@piagent/platform 1.7.1 → 1.9.0

package/AGENTS.md

@@ -29,3 +29,10 @@ This repository builds reusable Pi agent infrastructure for multiple projects an
 - Avoid hidden magic in prompts. If behavior must be enforced, put it in extension/tool-call guard.
 - Source code and identifiers: English.
 - Human-facing long-form docs may be Vietnamese; reusable workflow prompts and command names stay English.
+
+## Checks
+```
+npm run typecheck
+npm test
+```
+Run the test files that cover a change first (`node --test tests/<name>.test.mjs`); `npm test` runs everything.

package/CHANGELOG.md

@@ -4,6 +4,118 @@ This file records release-facing changes for Pi Agent Platform. Copy the relevan
 
 ## Unreleased
 
+## v1.9.0 - 2026-10-02
+
+Freeform sessions and the managed team harness. This release retires the task
+contract and the workflow commands; work is requested in plain language and the
+guard checks every tool call.
+
+### Freeform sessions
+
+- Retired the task contract: a session no longer creates a contract, declared scope, work plan, acceptance receipt, completion gate or recovery handoff, and no write waits for one. Task records written by earlier releases under `.pi/piagent-state/tasks` stay readable as history.
+- Retired `/workflow`, `/fresh` (and `/fresh-*`), `/onboard`, `/onboard-project`, `/commands`, `/piagent-commands`, `/model-options`, `/profiles`, `/profile-tech` and the prompt-template aliases (`/task`, `/scout`, `/be-to-fe`, `/plan`, `/discuss`, `/review`, `/commit`, `/pr`, `/platform-improve`). Pi no longer loads `packages/piagent-core/prompts`. Project onboarding is a plain request recorded with `piagent_project_onboarding_record`.
+- Retired the task-bound tools `piagent_task_start`, `piagent_task_progress`, `piagent_task_gate_check`, `piagent_context_record`, `piagent_verify_record`, `piagent_trace_record` and `piagent_memory_citation_record`; a tool group never re-activates them. `piagent_document_read` and `piagent_source_checkout` remain.
+- The input hook passes text through unchanged: pasted checklists are no longer collapsed and long prompts are not stored in a task inbox.
+- Delegation allows up to two fresh read-only helpers; token-saving estimates are telemetry, not an admission gate (bounded-delegation-v2).
+- Kept for freeform turns: protected and read-only paths, permission profiles, the context budget for large files, confirmation for destructive and external-provider actions, and the stale read-to-edit check, which was keyed to the task run and now uses the session.
+
+### Managed team harness
+
+- Added the managed harness for company sessions imported by Agent Watch (`piagent studio`, `--web`): Studio chooses the main, research and review routes; tools run in a sandboxed worker with per-run authority.
+- Per-turn process from the team's Harness in Studio: plan, checks and review, each `suggest` or `require`, with bounded fix loops. A plan guard refuses edits (including shell edits) until a plan exists and reports `planSkipped` after three refused answers; invented tool names are counted.
+- Process report v2 (`plan_skipped`, `unknown_tools`) is negotiated: Studio lists `process_versions`, Agent Watch advertises `process-v2`.
+- Detached processes are stopped at turn end; stopping during a helper reports `aborted`/`managed-helper-cancelled` instead of a send failure.
+
+### Security and fixes
+
+- The runtime dependency audit accepts three denial-of-service advisories in `brace-expansion` 5.0.9 (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p) until 2026-10-31: every published Pi host, 1.0.0 included, pins that version through its npm-shrinkwrap, so no Piagent change can update it. The exceptions live in `scripts/runtime-advisory-exceptions.json`, apply only at the Pi host's own copy, print on every audit and end on their own; any other finding still blocks.
+- Redacted Agent Studio credentials (`as_live_`, `as_device_`, `as_run_`). Write/edit previews and runtime command output are redacted before they are split or truncated, the gateway stream no longer flushes half a credential on a long line, and the client live file label recognises Studio tokens.
+- A shell command can no longer create a new file in a shared source-checkout cache by spelling the path through an alias such as `/var` for `/private/var`.
+- WebUI approvals: an allowed decision is now consumed by the guard, so the decision request receives its receipt and the approval leaves the queue. Before, every decision without a task stayed pending and could fill the broker.
+- Removed the WebUI runtime actions that still sent `/commands` and `/onboard ...`; with those commands gone they would have reached the model as a message and started a paid turn. A test now ties every WebUI runtime action to a registered command.
+- `piagent-explain` no longer lists task-contract, task-scope or lifecycle gates.
+- The sandbox allows signals within the same sandbox, which fixes `grep` EPERM, timeouts and orphaned cancelled commands.
+- The dashboard relay no longer freezes when `project.paths` exceeds the default control response limit.
+
+### Dashboard and company mode, from live runs
+
+- A company turn now settles once, after its harness rounds (the check request, the review, the fixes). Before, the dashboard treated the turn as finished at the first answer: Stop disappeared, the later rounds were not streamed, and for a moment the turn read "no answer yet, press Continue".
+- `run_with_network` works: the network sandbox now allows the system resolver socket, so an approved command can resolve host names. Before, every approved network command failed with `ENOTFOUND`. When an approved command still cannot reach the network, the agent is told the network is unreachable instead of being pointed back to `run_with_network`.
+- The header and the Workspace panel show a review subagent while it runs ("Subagent 1/2"); its start and end now refresh the conversation.
