@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/templates/skills/delegate-work/files/scripts/codex-exec.sh

@@ -26,7 +26,7 @@
 # Env overrides (flags -m/-e take precedence):
 #   CODEX_MODEL   default: gpt-5.6-sol          gpt-5.6-sol | gpt-5.6-terra | gpt-5.6-luna
 #   CODEX_EFFORT  default: high                 reasoning effort (never "fast"/low)
-#   CODEX_SANDBOX default: workspace-write      read-only | workspace-write | danger-full-access
+#   CODEX_SANDBOX default: workspace-write (passed to codex's -s option)
 #   CODEX_BYPASS  set to 1 to use --dangerously-bypass-approvals-and-sandbox
 #                 (fully unsandboxed — opt in only when a phase must write
 #                 outside its worktree; overrides CODEX_SANDBOX)

package/templates/skills/scheduling/content.md

@@ -45,6 +45,8 @@ Tasks created by a schedule are automatic tasks. Their completed output is not s
 
 A task whose answer needs time (a build, a deploy, a reply) calls `defer-task` with `delayMs` or `runAt`, a `summary` of what you did so far, and a `note` that says what is pending. The tool completes the task and creates the one-off schedule for you. The task reaches its final state (`completed`) on this call, and the `summary` becomes its output. The wake-up task carries the deferred task as its parent, so you receive that task's context. Add `checks` to list what to verify on wake-up. Do not hand-roll this with `create-schedule`.
 
+When waiting on tasks, include `wakeOn:{event:"settled",taskIds:["<id>"],mode:"all"}` alongside `delayMs` or `runAt`. The displayed time is a ceiling; matching task outcomes wake you sooner.
+
 ## Secrets
 
 A `taskTemplate` and `scriptArgs` are stored as plain text and replayed on every run. They must not contain a token, password, or key. Call the external API from a script through a registered connection or a credential binding instead. See the `swarm-scripts` skill, section Secrets.

