading of a JSON string that may be truncated:
+
+```ts
+import type { WriteReceipt } from "@agent-native/core/action";
+
+const _receipt: WriteReceipt = {
+  changed: true,
+  verified: false,
+  summary: "Saved; panel 3 returned no rows.",
+  checks: [{ id: "panel-3", ok: false, detail: "0 rows" }],
+};
+return { id, _receipt };
+```
+
+`verified` is `true` (the effect was observed), `false` (checked and did not hold), or `"unverified"` (could not be checked); `checks` and `warnings` are optional. The agent loop reads the receipt before the result is stringified and truncated (summary 200 chars, 8 checks, 5 warnings):
+
+- `verified: false` or `changed: false` forces one honest-reconciliation retry per turn: the model must say what the receipt shows and may not call the change visible or working. If the retry is spent, the answer is prefixed with the receipt block.
+- `verified: "unverified"` only prefixes that note; no retry.
+- A receipt that is present but malformed counts as `unverified`, never clean. `changed: false` also records the call as `completedSideEffect: false`.
+- Set `subject` (the stable target, such as a dashboard id) so a later `changed: true, verified: true` receipt for the same subject can supersede an earlier flagged one in the same turn. When the earlier receipt had failing or unverified `checks`, the later receipts (from this action or another that writes the same subject) must carry an `ok: true` check with the same `id` for each; a receipt without checks never clears one that had them. A flagged receipt with no failing checks is superseded only by the same action. Receipts without a `subject` are never superseded.
+
+A receipt is not an error channel. A write that did not achieve the requested state throws (`fail()`); return `changed: false` only for a benign no-op, such as the record already being in the requested state.
+
 ## Frontend Hooks
 
 Import from focused `@agent-native/core/client/*` entry points; the broad

package/dist/templates/factory/.agents/skills/review-latest-feedback/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: review-latest-feedback
 description: >-
-  Sweep Slack, GitHub, Sentry, Analytics, trackers, and automated diagnostics,
-  plus app/template, desktop, and package deploy/release/publish lanes. Fix
-  verified defects, verify recovery targets, and recap. Use for scheduled or
-  manual sweeps.
+  Review Slack, GitHub, CI, Sentry, Analytics, diagnostics, linked trackers,
+  and app/template, desktop, and package deploy/release lanes. Answer reporters
+  first; fix verified defects, verify delivery, build upvoted features, and
+  recap. Use for scheduled or manual sweeps.
 user-invocable: true
 scope: dev
 metadata:
@@ -218,15 +218,9 @@ Phase 2 reapplies these rules after full-thread review.
 Use `## Slack channels` unless the invocation narrows scope.
 
 **Automated diagnostics are feedback.** For Slack, gate before reading.
-Before investigating, use only alert and linked issue/PR/run/task metadata to
-identify repo/ref/SHA, workflow/service/environment, failure fingerprint, and
-active same-failure owner; this is Phase 0's sole pre-claim exception. If
-unowned/in scope, claim: Slack `👀`; elsewhere, current-task status row with
-source permalink, fingerprint, owner task/worktree, next action. Continue if
-this task owns it; else record **Owned elsewhere** (owner/link/action) and
-stop. No logs/tests/artifacts before claim. The required Slack claim reaction
-is authorized here; other source mutations need exact authorization. Then read
-`references/automated-diagnostics.md`.
+Before claiming, use only alert/link metadata. Follow
+[`automated-diagnostics.md`](references/automated-diagnostics.md) for ownership,
+claim, and stop/continue; inspect logs, tests, and artifacts only afterward.
 
 **Defects and design feedback.** A clear bug has observable broken behavior: a
 click or submit does nothing, an action errors, data is lost or reverted, the
@@ -271,13 +265,12 @@ the query also returns ordinary replies and old polls that happen to carry the
 reaction. Take the ones that name a concrete improvement; skip the rest
 without comment.
 
