@cleocode/contracts 2026.5.134 → 2026.6.0

package/src/__tests__/operations-registry.test.ts

@@ -50,4 +50,18 @@ describe('operations-registry', () => {
     const result = defineDomain('tasks', ops);
     expect(result).toBe(ops);
   });
+
+  it('registers tasks.relates.add-batch as a mutate op (T11575)', () => {
+    // Regression guard for T11575: the handler + CLI command shipped but the
+    // OperationDef was missing, so the dispatcher rejected every call with
+    // E_INVALID_OPERATION before it reached the handler.
+    const op = OPERATIONS.find((o) => o.domain === 'tasks' && o.operation === 'relates.add-batch');
+    expect(op).toBeDefined();
+    expect(op?.gateway).toBe('mutate');
+    // The CLI accepts either { relations:[...] } or { edges:[...] }, so neither
+    // is individually required at the dispatch boundary.
+    expect(op?.requiredParams).toEqual([]);
+    const paramNames = (op?.params ?? []).map((p) => p.name);
+    expect(paramNames).toEqual(expect.arrayContaining(['relations', 'edges', 'dryRun']));
+  });
 });

package/src/__tests__/skill-executor-contract.test.ts

@@ -0,0 +1,104 @@
+/**
+ * Contract tests for the `SkillExecutor` DIP seam
+ * (`@cleocode/contracts/tools/skill-executor`, P1 · T11476).
+ *
+ * Pins the dispatcher-facing abstraction so the concrete in-process
+ * `SkillExecutorAdapter` (T11477) binds to a stable, runtime-decoupled shape.
+ * Types-only module — these are type-level assertions exercised via a fake.
+ *
+ * @epic T11391
+ * @task T11476
+ * @saga T11387
+ */
+
+import { describe, expect, it } from 'vitest';
+import type {
+  ExecuteShellResult,
+  PathExistsResult,
+  ReadFileResult,
+  WriteFileResult,
+} from '../tools/atomic.js';
+import type {
+  GuardedToolSurface,
+  SkillExecuteInput,
+  SkillExecuteResult,
+  SkillExecuteStatus,
+  SkillExecutor,
+} from '../tools/skill-executor.js';
+
+/** Minimal in-test guarded surface — every method routes to a typed stub. */
+const fakeTools: GuardedToolSurface = {
+  async readFileText(input): Promise<ReadFileResult> {
+    return { path: input.path, content: '' };
+  },
+  async readJson<T>(_path: string): Promise<T> {
+    return {} as T;
+  },
+  async writeFileAtomic(input): Promise<WriteFileResult> {
+    return { path: input.path, bytesWritten: 0 };
+  },
+  async pathExists(_input): Promise<PathExistsResult> {
+    return { exists: false };
+  },
+  async executeShell(_input): Promise<ExecuteShellResult> {
+    return { stdout: '', stderr: '', code: 0 };
+  },
+  async runGit(_input): Promise<ExecuteShellResult> {
+    return { stdout: '', stderr: '', code: 0 };
+  },
+};
+
+/** A fake SkillExecutor — proves the abstraction is implementable by injection. */
+const fakeExecutor: SkillExecutor = {
+  async execute(input: SkillExecuteInput): Promise<SkillExecuteResult> {
+    if (input.skillId === 'boom') {
+      return { status: 'failure', output: {}, error: 'kaboom' };
+    }
+    return { status: 'success', output: { ranSkill: input.skillId } };
+  },
+};
+
+describe('SkillExecutor DIP seam (AC1)', () => {
+  it('execute() accepts { skillId, context, tools } and resolves a terminal envelope', async () => {
+    const result = await fakeExecutor.execute({
+      skillId: 'noop',
+      context: { foo: 'bar' },
+      tools: fakeTools,
+    });
+    expect(result.status).toBe<SkillExecuteStatus>('success');
+    expect(result.output).toEqual({ ranSkill: 'noop' });
+    expect(result.error).toBeUndefined();
+  });
+
+  it('surfaces a failure envelope with status + error', async () => {
+    const result = await fakeExecutor.execute({
+      skillId: 'boom',
+      context: {},
+      tools: fakeTools,
+    });
+    expect(result.status).toBe<SkillExecuteStatus>('failure');
+    expect(result.error).toBe('kaboom');
+    expect(result.output).toEqual({});
+  });
+});
+
+describe('GuardedToolSurface dependency (AC2)', () => {
+  it('the injected tools surface exposes the guarded atomic primitives', async () => {
+    const input: SkillExecuteInput = { skillId: 's', context: {}, tools: fakeTools };
+    const read = await input.tools.readFileText({ path: '/abs/x.ts' });
+    expect(read.path).toBe('/abs/x.ts');
+    const wrote = await input.tools.writeFileAtomic({ path: '/abs/y.ts', content: 'z' });
+    expect(wrote.bytesWritten).toBe(0);
+    const shell = await input.tools.executeShell({ command: 'true' });
+    expect(shell.code).toBe(0);
+    const git = await input.tools.runGit({ args: ['status'] });
+    expect(git.code).toBe(0);
+  });
+});
+
+describe('result-status taxonomy', () => {
+  it('SkillExecuteStatus is exactly success | failure', () => {
+    const statuses: SkillExecuteStatus[] = ['success', 'failure'];
+    expect(statuses).toEqual(['success', 'failure']);
+  });
+});

