@mono-agent/agent-app 0.20.10 → 0.20.14

package/schema/mono-agent.config.schema.json

@@ -35,32 +35,19 @@
         "model": {
           "description": "Configures model for the runtime section.",
           "examples": [
-            "codex:gpt-5.6-terra"
+            "openai-codex:gpt-5.6-terra"
           ],
           "type": "string"
         },
-        "fallbackModels": {
-          "description": "Legacy fallback list whose routes inherit runtime.effort. Prefer runtime.fallbacks for new configs.",
-          "examples": [
-            [
-              "pi:ollama:gemma4:31b"
-            ]
-          ],
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "default": []
-        },
         "fallbacks": {
           "description": "Canonical ordered fallback routes. Omitted per-route effort means that provider's default.",
           "examples": [
             [
               {
-                "model": "codex:gpt-5.6-sol"
+                "model": "openai-codex:gpt-5.6-sol"
               },
               {
-                "model": "pi:openai-codex:gpt-5.6-terra",
+                "model": "anthropic:claude-sonnet-4-6",
                 "effort": "high"
               }
             ]
@@ -135,28 +122,8 @@
             }
           }
         },
-        "routeSafety": {
-          "description": "Uniform preserves one shared safety contract; per-route-native uses and reports each provider's explicit contract.",
-          "examples": [
-            "per-route-native"
-          ],
-          "type": "string",
-          "default": "uniform",
-          "enum": [
-            "uniform",
-            "per-route-native"
-          ]
-        },
-        "executionMode": {
-          "description": "Configures executionMode for the runtime section.",
-          "examples": [
-            "inferred"
-          ],
-          "type": "string",
-          "default": "inferred"
-        },
         "effort": {
-          "description": "Route-specific effort. Reasoning-capable pi:* maps ultra to LOW; Pi without reasoning uses OFF. Direct codex:* forwards ultra unchanged. Mono-agent rejects ultra on its Claude SDK route because the pinned SDK public contract ends at max (the SDK JavaScript itself forwards the value). The Claude CLI route passes --effort ultra, but both tested Claude Code binaries (SDK-bundled 2.1.206 and local 2.1.210) warn that it is unknown, ignore it, and use default effort. Direct OpenCode rejects explicit effort. Ranking above max only prevents keyword downgrade.",
+          "description": "Route-specific effort forwarded through Pi to the selected provider. Doctor warns when a configured value falls outside the model's advertised ladder but keeps turn-time handling permissive. Ranking above max only prevents keyword downgrade.",
           "examples": [
             "medium"
           ],
@@ -321,7 +288,7 @@
       ]
     },
     "subagents": {
-      "description": "Subagent profiles the Agent tool can deploy, plus its caps. Disabled unless enabled is true, in which case Agent must also appear in tools.allowedTools. Each definition needs exactly one of prompt or promptPath; omitted allowedTools means a read-only default set, and the \"*\" wildcard is rejected. The agent may also author a specialized subagent at call time unless inline.enabled is false; inline.allowedTools caps what an authored subagent may request, defaulting to the parent agent's own built-ins.",
+      "description": "Subagent profiles the Agent tool can deploy, plus its caps. Disabled unless enabled is true, in which case Agent must also appear in tools.allowedTools. Each definition needs exactly one of prompt or promptPath; omitted allowedTools means a read-only default set, and the \"*\" wildcard is rejected. The agent may also author a specialized subagent at call time unless inline.enabled is false; inline.allowedTools caps what an authored subagent may request, defaulting to the parent agent's own built-ins. maxConcurrent is a ceiling, not a scheduling guarantee: Pi 0.85 serializes all tool calls when any stateful/mutating or MCP tool is offered.",
       "examples": [
         {
           "enabled": true,
@@ -751,14 +718,7 @@
             "model": {
               "description": "Configures llm.model for the memory section.",
               "examples": [
-                "pi:openai-codex:gpt-5.6-terra"
-              ],
-              "type": "string"
-            },
-            "executionMode": {
-              "description": "Configures llm.executionMode for the memory section.",
-              "examples": [
-                "example"
+                "openai-codex:gpt-5.6-terra"
               ],
               "type": "string"
             },
@@ -801,6 +761,20 @@
             }
           }
         },
+        "rememberTool": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "description": "Enables the memory capability.",
+              "examples": [
+                true
+              ],
+              "type": "boolean",
+              "default": true
+            }
+          }
+        },
         "consolidation": {
           "type": "object",
           "additionalProperties": false,
@@ -1443,7 +1417,75 @@
     },
     "providers": {
       "type": "object",