package/templates/skills/serply-search/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: serply-search
+description: Query real Google results through Serply, with separate endpoints for news (dated coverage) and scholar (citation counts). Use when the ranking itself, the publication date, or the citation count is the answer.
+---
+
+# Serply Search
+
+Serply (https://serply.io) is a Google SERP API. It returns the ranked organic results for a keyword query, and exposes Google News and Google Scholar as separate endpoints. API reference: https://serply.io/docs
+
+## When to use Serply vs. Exa vs. WebSearch
+
+| Query shape | Use |
+|---|---|
+| "Companies building agent coordination layers" | Exa (conceptual, embedding match) |
+| "Blogs that argue knowledge is not data" | Exa (argument-shape) |
+| "What ranks on page 1 for `bun sqlite orm`" | **Serply** search (the ranking is the answer) |
+| "Funding rounds for company X since June" | **Serply** news (named entity plus date) |
+| "How heavily cited is paper Y" | **Serply** scholar (citation counts) |
+| "What is the official Bun docs URL?" | WebSearch (one concrete lookup) |
+
+Exa ranks by embedding similarity, so it wins at "find me things shaped like this". Serply returns what Google actually ranks, which is what you want when position, recency, or citation weight is the thing being measured. A plain WebSearch is still the cheapest way to settle a single fact.
+
+## Step 1. Get the API key
+
+```bash
+# Via MCP tool (preferred, handles secret resolution)
+mcp__agent-swarm__get-config(key="SERPLY_API_KEY", includeSecrets=true)
+```
+
+The value comes back at `configs[0].value`. Export to env or pass inline. Keys come from https://serply.io
+
+## Step 2. Web search
+
+```bash
+curl -sS 'https://api.serply.io/v1/search/?q=bun+sqlite+orm&num=10' \
+  -H "X-Api-Key: $SERPLY_API_KEY" \
+  -H 'User-Agent: agent-swarm/1.0'
+```
+
+Parameters go in the query string:
+
+- `q` (required): URL-encoded keywords, not a natural-language description. Google operators pass straight through, so `q=sqlite+site%3Abun.sh` and `tbs=` date filters behave as they do in the browser.
+- `num`: how many results to return. Honored up to 10 and clamped there, so page instead of asking for 20.
+
+Response (trimmed):
+
+```json
+{
+  "results": [
+    {
+      "title": "Use Drizzle ORM with Bun | Bun Guides",
+      "description": "Drizzle is an ORM that supports both a SQL-like \"query builder\" API and an ORM-like Queries API.",
+      "position": 1,
+      "realPosition": 1,
+      "result_type": "organic",
+      "link": "https://bun.com/guides/ecosystem/drizzle"
+    }
+  ]
+}
+```
+
+The snippet field is `description`, not `snippet`, and the URL field is `link`, not `url`. Each row also carries `metadata.display_url`. The payload has `answers`, `knowledge_graph` and `related_questions` beside `results`, populated only when Google returned them and empty otherwise.
+
+## Step 3. News and scholar
+
+Same host and header, different path, different response key.
+
+```bash
+curl -sS 'https://api.serply.io/v1/news/?q=openai+funding' \
+  -H "X-Api-Key: $SERPLY_API_KEY" -H 'User-Agent: agent-swarm/1.0'
+```
+
+News rows land in `entries[]`, each with `title`, `link`, `published` (RFC 1123), `summary`, and `source.title`. It returns the whole feed and ignores `num`.
+
+```bash
+curl -sS 'https://api.serply.io/v1/scholar/?q=attention+is+all+you+need&num=3' \
+  -H "X-Api-Key: $SERPLY_API_KEY" -H 'User-Agent: agent-swarm/1.0'
+```
+
+Scholar rows land in `articles[]`, each with `title`, `link`, `description`, `author.names`, and `extras.citations.count` as a string like `"Cited by 269516"`. When Google found a PDF, `doc.link` points at it.
+
+## Step 4. Pair with WebFetch
+
+A SERP row gives you a title, a snippet, and a rank. For anything you will cite, fetch the page. Serply is the index, WebFetch is the source.
+
+## Discipline: no fabrication
+
+If a query surfaces nothing relevant, write "not surfaced" rather than inventing a plausible link. A search that came back thin is a real finding and worth reporting as one.
+
+## Quick gotchas
+
+- The header is `X-Api-Key` holding the bare key, **not** `Authorization: Bearer`.
+- Serply sits behind Cloudflare, which rejects a default library User-Agent. Python `urllib` gets `HTTP 403` with the body `error code: 1010`. Send an explicit `User-Agent`; curl's own default is accepted.
+- `/v1/scholar/` returns both `articles` and an empty `results: []`. Read `articles`. Reading `results` gives you zero papers for every query, and nothing about the response says why.
+- Rankings are location-dependent, so two runs from different regions can legitimately disagree. Record the query alongside the positions whenever the position is the point.

package/templates/skills/serply-search/config.json

@@ -0,0 +1,13 @@
+{
+  "kind": "skill",
+  "name": "serply-search",
+  "displayName": "Serply Search",
+  "slug": "serply-search",
+  "title": "Serply Search",
+  "description": "Query real Google results through Serply, with separate endpoints for news (dated coverage) and scholar (citation counts). Use when the ranking itself, the publication date, or the citation count is the answer.",
+  "version": "1.0.0",
+  "category": "skills",
+  "placeholders": ["SERPLY_API_KEY"],
+  "runAllSeedersCandidate": false,
+  "tags": ["research", "search", "web"]
+}

