@heretyc/subagent-mcp 2.8.0 → 2.8.1

package/README.md

@@ -69,8 +69,14 @@ For manual wiring, developer install from source, Gemini CLI, and Claude Desktop
 | `coding` | bounded runnable code artifact, one-pass (implement, test, refactor) |
 | `knowledge_synthesis` | novel integrated prose over sources (synthesize, summarize, draft) |
 | `mechanical` | deterministic single-pass transform, exact-match checkable (grep, rename, reformat) |
+| `prompt_engineering` | designed/optimized prompt or prompt-system steering an LLM/agent (composite-inferred) |
+| `vulnerability_research` | discovery + PoC of a novel vulnerability (composite-inferred) |
+| `molecular_biology` | reasoned molecular/computational-biology result over sequences, structures, or -omics data (composite-inferred) |
+| `ml_accelerator_design` | hardware/software design for ML acceleration — dataflow, kernel, roofline (composite-inferred) |
 | `fallback_default` | no category matches with confidence; prefer splitting work instead |
 
+The last four are **composite-inferred**: they carry no dedicated benchmark and their routing competency is composed from parent categories rather than measured directly.
+
 **Atomic-split guidance:** if you are unsure which category fits, do NOT submit one large amorphous task. Break the work into smaller atomic steps each mapping to a single category and launch one agent per step.
 
 ---

package/directives/orchestration-claude.md

@@ -1,21 +1,14 @@
-<!-- INJECTED PRE-PROMPT DIRECTIVE — BINDING, NON-NEGOTIABLE -->
+<!-- INJECTED PRE-PROMPT DIRECTIVE - BINDING, NON-NEGOTIABLE -->
 <SUB-AGENT-INVARIANT priority="CRITICAL" override="NONE">
+ORCHESTRATION MODE ON: ORCHESTRATOR; default=DELEGATE.
 
-ORCHESTRATION MODE ON. You = ORCHESTRATOR. DEFAULT = DELEGATE.
+INLINE BY RIGHT only for main-session-only capability: user interaction/consent, agent control, tiny audits, final git/PR, irreducible verify loops. State which+why. Direct tool calls spend main context; keep to that set.
 
-INLINE BY RIGHT (no violation): steps bound to main-session-only capability —
-MCP tools sub-agents can't inherit, interactive/consent tools, tight verify
-loops. State which + why, one line.
+Clarification/consent: subagents surface questions to orchestrator. Orchestrator asks with AskUserQuestion, sends answer back. Question/gate/audit duty does not justify adjacent discovery or edits inline.
 
-MUST DELEGATE/OFFLOAD (breach if not): pure compute (parse/aggregate/transform);
-any payload >50KB or >200 lines → scratch file, hand off the PATH.
-Mixed task = SPLIT. One MCP-bound step never makes the whole task inline.
+MUST DELEGATE/OFFLOAD: pure compute; implementation/integration edits; mixed tasks split. One MCP-bound step never makes all inline. Payload >50KB or >200 lines -> scratch path (%TEMP% or /tmp), hand off PATH. Orchestrator audits diffs/results before commit.
 
-CONFLICT ORDER: safety-scope > user instruction this turn > delegate-default.
-User tool-pin re-partitions work; does not suspend mode.
-
-IPC = temp scratch files ONLY. Windows: %TEMP%. POSIX: /tmp.
-Full model + governance: server MCP instructions.
-DISABLE: never on own initiative. Propose via AskUserQuestion only.
+CONFLICT ORDER: safety-scope > user instruction this turn > delegate-default. Tool-pin repartitions work, does not suspend mode. IPC=temp scratch files only. Full model/governance: server MCP instructions.
 
+DISABLE: never on own initiative. Propose via AskUserQuestion only; disable only after explicit user permission.
 </SUB-AGENT-INVARIANT>

package/directives/orchestration-codex.md

@@ -1,22 +1,15 @@
-<!-- INJECTED PRE-PROMPT DIRECTIVE — BINDING, NON-NEGOTIABLE -->
 <SUB-AGENT-INVARIANT priority="CRITICAL" override="NONE">
-SCOPE: If this session's prompt begins with "<this is a request from a parent process>", SUB-AGENT-INVARIANT does NOT apply to this session, SKIP the remainder of this directive.
+SCOPE: if prompt begins "<this is a request from a parent process>", skip rest.
 
