@axiom-lattice/core 4.3.0 → 5.0.0

package/dist/index.js

@@ -1747,6 +1747,7 @@ __export(index_exports, {
   TaskLifecycleNotifier: () => TaskLifecycleNotifier,
   TaskLifecycleService: () => TaskLifecycleService,
   TaskRunBridgeStoresRequiredError: () => TaskRunBridgeStoresRequiredError,
+  TaskRunRegistry: () => TaskRunRegistry,
   TaskStatus: () => TaskStatus,
   TeamAgentGraphBuilder: () => TeamAgentGraphBuilder,
   TenantPluginCatalog: () => TenantPluginCatalog,
@@ -1758,7 +1759,6 @@ __export(index_exports, {
   VectorStoreProviderManager: () => VectorStoreProviderManager,
   VolumeFilesystem: () => VolumeFilesystem,
   abortWorkflowRun: () => abortWorkflowRun,
-  agentHasManagedTaskCapability: () => agentHasManagedTaskCapability,
   agentInstanceManager: () => agentInstanceManager,
   agentLatticeManager: () => agentLatticeManager,
   appendReconciliationWarning: () => appendReconciliationWarning,
@@ -1811,7 +1811,6 @@ __export(index_exports, {
   createSandboxProvider: () => createSandboxProvider,
   createSandboxResolver: () => createSandboxResolver,
   createSchedulerMiddleware: () => createSchedulerMiddleware,
-  createSemanticMetricsMiddleware: () => createSemanticMetricsMiddleware,
   createSharePayload: () => createSharePayload,
   createTaskExecutionService: () => createTaskExecutionService,
   createTaskLifecycleService: () => createTaskLifecycleService,
@@ -1933,6 +1932,9 @@ __export(index_exports, {
   projectTaskAdmissionNotifier: () => projectTaskAdmissionNotifier,
   queueLatticeManager: () => queueLatticeManager,
   readLoopBreakerConfig: () => readLoopBreakerConfig,
+  reconcileAllTenantTaskRuns: () => reconcileAllTenantTaskRuns,
+  reconcileStaleTaskRuns: () => reconcileStaleTaskRuns,
+  reconcileTenantTaskRuns: () => reconcileTenantTaskRuns,
   registerAgentLattice: () => registerAgentLattice,
   registerAgentLatticeWithTenant: () => registerAgentLatticeWithTenant,
   registerAgentLattices: () => registerAgentLattices,
@@ -1967,7 +1969,6 @@ __export(index_exports, {
   sandboxLatticeManager: () => sandboxLatticeManager,
   sanitizeToolCallId: () => sanitizeToolCallId,
   scheduleLatticeManager: () => scheduleLatticeManager,
-  semanticMetricsPlugin: () => semanticMetricsPlugin,
   serializePluginMeta: () => serializePluginMeta,
   serializeTaskMutationSuccess: () => serializeTaskMutationSuccess,
   serializeTaskNormalizationFallback: () => serializeTaskNormalizationFallback,
@@ -1981,6 +1982,7 @@ __export(index_exports, {
   storeLatticeManager: () => storeLatticeManager,
   sttModelLatticeManager: () => sttModelLatticeManager,
   taskLifecycleNotifier: () => taskLifecycleNotifier,
+  taskRunRegistry: () => taskRunRegistry,
   toJsonSchema: () => toJsonSchema,
   toSafeStateExpr: () => toSafeStateExpr,
   toolLatticeManager: () => toolLatticeManager,
@@ -2420,11 +2422,11 @@ var ToolLatticeManager = class _ToolLatticeManager extends BaseLatticeManager {
    * @param key Lattice键名
    * @param tool 已有的StructuredTool实例
    */
-  registerExistingTool(key5, tool71) {
+  registerExistingTool(key5, tool68) {
     const config = {
-      name: tool71.name,
-      description: tool71.description,
-      schema: tool71.schema,
+      name: tool68.name,
+      description: tool68.description,
+      schema: tool68.schema,
       // StructuredTool的schema已经是Zod兼容的
       needUserApprove: false
       // MCP工具默认不需要用户批准
@@ -2432,7 +2434,7 @@ var ToolLatticeManager = class _ToolLatticeManager extends BaseLatticeManager {
     const toolLattice = {
       key: key5,
       config,
-      client: tool71
+      client: tool68
     };
     this.register(key5, toolLattice);
   }
@@ -2443,14 +2445,14 @@ var ToolLatticeManager = class _ToolLatticeManager extends BaseLatticeManager {
    * @param key - tool lattice key (no tenant prefix)
    * @param tool - the StructuredTool client
    */
-  registerExistingToolWithTenant(tenantId2, key5, tool71) {
+  registerExistingToolWithTenant(tenantId2, key5, tool68) {
     const config = {
-      name: tool71.name,
-      description: tool71.description,
-      schema: tool71.schema,
+      name: tool68.name,
+      description: tool68.description,
+      schema: tool68.schema,
       needUserApprove: false
     };
-    const toolLattice = { key: key5, config, client: tool71 };
+    const toolLattice = { key: key5, config, client: tool68 };
     this.registerWithTenant(tenantId2, key5, toolLattice);
   }
   /**
@@ -2500,8 +2502,8 @@ var ToolLatticeManager = class _ToolLatticeManager extends BaseLatticeManager {
 };
 var toolLatticeManager = ToolLatticeManager.getInstance();
 var registerToolLattice = (key5, config, executor) => toolLatticeManager.registerLattice(key5, config, executor);
-var registerExistingTool = (key5, tool71) => toolLatticeManager.registerExistingTool(key5, tool71);
-var registerExistingToolWithTenant = (tenantId2, key5, tool71) => toolLatticeManager.registerExistingToolWithTenant(tenantId2, key5, tool71);
+var registerExistingTool = (key5, tool68) => toolLatticeManager.registerExistingTool(key5, tool68);
+var registerExistingToolWithTenant = (tenantId2, key5, tool68) => toolLatticeManager.registerExistingToolWithTenant(tenantId2, key5, tool68);
 var getToolLattice = (key5) => toolLatticeManager.getToolLattice(key5);
 var getToolClientWithTenant = (tenantId2, key5) => toolLatticeManager.getToolClientWithTenant(tenantId2, key5);
 var getToolDefinition = (key5) => toolLatticeManager.getToolDefinition(key5);
@@ -3341,15 +3343,15 @@ ${body}` : `${frontmatter}
     const resourcesDir = path.join(skillDir, "resources");
     try {
       const entries = await fs.readdir(resourcesDir, { withFileTypes: true, recursive: true });
-      const resources3 = [];
+      const resources2 = [];
       for (const entry of entries) {
         if (!entry.isDirectory()) {
           const fullPath = path.join(entry.path, entry.name);
           const relativePath = path.relative(resourcesDir, fullPath);
-          resources3.push(relativePath.replace(/\\/g, "/"));
+          resources2.push(relativePath.replace(/\\/g, "/"));
         }
       }
-      return resources3.sort();
+      return resources2.sort();
     } catch (error) {
       if (error.code === "ENOENT") {
         return [];
@@ -13205,7 +13207,7 @@ function readLoopBreakerConfig(env = process.env) {
   return {
     repeatWarn: parse(env.AGENT_REPEATED_TOOL_CALL_WARN, 3),
     repeatStop: parse(env.AGENT_REPEATED_TOOL_CALL_STOP, 5),
-    runLimit: parse(env.AGENT_TOOL_CALL_RUN_LIMIT, 120),
+    runLimit: parse(env.AGENT_TOOL_CALL_RUN_LIMIT, 300),
     skillRunLimit: parse(env.AGENT_SKILL_CALL_RUN_LIMIT, 8)
   };
 }
@@ -13628,11 +13630,11 @@ var PluginRegistry = class {
         if (!isRecord2(rawDefinition) || typeof rawDefinition.version !== "string" || rawDefinition.version.trim().length === 0 || typeof rawDefinition.content !== "string") {
           throw new Error(`Plugin "${key5}": skill "${name}" version and content must be a string`);
         }
-        const resources3 = rawDefinition.resources;
-        if (resources3 !== void 0 && !isRecord2(resources3)) {
+        const resources2 = rawDefinition.resources;
+        if (resources2 !== void 0 && !isRecord2(resources2)) {
           throw new Error(`Plugin "${key5}": skill "${name}" resources must be an object`);
         }
-        for (const [path8, resource] of Object.entries(resources3 ?? {})) {
+        for (const [path8, resource] of Object.entries(resources2 ?? {})) {
           try {
             validateRelativePath(path8, "resource");
           } catch {
@@ -14785,7 +14787,7 @@ function isSafeUiPath(path8) {
 }
 function validateSandboxPluginManifest(args) {
   const diagnostics = [];
-  const error = (code, message, pluginType, tool71) => diagnostics.push({ level: "error", code, message, pluginType, tool: tool71 });
+  const error = (code, message, pluginType, tool68) => diagnostics.push({ level: "error", code, message, pluginType, tool: tool68 });
   const raw = args.raw;
   if (!isRecord5(raw)) {
     error("MANIFEST_NOT_OBJECT", "manifest must be a JSON object", args.dirName);
@@ -15793,9 +15795,9 @@ function freezeMetadata(metadata) {
     ...resourceSelector ? { resourceSelector } : {}
   });
 }
-function toolName(tool71) {
-  if (typeof tool71 !== "object" || tool71 === null || !("name" in tool71)) return void 0;
-  return typeof tool71.name === "string" ? tool71.name : void 0;
+function toolName(tool68) {
+  if (typeof tool68 !== "object" || tool68 === null || !("name" in tool68)) return void 0;
+  return typeof tool68.name === "string" ? tool68.name : void 0;
 }
 function schemaHasConnectionKey(schema6) {
   const definition = isRecord7(schema6._def) ? schema6._def : void 0;
@@ -15803,10 +15805,10 @@ function schemaHasConnectionKey(schema6) {
   const fields = typeof shape === "function" ? shape() : shape;
   return isRecord7(fields) && Object.prototype.hasOwnProperty.call(fields, "connectionKey");
 }
-function hasConnectionKeySchema(tool71) {
-  if (!isRecord7(tool71) || !isRecord7(tool71.schema)) return false;
-  if (schemaHasConnectionKey(tool71.schema)) return true;
-  const definition = isRecord7(tool71.schema._def) ? tool71.schema._def : void 0;
+function hasConnectionKeySchema(tool68) {
+  if (!isRecord7(tool68) || !isRecord7(tool68.schema)) return false;
+  if (schemaHasConnectionKey(tool68.schema)) return true;
+  const definition = isRecord7(tool68.schema._def) ? tool68.schema._def : void 0;
   if (Array.isArray(definition?.options) && definition.options.length > 0) {
     return definition.options.every(
       (option) => isRecord7(option) && schemaHasConnectionKey(option)
@@ -15861,8 +15863,8 @@ var CapabilityToolRegistry = class {
    * @remarks Standard connection authorization is captured only for tools whose
    * schema declares `connectionKey`; legacy selectors remain explicit metadata.
    */
-  register(name, metadata, tool71) {
-    this.registerInternal(name, metadata, hasConnectionKeySchema(tool71));
+  register(name, metadata, tool68) {
+    this.registerInternal(name, metadata, hasConnectionKeySchema(tool68));
   }
   /**
    * Registers all tools actually exposed by a middleware instance.
@@ -15873,13 +15875,13 @@ var CapabilityToolRegistry = class {
    * @returns Nothing.
    */
   registerMiddleware(capabilityType, middleware, resourceSelectors = {}) {
-    for (const tool71 of middleware.tools ?? []) {
-      const name = toolName(tool71);
+    for (const tool68 of middleware.tools ?? []) {
+      const name = toolName(tool68);
       if (name) {
         this.registerInternal(name, {
           capabilityType,
           resourceSelector: resourceSelectors[name]
-        }, hasConnectionKeySchema(tool71));
+        }, hasConnectionKeySchema(tool68));
       }
     }
   }
@@ -16571,9 +16573,9 @@ var ReActAgentGraphBuilder = class {
    */
   async build(agentLattice, params) {
     const tools = params.tools.map((t) => {
-      const tool71 = getToolClientWithTenant(params.tenantId ?? "default", t.key);
-      return tool71;
-    }).filter((tool71) => tool71 !== void 0);
+      const tool68 = getToolClientWithTenant(params.tenantId ?? "default", t.key);
+      return tool68;
+    }).filter((tool68) => tool68 !== void 0);
     const stateSchema2 = createReactAgentSchema(params.stateSchema);
     const middlewareConfigs = params.middleware || [];
     const filesystemBackend = createFilesystemBackendFactory(middlewareConfigs);
@@ -16889,6 +16891,41 @@ var AgentManager = class _AgentManager {
   }
 };
 
+// src/services/TaskExecutionContext.ts
+var DELEGATED_WORKER_SCOPE_TOKEN = Symbol("delegated-worker-scope");
+var delegatedWorkerScopeSecret = Object.freeze({});
+function createDelegatedWorkerRunConfig(taskId) {
+  return {
+    taskId,
+    delegatedTaskId: taskId,
+    taskExecutionRole: "worker",
+    execution: { taskId },
+    [DELEGATED_WORKER_SCOPE_TOKEN]: delegatedWorkerScopeSecret
+  };
+}
+function getDelegatedTaskId(runConfig) {
+  return runConfig[DELEGATED_WORKER_SCOPE_TOKEN] === delegatedWorkerScopeSecret && runConfig.taskExecutionRole === "worker" && typeof runConfig.taskId === "string" && runConfig.taskId.trim() !== "" && typeof runConfig.delegatedTaskId === "string" && runConfig.taskId === runConfig.delegatedTaskId ? runConfig.taskId : void 0;
+}
+function hasDelegatedWorkerToken(runConfig) {
+  return Object.prototype.hasOwnProperty.call(runConfig, DELEGATED_WORKER_SCOPE_TOKEN);
+}
+function preserveDelegatedWorkerContext(source, target) {
+  const delegatedTaskId = getDelegatedTaskId(source);
+  if (!delegatedTaskId) return;
+  target.taskId = delegatedTaskId;
+  target.delegatedTaskId = delegatedTaskId;
+  target.taskExecutionRole = "worker";
+  target.execution = { taskId: delegatedTaskId };
+  target[DELEGATED_WORKER_SCOPE_TOKEN] = delegatedWorkerScopeSecret;
+}
+function stripDelegatedWorkerContext(target) {
+  delete target.taskId;
+  delete target.delegatedTaskId;
+  delete target.taskExecutionRole;
+  delete target.execution;
+  delete target[DELEGATED_WORKER_SCOPE_TOKEN];
+}
+
 // src/agent_worker/agent_worker_graph.ts
 var AgentWorkerState = import_langgraph5.Annotation.Root({
   // Input parameters
@@ -16913,6 +16950,13 @@ var AgentWorkerState = import_langgraph5.Annotation.Root({
     reducer: (x, y) => y ?? x,
     default: () => void 0
   }),
+  // Optional persistent TaskItem binding. Rebuilt into an authentic delegated
+  // worker scope on every execute (the in-process scope symbol cannot survive
+  // LangGraph checkpointing, so it is re-derived from this plain task id).
+  taskId: (0, import_langgraph5.Annotation)({
+    reducer: (x, y) => y ?? x,
+    default: () => ""
+  }),
   // Execution result
   result: (0, import_langgraph5.Annotation)({
     reducer: (x, y) => y ?? x,
@@ -16930,14 +16974,15 @@ var AgentWorkerState = import_langgraph5.Annotation.Root({
   })
 });
 async function executeNode(state) {
-  const { assistant_id, thread_id, input, command2, runConfig } = state;
+  const { assistant_id, thread_id, input, command2, runConfig, taskId } = state;
+  const effectiveRunConfig = taskId ? { ...runConfig ?? {}, ...createDelegatedWorkerRunConfig(taskId) } : runConfig;
   const callParams = {
     assistant_id,
     "x-tenant-id": runConfig?.tenantId,
     thread_id,
     input,
     command: command2,
-    runConfig
+    runConfig: effectiveRunConfig
   };
   const result = await AgentManager.getInstance().callAgentInQueue(
     callParams,
@@ -17687,8 +17732,8 @@ function validateCapability(value, index) {
         fieldPath: `/capabilities/${index}/allowedTools`
       });
     }
-    for (const [toolIndex, tool71] of capability.allowedTools.entries()) {
-      if (typeof tool71 !== "string") {
+    for (const [toolIndex, tool68] of capability.allowedTools.entries()) {
+      if (typeof tool68 !== "string") {
         throw new CapabilityBundleValidationError(
           "CAPABILITY_BUNDLE_INVALID_CAPABILITY",
           "allowedTools entries must be strings",
@@ -17702,10 +17747,10 @@ function validateCapability(value, index) {
         fieldPath: `/capabilities/${index}/allowedTools`
       });
     }
-    const toolNames = new Set(plugin.meta.tools.map((tool71) => tool71.name));
-    for (const [toolIndex, tool71] of capability.allowedTools.entries()) {
-      if (typeof tool71 !== "string" || !toolNames.has(tool71)) {
-        throw new CapabilityBundleValidationError("CAPABILITY_BUNDLE_UNKNOWN_TOOL", `Unknown tool '${String(tool71)}'`, {
+    const toolNames = new Set(plugin.meta.tools.map((tool68) => tool68.name));
+    for (const [toolIndex, tool68] of capability.allowedTools.entries()) {
+      if (typeof tool68 !== "string" || !toolNames.has(tool68)) {
+        throw new CapabilityBundleValidationError("CAPABILITY_BUNDLE_UNKNOWN_TOOL", `Unknown tool '${String(tool68)}'`, {
           capabilityType,
           fieldPath: `/capabilities/${index}/allowedTools/${toolIndex}`
         });
@@ -18188,7 +18233,7 @@ function applyStaticCeiling(capabilities, staticMiddleware) {
     const projectTools = capability.allowedTools;
     const staticTools = ceiling.allowedTools;
     const effectiveStaticTools = staticTools?.length === 0 ? void 0 : staticTools;
-    const allowedTools = projectTools === void 0 ? effectiveStaticTools : effectiveStaticTools === void 0 ? projectTools : projectTools.filter((tool71) => effectiveStaticTools.includes(tool71));
+    const allowedTools = projectTools === void 0 ? effectiveStaticTools : effectiveStaticTools === void 0 ? projectTools : projectTools.filter((tool68) => effectiveStaticTools.includes(tool68));
     runtime[capability.type] = structuredClone({
       ...capability,
       config: applyStaticResourceCeiling(capability, ceiling),
@@ -18288,38 +18333,6 @@ var CapabilityRuntimeResolver = class {
   }
 };
 
-// src/services/TaskExecutionContext.ts
-var DELEGATED_WORKER_SCOPE_TOKEN = Symbol("delegated-worker-scope");
-var delegatedWorkerScopeSecret = Object.freeze({});
-function createDelegatedWorkerRunConfig(taskId) {
-  return {
-    taskId,
-    delegatedTaskId: taskId,
-    taskExecutionRole: "worker",
-    [DELEGATED_WORKER_SCOPE_TOKEN]: delegatedWorkerScopeSecret
-  };
-}
-function getDelegatedTaskId(runConfig) {
-  return runConfig[DELEGATED_WORKER_SCOPE_TOKEN] === delegatedWorkerScopeSecret && runConfig.taskExecutionRole === "worker" && typeof runConfig.taskId === "string" && runConfig.taskId.trim() !== "" && typeof runConfig.delegatedTaskId === "string" && runConfig.taskId === runConfig.delegatedTaskId ? runConfig.taskId : void 0;
-}
-function hasDelegatedWorkerToken(runConfig) {
-  return Object.prototype.hasOwnProperty.call(runConfig, DELEGATED_WORKER_SCOPE_TOKEN);
-}
-function preserveDelegatedWorkerContext(source, target) {
-  const delegatedTaskId = getDelegatedTaskId(source);
-  if (!delegatedTaskId) return;
-  target.taskId = delegatedTaskId;
-  target.delegatedTaskId = delegatedTaskId;
-  target.taskExecutionRole = "worker";
-  target[DELEGATED_WORKER_SCOPE_TOKEN] = delegatedWorkerScopeSecret;
-}
-function stripDelegatedWorkerContext(target) {
-  delete target.taskId;
-  delete target.delegatedTaskId;
-  delete target.taskExecutionRole;
-  delete target[DELEGATED_WORKER_SCOPE_TOKEN];
-}
-
 // src/services/TrustedAgentDispatchCapability.ts
 var TRUSTED_AGENT_DISPATCH = Symbol("axiom.trustedAgentDispatch");
 
@@ -18483,8 +18496,22 @@ function sanitizeCallerRunConfig(value, preserveDelegatedContext = true) {
   } else {
     stripDelegatedWorkerContext(callerRunConfig);
   }
+  preserveExecutionBinding(value, callerRunConfig);
   return callerRunConfig;
 }
+function preserveExecutionBinding(source, target) {
+  if (typeof source !== "object" || source === null || Array.isArray(source)) return;
+  const execution = (0, import_protocols10.descriptorDataValue)(Object.getOwnPropertyDescriptor(source, "execution"))?.value;
+  if (typeof execution !== "object" || execution === null || Array.isArray(execution)) return;
+  const taskId = (0, import_protocols10.descriptorDataValue)(Object.getOwnPropertyDescriptor(execution, "taskId"))?.value;
+  if (typeof taskId !== "string" || taskId.trim() === "") return;
+  Object.defineProperty(target, "execution", {
+    value: { taskId },
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+}
 function sanitizeExecutionRunConfig(value) {
   return cloneRunConfig(value, false);
 }
@@ -18604,6 +18631,7 @@ function checkpointCapabilityRevision(state) {
 }
 var QUEUE_PROCESSOR_RETRY_BASE_MS = 100;
 var QUEUE_PROCESSOR_MAX_RETRIES = 3;
+var AGENT_RECURSION_LIMIT = 1e3;
 function hasExactKeys(record, required, optional = []) {
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
   return required.every((key5) => Object.prototype.hasOwnProperty.call(record, key5)) && Reflect.ownKeys(record).every((key5) => typeof key5 === "string" && allowed.has(key5));
@@ -18656,7 +18684,7 @@ var Agent = class {
               ...executionRunConfig,
               runConfig: executionRunConfig
             },
-            recursionLimit: 200,
+            recursionLimit: AGENT_RECURSION_LIMIT,
             signal
           }
         );
@@ -18731,7 +18759,7 @@ var Agent = class {
             },
             streamMode: ["updates", "messages"],
             subgraphs: false,
-            recursionLimit: 200,
+            recursionLimit: AGENT_RECURSION_LIMIT,
             signal
           }
         );
@@ -19229,6 +19257,15 @@ var Agent = class {
       configurable: true,
       writable: true
     });
+    const trustedTaskId = parsed.projectTask?.taskId;
+    if (trustedTaskId) {
+      Object.defineProperty(base, "execution", {
+        value: { taskId: trustedTaskId },
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
     return base;
   }
   getHumanPendingContent(message) {
@@ -19432,7 +19469,7 @@ var Agent = class {
           ...executionRunConfig,
           runConfig: executionRunConfig
         },
-        recursionLimit: 200,
+        recursionLimit: AGENT_RECURSION_LIMIT,
         signal
       }
     );
@@ -19543,7 +19580,7 @@ var Agent = class {
         },
         streamMode: ["updates", "messages"],
         subgraphs: false,
-        recursionLimit: 200,
+        recursionLimit: AGENT_RECURSION_LIMIT,
         signal
       }
     );
@@ -20300,6 +20337,20 @@ var agentInstanceManager = AgentInstanceManager.getInstance();
 var DEFAULT_SUBAGENT_PROMPT = "In order to complete the objective that the user asks of you, you have access to a number of standard tools.";
 var EXCLUDED_STATE_KEYS = ["messages", "todos", "jumpTo"];
 var DEFAULT_GENERAL_PURPOSE_DESCRIPTION = "General-purpose agent for researching complex questions, searching for files and content, and executing multi-step tasks. When you are searching for a keyword or file and are not confident that you will find the right match in the first few tries use this agent to perform the search for you. This agent has access to all tools as the main agent.";
+function createGeneralPurposeAgent(options) {
+  const middleware = [...options.middleware];
+  if (options.interruptOn) {
+    middleware.push((0, import_langchain53.humanInTheLoopMiddleware)({ interruptOn: options.interruptOn }));
+  }
+  return (0, import_langchain53.createAgent)({
+    model: options.model,
+    systemPrompt: DEFAULT_SUBAGENT_PROMPT,
+    tools: options.tools,
+    middleware,
+    checkpointer: getCheckpointSaver("default"),
+    name: "general-purpose"
+  });
+}
 function getTaskToolDescription(subagentDescriptions) {
   return subagentDescriptions.length > 0 ? `
 Launch an ephemeral subagent to handle complex, multi-step independent tasks with isolated context windows.
@@ -20479,21 +20530,12 @@ function getSubagents(options) {
   const agents = {};
   const subagentDescriptions = [];
   if (generalPurposeAgent) {
-    const generalPurposeMiddleware = [...defaultSubagentMiddleware];
-    if (defaultInterruptOn) {
-      generalPurposeMiddleware.push(
-        (0, import_langchain53.humanInTheLoopMiddleware)({ interruptOn: defaultInterruptOn })
-      );
-    }
-    const generalPurposeSubagent = (0, import_langchain53.createAgent)({
+    agents["general-purpose"] = createGeneralPurposeAgent({
       model: defaultModel,
-      systemPrompt: DEFAULT_SUBAGENT_PROMPT,
       tools: defaultTools,
-      middleware: generalPurposeMiddleware,
-      checkpointer: getCheckpointSaver("default"),
-      name: "general-purpose"
+      middleware: defaultSubagentMiddleware,
+      interruptOn: defaultInterruptOn
     });
-    agents["general-purpose"] = generalPurposeSubagent;
     subagentDescriptions.push(
       `- general-purpose: ${DEFAULT_GENERAL_PURPOSE_DESCRIPTION}`
     );
@@ -23932,6 +23974,7 @@ ${BASE_PROMPT}` : BASE_PROMPT;
 }
 
 // src/agent_lattice/builders/DeepAgentGraphBuilder.ts
+var import_protocols15 = require("@axiom-lattice/protocols");
 init_MemoryLatticeManager();
 var DeepAgentGraphBuilder = class {
   /**
@@ -23945,7 +23988,7 @@ var DeepAgentGraphBuilder = class {
     const tools = params.tools.map((t) => {
       const toolClient = getToolClientWithTenant(params.tenantId ?? "default", t.key);
       return toolClient;
-    }).filter((tool71) => tool71 !== void 0);
+    }).filter((tool68) => tool68 !== void 0);
     const subagents = await Promise.all(params.subAgents.map(async (sa) => {
       if (sa.client) {
         return {
@@ -23981,6 +24024,28 @@ var DeepAgentGraphBuilder = class {
       backend: filesystemBackend,
       middleware: middlewares
     });
+    if (middlewares.some((candidate) => candidate.name === "TaskMiddleware") && agentLattice.config.key) {
+      const tenantId2 = params.tenantId ?? "default";
+      const generalPurposeKey = `${agentLattice.config.key}-general-purpose`;
+      if (!agentLatticeManager.hasAgentLatticeWithTenant(tenantId2, generalPurposeKey)) {
+        const generalPurposeAgent = createGeneralPurposeAgent({
+          model: params.model,
+          tools,
+          middleware: middlewares
+        });
+        agentLatticeManager.registerWithTenant(tenantId2, generalPurposeKey, {
+          config: {
+            key: generalPurposeKey,
+            name: "general-purpose",
+            description: DEFAULT_GENERAL_PURPOSE_DESCRIPTION,
+            type: import_protocols15.AgentType.REACT,
+            prompt: DEFAULT_SUBAGENT_PROMPT,
+            tenantId: tenantId2
+          },
+          client: generalPurposeAgent
+        });
+      }
+    }
     return deepAgent;
   }
 };
@@ -25575,7 +25640,7 @@ var TeamAgentGraphBuilder = class {
     const tools = params.tools.map((t) => {
       const toolClient = getToolClientWithTenant(params.tenantId ?? "default", t.key);
       return toolClient;
-    }).filter((tool71) => tool71 !== void 0);
+    }).filter((tool68) => tool68 !== void 0);
     const teammates = params.subAgents.map((sa) => {
       const baseConfig = sa.config;
       return {
@@ -25932,11 +25997,11 @@ _A2ARemoteClient.MAX_CACHED_TASKS = 100;
 var A2ARemoteClient = _A2ARemoteClient;
 