+- A company conversation opened while company mode is not running (after a restart, a crash or an update) says so and offers Reconnect in place. Reading still never starts company mode, since starting may ask for Keychain access.
+- A conversation whose history cannot be read no longer shows the previous conversation's messages under its title.
+- Approval cards: the network approval shows the exact command; task, tool-call and provider references are gone; paths inside the project are shown relative to it (the project folder reads "The whole project folder"); known reasons and consequences are shown in Vietnamese. The exec-policy reason now reads "Confirmation required: the command runs git push" instead of naming a "legacy policy pattern".
+- An `apply_patch` step is shown as an edit of its files with the patch's diff, like `edit`, in the history and while it runs.
+
+### Many members at once, from a 20-developer run
+
+- A company request that Studio refuses because every company model account that can serve the conversation is busy (`session_account_busy_retry_later`, `session_account_not_ready_retry_later`, `concurrency_limit`, `account_capacity_unavailable`, `request_rate_limit`) now waits in line and is asked again, for up to 20 minutes. These refusals come before any model is asked, so nothing is sent twice; a failure after admission is still never replayed. The wait is a step of the running turn in the dashboard ("Wait for a free company account") and the working line in the Terminal; Stop ends it. Before, the turn failed after Studio's 30-second wait.
+- Dashboard commands are outdated only when their own conversation changed. Before, any change to any conversation made every other command stale, so with several conversations running a new conversation could fail with `session-revision-stale`. A failure to create a conversation is now shown as a sentence instead of a code. Stop no longer fails while the agent works through quick steps: a running turn changes its conversation after every step, so Stop is bound to the operation it names, not to the page's last read; if Stop still fails, the dashboard says so instead of doing nothing.
+- A company request refused before the model did any work because the account's sign-in was being renewed (`upstream_auth_required`, `execution_precondition_failed`) is asked again up to three times, 3, 6 and 9 s apart; an account that really has to sign in again still says so.
+- Opening a company conversation, starting a run and granting a subagent ask Studio again when it is too busy to answer in time (`serverUnavailable`), as does a request Studio could not check in time (`operation_unavailable`). Under load, most company conversations opened from the dashboard used to fail to open, and most required reviews ended as "review could not run". A review that still cannot run keeps its reason as a code in the conversation file.
+- The dashboard stays fast with many conversations: listing them read every session file in full on every catalog (863 conversations: about 4 s each time, far more under load, so pages waited 30–40 s and timed out). Unchanged files now keep what was read before and only changed ones are read again, by Pi itself (44 ms instead of about 4 s).
+- A member's session can read the skills Pi lists for it where they are installed (the package's and the user's); the guard used to refuse that read as "outside the project". Writes there stay refused.
+- A new conversation whose creation takes longer than the dashboard's 30-second answer (the first one after the Gateway starts, a company runtime opening) is no longer reported as "could not be created" while it is created and runs: the page sends the same command again, which waits behind the create and returns its receipt, for up to two minutes; if it still has no answer it says the conversation may exist. Before, a member who believed the message was lost sent it again and two runs edited the same project.
+- A dashboard message that stays unconfirmed is released after two minutes: its command now expires then, so it can no longer run, and the draft is kept to send again. Before, the composer stayed locked until the page was reloaded.
+- Company sessions recover after the Mac sleeps: a run grant that lapsed under a request (Studio's clock catches up at once after a sleep, and grants last two minutes) is renewed and the request asked again, and an Agent Watch helper killed by a request that outlived the sleep is replaced when the next turn starts. Before, every company conversation failed with `invalid_run_grant` or "the Agent Watch helper stopped" until it was reopened.
+- A request the model's provider declines under its usage policy (seen when a member asked to print an `.env` file encoded in base64) is reported as such, with its own dashboard copy ("ask in a different way"), instead of "the request could not be sent".
+- An answer stream that ended with nothing in it ("stream ended without a stop reason") is reported as "the model returned no response" (`upstream_incomplete`) instead of "the request could not be sent"; it is not sent again, and "tiếp tục" continues. A company failure no code names keeps its own words, redacted, in the conversation file (not shown) so it can be told apart later.
+- Two project folders with the same name (two clones of one repository) show where each one is in the new-conversation menu.
+- A message sent right after Stop reaches the conversation on a busy machine. Every catalog the dashboard built opened and parsed every conversation file to learn its model and thinking level (929 files, 140 MB: about a second of blocked Gateway each time, 1–6 s under load); a Stop then took up to 50 s and the next messages stayed unconfirmed with the composer locked for minutes. A file's facts are now kept until its size, modification time or inode changes: catalogs take 0.1–0.5 s under the same load, and a stop-then-send probe that failed 3 of 4 times passes.