package/templates/skills/serply-search/content.md

@@ -0,0 +1,90 @@
+# Serply Search
+
+Serply (https://serply.io) is a Google SERP API. It returns the ranked organic results for a keyword query, and exposes Google News and Google Scholar as separate endpoints. API reference: https://serply.io/docs
+
+## When to use Serply vs. Exa vs. WebSearch
+
+| Query shape | Use |
+|---|---|
+| "Companies building agent coordination layers" | Exa (conceptual, embedding match) |
+| "Blogs that argue knowledge is not data" | Exa (argument-shape) |
+| "What ranks on page 1 for `bun sqlite orm`" | **Serply** search (the ranking is the answer) |
+| "Funding rounds for company X since June" | **Serply** news (named entity plus date) |
+| "How heavily cited is paper Y" | **Serply** scholar (citation counts) |
+| "What is the official Bun docs URL?" | WebSearch (one concrete lookup) |
+
+Exa ranks by embedding similarity, so it wins at "find me things shaped like this". Serply returns what Google actually ranks, which is what you want when position, recency, or citation weight is the thing being measured. A plain WebSearch is still the cheapest way to settle a single fact.
+
+## Step 1. Get the API key
+
+```bash
+# Via MCP tool (preferred, handles secret resolution)
+mcp__agent-swarm__get-config(key="SERPLY_API_KEY", includeSecrets=true)
+```
+
+The value comes back at `configs[0].value`. Export to env or pass inline. Keys come from https://serply.io
+
+## Step 2. Web search
+
+```bash
+curl -sS 'https://api.serply.io/v1/search/?q=bun+sqlite+orm&num=10' \
+  -H "X-Api-Key: $SERPLY_API_KEY" \
+  -H 'User-Agent: agent-swarm/1.0'
+```
+
+Parameters go in the query string:
+
+- `q` (required): URL-encoded keywords, not a natural-language description. Google operators pass straight through, so `q=sqlite+site%3Abun.sh` and `tbs=` date filters behave as they do in the browser.
+- `num`: how many results to return. Honored up to 10 and clamped there, so page instead of asking for 20.
+
+Response (trimmed):
+
+```json
+{
+  "results": [
+    {
+      "title": "Use Drizzle ORM with Bun | Bun Guides",
+      "description": "Drizzle is an ORM that supports both a SQL-like \"query builder\" API and an ORM-like Queries API.",
+      "position": 1,
+      "realPosition": 1,
+      "result_type": "organic",
+      "link": "https://bun.com/guides/ecosystem/drizzle"
+    }
+  ]
+}
+```
+
+The snippet field is `description`, not `snippet`, and the URL field is `link`, not `url`. Each row also carries `metadata.display_url`. The payload has `answers`, `knowledge_graph` and `related_questions` beside `results`, populated only when Google returned them and empty otherwise.
+
+## Step 3. News and scholar
+
+Same host and header, different path, different response key.
+
+```bash
+curl -sS 'https://api.serply.io/v1/news/?q=openai+funding' \
+  -H "X-Api-Key: $SERPLY_API_KEY" -H 'User-Agent: agent-swarm/1.0'
+```
+
+News rows land in `entries[]`, each with `title`, `link`, `published` (RFC 1123), `summary`, and `source.title`. It returns the whole feed and ignores `num`.
+
+```bash
+curl -sS 'https://api.serply.io/v1/scholar/?q=attention+is+all+you+need&num=3' \
+  -H "X-Api-Key: $SERPLY_API_KEY" -H 'User-Agent: agent-swarm/1.0'
+```
+
+Scholar rows land in `articles[]`, each with `title`, `link`, `description`, `author.names`, and `extras.citations.count` as a string like `"Cited by 269516"`. When Google found a PDF, `doc.link` points at it.
+
+## Step 4. Pair with WebFetch
+
+A SERP row gives you a title, a snippet, and a rank. For anything you will cite, fetch the page. Serply is the index, WebFetch is the source.
+
+## Discipline: no fabrication
+
+If a query surfaces nothing relevant, write "not surfaced" rather than inventing a plausible link. A search that came back thin is a real finding and worth reporting as one.
+
+## Quick gotchas
+
+- The header is `X-Api-Key` holding the bare key, **not** `Authorization: Bearer`.
+- Serply sits behind Cloudflare, which rejects a default library User-Agent. Python `urllib` gets `HTTP 403` with the body `error code: 1010`. Send an explicit `User-Agent`; curl's own default is accepted.
+- `/v1/scholar/` returns both `articles` and an empty `results: []`. Read `articles`. Reading `results` gives you zero papers for every query, and nothing about the response says why.
+- Rankings are location-dependent, so two runs from different regions can legitimately disagree. Record the query alongside the positions whenever the position is the point.