 // src/agent_lattice/builders/RemoteAgentGraphBuilder.ts
-var import_protocols15 = require("@axiom-lattice/protocols");
+var import_protocols16 = require("@axiom-lattice/protocols");
 init_MemoryLatticeManager();
 var RemoteAgentGraphBuilder = class {
   async build(agentLattice, params) {
-    if (agentLattice.config.type !== import_protocols15.AgentType.A2A_REMOTE) {
+    if (agentLattice.config.type !== import_protocols16.AgentType.A2A_REMOTE) {
       throw new Error(
         `RemoteAgentGraphBuilder received wrong agent type: ${agentLattice.config.type}`
       );
@@ -26001,7 +26066,7 @@ function extractLastHumanMessage(messages) {
 // src/agent_lattice/builders/WorkflowAgentGraphBuilder.ts
 var import_langchain61 = require("langchain");
 init_MemoryLatticeManager();
-var import_protocols16 = require("@axiom-lattice/protocols");
+var import_protocols17 = require("@axiom-lattice/protocols");
 init_compile();
 
 // src/agent_lattice/builders/middlewareSanitize.ts
@@ -26039,7 +26104,7 @@ ${configPrompt}` : base;
 }
 var WorkflowAgentGraphBuilder = class {
   async build(agentLattice, params) {
-    if (!(0, import_protocols16.isWorkflowAgentConfig)(agentLattice.config)) {
+    if (!(0, import_protocols17.isWorkflowAgentConfig)(agentLattice.config)) {
       throw new Error(
         `WorkflowAgentGraphBuilder received wrong agent type: ${agentLattice.config.type}`
       );
@@ -26177,7 +26242,7 @@ var AgentGraphBuilderFactory = class _AgentGraphBuilderFactory {
 };
 
 // src/agent_lattice/builders/AgentParamsBuilder.ts
-var import_protocols17 = require("@axiom-lattice/protocols");
+var import_protocols18 = require("@axiom-lattice/protocols");
 var AgentParamsBuilder = class {
   /**
    * constructor
@@ -26195,8 +26260,8 @@ var AgentParamsBuilder = class {
    * @returns Agent build parameters
    */
   async buildParams(agentLattice, options) {
-    const skills = (0, import_protocols17.isDeepAgentConfig)(agentLattice.config) || (0, import_protocols17.isProcessingAgentConfig)(agentLattice.config) ? agentLattice.config.skillCategories : void 0;
-    const toolKeys = options?.overrideTools || (0, import_protocols17.getToolsFromConfig)(agentLattice.config);
+    const skills = (0, import_protocols18.isDeepAgentConfig)(agentLattice.config) || (0, import_protocols18.isProcessingAgentConfig)(agentLattice.config) ? agentLattice.config.skillCategories : void 0;
+    const toolKeys = options?.overrideTools || (0, import_protocols18.getToolsFromConfig)(agentLattice.config);
     const tenantId2 = agentLattice.config.tenantId || "default";
     const tools = toolKeys.map((toolKey) => {
       const toolLattice = toolLatticeManager.getToolLatticeWithTenant(tenantId2, toolKey) ?? toolLatticeManager.getToolLatticeWithTenant("default", toolKey);
@@ -26215,7 +26280,7 @@ var AgentParamsBuilder = class {
     if (!model) {
       throw new Error(`Model "${modelKey}" does not exist`);
     }
-    const subAgentKeys = (0, import_protocols17.getSubAgentsFromConfig)(agentLattice.config);
+    const subAgentKeys = (0, import_protocols18.getSubAgentsFromConfig)(agentLattice.config);
     const subAgents = await Promise.all(subAgentKeys.map(async (agentKey) => {
       const subAgentLattice = await this.getAgentLatticeFunc(agentKey);
       if (!subAgentLattice) {
@@ -26232,7 +26297,7 @@ var AgentParamsBuilder = class {
     }));
     const resolvedSubAgents = subAgents.filter((s) => s !== null);
     let internalSubAgents = [];
-    if ((0, import_protocols17.isDeepAgentConfig)(agentLattice.config) || (0, import_protocols17.isProcessingAgentConfig)(agentLattice.config)) {
+    if ((0, import_protocols18.isDeepAgentConfig)(agentLattice.config) || (0, import_protocols18.isProcessingAgentConfig)(agentLattice.config)) {
       internalSubAgents = agentLattice.config.internalSubAgents?.map((i) => ({
         key: i.key,
         config: i
@@ -26710,9 +26775,15 @@ For human judgment, use the actual HITL payload \`status: "interrupted"\` plus
 handled by the configured HITL lifecycle; \`review_required\` is not a task status.
 
 Create the active parent and each started subtask as records: \`manage_task
-create\` always persists \`pending\`. Execution starts only via
-\`task(taskId, agentId)\` dispatch, or the agent works inline and keeps the status
-truthful with \`set_status\`. Use \`pending\` only for future or
+create\` always persists \`pending\`. **Process the task you were assigned in this
+run: set it \`in_progress\` with \`manage_task set_status\` when you start (a
+dispatched task is claimed automatically by the engine).** To bring
+in a more suitable expert, create a subtask (\`pending\`) and dispatch THAT with
+\`task { taskId, agentId }\` (a specialist, or agentId "general-purpose" to run your
+own capabilities in an isolated run). **Never re-dispatch the task you are
+currently processing** \u2014 delegating to an expert means giving them a child task,
+not handing over your own. Report the outcome with \`set_status completed\` (result
++ beliefImpact), \`failed\`, or \`interrupted\`. Use \`pending\` only for future or
 dependency-blocked work.
 Before marking the parent completed, call \`list(parentId)\`: every child must
 be completed or cancelled, while a failed or interrupted child blocks completion
@@ -28003,34 +28074,24 @@ Renew HITL approval when a foundational assumption or authority boundary changes
 
 ## Skill Loading Policy
 
-Visible in <available_skills> does not mean loaded. Follow these three tiers.
-
-### Tier 1 \u2014 Session start (mandatory, unconditional)
-Load before any other work; the bootstrap prompt enforces this:
-- [[agent-architecture]] (this skill) \u2014 shared policy and routing.
-- [[task-tracking]] \u2014 before your first \`manage_task\` call; Task management is
-  the planning surface and is gated again under Architect Task Policy.
-
-### Tier 2 \u2014 Scenario gates (mandatory before entering the scenario)
-Load the owning skill with the \`skill\` tool BEFORE the first action of that
-scenario. Never execute a scenario without its owning skill loaded:
-- Creating or modifying a Capability (\`react\`) or Orchestra (\`deep_agent\`)
-  Agent \u2192 [[agent-build]]
-- Creating or modifying a Workflow (stable enumerable pipelines) \u2192 [[design-workflow]]
-- Learning a capability from source material \u2192 [[document-learning-learn-capability]]
-- Designing evals, running evals, or fixing eval failures \u2192 [[eval-verify]]
-- Claiming work is complete or delivered \u2192 [[completion-gate]]
-- Final configuration pre-check before delivery \u2192 [[review-agent]]
-- Placing or authoring knowledge files (company vs project level) \u2192 [[knowledge-management]]
-
-If a Tier 2 load fails, retry once, then stop and tell the user which
-capability is unavailable. Do not improvise the scenario from partial knowledge.
-
-### Tier 3 \u2014 Reference (load on demand, never preload)
-Deep details reachable through wiki-links inside loaded skills, and plugin
-skills outside this chain (for example task-definition for non-architect
-agents, or sandbox-plugins-authoring for the \`plugin-builder\` agent). Load one
-only when the current step actually needs it.
+Visible in <available_skills> does not mean loaded. Load a skill only when the
+current step actually requires its procedure \u2014 one at a time, never preloaded.
+Do not load skills speculatively or to "see what exists": inspect existing
+assets with a bounded read-only survey, not by loading skill content.
+
+- [[agent-architecture]] (this skill) \u2014 loaded at session start by the bootstrap
+  prompt; it is the shared policy and router.
+- [[task-tracking]] \u2014 load right before your first \`manage_task\` call; Task
+  management is the planning surface (gated again under Architect Task Policy).
+- Procedure skills \u2014 [[agent-build]], [[design-workflow]],
+  [[document-learning-learn-capability]], [[eval-verify]], [[completion-gate]],
+  [[review-agent]], [[knowledge-management]]: load the ONE that owns the step you
+  are about to perform, immediately before performing it. Never preload the chain.
+- Reference and plugin skills (deep wiki-links, task-definition, sandbox authoring,
+  and any plugin skills): load only when the current step needs them; never preload.
+
+Loading a skill is a tool call, not a plan. If a required load fails, retry once,
+then stop and tell the user which capability is unavailable.
 
 ## Agent Forms and Routing
 - **Capability** (\`react\`) for bounded direct work: [[agent-build]]
@@ -28043,9 +28104,19 @@ only when the current step actually needs it.
 - **Tenant plugin** (sandbox-authored tool + optional HTML UI) \u2192 use the \`plugin-builder\` agent, or load [[sandbox-plugins-authoring]].
 
 ## Architect Task Policy
-The Agent Architect uses persistent TaskItems as its planning surface. Architect must not use
-\`write_todos\`. Create a persistent child only for an independently verifiable
+The Agent Architect MUST use persistent TaskItems as its single working surface;
+Architect must not use \`write_todos\` for independently verifiable outcomes, and
+working without a corresponding TaskItem is a policy violation.
+Create a persistent child only for an independently verifiable
 outcome; tool calls and file reads are actions inside the active Task.
+**Each task is your evidence ledger**: its Acceptance Criteria + Belief State define
+what counts as evidence, the work runs inside your own run (eval / \`invoke_agent\` for
+subject agents) and produces that evidence, and the parent completes only when the
+evidence is sufficient. Process the task you were assigned in this run; set it
+\`in_progress\` with \`manage_task set_status\` when you start. Delegate a subtask only
+when it belongs to another agent \u2014 create it (\`pending\`) and dispatch it with
+\`task { taskId, agentId }\`. To exercise a designed/subject agent, use eval /
+\`invoke_agent\` inside your own run instead of \`task\` dispatch.
 **MANDATORY: before your first \`manage_task\` call in this session, load
 [[task-tracking]] with the \`skill\` tool.** Do not create, update, or transition
 any Task until it is loaded. If the load fails, retry once, then tell the user
@@ -28116,11 +28187,11 @@ When a room request is actionable work, decide between two paths:
   \`assistantId\`, then dispatch it with
   \`task { taskId, agentId: <bot assistantId> }\` so the specialist actually runs
   (creating the task alone starts nothing). \`task\` transfers the task owner to
-  \`agentId\` and requires a **task-capable** bot (enabled \`task\` middleware that
-  exposes \`manage_task\`); a non-capable target is rejected with
-  \`TASK_DELEGATE_TARGET_NOT_CAPABLE\`. State the expected output and
-  acceptance criteria in the task description so the assigned bot can verify its
-  own work.
+  \`agentId\` and runs it in an isolated thread; the target does not need task
+  tools \u2014 if it has \`manage_task\` it records status itself, otherwise reconcile
+  its returned \`executionResultId\` with \`manage_task\` update. State the expected output
+  and acceptance criteria in the task description so the assigned bot can
+  verify its own work.
 
 ## Discovering bots
 Before delegating, call \`list_room_roster\` to see the active room bots and their
@@ -28271,9 +28342,15 @@ criteria are truly met \u2014 never as a workaround.
   uncertainties, with no required minimum and a maximum of seven:
   \`manage_task create(title: <goal>, description: <contract + Belief State>, ownerType: "agent")\`
   \`create\` always yields a \`pending\` record \u2014 it never starts execution. Record
-  the returned parent task id, then run it by dispatching
-  \`task { taskId, agentId }\` (a fresh isolated thread); otherwise work inline and
-  \`set_status\` as you go.
+  the returned parent task id, then **process it in this run**, setting it
+  \`in_progress\` with \`manage_task set_status\` when you start. To decompose, create each subtask
+  with \`manage_task create\` (\`pending\`) and delegate it with \`task { taskId,
+  agentId }\` to the agent that should execute it (a specialist, or
+  "general-purpose" for your own capabilities). The executor does not need
+  \`manage_task\`: it returns an observation and \`executionResultId\`, and the caller
+  records the outcome with \`manage_task\`. To exercise a subject application agent,
+  use eval cases / \`invoke_agent\` inside your own run \u2014 \`task\` dispatch is
+  delegation of persistent work, not an evaluation mechanism.
 - **Create a subtask for a verifiable result**, not per phase: identify its
   deliverable, define observable acceptance criteria and required evidence, and
   state positive and negative result branches under Targets / Expected Impact
@@ -28298,10 +28375,15 @@ ${TASK_BELIEF_REFERENCE_EXAMPLE}
 
 ## Status discipline \u2014 MANDATORY
 
+- Execution ownership: process the task you were assigned in this run; set it
+  \`in_progress\` with \`manage_task set_status\` when you start. To involve a more
+  suitable expert, create a subtask and dispatch it with \`task { taskId, agentId }\`
+  \u2014 never re-dispatch the task you are processing. Report the outcome with
+  \`set_status completed\` (result + beliefImpact), \`failed\`, or \`interrupted\`.
 - All status transitions go through \`manage_task set_status\` (with
   \`result\` on completed, \`failureReason\` on failed). \`update\` is for
   content fields only and rejects a status field.
-- A subtask is \`completed\` ONLY when its work is actually finished.
+- A task is \`completed\` ONLY when its work is actually finished.
   While fixing eval failures, keep it \`in_progress\` \u2014 never mark
   \`completed\` as a workaround (the state machine rejects illegal
   transitions).
@@ -28901,6 +28983,11 @@ its evidence projection, not an independent source of goals or expectations.
      touching any eval project. An eval project created without a real, confirmed
      subject is a hard error. If the agent is only planned (not yet materialized),
      evaluation must wait until materialization returns its id.
+   - **Exercise the subject through eval \u2014 never through \`task\` dispatch.** The
+     subject agent is invoked by eval cases / \`invoke_agent\`; do NOT create a
+     TaskItem assigned to the subject and dispatch it. \`task\` is for delegated
+     execution of persistent work, not an evaluation mechanism. Use eval cases to
+     measure the subject; keep \`task\` dispatch for executors running real work.
    - **Check existence before creating; reuse is the rule, creation is the exception.**
      Project names are unique per tenant. 1) Name it exactly \`eval-{agent-id}\`.
      2) \`read_eval list_projects({ name: "eval-{agent-id}" })\` \u2014 a name-scoped lookup,
@@ -29888,7 +29975,7 @@ var InMemoryMenuStore = class {
 // src/agent_lattice/agentArchitectTools.ts
 var import_zod50 = __toESM(require("zod"));
 var import_uuid9 = require("uuid");
-var import_protocols18 = require("@axiom-lattice/protocols");
+var import_protocols19 = require("@axiom-lattice/protocols");
 function getTenantId2(exeConfig) {
   const runConfig = exeConfig?.configurable?.runConfig || {};
   return runConfig.tenantId || "default";
@@ -29938,7 +30025,7 @@ function getStringMetadata(config) {
 }
 function isUndecidedLearningPlaceholder(config) {
   const metadata = getStringMetadata(config);
-  return config.type === import_protocols18.AgentType.REACT && metadata.learningPlaceholder === "true" && metadata.architectureStatus === "undecided";
+  return config.type === import_protocols19.AgentType.REACT && metadata.learningPlaceholder === "true" && metadata.architectureStatus === "undecided";
 }
 function requireSkillDeclaration(skillLoaded) {
   if (skillLoaded !== true) {
@@ -29950,7 +30037,7 @@ function requireSkillDeclaration(skillLoaded) {
   return void 0;
 }
 async function validateAgentReferences(input, tenantId2) {
-  const availableTools = getAvailableTools(tenantId2).map((tool71) => tool71.key);
+  const availableTools = getAvailableTools(tenantId2).map((tool68) => tool68.key);
   const availableMiddlewareTypes = getAvailableMiddlewareTypes();
   const availableCustomMiddlewareKeys = CustomMiddlewareRegistry.list().filter(
     (key5) => CustomMiddlewareRegistry.get(key5) !== void 0
@@ -30091,7 +30178,7 @@ registerToolLattice(
         key: id,
         name: input.name,
         description: input.description || "",
-        type: input.type === "deep_agent" ? import_protocols18.AgentType.DEEP_AGENT : import_protocols18.AgentType.REACT,
+        type: input.type === "deep_agent" ? import_protocols19.AgentType.DEEP_AGENT : import_protocols19.AgentType.REACT,
         prompt: input.prompt,
         ...input.tools && input.tools.length > 0 ? { tools: input.tools } : {},
         ...input.middleware && input.middleware.length > 0 ? { middleware: input.middleware } : {},
@@ -30148,7 +30235,7 @@ registerToolLattice(
         key: id,
         name: input.name,
         description: input.description || "",
-        type: import_protocols18.AgentType.WORKFLOW,
+        type: import_protocols19.AgentType.WORKFLOW,
         prompt: input.description || `Workflow: ${input.name}`,
         workflowYaml: input.yaml,
         ...input.tools && input.tools.length > 0 ? { tools: input.tools } : {},
@@ -30185,7 +30272,7 @@ registerToolLattice(
         return JSON.stringify({ error: `Agent '${input.id}' not found` });
       }
       const graphDef = agent.graphDefinition;
-      if (!graphDef || graphDef.type !== import_protocols18.AgentType.WORKFLOW) {
+      if (!graphDef || graphDef.type !== import_protocols19.AgentType.WORKFLOW) {
         return JSON.stringify({ error: `Agent '${input.id}' is not a workflow agent` });
       }
       const yaml2 = graphDef.workflowYaml;
@@ -30300,7 +30387,7 @@ registerToolLattice(
         return JSON.stringify({ error: `Agent '${input.id}' not found` });
       }
       const existingConfig = existing.graphDefinition || {};
-      const isWorkflow = existingConfig.type === import_protocols18.AgentType.WORKFLOW;
+      const isWorkflow = existingConfig.type === import_protocols19.AgentType.WORKFLOW;
       const isPlaceholder = isUndecidedLearningPlaceholder(existingConfig);
       if (!isWorkflow && !isPlaceholder) {
         console.log(`[update_workflow] ERROR: not a workflow agent: ${input.id}`);
@@ -30316,7 +30403,7 @@ registerToolLattice(
       const mergedConfig = {
         ...existingConfig,
         ...isPlaceholder ? {
-          type: import_protocols18.AgentType.WORKFLOW,
+          type: import_protocols19.AgentType.WORKFLOW,
           workflowYaml: input.yaml,
           metadata: {
             ...getStringMetadata(existingConfig),
@@ -30422,14 +30509,14 @@ registerToolLattice(
       const mergedConfig = { ...existingConfig, ...input.config };
       const isPlaceholder = isUndecidedLearningPlaceholder(existingConfigRecord);
       const materializedType = input.config.type;
-      const isMaterializingPlaceholder = isPlaceholder && (materializedType === import_protocols18.AgentType.REACT || materializedType === import_protocols18.AgentType.DEEP_AGENT);
+      const isMaterializingPlaceholder = isPlaceholder && (materializedType === import_protocols19.AgentType.REACT || materializedType === import_protocols19.AgentType.DEEP_AGENT);
       if (isMaterializingPlaceholder) {
         mergedConfig.metadata = {
           ...getStringMetadata(existingConfigRecord),
           ...input.config.metadata ?? {},
           learningPlaceholder: "false",
           architectureStatus: "materialized",
-          architectureForm: materializedType === import_protocols18.AgentType.DEEP_AGENT ? "orchestra" : "capability"
+          architectureForm: materializedType === import_protocols19.AgentType.DEEP_AGENT ? "orchestra" : "capability"
         };
       } else if (isPlaceholder && input.config.metadata !== void 0) {
         const metadata = {
@@ -30679,100 +30766,20 @@ var import_protocols20 = require("@axiom-lattice/protocols");
 // src/agent_lattice/agentArchitectPrompt.ts
 var AGENT_ARCHITECT_PROMPT = `You are the Agent Architect.
 
-CRITICAL FIRST ACTION: Before any response or other action, call the \`skill\`
-tool with skill_name: "agent-architecture" to load agent-architecture and follow it.
-Immediately after it loads, call the \`skill\` tool again with skill_name:
-"task-tracking" \u2014 persistent Task management is your core planning surface and
-you must have its operation reference before creating or updating any Task.
-Never announce skill loads. If a load fails, retry once, then stop and
-explicitly report that the required skill could not be loaded.`;
-
-// src/agent_lattice/agentReviewerConfig.ts
-var import_protocols19 = require("@axiom-lattice/protocols");
-
-// src/agent_lattice/agentReviewerPrompt.ts
-var AGENT_REVIEWER_PROMPT = `# Agent Reviewer
-
-You are an **Agent Reviewer** \u2014 a quality assurance specialist for AI agents. Your job is to review agent configurations for correctness and test them by invoking them with realistic messages.
-
-## Your Tools
-
-- **get_agent** \u2014 Fetch an agent's full configuration
-- **list_agents** \u2014 List all agents in the workspace
-- **list_tools** \u2014 List all available tools that can be assigned to agents
-- **invoke_agent** \u2014 Test an agent by sending a message and getting its response. This spawns a completely fresh agent context \u2014 clean, isolated, and realistic.
-
-## Your Workflow
-
-### When asked to review an agent:
-
-1. Call **get_agent** to fetch the agent's config
-2. Review the configuration for:
-   - **Completeness** \u2014 Are name, description, prompt present? Is the prompt clear and actionable?
-   - **Tool validity** \u2014 Do the referenced tools exist? Call **list_tools** to verify.
-   - **Middleware correctness** \u2014 Is every middleware entry complete (id, type, name, description, enabled, config)?
-   - **Sub-agent references** \u2014 Do referenced sub-agent IDs exist? Call **list_agents** to verify.
-   - **Type consistency** \u2014 Does the agent type match its configuration shape? (e.g., PROCESSING must have edges, DEEP_AGENT may have subAgents)
-3. Report your findings clearly. For each issue, state:
-   - Severity (ERROR / WARNING / INFO)
-   - What the problem is
-   - How to fix it
-
-### When asked to test an agent:
+Your working surface is persistent **TaskItems**. Every independently verifiable
+outcome MUST be a TaskItem created and kept truthful through \`manage_task\`; do NOT
+keep a separate todo list \u2014 the TaskItem is your only planning and evidence surface.
+Gather evidence through tasks, and treat the parent as done only when its
+acceptance evidence is sufficient. If the \`task\` tools are unavailable, stop and
+report that task management is unavailable instead of working around it.
 
-1. Call **get_agent** to understand the agent's purpose and expected behavior
-2. Craft a realistic test message that exercises the agent's core responsibility \u2014 what would a real user say?
-3. Call **invoke_agent(id, message)** to send the test message
-4. Analyze the response:
-   - **If result.__interrupt__ is present** (an array of interrupt objects): The agent hit a human-in-the-loop interrupt (e.g., ask_user_to_clarify or interrupt() in a workflow). This is NOT an error \u2014 it means the agent paused execution waiting for user feedback. Each interrupt has a value (the question/request) and optionally an id. Report this as: "The agent successfully paused and is waiting for user input: <describe the interrupt value>." The messages array may contain the agent's output up to the point of interruption.
-   - **Otherwise, result.messages contains the agent's output**: The agent completed without interruption. Check:
-     - Did the agent understand the request?
-     - Was the response relevant and accurate?
-     - Did the agent use the right tools?
-     - Were there any errors or unexpected behaviors?
-   - **If result.error is present**: The invocation itself failed (agent not found, compilation error, etc.). Report the error clearly.
-5. Report your findings with the agent's actual response
-
-### When results are wrong:
-
-If the agent's response is incorrect or unexpected:
-1. Point out specifically what went wrong
-2. Suggest what might need to change in the prompt or middleware config
-3. Offer to re-test after fixes are applied
-
-## Important Rules
-
-- **Always use invoke_agent for testing.** This is the ONLY way to test \u2014 it spawns a fresh agent context isolated from all other conversations.
-- **Be specific in your feedback.** Say "the agent failed to call the sql tool because the middleware config is missing databaseKeys" not "the agent didn't work."
-- **One agent at a time.** Focus on one agent per review or test request. Don't try to review multiple agents simultaneously.
-- **Be concise but thorough.** Cover all the checks, but present findings clearly without fluff.
-`;
-
-// src/agent_lattice/agentReviewerConfig.ts
-var AGENT_REVIEWER_KEY = "agent-reviewer";
-var agentReviewerConfig = {
-  key: AGENT_REVIEWER_KEY,
-  name: "Agent Reviewer",
-  description: "Review and test AI agents. Use this agent to check agent configurations for correctness and to test agents by invoking them with realistic messages.",
-  type: import_protocols19.AgentType.REACT,
-  prompt: AGENT_REVIEWER_PROMPT,
-  tools: [
-    "invoke_agent",
-    "get_agent",
-    "list_agents",
-    "list_tools"
-  ],
-  middleware: [
-    {
-      id: "widget",
-      type: "widget",
-      name: "Widget",
-      description: "Render interactive HTML widgets and SVG diagrams",
-      enabled: true,
-      config: {}
-    }
-  ]
-};
+CRITICAL FIRST ACTION: Before any response or other action, call the \`skill\`
+tool with skill_name: "agent-architecture" to load the shared policy and router,
+and follow it. Load every OTHER skill only when the current step actually
+requires its procedure \u2014 one at a time, never preloaded. Load "task-tracking"
+right before your first \`manage_task\` call. Never announce skill loads. If a
+required load fails, retry once, then stop and explicitly report that the
+required skill could not be loaded.`;
 
 // src/agent_lattice/agentArchitectConfig.ts
 var AGENT_ARCHITECT_KEY = "agent-architect";
@@ -30798,7 +30805,6 @@ var agentArchitectConfig = {
     "manage_binding"
   ],
   subAgents: ["document-parser-benchmark"],
-  internalSubAgents: [agentReviewerConfig],
   middleware: [
     {
       id: "filesystem",
@@ -30883,9 +30889,96 @@ var agentArchitectConfig = {
   ]
 };
 
-// src/agent_lattice/roomCoordinatorConfig.ts
+// src/agent_lattice/agentReviewerConfig.ts
 var import_protocols21 = require("@axiom-lattice/protocols");
 