+- A Gateway that is busy is no longer replaced by a second one. `piagent dashboard open` and the company launch took a Gateway that did not answer within 1.5 s for gone and started another; the new one took over the control socket while the first kept running unreachable, serving its pages and holding its conversations (three were found running at once). A Gateway that answers late is waited for (up to 30 s), only a socket nobody listens on is replaced, and an old Gateway that exits no longer removes the running one's socket.
+- `piagent-doctor` lists `enabledModels` patterns that match no model Pi knows (Pi warns about each on every start), and `piagent-model-scope --prune` removes only those; patterns of a provider that is only signed out are kept.
+- Public text names no other agent product or project; the wording check enforces it across docs, the docs site and the core package.
+
+### Experiment loops and test audits
+
+- The guard covers experiment-loop tools that an optional Pi package can add. `run_experiment` runs its command through `bash -c` itself, so the guard checks that command like `bash` (protected paths, the exec policy, confirmations, read-only profiles). `log_experiment` commits every change when an idea is kept and erases every uncommitted change otherwise, outside the guard, so `init_experiment` and `log_experiment` run only on an `experiment/` branch or a linked worktree, and `init_experiment` only with nothing uncommitted outside `.auto/`. A loop config that moves the commands to another folder is refused. The dashboard shows an experiment run as the command it runs.
+- New packaged skill `test-audit` (`/skill:test-audit`, also chosen by the model when it writes or changes tests): decide whether a new test earns its place, and find tests that cost more than they protect, with a read-only review table before any edit.
+
+### Guard cleanup
+
+- Removed the guard code that only ran with a task contract: the completion hook, task change and verification recording, the task-bound branches of tool authorization (read-only task rules, opaque-shell rule, semantic repair, phase decisions, performance review), and the phase-tool, semantic-repair and independent-acceptance runtimes it created. The guard went from 4993 to 4139 lines; protected and read-only paths, permission profiles, the context budget, the stale-edit check and confirmations are unchanged.
+- Reopening a session that ran a task before 1.9.0 no longer resumes, re-binds or warns about that task; its records stay as history.
+
+### Models
+
+- Added reviewed Sonnet 5.5 metadata to explicit Claude/full model-scope setup on Pi 0.87.1: native 1M context, 128K output, adaptive thinking, no unsupported off/minimal modes or temperature override. Existing custom endpoints and model entries are preserved. This does not establish account entitlement.
+- Included Sonnet 5.5 and Opus 5.5 in model selection presets. Agent Watch can supply the same model through a Studio key without changing personal authentication.
+
+### Tests and evidence
+
+- Retired the test suites that only exercised the task contract (task lifecycle, acceptance gating, workflow dispatch and the scripted production journeys that asserted task records); they remain at commit 85f76db. Security assertions that used a task as setup were rewritten to run without one, and the reconnect, lost-receipt and single-turn HTTP/WebSocket journeys now run as freeform turns.
+- The historical P3 phase-tool counterfactual reports `counterfactual-baseline-retired` instead of a ratio, because its baseline tools no longer exist.
+- Benchmark and journey results published for earlier releases were measured with task contracts and are historical.
+- Live verification on the installed release: 9 personal dashboard scenarios and 4 company scenarios (plan, checks and review; Stop during the review; a network install after approval; a message sent during a turn) pass; 27/27 browser tests.
+- A busy test fixture that ignores SIGTERM now exits when its test runner is killed, instead of spinning a CPU core.
+- Docs site: an Ecosystem page (Piagent, Agent Watch, Agent Studio), a 1.9.0 What's new with dashboard screenshots, and pages that still described the task contract updated. The screenshots are served by the site and not shipped in the npm package.
+
+### Install and update
+
+```sh
+npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.87.1
+npm install -g --ignore-scripts @piagent/platform@1.9.0
+piagent-install --stable
+piagent-doctor --offline
+```
+
+
+## v1.8.0 - 2026-09-23
+
+- Pinned Pi host and Pi AI to 0.87.1 so Codex-authenticated sessions and the WebUI can list GPT-6 Astra, Sol, and Luna. Pi's authenticated catalog remains the authority for availability and supported thinking levels.
+- Added a new parent-routing map: Luna Medium for bounded work, Sol Medium/High for everyday and higher-risk work, and Astra Extra High for broad ambiguous work. Parent routing stays off by default; explicit model pins remain unchanged. If a GPT-6 target is unavailable, the router records a legacy 5.6 fallback instead of silently substituting it. The historical v1 mapping and benchmark corpus remain frozen.
+- New setup and WebUI sessions prefer GPT-6 Sol High when authenticated. Existing sessions and explicit user settings are not rewritten by the package. Astra's unsupported `off` level is omitted from WebUI choices.
+- Verified the release without paid provider turns; the prior 108-session comparison is historical evidence for v1.7.1, not a GPT-6 performance or token-saving claim.
+
+### Install and update
+
+```sh
+npm install -g --ignore-scripts @earendil-works/pi-coding-agent@0.87.1
+npm install -g --ignore-scripts @piagent/platform@1.8.0
+piagent-install --stable
+piagent-doctor --offline
+```
+
 ## v1.7.1 - 2026-09-23
 