-      "additionalProperties": false,
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "type": {
+            "enum": [
+              "ollama",
+              "lmstudio",
+              "openai_compat"
+            ]
+          },
+          "baseUrl": {
+            "type": "string"
+          },
+          "enabled": {
+            "type": "boolean"
+          },
+          "trustPublicUrl": {
+            "type": "boolean"
+          },
+          "apiKey": {
+            "type": "string"
+          },
+          "apiKeyEnv": {
+            "type": "string"
+          },
+          "maxAdvertisedModels": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 200,
+            "default": 100
+          },
+          "models": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "name"
+              ],
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "alias": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "displayName": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "capabilities": {
+                  "type": "object",
+                  "additionalProperties": true
+                },
+                "pricing": {
+                  "type": "object",
+                  "additionalProperties": true
+                }
+              }
+            }
+          }
+        }
+      },
       "properties": {
         "piAuthPath": {
           "description": "Configures piAuthPath for the providers section.",
@@ -1531,6 +1573,12 @@
               "apiKeyEnv": {
                 "type": "string"
               },
+              "maxAdvertisedModels": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 200,
+                "default": 100
+              },
               "models": {
                 "type": "array",
                 "items": {
@@ -1662,6 +1710,94 @@
         }
       }
     },
+    "monitors": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "default": false
+        },
+        "maxActive": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 32,
+          "default": 8
+        },
+        "maxActivePerConversation": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 8,
+          "default": 2
+        },
+        "maxRuntimeMs": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 3600000,
+          "default": 3600000
+        },
+        "persistentMaxRuntimeMs": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 86400000,
+          "default": 86400000
+        },
+        "coalesceMs": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 5000,
+          "default": 200
+        },
+        "maxBatchLines": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 2000,
+          "default": 200
+        },
+        "maxBatchBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1048576,
+          "default": 65536
+        },
+        "maxLineBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 65536,
+          "default": 4096
+        },
+        "maxChainDepth": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 8,
+          "default": 4
+        },
+        "rateLimit": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "windowMs": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 60000,
+              "default": 1000
+            },
+            "maxLinesPerWindow": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 20000,
+              "default": 200
+            },
+            "sustainedWindows": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 60,
+              "default": 5
+            }
+          }
+        }
+      }
+    },
     "interaction": {
       "type": "object",
       "additionalProperties": false,
@@ -2444,6 +2580,20 @@
           ],
           "type": "boolean"
         },
+        "unfurlLinks": {
+          "description": "Controls link previews on native Slack agent `chat.postMessage` requests. When unset, the request field is omitted and Slack's current default behavior is preserved.",
+          "examples": [
+            false
+          ],
+          "type": "boolean"
+        },
+        "unfurlMedia": {
+          "description": "Controls media previews on native Slack agent `chat.postMessage` requests. When unset, the request field is omitted and Slack's current default behavior is preserved.",
+          "examples": [
+            false
+          ],
+          "type": "boolean"
+        },
         "resolveUserNames": {
           "description": "Resolves the speaker's display name and handle via `users.info` so the agent knows who is talking. Requires the `users:read` scope; a missing scope degrades to an unnamed speaker rather than failing turns.",
           "examples": [

package/skills/mono-agent-composer/SKILL.md

@@ -38,7 +38,7 @@ Do **not** read or grep the `@mono-agent` TypeScript/package source — `package
 - Ask one question at a time; skip anything the user already answered.
 - Respect existing knowledge: if the folder has `AGENTS.md`, `CLAUDE.md`, `README.md`, or `SOUL.md`, reference it from the identity instead of copying it. `IDENTITY.md` → `## Role` is the single canonical guided-init Role location. Never overwrite an existing identity; say explicitly that a newly entered Role was not written and tell the user to add or edit that heading manually.