package/templates/skills/swarm-extensions/config.json

@@ -0,0 +1,14 @@
+{
+  "kind": "skill",
+  "name": "swarm-extensions",
+  "displayName": "Swarm Extensions",
+  "slug": "swarm-extensions",
+  "title": "Swarm Extensions",
+  "description": "Write, install, and manage swarm extensions: TypeScript hook bundles that block, modify, or observe task creation, follow-ups, Slack routing, heartbeat remediation, and tool calls. Covers the hook contract, where to fetch swarm-extension.d.ts, the extension-install and extension-list tools, config schemas, and the operator enable step.",
+  "version": "1.0.0",
+  "category": "skills",
+  "placeholders": [],
+  "runAllSeedersCandidate": true,
+  "systemDefault": true,
+  "tags": ["extensions", "hooks", "policy", "automation"]
+}

package/templates/skills/swarm-extensions/content.md

@@ -0,0 +1,120 @@
+# Swarm Extensions
+
+An extension is a trusted TypeScript hook bundle that runs inside the swarm API server. Use one when a rule must apply to the whole swarm: block or rewrite new tasks, route Slack channels, suppress follow-ups, change stalled-task remediation, guard tool calls, or react after a task or tool call finishes.
+
+Do not use an extension for work that one task, one script, or one schedule can do.
+
+## Tools
+
+`extension-install` and `extension-list`. They are deferred. Load them with your harness tool search before the first call.
+
+`extension-install` validates the bundle (manifest, imports, typecheck against the hook contract) and stores it. Only a lead agent, an operator, or a dashboard user may install. A worker gets `Forbidden` from the tool. When you are a worker, write and validate the bundle, then hand it to your lead with `send-task` (include the manifest, the hooks file, and the config) and report that in your output. Do not call the REST install route with the shared API key to get around the role check. The stored extension stays disabled. An operator enables it from the dashboard (Settings, Extensions) or with `POST /api/extensions/{id}/enable`. Say this in your task report and give the extension name.
+
+Installing a bundle with the same name and changed files stores a new version. The active version does not change until an operator activates it.
+
+## Get the contract before you write hooks
+
+Fetch the generated type definitions and read them. Do not guess event names or field names.
+
+```bash
+curl -s "$MCP_BASE_URL/api/extensions/type-defs" \
+  -H "X-Agent-ID: $AGENT_ID" -H "Authorization: Bearer ${AGENT_SWARM_API_KEY:-$API_KEY}"
+```
+
+`$MCP_BASE_URL`, `$AGENT_ID`, and `$AGENT_SWARM_API_KEY` (or `$API_KEY`) are in every worker environment. The response is the `swarm-extension` module declaration: every event, its payload, and what a `modify` result may change.
+
+## Events
+
+| Event | When | Result |
+|---|---|---|
+| `pre.task.create` | before any task is stored (REST, MCP, Slack, schedule, workflow, webhook, follow-up) | `block(reason)`, `modify({ priority, agentId, tags, description, ... })`, or nothing |
+| `pre.task.followUp` | before the lead follow-up task for a finished worker task | `block`, `modify({ description, priority, agentId })`, or nothing |
+| `pre.slack.route` | before a Slack message becomes a task | `modify({ target: { kind: "agent", agentId } })`, `{ kind: "lead" }`, `{ kind: "broadcast" }` |
+| `pre.heartbeat.remediate` | after the heartbeat sweep finds a stalled task | `modify({ proposedAction: "record" | "fail" | "supersede-resume" })` |
+| `pre.tool.call` | before an agent MCP tool call runs | `block(reason)` or `modify({ args })` |
+| `post.task.created`, `post.task.completed`, `post.task.failed`, `post.task.cancelled`, `post.task.superseded`, `post.task.progress` | after the change is committed | none |
+| `post.slack.message`, `post.tool.call` | after the message or tool call finished | none |
+
+`event.origin` on `pre.task.create` tells where the task comes from: `rest`, `app`, `mcp`, `slack`, `schedule`, `workflow`, `webhook`, `followUp`, or `extension:<name>`.