 The v1.7.0 tag was not published: both tag workflow attempts reached the
@@ -680,7 +792,7 @@ Four documents restated something the code already knew, and each had drifted. T
   and fail-closed shadow/recommend/auto modes. `piagent-route` provides the only
   explicit prelaunch enforcement path; extension auto does not mutate the Pi
   user default or switch models mid-conversation.
-- Added a bounded Windsurf-style retrieval route (read-only grep/find/read, up
+- Added a bounded retrieval route (read-only grep/find/read, up
   to eight parallel searches and four rounds, recommendation-only), a 240-case
   offline routing gate, and a resume-locked 144-session static-versus-adaptive
   protocol dry-run. No authenticated benchmark is implied by these local gates.

package/README.md

@@ -2,7 +2,7 @@
 
 [Tiếng Việt](README.vi.md)
 
-Reusable Pi package for project onboarding, profile-based coding workflows, guarded tool usage, multi-agent orchestration, MCP setup, memory policy, and task verification.
+Reusable Pi package for freeform coding chat, guarded tools, project context and a managed main/research/review harness.
 
 Public docs: [piagent.io.vn](https://piagent.io.vn)
 
@@ -46,13 +46,11 @@ cd /path/to/project
 pi
 ```
 
-That is the daily flow. Pi onboards the project, selects an operating profile, uses the right tools, records task evidence, and hands off verified implementation work.
+Send the request directly in plain language. Since 1.9.0 there is no `/task` or `/workflow` step, no task contract and no projected token-saving threshold.
 
-Running several agents side by side — one implementing, one reviewing read-only, one verifying — start `herdr` from the project instead of `pi` and open a Pi pane per role. Herdr orchestrates terminals and sessions; it is not a security boundary, so every gate still lives in the Pi extension and OAuth is still a `/login` inside Pi. See [Herdr workflow](docs/herdr-workflow.md).
+For the local macOS team harness, import a managed key through Agent Watch and run `piagent studio` or `piagent studio --web`. Studio chooses the main/research/review routes; the member chooses thinking. Managed sessions have isolated tools and per-run authority. Personal sessions keep their own OAuth and model picker under `pi`.
 
-First run in a new project, type `/onboard` and choose the run action, or type `/onboard run`. It launches the bounded onboarding workflow, recommends a profile, explains the tradeoffs, asks before applying, then writes `.pi/piagent-profile.json`, its lock, `.pi/tech-stack.json`, `.pi/tech-context/*`, `.pi/project-context.md`, and `.pi/memory/*`.
-
-`/commands` lists everything else. For trusted local runs, `piagent-auto` wraps `pi --approve` and sets a permission profile for that run — it does not bypass protected-path checks, destructive shell checks, task gates, or verification evidence. See the [command reference](docs/command-reference-vietnamese.md).
+See [local acceptance and remaining release gates](docs/managed-local-acceptance.md). Existing direct CLI keys remain compatible and do not gain managed harness enforcement.
 
 ## Uninstall
 
@@ -69,12 +67,11 @@ Removal targets what is registered in Pi's settings rather than what the current
 
 ## What it provides
 
-- Global Pi package with workflow prompts, runtime commands, skills, guard extensions, and piagent subagents.
-- Runtime command menu via `/commands`.
-- Workflow launcher via `/workflow` for task, scout, BE-to-FE, review, git, and onboarding work.
-- Runtime onboarding via `/onboard`; `/onboard run` launches the first-read onboarding workflow.
+- Global Pi package with runtime commands, skills, guard extensions, and piagent subagents.
+- Freeform turns: a request in plain language is the whole interface. Scouting, planning, review, commits and pull requests are ordinary requests.
+- Project onboarding on request: ask the agent to inspect the project read-only and record its context, and it writes `.pi/project-context.md`.
 - Runtime profile selection via `/profile`, plus select-style tech stack setup via `/profile setup` and `/profile tech`.
-- Runtime usage/session controls via `/usage` and `/fresh`, plus Pi native `/name` and `/session`.
+- Runtime usage controls via `/usage`, plus Pi native `/name`, `/new` and `/session`.
 - Explicit project memory via `/memory` or `/memory-policy` and `piagent_memory_*` tools.
 - Local Context Engine controls via `/context`: incremental code index, hybrid search, token-budgeted packs, bounded current-turn source/test snapshots for automatic tasks, test impact, efficiency telemetry, and semantic compaction. Index storage is owner-only and securely purged when exclusion policy changes; manual packs remain advisory, while current-turn snapshots are freshness-checked and exact edits fail closed on a later mismatch.
 - MCP setup helpers for Context7, Chrome DevTools, GitHub, Playwright, and Figma.
@@ -87,17 +84,14 @@ Removal targets what is registered in Pi's settings rather than what the current
   - `piagent_exec_policy_check`
   - `piagent_context_budget`
   - `piagent_tool_policy_check`
-  - `piagent_task_gate_check`
   - `piagent_usage_snapshot`
   - `piagent_context_preflight`
   - `piagent_orchestration_policy`
 - Context7-ready tech stack manifest and concise `.pi/tech-context/*` snapshots for selected profile roles.
-- Accident-brake guardrails for protected paths, destructive shell commands, task contracts, context manifests, observed verification evidence, and trace records.
-- Session-bound Task Contract v2: one Pi session per task, bounded retry history,
-  Git baseline-aware changed files, scope enforcement, all-command verification,
-  strict acceptance receipts, identity-bound journal checkpoints, and an
-  immutable terminal outcome. These are same-runtime operational records, not
-  independent attestation.
+- Accident-brake guardrails for protected and read-only paths, destructive shell commands, external-provider actions, large-file edits, and edits made against a stale read.
+- Task contracts and workflow commands were retired in 1.9.0: a session no longer
+  creates a contract, scope, acceptance receipt or final gate. Task records left
+  under `.pi/piagent-state/tasks` by earlier releases stay readable as history.
 - Adaptive context planning uses Pi-reported model/thinking/context facts to set
   a bounded context budget; cited repository-memory hints never replace current
   source reads. The parent model stays operator-pinned—there is no automatic
@@ -119,8 +113,8 @@ Removal targets what is registered in Pi's settings rather than what the current
   transactional-config, and exact temporal-billing invariants. It locks
   Piagent/`codex-cli` to Luna/medium and uses three repeats (42 paired sessions) with token, duration,
   full-suite, and zero-retry gates. A separate provider-free WebUI
-  parity gate proves the 10 workflow and 32 runtime-control paths before any
-  model quota is used.
+  parity gate proves the 31 runtime-control paths before any model quota is
+  used (workflow ingress was retired in 1.9.0).
 - The public `v1.6.0` production-v1 run
   `production-v1-20260824T040017Z-05b7cf`, on exact commit
   `3bba8f0b3ff521bc2a355e1f6bef6d1bbdc09511` with GPT-5.6 Luna Medium,
@@ -142,7 +136,7 @@ Project profiles can declare a runtime `permissionProfile`:
 | Profile | Use when | Guard behavior |
 |---|---|---|
 | `read-only` | Scout, audit, review | Allows `read`, `grep`, `find`, `ls`, and piagent state tools; blocks shell, `write`/`edit`/`apply_patch`, and unknown tools. |
-| `workspace-write` | Normal implementation | Default profile. Keeps current protected-path, shell, capability, task, and verify gates. |
+| `workspace-write` | Normal implementation | Default profile. Keeps protected-path, read-only-path, shell and capability checks, and asks before destructive or external actions. |
 | `trusted-full-access` | Trusted local automation | Expands workspace tool/scope autonomy, but still enforces protected paths, secret redaction, capability lock integrity, and destructive/external confirmation. |
 
 For one run, set `PIAGENT_PERMISSION_PROFILE=read-only|workspace-write|trusted-full-access`, or use `piagent-auto --read-only`, `--workspace-write`, or `--full-access`.
@@ -162,7 +156,7 @@ Legacy aliases still work: `/permission-status`, `/read-only`, `/workspace-write
 
 ## Parent-direct orchestration
 
-The parent model owns reasoning, implementation, and verification. Helpers are off by default. With explicit opt-in, runtime may dispatch one fresh read-only helper only when it proves two independent lanes and at least 30% projected net token saving after handoff and merge. Workers, retries, nested helpers, and parallel helpers remain disabled.
+The parent model owns reasoning, implementation, and verification. When helpers are enabled it may delegate up to two fresh read-only helpers, such as an independent research question or a review of its patch. Token-saving estimates are telemetry, not an admission requirement. Helpers never implement, inherit parent history, spawn nested helpers, or retry a deterministic failure.
 
 Inside Pi:
 
@@ -170,27 +164,14 @@ Inside Pi:
 /piagent-orchestration
 ```
 