package/src/backup-manifest.ts

@@ -76,7 +76,7 @@ export interface BackupDatabaseEntry {
   /**
    * Latest applied migration identifier.
    * For Drizzle-managed DBs: folderMillis string (e.g. "20260327000000").
-   * For signaldock.db: SIGNALDOCK_SCHEMA_VERSION constant.
+   * For signaldock.db: AGENT_REGISTRY_SCHEMA_VERSION constant.
    */
   schemaVersion: string;
   /**

package/src/brain-graph.ts

@@ -62,7 +62,7 @@ export type BrainNodeKind =
  * that bridge runtime output to the wire format translate between the two
  * naming planes at the adapter boundary.
  */
-export type BrainSubstrate = 'brain' | 'nexus' | 'tasks' | 'conduit' | 'signaldock';
+export type BrainSubstrate = 'brain' | 'nexus' | 'tasks' | 'conduit' | 'agent-registry';
 
 // ---------------------------------------------------------------------------
 // Canonical graph node
@@ -77,7 +77,7 @@ export type BrainSubstrate = 'brain' | 'nexus' | 'tasks' | 'conduit' | 'signaldo
  * - `"nexus:sym-123"` — a nexus code symbol
  * - `"tasks:T949"` — a CLEO task
  * - `"conduit:msg-7f3a2b1c"` — a conduit message
- * - `"signaldock:agent-cleo-prime"` — a SignalDock agent
+ * - `"agent-registry:agent-cleo-prime"` — an Agent Registry agent
  *
  * @remarks
  * This is the shape produced by all substrate adapters in `@cleocode/brain`

package/src/config.ts

@@ -451,6 +451,58 @@ export interface LlmRoleConfig {
    * inherits the default credential resolution order.
    */
   credentialLabel?: string;
+  /**
+   * Optional reference to a named profile in {@link LlmConfig.profiles}. When
+   * set, the named profile's `provider` / `model` / `credentialLabel` take
+   * precedence over this entry's inline `provider` / `model` — letting many
+   * roles share one reusable provider+model definition (hermes-agent's
+   * profile-mapping model).
+   *
+   * @task T11617
+   */
+  profile?: string;
+}
+
+/**
+ * Tuning parameters carried by a named LLM profile.
+ *
+ * @task T11617
+ */
+export interface LlmProfileTuning {
+  /** Default maximum tokens to generate for calls bound to this profile. */
+  maxTokens?: number;
+  /** Default sampling temperature (0.0–1.0) for calls bound to this profile. */
+  temperature?: number;
+}
+
+/**
+ * A named, reusable LLM profile.
+ *
+ * A profile names a `provider` + `model` (+ optional credential label and
+ * tuning params) ONCE so that multiple call-sites/roles can bind to it by name
+ * instead of repeating the inline tuple. This is the "Profile" abstraction
+ * modeled on hermes-agent's `auxiliary.<task>` provider bindings — the user
+ * selects which provider fulfills a profile, and roles map to profiles.
+ *
+ * Profiles live in {@link LlmConfig.profiles}; roles reference them via
+ * {@link LlmRoleConfig.profile} and the default binding via
+ * {@link LlmConfig.defaultProfile}.
+ *
+ * @task T11617
+ */
+export interface LlmProfileConfig {
+  /** LLM provider transport this profile resolves to. */
+  provider: LlmProviderTransport;
+  /** Full model identifier for the selected provider. */
+  model: string;
+  /**
+   * Optional credential label pinning this profile to a specific credential
+   * pool entry (e.g. `'codex-cli'` for the OpenAI Codex OAuth token). When
+   * omitted, the standard priority-based credential resolution applies.
+   */
+  credentialLabel?: string;
+  /** Optional tuning parameters (max tokens, temperature). */
+  params?: LlmProfileTuning;
 }
 