-An upvoted item is a **feature or UX change**: it skips only the clear-bug bar,
-not `👀`, fix-altitude, verification, or question-budget requirements. The
-upvote overrides the bug gate, not ownership; build the smallest endorsed
-version and name Sid or Alice in the recap. Add `👀` before investigation or
-delegation and read it back. Keep an evidence-limited disposition until Phase
-2's four bars hold; then use **Shipped**, adding `✅` only if it also meets
-**Fixed**.
+An upvote endorses a **feature or UX change** and skips only the clear-bug bar;
+it does not change ownership, reaction, verification, or question-budget rules.
+Build the smallest endorsed version, name Sid or Alice, and state requested
+versus actual behavior in the recap. Add `👀` before investigation or
+delegation and read it back. Keep it evidence-limited until Phase 2's four bars
+hold; then use **Shipped**, adding `✅` only if it meets **Fixed**.
 
 Don't search `has::eyes:`; use the owner or handoff path above.
 
@@ -326,13 +319,15 @@ inventing a fix.
 
 ### Deployment, release, and publish failures
 
-Scan app/template, desktop build/release, and package-publish lanes on every
-sweep, even without a linked report. Include queued/running runs, run-only
-failures, and missing/stale artifacts; carry active run IDs and rows across
-cursors. Fix verified repo-owned causes; record external/manual causes with the
-next owner/action. Use [`deployment-recovery.md`](references/deployment-recovery.md)
-for lane-specific recovery and target proof. Green CI or merged source
-does not prove delivery.
+Scan app/template, desktop, and package lanes every sweep, even without linked
+feedback. Carry active run IDs, queued/running runs, failures, and missing/stale
+artifacts across cursors. Fix repo causes; record external/manual causes with
+the next owner/action. CI-red deploy rows from [CI triage](references/ci-red-report.md)
+reuse this operational fingerprint. Follow
+[`deployment-recovery.md`](references/deployment-recovery.md) for recovery and
+target proof; keep delivery active until proof passes. A source issue may be
+**Fixed** separately; delivery gaps are never **Quarantined**. Green CI or
+merged source does not prove delivery.
 