-This shows the active mode, one-helper ceiling, review lenses, Field Guide path, writer policy, and dispatch/skip evidence without triggering a model follow-up.
-
-For bounded source work, runtime creates the session-bound contract before the
-model starts and injects its path scope plus concise verifier. Broad, high-risk,
-or ambiguous work falls back to one explicit `piagent_task_start`. A source task
-requires a Git working tree and a meaningful project verifier. Direct and shell
-writes are constrained to declared scope; final completion needs every planned
-verify command and changed-file evidence. Read-only scouts do not need a source
-verifier and must leave the working tree unchanged.
-
-The installed v1.7.1 policy treats incomplete acceptance proof as diagnostic:
-unproved criteria remain pending and completion carries no quality claim. Task
-contract, scope, current passing verification, and trace still gate completion.
-Select `acceptanceProofMode: "enforce"` in a reviewed package policy when every
-criterion must be proved before completion.
+This shows the active mode, helper ceiling, review lenses, Field Guide path, writer policy, and dispatch/skip evidence without triggering a model follow-up.
 
-Routine evidence is runtime-managed: successful targeted reads, actual changes,
-exact verifier results, current-tree digest, trace and final gate are recorded
-from Pi lifecycle hooks. Automatic bounded tasks carry no Piagent management
-schema or lifecycle calls. Context/status/evidence/gate tools are diagnostic or
-recovery surfaces, not a checklist for every task.
+Source work is freeform: the model reads, edits and runs the project's checks
+directly, with no contract, declared scope or final gate. The guard still
+enforces protected and read-only paths, the permission profile, the context
+budget for large files and stale read-to-edit snapshots, and asks before
+destructive or external actions. In the managed company harness the plan,
+check and review steps per turn are set by the team's Harness in Studio.
 
 ## Profiles
 
@@ -228,28 +209,24 @@ Commands and lock format: [Capability packs](docs/capability-packs.md).
 