+// src/agent_lattice/agentReviewerPrompt.ts
+var AGENT_REVIEWER_PROMPT = `# Agent Reviewer
+
+You are an **Agent Reviewer** \u2014 a quality assurance specialist for AI agents. Your job is to review agent configurations for correctness and test them by invoking them with realistic messages.
+
+## Your Tools
+
+- **get_agent** \u2014 Fetch an agent's full configuration
+- **list_agents** \u2014 List all agents in the workspace
+- **list_tools** \u2014 List all available tools that can be assigned to agents
+- **invoke_agent** \u2014 Test an agent by sending a message and getting its response. This spawns a completely fresh agent context \u2014 clean, isolated, and realistic.
+
+## Your Workflow
+
+### When asked to review an agent:
+
+1. Call **get_agent** to fetch the agent's config
+2. Review the configuration for:
+   - **Completeness** \u2014 Are name, description, prompt present? Is the prompt clear and actionable?
+   - **Tool validity** \u2014 Do the referenced tools exist? Call **list_tools** to verify.
+   - **Middleware correctness** \u2014 Is every middleware entry complete (id, type, name, description, enabled, config)?
+   - **Sub-agent references** \u2014 Do referenced sub-agent IDs exist? Call **list_agents** to verify.
+   - **Type consistency** \u2014 Does the agent type match its configuration shape? (e.g., PROCESSING must have edges, DEEP_AGENT may have subAgents)
+3. Report your findings clearly. For each issue, state:
+   - Severity (ERROR / WARNING / INFO)
+   - What the problem is
+   - How to fix it
+
+### When asked to test an agent:
+
+1. Call **get_agent** to understand the agent's purpose and expected behavior
+2. Craft a realistic test message that exercises the agent's core responsibility \u2014 what would a real user say?
+3. Call **invoke_agent(id, message)** to send the test message
+4. Analyze the response:
+   - **If result.__interrupt__ is present** (an array of interrupt objects): The agent hit a human-in-the-loop interrupt (e.g., ask_user_to_clarify or interrupt() in a workflow). This is NOT an error \u2014 it means the agent paused execution waiting for user feedback. Each interrupt has a value (the question/request) and optionally an id. Report this as: "The agent successfully paused and is waiting for user input: <describe the interrupt value>." The messages array may contain the agent's output up to the point of interruption.
+   - **Otherwise, result.messages contains the agent's output**: The agent completed without interruption. Check:
+     - Did the agent understand the request?
+     - Was the response relevant and accurate?
+     - Did the agent use the right tools?
+     - Were there any errors or unexpected behaviors?
+   - **If result.error is present**: The invocation itself failed (agent not found, compilation error, etc.). Report the error clearly.
+5. Report your findings with the agent's actual response
+
+### When results are wrong:
+
+If the agent's response is incorrect or unexpected:
+1. Point out specifically what went wrong
+2. Suggest what might need to change in the prompt or middleware config
+3. Offer to re-test after fixes are applied
+
+## Important Rules
+
+- **Always use invoke_agent for testing.** This is the ONLY way to test \u2014 it spawns a fresh agent context isolated from all other conversations.
+- **Be specific in your feedback.** Say "the agent failed to call the sql tool because the middleware config is missing databaseKeys" not "the agent didn't work."
+- **One agent at a time.** Focus on one agent per review or test request. Don't try to review multiple agents simultaneously.
+- **Be concise but thorough.** Cover all the checks, but present findings clearly without fluff.
+`;
+
+// src/agent_lattice/agentReviewerConfig.ts
+var AGENT_REVIEWER_KEY = "agent-reviewer";
+var agentReviewerConfig = {
+  key: AGENT_REVIEWER_KEY,
+  name: "Agent Reviewer",
+  description: "Review and test AI agents. Use this agent to check agent configurations for correctness and to test agents by invoking them with realistic messages.",
+  type: import_protocols21.AgentType.REACT,
+  prompt: AGENT_REVIEWER_PROMPT,
+  tools: [
+    "invoke_agent",
+    "get_agent",
+    "list_agents",
+    "list_tools"
+  ],
+  middleware: [
+    {
+      id: "widget",
+      type: "widget",
+      name: "Widget",
+      description: "Render interactive HTML widgets and SVG diagrams",
+      enabled: true,
+      config: {}
+    }
+  ]
+};
+
+// src/agent_lattice/roomCoordinatorConfig.ts
+var import_protocols22 = require("@axiom-lattice/protocols");
+
 // src/agent_lattice/roomCoordinatorPrompt.ts
 var ROOM_COORDINATOR_PROMPT = `You are the Room Coordinator. CRITICAL FIRST ACTION: Before any response or other action, call the \`skill\` tool with skill_name: "room-coordination" to load room-coordination and follow it. Never announce the skill load. If it fails, retry once, then stop and explicitly report that the required room-coordination skill could not be loaded.`;
 
@@ -30895,7 +30988,7 @@ var roomCoordinatorConfig = {
   key: ROOM_COORDINATOR_KEY,
   name: "Room Coordinator",
   description: "Manages project room conversations: replies when no bot is mentioned, coordinates room members, and organizes project work.",
-  type: import_protocols21.AgentType.DEEP_AGENT,
+  type: import_protocols22.AgentType.DEEP_AGENT,
   prompt: ROOM_COORDINATOR_PROMPT,
   tools: [],
   middleware: [
@@ -31530,17 +31623,6 @@ var getAgentClient = (tenantId2, key5, options) => agentLatticeManager.initializ
 var getAgentClientAsync = async (tenantId2, key5, options) => agentLatticeManager.initializeClientAsync(tenantId2, key5, options);
 var createAgentClientFromAgentLattice = async (agentLattice, options) => await agentLatticeManager.createAgentClientFromConfig(agentLattice, options);
 
-// src/agent_lattice/taskCapability.ts
-function agentHasManagedTaskCapability(config) {
-  const middleware = config?.middleware;
-  const taskMiddleware = Array.isArray(middleware) ? middleware.find((entry) => entry?.type === "task" && entry?.enabled === true) : void 0;
-  if (!taskMiddleware) {
-    return false;
-  }
-  const allowedTools = taskMiddleware.allowedTools;
-  return allowedTools === void 0 || Array.isArray(allowedTools) && (allowedTools.length === 0 || allowedTools.includes("manage_task"));
-}
-
 // src/index.ts
 init_memory_lattice();
 
@@ -31639,7 +31721,7 @@ var getVectorStoreClient = (key5) => vectorStoreLatticeManager.getVectorStoreCli
 
 // src/logger_lattice/LoggerLatticeManager.ts
 init_BaseLatticeManager();
-var import_protocols22 = require("@axiom-lattice/protocols");
+var import_protocols23 = require("@axiom-lattice/protocols");
 
 // src/logger_lattice/PinoLoggerClient.ts
 var import_pino = __toESM(require("pino"));
@@ -31861,11 +31943,11 @@ var LoggerLatticeManager = class _LoggerLatticeManager extends BaseLatticeManage
     if (client) {
       loggerClient = client;
     } else {
-      if (config.type === import_protocols22.LoggerType.PINO) {
+      if (config.type === import_protocols23.LoggerType.PINO) {
         loggerClient = new PinoLoggerClient(config);
-      } else if (config.type === import_protocols22.LoggerType.CONSOLE) {
+      } else if (config.type === import_protocols23.LoggerType.CONSOLE) {
         loggerClient = new ConsoleLoggerClient(config);
-      } else if (config.type === import_protocols22.LoggerType.CUSTOM) {
+      } else if (config.type === import_protocols23.LoggerType.CUSTOM) {
         throw new Error(
           `Custom logger client must be provided. Please pass the client to registerLattice.`
         );
@@ -32945,15 +33027,15 @@ var McpLatticeManager = class _McpLatticeManager extends BaseLatticeManager {
     const metaByName = new Map(metaList.map((m) => [m.name, m.meta]));
     this.unregisterServerTools(tenantId2, serverKey);
     const keys = [];
-    for (const tool71 of tools) {
-      if (rt.selectedTools && !rt.selectedTools.includes(tool71.name)) continue;
-      const meta = metaByName.get(tool71.name);
+    for (const tool68 of tools) {
+      if (rt.selectedTools && !rt.selectedTools.includes(tool68.name)) continue;
+      const meta = metaByName.get(tool68.name);
       const rawVisibility = meta?.ui?.visibility;
       const visibility = Array.isArray(rawVisibility) ? rawVisibility : typeof rawVisibility === "string" ? [rawVisibility] : void 0;
       if (visibility && !visibility.includes("model")) continue;
       const ref = extractAppsRef(meta, serverKey);
-      const registered = ref ? wrapMcpToolWithUi(tool71, ref) : tool71;
-      const toolKey = _McpLatticeManager.buildToolKey(serverKey, tool71.name);
+      const registered = ref ? wrapMcpToolWithUi(tool68, ref) : tool68;
+      const toolKey = _McpLatticeManager.buildToolKey(serverKey, tool68.name);
       try {
         toolLatticeManager.registerExistingToolWithTenant(tenantId2, toolKey, registered);
         keys.push(toolKey);
@@ -36127,7 +36209,7 @@ var LatticeEvalSuite = class {
 };
 
 // src/eval_lattice/LatticeEvalProject.ts
-var import_protocols23 = require("@axiom-lattice/protocols");
+var import_protocols24 = require("@axiom-lattice/protocols");
 var import_messages8 = require("@langchain/core/messages");
 var import_uuid11 = require("uuid");
 var DEFAULT_CALIBRATION_PROBES = [
@@ -36183,7 +36265,7 @@ var LatticeEvalProject = class {
       key: this.judgeAgentKey,
       name: `Judge agent for ${this.project.projectName}`,
       description: "Judge agent for evaluating Lattice test cases",
-      type: import_protocols23.AgentType.REACT,
+      type: import_protocols24.AgentType.REACT,
       prompt: "",
       modelKey: judgeModelKey
     };
@@ -36409,7 +36491,7 @@ function getMenuRegistry() {
 }
 
 // src/services/ProjectTaskReassignmentAuthorization.ts
-var import_protocols24 = require("@axiom-lattice/protocols");
+var import_protocols25 = require("@axiom-lattice/protocols");
 var issued = /* @__PURE__ */ new WeakMap();
 function createProjectTaskReassignmentAuthorizer(policy, threadValidator) {
   return {
@@ -36442,7 +36524,7 @@ function inspectProjectTaskReassignmentAuthorization(authorization) {
   return snapshot ? { ...snapshot } : void 0;
 }
 function snapshotInput(input) {
-  const row = (0, import_protocols24.snapshotExactRecord)(input, [
+  const row = (0, import_protocols25.snapshotExactRecord)(input, [
     "tenantId",
     "workspaceId",
     "projectId",
@@ -36485,7 +36567,7 @@ function snapshotInput(input) {
 }
 
 // src/services/TaskLifecycleNotifier.ts
-var import_protocols25 = require("@axiom-lattice/protocols");
+var import_protocols26 = require("@axiom-lattice/protocols");
 var TaskLifecycleNotifier = class {
   constructor() {
     this.listeners = /* @__PURE__ */ new Set();
@@ -36529,7 +36611,7 @@ var TaskLifecycleNotifier = class {
 };
 var taskLifecycleNotifier = new TaskLifecycleNotifier();
 function snapshotNotification(value) {
-  const row = (0, import_protocols25.snapshotExactRecord)(value, [
+  const row = (0, import_protocols26.snapshotExactRecord)(value, [
     "tenantId",
     "workspaceId",
     "projectId",
@@ -36561,7 +36643,7 @@ function nonempty(value) {
 }
 
 // src/services/ProjectTaskAdmissionNotifier.ts
-var import_protocols26 = require("@axiom-lattice/protocols");
+var import_protocols27 = require("@axiom-lattice/protocols");
 var ProjectTaskAdmissionNotifier = class {
   /**
    * Creates a bounded Project task admission notifier.
@@ -36634,7 +36716,7 @@ var ProjectTaskAdmissionNotifier = class {
 };
 var projectTaskAdmissionNotifier = new ProjectTaskAdmissionNotifier();
 function snapshotNotification2(value) {
-  const row = (0, import_protocols26.snapshotExactRecord)(value, [
+  const row = (0, import_protocols27.snapshotExactRecord)(value, [
     "tenantId",
     "workspaceId",
     "projectId",
@@ -36664,9 +36746,9 @@ function canonicalTimestamp(value) {
 }
 
 // src/services/ProjectMutationMutex.ts
-var import_protocols27 = require("@axiom-lattice/protocols");
+var import_protocols28 = require("@axiom-lattice/protocols");
 function projectKey(scope) {
-  const row = (0, import_protocols27.snapshotExactRecord)(scope, ["tenantId", "projectId"]);
+  const row = (0, import_protocols28.snapshotExactRecord)(scope, ["tenantId", "projectId"]);
   if (!row || typeof row.tenantId !== "string" || !row.tenantId || row.tenantId.includes("\0") || typeof row.projectId !== "string" || !row.projectId || row.projectId.includes("\0")) {
     throw new Error("Invalid Project mutation scope");
   }
@@ -36741,7 +36823,7 @@ function createTrustedAgentMessageDispatcher(resolve4) {
 
 // src/services/RoomAgentMessageService.ts
 var import_crypto8 = require("crypto");
-var import_protocols28 = require("@axiom-lattice/protocols");
+var import_protocols29 = require("@axiom-lattice/protocols");
 var INPUT_KEYS = [
   "tenantId",
   "workspaceId",
@@ -36861,7 +36943,7 @@ var RoomAgentMessageService = class {
 function exactValues(value, required, optional = []) {
   try {
     if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-    return (0, import_protocols28.snapshotExactRecord)(value, required, optional);
+    return (0, import_protocols29.snapshotExactRecord)(value, required, optional);
   } catch {
     return void 0;
   }
@@ -36913,7 +36995,7 @@ function sourceOriginMatches(author, source) {
   return false;
 }
 function snapshotMentions(value) {
-  const rows = (0, import_protocols28.snapshotExactArray)(value);
+  const rows = (0, import_protocols29.snapshotExactArray)(value);
   if (!rows) return void 0;
   const mentions = [];
   for (const row of rows) {
@@ -36941,7 +37023,7 @@ function snapshotCanonical(value, expected) {
   const author = exactValues(values?.author, ["type", "membershipId", "assistantId"]);
   const content = exactValues(values?.content, ["type", "text"]);
   const createdAt = date(values?.createdAt);
-  if (!values || !createdAt || typeof values.id !== "string" || values.id.length === 0 || (0, import_protocols28.snapshotExactArray)(values.mentions)?.length !== 0 || author?.type !== "bot" || expected.author.type !== "bot" || author.membershipId !== expected.author.membershipId || author.assistantId !== expected.author.assistantId || content?.type !== "text" || content.text !== expected.content.text || values.tenantId !== expected.tenantId || values.workspaceId !== expected.workspaceId || values.projectId !== expected.projectId || values.roomId !== expected.roomId || values.replyToMessageId !== expected.replyToMessageId || values.source !== "agent" || values.sourceId !== expected.sourceId || values.idempotencyKey !== expected.idempotencyKey) return void 0;
+  if (!values || !createdAt || typeof values.id !== "string" || values.id.length === 0 || (0, import_protocols29.snapshotExactArray)(values.mentions)?.length !== 0 || author?.type !== "bot" || expected.author.type !== "bot" || author.membershipId !== expected.author.membershipId || author.assistantId !== expected.author.assistantId || content?.type !== "text" || content.text !== expected.content.text || values.tenantId !== expected.tenantId || values.workspaceId !== expected.workspaceId || values.projectId !== expected.projectId || values.roomId !== expected.roomId || values.replyToMessageId !== expected.replyToMessageId || values.source !== "agent" || values.sourceId !== expected.sourceId || values.idempotencyKey !== expected.idempotencyKey) return void 0;
   return {
     id: values.id,
     tenantId: expected.tenantId,
@@ -36960,7 +37042,7 @@ function snapshotCanonical(value, expected) {
 }
 
 // src/services/ProjectTaskOwnerPolicy.ts
-var import_protocols29 = require("@axiom-lattice/protocols");
+var import_protocols30 = require("@axiom-lattice/protocols");
 var MEMBERSHIP_REQUIRED_KEYS = [
   "id",
   "tenantId",
@@ -37069,7 +37151,7 @@ function sameRosterScope(membership, scope) {
   return membership.tenantId === scope.tenantId && membership.workspaceId === scope.workspaceId && membership.projectId === scope.projectId && membership.roomId === scope.roomId;
 }
 function snapshotScope(value, keys) {
-  const values = (0, import_protocols29.snapshotExactRecord)(value, keys);
+  const values = (0, import_protocols30.snapshotExactRecord)(value, keys);
   if (!values || keys.some((key5) => !isNonemptyString(values[key5]))) return void 0;
   return values;
 }
@@ -37081,7 +37163,7 @@ function projectScope(scope, keys) {
 function snapshotMembership2(value) {
   try {
     if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-    const values = (0, import_protocols29.snapshotExactRecord)(value, MEMBERSHIP_REQUIRED_KEYS, ["responsibility"]);
+    const values = (0, import_protocols30.snapshotExactRecord)(value, MEMBERSHIP_REQUIRED_KEYS, ["responsibility"]);
     if (!values) return void 0;
     const joinedAt = snapshotDate(values.joinedAt);
     const updatedAt = snapshotDate(values.updatedAt);
@@ -37120,7 +37202,7 @@ function snapshotDate(value) {
 
 // src/services/TaskLifecycleService.ts
 var import_node_crypto8 = require("crypto");
-var import_protocols30 = require("@axiom-lattice/protocols");
+var import_protocols31 = require("@axiom-lattice/protocols");
 
 // src/middlewares/taskBelief.ts
 var import_node_crypto7 = require("crypto");
@@ -37191,7 +37273,7 @@ async function applyBeliefImpacts(taskStore, owner, impacts) {
   if (impacts.length === 0) return { description: owner.description ?? "" };
   let current = owner;
   for (let attempt = 0; attempt < BELIEF_OWNER_WRITE_ATTEMPTS; attempt += 1) {
-    const parsed = (0, import_protocols30.parseTaskBeliefState)(current.description ?? "");
+    const parsed = (0, import_protocols31.parseTaskBeliefState)(current.description ?? "");
     const existingTable = parsed.success;
     if (!existingTable && parsed.code !== "MISSING_BELIEF_STATE") {
       return { description: current.description ?? "", task: current };
@@ -37208,7 +37290,7 @@ async function applyBeliefImpacts(taskStore, owner, impacts) {
       changed = true;
     }
     if (!changed) return { description: current.description ?? "", task: current };
-    const description = (0, import_protocols30.replaceTaskBeliefState)(current.description ?? "", { entries });
+    const description = (0, import_protocols31.replaceTaskBeliefState)(current.description ?? "", { entries });
     try {
       const updated = await taskStore.updateIfStatusAndUpdatedAt(
         current.tenantId,
@@ -37233,8 +37315,8 @@ async function applyBeliefImpacts(taskStore, owner, impacts) {
   return { description: current.description ?? "", task: current };
 }
 function parseExternalDependency(value) {
-  const row = (0, import_protocols30.snapshotExactRecord)(value, ["type", "summary", "requestedAt", "dependencyTaskIds"]);
-  const ids = (0, import_protocols30.snapshotExactArray)(row?.dependencyTaskIds);
+  const row = (0, import_protocols31.snapshotExactRecord)(value, ["type", "summary", "requestedAt", "dependencyTaskIds"]);
+  const ids = (0, import_protocols31.snapshotExactArray)(row?.dependencyTaskIds);
   if (!row || row.type !== "external_dependency" || typeof row.summary !== "string" || !row.summary.trim() || typeof row.requestedAt !== "string" || !Number.isFinite(Date.parse(row.requestedAt)) || !ids || ids.length === 0 || ids.some((id) => typeof id !== "string" || !id.trim())) return void 0;
   const trimmed = ids.map((id) => id.trim());
   if (new Set(trimmed).size !== trimmed.length) return void 0;
@@ -37321,7 +37403,7 @@ function beliefStateOf(value) {
 function sameBeliefOwner(left, right) {
   const leftIdentity = { ...left, beliefState: void 0 };
   const rightIdentity = { ...right, beliefState: void 0 };
-  return canonicalJson(leftIdentity) === canonicalJson(rightIdentity) && (0, import_protocols30.taskBeliefStatesEqual)(left.beliefState, right.beliefState);
+  return canonicalJson(leftIdentity) === canonicalJson(rightIdentity) && (0, import_protocols31.taskBeliefStatesEqual)(left.beliefState, right.beliefState);
 }
 function sameBeliefOwnerIdentity(left, right) {
   return canonicalJson({ ...left, beliefState: void 0 }) === canonicalJson({ ...right, beliefState: void 0 });
@@ -37469,7 +37551,7 @@ function changedBeliefKeys(left, right) {
   return [...keys].filter((key5) => {
     const oldEntry = leftByKey.get(key5);
     const newEntry = rightByKey.get(key5);
-    return !oldEntry || !newEntry || !(0, import_protocols30.taskBeliefStatesEqual)(
+    return !oldEntry || !newEntry || !(0, import_protocols31.taskBeliefStatesEqual)(
       { entries: [oldEntry] },
       { entries: [newEntry] }
     );
@@ -38490,10 +38572,10 @@ var TaskLifecycleService = class {
     const description = preserveTargetContract(existing.description ?? "", input.description);
     const pending = existing.context?.belief_reconciliation_audit;
     const pendingAudit = pending && typeof pending === "object" ? pending : void 0;
-    const oldBelief = (0, import_protocols30.parseTaskBeliefState)(existing.description ?? "");
-    const newBelief = (0, import_protocols30.parseTaskBeliefState)(description);
+    const oldBelief = (0, import_protocols31.parseTaskBeliefState)(existing.description ?? "");
+    const newBelief = (0, import_protocols31.parseTaskBeliefState)(description);
     if (!newBelief.success) return failure2("INVALID_BELIEF_TABLE", newBelief.message);
-    if (!pendingAudit && description === (existing.description ?? "") && oldBelief.success && (0, import_protocols30.taskBeliefStatesEqual)(oldBelief.state, newBelief.state)) {
+    if (!pendingAudit && description === (existing.description ?? "") && oldBelief.success && (0, import_protocols31.taskBeliefStatesEqual)(oldBelief.state, newBelief.state)) {
       return { success: true, task: existing, mutated: false };
     }
     const canonicalNew = newBelief.state.entries;
@@ -38624,7 +38706,7 @@ var TaskLifecycleService = class {
   }
   beliefOwnerSnapshot(task, parent) {
     const owner = parent?.ownerType === "agent" ? parent : task;
-    const parsed = (0, import_protocols30.parseTaskBeliefState)(owner.description ?? "");
+    const parsed = (0, import_protocols31.parseTaskBeliefState)(owner.description ?? "");
     const beliefState = parsed.success ? parsed.state : { entries: [] };
     if (parent?.ownerType === "agent") {
       return {
@@ -39396,7 +39478,7 @@ function createTaskLifecycleService(deps) {
 // src/services/TaskExecutionService.ts
 var import_node_crypto9 = require("crypto");
 var import_node_util3 = require("util");
-var import_protocols31 = require("@axiom-lattice/protocols");
+var import_protocols32 = require("@axiom-lattice/protocols");
 
 // src/services/taskErrorMessage.ts
 var MAX_EXECUTION_ERROR_MESSAGE_LENGTH = 1024;
@@ -39538,6 +39620,33 @@ function createTaskRunBridge(deps) {
           transitioned: true
         };
       }
+      if (task.status === "interrupted" || task.status === "failed") {
+        if (task.ownerType !== "agent") {
+          return {
+            success: false,
+            code: "AGENT_TASK_REQUIRED",
+            error: "Lifecycle transitions only support agent tasks."
+          };
+        }
+        const result = task.status === "interrupted" ? await deps.lifecycle.resumeInterruption({ tenantId: tenantId2, taskId: task.id, actor, threadId }) : await deps.lifecycle.retryTask({ tenantId: tenantId2, taskId: task.id, actor, threadId });
+        if (!result.success) {
+          return {
+            success: false,
+            code: result.code,
+            error: result.error,
+            ...result.hint !== void 0 ? { hint: result.hint } : {},
+            ...result.retryable !== void 0 ? { retryable: result.retryable } : {},
+            ...result.warnings !== void 0 ? { warnings: result.warnings } : {}
+          };
+        }
+        return {
+          success: true,
+          task: result.task,
+          warnings: result.warnings ?? [],
+          mutated: true,
+          transitioned: true
+        };
+      }
       return { success: true, task, warnings, mutated: false, transitioned: false };
     },
     async settleRun(input) {
@@ -39691,48 +39800,18 @@ async function prepareTaskDispatch(deps, input) {
       }
     };
   }
-  if (task.status !== "pending") {
+  if (task.status !== "pending" && task.status !== "interrupted" && task.status !== "failed") {
     return {
       kind: "failure",
       failure: {
         success: false,
         code: "TASK_NOT_DISPATCHABLE",
-        error: "Only a `pending` task can be dispatched.",
-        hint: `This task is '${task.status}'. Only a \`pending\` task dispatches: resolve it (resume an interruption / cancel a stuck run) or create a new task.`,
+        error: "Only a `pending`, `interrupted`, or `failed` task can be dispatched.",
+        hint: `This task is '${task.status}'. A \`pending\` task starts, an \`interrupted\` task resumes, and a \`failed\` task retries. A task already \`in_progress\` is held by a live run; terminal tasks cannot be dispatched.`,
         taskId: task.id
       }
     };
   }
-  if (deps.resolveTaskCapability) {
-    let targetCapable;
-    try {
-      targetCapable = await deps.resolveTaskCapability(input.tenantId, input.agentId);
-    } catch (error) {
-      return {
-        kind: "failure",
-        failure: {
-          success: false,
-          code: "AGENT_RESOLUTION_FAILED",
-          error: errorMessage(error),
-          taskId: task.id,
-          agentId: input.agentId
-        }
-      };
-    }
-    if (!targetCapable) {
-      return {
-        kind: "failure",
-        failure: {
-          success: false,
-          code: "TASK_DELEGATE_TARGET_NOT_CAPABLE",
-          taskId: task.id,
-          agentId: input.agentId,
-          error: `Agent '${input.agentId}' cannot manage tasks, so a dispatched TaskItem could never be completed.`,
-          hint: "Delegate to an agent with the `task` middleware (exposes `manage_task`), or do the work inline and update the task with `manage_task set_status`."
-        }
-      };
-    }
-  }
   const managedAuthority = executionAuthorityRegistry.resolve(task);
   if (managedAuthority) {
     if (managedAuthority.onManagedStart) {
@@ -40144,6 +40223,7 @@ function toJsonSafeValue(value) {
 }
 
 // src/services/TaskExecutionService.ts
+var import_langgraph14 = require("@langchain/langgraph");
 function persistedExecutionObservation(item, attempted) {
   const detail = item.detail;
   const persistedObservation = toJsonSafeValue(detail?.observation);
@@ -40190,9 +40270,10 @@ function createTaskExecutionService(deps) {
   const run = async (plan) => {
     const { tenantId: tenantId2, agentId, actor, parent, completedDependencies } = plan;
     let task = plan.task;
+    const persistedThreadId = (task.status === "interrupted" || task.status === "failed") && typeof task.context?.thread_id === "string" && task.context.thread_id.trim() !== "" ? task.context.thread_id : void 0;
     let threadId;
     try {
-      threadId = (deps.createThreadId ?? import_node_crypto9.randomUUID)();
+      threadId = persistedThreadId ?? (deps.createThreadId ?? import_node_crypto9.randomUUID)();
     } catch (error) {
       return {
         success: false,
@@ -40203,7 +40284,7 @@ function createTaskExecutionService(deps) {
       };
     }
     const eventKey = `execution-result:${threadId}`;
-    if (!(0, import_protocols31.isExecutionResultEventKey)(eventKey)) {
+    if (!(0, import_protocols32.isExecutionResultEventKey)(eventKey)) {
       return {
         success: false,
         code: "INVALID_EXECUTION_RESULT_ID",
@@ -40231,12 +40312,12 @@ function createTaskExecutionService(deps) {
       task = transfer.task;
     }
     const warnings = [];
-    if (task.status === "pending") {
+    if (task.status === "pending" || task.status === "interrupted" || task.status === "failed") {
       const begun = await bridge.beginRun({
         tenantId: tenantId2,
         task,
         actor,
-        threadId: plan.callerThreadId
+        threadId
       });
       if (!begun.success) return { ...begun, taskId: task.id };
       if (!begun.mutated || !begun.transitioned) {
@@ -40265,6 +40346,19 @@ function createTaskExecutionService(deps) {
     try {
       observation = toJsonSafeValue(await deps.invokeAgent(invocation));
     } catch (error) {
+      if (error instanceof import_langgraph14.GraphInterrupt) {
+        try {
+          await bridge.settleRun({
+            tenantId: tenantId2,
+            task,
+            actor,
+            threadId,
+            outcome: { kind: "interrupted", summary: "Awaiting user input" }
+          });
+        } catch {
+        }
+        throw error;
+      }
       const normalizationError = error instanceof JsonSafeValueError;
       const message = normalizationError ? `${error.code}: ${error.message}` : errorMessage(error);
       const failureCode = normalizationError ? "EXECUTION_RESULT_NORMALIZATION_FAILED" : "AGENT_INVOCATION_FAILED";
@@ -40395,6 +40489,76 @@ function createTaskExecutionService(deps) {
   };
 }
 