 - Fail closed: no allowed tools, no memory writes, loopback-only network until the user opts in.
-- Do not fake runtime success, silently broaden tool access, or hide provider/MCP failures. Backup models are configured failover (`runtime.fallbacks[]`), never silent substitution. Legacy `runtime.fallbackModels` and `MONO_AGENT_FALLBACK_MODELS` remain compatibility inputs with no removal deadline, but do not emit them for a new agent.
+- Do not fake runtime success, silently broaden tool access, or hide provider/MCP failures. Backup models are configured failover (`runtime.fallbacks[]`), never silent substitution. `runtime.fallbackModels` and `MONO_AGENT_FALLBACK_MODELS` were retired in 0.21.0 and are rejected at load, but do not emit them for a new agent.
 - Secrets stay in `.env` or exported environment variables. An ignored or untracked config file is not permission to inline them; never commit tokens or `.env*` files.
 
 ## Prerequisites
@@ -75,7 +75,7 @@ Everything below runs in the user's agent folder, not the workspace.
    mono-agent init --model <ref> [--fallback <ref> [--fallback-effort <provider-default|level>]]... [--effort <level>] [--auth] [--memory lite|journal|bujo]   # bare scaffold
    ```
 
-   Either writes a `mono-agent.config.json` (with `tools.allowedTools` pre-filled from the selected capabilities' recommended tools), an `IDENTITY.md` whose `## Role` body is the one Role destination and which references any knowledge files already present, the managed project-local `mono-agent-configure` and `mono-agent-memory` skills, and `.mono-agent/` working directories (presets also emit a `.env.example` and any extra files). `--effort` writes `runtime.effort` on supporting providers (do not use it with direct `opencode:*` SDK 1.x); `--auth` opts in to provider setup before writing files; `--dry-run` previews without writing or launching auth/preflight commands. Existing scaffold/config files are never overwritten; reviewed secret setup is the deliberate exception that can transactionally replace `.env` and update `.gitignore`.
+   Either writes a `mono-agent.config.json` (with `tools.allowedTools` pre-filled from the selected capabilities' recommended tools), an `IDENTITY.md` whose `## Role` body is the one Role destination and which references any knowledge files already present, the managed project-local `mono-agent-configure` and `mono-agent-memory` skills, and `.mono-agent/` working directories (presets also emit a `.env.example` and any extra files). `--effort` writes `runtime.effort`, which is narrowed per model for display and still accepted at turn time; `--auth` opts in to provider setup before writing files; `--dry-run` previews without writing or launching auth/preflight commands. Existing scaffold/config files are never overwritten; reviewed secret setup is the deliberate exception that can transactionally replace `.env` and update `.gitignore`.
 3. **Configure.** Edit `mono-agent.config.json` to match the discovery answers. For a newly created identity, put the agreed text under `IDENTITY.md` → `## Role`; if it existed before init, preserve it and report that the new answer was not stored. Preserve the generated `mono-agent-configure` and `mono-agent-memory` selections when appending other skills, and do not auto-select this full authoring-oriented composer inside the generated agent. Read `references/config-blueprint.md` for the full annotated config shape: every channel section, skills, MCP, memory, sandbox, and fallback models. Run `mono-agent config` to see the resolved configuration field-by-field with each value tagged `env` / `json` / `default` — the fastest way to confirm a value came from where you intended.
 4. **Validate.**
 

package/skills/mono-agent-composer/references/config-blueprint.md

@@ -28,29 +28,22 @@ my-agent/
 
 ## Annotated Config
 
-New configs use `runtime.fallbacks[]`, where each route owns its optional exact
-effort. Legacy `runtime.fallbackModels` and `MONO_AGENT_FALLBACK_MODELS` remain
-supported compatibility inputs with no removal deadline; do not emit them for a
-new agent.
+Configs use `runtime.fallbacks[]`, where each route owns its optional exact
+effort. `runtime.fallbackModels` and `MONO_AGENT_FALLBACK_MODELS` were retired in
+0.21.0 and are now rejected at load — never emit them.