 ## Main workflows
 
-Everything below is typed inside a Pi session. `/commands` lists the full set; [command reference](docs/command-reference-vietnamese.md) explains each one. The recommended team surface is grouped by namespace so people do not need to remember many one-off commands.
+Work is requested in plain language; the commands below are settings and read-only views typed inside a Pi session, and none of them starts a model turn. [Command reference](docs/command-reference-vietnamese.md) explains each one.
 
 | Command | Use when |
 |---|---|
-| `/workflow` | Open the workflow picker. |
-| `/workflow task <request>` | The requirement is clear enough to implement. |
-| `/workflow scout <request>` | Read-only investigation — payment, auth, data, or backend-contract mapping — before deciding whether to implement. |
-| `/workflow discuss <rough request>` | The requirement is not clear yet. |
-| `/workflow plan <goal>` | You want a plan before any edit. |
-| `/workflow review current diff` | Reviewing work already done. |
-| `/workflow commit <message>` | Governed local commit: inspect status and diff, stage only the intended files, run verification, commit. Never pushes. |
-| `/workflow pr <title>` | Governed pull request: confirms before any `git push` or GitHub write. Draft by default. |
-| `/workflow be-to-fe <request>` | Backend or spec is read-only and the implementation target is frontend. Pair with `/profile be-readonly-fe`. |
-| `/workflow platform-improve <request>` | Package-level work: setup, MCP, model scope, memory, runtime policy, prompts, skills, subagents. |
-| `/fresh <workflow> <request>` | The current session is already heavy. Opens a new governed session for any canonical workflow (`/fresh help` lists them) and replays the compact workflow prompt. |
-| `/piagent-inspector` | Open one read-only menu for task files and line diff, commands and failures, safety warnings, and context budget. A four-row panel is always shown beside Pi's native footer and can be hidden for the session with `toggle`. |
+| `/profile` | Show or apply the project profile; `/profile setup` selects the tech for each role. |
+| `/permission` | Show or switch the session permission profile. |
+| `/context` | Context Engine index, search, packs, test impact and compaction. |
+| `/usage` | Session, model, thinking and context usage; `/usage logs` shows compacted tool output. |
+| `/memory` | Explicit project memory. |
+| `/piagent-mcp` | MCP servers, scopes and approvals. |
+| `/piagent-status` | Profile, guard, runtime and authenticated model state. |
+| `/piagent-inspector` | One read-only menu for the session diff, commands and failures, safety warnings, and context budget. A four-row panel is always shown beside Pi's native footer and can be hidden for the session with `toggle`. |
 
-Short workflow aliases such as `/task`, `/scout`, `/be-to-fe`, `/commit`, and `/pr` still work for power users, but docs and onboarding teach `/workflow` as the default.
+The workflow commands (`/workflow`, `/task`, `/scout`, `/fresh`, `/onboard`, `/commands`, `/model-options`) were retired in 1.9.0. Say what you want instead — "scout the payment flow read-only, do not edit", "review the current diff", "commit these two files". For a heavy session, start a new one with Pi's `/new`.
 
-Git stays a capability rather than a `/git-*` namespace, so natural language works too. Broad staging — `git add .`, `git add -A`, `git add --all`, `git add -- .`, `git add :/` — requires confirmation, so unrelated or private files are not swept into a commit silently.
+Git stays a capability rather than a `/git-*` namespace, so natural language works. `git push`, GitHub writes and publishing ask for confirmation first. Broad staging — `git add .`, `git add -A`, `git add --all`, `git add -- .`, `git add :/` — requires confirmation, so unrelated or private files are not swept into a commit silently.
 
-Paste a screenshot path straight into a task and the guard attaches it as `[image1]` before the model sees the prompt: `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.bmp`, up to 4 images at 8 MB each. The target must be inside the project or a directory listed in `additionalReadRoots`; protected paths, paths outside the resolved filesystem read scope, symlink escapes, and extension-only fake images are refused. The guard also collapses pasted mandatory-flow boilerplate, so there is no need to paste a checklist into every task.
+Paste a screenshot path straight into a task and the guard attaches it as `[image1]` before the model sees the prompt: `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.bmp`, up to 4 images at 8 MB each. The target must be inside the project or a directory listed in `additionalReadRoots`; protected paths, paths outside the resolved filesystem read scope, symlink escapes, and extension-only fake images are refused. Pasted text reaches the model as typed; there is no checklist to paste.
 
 Web research and image understanding remain separate capabilities. The pinned `pi-web-access` integration uses the authenticated `openai-codex` route first when it is available and keeps its automatic search fallback; it never copies provider credentials into project or browser state. Images are passed as native image input to the selected session model rather than through a Piagent-owned OCR service. The dashboard reports both effective facts under **Settings → Providers & models**: `Codex Web Search` when that route is ready, and `Codex Vision` only when the current Codex model advertises image input.
 
@@ -259,7 +236,7 @@ A spec that lives outside the project — the one just downloaded to `~/Download
 
 ## Model selection
 
-Handled by Pi's native UI: `/model` or `Ctrl+L` to pick, `Ctrl+P` to cycle the scoped set, `Shift+Tab` to cycle thinking level where the model supports it. Type `/model-options` for the current Piagent model/thinking guidance. Global setup seeds `enabledModels`; see [Model options](docs/model-options.md) to inspect or re-apply it.
+Handled by Pi's native UI: `/model` or `Ctrl+L` to pick, `Ctrl+P` to cycle the scoped set, `Shift+Tab` to cycle thinking level where the model supports it. Global setup seeds `enabledModels`; see [Model options](docs/model-options.md) to inspect or re-apply it.
 