 /**
@@ -482,11 +534,31 @@ export interface LlmConfig {
   /**
    * Per-role LLM overrides. Each role optionally pins to a credential label.
    *
-   * Resolution order: `roles[role]` → `default` → implicit fallback.
+   * Resolution order: `roles[role].profile` → `roles[role]` (inline) →
+   * `defaultProfile` → `default` → implicit fallback.
    *
    * @task T-LLM-CRED-CENTRALIZATION Phase 4 (T9306)
    */
   roles?: Partial<Record<RoleName, LlmRoleConfig>>;
+  /**
+   * Named, reusable LLM profiles keyed by profile name. Roles bind to a
+   * profile via {@link LlmRoleConfig.profile}; the unscoped default binding is
+   * {@link LlmConfig.defaultProfile}. Modeled on hermes-agent's
+   * provider→profile mapping for "what to use when".
+   *
+   * @task T11617
+   */
+  profiles?: Record<string, LlmProfileConfig>;
+  /**
+   * Name of the profile (a key of {@link LlmConfig.profiles}) used for any
+   * role that does NOT pin its own provider/model/profile. This is the
+   * user-selectable default binding for background roles — it is NEVER a
+   * hardcoded provider in code; the owner re-selects it with
+   * `cleo llm bind --default <profileName>`.
+   *
+   * @task T11617
+   */
+  defaultProfile?: string;
 }
 
 /** SignalDock transport mode. */

package/src/db-inventory.json

@@ -87,8 +87,8 @@
       "role": "signaldock-project",
       "tier": "project",
       "filePathTemplate": "<projectRoot>/.cleo/signaldock.db",
-      "drizzleSchemaPath": "packages/core/src/store/schema/signaldock-schema.ts",
-      "migrationsDir": "packages/core/migrations/drizzle-signaldock/",
+      "drizzleSchemaPath": "packages/core/src/store/schema/agent-registry-schema.ts",
+      "migrationsDir": "packages/core/migrations/drizzle-agent-registry/",
       "ownerPackage": "@cleocode/core",
       "openedVia": "HISTORICAL — project-tier signaldock.db was migrated into conduit.db post-T310/ADR-037. No live opener; charter row retained for migration provenance and legacy backup detection.",
       "concurrency": "single-writer",
@@ -100,8 +100,8 @@
       "role": "signaldock-global",
       "tier": "global",
       "filePathTemplate": "$XDG_DATA_HOME/cleo/signaldock.db",
-      "drizzleSchemaPath": "packages/core/src/store/schema/signaldock-schema.ts",
-      "migrationsDir": "packages/core/migrations/drizzle-signaldock/",
+      "drizzleSchemaPath": "packages/core/src/store/schema/agent-registry-schema.ts",
+      "migrationsDir": "packages/core/migrations/drizzle-agent-registry/",
       "ownerPackage": "@cleocode/core",
       "openedVia": "openCleoDb('signaldock')",
       "concurrency": "single-writer",