 
 ```jsonc
 {
   // Runtime: primary model plus ordered backups tried on retryable provider
   // failures (failover is reported in run results, never silent).
   "runtime": {
-    "model": "claude:claude-sonnet-4-6",   // claude:* | codex:* | pi:<provider>:<model>
-    "fallbacks": [{ "model": "pi:ollama:gemma4:31b" }],
-    "routeSafety": "uniform",              // uniform | per-route-native
-    "executionMode": "sdk",                // sdk | cli (default inferred from model)
-    "effort": "medium",                    // none|minimal|low|medium|high|xhigh|max|ultra; omit for direct opencode:*
-                                           // Reasoning-capable pi:* maps ultra to LOW; Pi without reasoning uses OFF.
-                                           // Direct codex:* forwards ultra unchanged. Mono-agent rejects ultra on its Claude SDK route
-                                           // because the pinned SDK public contract ends at max (the SDK JavaScript itself forwards the value).
-                                           // The Claude CLI route passes --effort ultra, but both tested Claude Code binaries
-                                           // (SDK-bundled 2.1.206 and local 2.1.210) warn that it is unknown, ignore it, and use default effort.
-                                           // Direct OpenCode rejects explicit effort.
+    "model": "anthropic:claude-sonnet-4-6", // canonical <provider>:<model>, split at the first colon only
+    "fallbacks": [{ "model": "ollama:gemma4:31b" }],
+    "effort": "medium",                    // none|minimal|low|medium|high|xhigh|max|ultra
+                                           // Narrowed per model for display; still accepted at turn time.
+                                           // A model advertising no ultra rung simply does not offer it in pickers.
                                            // Ranking above max only prevents keyword downgrade.
-    "permissionMode": "default",           // default|plan|acceptEdits|bypassPermissions (CLI backends)
+    "permissionMode": "default",           // default|plan|acceptEdits|bypassPermissions
     "maxTurns": 0,                         // 0 or omitted means unlimited; 1-100 caps turns
     "compaction": {
       "enabled": true,                     // default true
@@ -72,7 +65,11 @@ new agent.
     "maxPendingRuns": 100
   },
 
-  // Local/self-hosted providers for pi:<provider>:<model> references.
+  // Providers the agent supports, keyed by canonical provider id. This map
+  // gates what is selectable: a route naming a provider that is neither a Pi
+  // builtin, nor `ollama`/`lmstudio` (zero-config autodiscovered), nor declared
+  // here with a "baseUrl", fails config load. `piAuthPath`, `piNative`, and
+  // `local` are reserved keys, never provider ids.
   "providers": {
     "piAuthPath": "~/.pi/agent/auth.json", // Pi OAuth credentials (openai-codex, ...)
     // Pi-native bridge tuning (all optional).
@@ -82,19 +79,22 @@ new agent.
       "maxRetryDelayMs": 60000,            // backoff cap between retries (ms)
       "piSessionsRoot": ".mono-agent/sessions" // durable JSONL sessions → resume across restarts (unset = in-memory)
     },
-    "local": [
-      {
-        "id": "ollama",
-        "type": "ollama",                  // ollama | lmstudio | openai_compat
-        "baseUrl": "http://localhost:11434",
-        "enabled": true,
-        "trustPublicUrl": false,           // explicit opt-in for non-private URLs
-        // Keep the key in .env; config stores only its variable name.
-        // Inline "apiKey" remains schema-compatible for existing consumers.
-        "apiKeyEnv": "MY_PROVIDER_KEY",
-        "models": [{ "name": "gemma4:31b", "capabilities": { "context_window": 32768 } }]
-      }
-    ]
+    // One entry per provider id; every field below is optional. Declare an
+    // ollama/lmstudio entry only to override its endpoint or credential.
+    "ollama": {
+      "type": "ollama",                    // ollama | lmstudio | openai_compat; required with a
+                                           // baseUrl unless the id is ollama or lmstudio
+      "baseUrl": "http://localhost:11434",
+      "enabled": true,                     // false keeps the route loadable but unselectable
+      "trustPublicUrl": false,             // explicit opt-in for non-private URLs
+      // Keep the key in .env; config stores only its variable name.