 ## Phase 2: fix
 
@@ -363,8 +358,7 @@ slack_search: <2-4 distinctive symptom words> in:<#CHANNEL>
 ```
 
 Search in the reporter's words — `zoom invalid_client`, `logout twice` — not
-your diagnosis. People describe one bug differently, so read the hits rather
-than trusting the count.
+your diagnosis. Read hits; one bug may have different descriptions.
 
 **A repeat report after a Fixed claim is evidence that fix failed.** It is the
 only falsification signal this workflow gets, and it outranks your belief that
@@ -435,10 +429,9 @@ pre-existing.
 ### Npx and package reports have a release follow-up
 
 Use [`deployment-recovery.md`](references/deployment-recovery.md) for npx
-version evidence, registry proof, publication status, and existing-app upgrade
-verification. A verified merge may be **Fixed** under the issue-closure rule
-above while its delivery row stays open; a local scaffold or beta promise is not
-delivery.
+version, registry, publication, and existing-app upgrade proof. A verified merge
+may be **Fixed** while its delivery row stays open; a local scaffold or beta
+promise is not delivery.
 
 ### Documentation has a runnable proof obligation
 
@@ -457,12 +450,6 @@ Never hard-code a rule for the wording of one report. One data point justifies
 a local regression test or a contained fix; it never justifies a global agent
 instruction or prompt exception.
 
-### The bar for saying "Fixed"
-
-Phase 2 defines the proof bars for **Fixed**, **Shipped**, and
-**Live verified**. Upvoted improvements state requested versus actual behavior
-and use **Shipped**.
-
 ## Phase 3: reply
 
 Thank issue reporters for opening it and Slack reporters for sharing. Give the

package/dist/templates/headless/.agents/skills/actions/SKILL.md

@@ -107,6 +107,31 @@ An action that hands control back to the user (question form, intake dialog) set
 
 Reach for `outputSchema` (validate the return), `_agentImages` (attach images the agent can see), `authorize` (gate who may call it), or `needsApproval` (require human sign-off per call) only when the action needs that guarantee — examples in `references/action-fields.md`.
 
+### Write receipts
+
+A write action that can check its own effect returns a plain-object result with a reserved `_receipt`, so the final answer is reconciled with what the write did, not with the model's reading of a JSON string that may be truncated:
+
+```ts
+import type { WriteReceipt } from "@agent-native/core/action";
+
+const _receipt: WriteReceipt = {
+  changed: true,
+  verified: false,
+  summary: "Saved; panel 3 returned no rows.",
+  checks: [{ id: "panel-3", ok: false, detail: "0 rows" }],
+};
+return { id, _receipt };
+```
+
+`verified` is `true` (the effect was observed), `false` (checked and did not hold), or `"unverified"` (could not be checked); `checks` and `warnings` are optional. The agent loop reads the receipt before the result is stringified and truncated (summary 200 chars, 8 checks, 5 warnings):
+
+- `verified: false` or `changed: false` forces one honest-reconciliation retry per turn: the model must say what the receipt shows and may not call the change visible or working. If the retry is spent, the answer is prefixed with the receipt block.
+- `verified: "unverified"` only prefixes that note; no retry.
+- A receipt that is present but malformed counts as `unverified`, never clean. `changed: false` also records the call as `completedSideEffect: false`.
+- Set `subject` (the stable target, such as a dashboard id) so a later `changed: true, verified: true` receipt for the same subject can supersede an earlier flagged one in the same turn. When the earlier receipt had failing or unverified `checks`, the later receipts (from this action or another that writes the same subject) must carry an `ok: true` check with the same `id` for each; a receipt without checks never clears one that had them. A flagged receipt with no failing checks is superseded only by the same action. Receipts without a `subject` are never superseded.
+
+A receipt is not an error channel. A write that did not achieve the requested state throws (`fail()`); return `changed: false` only for a benign no-op, such as the record already being in the requested state.
+
 ## Frontend Hooks
 
 Import from focused `@agent-native/core/client/*` entry points; the broad

package/dist/templates/workspace-core/.agents/skills/actions/SKILL.md

@@ -107,6 +107,31 @@ An action that hands control back to the user (question form, intake dialog) set
 
 Reach for `outputSchema` (validate the return), `_agentImages` (attach images the agent can see), `authorize` (gate who may call it), or `needsApproval` (require human sign-off per call) only when the action needs that guarantee — examples in `references/action-fields.md`.
 
+### Write receipts
+
+A write action that can check its own effect returns a plain-object result with a reserved `_receipt`, so the final answer is reconciled with what the write did, not with the model's reading of a JSON string that may be truncated:
+
+```ts
+import type { WriteReceipt } from "@agent-native/core/action";
+
+const _receipt: WriteReceipt = {
+  changed: true,
+  verified: false,
+  summary: "Saved; panel 3 returned no rows.",
+  checks: [{ id: "panel-3", ok: false, detail: "0 rows" }],
+};
+return { id, _receipt };
+```
+
+`verified` is `true` (the effect was observed), `false` (checked and did not hold), or `"unverified"` (could not be checked); `checks` and `warnings` are optional. The agent loop reads the receipt before the result is stringified and truncated (summary 200 chars, 8 checks, 5 warnings):
+
+- `verified: false` or `changed: false` forces one honest-reconciliation retry per turn: the model must say what the receipt shows and may not call the change visible or working. If the retry is spent, the answer is prefixed with the receipt block.