package/src/dispatch/operations-registry.ts

@@ -2676,6 +2676,51 @@ export const OPERATIONS: OperationDef[] = [
       },
     ] satisfies ParamDef[],
   },
+  {
+    // T11575 — the handler (dispatch/domains/tasks.ts 'relates.add-batch') and
+    // CLI command (cli/commands/relates.ts add-batch) shipped, but no
+    // OperationDef existed here, so `resolve()` returned undefined and the
+    // dispatcher rejected the call with E_INVALID_OPERATION before it ever
+    // reached the handler. Registering the op (gateway:'mutate') closes the gap.
+    gateway: 'mutate',
+    domain: 'tasks',
+    operation: 'relates.add-batch',
+    description:
+      'tasks.relates.add-batch (mutate) — bulk-add advisory relation edges from a JSON payload ({relations:[...]} or {edges:[...]}); use dryRun to preview without writing.',
+    tier: 1,
+    idempotent: false,
+    sessionRequired: false,
+    // Neither `relations` nor `edges` is individually required — the handler
+    // accepts either shape and validates emptiness in core — so no param is
+    // declared required at the dispatch boundary.
+    requiredParams: [],
+    params: [
+      {
+        name: 'relations',
+        type: 'array',
+        required: false,
+        description: 'Array of relation edges ({from|taskId, to|relatedId, type, reason})',
+      },
+      {
+        name: 'edges',
+        type: 'array',
+        required: false,
+        description: 'Alias for `relations` — array of relation edges',
+      },
+      {
+        name: 'dryRun',
+        type: 'boolean',
+        required: false,
+        description: 'Validate and report what would be created without writing',
+      },
+      {
+        name: 'reasonWaiver',
+        type: 'string',
+        required: false,
+        description: 'Explicit audit waiver text for edges without per-edge reasons',
+      },
+    ] satisfies ParamDef[],
+  },
   {
     gateway: 'mutate',
     domain: 'tasks',

package/src/exit-codes.ts

@@ -247,6 +247,26 @@ export enum ExitCode {
    * @adr ADR-079-r4
    */
   AC_COVERAGE_INCOMPLETE = 108,
+
+  /**
+   * E_CANCELLED_CHILD_NO_WAIVER — `cleo complete <parentId>` was rejected
+   * because the parent has one or more `cancelled` children that have NOT been
+   * waived or replaced. A cancelled child represents work that was NOT done;
+   * silently treating it as satisfied lets a parent complete as if cancelled
+   * work had shipped (PM-Core V2 design-point 4 — agent-trust completion).
+   *
+   * `error.details.cancelledChildIds` lists the offending children. Recovery:
+   *   1. Record an audited waiver for the cancelled children via
+   *      `cleo complete <parentId> --waive-cancelled-children "<reason>"`
+   *      (logged to `.cleo/audit/cancelled-child-waiver.jsonl`).
+   *   2. Re-open and finish the work (the child stops being cancelled).
+   *   3. Replace the cancelled work with a new done child and waive the
+   *      original, citing the replacement task id in the reason.
+   *
+   * @codeName E_CANCELLED_CHILD_NO_WAIVER
+   * @saga T10538 (PM-Core V2 agent-trust)
+   */
+  CANCELLED_CHILD_NO_WAIVER = 109,
 }
 
 // ---------------------------------------------------------------------------

package/src/index.ts

@@ -263,6 +263,8 @@ export type {
   LifecycleEnforcementMode,
   LlmConfig,
   LlmDefaultConfig,
+  LlmProfileConfig,
+  LlmProfileTuning,
   LlmProviderEntry,
   LlmProviderTransport,
   LlmRoleConfig,
@@ -829,6 +831,14 @@ export type {
   PatternRecord,
   SessionSummary,
 } from './memory.js';
+export type {
+  MigrationEnumDrift,
+  MigrationForeignKeyViolation,
+  MigrationTableParity,
+  VerifyMigrationResult,
+} from './migration-parity.js';
+// === Migration Parity (T11551 — DHQ-045 exodus zero-loss durable guard) ===
+export { MIGRATION_ENUM_DRIFT_SAMPLE_LIMIT } from './migration-parity.js';
 // === MVI progressive-disclosure primitive (T11349 · Epic T11285 · Saga T11283) ===
 export type {
   ExpansionHint,
@@ -1939,12 +1949,12 @@ export {
 } from './status-registry.js';
 // === Sub-Accessor Contracts (T9188) ===
 export type {
+  AgentRegistrySubAccessor,
   BrainAccessor,
   BrainMemoryHit,
   BrainObserveParams,
   ConduitAccessor,
   NexusAccessor,
-  SignaldockAccessor,
   TelemetryAccessor,
 } from './sub-accessors.js';
 export type {