-ORCHESTRATION MODE ON. You = ORCHESTRATOR. DEFAULT = DELEGATE.
+ORCHESTRATION MODE ON: ORCHESTRATOR; default=DELEGATE.
 
-INLINE BY RIGHT (no violation): steps bound to main-session-only capability —
-MCP tools sub-agents can't inherit, interactive/consent tools, tight verify
-loops. State which + why, one line.
+INLINE BY RIGHT only for main-session-only capability: user interaction/consent, agent control, tiny audits, final git/PR, irreducible verify loops. State which+why. Direct calls spend main context; keep to that set.
 
-MUST DELEGATE/OFFLOAD (breach if not): pure compute (parse/aggregate/transform);
-any payload >50KB or >200 lines → scratch file, hand off the PATH.
-Mixed task = SPLIT. One MCP-bound step never makes the whole task inline.
+Clarification/consent: subagents surface questions to orchestrator. Orchestrator asks with request-user-input, sends answer back. Question/gate/audit duty does not justify adjacent discovery or edits inline.
 
-CONFLICT ORDER: safety-scope > user instruction this turn > delegate-default.
-User tool-pin re-partitions work; does not suspend mode.
+MUST DELEGATE/OFFLOAD: pure compute; implementation/integration edits; mixed tasks split. One MCP-bound step never makes all inline. Payload >50KB or >200 lines -> scratch path (%TEMP% or /tmp), hand off PATH. Orchestrator audits diffs/results before commit.
 
-IPC = temp scratch files ONLY. Windows: %TEMP%. POSIX: /tmp.
-Full model + governance: server MCP instructions.
-DISABLE: never on own initiative. Propose via request-user-input only.
+CONFLICT ORDER: safety-scope > user instruction this turn > delegate-default. Tool-pin repartitions work, does not suspend mode. IPC=temp scratch files only. Full governance: server MCP instructions.
 
+DISABLE: never on own initiative. Propose via request-user-input only; disable only after explicit permission.
 </SUB-AGENT-INVARIANT>

package/directives/reminder-on.md

@@ -3,6 +3,12 @@
 
 ORCHESTRATION ON. Delegate-default: decompose; delegate; keep orchestrator
 context lean. The 5-CALL RULE is satisfied by delegation.
+Subagents may ask for clarification/consent through the orchestrator; answers
+return to subagents. Questions, gates, and audits do not justify adjacent
+inline discovery/edits. Orchestrator tool use is limited to user interaction,
+agent control, tiny audits, final git/PR actions, and irreducible verify loops.
+Implementation/integration edits remain delegated by default; audit before
+commit.
 <SUB-AGENT-INVARIANT> governance applies — full model: server MCP instructions.
 Sub-agent sessions: ignore this block.
 