+      // Inline "apiKey" remains schema-compatible for existing consumers.
+      "apiKeyEnv": "MY_PROVIDER_KEY",
+      "maxAdvertisedModels": 100,          // 1-200 catalog cap; default 100
+      "models": [{ "name": "gemma4:31b", "capabilities": { "context_window": 32768 } }]
+    }
+    // Legacy shape, still accepted and migrated on load — do not emit it for a
+    // new agent: "local": [{ "id": "ollama", "type": "ollama", ... }]
   },
 
   // Identity, optional soul, and selected skills.
@@ -128,11 +128,14 @@ new agent.
       "dim": 768                           // nomic-embed-text:v1.5 output dimension
     },
     "llm": {                               // enables bujo capture and the effective bujo tier; omit for lite/journal
-      // Env: MONO_AGENT_MEMORY_LLM_PROVIDER / _MODEL / _EXECUTION_MODE / _ENDPOINT.
+      // Env: MONO_AGENT_MEMORY_LLM_PROVIDER / _MODEL / _ENDPOINT / _TRACE / _TIMEOUT_MS.
+      // `memory.llm.executionMode` and MONO_AGENT_MEMORY_LLM_EXECUTION_MODE were
+      // retired in 0.21.0 and are rejected at load — never emit them.
       "provider": "ollama",                // ollama | agent-host
-      "model": "qwen3.6:latest",           // ollama: model string; agent-host: runtime ref, e.g. pi:openai-codex:gpt-5.5
+      "model": "qwen3.6:latest",           // ollama: model string; agent-host: canonical <provider>:<model>
       "endpoint": "http://localhost:11434" // ollama only; invalid for agent-host
-      // For agent-host, use: "model": "pi:openai-codex:gpt-5.5", "executionMode": "sdk"; omit endpoint.
+      // For agent-host, use: "model": "openai-codex:gpt-5.6-sol"; omit endpoint.
+      // agent-host also accepts "trace" (default true) and "timeoutMs" (default 60000).
     },
     // Bujo auto-scheduler — override the default or disable it.
     // Consolidation runs in-app; no external cron or launchd needed.
@@ -204,9 +207,9 @@ new agent.
     "progress": { "enabled": true }
   },
 
-  // Sandbox for Pi-owned runtime commands. Direct Codex uses its own sandbox;
-  // Claude/direct OpenCode cannot enforce these exact srt scopes. All reject
-  // this block (pi:opencode-go:* remains a Pi route).
+  // Sandbox for Pi-owned runtime commands. Every route is Pi-native, so this
+  // block applies uniformly across the primary, every fallback, and every
+  // per-trigger override — no route family rejects it any more.
   "sandbox": {
     "mode": "native",                      // native (srt-wrapped) | off
     "network": { "mode": "none", "allowlist": [] }, // none|localhost|allowlist|all; *.suffix wildcards; all = open egress with filesystem still enforced (managed/explicit node+cli SRT launch only)
@@ -275,7 +278,7 @@ new agent.
         "path": "/webhook/invoke",
         "mode": "sync",
         "prompt": "Respond to this request:",
-        "model": "claude:claude-sonnet-4-6", // optional per-trigger override
+        "model": "anthropic:claude-sonnet-4-6", // optional per-trigger override
         "effort": "high",                  // same eight-level effort enum as runtime
         "maxRunMs": 3600000,               // endpoint override; 0 disables only this watchdog
         "notify": true,                     // deliver the successful final answer verbatim
@@ -329,6 +332,8 @@ new agent.
     "botUserIds": ["U0BOT"],               // optional supplemental ID; own ID is auto-discovered
     "mentionTextAliases": ["@agent"],
     "stripMentionText": true,
+    "unfurlLinks": false,                   // optional native chat.postMessage override
+    "unfurlMedia": false,                   // omitted preserves Slack's default
     "shortcuts": [                         // slack.shortcuts: JSON-only; callbackId matches the Slack app
       {
         "callbackId": "triage_request",
@@ -412,7 +417,7 @@ new agent.