package/src/migration-parity.ts

@@ -0,0 +1,178 @@
+/**
+ * Migration-parity contracts — the structured result of a generic
+ * source→target SQLite migration equivalence check.
+ *
+ * These types describe the output of the reusable CORE `verifyMigration()`
+ * primitive (T11551 · DHQ-045), the durable guard that prevents the exodus
+ * dual-DB migration from silently losing rows ever again.
+ *
+ * ## Why a structured contract
+ *
+ * The exodus zero-loss campaign (T11531/46/47/48/49/T11550) lost ~805K rows
+ * as-shipped because the original verify path returned a loose boolean and a
+ * free-text error. A typed parity report makes each failure class
+ * machine-inspectable:
+ *
+ *   - **Row-count parity** — per (source-table → target-table) row counts.
+ *   - **Foreign-key integrity** — the `PRAGMA foreign_key_check` rows on the
+ *     consolidated target (genuine data orphans, not copy-order artifacts).
+ *   - **Content checksum** — an ordered canonical-JSON digest per table, over
+ *     the intersection of source/target columns, so content drift is caught
+ *     even when counts match.
+ *   - **Enum/type drift** — values present in a source column that are NOT in
+ *     the target column's CHECK enum. This is the exact failure class that
+ *     `INSERT OR IGNORE` used to swallow silently.
+ *
+ * @task T11551 (DHQ-045 — exodus zero-loss durable guard)
+ * @epic T10878
+ * @saga T11242
+ * @adr ADR-068, ADR-069
+ * @public
+ */
+
+/**
+ * Per-table row-count + content-checksum parity entry.
+ *
+ * Produced for every legacy source table that maps to a consolidated target
+ * table. `countMatch` and `hashMatch` together decide whether the table copied
+ * losslessly: a `false` on either is a parity failure.
+ *
+ * @public
+ */
+export interface MigrationTableParity {
+  /** Physical table name in the legacy source DB. */
+  readonly sourceTable: string;
+  /** Physical table name in the consolidated target DB (after name-mapping). */
+  readonly targetTable: string;
+  /**
+   * Logical scope label for the target table (`'project'` | `'global'` for
+   * exodus; an opaque string for other migrations).
+   */
+  readonly scope: string;
+  /** Row count in the source legacy table. */
+  readonly sourceCount: number;
+  /** Row count in the consolidated target table. */
+  readonly targetCount: number;
+  /** Ordered canonical-JSON SHA-256 digest (32 hex) of the source rows. */
+  readonly sourceHash: string;
+  /** Ordered canonical-JSON SHA-256 digest (32 hex) of the target rows. */
+  readonly targetHash: string;
+  /** `true` when `sourceCount === targetCount`. */
+  readonly countMatch: boolean;
+  /** `true` when `sourceHash === targetHash`. */
+  readonly hashMatch: boolean;
+}
+
+/**
+ * A single orphan row surfaced by `PRAGMA foreign_key_check` on the
+ * consolidated target after migration.
+ *
+ * Each entry mirrors one row of the `PRAGMA foreign_key_check` result: the
+ * child `table`, the offending `rowid`, the referenced `parent` table, and the
+ * `fkid` (the index of the foreign-key constraint within that table).
+ *
+ * A non-empty list means the migrated data has referential orphans — NOT
+ * copy-order artifacts (the migration copies with `foreign_keys=OFF` and checks
+ * afterward). The parity gate fails only on orphans the migration *introduced*
+ * (those absent from the source); pre-existing source orphans are carried
+ * forward losslessly and tolerated (T11572).
+ *
+ * @public
+ */
+export interface MigrationForeignKeyViolation {
+  /** Child table containing the orphan row. */
+  readonly table: string;
+  /** `rowid` of the orphan row (or `null` for WITHOUT ROWID tables). */
+  readonly rowid: number | null;
+  /** Referenced parent table that has no matching row. */
+  readonly parent: string;
+  /** Index of the violated foreign-key constraint within `table`. */
+  readonly fkid: number;
+}
+
+/**