+- `verified: "unverified"` only prefixes that note; no retry.
+- A receipt that is present but malformed counts as `unverified`, never clean. `changed: false` also records the call as `completedSideEffect: false`.
+- Set `subject` (the stable target, such as a dashboard id) so a later `changed: true, verified: true` receipt for the same subject can supersede an earlier flagged one in the same turn. When the earlier receipt had failing or unverified `checks`, the later receipts (from this action or another that writes the same subject) must carry an `ok: true` check with the same `id` for each; a receipt without checks never clears one that had them. A flagged receipt with no failing checks is superseded only by the same action. Receipts without a `subject` are never superseded.
+
+A receipt is not an error channel. A write that did not achieve the requested state throws (`fail()`); return `changed: false` only for a benign no-op, such as the record already being in the requested state.
+
 ## Frontend Hooks
 
 Import from focused `@agent-native/core/client/*` entry points; the broad

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.203.0",
+  "version": "0.203.1-nightly-20261007183952",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -682,7 +682,7 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.203.0",
+    "@agent-native/agentkit": "^0.203.1-nightly-20261007183952",
     "@agent-native/recap-cli": "^0.5.64"
   },
   "devDependencies": {
@@ -753,7 +753,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": ">=0.196.0",
+    "@agent-native/core-corpus": "0.203.1-nightly-20261007183952",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",

package/src/templates/chat/.agents/skills/actions/SKILL.md

@@ -107,6 +107,31 @@ An action that hands control back to the user (question form, intake dialog) set
 
 Reach for `outputSchema` (validate the return), `_agentImages` (attach images the agent can see), `authorize` (gate who may call it), or `needsApproval` (require human sign-off per call) only when the action needs that guarantee — examples in `references/action-fields.md`.
 
+### Write receipts
+
+A write action that can check its own effect returns a plain-object result with a reserved `_receipt`, so the final answer is reconciled with what the write did, not with the model's reading of a JSON string that may be truncated:
+
+```ts
+import type { WriteReceipt } from "@agent-native/core/action";
+
+const _receipt: WriteReceipt = {
+  changed: true,
+  verified: false,
+  summary: "Saved; panel 3 returned no rows.",
+  checks: [{ id: "panel-3", ok: false, detail: "0 rows" }],
+};
+return { id, _receipt };
+```
+
+`verified` is `true` (the effect was observed), `false` (checked and did not hold), or `"unverified"` (could not be checked); `checks` and `warnings` are optional. The agent loop reads the receipt before the result is stringified and truncated (summary 200 chars, 8 checks, 5 warnings):
+
+- `verified: false` or `changed: false` forces one honest-reconciliation retry per turn: the model must say what the receipt shows and may not call the change visible or working. If the retry is spent, the answer is prefixed with the receipt block.
+- `verified: "unverified"` only prefixes that note; no retry.
+- A receipt that is present but malformed counts as `unverified`, never clean. `changed: false` also records the call as `completedSideEffect: false`.
+- Set `subject` (the stable target, such as a dashboard id) so a later `changed: true, verified: true` receipt for the same subject can supersede an earlier flagged one in the same turn. When the earlier receipt had failing or unverified `checks`, the later receipts (from this action or another that writes the same subject) must carry an `ok: true` check with the same `id` for each; a receipt without checks never clears one that had them. A flagged receipt with no failing checks is superseded only by the same action. Receipts without a `subject` are never superseded.
+
+A receipt is not an error channel. A write that did not achieve the requested state throws (`fail()`); return `changed: false` only for a benign no-op, such as the record already being in the requested state.
+
 ## Frontend Hooks
 
 Import from focused `@agent-native/core/client/*` entry points; the broad

package/src/templates/default/.agents/skills/actions/SKILL.md

@@ -107,6 +107,31 @@ An action that hands control back to the user (question form, intake dialog) set
 
 Reach for `outputSchema` (validate the return), `_agentImages` (attach images the agent can see), `authorize` (gate who may call it), or `needsApproval` (require human sign-off per call) only when the action needs that guarantee — examples in `references/action-fields.md`.
 
+### Write receipts
+
+A write action that can check its own effect returns a plain-object result with a reserved `_receipt`, so the final answer is reconciled with what the write did, not with the model's reading of a JSON string that may be truncated:
+
+```ts
+import type { WriteReceipt } from "@agent-native/core/action";
+
+const _receipt: WriteReceipt = {
+  changed: true,
+  verified: false,
+  summary: "Saved; panel 3 returned no rows.",
+  checks: [{ id: "panel-3", ok: false, detail: "0 rows" }],
+};
+return { id, _receipt };
+```
+
+`verified` is `true` (the effect was observed), `false` (checked and did not hold), or `"unverified"` (could not be checked); `checks` and `warnings` are optional. The agent loop reads the receipt before the result is stringified and truncated (summary 200 chars, 8 checks, 5 warnings):
+