         "timezone": "UTC",                 // IANA timezone
         "prompt": "Post the morning summary.",
         "conversationId": "cron-daily",    // optional: share memory/history across ticks
-        "model": "claude:claude-sonnet-4-6", // optional per-trigger override
+        "model": "anthropic:claude-sonnet-4-6", // optional per-trigger override
         "effort": "high",
         "notify": true,                     // successful non-empty final answer is delivered verbatim
         // Explicit destination; if omitted, infer only with exactly one candidate.
@@ -435,7 +440,7 @@ new agent.
 mono-agent presets list                 # saved answer-sets (id, risk, description)
 mono-agent presets show <id>            # generated config + .env.example + follow-up checklist
 mono-agent init --preset <id> --yes [--with slack,cron] [--dry-run]   # scaffold from a preset (non-interactive)
-mono-agent init --model claude:claude-sonnet-4-6 --fallback pi:ollama:gemma4:31b [--memory lite|journal|bujo]
+mono-agent init --model anthropic:claude-sonnet-4-6 --fallback ollama:gemma4:31b [--memory lite|journal|bujo]
 mono-agent config       # resolved config field-by-field, each value tagged env/json/default
 mono-agent validate [--preset <id>] [--consumer <path>]     # per-section report; --preset also checks the preset's capabilities
 mono-agent start        # traceability + every configured channel
@@ -445,7 +450,7 @@ mono-agent restart --clear-sessions  # restart AND purge persisted pi sessions (
 
 A `.env` file in the folder is loaded automatically (exported shell variables win); use `--env-file <path>` for an alternate file. `validate --consumer <path>` loads the consumer folder's `.env` by default and resolves relative `--config` / `--env-file` paths there. `start` prints the traceability source (Phoenix when an `observability.exporters` Phoenix entry is configured, otherwise the local JSONL artifacts) and one status line per channel: `running` with its endpoint facts, `waiting_for_config` with the exact missing setting, `disabled`, or `failed` with the reason. Config is JSON-first: edit `mono-agent.config.json` directly (agents can edit it) and run `mono-agent restart` to apply — there is no live browser re-apply.
 
-For BuJo capture and the effective `bujo` tier that runs scheduled consolidation, configure `memory.llm`. Use `provider: "ollama"` with a local Ollama chat model string and optional `endpoint`, or `provider: "agent-host"` with `model` as a normal SDK runtime model reference such as `pi:openai-codex:gpt-5.5` and `executionMode: "sdk"`. `endpoint` is Ollama-only, and CLI-backed refs such as `codex:gpt-5.5` are rejected for memory LLMs until runtimes can enforce no external actions. The same values can be supplied via `MONO_AGENT_MEMORY_LLM_PROVIDER`, `MONO_AGENT_MEMORY_LLM_MODEL`, `MONO_AGENT_MEMORY_LLM_EXECUTION_MODE`, and `MONO_AGENT_MEMORY_LLM_ENDPOINT`. Routine BuJo consolidation runs via the in-app scheduler; the standalone `memory-bujo` maintenance CLI was removed (use `mono-agent memory <subcommand>` from the agent folder). `agent-host` LLM capture is an in-app composition path that injects the `LlmComplete` implementation into the BuJo store.
+For BuJo capture and the effective `bujo` tier that runs scheduled consolidation, configure `memory.llm`. Use `provider: "ollama"` with a local Ollama chat model string and optional `endpoint`, or `provider: "agent-host"` with `model` as a canonical `<provider>:<model>` runtime reference such as `openai-codex:gpt-5.6-sol`. Every route is Pi-native, so there is no SDK-versus-CLI distinction and no reference family is singled out for rejection: any reference the runtime accepts is valid here, including `openai-codex:*`. `endpoint` is Ollama-only and invalid for `agent-host`; `agent-host` additionally accepts `trace` (record each `complete()` as a `mem-*` run; default `true`) and `timeoutMs` (per-`complete()` abort, default 60000, range 1000-600000). The same values can be supplied via `MONO_AGENT_MEMORY_LLM_PROVIDER`, `MONO_AGENT_MEMORY_LLM_MODEL`, `MONO_AGENT_MEMORY_LLM_ENDPOINT`, `MONO_AGENT_MEMORY_LLM_TRACE`, and `MONO_AGENT_MEMORY_LLM_TIMEOUT_MS`. `memory.llm.executionMode` and `MONO_AGENT_MEMORY_LLM_EXECUTION_MODE` were retired in 0.21.0 and now fail config load — delete them, never emit them. Routine BuJo consolidation runs via the in-app scheduler; the standalone `memory-bujo` maintenance CLI was removed (use `mono-agent memory <subcommand>` from the agent folder). `agent-host` LLM capture is an in-app composition path that injects the `LlmComplete` implementation into the BuJo store.