+// src/services/TaskRunRegistry.ts
+var TaskRunRegistry = class {
+  constructor() {
+    this.live = /* @__PURE__ */ new Set();
+  }
+  /** Marks a task as currently held by a live run. */
+  register(taskId) {
+    this.live.add(taskId);
+  }
+  /** Removes a task once its run has ended. */
+  unregister(taskId) {
+    this.live.delete(taskId);
+  }
+  /** Reports whether a task is currently held by a live run. */
+  isLive(taskId) {
+    return this.live.has(taskId);
+  }
+  /** Returns a snapshot of the live task ids (diagnostics/tests). */
+  snapshot() {
+    return [...this.live];
+  }
+  /** Clears all live entries (tests / process teardown). */
+  clear() {
+    this.live.clear();
+  }
+};
+var taskRunRegistry = new TaskRunRegistry();
+async function reconcileStaleTaskRuns(input) {
+  const registry4 = input.registry ?? taskRunRegistry;
+  const converged = [];
+  for (const task of input.tasks) {
+    if (task.status !== "in_progress" || registry4.isLive(task.id)) continue;
+    const result = await input.lifecycle.interruptTask({
+      tenantId: task.tenantId,
+      taskId: task.id,
+      actor: input.actor,
+      type: "missing_input",
+      summary: "Run is no longer executing this task (no_executor)"
+    });
+    if (result.success) converged.push(task.id);
+  }
+  return { converged };
+}
+async function reconcileTenantTaskRuns(input) {
+  const tasks = await input.taskStore.list({ tenantId: input.tenantId, status: "in_progress" });
+  const candidates = input.include ? tasks.filter(input.include) : tasks;
+  return reconcileStaleTaskRuns({
+    tasks: candidates,
+    actor: input.actor,
+    lifecycle: input.lifecycle,
+    ...input.registry ? { registry: input.registry } : {}
+  });
+}
+async function reconcileAllTenantTaskRuns(input) {
+  const tenants = await input.tenantStore.listTenants();
+  const converged = [];
+  for (const tenant of tenants) {
+    const result = await reconcileTenantTaskRuns({
+      tenantId: tenant.id,
+      actor: input.actor,
+      taskStore: input.taskStore,
+      lifecycle: input.lifecycle,
+      ...input.registry ? { registry: input.registry } : {},
+      ...input.include ? { include: input.include } : {}
+    });
+    converged.push(...result.converged);
+  }
+  return { converged };
+}
+
 // src/index.ts
 var Protocols = __toESM(require("@axiom-lattice/protocols"));
 
@@ -40660,10 +40824,10 @@ var createLoadSkillContentTool = (pluginSkills, pluginSkillOwnersOrStaticSelecti
             lockIdentity
           );
           let result2 = pluginSkill.definition.content;
-          const resources3 = Object.entries(pluginSkill.definition.resources ?? {});
-          if (resources3.length > 0) {
+          const resources2 = Object.entries(pluginSkill.definition.resources ?? {});
+          if (resources2.length > 0) {
             result2 += "\n\n---\n\n**Resources** (synced to the sandbox; use `read_file` to access):\n";
-            for (const [resourcePath, resource] of resources3) {
+            for (const [resourcePath, resource] of resources2) {
               result2 += `- ${resourcePath} (mime type: ${resource.mimeType ?? "not specified"})
 `;
             }
@@ -40690,10 +40854,10 @@ var createLoadSkillContentTool = (pluginSkills, pluginSkillOwnersOrStaticSelecti
             `/root/.agents/skills/${input.skill_name}/resources`,
             { recursive: false }
           );
-          const resources3 = resourcesResult.files.map((f) => f.path.split("/").pop()).filter(Boolean);
-          if (resources3.length > 0) {
+          const resources2 = resourcesResult.files.map((f) => f.path.split("/").pop()).filter(Boolean);
+          if (resources2.length > 0) {
             result += "\n\n---\n\n**Resources** (use `read_file` tool to access):\n";
-            resources3.forEach((r) => {
+            resources2.forEach((r) => {
               result += `- ${r}
 `;
             });
@@ -41015,1367 +41179,12 @@ var skillPlugin = {
   })
 };
 