+ * An enum/type-drift finding — a value present in a source column that the
+ * target column's CHECK constraint enum does NOT accept.
+ *
+ * This is the exact class that `INSERT OR IGNORE` silently dropped during the
+ * un-hardened exodus migration. The migration layer normalises known drift
+ * (legacy enum aliases, epoch→ISO timestamps) before insert; any value that
+ * still cannot be coerced surfaces here so the gate fails loudly rather than
+ * dropping rows.
+ *
+ * @public
+ */
+export interface MigrationEnumDrift {
+  /** Physical target table name whose column has the CHECK enum. */
+  readonly targetTable: string;
+  /** Column name carrying the CHECK enum on the target. */
+  readonly column: string;
+  /**
+   * Up to {@link MIGRATION_ENUM_DRIFT_SAMPLE_LIMIT} distinct source values that
+   * are NOT members of the target enum. Truncated for legibility; `driftCount`
+   * is the true total of out-of-enum source rows.
+   */
+  readonly offendingValues: readonly string[];
+  /** The canonical enum members accepted by the target CHECK constraint. */
+  readonly allowedValues: readonly string[];
+  /** Total number of source rows whose value is outside the target enum. */
+  readonly driftCount: number;
+}
+
+/**
+ * Maximum number of distinct offending values captured per
+ * {@link MigrationEnumDrift} entry, to keep the report bounded.
+ *
+ * @public
+ */
+export const MIGRATION_ENUM_DRIFT_SAMPLE_LIMIT = 20 as const;
+
+/**
+ * Aggregate result of {@link MigrationTableParity} / FK / enum-drift checks for
+ * a single source→target migration verification pass.
+ *
+ * `ok === true` IFF every table has `countMatch && hashMatch`, the
+ * `introducedForeignKeyViolations` list is empty (pre-existing source orphans do
+ * NOT fail the strict check — T11572), AND no {@link MigrationEnumDrift} was
+ * detected. When `ok === false`, `error` is ALWAYS populated with a
+ * human-readable failure summary (the false-pass guard from T11531).
+ *
+ * @public
+ */
+export interface VerifyMigrationResult {
+  /** `true` only when every parity, FK, and enum-drift check passed. */
+  readonly ok: boolean;
+  /** Per-table row-count + checksum parity entries. */
+  readonly tables: readonly MigrationTableParity[];
+  /**
+   * ALL orphan rows from `PRAGMA foreign_key_check` on the consolidated target —
+   * both pre-existing (already orphaned in the SOURCE) and migration-introduced.
+   *
+   * NOTE: this list is NOT, on its own, a data-loss signal. A legacy source DB
+   * can carry pre-existing orphans (rows whose parent was deleted before the
+   * migration); those copy through faithfully (zero loss) and are NOT a migration
+   * failure. Use {@link introducedForeignKeyViolations} for the data-loss gate.
+   */
+  readonly foreignKeyViolations: readonly MigrationForeignKeyViolation[];
+  /**
+   * Orphans present on the consolidated TARGET that the SOURCE did NOT already
+   * have — i.e. referential integrity the migration *worsened* (a parent row the
+   * migration dropped). This is the FK class that indicates genuine data loss and
+   * is the one the cutover parity gate fails on. Empty when the migration only
+   * carried forward pre-existing source orphans (T11572).
+   */
+  readonly introducedForeignKeyViolations: readonly MigrationForeignKeyViolation[];
+  /**
+   * Orphans that ALREADY existed in the SOURCE before migration (a data-hygiene
+   * pre-condition, not a migration defect). Carried forward as-is (zero loss);
+   * surfaced as a WARN for a follow-up clean-up, never an abort (T11572).
+   */
+  readonly preExistingForeignKeyViolations: readonly MigrationForeignKeyViolation[];
+  /** Enum/type-drift findings (source values outside the target CHECK enum). */
+  readonly enumDrift: readonly MigrationEnumDrift[];
+  /**
+   * Human-readable failure summary, populated whenever `ok === false`.
+   * `undefined` on success.
+   */
+  readonly error?: string;
+}