 
 For operator views, run `mono-agent tui` or `mono-agent web` from any directory once the agent is started. Both discover running agents via the trace-source registry. The TUI and assistant-ui web console chat over the default-on `tui` stream endpoint (`"tui": {"enabled": false}` opts out); on macOS, `mono-agent tui --configure` opens a persistent, visibly marked proposal-only SELF-CONFIG conversation against the managed background agent and must not be combined with `--local`. Approval, rejection, and no-change turns continue that session; only quitting exits it. `mono-agent web` is an always-on service namespace, binds `0.0.0.0:5050` by default, and has no app login; use `--loopback` to narrow it. Capable agents expose stable read-only cron channels there. Run-now and runtime enable controls remain hidden unless `tui.apiKey` is configured and `cron.operatorActions.enabled` is explicitly true; every mutation still requires confirmation, is agent-audited, and does not rewrite job config. The former read-only recorder command, package, and relay were removed; use `mono-agent tui` (recorded-run replay) or `mono-agent web` (live console). The low-level `mono-agent-tui` bin also supports `--responder <file>` (embedded, an ESM module default-exporting an `AgentResponderLike` or exporting `createResponder(env, cwd, configJson)`) and `--url <baseUrl>` (direct connect).
 

package/skills/mono-agent-composer/references/discovery-questions.md

@@ -9,16 +9,14 @@ Question:
 ```text
 Which model should drive the agent, and should any backups take over when the provider fails?
 
-1. `claude:<model>` through SDK or CLI mode
-2. `codex:<model>` through CLI mode (the default direct Codex path)
-3. `pi:openai-codex:<model>` through SDK mode (a selectable Pi alternative when Pi auth is configured)
-4. `pi:<provider>:<model>` through SDK mode (OpenAI, Copilot, OpenRouter, OpenCode-through-Pi, local Ollama, LM Studio, ...)
-5. A custom MonoRuntimeLike supplied programmatically (escape hatch)
+1. `<provider>:<model>` on any provider the agent declares — `openai-codex`, `anthropic`,
+   `github-copilot`, `openrouter`, `opencode-go`, local `ollama`/`lmstudio`, ...
+2. A custom MonoRuntimeLike supplied programmatically (escape hatch)
 ```
 
-Fills: `runtime.model`, canonical `runtime.fallbacks[]` (ordered backup routes tried on retryable provider failures, each with optional exact effort), `runtime.executionMode` (usually inferred), `runtime.effort`, `runtime.maxTurns`. Legacy `runtime.fallbackModels` and `MONO_AGENT_FALLBACK_MODELS` remain supported with no removal deadline, but do not emit them for a new agent. Keep a direct `codex:*` chain all-direct. Pi, Claude, and direct OpenCode may mix only with `sandbox` omitted/off; if native mono-agent sandboxing is selected, every primary/fallback/trigger model must stay on Pi (`pi:opencode-go:*` is Pi). Direct `opencode:*` is advanced scaffold/config-only, requires effective allow-all (an omitted or wildcard-containing allowlist with no denied tools) plus an explicit native `permissionMode`, and must omit `runtime.effort` under SDK 1.x.
+Fills: `runtime.model`, `runtime.fallbacks[]` (ordered backup routes tried on retryable provider failures, each with optional exact effort), `runtime.effort`, `runtime.maxTurns`, and `providers` (the map declaring which providers this agent supports — it gates what is selectable). `runtime.fallbackModels` and `MONO_AGENT_FALLBACK_MODELS` were retired in 0.21.0 and are rejected at load; never emit them. Every route is Pi-native, so a chain may mix providers freely and native mono-agent sandboxing applies uniformly.