 ## MCP setup
 
@@ -277,9 +254,9 @@ Keep provider keys in environment variables, never in committed config. Switchin
 
 ## Subagents
 
-`piagent-setup` installs the optional `pi-subagents` compatibility runtime with a clamped `safe` preset. Daily tasks stay parent-direct; builtin agents and workers are disabled, and explicit helper mode still requires the measured 30% gate. The inspector states dispatch/skip reasons and projected saving.
+`piagent-setup` installs the optional `pi-subagents` compatibility runtime with a clamped `safe` preset. Daily tasks stay parent-direct; builtin agents and workers are disabled, and helper mode allows up to two read-only helpers. The inspector states dispatch/skip reasons.
 
-`/subagents-doctor` runs a health check. See [Subagents and multi-agent](docs/subagents-and-multiagent.md) for the one read-only helper opt-in contract.
+`/subagents-doctor` runs a health check. See [Subagents and multi-agent](docs/subagents-and-multiagent.md) for the read-only helper opt-in contract.
 
 ## Repository layout
 
@@ -292,7 +269,7 @@ piagent/
 ├─ evals/                            governed evaluation scenarios
 ├─ packs/                            versioned capability manifests and recipes
 ├─ packages/
-│  ├─ piagent-core/                  Pi package: extensions, runtime, prompts, skills
+│  ├─ piagent-core/                  Pi package: extensions, runtime, skills, managed harness
 │  └─ piagent-webui/                 dashboard: contracts, client, server, gateway, ownership
 ├─ schemas/                          JSON schemas
 ├─ scripts/                          setup, doctor, verification helpers
@@ -356,8 +333,8 @@ This repository intentionally excludes:
 - [Subagent orchestration capabilities](docs/subagent-orchestration-capabilities.md)
 - [Context-window policy](docs/context-window-policy.md)
 - [Memory policy](docs/memory-policy.md)
-- [Task lifecycle tiếng Việt](docs/task-lifecycle-vietnamese.md)
-- [Task implementation contract](docs/task-implementation-contract.md)
+- [Task lifecycle tiếng Việt](docs/task-lifecycle-vietnamese.md) (historical, before 1.9.0)
+- [Task implementation contract](docs/task-implementation-contract.md) (historical, before 1.9.0)
 - [Runtime quality baseline](docs/runtime-quality-baseline.md)
 - [Usage observability](docs/usage-observability.md)
 - [Model options](docs/model-options.md)
@@ -369,7 +346,7 @@ This repository intentionally excludes:
 
 ## Maturity
 
-The current package version is read from package metadata and release tags. Personal machines may follow the unpinned package source when accepting ongoing updates; production/team quickstarts and committed project settings should pin an explicit tag such as `v1.7.1` or a reviewed commit.
+The current package version is read from package metadata and release tags. Personal machines may follow the unpinned package source when accepting ongoing updates; production/team quickstarts and committed project settings should pin an explicit tag such as `v1.9.0` or a reviewed commit.
 
 Ready for:
 
@@ -379,7 +356,7 @@ Ready for:
 - read-only scouting and planning;
 - backend-readonly/frontend-write workflows;
 - bounded subagent scouting, planning, implementation, and review;
-- runtime checks for exec policy, context budget, context preflight, tool policy, task gate, and usage snapshot;
+- runtime checks for exec policy, context budget, context preflight, tool policy, and usage snapshot;
 - project-level quality/token/cost benchmarking.
 