package/dist/index.js

@@ -45,7 +45,7 @@ const SPAWN_GRACE_MS = (() => {
 // so the handler-validation test can exercise them without importing this entry
 // module (which would open the stdio transport).
 // Caveman self-classification gloss for the task_category param (tool-description.md).
-const TASK_CATEGORY_GLOSS = "REQUIRED. Task shape -> routing category (the server picks the best model for it). Pick ONE: math_proof: proof/derivation/formally-checkable result; deductive step-validity under axioms; verified by a proof-checker not tests. security_review: security verdict/threat-assessment/demonstrated exploit; adversarial reasoning over attack surface — vuln, auth/authz, crypto, exploitability. debugging: verified fix/root-cause; ONLY with an observed failure (error, crash, red test, regression, flake); done when the symptom is resolved. quality_review: evaluative verdict on an existing NON-security artifact with NO observed failure; review diff/PR, compare A-vs-B, validate-vs-spec; never self-review. architecture: cross-module design/plan, NO code, NO execution loop; system structure, interface/migration strategy, decompose-into-tasks; >2 files or public API. agentic_execution: reach a target end-state by iterating in a mutating env (act/observe/adapt loop); run/deploy/provision/browse, tool/function-call, iterate-until-tests-pass. data_analysis: empirical finding/model ABOUT a structured dataset; query/SQL/dataframe answer, statistic, fit-model-report-drivers; the finding is the deliverable even if code runs. coding: bounded runnable code artifact, one-pass; implement function/module/feature/script, write tests, single-module refactor; compiles/passes tests. knowledge_synthesis: novel integrated prose over sources; synthesize/summarize/translate/draft/explain-across-files; judged by faithfulness/coherence not exact-match. mechanical: deterministic single-pass transform/leaf op, exact-match checkable; find/grep/list/rename/reformat/convert/extract-to-fixed-schema; minimal reasoning. fallback_default: no category fits with confidence (under-specified/mixed/tied); read-only sentinel — PREFER splitting the work into smaller atomic steps that each map to one category.";
+const TASK_CATEGORY_GLOSS = "REQUIRED. Task shape -> routing category (server picks best model for it). Pick ONE: math_proof: deliverable=proof/derivation/formally-checkable result; proof IS deliverable; deductive step-validity under axioms; verified by proof-checker not tests. security_review: deliverable=security verdict/threat-assessment/demonstrated-exploit; adversarial reasoning over attack surface; vuln, auth/authz, crypto, exploitability. debugging: deliverable=verified fix/root-cause; ONLY observed failure (error, crash, red test, regression, flake) preconditions work; done when symptom resolved. quality_review: deliverable=evaluative verdict on existing NON-security artifact, NO observed failure; review diff/PR, compare A-vs-B, validate-vs-spec; never self-review. architecture: deliverable=cross-module design/plan, NO code, NO execution loop; system structure, interface/migration strategy, decompose-into-tasks; >2 files or public API. agentic_execution: deliverable=target end-state via iterate in mutating env (act/observe/adapt loop); run/deploy/provision/browse, tool/function-call, iterate-until-tests-pass. data_analysis: deliverable=empirical finding/model ABOUT structured dataset; query/SQL/dataframe answer, statistic, fit-model-report-drivers; finding scored even if code runs. coding: deliverable=bounded runnable code artifact, one-pass; implement function/module/feature/script, write tests, single-module refactor; compiles/passes-tests. knowledge_synthesis: deliverable=novel integrated prose over sources; synthesize/summarize/translate/draft/explain-across-files; verified by faithfulness/coherence not exact-match. mechanical: deliverable=deterministic single-pass transform/leaf op, exact-match checkable; find/grep/list/rename/reformat/format-convert/extract-to-fixed-schema; minimal reasoning. prompt_engineering: deliverable=designed/optimized prompt or prompt-system steering an LLM/agent; author/refine/eval instructions; system prompt, few-shot, template, prompt rubric; comp-infer parents knowledge_synthesis+coding+quality_review; no direct benchmark. vulnerability_research: deliverable=NOVEL vuln discovery/root-cause/PoC, NOT broad CVE summary; find flaw, root-cause, build PoC; fuzzing, reverse-engineer, exploit primitive; comp-infer parents security_review+debugging+coding; no direct benchmark. molecular_biology: deliverable=reasoned molecular/computational-biology result; sequences, structures, pathways, -omics data; comp-infer parents knowledge_synthesis+data_analysis+math_proof; no direct benchmark. ml_accelerator_design: deliverable=hardware/software design for ML acceleration; dataflow, tiling, memory hierarchy, kernel, roofline; comp-infer parents architecture+coding+math_proof; no direct benchmark. fallback_default: no category matches with confidence (under-specified/mixed/tied); read-only; PREFER splitting work into smaller atomic steps each mapping to one category.";
 function errorResult(text) {
     return { content: [{ type: "text", text }], isError: true };
 }