 
-The interactive `mono-agent init` wizard discovers Pi OpenAI-Codex auth, OpenCode models, Ollama models, and LM Studio's local server best-effort. It defaults to direct `codex:gpt-5.6-terra` and presents both `pi:openai-codex:gpt-5.6-terra` and `pi:openai-codex:gpt-5.6-sol` as concrete selectable candidates. Direct `codex:gpt-5.6-sol` is also selectable; direct GPT-5.6 routes require Codex CLI 0.144.0 or newer. The wizard maps discovered OpenCode options to `pi:opencode-go:<model>` for setup/preflight, and auto-adds local provider modules when a primary or fallback model uses `pi:ollama:*` or `pi:lmstudio:*`. Recover missing Pi OAuth with `mono-agent auth login <provider>` (and `--pi-auth-path` when required). Direct `opencode:<provider>:<model>` refs are supported only as hand-authored runtime backend config; do not present them as a first-class composer or init wizard selection. For local models also fill `providers.local` (e.g. an Ollama or LM Studio base URL plus model capabilities). Follow-up only if needed: continuous provider session per conversation (`runtime.session.mode: "continuous"`, default) versus stateless per-message.
+The interactive `mono-agent init` wizard discovers Pi OpenAI-Codex auth, OpenCode models, Ollama models, and LM Studio's local server best-effort. It presents `openai-codex:gpt-5.6-terra` and `openai-codex:gpt-5.6-sol` as concrete selectable candidates, maps discovered OpenCode options to `opencode-go:<model>`, and auto-adds local provider modules when a primary or fallback model uses `ollama:*` or `lmstudio:*`. Recover missing Pi OAuth with `mono-agent auth login <provider>` (and `--pi-auth-path` when required). `ollama` and `lmstudio` are zero-config autodiscovered; declare a `providers` entry only to override an endpoint or credential, or to widen selection to a provider no route uses. Follow-up only if needed: continuous provider session per conversation (`runtime.session.mode: "continuous"`, default) versus stateless per-message.
 
 ## 2. Channels Of Communication
 
@@ -175,9 +173,7 @@ setup needed.
 - Ask: which chat LLM provider/model for LLM pipelines?
   - Ollama: local model string such as `qwen3.6:latest`; pull it first with
     `ollama pull qwen3.6:latest`.
-  - agent-host: SDK runtime model reference such as `pi:openai-codex:gpt-5.6-terra` with
-    `executionMode: "sdk"`. Do not use CLI-backed refs such as `codex:gpt-5.6-terra`; they are
-    rejected for memory LLMs until runtimes can enforce no external actions.
+  - agent-host: a canonical runtime model reference such as `openai-codex:gpt-5.6-terra`.
 - Ask: should per-turn intelligent capture be enabled (`writeMode: "capture"`), or only
   deterministic rapid-log summaries (`append-host-summary`) plus scheduled consolidation?
 - Ask: should we keep the default consolidation schedule (`0 */2 * * *`), customise the
@@ -213,8 +209,7 @@ For an agent-host memory LLM, write the `llm` block as:
 ```jsonc
 "llm": {
   "provider": "agent-host",
-  "model": "pi:openai-codex:gpt-5.6-terra",
-  "executionMode": "sdk"
+  "model": "openai-codex:gpt-5.6-terra"
 }
 ```
 
@@ -243,7 +238,7 @@ CLI was removed.
 Question:
 
 ```text
-Should Pi-owned runtime commands run inside the native mono-agent sandbox? Direct Codex uses its own native sandbox and rejects this block; Claude and direct OpenCode reject it because their provider-owned tools cannot enforce the exact `srt` scopes.
+Should Pi-owned runtime commands run inside the native mono-agent sandbox? Every route is Pi-native, so one answer covers the primary, every fallback, and every per-trigger override.
 
 1. No sandbox for the first pass
 2. Native sandbox, no network (fail closed)