+- `verified: false` or `changed: false` forces one honest-reconciliation retry per turn: the model must say what the receipt shows and may not call the change visible or working. If the retry is spent, the answer is prefixed with the receipt block.
+- `verified: "unverified"` only prefixes that note; no retry.
+- A receipt that is present but malformed counts as `unverified`, never clean. `changed: false` also records the call as `completedSideEffect: false`.
+- Set `subject` (the stable target, such as a dashboard id) so a later `changed: true, verified: true` receipt for the same subject can supersede an earlier flagged one in the same turn. When the earlier receipt had failing or unverified `checks`, the later receipts (from this action or another that writes the same subject) must carry an `ok: true` check with the same `id` for each; a receipt without checks never clears one that had them. A flagged receipt with no failing checks is superseded only by the same action. Receipts without a `subject` are never superseded.
+
+A receipt is not an error channel. A write that did not achieve the requested state throws (`fail()`); return `changed: false` only for a benign no-op, such as the record already being in the requested state.
+
 ## Frontend Hooks
 
 Import from focused `@agent-native/core/client/*` entry points; the broad

package/src/templates/factory/.agents/skills/review-latest-feedback/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: review-latest-feedback
 description: >-
-  Sweep Slack, GitHub, Sentry, Analytics, trackers, and automated diagnostics,
-  plus app/template, desktop, and package deploy/release/publish lanes. Fix
-  verified defects, verify recovery targets, and recap. Use for scheduled or
-  manual sweeps.
+  Review Slack, GitHub, CI, Sentry, Analytics, diagnostics, linked trackers,
+  and app/template, desktop, and package deploy/release lanes. Answer reporters
+  first; fix verified defects, verify delivery, build upvoted features, and
+  recap. Use for scheduled or manual sweeps.
 user-invocable: true
 scope: dev
 metadata:
@@ -218,15 +218,9 @@ Phase 2 reapplies these rules after full-thread review.
 Use `## Slack channels` unless the invocation narrows scope.
 
 **Automated diagnostics are feedback.** For Slack, gate before reading.
-Before investigating, use only alert and linked issue/PR/run/task metadata to
-identify repo/ref/SHA, workflow/service/environment, failure fingerprint, and
-active same-failure owner; this is Phase 0's sole pre-claim exception. If
-unowned/in scope, claim: Slack `👀`; elsewhere, current-task status row with
-source permalink, fingerprint, owner task/worktree, next action. Continue if
-this task owns it; else record **Owned elsewhere** (owner/link/action) and
-stop. No logs/tests/artifacts before claim. The required Slack claim reaction
-is authorized here; other source mutations need exact authorization. Then read
-`references/automated-diagnostics.md`.
+Before claiming, use only alert/link metadata. Follow
+[`automated-diagnostics.md`](references/automated-diagnostics.md) for ownership,
+claim, and stop/continue; inspect logs, tests, and artifacts only afterward.
 
 **Defects and design feedback.** A clear bug has observable broken behavior: a
 click or submit does nothing, an action errors, data is lost or reverted, the
@@ -271,13 +265,12 @@ the query also returns ordinary replies and old polls that happen to carry the
 reaction. Take the ones that name a concrete improvement; skip the rest
 without comment.
 
-An upvoted item is a **feature or UX change**: it skips only the clear-bug bar,
-not `👀`, fix-altitude, verification, or question-budget requirements. The
-upvote overrides the bug gate, not ownership; build the smallest endorsed
-version and name Sid or Alice in the recap. Add `👀` before investigation or
-delegation and read it back. Keep an evidence-limited disposition until Phase
-2's four bars hold; then use **Shipped**, adding `✅` only if it also meets
-**Fixed**.
+An upvote endorses a **feature or UX change** and skips only the clear-bug bar;
+it does not change ownership, reaction, verification, or question-budget rules.
+Build the smallest endorsed version, name Sid or Alice, and state requested
+versus actual behavior in the recap. Add `👀` before investigation or
+delegation and read it back. Keep it evidence-limited until Phase 2's four bars
+hold; then use **Shipped**, adding `✅` only if it meets **Fixed**.
 
 Don't search `has::eyes:`; use the owner or handoff path above.
 
@@ -326,13 +319,15 @@ inventing a fix.
 
 ### Deployment, release, and publish failures
 
-Scan app/template, desktop build/release, and package-publish lanes on every
-sweep, even without a linked report. Include queued/running runs, run-only
-failures, and missing/stale artifacts; carry active run IDs and rows across
-cursors. Fix verified repo-owned causes; record external/manual causes with the
-next owner/action. Use [`deployment-recovery.md`](references/deployment-recovery.md)
-for lane-specific recovery and target proof. Green CI or merged source
-does not prove delivery.
+Scan app/template, desktop, and package lanes every sweep, even without linked
+feedback. Carry active run IDs, queued/running runs, failures, and missing/stale
+artifacts across cursors. Fix repo causes; record external/manual causes with
+the next owner/action. CI-red deploy rows from [CI triage](references/ci-red-report.md)
+reuse this operational fingerprint. Follow
+[`deployment-recovery.md`](references/deployment-recovery.md) for recovery and
+target proof; keep delivery active until proof passes. A source issue may be
+**Fixed** separately; delivery gaps are never **Quarantined**. Green CI or
+merged source does not prove delivery.
 
 ## Phase 2: fix
 
@@ -363,8 +358,7 @@ slack_search: <2-4 distinctive symptom words> in:<#CHANNEL>
 ```
 