+
+## Bundle shape
+
+The bundle is a manifest plus a files map. Version 1 accepts one file, the `assets.hooks` TypeScript file, and only `runtime: "api"`.
+
+```json
+{
+  "manifest": {
+    "name": "require-ticket-ref",
+    "description": "Blocks REST and MCP tasks that do not name a ticket",
+    "version": "1.0.0",
+    "runtime": "api",
+    "assets": { "hooks": "hooks.ts" }
+  },
+  "files": { "hooks.ts": "<file content>" },
+  "config": { "pattern": "DES-\\d+" }
+}
+```
+
+Rules for `hooks.ts`:
+
+- Import only from `swarm-extension`, `zod`, and `stdlib`. Relative imports, other packages, and dynamic imports are rejected.
+- Export the extension as `default`. Export `config` (a Zod schema) when the extension takes configuration. The install validates `config` against it.
+- Return `block(reason)` or `modify(data)` from pre hooks. Return nothing to continue.
+- Keep handlers fast. A handler is cancelled after 5 seconds. Five consecutive failures auto-disable the extension.
+- Handlers run outside database transactions and must not assume ordering with other extensions. Use `priority` in `api.on(event, handler, { priority })` when order matters (lower runs first).
+
+## Minimal hooks file
+
+```ts
+import { block, modify, type SwarmExtension } from "swarm-extension";
+import { z } from "zod";
+
+export const config = z.object({ pattern: z.string().default("DES-\\d+") });
+
+const manifest = {
+  name: "require-ticket-ref",
+  description: "Blocks REST and MCP tasks that do not name a ticket",
+  version: "1.0.0",
+  runtime: "api",
+  assets: { hooks: "hooks.ts" },
+  config,
+} as const;
+
+const extension: SwarmExtension<typeof manifest> = (api) => {
+  api.on("pre.task.create", (event, ctx) => {
+    if (event.origin !== "rest" && event.origin !== "mcp") return;
+    if (new RegExp(ctx.config.pattern).test(event.description)) return;
+    return block(`Task must reference a ticket matching ${ctx.config.pattern}`);
+  });
+
+  api.on("post.task.completed", async (event, ctx) => {
+    await ctx.state.incr("completed");
+    ctx.log.info("task completed", { id: event.task.id });
+  });
+};
+
+export default extension;
+```
+
+## Context (`ctx`)
+
+- `ctx.config`: the validated configuration.
+- `ctx.state`: per-extension key-value store (`get`, `set`, `incr`, `del`).
+- `ctx.swarm`: the swarm SDK. Call any script-exposed tool by name with underscores, for example `await ctx.swarm.slack_post({ channelId, message })` or `await ctx.swarm.task_send({ ... })`. Calls made from a hook carry the `ext:<name>` identity, which has lead privileges while the extension is enabled. Calls resolve with `{ success, status, data }` and do not throw on a tool error. Check `success` and throw when the hook must fail. The type definitions import `SwarmSdk` from `swarm-sdk`. Call the `script-query-types` tool (or `GET /api/scripts/type-defs`) to get `swarm-sdk.d.ts` with every method name and argument type before you use `ctx.swarm`.
+- `ctx.log`: structured logger. Entries appear in the extension run log on the dashboard.
+- `ctx.signal`: abort signal for the 5-second cap.
+
+## Verify
+
+1. Call `extension-list` and confirm the name, version, and `enabled: false`.
+2. Report the enable step. After an operator enables it, the dashboard run log shows every dispatch with its result (`continue`, `modify`, `block`, or `error`).
+3. Trigger the event once and confirm the effect (for example, a blocked REST task returns HTTP 422 with your reason).
+
+## Common mistakes
+
+- Guessing event names. Fetch the type definitions.
+- Using `import` from a package other than `swarm-extension`, `zod`, or `stdlib`.
+- Returning a plain object instead of `block(...)` or `modify(...)`.
+- Modifying fields the event does not allow. Read the `*Modify` type for that event.
+- Expecting the extension to run after install. It runs only after an operator enables it.
+- Blocking tasks from every origin. Check `event.origin` so schedules, workflows, and follow-ups keep working unless you mean to block them.