-// src/middlewares/semanticMetricsMiddleware.ts
-var import_langchain70 = require("langchain");
-
-// src/tool_lattice/semantic_metrics/metrics_datasource_tool.ts
-var import_zod55 = __toESM(require("zod"));
-var import_langchain67 = require("langchain");
-
-// src/tool_lattice/semantic_metrics/types.ts
-function readToolRunConfig(exeConfig) {
-  return exeConfig?.configurable?.runConfig;
-}
-function resolveDatasourceId(input, exeConfig) {
-  const id = input.datasourceId ?? readToolRunConfig(exeConfig)?.metricsDataSource?.datasourceId;
-  if (id === void 0 || id === null || id === "") {
-    throw new Error("datasourceId is required (provide it or set runConfig.metricsDataSource.datasourceId)");
-  }
-  return Number(id);
-}
-function assertDatasourceSelected(scope, datasourceId) {
-  if (scope.unrestricted) return;
-  if (!scope.ids.includes(datasourceId)) {
-    throw new Error(
-      `DATASOURCE_NOT_SELECTED: datasource ${datasourceId} is not in the effective scope [${scope.ids.join(", ")}]`
-    );
-  }
-}
-function effectiveDatasourceScope(connectionScope) {
-  return connectionScope.length > 0 ? { unrestricted: false, ids: [...connectionScope] } : { unrestricted: true, ids: [] };
-}
-var DDL_DML_KEYWORDS = [
-  "insert",
-  "update",
-  "delete",
-  "drop",
-  "alter",
-  "create",
-  "truncate",
-  "grant",
-  "revoke",
-  "merge",
-  "replace",
-  "upsert"
-];
-var DDL_DML_RE = new RegExp(`\\b(?:${DDL_DML_KEYWORDS.join("|")})\\b`, "i");
-var SELECT_INTO_RE = /\bselect\b[\s\S]*?\binto\b/i;
-function validateSql(sql) {
-  const trimmed = sql.trim();
-  if (!trimmed) {
-    return { ok: false, reason: "SQL is empty" };
-  }
-  const withoutComments = trimmed.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ");
-  const statements = withoutComments.split(";").map((s) => s.trim()).filter(Boolean);
-  if (statements.length > 1) {
-    return { ok: false, reason: "Multiple statements are not allowed" };
-  }
-  const firstKeyword = withoutComments.trim().split(/\s+/)[0].toLowerCase();
-  if (firstKeyword !== "select" && firstKeyword !== "with") {
-    return { ok: false, reason: `Only SELECT or WITH queries are allowed (got "${firstKeyword}")` };
-  }
-  if (SELECT_INTO_RE.test(withoutComments)) {
-    return { ok: false, reason: "SELECT INTO is not allowed (creates a table)" };
-  }
-  if (DDL_DML_RE.test(withoutComments)) {
-    return { ok: false, reason: "Only read-only queries are allowed (DML/DDL detected)" };
-  }
-  return { ok: true };
-}
-
-// src/tool_lattice/semantic_metrics/SemanticMetricsV2Client.ts
-var NO_CONNECTION_HINT = "No semantic-metrics connection is configured for this tenant. Add a connection of type 'semantic-metrics' for the tenant, then select it (connections) or enable connectAll in the agent's middleware config.";
-async function resolveMetricsClientFromSelector(selector, scope, connectionKey) {
-  let resolved;
-  try {
-    resolved = await resolvePluginConnections(selector.connectionType, selector, scope);
-  } catch (error) {
-    if (error instanceof Error && error.message === "ConnectionStore not configured") {
-      throw new Error(NO_CONNECTION_HINT);
-    }
-    throw error;
-  }
-  const available = resolved.map((c) => c.key).join(", ");
-  if (resolved.length === 0) {
-    throw new Error(NO_CONNECTION_HINT);
-  }
-  const key5 = connectionKey?.trim() || (resolved.length === 1 ? resolved[0].key : "");
-  if (!key5) {
-    throw new Error(
-      `connectionKey is required. Available connections: ${available}`
-    );
-  }
-  const entry = resolved.find((c) => c.key === key5);
-  if (!entry) {
-    throw new Error(`Connection "${key5}" not found. Available connections: ${available}`);
-  }
-  const config = entry.config;
-  return new SemanticMetricsV2Client(config);
-}
-var SemanticMetricsV2Client = class {
-  /**
-   * @param config - Connection configuration (server URL, optional API key and headers).
-   */
-  constructor(config) {
-    this.config = config;
-    this.baseUrl = config.serverUrl.replace(/\/$/, "");
-  }
-  /**
-   * Build default request headers: `Accept: application/json`, custom headers,
-   * and a Bearer `Authorization` header when an API key is configured.
-   *
-   * @returns Merged headers.
-   */
-  getHeaders() {
-    const headers = {
-      Accept: "application/json",
-      ...this.config.headers ?? {}
-    };
-    if (this.config.apiKey) {
-      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
-    }
-    return headers;
-  }
-  /**
-   * Numeric selected resource ids of this connection (normalized).
-   *
-   * Reads `selectedEntities` — the standard connection resource-selection
-   * field written by the connection UI (`connection.discover` + selection).
-   *
-   * @returns The selected resource ids; empty when unrestricted.
-   */
-  getSelectedEntities() {
-    const raw = this.config.selectedEntities;
-    if (!Array.isArray(raw)) return [];
-    return raw.map((v) => Number(v)).filter((n) => Number.isFinite(n));
-  }
-  /**
-   * Perform a JSON request against the base URL.
-   *
-   * The Metrics Server wraps every response as `{ code, message, data }`. A
-   * `code` of 200 resolves to `data`; any other `code` throws a business error
-   * carrying the server message (regardless of HTTP status). Non-envelope
-   * bodies are returned as-is.
-   *
-   * @param path - Path appended to the base URL (must start with `/`).
-   * @param init - Optional `fetch` init overrides (method, body, per-call headers).
-   * @returns The unwrapped `data` payload of the response envelope.
-   * @throws When the server returns a non-200 `code`, or the HTTP response is not OK.
-   */
-  async request(path8, init = {}) {
-    const response = await fetch(`${this.baseUrl}${path8}`, {
-      ...init,
-      method: init.method ?? "GET",
-      headers: { ...this.getHeaders(), ...init.headers ?? {} }
-    });
-    const text = await response.text().catch(() => "");
-    const parsed = this.parseBody(text);
-    if (parsed?.envelope === true) {
-      if (parsed.code !== 200) {
-        throw new Error(`API ${parsed.code}: ${parsed.message || "Unknown error"}`);
-      }
-      return parsed.data;
-    }
-    if (!response.ok) {
-      throw new Error(`HTTP ${response.status}: ${text || response.statusText}`);
-    }
-    return parsed?.value ?? void 0;
-  }
-  /**
-   * Parse a response body text. Detects the server envelope `{ code, message, data }`.
-   *
-   * @param text - Raw response body text.
-   * @returns `{ envelope: true, code, message, data }` for an envelope body,
-   *   `{ envelope: false, value }` for anything else (or `{ envelope: false }` when empty/invalid).
-   */
-  parseBody(text) {
-    if (!text.trim()) return { envelope: false };
-    try {
-      const value = JSON.parse(text);
-      if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-        const record = value;
-        if (typeof record.code === "number") {
-          return {
-            envelope: true,
-            code: record.code,
-            message: typeof record.message === "string" ? record.message : void 0,
-            data: record.data
-          };
-        }
-      }
-      return { envelope: false, value };
-    } catch {
-      return { envelope: false, value: text };
-    }
-  }
-  /**
-   * POST a JSON body to a path.
-   *
-   * @param path - Path appended to the base URL.
-   * @param body - Payload serialized as JSON.
-   * @returns Parsed JSON response body.
-   */
-  post(path8, body) {
-    return this.request(path8, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    });
-  }
-  /**
-   * PUT a JSON body to a path.
-   *
-   * @param path - Path appended to the base URL.
-   * @param body - Payload serialized as JSON.
-   * @returns Parsed JSON response body.
-   */
-  put(path8, body) {
-    return this.request(path8, {
-      method: "PUT",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    });
-  }
-  /**
-   * List all datasources.
-   *
-   * @returns Parsed JSON response body.
-   */
-  listDatasources() {
-    return this.request("/datasources");
-  }
-  /**
-   * Get table grants for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  getTableGrants(datasourceId) {
-    return this.request(`/datasources/${encodeURIComponent(datasourceId)}/table-grants`);
-  }
-  /**
-   * Run a read-only SQL query against a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param input - Query input: `sql` (SELECT/WITH only), optional `params`, `maxRows`, `debug`.
-   * @returns Parsed JSON response body.
-   * @throws When `sql` fails read-only validation (rejected before any fetch).
-   */
-  async queryDatasource(datasourceId, input) {
-    const validation = validateSql(input.sql);
-    if (!validation.ok) throw new Error(`SQL_NOT_ALLOWED: ${validation.reason}`);
-    return this.post(`/datasources/${encodeURIComponent(datasourceId)}/query`, input);
-  }
-  /**
-   * Test a datasource connection.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  testDatasource(datasourceId) {
-    return this.post(`/datasources/${encodeURIComponent(datasourceId)}/test`, {});
-  }
-  /**
-   * Get connection-pool status for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  getPoolStatus(datasourceId) {
-    return this.request(`/datasources/${encodeURIComponent(datasourceId)}/pool`);
-  }
-  /**
-   * List table metadata for a datasource, auto-paginating.
-   *
-   * The server pages this collection (`page`/`pageSize`, default page size 20),
-   * so requests aggregate every page into one `{ items, total }` result.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns `{ items: [...], total }` covering all pages.
-   */
-  async listTables(datasourceId) {
-    return this.listMetaPage(`/datasources/${encodeURIComponent(datasourceId)}/meta/tables`);
-  }
-  /**
-   * Shared pagination walk for the paged meta collections (`{items,total,page,pageSize}`).
-   *
-   * @param basePath - Collection path (tables or metrics).
-   * @returns `{ items, total }` aggregated across all pages.
-   */
-  async listMetaPage(basePath) {
-    const pageSize = 100;
-    const items = [];
-    let total = Number.POSITIVE_INFINITY;
-    for (let page = 1; items.length < total; page += 1) {
-      const body = await this.request(`${basePath}?page=${page}&pageSize=${pageSize}`);
-      const record = body !== null && typeof body === "object" ? body : {};
-      const batch = Array.isArray(record.items) ? record.items : [];
-      items.push(...batch);
-      total = typeof record.total === "number" ? record.total : items.length;
-      if (batch.length === 0) break;
-    }
-    return { items, total: items.length };
-  }
-  /**
-   * Get metadata for a single table.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param tableKey - Table key.
-   * @returns Parsed JSON response body.
-   */
-  getTable(datasourceId, tableKey) {
-    return this.request(
-      `/datasources/${encodeURIComponent(datasourceId)}/meta/tables/${encodeURIComponent(tableKey)}`
-    );
-  }
-  /**
-   * Create a table definition for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param payload - Table definition payload.
-   * @returns Parsed JSON response body.
-   */
-  createTable(datasourceId, payload) {
-    return this.post(`/datasources/${encodeURIComponent(datasourceId)}/meta/tables`, payload);
-  }
-  /**
-   * Update a table definition for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param tableKey - Table key.
-   * @param payload - Table definition payload.
-   * @returns Parsed JSON response body.
-   */
-  /**
-   * Update a published table meta via read-modify-write.
-   *
-   * The server's PUT replaces the whole payload, so the current payload is
-   * fetched first and the incoming fields are merged on top; fields not
-   * mentioned are preserved.
-   */
-  async updateTable(datasourceId, tableKey, payload) {
-    const existing = await this.readMetaPayload(`${this.baseUrl}/datasources/${encodeURIComponent(datasourceId)}/meta/tables/${encodeURIComponent(tableKey)}`);
-    return this.put(
-      `/datasources/${encodeURIComponent(datasourceId)}/meta/tables/${encodeURIComponent(tableKey)}`,
-      { payload: { ...existing, ...payload } }
-    );
-  }
-  /**
-   * List metric definitions for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  /**
-   * List metric metadata for a datasource, auto-paginating.
-   *
-   * The server pages this collection (`page`/`pageSize`, default page size 20),
-   * so requests aggregate every page into one `{ items, total }` result.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns `{ items: [...], total }` covering all pages.
-   */
-  async listMetrics(datasourceId) {
-    return this.listMetaPage(`/datasources/${encodeURIComponent(datasourceId)}/meta/metrics`);
-  }
-  /**
-   * Get a single metric definition.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param metricKey - Metric key.
-   * @returns Parsed JSON response body.
-   */
-  getMetric(datasourceId, metricKey) {
-    return this.request(
-      `/datasources/${encodeURIComponent(datasourceId)}/meta/metrics/${encodeURIComponent(metricKey)}`
-    );
-  }
-  /**
-   * Create a metric definition for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param payload - Metric definition payload.
-   * @returns Parsed JSON response body.
-   */
-  createMetric(datasourceId, payload) {
-    return this.post(`/datasources/${encodeURIComponent(datasourceId)}/meta/metrics`, payload);
-  }
-  /**
-   * Update a metric definition for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param metricKey - Metric key.
-   * @param payload - Metric definition payload.
-   * @returns Parsed JSON response body.
-   */
-  /**
-   * Update a published metric meta via read-modify-write.
-   *
-   * The server's PUT replaces the whole payload, so the current payload is
-   * fetched first and the incoming fields are merged on top; fields not
-   * mentioned are preserved.
-   */
-  async updateMetric(datasourceId, metricKey, payload) {
-    const existing = await this.readMetaPayload(`${this.baseUrl}/datasources/${encodeURIComponent(datasourceId)}/meta/metrics/${encodeURIComponent(metricKey)}`);
-    return this.put(
-      `/datasources/${encodeURIComponent(datasourceId)}/meta/metrics/${encodeURIComponent(metricKey)}`,
-      { payload: { ...existing, ...payload } }
-    );
-  }
-  /**
-   * Fetch the current `payload` object of a published meta entry.
-   *
-   * The single-entry read returns `{ code, data: [entry] }` (already unwrapped
-   * to the array by {@link request}); the payload lives on the first entry.
-   *
-   * @param absoluteUrl - Full URL of the single-entry meta read.
-   * @returns The stored payload object (empty when none exists).
-   */
-  async readMetaPayload(absoluteUrl) {
-    const response = await fetch(absoluteUrl, { headers: this.getHeaders() });
-    const text = await response.text().catch(() => "");
-    if (!response.ok) {
-      throw new Error(`HTTP ${response.status}: ${text || response.statusText}`);
-    }
-    const parsed = this.parseBody(text);
-    const data = parsed?.envelope === true ? parsed.data : parsed?.value;
-    const entry = Array.isArray(data) ? data[0] : data;
-    const payload = entry?.payload;
-    return payload !== null && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-  }
-  /**
-   * Get runtime metadata for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  getRuntimeMeta(datasourceId) {
-    return this.request(`/datasources/${encodeURIComponent(datasourceId)}/meta`);
-  }
-  /**
-   * Run a metrics query.
-   *
-   * @param request - Metrics query request payload.
-   * @returns Parsed JSON response body.
-   */
-  queryMetrics(request) {
-    return this.post("/metrics/query", request);
-  }
-  /**
-   * Run an ad-hoc custom SQL query, validated as read-only before sending.
-   *
-   * @param request - Request with `datasourceId`, `customSql` (SELECT/WITH only),
-   * and optional `limit` / `debug`.
-   * @returns Parsed JSON response body.
-   * @throws When `customSql` fails read-only validation (rejected before any fetch).
-   */
-  async customSql(request) {
-    const validation = validateSql(request.customSql);
-    if (!validation.ok) throw new Error(`SQL_NOT_ALLOWED: ${validation.reason}`);
-    return this.post("/metrics/query", request);
-  }
-};
-
-// src/tool_lattice/semantic_metrics/metrics_datasource_tool.ts
-var DESCRIPTION = `PHYSICAL LAYER EXPLORATION \u2014 the only tool for probing raw datasource structure (Builder/Admin only; business agents do not need it).
-
-OWNS: discovering datasources, reading table-grants (the exploration boundary for this tenant), and running read-only SQL (SELECT/WITH only) to inspect physical tables, columns, sample rows, and value distributions. Also: per-datasource connection test and pool status.
-
-DOES NOT OWN:
-- Published semantic assets (table meta / metric meta) \u2192 use metrics_meta_tool.
-- Runtime meta and business metric queries \u2192 use metrics_runtime_tool.
-
-USE WHEN: starting a modeling task \u2014 \`list_datasources\` is always the FIRST step: it returns the datasource ids that every other action and tool requires (get_grants, query_sql here; read_semantic_catalog, query_metrics in metrics_runtime_tool; the meta actions in metrics_meta_tool). Read grants next, then probe tables, columns, samples, and distributions within the grant. If a field's business meaning is unclear, probe sample values and distributions here before publishing anything.
-
-COMMON MISTAKES (do not):
-- Do not answer business metric questions here (e.g. "monthly sales by region") \u2014 that is metrics_runtime_tool \`query\` against published metrics, NOT this tool's \`query_sql\` (physical-table SQL).
-- Do not read or publish semantic meta through this tool \u2014 metrics_meta_tool owns the semantic layer.
-- Do not probe tables outside the tenant's table-grants; un-granted probes are rejected and break the exploration boundary.
-- Do not attempt writes \u2014 SQL is validated read-only and rejected before sending.`;
-function createMetricsDatasourceTool(params) {
-  const { connectionType, connections, connectAll } = params;
-  return (0, import_langchain67.tool)(
-    async (input, exeConfig) => {
-      try {
-        const client = await resolveMetricsClientFromSelector(
-          { connectionType, connections, connectAll },
-          readToolRunConfig(exeConfig) ?? {},
-          input.connectionKey
-        );
-        const scope = effectiveDatasourceScope(client.getSelectedEntities());
-        switch (input.action) {
-          case "list_datasources": {
-            const result = await client.listDatasources();
-            const filtered = scope.unrestricted ? result : result.filter((d) => scope.ids.includes(Number(d.id)));
-            const safe = filtered.map((d) => ({
-              id: d.id,
-              name: d.name,
-              sourceType: d.sourceType,
-              description: d.description,
-              statusLabel: d.statusLabel
-            }));
-            return JSON.stringify(safe, null, 2);
-          }
-          case "get_grants": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            const result = await client.getTableGrants(ds);
-            return JSON.stringify(result, null, 2);
-          }
-          case "query_sql": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            if (!input.sql) throw new Error("sql is required for the 'query_sql' action");
-            const result = await client.queryDatasource(ds, {
-              sql: input.sql,
-              params: input.params,
-              maxRows: input.maxRows
-            });
-            return JSON.stringify(result, null, 2);
-          }
-          case "test_connection": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            const result = await client.testDatasource(ds);
-            return JSON.stringify(result, null, 2);
-          }
-          case "pool_status": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            const result = await client.getPoolStatus(ds);
-            return JSON.stringify(result, null, 2);
-          }
-        }
-      } catch (error) {
-        return `Error: ${error instanceof Error ? error.message : String(error)}`;
-      }
-    },
-    {
-      name: "metrics_datasource_tool",
-      description: DESCRIPTION,
-      schema: import_zod55.default.object({
-        action: import_zod55.default.enum(["list_datasources", "get_grants", "query_sql", "test_connection", "pool_status"]).describe(
-          "list_datasources: list datasources \u2014 ALWAYS call this first to obtain the datasource id used by every other action and tool; get_grants: read table-grants; query_sql: run read-only SQL against PHYSICAL tables (note: this is query_sql, NOT the semantic 'query' action of metrics_runtime_tool); test_connection: test the datasource; pool_status: connection-pool status"
-        ),
-        connectionKey: import_zod55.default.string().optional().describe("Connection key. Omit when only one semantic-metrics connection exists"),
-        datasourceId: import_zod55.default.coerce.number().optional().describe("Numeric datasource id, e.g. 15 (required for all actions except list_datasources; optional if set in runConfig.metricsDataSource)"),
-        sql: import_zod55.default.string().optional().describe("Read-only SQL (SELECT/WITH only). Required for the query action. Metadata templates \u2014 PostgreSQL/SQL Server columns: select column_name, data_type from information_schema.columns where table_schema = :schemaName and table_name = :tableName order by ordinal_position; HANA columns: select column_name, data_type_name from table_columns where schema_name = :schemaName and table_name = :tableName order by position; distributions: select <dim>, count(*) as row_count from <table> group by <dim> order by row_count desc limit :maxRows"),
-        params: import_zod55.default.record(import_zod55.default.union([import_zod55.default.string(), import_zod55.default.number(), import_zod55.default.boolean()])).optional().describe("Named :param values for the SQL"),
-        maxRows: import_zod55.default.number().optional().describe("Max rows to return")
-      })
-    }
-  );
-}
-
-// src/tool_lattice/semantic_metrics/metrics_meta_tool.ts
-var import_zod56 = __toESM(require("zod"));
-var import_langchain68 = require("langchain");
-var DESCRIPTION2 = `SEMANTIC ASSET REGISTRY (Builder/Admin only) \u2014 the only tool for reading and publishing the runtime's semantic layer: table meta (meta/tables) and metric meta (meta/metrics).
-
-OWNS: listing published tables and metrics, reading one by objectKey, publishing a semantic table (create_table: columns tagged with role dimension|measure), publishing a metric (create_metric: a metric_index payload then a metric_detail payload using the SQL-free calculation DSL), and correcting published assets (update_table / update_metric).
-
-DOES NOT OWN:
-- Running queries or reading the aggregated runtime view \u2192 metrics_runtime_tool (get_meta / query / custom_sql).
-- Probing physical tables, columns, grants, or samples \u2192 metrics_datasource_tool.
-
-USE WHEN: physical exploration is done and the model has been proposed and confirmed by the user \u2014 to publish the semantic table and metrics, or to correct published assets afterwards.
-
-COMMON MISTAKES (do not):
-- Do not call get_meta here \u2014 that action belongs to metrics_runtime_tool, not this tool.
-- Do not try to "query numbers" through this tool \u2014 list/read actions return definitions only; use metrics_runtime_tool query for data.
-- Do not publish a metric whose sourceTable has no published table meta, or whose dimensions are not published columns with role dimension \u2014 the server will reject it.
-- The builder assistant must load the semantic-metrics-modeling skill and pass modelingSkillLoaded: true on write actions; no removal actions are exposed on purpose.`;
-var MODELING_SKILL_NAME = "semantic-metrics-modeling";
-var BUILDER_ASSISTANT_ID = "semantic-metrics-builder";
-function requireModelingSkillLoaded(action, input, exeConfig) {
-  const isWriteAction = action === "create_table" || action === "update_table" || action === "create_metric" || action === "update_metric";
-  if (!isWriteAction) return void 0;
-  const runConfig = readToolRunConfig(exeConfig);
-  const assistantId = runConfig?.assistant_id;
-  if (assistantId === BUILDER_ASSISTANT_ID && input.modelingSkillLoaded !== true) {
-    return JSON.stringify({
-      success: false,
-      error: `Load the '${MODELING_SKILL_NAME}' skill before publishing meta.`
-    });
-  }
-  return void 0;
-}
-function actionRequiresPayload(action) {
-  return action === "create_table" || action === "update_table" || action === "create_metric" || action === "update_metric";
-}
-function createMetricsMetaTool(params) {
-  const { connectionType, connections, connectAll } = params;
-  return (0, import_langchain68.tool)(
-    async (input, exeConfig) => {
-      try {
-        const guardError = requireModelingSkillLoaded(input.action, input, exeConfig);
-        if (guardError !== void 0) return guardError;
-        const client = await resolveMetricsClientFromSelector(
-          { connectionType, connections, connectAll },
-          readToolRunConfig(exeConfig) ?? {},
-          input.connectionKey
-        );
-        const ds = resolveDatasourceId(input, exeConfig);
-        assertDatasourceSelected(effectiveDatasourceScope(client.getSelectedEntities()), ds);
-        if (actionRequiresPayload(input.action) && input.payload === void 0) {
-          throw new Error(`payload is required for ${input.action}`);
-        }
-        const payload = input.payload ?? {};
-        switch (input.action) {
-          case "list_tables": {
-            return JSON.stringify(await client.listTables(ds), null, 2);
-          }
-          case "read_table_meta": {
-            if (!input.objectKey) throw new Error("objectKey is required for read_table_meta");
-            return JSON.stringify(await client.getTable(ds, input.objectKey), null, 2);
-          }
-          case "create_table": {
-            return JSON.stringify(await client.createTable(ds, payload), null, 2);
-          }
-          case "update_table": {
-            if (!input.objectKey) throw new Error("objectKey is required for update_table");
-            return JSON.stringify(await client.updateTable(ds, input.objectKey, payload), null, 2);
-          }
-          case "list_metrics": {
-            return JSON.stringify(await client.listMetrics(ds), null, 2);
-          }
-          case "read_metric_meta": {
-            if (!input.objectKey) throw new Error("objectKey is required for read_metric_meta");
-            return JSON.stringify(await client.getMetric(ds, input.objectKey), null, 2);
-          }
-          case "create_metric": {
-            return JSON.stringify(await client.createMetric(ds, payload), null, 2);
-          }
-          case "update_metric": {
-            if (!input.objectKey) throw new Error("objectKey is required for update_metric");
-            return JSON.stringify(await client.updateMetric(ds, input.objectKey, payload), null, 2);
-          }
-        }
-      } catch (error) {
-        return `Error: ${error instanceof Error ? error.message : String(error)}`;
-      }
-    },
-    {
-      name: "metrics_meta_tool",
-      description: DESCRIPTION2,
-      schema: import_zod56.default.object({
-        action: import_zod56.default.enum([
-          "list_tables",
-          "read_table_meta",
-          "create_table",
-          "update_table",
-          "list_metrics",
-          "read_metric_meta",
-          "create_metric",
-          "update_metric"
-        ]).describe(
-          "Actions ONLY in this meta tool (runtime query actions like get_meta/query belong to metrics_runtime_tool): list_tables/list_metrics (browse published assets), read_table_meta/read_metric_meta (details by objectKey), create_table/create_metric (publish), update_table/update_metric (correct)"
-        ),
-        connectionKey: import_zod56.default.string().optional().describe("Connection key. Omit when only one semantic-metrics connection exists"),
-        datasourceId: import_zod56.default.coerce.number().optional().describe("Numeric datasource id, e.g. 15 (optional if set in runConfig.metricsDataSource)"),
-        objectKey: import_zod56.default.string().optional().describe("Semantic table/metric key (required for read_table_meta/update_table/read_metric_meta/update_metric)"),
-        payload: import_zod56.default.record(import_zod56.default.unknown()).optional().describe("Meta payload (required for create/update actions; objectType/objectKey/status/payload/accessGrant)"),
-        modelingSkillLoaded: import_zod56.default.literal(true).optional().describe("Set true after loading the semantic-metrics-modeling skill (required for the builder assistant on write actions)")
-      })
-    }
-  );
-}
-
-// src/tool_lattice/semantic_metrics/metrics_runtime_tool.ts
-var import_zod57 = __toESM(require("zod"));
-var import_langchain69 = require("langchain");
-var DESCRIPTION3 = `RUNTIME QUERY SURFACE \u2014 read what is published and answer business questions with numbers. Business agents use ONLY this tool; Builder agents also use it to verify freshly published metrics.
-
-OWNS: list_datasources (self-contained datasource discovery \u2014 redacted output, the first step before anything else), read_semantic_catalog (the published semantic model for a datasource: tables, metrics, dimensions, filters) and query_metrics (the semantic metric query: metrics / groupBy / filters / orderBy / limit \u2014 the server generates the SQL, so there is no free-form SQL here).
-
-DOES NOT OWN:
-- Publishing or correcting semantic tables/metrics \u2192 metrics_meta_tool (create_table/update_table/create_metric/update_metric/list_tables/read_table_meta/list_metrics/read_metric_meta).
-- Physical exploration of raw tables, grants, or samples \u2192 metrics_datasource_tool (query_sql).
-- Free-form custom SQL \u2014 intentionally not provided; use query against published metrics.
-
-USE WHEN: read_semantic_catalog to see what is published before asking numbers; query_metrics to answer a business question from already-published metrics (Business) or to verify a just-published metric against its acceptance evidence (Builder).
-
-COMMON MISTAKES (do not):
-- Do not call meta-tool actions here (create_table / update_table / create_metric / update_metric / list_tables / read_table_meta / list_metrics / read_metric_meta) \u2014 they live in metrics_meta_tool and will fail schema validation here.
-- Do not look for a custom-SQL action \u2014 there is none; explore physical data with metrics_datasource_tool query_sql, and query business numbers with the semantic query action.
-- Metrics and dimensions in query_metrics must already be published; querying an unpublished metric fails with "not found in catalog".`;
-function createMetricsRuntimeTool(params) {
-  const { connectionType, connections, connectAll } = params;
-  return (0, import_langchain69.tool)(
-    async (input, exeConfig) => {
-      try {
-        const client = await resolveMetricsClientFromSelector(
-          { connectionType, connections, connectAll },
-          readToolRunConfig(exeConfig) ?? {},
-          input.connectionKey
-        );
-        const scope = effectiveDatasourceScope(client.getSelectedEntities());
-        switch (input.action) {
-          case "list_datasources": {
-            const result = await client.listDatasources();
-            const filtered = scope.unrestricted ? result : result.filter((d) => scope.ids.includes(Number(d.id)));
-            const safe = filtered.map((d) => ({
-              id: d.id,
-              name: d.name,
-              sourceType: d.sourceType,
-              description: d.description,
-              statusLabel: d.statusLabel
-            }));
-            return JSON.stringify(safe, null, 2);
-          }
-          case "read_semantic_catalog": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            return JSON.stringify(await client.getRuntimeMeta(ds), null, 2);
-          }
-          case "query_metrics": {
-            if (!input.query) throw new Error("query is required for the 'query_metrics' action");
-            const bodyDatasourceId = input.query.datasourceId;
-            if (bodyDatasourceId !== void 0) {
-              assertDatasourceSelected(scope, Number(bodyDatasourceId));
-            }
-            return JSON.stringify(await client.queryMetrics(input.query), null, 2);
-          }
-        }
-      } catch (error) {
-        return `Error: ${error instanceof Error ? error.message : String(error)}`;
-      }
-    },
-    {
-      name: "metrics_runtime_tool",
-      description: DESCRIPTION3,
-      schema: import_zod57.default.object({
-        action: import_zod57.default.enum(["list_datasources", "read_semantic_catalog", "query_metrics"]).describe(
-          "Actions ONLY in this runtime tool: list_datasources (list available datasources \u2014 ALWAYS call this first to obtain the datasourceId; output is redacted to non-sensitive fields), read_semantic_catalog (read the published semantic model: tables, metrics, dimensions), query_metrics (run a semantic metric query \u2014 the only way to get business numbers). Do NOT put meta-tool actions (list_tables/read_table_meta/create_table/update_table/list_metrics/read_metric_meta/create_metric/update_metric) here"
-        ),
-        connectionKey: import_zod57.default.string().optional().describe("Connection key. Omit when only one semantic-metrics connection exists"),
-        datasourceId: import_zod57.default.coerce.number().optional().describe("Numeric datasource id, e.g. 15 (required for read_semantic_catalog; optional if set in runConfig.metricsDataSource)"),
-        query: import_zod57.default.record(import_zod57.default.unknown()).optional().describe('Semantic metric query request. Required for the query_metrics action, e.g. { datasourceId: 15, metrics: ["sell_in_nes"], groupBy: ["sales_team"], filters: [{ dimension: "posting_year", operator: "GTE", values: [2024] }], limit: 10 }')
-      })
-    }
-  );
-}
-
-// src/middlewares/semanticMetricsModelingSkill.ts
-var CONTENT = `---
-name: semantic-metrics-modeling
-description: Builder policy for turning a granted datasource into published semantic tables and metrics. Governs goal agreement, FEP verification, persistent-task tracking, belief-state updates, and continuous refinement until acceptance evidence is met.
----
-
-# Semantic Metrics Modeling
-
-You are the Semantic Metrics Builder. You turn physical datasource tables into reusable
-**semantic tables** and **business metrics** on a Metrics Server (\`/api/v1\`). Work is
-governed, observable, and continuously refined \u2014 never a one-shot guess.
-
-## Goal Model
-
-Before any exploration or publishing, agree with the user on:
-- **Real goal**: the business outcome (which metrics, for what decision), not just "make a table".
-- **Consumer**: who reads the result and how.
-- **Usable state**: observable conditions that make the published meta useful.
-- **Scope**: which datasource/tables, and what is explicitly out of scope.
-- **Acceptance evidence**: objective criteria (e.g. "metric \`sell_in_nes\` returns sane monthly
-  totals for 2024") used to decide success.
-Do not guess material goals, consumers, or acceptance evidence.
-
-**Vague requests** (e.g. "build the metric layer") \u2014 do not act and do not ask blind questions.
-First run cheap read-only observations (\`list_datasources\`, \`get_grants\`, \`list_tables\`,
-\`list_metrics\`) to see what is authorized and already published, then ask focused questions that
-carry that context and offer concrete options (which datasource/tables, which business questions,
-extend existing metrics or build new). Every clarification question must include enough context and
-options for the user to answer in one step. Only after the user picks a direction does the Goal
-Model become confirmable \u2014 record it, create the task, and proceed to the workflow.
-
-## Target model and quality bar
-
-Your goal is a specific, verifiable artifact, not "some tables and metrics".
-
-**Target shape** \u2014 one delivery is:
-- a published \`table_view_detail\` meta per logical table, with every column tagged
-  \`role\` (dimension | measure) and a business-readable \`label\`;
-- a \`metric_index\` + \`metric_detail\` pair per metric, using the SQL-free \`calculation\` DSL;
-- the set, taken together, answers the user's concrete business question.
-
-**Publish gate (self-check every metric before create)** \u2014 if any fails, do **not** publish; go
-explore or ask the user:
-1. measure: an aggregation is chosen **and** its business meaning is confirmed (net/gross, currency, dedupe or not);
-2. dimension: has a business meaning and a grain (day/month/year/\u2026);
-3. \`displayName\`/\`label\` are business-readable;
-4. the metric answers one concrete question from the user's stated goal;
-5. a runtime \`query\` returns numbers consistent with the confirmed meaning.
-
-**Intent gaps first** \u2014 before diving into exploration, list the inputs you still need to meet the
-quality bar (business meaning, grain, target metric list, table scope, consumer) and ask for them
-explicitly. Exploration and user questions are both driven by this target shape and quality bar:
-missing business meaning \u2192 ask; unclear field semantics \u2192 probe or ask; right shape but it does not
-answer the business question \u2192 do not publish.
-
-## FEP Loop
-
-Apply this loop to every step (explore, publish table, publish metric, verify):
-**OBSERVE \u2192 HYPOTHESIZE \u2192 ACT \u2192 VERIFY \u2192 DECIDE \u2192 RECONCILE**
-
-- **Observe**: current state, grants, published meta, and decision-relevant uncertainty.
-- **Hypothesize**: what evidence should appear if your model is right, and how each outcome changes the decision.
-- **Act**: one proportional action \u2014 no more than necessary.
-- **Verify**: compare the observed result (e.g. a runtime \`query\`) against the prediction.
-- **Decide**: classify as **RETAIN** (confirmed), **REVERT** (rejected), or **INCONCLUSIVE**.
-- **Reconcile**: update the belief state and plan, then repeat while decision-relevant action remains.
-
-Renew user approval when a foundational assumption or the goal changes.
-
-## Task Policy
-
-Use persistent TaskItems as your planning surface. Do not use \`write_todos\`. Create a child task
-only for an independently verifiable outcome (e.g. "publish table meta for \`hankel_distr_sell_in\`").
-Exploration queries and tool calls are activities inside the active task. See the
-\`task-definition\` skill for \`manage_task\` operation details.
-
-## Belief State
-
-Record your modeling beliefs in the active task's description under a \`## Belief State\` section as
-a Markdown table:
-
-\`\`\`
-| Belief Key | Probability | Target | Basis |
-|---|---|---|---|
-| sell-in-nes-source-table | 70% | 100% | column \`nes\` probed as numeric measure in grant |
-\`\`\`
-
-Rules: belief keys are lowercase kebab-case; probability/target are percentages 0\u2013100% that
-represent evidence support, not calibrated probability. Update this section each FEP reconcile so
-the task always reflects the current evidence.
-
-## Workflow
-
-1. **Pick the datasource.** \`metrics_datasource_tool\` action \`list_datasources\`, or the preset
-   \`runConfig.metricsDataSource\` (\`serverKey\`\u2192connectionKey, \`datasourceId\`).
-2. **Read the boundary.** \`get_grants\` \u2192 note the allowed schema + table pattern. Never probe outside it.
-3. **Explore within the grant.** \`query\` with read-only SQL. Use the templates in
-   \`references/metadata-sql.md\`; if the user supplied schema docs or sample files, read them first
-   via filesystem to reduce querying.
-4. **Propose the model.** Present the table columns (with \`role: dimension | measure\`) and the
-   metrics (aggregate/derived) for approval before publishing.
-5. **Publish the semantic table.** \`metrics_meta_tool\` \`create_table\`.
-6. **Publish the metric.** \`metrics_meta_tool\` \`create_metric\` \u2014 \`metric_index\` then \`metric_detail\`
-   using the SQL-free \`calculation\` DSL.
-7. **Verify.** \`metrics_runtime_tool\` \`get_meta\`, then \`query\` the metric against acceptance evidence.
-
-## 1. Explore
-
-Read \`table-grants\`, then probe with \`query\`. SQL is validated read-only by the client and the
-server enforces the grant; un-granted tables return \`TABLE_NOT_GRANTED\`. Prefer the
-\`references/metadata-sql.md\` templates because dialect varies (PostgreSQL / SQL Server / HANA).
-If the user provides a data dictionary or sample data file, read it with filesystem and reconcile it
-against the probed columns.
-
-## Unclear field semantics
-
-A probed column name may not reveal its business meaning (e.g. whether \`nes\` is a net amount to
-sum, a rate to average, or an enum to filter). Publishing meta on a misunderstood field pollutes
-the runtime and every downstream metric that depends on it, and delete is not available. Treat this
-as FEP **INCONCLUSIVE** \u2014 never guess, and never publish on an unverified guess.
-
-Resolve in order of increasing cost:
-1. **Probe sample values and distribution** (\`query\`, templates in \`references/metadata-sql.md\`):
-   - numbers in (0,1) or clustered near 100 \u2192 likely a ratio/percentage \u2192 dimension or \`avg\`, rarely \`sum\`;
-   - large additive amounts (currency, counts) \u2192 measure with \`sum\`;
-   - small enumerations (year 2023/2024, 0/1 flags, codes) \u2192 dimension.
-   The share of zeros/negatives and the value scale usually disambiguate semantics.
-2. **Read user-provided docs**: if the user supplied a data dictionary or sample file, read it via
-   filesystem and reconcile it against the probed columns.
-3. **Cross-field correlation**: compare the unclear field with fields whose semantics are confirmed.
-
-If evidence is still INCONCLUSIVE:
-- Do **not** publish meta that depends on the unclear field.
-- List the field with its candidate interpretations in the **Propose the model** step and ask the
-  user to confirm its semantics (role, value meaning, net/gross) via ask_user_to_clarify. The user
-  does not need to see the table \u2014 your probed schema, samples, and candidates are enough.
-- Record a low-probability belief entry (e.g.
-  \`| sales-nes-semantics | 40% | 100% | user must confirm role / net amount |\`) so verify/refine can
-  revisit it later instead of assuming it is settled.
-
-## 2. Publish table meta (\`create_table\`)
-
-Publish the authoritative shape below (objectType \`table_view_detail\`, with an EXACT accessGrant):
-
-\`\`\`json
-{
-  "objectType": "table_view_detail",
-  "objectKey": "hankel_view_sales_summary",
-  "status": 1,
-  "payload": {
-    "schemaName": "public",
-    "tableName": "hankel_view_sales_summary",
-    "displayName": "Hankel Sales Summary",
-    "docType": "Sales Summary",
-    "docTypeEn": "Sales Summary",
-    "shortDesc": "Sales-level progress summary.",
-    "grain": "canonical_sales_name",
-    "sourceSystem": "Hankel Run for Gold",
-    "sourceTables": ["hankel_project_opportunity_lines", "hankel_new_order_lines"],
-    "columns": [
-      { "name": "canonical_sales_name", "label": "Canonical Sales Name", "type": "string", "role": "dimension", "description": "Standardized sales name used for grouping." },
-      { "name": "nes", "label": "NES", "type": "number", "role": "measure", "description": "Net external sales amount." },
-      { "name": "report_cutoff_date", "label": "Report Cutoff Date", "type": "date", "role": "time", "description": "Cutoff date of the report snapshot." }
-    ]
-  },
-  "accessGrant": {
-    "schemaName": "public",
-    "tablePattern": "hankel_view_sales_summary",
-    "patternType": "EXACT",
-    "caseSensitive": false,
-    "status": 1
-  }
-}
-\`\`\`
-
-Design rules:
-- \`objectKey\` is stable and unique per datasource (the view/table key).
-- \`columns[].role\` has THREE values: \`dimension\` (grouping/filtering), \`measure\` (aggregated numbers), \`time\` (the report cutoff/snapshot date used by default_time_context).
-- Give every column a business \`description\`.
-- Lineage fields (\`docType\`, \`shortDesc\`, \`grain\`, \`sourceSystem\`, \`sourceTables\`) make the asset findable and trustworthy \u2014 fill them from exploration evidence.
-- Runtime table publication uses \`patternType: "EXACT"\` (\`PREFIX\` is only for datasource-level exploration scopes).
-- For each semantic table also publish the identity twin: the same body with \`objectType: "table_catalog"\` and the same \`objectKey\` (same or richer payload).
-
-## 3. Publish metric meta (\`create_metric\`)
-
-Two steps for the same \`objectKey\`.
-
-### 3a. Metric index (for lists/search)
-
-\`\`\`json
-{
-  "objectType": "metric_index",
-  "objectKey": "sell_in_nes",
-  "status": 1,
-  "payload": {
-    "metric_name": "sell_in_nes",
-    "display_name": "Sell-in NES",
-    "domain": "sales",
-    "short_desc": "Net external sales amount from distributor sell-in rows.",
-    "search_keywords": ["sell in", "nes", "net external sales"],
-    "source_type": "cdp_postgres",
-    "source": { "table_view": "public.hankel_distr_sell_in" }
-  }
-}
-\`\`\`
-
-\`search_keywords\` drive metric retrieval for natural-language questions \u2014 include business synonyms.
-
-### 3b. Metric detail (the calculation)
-
-IMPORTANT \u2014 runtime schema requirement: the Metrics Server query runtime only recognizes metrics
-published in the FULL runtime style below (the same shape as existing working metrics, with
-snake_case fields like \`metric_name\`, \`source.table_view\`, \`supported_dimensions\` objects, and
-\`default_time_context\`). A minimal \`{name, sourceTable, calculation, dimensions}\` payload is
-accepted by the publish API but is NOT queryable \u2014 querying it returns 403 "not authorized".
-
-Aggregate metric (full runtime style):
-
-\`\`\`json
-{
-  "objectType": "metric_detail",
-  "objectKey": "sell_in_nes",
-  "status": 1,
-  "payload": {
-    "metric_name": "sell_in_nes",
-    "display_name": "Sell-in NES",
-    "domain": "sales",
-    "description": "Net external sales amount from distributor sell-in rows.",
-    "data_type": "numeric",
-    "format": "currency",
-    "source_type": "cdp_postgres",
-    "source": { "table_view": "public.hankel_distr_sell_in", "base_filters": [] },
-    "calculation": { "type": "aggregate", "aggregation": "sum", "measure": "nes" },
-    "supported_dimensions": [
-      { "dim_id": "posting_year", "field_name": "posting_year", "label": "Posting Year", "data_type": "number" },
-      { "dim_id": "sales_team", "field_name": "sales_team", "label": "Sales Team", "data_type": "string" }
-    ],
-    "default_time_context": {
-      "time_dimension": "posting_date",
-      "label": "Posting date",
-      "granularity": "month",
-      "window": "YTD",
-      "supported_grains": ["month", "year"]
-    },
-    "ai_agent_context": {
-      "polarity": "positive",
-      "synonyms": ["sell in", "nes", "net external sales"],
-      "human_readable_explanation": "Higher sell-in NES means more goods purchased from the distributor."
-    }
-  }
-}
-\`\`\`
-
-Derived ratio metric (references two aggregate metrics):
-
-\`\`\`json
-{
-  "objectType": "metric_detail",
-  "objectKey": "gross_margin_rate",
-  "status": 1,
-  "payload": {
-    "metric_name": "gross_margin_rate",
-    "display_name": "Gross Margin Rate",
-    "description": "Gross margin divided by sell-in NES.",
-    "domain": "sales",
-    "data_type": "numeric",
-    "format": "percent",
-    "source_type": "cdp_postgres",
-    "source": { "table_view": "public.hankel_distr_sell_in", "base_filters": [] },
-    "calculation": { "type": "derived", "operator": "ratio", "numerator": "gross_margin", "denominator": "sell_in_nes" },
-    "supported_dimensions": [
-      { "dim_id": "posting_year", "field_name": "posting_year", "label": "Posting Year", "data_type": "number" }
-    ],
-    "default_time_context": { "time_dimension": "posting_date", "granularity": "month", "supported_grains": ["month", "year"] }
-  }
-}
-\`\`\`
-
-Design rules:
-- \`objectKey\` unique per datasource (index and detail share it).
-- \`payload.metric_name\` must equal \`objectKey\`.
-- \`source.table_view\` must be schema-qualified and match the published table meta's physical table.
-- \`supported_dimensions\` is an array of OBJECTS ({dim_id, field_name, label, data_type}); include the time dimension too; each must be a published column of that table meta.
-- \`calculation.type: "aggregate"\` = one measure + aggregation (sum/avg/count/min/max/count_distinct).
-- \`calculation.type: "derived"\` operator \`ratio\` references existing metric objectKeys (numerator/denominator); a \`formula\` variant takes an expression of metric names, numbers, parentheses, and + - * / \u2014 referenced metrics must share the same source.table_view.
-- \`default_time_context\` (\`time_dimension\` + \`granularity\` + \`supported_grains\`, optionally \`window\`) is required by the query runtime; its \`time_dimension\` must appear in supported_dimensions.
-- \`ai_agent_context\` (\`polarity\`, \`synonyms\`, \`human_readable_explanation\`) improves natural-language metric retrieval \u2014 always provide it.
-- One semantic query can only combine metrics sharing the same source.table_view; groupBy values must be dim_ids or time-grain expressions like \`posting_date__month\`.
-- Do not inline raw SQL for new DB-backed metrics (complex logic belongs in a view).
-- Use \`update_metric\` / \`update_table\` to correct mistakes; no removal actions are exposed.
-
-## 4. Verify and refine
-
-- \`get_meta\` \u2192 confirm the table and metric are visible.
-- \`query\` the metric against the acceptance evidence. On failure, apply the FEP reconcile: update the
-  \`## Belief State\`, fix the meta, and retry \u2014 until acceptance evidence is met.
-
-## Troubleshooting
-
-| Symptom | Cause / fix |
-|---|---|
-| \`TABLE_NOT_GRANTED\` | SQL referenced a table outside the tenant grant; pick an in-grant table |
-| metric create fails: sourceTable missing | publish the table meta first |
-| metric create fails: unknown dimension | publish the dimension column with \`role: dimension\` |
-| derived metric create fails | numerator/denominator metrics don't exist yet \u2014 publish them first |
-| datasource \`query\` rejected | SQL was not read-only (SELECT/WITH only) or multi-statement |
-| \`403 Metric is not authorized\` on query_metrics | the metric meta is not in the queryable runtime schema (e.g. missing \`source.table_view\` / \`supported_dimensions\` / \`default_time_context\`) or genuinely unauthorized \u2014 re-publish with the full runtime payload and verify; never retry blindly |
-
-## Safety
-
-- Only query tables that match the tenant's \`table-grants\`.
-- Never return a full physical-table inventory or reveal whether an un-granted table exists.
-- SQL is validated read-only; let the server reject anything outside that.
-`;
-var resources = {
-  "references/metadata-sql.md": {
-    content: `# Datasource exploration SQL templates (read-only)
-
-Pick the block matching the server's database. These run through the datasource \`query\` action;
-the SQL is validated read-only.
-
-## PostgreSQL
-- Tables: \`select table_schema, table_name from information_schema.tables where table_schema not in ('pg_catalog','information_schema') order by table_schema, table_name\`
-- Columns: \`select column_name, data_type from information_schema.columns where table_schema = :schemaName and table_name = :tableName order by ordinal_position\`
-- Sample: \`select * from :schemaName.:tableName limit :maxRows\` \u2014 pass a concrete table, not a bound param, if the server does not support binding identifiers.
-
-## SQL Server
-- Tables: \`select table_schema, table_name from information_schema.tables order by table_schema, table_name\`
-- Columns: \`select column_name, data_type from information_schema.columns where table_schema = :schemaName and table_name = :tableName order by ordinal_position\`
-
-## HANA
-- Tables: \`select schema_name, table_name from sys.tables where schema_name = :schemaName order by table_name\`
-- Columns: \`select column_name, data_type_name from table_columns where schema_name = :schemaName and table_name = :tableName order by position\`
-
-## Value distribution (any dialect)
-\`select <dim>, count(*) as row_count from <table> group by <dim> order by row_count desc limit :maxRows\`
-`
-  },
-  "examples/table-meta.json": {
-    content: `{
-  "objectType": "table_view_detail",
-  "objectKey": "hankel_distr_sell_in",
-  "status": 1,
-  "payload": {
-    "schemaName": "public",
-    "tableName": "hankel_distr_sell_in",
-    "displayName": "Hankel Distributor Sell In",
-    "description": "Distributor sell-in transaction rows for the Hankel tenant.",
-    "columns": [
-      { "name": "posting_year", "label": "Posting Year", "type": "number", "role": "dimension" },
-      { "name": "posting_month", "label": "Posting Month", "type": "number", "role": "dimension" },
-      { "name": "sales_team", "label": "Sales Team", "type": "string", "role": "dimension" },
-      { "name": "region", "label": "Region", "type": "string", "role": "dimension" },
-      { "name": "nes", "label": "Net External Sales", "type": "number", "role": "measure" },
-      { "name": "gross_margin", "label": "Gross Margin", "type": "number", "role": "measure" }
-    ]
-  }
-}
-`
-  },
-  "examples/metric-aggregate.json": {
-    content: `{
-  "objectType": "metric_detail",
-  "objectKey": "hankel_sell_in_nes",
-  "status": 1,
-  "payload": {
-    "name": "hankel_sell_in_nes",
-    "displayName": "Sell-in NES",
-    "description": "Net external sales amount from distributor sell-in rows.",
-    "sourceTable": "hankel_distr_sell_in",
-    "calculation": { "type": "aggregate", "aggregation": "sum", "measure": "nes" },
-    "dimensions": ["posting_year", "posting_month", "sales_team", "region"]
-  }
-}
-`
-  },
-  "examples/metric-derived.json": {
-    content: `{
-  "objectType": "metric_detail",
-  "objectKey": "hankel_gross_margin_rate",
-  "status": 1,
-  "payload": {
-    "name": "hankel_gross_margin_rate",
-    "displayName": "Gross Margin Rate",
-    "description": "Gross margin divided by sell-in NES.",
-    "sourceTable": "hankel_distr_sell_in",
-    "calculation": {
-      "type": "derived",
-      "operator": "ratio",
-      "numerator": "hankel_gross_margin",
-      "denominator": "hankel_sell_in_nes"
-    },
-    "dimensions": ["posting_year", "sales_team", "region"]
-  }
-}
-`
-  }
-};
-var SEMANTIC_METRICS_MODELING_SKILL = {
-  version: "1.0.0",
-  content: CONTENT,
-  resources
-};
-
-// src/middlewares/semanticMetricsBuilderPrompt.ts
-var SEMANTIC_METRICS_BUILDER_PROMPT = `You are the Semantic Metrics Builder.
-
-CRITICAL FIRST ACTION: Before any response or other action, call the \`skill\`
-tool with skill_name: "semantic-metrics-modeling" to load semantic-metrics-modeling and follow it.
-Never announce the skill load. If it fails, retry once, then stop and explicitly
-report that the required Semantic Metrics Builder skill could not be loaded.`;
-
-// src/middlewares/semanticMetricsMiddleware.ts
-var import_protocols32 = require("@axiom-lattice/protocols");
-function createSemanticMetricsMiddleware(config) {
-  const connections = config.connections ?? [];
-  const connectAll = config.connectAll === true;
-  const selector = { connectionType: "semantic-metrics", connections, connectAll };
-  return (0, import_langchain70.createMiddleware)({
-    name: "SemanticMetrics",
-    contextSchema,
-    tools: [
-      createMetricsDatasourceTool(selector),
-      createMetricsMetaTool(selector),
-      createMetricsRuntimeTool(selector)
-    ]
-  });
-}
-function buildConnectionHeaders(config) {
-  const headers = {
-    Accept: "application/json",
-    ...config.headers !== void 0 && config.headers !== null ? config.headers : {}
-  };
-  if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
-  return headers;
-}
-function resolveBaseUrl(config) {
-  const serverUrl = config.serverUrl;
-  if (!serverUrl) {
-    throw new Error("serverUrl is required");
-  }
-  return serverUrl.replace(/\/$/, "");
-}
-var semanticMetricsPlugin = {
-  meta: {
-    type: "semantic-metrics",
-    category: "data",
-    capabilityBundleEligible: true,
-    openExpose: [
-      // Query-only surface: no writes reach either tool (SQL is read-only).
-      { name: "metrics_datasource_tool", readOnly: true },
-      { name: "metrics_runtime_tool", readOnly: true }
-    ],
-    name: "Semantic Metrics",
-    description: "Semantic metrics datasource exploration, meta publishing, and runtime querying. PERMISSION MODEL \u2014 query-only agents (metric definitions + data): enable this middleware with allowedTools ['metrics_runtime_tool']. Metric designers (Builder): keep all three tools (metrics_datasource_tool, metrics_meta_tool, metrics_runtime_tool) for exploration, publishing, and verification, or use the built-in 'semantic-metrics-builder' agent.",
-    version: "1.0.0",
-    tools: [
-      { name: "metrics_datasource_tool", description: "Explore datasource structure within the tenant's granted scope" },
-      { name: "metrics_meta_tool", description: "Publish and maintain runtime semantic tables and metrics" },
-      { name: "metrics_runtime_tool", description: "Read runtime meta and execute semantic metric queries" }
-    ],
-    configSchema: {
-      type: "object",
-      title: "Semantic Metrics Configuration",
-      description: "First select connections (connections or connectAll). Then scope tools by role via allowedTools: QUERY-ONLY agents (metric definitions + data) set allowedTools to ['metrics_runtime_tool'] \u2014 it is self-contained (list_datasources, read_semantic_catalog, query_metrics); metric DESIGNERS keep all three tools (datasource exploration, meta publishing, runtime verification).",
-      properties: {
-        connections: {
-          type: "array",
-          title: "Connections",
-          items: { type: "string" },
-          widget: "connectionSelect"
-        },
-        connectAll: {
-          type: "boolean",
-          title: "Connect All",
-          default: false,
-          widget: "switch"
-        }
-      }
-    },
-    defaultConfig: { connections: [], connectAll: false }
-  },
-  connection: {
-    // PluginConnectionFieldSchema.type supports only string/number/boolean/password,
-    // so headers is NOT a form field; the V2 client still reads config.headers at runtime.
-    fields: [
-      { key: "serverUrl", type: "string", title: "Metrics Server Base URL (include /api/v1)", required: true },
-      { key: "apiKey", type: "password", title: "API Key (optional)" }
-    ],
-    test: async (config) => {
-      try {
-        const baseUrl = resolveBaseUrl(config);
-        const res = await fetch(`${baseUrl}/datasources`, {
-          headers: buildConnectionHeaders(config)
-        });
-        const text = await res.text().catch(() => "");
-        let ok = res.ok;
-        let detail = "";
-        try {
-          const parsed = JSON.parse(text);
-          if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
-            const code = parsed.code;
-            if (typeof code === "number") {
-              ok = res.ok && code === 200;
-              if (!ok) detail = ` (${parsed.message ?? code})`;
-            }
-          }
-        } catch {
-        }
-        return {
-          ok,
-          message: ok ? `Reachable at ${baseUrl}` : `HTTP ${res.status}${detail}`
-        };
-      } catch (err) {
-        return {
-          ok: false,
-          message: `Cannot connect: ${err instanceof Error ? err.message : String(err)}`
-        };
-      }
-    },
-    discover: async (config) => {
-      try {
-        const baseUrl = resolveBaseUrl(config);
-        const res = await fetch(`${baseUrl}/datasources`, {
-          headers: buildConnectionHeaders(config)
-        });
-        const text = await res.text();
-        if (!res.ok) {
-          throw new Error(`HTTP ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
-        }
-        const parsed = JSON.parse(text);
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-          throw new Error("Metrics server returned an unexpected payload (expected a JSON envelope)");
-        }
-        const envelope = parsed;
-        if (typeof envelope.code === "number" && envelope.code !== 200) {
-          throw new Error(envelope.message || `API ${envelope.code}`);
-        }
-        const data = envelope.data;
-        if (!Array.isArray(data)) {
-          throw new Error("Metrics server returned an unexpected payload (expected a datasource array)");
-        }
-        return data.filter((d) => {
-          if (d === null || typeof d !== "object") return false;
-          const id = d.id;
-          return id !== void 0 && id !== null && id !== "";
-        }).map((item) => ({
-          id: String(item.id),
-          name: item.name ?? String(item.id)
-        }));
-      } catch (err) {
-        throw new Error(
-          `Cannot discover datasources: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-  },
-  skills: {
-    "semantic-metrics-modeling": SEMANTIC_METRICS_MODELING_SKILL
-  },
-  agents: {
-    "semantic-metrics-builder": {
-      key: "semantic-metrics-builder",
-      name: "Semantic Metrics Builder",
-      description: "Explore a granted datasource and build semantic tables and metrics interactively, tracking the work as persistent tasks with belief state and verifying each step.",
-      type: import_protocols32.AgentType.DEEP_AGENT,
-      prompt: SEMANTIC_METRICS_BUILDER_PROMPT,
-      middleware: [
-        {
-          id: "semantic-metrics",
-          type: "semantic-metrics",
-          name: "Semantic Metrics",
-          description: "Explore datasources, publish table/meta metrics, query runtime",
-          enabled: true,
-          config: { connections: [], connectAll: true }
-        },
-        {
-          id: "skill",
-          type: "skill",
-          name: "Skill",
-          description: "Load the semantic-metrics-modeling policy and task-definition reference",
-          enabled: true,
-          config: { readAll: false, skills: ["semantic-metrics-modeling", "task-definition"] }
-        },
-        {
-          id: "task",
-          type: "task",
-          name: "Task",
-          description: "Persistent TaskItems as the planning surface; update Belief State in task descriptions",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "ask_user_to_clarify",
-          type: "ask_user_to_clarify",
-          name: "Ask User",
-          description: "Wait for user input at modeling approval gates",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "filesystem",
-          type: "filesystem",
-          name: "Filesystem",
-          description: "Read user-provided schema docs, data dictionaries, or sample data files",
-          enabled: true,
-          config: {}
-        }
-      ]
-    }
-  },
-  middleware: (config) => createSemanticMetricsMiddleware(config)
-};
-
 // src/middlewares/collectionMiddleware.ts
-var import_langchain81 = require("langchain");
+var import_langchain77 = require("langchain");
 