 Search in the reporter's words — `zoom invalid_client`, `logout twice` — not
-your diagnosis. People describe one bug differently, so read the hits rather
-than trusting the count.
+your diagnosis. Read hits; one bug may have different descriptions.
 
 **A repeat report after a Fixed claim is evidence that fix failed.** It is the
 only falsification signal this workflow gets, and it outranks your belief that
@@ -435,10 +429,9 @@ pre-existing.
 ### Npx and package reports have a release follow-up
 
 Use [`deployment-recovery.md`](references/deployment-recovery.md) for npx
-version evidence, registry proof, publication status, and existing-app upgrade
-verification. A verified merge may be **Fixed** under the issue-closure rule
-above while its delivery row stays open; a local scaffold or beta promise is not
-delivery.
+version, registry, publication, and existing-app upgrade proof. A verified merge
+may be **Fixed** while its delivery row stays open; a local scaffold or beta
+promise is not delivery.
 
 ### Documentation has a runnable proof obligation
 
@@ -457,12 +450,6 @@ Never hard-code a rule for the wording of one report. One data point justifies
 a local regression test or a contained fix; it never justifies a global agent
 instruction or prompt exception.
 
-### The bar for saying "Fixed"
-
-Phase 2 defines the proof bars for **Fixed**, **Shipped**, and
-**Live verified**. Upvoted improvements state requested versus actual behavior
-and use **Shipped**.
-
 ## Phase 3: reply
 
 Thank issue reporters for opening it and Slack reporters for sharing. Give the

package/src/templates/headless/.agents/skills/actions/SKILL.md

@@ -107,6 +107,31 @@ An action that hands control back to the user (question form, intake dialog) set
 
 Reach for `outputSchema` (validate the return), `_agentImages` (attach images the agent can see), `authorize` (gate who may call it), or `needsApproval` (require human sign-off per call) only when the action needs that guarantee — examples in `references/action-fields.md`.
 
+### Write receipts
+
+A write action that can check its own effect returns a plain-object result with a reserved `_receipt`, so the final answer is reconciled with what the write did, not with the model's reading of a JSON string that may be truncated:
+
+```ts
+import type { WriteReceipt } from "@agent-native/core/action";
+
+const _receipt: WriteReceipt = {
+  changed: true,
+  verified: false,
+  summary: "Saved; panel 3 returned no rows.",
+  checks: [{ id: "panel-3", ok: false, detail: "0 rows" }],
+};
+return { id, _receipt };
+```
+
+`verified` is `true` (the effect was observed), `false` (checked and did not hold), or `"unverified"` (could not be checked); `checks` and `warnings` are optional. The agent loop reads the receipt before the result is stringified and truncated (summary 200 chars, 8 checks, 5 warnings):
+
+- `verified: false` or `changed: false` forces one honest-reconciliation retry per turn: the model must say what the receipt shows and may not call the change visible or working. If the retry is spent, the answer is prefixed with the receipt block.
+- `verified: "unverified"` only prefixes that note; no retry.
+- A receipt that is present but malformed counts as `unverified`, never clean. `changed: false` also records the call as `completedSideEffect: false`.
+- Set `subject` (the stable target, such as a dashboard id) so a later `changed: true, verified: true` receipt for the same subject can supersede an earlier flagged one in the same turn. When the earlier receipt had failing or unverified `checks`, the later receipts (from this action or another that writes the same subject) must carry an `ok: true` check with the same `id` for each; a receipt without checks never clears one that had them. A flagged receipt with no failing checks is superseded only by the same action. Receipts without a `subject` are never superseded.
+
+A receipt is not an error channel. A write that did not achieve the requested state throws (`fail()`); return `changed: false` only for a benign no-op, such as the record already being in the requested state.
+
 ## Frontend Hooks
 
 Import from focused `@agent-native/core/client/*` entry points; the broad