package/templates/skills/swarm-scripts/SKILL.md

@@ -37,7 +37,7 @@ The swarm ships named scripts at global scope. Each one replaces a multi-step to
 | `task-context-gathering` | `{ taskId, queries: [...] }` | the task plus a deduplicated multi-query memory recall |
 | `smart-recall` | `{ queries: [...] }` | multi-query memory recall without the task |
 | `memory-dedup-check` | `{ text, threshold? }` | near-duplicates before you store a memory |
-| `delegate` | `{ agentName, task, routingReason, parentTaskId? }` | a subtask for an agent by name, returns `{ taskId }` |
+| `delegate` | `{ agentName, task, routingReason, routingNote, parentTaskId? }` | a subtask for an agent by name, returns `{ taskId }` |
 | `wait-for-task` | `{ taskId }` | waits up to about 25 s for a terminal state, returns `{ done, status, output }`; call again while `done` is false |
 | `get-child-outputs` | `{ parentTaskId }` | every child with status and output |
 | `complete-task` | `{ taskId, output }` | finish a task from inside a script |
@@ -74,7 +74,7 @@ export default async function (args: z.infer<typeof argsSchema>, ctx: ScriptCont
 ### What `ctx` holds
 
 - `ctx.swarm.*`: the swarm SDK. `task_get`, `task_send`, `task_storeProgress`, `task_action`, `task_list`, `slack_reply`, `memory_search`, `memory_store`, `kv_get`, `kv_getOrNull`, `kv_set`, `kv_delete`, `kv_incr`, `kv_list`, `swarm_get`, `agent_info`, `db_query`, and more. `kv_getOrNull` returns the entry, `null` on a missing key, and throws on other errors.
-- `ctx.swarm.task_send` requires `routingReason` whenever `agentId` is present. Use `human_pinned` for an explicit/configured choice, `skill` for a role or specialization match, `continuity` for the same worker/session, `reroute_fault` for a fault handoff, or `overflow` for capacity/pool escalation. Omit both `agentId` and routing fields for the pool.
+- `ctx.swarm.task_send` requires `routingReason` and `routingNote` whenever `agentId` is present. The note must explain the worker choice in at least 10 characters after trimming whitespace (maximum 200 characters). Use `human_pinned` for an explicit/configured choice, `skill` for a role or specialization match, `continuity` for the same worker/session, `reroute_fault` for a fault handoff, or `overflow` for capacity/pool escalation. Omit both `agentId` and routing fields for the pool.
 - `ctx.swarm.config`: `apiKey`, `agentId`, `mcpBaseUrl`, and `ctx.swarm.config.get("KEY")` for user config values. All are `Redacted` wrappers that stringify to `<redacted>`. Never unwrap one into a return value, a log line, or a request body you build by hand.
 - `ctx.api.<slug>` and `ctx.mcp.<slug>`: typed clients for registered connections. They exist only for registered connections. Introspect with `Object.keys(ctx.api ?? {})` and `Object.keys(ctx.mcp ?? {})`.
 - `ctx.stdlib`: `fetch`, `fetchJson` (retries, 30 s timeout), `grep`, `glob`, `table`, `Redacted`.

package/templates/skills/swarm-scripts/content.md

@@ -32,7 +32,7 @@ The swarm ships named scripts at global scope. Each one replaces a multi-step to
 | `task-context-gathering` | `{ taskId, queries: [...] }` | the task plus a deduplicated multi-query memory recall |
 | `smart-recall` | `{ queries: [...] }` | multi-query memory recall without the task |
 | `memory-dedup-check` | `{ text, threshold? }` | near-duplicates before you store a memory |
-| `delegate` | `{ agentName, task, routingReason, parentTaskId? }` | a subtask for an agent by name, returns `{ taskId }` |
+| `delegate` | `{ agentName, task, routingReason, routingNote, parentTaskId? }` | a subtask for an agent by name, returns `{ taskId }` |
 | `wait-for-task` | `{ taskId }` | waits up to about 25 s for a terminal state, returns `{ done, status, output }`; call again while `done` is false |
 | `get-child-outputs` | `{ parentTaskId }` | every child with status and output |
 | `complete-task` | `{ taskId, output }` | finish a task from inside a script |
@@ -69,7 +69,7 @@ export default async function (args: z.infer<typeof argsSchema>, ctx: ScriptCont
 ### What `ctx` holds
 