 // src/tool_lattice/collection/list_collections.ts
-var import_zod58 = __toESM(require("zod"));
-var import_langchain71 = require("langchain");
+var import_zod55 = __toESM(require("zod"));
+var import_langchain67 = require("langchain");
 
 // src/tool_lattice/collection/utils.ts
 function getEffectiveCollectionScope(exeConfig, staticScope) {
@@ -42398,7 +41207,7 @@ var createListCollectionsTool = ({
   collectionKeys,
   connectAll
 }) => {
-  return (0, import_langchain71.tool)(
+  return (0, import_langchain67.tool)(
     async (_input, _exeConfig) => {
       try {
         const tenantId2 = _exeConfig?.configurable?.runConfig?.tenantId || "default";
@@ -42433,23 +41242,23 @@ var createListCollectionsTool = ({
     {
       name: "list_collections",
       description: LIST_COLLECTIONS_DESCRIPTION,
-      schema: import_zod58.default.object({})
+      schema: import_zod55.default.object({})
     }
   );
 };
 
 // src/tool_lattice/collection/search_collection.ts
-var import_zod59 = __toESM(require("zod"));
-var import_langchain72 = require("langchain");
+var import_zod56 = __toESM(require("zod"));
+var import_langchain68 = require("langchain");
 var SEARCH_COLLECTION_DESCRIPTION = `Search for content within a specific collection using semantic (vector) similarity. Use the 'filter' parameter to narrow results by metadata fields (e.g., {"category": "cardiovascular"}). Returns the most relevant content entries with similarity scores.`;
-var searchSchema = import_zod59.default.object({
-  collection: import_zod59.default.string().describe("The collection name to search in"),
-  query: import_zod59.default.string().describe("The search query text"),
-  filter: import_zod59.default.record(import_zod59.default.unknown()).optional().describe("Metadata filter conditions"),
-  top_k: import_zod59.default.number().optional().default(5).describe("Number of results to return")
+var searchSchema = import_zod56.default.object({
+  collection: import_zod56.default.string().describe("The collection name to search in"),
+  query: import_zod56.default.string().describe("The search query text"),
+  filter: import_zod56.default.record(import_zod56.default.unknown()).optional().describe("Metadata filter conditions"),
+  top_k: import_zod56.default.number().optional().default(5).describe("Number of results to return")
 });
 var createSearchCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => {
-  return (0, import_langchain72.tool)(
+  return (0, import_langchain68.tool)(
     async (input, _exeConfig) => {
       try {
         const { collection, query, filter: filter2, top_k } = input;
@@ -42515,10 +41324,10 @@ var createSearchCollectionTool = (scope = { collectionKeys: [], connectAll: true
 };
 
 // src/tool_lattice/collection/get_collection.ts
-var import_zod60 = __toESM(require("zod"));
-var import_langchain73 = require("langchain");
+var import_zod57 = __toESM(require("zod"));
+var import_langchain69 = require("langchain");
 var GET_COLLECTION_DESCRIPTION = `Get a collection's full definition including its custom fields schema. Use this to discover what metadata fields are available before adding entries.`;
-var createGetCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain73.tool)(
+var createGetCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain69.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.name, _exeConfig, scope);
@@ -42543,24 +41352,24 @@ Embedding: ${c.embeddingKey}${fieldsDesc}`;
       return `Error: ${error.message}`;
     }
   },
-  { name: "get_collection", description: GET_COLLECTION_DESCRIPTION, schema: import_zod60.default.object({ name: import_zod60.default.string().describe("Collection name") }) }
+  { name: "get_collection", description: GET_COLLECTION_DESCRIPTION, schema: import_zod57.default.object({ name: import_zod57.default.string().describe("Collection name") }) }
 );
 
 // src/tool_lattice/collection/create_collection.ts
-var import_zod61 = __toESM(require("zod"));
-var import_langchain74 = require("langchain");
-var createSchema = import_zod61.default.object({
-  name: import_zod61.default.string().describe("Collection name (lowercase, underscores only)"),
-  label: import_zod61.default.string().describe("Display name"),
-  embeddingKey: import_zod61.default.string().describe("Embedding model key"),
-  fields: import_zod61.default.array(import_zod61.default.object({
-    key: import_zod61.default.string().describe("Field key name"),
-    type: import_zod61.default.enum(["string", "number", "enum"]).describe("Field data type"),
-    enumValues: import_zod61.default.array(import_zod61.default.string()).optional().describe("Valid values for enum type"),
-    required: import_zod61.default.boolean().optional().default(false).describe("Whether field is required")
+var import_zod58 = __toESM(require("zod"));
+var import_langchain70 = require("langchain");
+var createSchema = import_zod58.default.object({
+  name: import_zod58.default.string().describe("Collection name (lowercase, underscores only)"),
+  label: import_zod58.default.string().describe("Display name"),
+  embeddingKey: import_zod58.default.string().describe("Embedding model key"),
+  fields: import_zod58.default.array(import_zod58.default.object({
+    key: import_zod58.default.string().describe("Field key name"),
+    type: import_zod58.default.enum(["string", "number", "enum"]).describe("Field data type"),
+    enumValues: import_zod58.default.array(import_zod58.default.string()).optional().describe("Valid values for enum type"),
+    required: import_zod58.default.boolean().optional().default(false).describe("Whether field is required")
   })).optional().describe("Custom field definitions for entries in this collection")
 });
-var createCreateCollectionTool = (scope = {}) => (0, import_langchain74.tool)(
+var createCreateCollectionTool = (scope = {}) => (0, import_langchain70.tool)(
   async (input, _exeConfig) => {
     try {
       const tenantId2 = _exeConfig?.configurable?.runConfig?.tenantId || "default";
@@ -42586,20 +41395,20 @@ var createCreateCollectionTool = (scope = {}) => (0, import_langchain74.tool)(
 );
 
 // src/tool_lattice/collection/update_collection.ts
-var import_zod62 = __toESM(require("zod"));
-var import_langchain75 = require("langchain");
-var schema = import_zod62.default.object({
-  name: import_zod62.default.string().describe("Collection name"),
-  label: import_zod62.default.string().optional().describe("New display name"),
-  embeddingKey: import_zod62.default.string().optional().describe("New embedding model key"),
-  fields: import_zod62.default.array(import_zod62.default.object({
-    key: import_zod62.default.string().describe("Field key name"),
-    type: import_zod62.default.enum(["string", "number", "enum"]).describe("Field data type"),
-    enumValues: import_zod62.default.array(import_zod62.default.string()).optional().describe("Valid values for enum type"),
-    required: import_zod62.default.boolean().optional().default(false).describe("Whether field is required")
+var import_zod59 = __toESM(require("zod"));
+var import_langchain71 = require("langchain");
+var schema = import_zod59.default.object({
+  name: import_zod59.default.string().describe("Collection name"),
+  label: import_zod59.default.string().optional().describe("New display name"),
+  embeddingKey: import_zod59.default.string().optional().describe("New embedding model key"),
+  fields: import_zod59.default.array(import_zod59.default.object({
+    key: import_zod59.default.string().describe("Field key name"),
+    type: import_zod59.default.enum(["string", "number", "enum"]).describe("Field data type"),
+    enumValues: import_zod59.default.array(import_zod59.default.string()).optional().describe("Valid values for enum type"),
+    required: import_zod59.default.boolean().optional().default(false).describe("Whether field is required")
   })).optional().describe("Custom field definitions for entries (replaces existing schema)")
 });
-var createUpdateCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain75.tool)(
+var createUpdateCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain71.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.name, _exeConfig, scope);
@@ -42620,9 +41429,9 @@ var createUpdateCollectionTool = (scope = { collectionKeys: [], connectAll: true
 );
 
 // src/tool_lattice/collection/delete_collection.ts
-var import_zod63 = __toESM(require("zod"));
-var import_langchain76 = require("langchain");
-var createDeleteCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain76.tool)(
+var import_zod60 = __toESM(require("zod"));
+var import_langchain72 = require("langchain");
+var createDeleteCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain72.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.name, _exeConfig, scope);
@@ -42634,19 +41443,19 @@ var createDeleteCollectionTool = (scope = { collectionKeys: [], connectAll: true
       return `Error: ${e.message}`;
     }
   },
-  { name: "delete_collection", description: `Delete a collection and all its entries. This cannot be undone.`, schema: import_zod63.default.object({ name: import_zod63.default.string().describe("Collection name") }) }
+  { name: "delete_collection", description: `Delete a collection and all its entries. This cannot be undone.`, schema: import_zod60.default.object({ name: import_zod60.default.string().describe("Collection name") }) }
 );
 
 // src/tool_lattice/collection/list_entries.ts
-var import_zod64 = __toESM(require("zod"));
-var import_langchain77 = require("langchain");
-var schema2 = import_zod64.default.object({
-  collection: import_zod64.default.string().describe("Collection name")
+var import_zod61 = __toESM(require("zod"));
+var import_langchain73 = require("langchain");
+var schema2 = import_zod61.default.object({
+  collection: import_zod61.default.string().describe("Collection name")
 });
 function buildKey2(tenantId2, name) {
   return `${tenantId2}:${name}`;
 }
-var createListEntriesTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain77.tool)(
+var createListEntriesTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain73.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.collection, _exeConfig, scope);
@@ -42675,19 +41484,19 @@ var createListEntriesTool = (scope = { collectionKeys: [], connectAll: true }) =
 );
 
 // src/tool_lattice/collection/add_entry.ts
-var import_zod65 = __toESM(require("zod"));
-var import_langchain78 = require("langchain");
+var import_zod62 = __toESM(require("zod"));
+var import_langchain74 = require("langchain");
 var import_documents = require("@langchain/core/documents");
 var import_uuid12 = require("uuid");
-var schema3 = import_zod65.default.object({
-  collection: import_zod65.default.string().describe("Collection name"),
-  content: import_zod65.default.string().describe("Entry content text"),
-  metadata: import_zod65.default.record(import_zod65.default.unknown()).optional().describe("Metadata fields matching the collection schema")
+var schema3 = import_zod62.default.object({
+  collection: import_zod62.default.string().describe("Collection name"),
+  content: import_zod62.default.string().describe("Entry content text"),
+  metadata: import_zod62.default.record(import_zod62.default.unknown()).optional().describe("Metadata fields matching the collection schema")
 });
 function key2(t, n) {
   return `${t}:${n}`;
 }
-var createAddEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain78.tool)(
+var createAddEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain74.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.collection, _exeConfig, scope);
@@ -42719,18 +41528,18 @@ var createAddEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (
 );
 
 // src/tool_lattice/collection/update_entry.ts
-var import_zod66 = __toESM(require("zod"));
-var import_langchain79 = require("langchain");
-var schema4 = import_zod66.default.object({
-  collection: import_zod66.default.string().describe("Collection name"),
-  entryId: import_zod66.default.string().describe("Entry ID to update"),
-  content: import_zod66.default.string().optional().describe("New content"),
-  metadata: import_zod66.default.record(import_zod66.default.unknown()).optional().describe("New metadata")
+var import_zod63 = __toESM(require("zod"));
+var import_langchain75 = require("langchain");
+var schema4 = import_zod63.default.object({
+  collection: import_zod63.default.string().describe("Collection name"),
+  entryId: import_zod63.default.string().describe("Entry ID to update"),
+  content: import_zod63.default.string().optional().describe("New content"),
+  metadata: import_zod63.default.record(import_zod63.default.unknown()).optional().describe("New metadata")
 });
 function key3(t, n) {
   return `${t}:${n}`;
 }
-var createUpdateEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain79.tool)(
+var createUpdateEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain75.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.collection, _exeConfig, scope);
@@ -42751,16 +41560,16 @@ var createUpdateEntryTool = (scope = { collectionKeys: [], connectAll: true }) =
 );
 
 // src/tool_lattice/collection/delete_entry.ts
-var import_zod67 = __toESM(require("zod"));
-var import_langchain80 = require("langchain");
-var schema5 = import_zod67.default.object({
-  collection: import_zod67.default.string().describe("Collection name"),
-  entryId: import_zod67.default.string().describe("Entry ID to delete")
+var import_zod64 = __toESM(require("zod"));
+var import_langchain76 = require("langchain");
+var schema5 = import_zod64.default.object({
+  collection: import_zod64.default.string().describe("Collection name"),
+  entryId: import_zod64.default.string().describe("Entry ID to delete")
 });
 function key4(t, n) {
   return `${t}:${n}`;
 }
-var createDeleteEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain80.tool)(
+var createDeleteEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain76.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.collection, _exeConfig, scope);
@@ -42780,7 +41589,7 @@ var createDeleteEntryTool = (scope = { collectionKeys: [], connectAll: true }) =
 function createCollectionMiddleware(params) {
   const { collectionKeys, connectAll, compileStableCandidateTools = false } = params;
   if (!compileStableCandidateTools && !connectAll && (!collectionKeys || collectionKeys.length === 0)) {
-    return (0, import_langchain81.createMiddleware)({
+    return (0, import_langchain77.createMiddleware)({
       name: "collectionMiddleware",
       contextSchema,
       tools: [
@@ -42790,7 +41599,7 @@ function createCollectionMiddleware(params) {
     });
   }
   const toolParams = { collectionKeys, connectAll };
-  return (0, import_langchain81.createMiddleware)({
+  return (0, import_langchain77.createMiddleware)({
     name: "collectionMiddleware",
     contextSchema,
     tools: [
@@ -42853,24 +41662,24 @@ var collectionPlugin = {
 };
 
 // src/middlewares/askUserClarifyMiddleware.ts
-var import_langchain83 = require("langchain");
-var import_langgraph14 = require("@langchain/langgraph");
+var import_langchain79 = require("langchain");
+var import_langgraph15 = require("@langchain/langgraph");
 
 // src/tool_lattice/ask_user_to_clarify/index.ts
-var import_langchain82 = require("langchain");
-var import_zod68 = __toESM(require("zod"));
-var questionSchema = import_zod68.default.object({
-  question: import_zod68.default.string().describe("The question text to ask the user. MUST include the specific context, options, or details being clarified \u2014 never use a bare generic label. Good: 'Confirm the plan: use Redis cache + PostgreSQL primary, split microservices as needed?' Bad: 'Confirm the plan?'"),
-  options: import_zod68.default.array(import_zod68.default.string()).optional().default([]).describe("List of EXACT, selectable values. Maximum 3 options allowed. DO NOT include placeholder values like 'Other' or 'Enter manually'. For free-text with predefined choices, use allowOther=true (works with 'single' and 'multiple'). For pure free-text without choices, use type='input' instead. For file_upload and input, pass an empty array."),
-  type: import_zod68.default.enum(["single", "multiple", "file_upload", "input"]).describe("The question format. 'single' = pick one from options (default, see tool description for guidance). 'multiple' = pick several from options. 'input' = free-text field (only when options cannot express the answer). 'file_upload' = file picker."),
-  required: import_zod68.default.boolean().optional().default(false).describe("Whether this question must be answered"),
-  allowOther: import_zod68.default.boolean().optional().default(true).describe("Set to true to append an 'Other' checkbox with a free-text input field. Works with 'single' and 'multiple' types. Use for open-ended answers or when the options cannot cover all possibilities. Not applicable for 'input' or 'file_upload' types.")
+var import_langchain78 = require("langchain");
+var import_zod65 = __toESM(require("zod"));
+var questionSchema = import_zod65.default.object({
+  question: import_zod65.default.string().describe("The question text to ask the user. MUST include the specific context, options, or details being clarified \u2014 never use a bare generic label. Good: 'Confirm the plan: use Redis cache + PostgreSQL primary, split microservices as needed?' Bad: 'Confirm the plan?'"),
+  options: import_zod65.default.array(import_zod65.default.string()).optional().default([]).describe("List of EXACT, selectable values. Maximum 3 options allowed. DO NOT include placeholder values like 'Other' or 'Enter manually'. For free-text with predefined choices, use allowOther=true (works with 'single' and 'multiple'). For pure free-text without choices, use type='input' instead. For file_upload and input, pass an empty array."),
+  type: import_zod65.default.enum(["single", "multiple", "file_upload", "input"]).describe("The question format. 'single' = pick one from options (default, see tool description for guidance). 'multiple' = pick several from options. 'input' = free-text field (only when options cannot express the answer). 'file_upload' = file picker."),
+  required: import_zod65.default.boolean().optional().default(false).describe("Whether this question must be answered"),
+  allowOther: import_zod65.default.boolean().optional().default(true).describe("Set to true to append an 'Other' checkbox with a free-text input field. Works with 'single' and 'multiple' types. Use for open-ended answers or when the options cannot cover all possibilities. Not applicable for 'input' or 'file_upload' types.")
 });
-var inputSchema = import_zod68.default.object({
-  questions: import_zod68.default.array(questionSchema).min(1, "At least one question is required").describe("A structured sequence of clarification questions. Use these to gather missing parameters or disambiguate user intent before proceeding.")
+var inputSchema = import_zod65.default.object({
+  questions: import_zod65.default.array(questionSchema).min(1, "At least one question is required").describe("A structured sequence of clarification questions. Use these to gather missing parameters or disambiguate user intent before proceeding.")
 });
 function createAskUserToClarifyTool() {
-  return (0, import_langchain82.tool)(
+  return (0, import_langchain78.tool)(
     async (input) => {
       return JSON.stringify(input);
     },
@@ -42895,7 +41704,7 @@ function isProjectRoomRun(request) {
   return isRecord9(runConfig?.projectRoom);
 }
 function createAskUserClarifyMiddleware() {
-  return (0, import_langchain83.createMiddleware)({
+  return (0, import_langchain79.createMiddleware)({
     name: "AskUserClarifyMiddleware",
     tools: [createAskUserToClarifyTool()],
     wrapToolCall: async (request, handler) => {
@@ -42905,7 +41714,7 @@ function createAskUserClarifyMiddleware() {
         return handler(request);
       }
       if (isProjectRoomRun(request)) {
-        return new import_langchain83.ToolMessage({
+        return new import_langchain79.ToolMessage({
           content: "You are replying inside a project room, which has no interactive clarification UI. Ask your clarifying questions directly in your reply text and stop; the user's next room message will continue the conversation.",
           tool_call_id: toolCall?.id,
           name: toolName2
@@ -42913,7 +41722,7 @@ function createAskUserClarifyMiddleware() {
       }
       const parsed = inputSchema.safeParse(toolCall?.args);
       if (!parsed.success) {
-        return new import_langchain83.ToolMessage({
+        return new import_langchain79.ToolMessage({
           content: `Invalid clarify tool arguments: ${parsed.error.message}`,
           tool_call_id: toolCall?.id,
           name: toolName2
@@ -42930,10 +41739,10 @@ function createAskUserClarifyMiddleware() {
         }))
       };
       const md = genUIMarkdown("clarify", uiData);
-      const result = await (0, import_langgraph14.interrupt)(md);
+      const result = await (0, import_langgraph15.interrupt)(md);
       const response = result.data;
       if (!response?.answers || response.answers.length === 0) {
-        return new import_langchain83.ToolMessage({
+        return new import_langchain79.ToolMessage({
           content: "No clarification questions were answered.",
           tool_call_id: toolCall?.id,
           name: toolName2
@@ -42943,7 +41752,7 @@ function createAskUserClarifyMiddleware() {
         (answer) => (answer.selectedOptions?.length ?? 0) > 0 || answer.otherText && answer.otherText.trim() !== "" || answer.filePath && answer.filePath.trim() !== ""
       );
       if (answeredQuestions.length === 0) {
-        return new import_langchain83.ToolMessage({
+        return new import_langchain79.ToolMessage({
           content: "No clarification questions were answered.",
           tool_call_id: toolCall?.id,
           name: toolName2
@@ -42973,7 +41782,7 @@ function createAskUserClarifyMiddleware() {
         }
         lines.push("");
       }
-      return new import_langchain83.ToolMessage({
+      return new import_langchain79.ToolMessage({
         content: lines.join("\n"),
         tool_call_id: toolCall?.id,
         name: toolName2
@@ -42999,11 +41808,11 @@ var askUserClarifyPlugin = {
 };
 