package/src/operations/admin.ts

@@ -30,9 +30,11 @@
 
 /**
  * Known transport categories for token recording.
- * Mirrors `TokenTransport` from `@cleocode/core`.
+ * Mirrors `TokenTransport` from `@cleocode/core`. `'mcp'` is a first-class
+ * origin (MCP-gateway requests); it is preserved verbatim, never coerced to
+ * `'agent'` (T11649).
  */
-export type AdminTokenTransport = 'cli' | 'api' | 'agent' | 'unknown';
+export type AdminTokenTransport = 'cli' | 'api' | 'agent' | 'mcp' | 'unknown';
 
 /**
  * Token measurement method classification.

package/src/operations/brain.ts

@@ -55,7 +55,7 @@
  *
  * @task T962 / T968
  */
-export type BrainSubstrateName = 'memory' | 'nexus' | 'tasks' | 'conduit' | 'signaldock';
+export type BrainSubstrateName = 'memory' | 'nexus' | 'tasks' | 'conduit' | 'agent-registry';
 
 /**
  * Concrete node type within a substrate (e.g. `observation`, `symbol`,
@@ -75,7 +75,7 @@ export type BrainNodeType = string;
  *   "memory:O-mo4abc123"
  *   "nexus:packages/core/src/store/sqlite-data-accessor.ts::createSqliteDataAccessor"
  *   "conduit:msg-7f3a2b1c"
- *   "signaldock:agent-cleo-prime"
+ *   "agent-registry:agent-cleo-prime"
  *
  * @remarks
  * The substrate prefix (before the first `:`) MUST match one of

package/src/operations/llm.ts

@@ -205,14 +205,22 @@ export interface CredentialResultWire {
  *
  * Resolution chain order:
  *   1. `role`               — `config.llm.roles[role]` (explicit override)
- *   2. `default`            — `config.llm.default` (canonical default)
- *   3. `implicit-fallback`  — hard-coded fallback inside the resolver
+ *   2. `profile`            — `config.llm.profiles[roles[role].profile]`
+ *   3. `default`            — `config.llm.default` (canonical default)
+ *   4. `default-profile`    — `config.llm.profiles[config.llm.defaultProfile]`
+ *   5. `implicit-fallback`  — hard-coded fallback inside the resolver
  *
  * Useful for `cleo llm whoami` diagnostics.
  *
  * @task T9306
- */
-export type ResolutionSource = 'role' | 'default' | 'implicit-fallback';
+ * @task T11617 (`profile`, `default-profile`)
+ */
+export type ResolutionSource =
+  | 'role'
+  | 'profile'
+  | 'default'
+  | 'default-profile'
+  | 'implicit-fallback';
 
 /**
  * Result envelope returned by `resolveLLMForRole(role)`.

package/src/operations/tasks.ts

@@ -1449,6 +1449,16 @@ export interface TasksCompleteQueryParams {
    * @task T10509
    */
   waiveReason?: string;
+  /**
+   * Reason for waiving the `E_CANCELLED_CHILD_NO_WAIVER` gate (PM-Core V2
+   * design-point 4). When the parent has `cancelled` children, completion is
+   * blocked unless this waiver is supplied — a cancelled child is abandoned
+   * work and must not silently satisfy parent completion. Recorded to
+   * `.cleo/audit/cancelled-child-waiver.jsonl`.
+   *
+   * @saga T10538 (PM-Core V2 agent-trust)
+   */
+  cancelledChildWaiverReason?: string;
 }
 /**
  * Result of `tasks.complete` — completion confirmation with unblocked tasks.

package/src/sub-accessors.ts

@@ -8,7 +8,7 @@
  *   - BrainAccessor        → brain.db (memory observations, semantic graph)
  *   - ConduitAccessor      → conduit.db (project-scoped messaging)
  *   - NexusAccessor        → nexus.db (code intelligence graph)
- *   - SignaldockAccessor   → signaldock.db (global agent identity)
+ *   - AgentRegistrySubAccessor   → signaldock.db (global agent identity)
  *   - TelemetryAccessor    → (future — telemetry collection)
  *
  * See DocsAccessor in docs-accessor.ts for the docs/llmtxt sub-accessor.
@@ -149,18 +149,18 @@ export interface NexusAccessor {
 }
 
 // ---------------------------------------------------------------------------
-// SignaldockAccessor
+// AgentRegistrySubAccessor
 // ---------------------------------------------------------------------------
 
 /**
- * SignaldockAccessor — typed interface for signaldock.db (global agent identity).
+ * AgentRegistrySubAccessor — typed interface for signaldock.db (global agent identity).
  *
- * Minimal surface for T9188; full signaldock API lives in signaldock-sqlite.ts.
+ * Minimal surface for T9188; full signaldock API lives in agent-registry-store.ts.
  *
  * @task T9188
  * @epic T9048
  */
-export interface SignaldockAccessor {
+export interface AgentRegistrySubAccessor {
   /**
    * Check whether signaldock.db is open and accessible.
    *