 - `ctx.swarm.*`: the swarm SDK. `task_get`, `task_send`, `task_storeProgress`, `task_action`, `task_list`, `slack_reply`, `memory_search`, `memory_store`, `kv_get`, `kv_getOrNull`, `kv_set`, `kv_delete`, `kv_incr`, `kv_list`, `swarm_get`, `agent_info`, `db_query`, and more. `kv_getOrNull` returns the entry, `null` on a missing key, and throws on other errors.
-- `ctx.swarm.task_send` requires `routingReason` whenever `agentId` is present. Use `human_pinned` for an explicit/configured choice, `skill` for a role or specialization match, `continuity` for the same worker/session, `reroute_fault` for a fault handoff, or `overflow` for capacity/pool escalation. Omit both `agentId` and routing fields for the pool.
+- `ctx.swarm.task_send` requires `routingReason` and `routingNote` whenever `agentId` is present. The note must explain the worker choice in at least 10 characters after trimming whitespace (maximum 200 characters). Use `human_pinned` for an explicit/configured choice, `skill` for a role or specialization match, `continuity` for the same worker/session, `reroute_fault` for a fault handoff, or `overflow` for capacity/pool escalation. Omit both `agentId` and routing fields for the pool.
 - `ctx.swarm.config`: `apiKey`, `agentId`, `mcpBaseUrl`, and `ctx.swarm.config.get("KEY")` for user config values. All are `Redacted` wrappers that stringify to `<redacted>`. Never unwrap one into a return value, a log line, or a request body you build by hand.
 - `ctx.api.<slug>` and `ctx.mcp.<slug>`: typed clients for registered connections. They exist only for registered connections. Introspect with `Object.keys(ctx.api ?? {})` and `Object.keys(ctx.mcp ?? {})`.
 - `ctx.stdlib`: `fetch`, `fetchJson` (retries, 30 s timeout), `grep`, `glob`, `table`, `Redacted`.

package/templates/workflows/claude-code-changelog-watch/config.json

@@ -9,6 +9,6 @@
   "category": "workflows",
   "placeholders": [],
   "requires": [],
-  "runAllSeedersCandidate": false,
+  "runAllSeedersCandidate": true,
   "tags": ["release-notes", "harness"]
 }

package/templates/workflows/gsc-topic-miner/config.json

@@ -9,6 +9,6 @@
   "category": "workflows",
   "placeholders": ["GSC_PROPERTY"],
   "requires": ["gsc", "agentfs"],
-  "runAllSeedersCandidate": false,
+  "runAllSeedersCandidate": true,
   "tags": ["gsc", "research", "content"]
 }

package/templates/workflows/linear-drain-loop/config.json

@@ -9,7 +9,7 @@
   "category": "workflows",
   "placeholders": ["LINEAR_PROJECT_ID"],
   "requires": ["linear"],
-  "runAllSeedersCandidate": false,
+  "runAllSeedersCandidate": true,
   "tags": [
     "workflow",
     "linear",

package/templates/workflows/llm-safe-release-context/config.json

@@ -9,6 +9,6 @@
   "category": "workflows",
   "placeholders": ["ORG_ID", "REPO_URL"],
   "requires": ["github"],
-  "runAllSeedersCandidate": false,
+  "runAllSeedersCandidate": true,
   "tags": ["workflow", "release-notes", "context"]
 }

package/templates/workflows/ralph-loop/config.json

@@ -9,6 +9,6 @@
   "category": "workflows",
   "placeholders": ["REPO_URL"],
   "requires": ["github"],
-  "runAllSeedersCandidate": false,
+  "runAllSeedersCandidate": true,
   "tags": ["workflow", "review", "iteration"]
 }