 // src/middlewares/widgetMiddleware.ts
-var import_langchain86 = require("langchain");
+var import_langchain82 = require("langchain");
 
 // src/tool_lattice/widget/loadGuidelines.ts
-var import_langchain84 = require("langchain");
-var import_zod69 = require("zod");
+var import_langchain80 = require("langchain");
+var import_zod66 = require("zod");
 
 // src/middlewares/guidelines/index.ts
 var CORE = `# Imagine \u2014 Visual Creation Suite
@@ -43794,13 +42603,13 @@ function getGuidelines(modules) {
 var AVAILABLE_MODULES = Object.keys(MODULE_SECTIONS);
 
 // src/tool_lattice/widget/loadGuidelines.ts
-var LoadGuidelinesInputSchema = import_zod69.z.object({
-  modules: import_zod69.z.array(import_zod69.z.string()).describe(
+var LoadGuidelinesInputSchema = import_zod66.z.object({
+  modules: import_zod66.z.array(import_zod66.z.string()).describe(
     "Which design modules to load. Choose all that apply. Available modules: [" + AVAILABLE_MODULES.join(",") + "]"
   )
 });
 function createLoadGuidelinesTool() {
-  return (0, import_langchain84.tool)(
+  return (0, import_langchain80.tool)(
     async (input) => {
       const result = getGuidelines(input.modules);
       return result;
@@ -43814,8 +42623,8 @@ function createLoadGuidelinesTool() {
 }
 
 // src/tool_lattice/widget/showWidget.ts
-var import_langchain85 = require("langchain");
-var import_zod70 = require("zod");
+var import_langchain81 = require("langchain");
+var import_zod67 = require("zod");
 function containsForbiddenTags(code) {
   const forbiddenPatterns = [
     /<!DOCTYPE/i,
@@ -43837,20 +42646,20 @@ function validateWidgetCode(code) {
   }
   return { valid: true };
 }
-var ShowWidgetInputSchema = import_zod70.z.object({
-  i_have_seen_guidelines: import_zod70.z.boolean().describe(
+var ShowWidgetInputSchema = import_zod67.z.object({
+  i_have_seen_guidelines: import_zod67.z.boolean().describe(
     "Must be true. Confirm you have called load_guidelines first."
   ),
-  title: import_zod70.z.string().describe("Title displayed above the widget"),
-  loading_messages: import_zod70.z.array(import_zod70.z.string()).optional().describe(
+  title: import_zod67.z.string().describe("Title displayed above the widget"),
+  loading_messages: import_zod67.z.array(import_zod67.z.string()).optional().describe(
     "1-4 short strings shown while the widget renders"
   ),
-  widget_code: import_zod70.z.string().describe(
+  widget_code: import_zod67.z.string().describe(
     "HTML fragment to render. Rules: 1. No DOCTYPE, <html>, <head>, or <body> tags. 2. Order: <style> block first, then HTML content, then <script> last. 3. Use only CSS variables for colors (e.g. var(--color-accent)). 4. No gradients, shadows, or blur effects. For SVG: start directly with <svg> tag."
   )
 });
 function createShowWidgetTool() {
-  return (0, import_langchain85.tool)(
+  return (0, import_langchain81.tool)(
     async (input) => {
       if (!input.i_have_seen_guidelines) {
         return "Error: You must call load_guidelines before using show_widget. Set i_have_seen_guidelines to true only after loading guidelines.";
@@ -43881,7 +42690,7 @@ function createWidgetMiddleware() {
     createLoadGuidelinesTool(),
     createShowWidgetTool()
   ];
-  return (0, import_langchain86.createMiddleware)({
+  return (0, import_langchain82.createMiddleware)({
     name: "widgetMiddleware",
     contextSchema,
     tools
@@ -43905,9 +42714,67 @@ var widgetPlugin = {
 };
 
 // src/middlewares/taskMiddleware.ts
-var import_langchain87 = require("langchain");
-var import_zod71 = require("zod");
-var import_langgraph15 = require("@langchain/langgraph");
+var import_langchain83 = require("langchain");
+var import_zod68 = require("zod");
+var import_langgraph16 = require("@langchain/langgraph");
+
+// src/util/truncateForJson.ts
+var TRUNCATION_MARKER = "...[truncated]";
+function truncateString(value, cap) {
+  if (value.length <= cap) return value;
+  const budget = Math.max(0, cap - TRUNCATION_MARKER.length);
+  return value.slice(0, budget) + TRUNCATION_MARKER;
+}
+function truncateValue(value, depth, maxDepth, maxEntries, maxStringLength, seen) {
+  if (typeof value === "string") return truncateString(value, maxStringLength);
+  if (value === null || typeof value !== "object") return value;
+  if (depth >= maxDepth) return "[truncated:max-depth]";
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  try {
+    if (value instanceof Date) return value.toISOString();
+    if (Array.isArray(value)) {
+      const limit2 = Math.min(value.length, maxEntries);
+      const output2 = [];
+      for (let index = 0; index < limit2; index += 1) {
+        output2.push(truncateValue(value[index], depth + 1, maxDepth, maxEntries, maxStringLength, seen));
+      }
+      if (value.length > limit2) output2.push("[truncated:entries]");
+      return output2;
+    }
+    const record = value;
+    const output = {};
+    const keys = Object.keys(record);
+    const limit = Math.min(keys.length, maxEntries);
+    for (let index = 0; index < limit; index += 1) {
+      const key5 = keys[index];
+      output[truncateString(key5, maxStringLength)] = truncateValue(
+        record[key5],
+        depth + 1,
+        maxDepth,
+        maxEntries,
+        maxStringLength,
+        seen
+      );
+    }
+    if (keys.length > limit) output["[truncated]"] = true;
+    return output;
+  } finally {
+    seen.delete(value);
+  }
+}
+function truncateForJson(value, options = {}) {
+  return truncateValue(
+    value,
+    0,
+    options.maxDepth ?? JSON_SAFE_MAX_DEPTH,
+    options.maxEntries ?? JSON_SAFE_MAX_COLLECTION_ENTRIES,
+    options.maxStringLength ?? JSON_SAFE_MAX_STRING_LENGTH,
+    /* @__PURE__ */ new WeakSet()
+  );
+}
+
+// src/middlewares/taskMiddleware.ts
 var import_protocols33 = require("@axiom-lattice/protocols");
 
 // src/middlewares/taskResponseSerialization.ts
@@ -44232,6 +43099,132 @@ function getRuntimeActor2(runConfig) {
   if (runConfig.user_id) return `user:${String(runConfig.user_id)}`;
   return void 0;
 }
+function readRuntimeRunConfig(source) {
+  const s = source;
+  const rc = s?.context?.runConfig ?? s?.configurable?.runConfig;
+  return rc && typeof rc === "object" && !Array.isArray(rc) ? rc : {};
+}
+function readExecutionTaskId(runConfig) {
+  const execution = runConfig.execution;
+  if (!execution || typeof execution !== "object" || Array.isArray(execution)) return void 0;
+  const value = execution.taskId;
+  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function renderTaskBinding(taskId) {
+  return `
+
+## Bound Task
+
+You are executing task \`${taskId}\`. Read its contract with \`manage_task get\`, update it as you work, and complete it when done.
+`;
+}
+function createBoundTaskLifecycle() {
+  return createTaskLifecycleService({ taskStore: getTaskStore(), workItemStore: getTaskWorkItemStore() });
+}
+function createBoundTaskBridge() {
+  return createTaskRunBridge({ lifecycle: createBoundTaskLifecycle() });
+}
+function isResumableInterruption(interruption) {
+  if (!interruption || typeof interruption !== "object" || Array.isArray(interruption)) return false;
+  const type = interruption.type;
+  return type === "missing_input" || type === "user_decision";
+}
+var TASK_WORKER_OBSERVATION_MAX_CHARS = 8192;
+function snapshotMessages(state) {
+  if (!state || typeof state !== "object") return [];
+  const values = state.values;
+  if (!values || typeof values !== "object") return [];
+  const messages = values.messages;
+  return Array.isArray(messages) ? messages : [];
+}
+function messageText(value) {
+  if (typeof value === "string") return value;
+  if (!Array.isArray(value)) return void 0;
+  return value.flatMap((part) => {
+    if (typeof part === "string") return [part];
+    if (part && typeof part === "object" && typeof part.text === "string") {
+      return [part.text];
+    }
+    return [];
+  }).join("");
+}
+function lastAssistantText(source) {
+  const messages = Array.isArray(source) ? source : source && typeof source === "object" && Array.isArray(source.messages) ? source.messages : snapshotMessages(source);
+  for (let index = messages.length - 1; index >= 0; index -= 1) {
+    const message = messages[index];
+    if (!message || typeof message !== "object") continue;
+    const role = message.role ?? message.type;
+    if (role !== "ai" && role !== "assistant") continue;
+    const text = messageText(message.content);
+    if (text !== void 0) return text;
+  }
+  return void 0;
+}
+function boundedWorkerObservation(result, state) {
+  const text = lastAssistantText(state) ?? lastAssistantText(result) ?? "";
+  return {
+    status: "completed",
+    output: truncateForJson(text, { maxStringLength: TASK_WORKER_OBSERVATION_MAX_CHARS })
+  };
+}
+var EXECUTOR_CACHE_TTL_MS = 3e4;
+var executorCache = /* @__PURE__ */ new Map();
+function executorString(value) {
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+async function renderAvailableExecutors(rc, tenantId2) {
+  const authority = classifyTaskAuthority(rc);
+  const governed = authority.kind === "projectRoom" || authority.kind === "projectTask";
+  const projectId = governed ? (authority.trusted.projectTask ?? authority.trusted.projectRoom)?.projectId : void 0;
+  const cacheKey = `${tenantId2}:${governed ? `project:${projectId ?? ""}` : "ordinary"}`;
+  const cached = executorCache.get(cacheKey);
+  const now = Date.now();
+  if (cached && now - cached.at < EXECUTOR_CACHE_TTL_MS) return cached.text;
+  const lines = [];
+  try {
+    if (governed && projectId) {
+      const store = getStoreLattice("default", "projectBotMembership").store;
+      if (typeof store.list === "function") {
+        const bots = await store.list(tenantId2, projectId);
+        for (const bot of (Array.isArray(bots) ? bots : []).slice(0, 40)) {
+          const row = bot;
+          if (row.status !== "active") continue;
+          const id = executorString(row.assistantId);
+          if (!id) continue;
+          const title = executorString(row.title);
+          const responsibility = executorString(row.responsibility);
+          lines.push(`- ${id}${title ? ` \u2014 ${title}` : ""}${responsibility ? ` (${responsibility})` : ""}`);
+        }
+      }
+    } else {
+      const configs = await agentLatticeManager.getAllAgentConfigsByTenant(tenantId2);
+      for (const config of configs.slice(0, 40)) {
+        const row = config;
+        const id = executorString(row.key);
+        if (!id) continue;
+        const name = executorString(row.name);
+        const description = executorString(row.description);
+        lines.push(`- ${id}${name ? ` \u2014 ${name}` : ""}${description ? ` (${description.slice(0, 120)})` : ""}`);
+      }
+    }
+  } catch {
+  }
+  if (lines.length === 0) {
+    executorCache.set(cacheKey, { at: now, text: "" });
+    return "";
+  }
+  const header = governed ? "## Available task executors (Project roster)" : "## Available task executors";
+  const text = `
+
+${header}
+
+Dispatch \`task\` only to an executor that has the tools the work needs (for example \`update_agent\`/\`create_agent\` for materialization). Never dispatch to the subject agent you are building. Use \`general-purpose\` to run your own capabilities.
+
+${lines.join("\n")}
+`;
+  executorCache.set(cacheKey, { at: now, text });
+  return text;
+}
 function delegatedTaskScopeError(taskId) {
   return JSON.stringify({
     success: false,
@@ -44599,65 +43592,75 @@ function buildReviewMarkdown(task) {
     result: task.result
   });
 }
-var manageTaskSchema = import_zod71.z.object({
-  action: import_zod71.z.enum(["create", "get", "list", "update", "set_status", "add_activity", "delete"]).describe("Action to perform. Available: create, get, list, update, set_status, add_activity, delete. To change status, use set_status. To change content fields, use update."),
-  id: import_zod71.z.string().optional().describe("Task ID (required for get, update, add_activity, and delete)"),
-  title: import_zod71.z.string().optional().describe("Task title (required for create)"),
-  description: import_zod71.z.string().optional().describe("Task description in Markdown"),
-  priority: import_zod71.z.enum(["low", "medium", "high"]).optional().describe("Priority level"),
-  status: import_zod71.z.enum(["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"]).optional().describe("Task status. For status-only changes, prefer set_status action. Agent summary-only interrupted updates default to missing_input"),
-  dueDate: import_zod71.z.string().optional().describe("Due date (ISO 8601 format)"),
-  metadata: import_zod71.z.record(import_zod71.z.unknown()).optional().describe("Structured metadata (e.g. projectId, module)"),
-  metadataFilter: import_zod71.z.record(
-    import_zod71.z.union([import_zod71.z.string(), import_zod71.z.number(), import_zod71.z.boolean()])
+var manageTaskSchema = import_zod68.z.object({
+  action: import_zod68.z.enum(["create", "get", "list", "update", "set_status", "add_activity", "delete"]).describe("Action to perform. Available: create, get, list, update, set_status, add_activity, delete. To change status, use set_status. To change content fields, use update."),
+  id: import_zod68.z.string().optional().describe("Task ID (required for get, update, add_activity; required for delete unless ids is given)"),
+  title: import_zod68.z.string().optional().describe("Task title (required for create)"),
+  description: import_zod68.z.string().optional().describe("Task description in Markdown"),
+  priority: import_zod68.z.enum(["low", "medium", "high"]).optional().describe("Priority level"),
+  status: import_zod68.z.enum(["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"]).optional().describe("Task status. For status-only changes, prefer set_status action. Set 'in_progress' when you start processing a task you hold; 'completed'/'failed' require the task to be 'in_progress'. Agent summary-only interrupted updates default to missing_input"),
+  dueDate: import_zod68.z.string().optional().describe("Due date (ISO 8601 format)"),
+  metadata: import_zod68.z.record(import_zod68.z.unknown()).optional().describe("Structured metadata (e.g. projectId, module)"),
+  metadataFilter: import_zod68.z.record(
+    import_zod68.z.union([import_zod68.z.string(), import_zod68.z.number(), import_zod68.z.boolean()])
   ).optional().describe("List-only filter. Every key must equal the task metadata value, e.g. {projectId:'p1', retries:2}. Multiple keys AND together."),
-  parentId: import_zod71.z.string().optional().describe("Parent task ID for grouping subtasks"),
-  sourceId: import_zod71.z.string().optional().describe("Source session/thread ID"),
-  context: import_zod71.z.record(import_zod71.z.unknown()).optional().describe("Additional context data"),
-  ownerType: import_zod71.z.enum(["user", "agent"]).optional().describe("Owner type. Defaults to 'user' if omitted"),
-  ownerId: import_zod71.z.string().optional().describe("Owner ID. Auto-filled from current user/agent if omitted"),
-  requireReview: import_zod71.z.boolean().optional().describe("If true, agent completion pauses as interrupted(review_required) for HITL approval"),
-  dependencies: import_zod71.z.array(import_zod71.z.string()).optional().describe("List of task IDs that must be completed before this task can start"),
-  dependencyTaskIds: import_zod71.z.array(import_zod71.z.string().trim().min(1)).optional().describe("Exact blocking task IDs required for an external_dependency interruption"),
-  result: import_zod71.z.string().optional().describe("Result summary. Used with set_status status='completed' or update status='completed'"),
-  failureReason: import_zod71.z.string().optional().describe("Failure reason. Used with set_status status='failed' or update status='failed'"),
-  files: import_zod71.z.array(import_zod71.z.object({
-    uri: import_zod71.z.string().describe("Uniquely locates the resource: http(s):// URL, /s/:token share, or sandbox path"),
-    name: import_zod71.z.string().optional().describe("Display name"),
-    addedBy: import_zod71.z.enum(["user", "agent"]).optional().describe("Who attached the file")
+  parentId: import_zod68.z.string().optional().describe("Parent task ID for grouping subtasks"),
+  sourceId: import_zod68.z.string().optional().describe("Source session/thread ID"),
+  context: import_zod68.z.record(import_zod68.z.unknown()).optional().describe("Additional context data"),
+  ownerType: import_zod68.z.enum(["user", "agent"]).optional().describe("Owner type. Defaults to 'user' if omitted"),
+  ownerId: import_zod68.z.string().optional().describe("Owner ID. Auto-filled from current user/agent if omitted"),
+  requireReview: import_zod68.z.boolean().optional().describe("If true, agent completion pauses as interrupted(review_required) for HITL approval"),
+  dependencies: import_zod68.z.array(import_zod68.z.string()).optional().describe("List of task IDs that must be completed before this task can start"),
+  dependencyTaskIds: import_zod68.z.array(import_zod68.z.string().trim().min(1)).optional().describe("Exact blocking task IDs required for an external_dependency interruption"),
+  result: import_zod68.z.string().optional().describe("Result summary. Used with set_status status='completed' or update status='completed'"),
+  failureReason: import_zod68.z.string().optional().describe("Failure reason. Used with set_status status='failed' or update status='failed'"),
+  files: import_zod68.z.array(import_zod68.z.object({
+    uri: import_zod68.z.string().describe("Uniquely locates the resource: http(s):// URL, /s/:token share, or sandbox path"),
+    name: import_zod68.z.string().optional().describe("Display name"),
+    addedBy: import_zod68.z.enum(["user", "agent"]).optional().describe("Who attached the file")
   })).optional().describe("File references attached to this task"),
-  beliefImpact: import_zod71.z.array(import_zod71.z.object({
-    key: import_zod71.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
-    after: import_zod71.z.number().int().min(0).max(100),
-    basis: import_zod71.z.string().trim().min(1).max(1e3),
-    isNew: import_zod71.z.boolean().optional().describe("Set true only to add a belief key that is absent from the belief owner's Belief State; omit for keys that already exist")
+  beliefImpact: import_zod68.z.array(import_zod68.z.object({
+    key: import_zod68.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+    after: import_zod68.z.number().int().min(0).max(100),
+    basis: import_zod68.z.string().trim().min(1).max(1e3),
+    isNew: import_zod68.z.boolean().optional().describe("Set true only to add a belief key that is absent from the belief owner's Belief State; omit for keys that already exist")
   })).optional().describe("Structured belief reports required when an agent-owned task completes; existing keys update the belief owner's table, and a brand-new key must be declared with isNew: true"),
-  content: import_zod71.z.string().optional().describe("Markdown content required for add_activity"),
-  summary: import_zod71.z.string().optional().describe("Brief summary of the operation"),
-  executionResultId: import_zod71.z.string().refine(import_protocols33.isExecutionResultEventKey, {
+  content: import_zod68.z.string().optional().describe("Markdown content required for add_activity"),
+  summary: import_zod68.z.string().optional().describe("Brief summary of the operation"),
+  executionResultId: import_zod68.z.string().refine(import_protocols33.isExecutionResultEventKey, {
     message: "executionResultId must be the execution-result:<threadId> event key returned by task()"
   }).optional().describe(
     "Canonical ASCII `execution-result:<suffix>` event key returned by task(); the nonempty suffix allows only A-Z, a-z, 0-9, period, underscore, colon, and hyphen, and is not a database row ID"
-  )
+  ),
+  ids: import_zod68.z.array(import_zod68.z.string().trim().min(1)).optional().describe("Task IDs to delete in one batch (delete action only). Use with or instead of id.")
 }).superRefine((input, context) => {
   if (input.executionResultId && input.action !== "update" && input.action !== "set_status" && input.action !== "add_activity") {
     context.addIssue({
-      code: import_zod71.z.ZodIssueCode.custom,
+      code: import_zod68.z.ZodIssueCode.custom,
       path: ["executionResultId"],
       message: "executionResultId is valid only for update, set_status, or add_activity"
     });
   }
   if (input.metadataFilter && input.action !== "list") {
     context.addIssue({
-      code: import_zod71.z.ZodIssueCode.custom,
+      code: import_zod68.z.ZodIssueCode.custom,
       path: ["metadataFilter"],
       message: "metadataFilter is valid only for list"
     });
   }
+  if (input.ids && input.action !== "delete") {
+    context.addIssue({
+      code: import_zod68.z.ZodIssueCode.custom,
+      path: ["ids"],
+      message: "ids is valid only for delete"
+    });
+  }
 });
-var startTaskSchema = import_zod71.z.object({
-  taskId: import_zod71.z.string().trim().min(1).describe("ID of the persisted TaskItem to start"),
-  agentId: import_zod71.z.string().trim().min(1).describe("ID of the Agent that should execute the task")
+var startTaskSchema = import_zod68.z.object({
+  taskId: import_zod68.z.string().trim().min(1).describe("ID of the persisted TaskItem to start"),
+  agentId: import_zod68.z.string().trim().min(1).describe(
+    `ID of the Agent that should execute the task. Use "general-purpose" to run the caller's own capabilities as an isolated worker.`
+  )
 });
 function mergeTaskUpdateWarnings(existing, added) {
   const warnings = [...existing ?? [], ...added ?? []];
@@ -44794,6 +43797,49 @@ function createTaskMiddleware(options = {}) {
     }
     const ownerId = input.ownerId || trustedScope?.assistantId || (input.ownerType === "agent" ? rc.assistant_id : null) || rc.user_id;
     const store = getTaskStore();
+    const deleteOneTask = async (id) => {
+      if (delegatedTaskId && id !== delegatedTaskId) {
+        return delegatedTaskScopeError(delegatedTaskId);
+      }
+      const existing = await store.getById(tenantId2, id);
+      if (!existing) {
+        return JSON.stringify({
+          success: false,
+          code: "TASK_NOT_FOUND",
+          error: `Task '${id}' was not found.`,
+          hint: "Use manage_task list to see available tasks and their correct IDs."
+        });
+      }
+      if (!taskMatchesRuntimeScope3(existing, workspaceId, projectId)) {
+        return taskScopeAccessError(id);
+      }
+      if (trustedProject?.projectTask) {
+        const trustedFailure = trustedTaskContextFailure(existing, trustedProject.projectTask);
+        if (trustedFailure) return trustedFailure;
+      }
+      let deleted;
+      if (trustedProject) {
+        const snapshot = taskMutationSnapshot(existing);
+        if (!snapshot) return trustedContextError();
+        try {
+          await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
+        } catch (error) {
+          return projectPolicyError(error);
+        }
+        deleted = await store.deleteIfSnapshot(tenantId2, id, snapshot);
+      } else {
+        deleted = await store.delete(tenantId2, id);
+      }
+      if (!deleted) {
+        return JSON.stringify({
+          success: false,
+          code: "TASK_DELETE_FAILED",
+          error: `Task '${id}' was not found or could not be deleted.`,
+          hint: "Use manage_task list to verify the task exists and you have access to it."
+        });
+      }
+      return JSON.stringify({ success: true, message: `Task '${id}' deleted` });
+    };
     switch (input.action) {
       case "create": {
         if (delegatedTaskId && input.parentId !== delegatedTaskId) {
@@ -44949,9 +43995,6 @@ function createTaskMiddleware(options = {}) {
             hint: "Pass the task ID you want to retrieve"
           });
         }
-        if (delegatedTaskId && input.id !== delegatedTaskId) {
-          return delegatedTaskScopeError(delegatedTaskId);
-        }
         const task = await store.getById(tenantId2, input.id);
         if (!task) {
           return JSON.stringify({
@@ -44997,25 +44040,6 @@ function createTaskMiddleware(options = {}) {
         });
       }
       case "list": {
-        if (delegatedTaskId) {
-          const delegatedTask = await store.getById(tenantId2, delegatedTaskId);
-          if (!delegatedTask || !taskMatchesRuntimeScope3(delegatedTask, workspaceId, projectId)) {
-            return serializeTaskReadResponse({ success: true, data: [], count: 0 });
-          }
-          const children = await store.list({
-            tenantId: tenantId2,
-            workspaceId,
-            projectId,
-            parentId: delegatedTaskId,
-            metadata: input.metadataFilter
-          });
-          const scopedChildren = children.filter((child) => child.id !== delegatedTaskId && child.parentId === delegatedTaskId && exactScopeMatch(child, delegatedTask));
-          return serializeTaskReadResponse({
-            success: true,
-            data: [delegatedTask, ...scopedChildren],
-            count: scopedChildren.length + 1
-          });
-        }
         const filter2 = {
           tenantId: tenantId2,
           ownerType: input.ownerType,
@@ -45610,41 +44634,31 @@ function createTaskMiddleware(options = {}) {
           });
           return lifecycleMutationResponse(interrupted);
         }
-        if (lifecycle && input.status === "in_progress" && existing.status === "interrupted") {
-          await validateExecutionResult();
-          const callerError = await revalidateCaller();
-          if (callerError) return callerError;
-          const resumed = await lifecycle.resumeInterruption({
-            tenantId: tenantId2,
-            taskId: input.id,
-            actor,
-            threadId: statusThreadId
-          });
-          return lifecycleMutationResponse(resumed);
-        }
-        if (lifecycle && input.status === "in_progress" && existing.status === "pending") {
-          await validateExecutionResult();
+        if (lifecycle && input.status === "in_progress") {
           const callerError = await revalidateCaller();
           if (callerError) return callerError;
-          const started = await lifecycle.startTask({
-            tenantId: tenantId2,
-            taskId: input.id,
-            actor,
-            threadId: statusThreadId
-          });
-          return lifecycleMutationResponse(started);
-        }
-        if (lifecycle && input.status === "in_progress" && existing.status === "failed") {
-          await validateExecutionResult();
-          const callerError = await revalidateCaller();
-          if (callerError) return callerError;
-          const retried = await lifecycle.retryTask({
+          if (existing.status === "interrupted") {
+            return lifecycleMutationResponse(await lifecycle.resumeInterruption({
+              tenantId: tenantId2,
+              taskId: input.id,
+              actor,
+              threadId: statusThreadId
+            }));
+          }
+          if (existing.status === "failed") {
+            return lifecycleMutationResponse(await lifecycle.retryTask({
+              tenantId: tenantId2,
+              taskId: input.id,
+              actor,
+              threadId: statusThreadId
+            }));
+          }
+          return lifecycleMutationResponse(await lifecycle.startTask({
             tenantId: tenantId2,
             taskId: input.id,
             actor,
             threadId: statusThreadId
-          });
-          return lifecycleMutationResponse(retried);
+          }));
         }
         const effectiveRequireReview = existing.requireReview === true || input.requireReview === true;
         const candidateReviewInterruption = input.status === "interrupted" && input.context?.interruption && typeof input.context.interruption === "object" && input.context.interruption.type === "review_required" && !!input.result?.trim();
@@ -45711,9 +44725,9 @@ function createTaskMiddleware(options = {}) {
           }
           let response;
           try {
-            response = await (0, import_langgraph15.interrupt)(buildReviewMarkdown(submitted.task));
+            response = await (0, import_langgraph16.interrupt)(buildReviewMarkdown(submitted.task));
           } catch (error) {
-            if (error instanceof import_langgraph15.GraphInterrupt) throw error;
+            if (error instanceof import_langgraph16.GraphInterrupt) throw error;
             return lifecycleMutationResponse(submitted, { code: "REVIEW_REQUIRED" });
           }
           if (response?.action === "approve") {
@@ -45825,54 +44839,49 @@ function createTaskMiddleware(options = {}) {
         return successfulTaskResponse(input.id, updatedStatus, true);
       }
       case "delete": {
-        if (!input.id) {
-          return JSON.stringify({
-            success: false,
-            error: "id is required for delete action",
-            hint: "Pass the task ID you want to delete"
-          });
-        }
-        if (delegatedTaskId && input.id !== delegatedTaskId) {
-          return delegatedTaskScopeError(delegatedTaskId);
-        }
-        const existing = await store.getById(tenantId2, input.id);
-        if (!existing) {
-          return JSON.stringify({
-            success: false,
-            code: "TASK_NOT_FOUND",
-            error: `Task '${input.id}' was not found.`,
-            hint: "Use manage_task list to see available tasks and their correct IDs."
-          });
-        }
-        if (!taskMatchesRuntimeScope3(existing, workspaceId, projectId)) {
-          return taskScopeAccessError(input.id);
-        }
-        if (trustedProject?.projectTask) {
-          const trustedFailure = trustedTaskContextFailure(existing, trustedProject.projectTask);
-          if (trustedFailure) return trustedFailure;
+        const missingTargetError = JSON.stringify({
+          success: false,
+          error: "id or ids is required for delete action",
+          hint: "Pass the task ID(s) you want to delete"
+        });
+        const requestedIds = input.ids && input.ids.length > 0 ? [.../* @__PURE__ */ new Set([...input.id ? [input.id] : [], ...input.ids])] : void 0;
+        if (requestedIds === void 0) {
+          if (!input.id) {
+            return missingTargetError;
+          }
+          return deleteOneTask(input.id);
         }
-        let deleted;
-        if (trustedProject) {
-          const snapshot = taskMutationSnapshot(existing);
-          if (!snapshot) return trustedContextError();
+        const deletedIds = [];
+        const failed = [];
+        for (const id of requestedIds) {
+          let raw;
           try {
-            await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
+            raw = await deleteOneTask(id);
           } catch (error) {
-            return projectPolicyError(error);
+            failed.push({
+              id,
+              code: "TASK_DELETE_FAILED",
+              error: error instanceof Error ? error.message : String(error)
+            });
+            continue;
+          }
+          const result = JSON.parse(raw);
+          if (result.success) {
+            deletedIds.push(id);
+          } else {
+            failed.push({
+              id,
+              ...result.code ? { code: result.code } : {},
+              error: result.error ?? `Task '${id}' could not be deleted.`
+            });
           }
-          deleted = await store.deleteIfSnapshot(tenantId2, input.id, snapshot);
-        } else {
-          deleted = await store.delete(tenantId2, input.id);
-        }
-        if (!deleted) {
-          return JSON.stringify({
-            success: false,
-            code: "TASK_DELETE_FAILED",
-            error: `Task '${input.id}' was not found or could not be deleted.`,
-            hint: "Use manage_task list to verify the task exists and you have access to it."
-          });
         }
-        return JSON.stringify({ success: true, message: `Task '${input.id}' deleted` });
+        return JSON.stringify({
+          success: failed.length === 0,
+          deleted: deletedIds,
+          failed,
+          summary: `${deletedIds.length} of ${requestedIds.length} deleted`
+        });
       }
       default:
         return JSON.stringify({
@@ -45987,23 +44996,29 @@ function createTaskMiddleware(options = {}) {
         error: "Runtime actor identity is required for persistent task execution"
       });
     }
+    const callerAssistantId = rc.assistant_id;
+    const agentId = input.agentId === "general-purpose" && callerAssistantId ? `${callerAssistantId}-general-purpose` : input.agentId;
     const service2 = createTaskExecutionService({
       taskStore: getTaskStore(),
       workItemStore: getTaskWorkItemStore(),
-      resolveAgent: async (targetTenantId, agentId) => !!await agentLatticeManager.getOrLoadWithTenant(targetTenantId, agentId),
-      resolveTaskCapability: async (targetTenantId, agentId) => agentHasManagedTaskCapability(
-        (await agentLatticeManager.getOrLoadWithTenant(targetTenantId, agentId))?.config
-      ),
+      resolveAgent: async (targetTenantId, agentId2) => !!await agentLatticeManager.getOrLoadWithTenant(targetTenantId, agentId2),
       invokeAgent: async (invocation) => {
-        const worker = new Agent({
-          tenant_id: invocation.tenantId,
+        const workerResult = await agentWorkerGraph.invoke({
           assistant_id: invocation.agentId,
           thread_id: invocation.threadId,
-          workspace_id: invocation.workspaceId,
-          project_id: invocation.projectId,
-          custom_run_config: createDelegatedWorkerRunConfig(invocation.taskId)
+          input: { message: invocation.message },
+          runConfig: {
+            ...rc,
+            assistant_id: invocation.agentId,
+            thread_id: invocation.threadId,
+            taskId: invocation.taskId,
+            tenantId: invocation.tenantId,
+            workspaceId: invocation.workspaceId,
+            projectId: invocation.projectId
+          }
         });
-        return worker.invoke({ input: { message: invocation.message } });
+        const finalState = workerResult?.finalState;
+        return boundedWorkerObservation(finalState, void 0);
       }
     });
     const trustedCaller = authority.kind === "projectTask" || authority.kind === "projectRoom" ? authority.trusted.projectTask ?? authority.trusted.projectRoom : void 0;
@@ -46012,15 +45027,75 @@ function createTaskMiddleware(options = {}) {
       workspaceId: rc.workspaceId,
       projectId: rc.projectId,
       taskId: input.taskId,
-      agentId: input.agentId,
+      agentId,
       actor,
       callerThreadId: rc.thread_id,
       ...trustedCaller ? { callerMembershipId: trustedCaller.membershipId, callerAssistantId: trustedCaller.assistantId } : {}
     }));
   };
-  return (0, import_langchain87.createMiddleware)({
+  return (0, import_langchain83.createMiddleware)({
     name: "TaskMiddleware",
     contextSchema,
+    // Persisted between invocations (ADRs: the run↔task binding survives turns).
+    stateSchema: import_zod68.z.object({
+      taskId: import_zod68.z.string().default("")
+    }),
+    // CLAIM: a run that holds a task moves it to in_progress (idempotent).
+    beforeAgent: async (state, runtime) => {
+      const rc = readRuntimeRunConfig(runtime);
+      const bound = typeof state?.taskId === "string" ? state.taskId : "";
+      const taskId = bound || readExecutionTaskId(rc) || "";
+      if (!taskId) return {};
+      if (!taskId) return {};
+      const tenantId2 = rc.tenantId || "default";
+      const threadId = runtime?.configurable?.thread_id;
+      const task = await getTaskStore().getById(tenantId2, taskId);
+      if (!task) return {};
+      const runWorkspaceId = typeof rc.workspaceId === "string" ? rc.workspaceId : void 0;
+      const runProjectId = typeof rc.projectId === "string" ? rc.projectId : void 0;
+      if (task.workspaceId && task.workspaceId !== runWorkspaceId) return {};
+      if (task.projectId && task.projectId !== runProjectId) return {};
+      if (task.status === "completed" || task.status === "failed" || task.status === "cancelled") {
+        return bound ? {} : { taskId };
+      }
+      taskRunRegistry.register(taskId);
+      if (task.status === "pending") {
+        await createBoundTaskBridge().beginRun({
+          tenantId: tenantId2,
+          task,
+          actor: getRuntimeActor2(rc) ?? "system",
+          ...threadId ? { threadId } : {}
+        });
+      } else if (task.status === "interrupted" && isResumableInterruption(task.context?.interruption)) {
+        await createBoundTaskLifecycle().resumeInterruption({
+          tenantId: tenantId2,
+          taskId: task.id,
+          actor: getRuntimeActor2(rc) ?? "system",
+          ...threadId ? { threadId } : {}
+        });
+      }
+      return bound ? {} : { taskId };
+    },
+    // SETTLE: a run that ends without a lifecycle transition converges the task.
+    afterAgent: async (state, runtime) => {
+      const taskId = typeof state?.taskId === "string" ? state.taskId : "";
+      if (!taskId) return {};
+      const rc = readRuntimeRunConfig(runtime);
+      const tenantId2 = rc.tenantId || "default";
+      const threadId = runtime?.configurable?.thread_id;
+      const task = await getTaskStore().getById(tenantId2, taskId);
+      if (task?.status === "in_progress" && task.context?.thread_id === threadId) {
+        await createBoundTaskBridge().settleRun({
+          tenantId: tenantId2,
+          task,
+          actor: getRuntimeActor2(rc) ?? "system",
+          ...threadId ? { threadId } : {},
+          outcome: { kind: "interrupted", summary: "Run ended without a task lifecycle transition" }
+        });
+      }
+      taskRunRegistry.unregister(taskId);
+      return {};
+    },
     wrapModelCall: async (request, handler) => {
       const taskPrompt = `## Task Management
 
@@ -46029,8 +45104,11 @@ ongoing record of a GOAL and its ACCEPTANCE CRITERIA.
 
 ### When to create a task
 - Agent-owned work is multi-step and needs a persistent contract and plan ->
-  create the parent task FIRST (a \`pending\` record), then either execute it
-  inline and keep the status truthful, or dispatch it with \`task\`.
+  create the parent task FIRST (a \`pending\` record), then process it in this run;
+  mark it \`in_progress\` with \`manage_task set_status\` when you start, and
+  \`completed\` when the acceptance criteria are met. To bring in an
+  expert, create a subtask and dispatch it with \`task { taskId, agentId }\` \u2014 never
+  re-dispatch the task you are processing.
 - Persistence is useful for resumption, review, or visibility across the
   independently verifiable business results.
 
@@ -46060,13 +45138,17 @@ ${TASK_CONVERGENCE_GUIDANCE}
 - No params: ownerType defaults to "user" with current user's ID
 - ownerType="agent": auto-fills ownerId from current agent (subtask for yourself)
 - Explicit ownerId: assign to a specific agent or user`;
+      const boundTaskId = request.state?.taskId;
+      const binding = typeof boundTaskId === "string" && boundTaskId ? renderTaskBinding(boundTaskId) : "";
+      const rc = readRuntimeRunConfig(request.runtime);
+      const executors = await renderAvailableExecutors(rc, rc.tenantId || "default");
       return handler({
         ...request,
-        systemPrompt: taskPrompt + "\n\n" + (request.systemPrompt ?? "")
+        systemPrompt: taskPrompt + binding + executors + "\n\n" + (request.systemPrompt ?? "")
       });
     },
     tools: [
-      (0, import_langchain87.tool)(
+      (0, import_langchain83.tool)(
         handleManageTask,
         {
           name: "manage_task",
@@ -46087,15 +45169,14 @@ ${TASK_CONVERGENCE_GUIDANCE}
 - update: Update a task's content fields (title/description/priority/dueDate/metadata/parentId/sourceId/context/ownerId/result/failureReason/requireReview/dependencies/files)
   Status changes can also be done here, but use set_status for a simpler dedicated status update.
 - set_status: Change a task's status (id and status required). Use this when you only need to change the status.
-  Valid status values: pending, in_progress, review, failed, interrupted, completed, cancelled
-  Companion fields: result (for completed), failureReason (for failed), summary (for any status)
-  To mark complete: set_status with status='completed', result='...'
+  Start processing a task you hold: set_status with status='in_progress' (the engine binds it to this run's thread).
+  To mark complete: set_status with status='completed', result='...' (the task must be in_progress)
   To mark failed: set_status with status='failed', failureReason='...'
   To pause for input: set_status with status='interrupted', summary='what is needed'
-  Status can be freely changed to any valid value \u2014 no restrictions on transitions.
+  Valid status values: pending, in_progress, review, failed, interrupted, completed, cancelled.
   set_status only changes the record; it never dispatches execution (only the \`task\` tool does).
 - add_activity: Add a Markdown activity without changing task fields or status (id and content required)
-- delete: Delete a task (id required)
+- delete: Delete one task by id, or a batch with ids (best-effort per id; returns deleted/failed lists). At least one of id/ids is required.
 
 ## Agent completion beliefs
 Completing an agent-owned task MAY include a beliefImpact array reporting which
@@ -46106,14 +45187,16 @@ Report existing keys directly; set 'isNew: true' to add a key the owner does not
 track yet. Belief is evidence metadata: it never blocks a completion, and an
 unmatched or malformed entry is recorded without changing the owner's table.
 Create always persists a pending record \u2014 a supplied status is coerced and no
-execution is dispatched. Only dispatching runs a task through the queue; an
-agent may also work inline and update status.`,
+execution is dispatched. When you start processing a task you hold, set it
+\`in_progress\` with \`manage_task set_status\`; a dispatched task is claimed
+automatically by the engine. Use \`task { taskId, agentId }\` to delegate a subtask
+to an expert \u2014 never re-dispatch the task you are processing.`,
           schema: manageTaskSchema
         }
       ),
-      (0, import_langchain87.tool)(handleStartTask, {
+      (0, import_langchain83.tool)(handleStartTask, {
         name: "task",
-        description: "Start a persisted TaskItem with any Agent in a fresh isolated thread. An ordinary task returns an observation plus executionResultId that the caller passes to the manage_task update or add_activity that interprets it; a project task returns a managed result (success:true, managed:true) because the project-lifecycle queue owns execution.",
+        description: `Start a persisted TaskItem with any existing Agent in a fresh isolated thread. Use this to delegate work \u2014 dispatch a subtask you created to the agent that should execute it; never re-dispatch the task you are currently processing (give the expert a child task instead). Pass agentId "general-purpose" for the general-purpose worker \u2014 ${DEFAULT_GENERAL_PURPOSE_DESCRIPTION} It has access to all the caller's tools, model, and middleware, so use it for general-purpose subtasks, to isolate context and token usage, and whenever no specialized agent fits. The target does NOT need task-management tools: it runs and returns an observation plus an executionResultId, and the caller passes that executionResultId to the manage_task update or add_activity that interprets and records it. A project task instead returns a managed result (success:true, managed:true) because the project-lifecycle queue owns execution.`,
         schema: startTaskSchema
       })
     ]
@@ -46256,7 +45339,7 @@ canonical Belief State:
 
 // src/middlewares/documentLearningMiddleware.ts
 var import_protocols34 = require("@axiom-lattice/protocols");
-var import_langchain88 = require("langchain");
+var import_langchain84 = require("langchain");
 
 // src/middlewares/documentLearningSkills.ts
 var LEARN_CAPABILITY_SKILL = `---
@@ -46495,7 +45578,7 @@ patterns discovered, recommendations. Include validation coverage: user-sample N
 `;
 
 // src/middlewares/documentLearningMiddleware.ts
-var createDocumentLearningMiddleware = () => (0, import_langchain88.createMiddleware)({
+var createDocumentLearningMiddleware = () => (0, import_langchain84.createMiddleware)({
   name: "DocumentLearningMiddleware",
   contextSchema,
   tools: []
@@ -46613,12 +45696,12 @@ var documentLearningPlugin = {
 };
 
 // src/middlewares/documentParserMiddleware.ts
-var import_langchain90 = require("langchain");
+var import_langchain86 = require("langchain");
 
 // src/tool_lattice/document_parser/index.ts
 var path7 = __toESM(require("path"));
-var import_zod72 = __toESM(require("zod"));
-var import_langchain89 = require("langchain");
+var import_zod69 = __toESM(require("zod"));
+var import_langchain85 = require("langchain");
 var PARSE_DOCUMENT_DESCRIPTION = `Parse a document file (docx, pdf) into structured Markdown using a remote document parsing service.
 This tool handles the full pipeline internally: file upload \u2192 document parsing \u2192 polling until complete \u2192 download result \u2192 save to filesystem.
 
@@ -46741,7 +45824,7 @@ function createParseDocumentTool({
   baseUrl = "",
   apiKey = ""
 }) {
-  return (0, import_langchain89.tool)(
+  return (0, import_langchain85.tool)(
     async (input, exe_config) => {
       try {
         const runConfig = exe_config?.configurable?.runConfig ?? { assistant_id: "", thread_id: "" };
@@ -46812,17 +45895,17 @@ function createParseDocumentTool({
     {
       name: "parse_document",
       description: PARSE_DOCUMENT_DESCRIPTION,
-      schema: import_zod72.default.object({
-        file_path: import_zod72.default.string().describe(
+      schema: import_zod69.default.object({
+        file_path: import_zod69.default.string().describe(
           'Absolute path to the document file. Must point to an existing .docx or .pdf file. Example: "/project/reports/contract.docx". The file must be accessible from the current workspace.'
         ),
-        engine: import_zod72.default.string().describe(
+        engine: import_zod69.default.string().describe(
           'Parsing engine to use. Available options: "textin" (recommended, works with local files, supports docx/pdf), "datalab" (alternative engine for docx/pdf), "mineru" (requires public URL, use only if textin/datalab fail), "paddleocr_remote" (PaddleOCR, good for scanned documents), "qwen_ocr" (OCR-focused, best for image-heavy PDFs).'
         ),
-        output_path: import_zod72.default.string().optional().describe(
+        output_path: import_zod69.default.string().optional().describe(
           'Path to save the parsed result. If not specified, the input extension is replaced with .md. Example: "/project/report.docx" becomes "/project/report.md". Parent directories are created automatically.'
         ),
-        output_format: import_zod72.default.enum(["markdown", "json"]).optional().default("markdown").describe(
+        output_format: import_zod69.default.enum(["markdown", "json"]).optional().default("markdown").describe(
           'Output format. "markdown": structured Markdown with tables, headers, formatting preserved (recommended). "json": raw JSON output from the parsing engine (for programmatic use).'
         )
       })
@@ -47240,7 +46323,7 @@ def main() -> None:
 if __name__ == "__main__":
     main()
 `;
-var resources2 = {
+var resources = {
   "references/api_reference.md": { mimeType: "text/markdown", content: `# API reference
 
 The supported command-line form is 'markitdown input -o output.md'. The Python API uses 'MarkItDown().convert(path)' upstream, but this runtime prefers the installed CLI and does not provide direct Python SDK LLM calls. Use local conversion for local files and keep output as Markdown.` },
@@ -47269,7 +46352,7 @@ Single file: 'markitdown input -o output.md'. Ordinary directory: 'scripts/batch
 var DOCUMENT_PARSER_MARKITDOWN_SKILL = {
   version: "1.1.0",
   content: MARKITDOWN_SKILL_CONTENT,
-  resources: resources2
+  resources
 };
 
 // src/middlewares/documentParserMiddleware.ts
@@ -47278,7 +46361,7 @@ function createDocumentParserMiddleware(config) {
   const baseUrl = config.baseUrl || "";
   const apiKey = config.apiKey || "";
   const connections = Array.isArray(config.connections) ? config.connections.filter((key5) => typeof key5 === "string") : [];
-  return (0, import_langchain90.createMiddleware)({
+  return (0, import_langchain86.createMiddleware)({
     name: "DocumentParser",
     contextSchema,
     tools: [createParseDocumentTool({ connectAll, connections, baseUrl, apiKey })]
@@ -47394,8 +46477,8 @@ var documentParserPlugin = {
 // src/middlewares/projectRoomMiddleware.ts
 var import_crypto10 = require("crypto");
 var import_protocols36 = require("@axiom-lattice/protocols");
-var import_langchain91 = require("langchain");
-var import_zod73 = require("zod");
+var import_langchain87 = require("langchain");
+var import_zod70 = require("zod");
 var PROJECT_ROOM_CONTEXT_REQUIRED = "PROJECT_ROOM_CONTEXT_REQUIRED";
 var PROJECT_ROOM_POST_FAILED = "PROJECT_ROOM_POST_FAILED";
 var PROJECT_ROOM_ROSTER_FAILED = "PROJECT_ROOM_ROSTER_FAILED";
@@ -47415,10 +46498,10 @@ var ROSTER_FAILED = JSON.stringify({
   error: PROJECT_ROOM_ROSTER_FAILED,
   message: PROJECT_ROOM_ROSTER_FAILED_MESSAGE
 });
-var postSchema = import_zod73.z.object({
-  text: import_zod73.z.string().trim().min(1).max(2e4)
+var postSchema = import_zod70.z.object({
+  text: import_zod70.z.string().trim().min(1).max(2e4)
 }).strict();
-var listSchema = import_zod73.z.object({}).strict();
+var listSchema = import_zod70.z.object({}).strict();
 function ownDataValue2(record, key5) {
   if (typeof record !== "object" || record === null || Array.isArray(record)) return void 0;
   try {
@@ -47485,10 +46568,10 @@ async function hasActiveCurrentMembership(scope) {
   return true;
 }
 function createProjectRoomMiddleware() {
-  return (0, import_langchain91.createMiddleware)({
+  return (0, import_langchain87.createMiddleware)({
     name: "ProjectRoomMiddleware",
     tools: [
-      (0, import_langchain91.tool)(async (input, config) => {
+      (0, import_langchain87.tool)(async (input, config) => {
         const { text } = input;
         const scope = readTrustedRoomScope(config);
         if (!scope) return CONTEXT_REQUIRED;
@@ -47519,7 +46602,7 @@ function createProjectRoomMiddleware() {
         description: "Post a text reply to the current trusted Project Room message",
         schema: postSchema
       }),
-      (0, import_langchain91.tool)(async (_input, config) => {
+      (0, import_langchain87.tool)(async (_input, config) => {
         const scope = readTrustedRoomScope(config);
         if (!scope) return CONTEXT_REQUIRED;
         try {
@@ -47561,8 +46644,8 @@ var projectRoomPlugin = {
 };
 
 // src/middlewares/sandboxPluginsMiddleware.ts
-var import_langchain92 = require("langchain");
-var import_zod74 = require("zod");
+var import_langchain88 = require("langchain");
+var import_zod71 = require("zod");
 var import_protocols37 = require("@axiom-lattice/protocols");
 
 // src/middlewares/sandboxPluginsSkills.ts
@@ -48284,16 +47367,16 @@ function tenantIdFrom(exeConfig) {
   const c = exeConfig;
   return c?.configurable?.runConfig?.tenantId ?? "default";
 }
-var managePluginSchema = import_zod74.z.object({
-  action: import_zod74.z.enum(["list", "get", "validate", "create", "update", "delete", "reload", "test"]),
-  type: import_zod74.z.string().optional(),
-  manifest: import_zod74.z.record(import_zod74.z.unknown()).optional(),
-  handlers: import_zod74.z.record(import_zod74.z.string()).optional(),
-  target: import_zod74.z.object({
-    kind: import_zod74.z.enum(["tool", "connection-test", "connection-discover"]),
-    name: import_zod74.z.string().optional(),
-    input: import_zod74.z.unknown().optional(),
-    connectionKey: import_zod74.z.string().optional()
+var managePluginSchema = import_zod71.z.object({
+  action: import_zod71.z.enum(["list", "get", "validate", "create", "update", "delete", "reload", "test"]),
+  type: import_zod71.z.string().optional(),
+  manifest: import_zod71.z.record(import_zod71.z.unknown()).optional(),
+  handlers: import_zod71.z.record(import_zod71.z.string()).optional(),
+  target: import_zod71.z.object({
+    kind: import_zod71.z.enum(["tool", "connection-test", "connection-discover"]),
+    name: import_zod71.z.string().optional(),
+    input: import_zod71.z.unknown().optional(),
+    connectionKey: import_zod71.z.string().optional()
   }).optional()
 });
 var sandboxPluginsPlugin = {
@@ -48367,10 +47450,10 @@ var sandboxPluginsPlugin = {
       ]
     }
   },
-  middleware: () => (0, import_langchain92.createMiddleware)({
+  middleware: () => (0, import_langchain88.createMiddleware)({
     name: "SandboxPluginsMiddleware",
     tools: [
-      (0, import_langchain92.tool)(
+      (0, import_langchain88.tool)(
         async (input, exeConfig) => {
           const tenantId2 = tenantIdFrom(exeConfig);
           const catalog2 = getSandboxPluginCatalog();
@@ -48511,7 +47594,6 @@ var BUILTIN_PLUGINS = [
   sqlPlugin,
   skillPlugin,
   metricsPlugin,
-  semanticMetricsPlugin,
   askUserClarifyPlugin,
   widgetPlugin,
   clawPlugin,
@@ -49087,6 +48169,7 @@ registerBuiltinPlugins();
   TaskLifecycleNotifier,
   TaskLifecycleService,
   TaskRunBridgeStoresRequiredError,
+  TaskRunRegistry,
   TaskStatus,
   TeamAgentGraphBuilder,
   TenantPluginCatalog,
@@ -49098,7 +48181,6 @@ registerBuiltinPlugins();
   VectorStoreProviderManager,
   VolumeFilesystem,
   abortWorkflowRun,
-  agentHasManagedTaskCapability,
   agentInstanceManager,
   agentLatticeManager,
   appendReconciliationWarning,
@@ -49151,7 +48233,6 @@ registerBuiltinPlugins();
   createSandboxProvider,
   createSandboxResolver,
   createSchedulerMiddleware,
-  createSemanticMetricsMiddleware,
   createSharePayload,
   createTaskExecutionService,
   createTaskLifecycleService,
@@ -49273,6 +48354,9 @@ registerBuiltinPlugins();
   projectTaskAdmissionNotifier,
   queueLatticeManager,
   readLoopBreakerConfig,
+  reconcileAllTenantTaskRuns,
+  reconcileStaleTaskRuns,
+  reconcileTenantTaskRuns,
   registerAgentLattice,
   registerAgentLatticeWithTenant,
   registerAgentLattices,
@@ -49307,7 +48391,6 @@ registerBuiltinPlugins();
   sandboxLatticeManager,
   sanitizeToolCallId,
   scheduleLatticeManager,
-  semanticMetricsPlugin,
   serializePluginMeta,
   serializeTaskMutationSuccess,
   serializeTaskNormalizationFallback,
@@ -49321,6 +48404,7 @@ registerBuiltinPlugins();
   storeLatticeManager,
   sttModelLatticeManager,
   taskLifecycleNotifier,
+  taskRunRegistry,
   toJsonSchema,
   toSafeStateExpr,
   toolLatticeManager,