 Application-level policy layer:
@@ -394,11 +371,9 @@ Application-level policy layer:
 - The ambiguous `source` field remains metadata for configured external providers and piagent tools, but is treated as a filesystem path for file-oriented tools and unknown/local tools; protected-path and read-scope checks then apply before execution.
 - Broad `grep`, `find`, and `ls` sweeps get result-filter backstops: protected file content lines or protected path metadata are redacted before the model sees output. Text tool results and JSON-like result details also pass through shared sensitive-data redaction; image, audio, and resource payloads are left intact.
 - The redaction release gate is a synthetic/internal benchmark for contextual recall, benign preservation, structured fields, and bounded large output. The public security threat model maps current assumptions, attack vectors, controls, and residual risks; it is not an independent audit. Stronger assurance still requires a broader OS/shell matrix, more parser fuzzing, continued symlink/path-traversal testing, third-party review, and an LTS/backport policy. Opaque entropy without a credential-bearing context and transformed output such as base64-encoded content remain outside the redaction guarantee.
-- Raw `bash` access to protected paths is blocked through shell operand extraction. The guard covers partial shell globs, bare filenames, canonical symbolic-link aliases, and attached input/output redirections. `.pi/piagent-state/**` and `.pi/piagent-profile.json` are self-protected; use `piagent_context` and piagent task tools instead.
+- Raw `bash` access to protected paths is blocked through shell operand extraction. The guard covers partial shell globs, bare filenames, canonical symbolic-link aliases, and attached input/output redirections. `.pi/piagent-state/**` and `.pi/piagent-profile.json` are self-protected; use `piagent_context` and the piagent tools instead.
 - External writes launched through guarded shell tools are confirmation-gated as well as direct provider tools. This includes GitHub CLI write actions and non-read-only `curl`/`wget` forms, including common execution wrappers; known read/list/GET forms remain non-interactive.
-- Verify evidence is accepted only when it matches an observed Pi bash tool result after task start. The observed ledger is persisted under `.pi/piagent-state/observed-bash.jsonl`, so parent agents can validate bash results produced by guarded subagent processes.
-- Observed command identity is retained as a SHA-256 hash while sensitive command text is redacted at both the in-memory and persisted evidence boundaries.
-- Passing final gates require an observed exit `0` command that exactly matches one of the task/profile `verifyCommands`; ad-hoc commands such as `true`, `echo ok`, or `npm test || true` are advisory only.
+- Observed bash results are persisted under `.pi/piagent-state/observed-bash.jsonl`, so parent agents can check results produced by guarded subagent processes. Command identity is kept as a SHA-256 hash while sensitive command text is redacted at both the in-memory and persisted boundaries.
 - Project memory files are private-by-default in generated projects; opt in to shared memory only after review/redaction.
 - It is not an OS sandbox or complete security boundary. It depends on the controlled tool paths and shell parsing that the platform observes, and it cannot stop another process with the same OS permissions from reading or writing outside the guard. For untrusted code, untrusted prompts, or adversarial workloads, run Pi inside an isolated container/VM with filesystem, process, network, and credential boundaries.
 - Release verification audits the small helper dependency tree separately from the exact Pi host and pinned optional add-ons at the high-severity gate. Upstream lower-severity findings are still reported and tracked; a green helper-only audit is not treated as proof that the deployed runtime tree is clean.

package/README.vi.md

@@ -2,7 +2,7 @@
 
 [English](README.md)
 
-Pi Agent Platform là reusable Pi harness dành cho project onboarding, workflow theo profile, guarded tool usage, MCP, multi-agent orchestration, memory policy, Context Engine và task verification.
+Pi Agent Platform cung cấp chat trực tiếp, công cụ có kiểm soát quyền, ngữ cảnh dự án và khung main/research/review cho tài khoản công ty.
 
 Tài liệu public: [piagent.io.vn](https://piagent.io.vn)
 
@@ -22,50 +22,17 @@ cd /path/to/project
 pi
 ```
 
-Trong session Pi đầu tiên của project, chạy `/onboard`. Hằng ngày, dùng `/workflow` để chọn luồng và `/usage` để xem session, model, thinking và token.
-
-## Nguyên tắc vận hành
-
-- Mỗi task dùng một session có tên rõ ràng.
-- Slash command chỉ chạy handler đã đăng ký; agent không phải scout lại command.
-- Prompt hướng dẫn model, còn policy quan trọng được enforce tại runtime.
-- Permission `read-only` chỉ cho phép kiểm tra; shell và các tool ghi `write`/`edit`/`apply_patch` đều bị chặn.
-- MCP config không chứa token hoặc OAuth credential.
-- Task source-changing cần scope, verify evidence và final gate.
-- Local state nằm trong `.pi/piagent-state/`, có owner-only permission và bounded retention.
-- Project-specific business logic nằm trong project profile hoặc adapter, không đưa vào core.
-
-Task Contract v2 hiện gắn task/session/run identity với current-tree verification,
-acceptance receipt giữ nguyên tiêu chí chưa được chứng minh, hash-chained journal checkpoint, retry có giới hạn và
-terminal outcome bất biến. Đây là operational record do cùng runtime tạo ra,
-không phải independent attestation.
-
-Policy cài sẵn của v1.7.1 dùng chế độ diagnostic cho acceptance proof: tiêu chí
-chưa được chứng minh vẫn ở trạng thái pending và khi hoàn tất sẽ ghi rõ không có
-khẳng định chất lượng. Task contract, scope, bước verify đang pass và trace vẫn
-chặn hoàn tất nếu thiếu. Khi cần chứng minh mọi tiêu chí trước khi hoàn tất,
-chọn `acceptanceProofMode: "enforce"` trong package policy đã được review.
-
-Adaptive Context Planner dùng model, thinking và context usage do Pi báo để đặt
-budget có giới hạn; repository-memory hint luôn có citation và không thay thế
-việc đọc source hiện tại. Parent model vẫn do operator pin: baseline ổn định này
-chưa ship solver hoặc automatic parent routing. Host execution là mặc định; nếu
-yêu cầu isolation backend chưa có adapter, mutation bị block thay vì âm thầm
-fallback về host.
-
-## Điều phối parent-direct
-
-Parent model tự sở hữu suy luận, implementation và verification. Helper mặc định
-tắt. Khi operator chủ động bật, runtime chỉ được dispatch tối đa một helper
-read-only dùng context fresh nếu chứng minh có hai lane độc lập và tổng token dự
-kiến sau handoff/merge giảm ít nhất 30%. Worker, retry, nested helper và parallel
-helper đều bị tắt.
-
-Trong Pi, `/piagent-orchestration` hiển thị mode hiện tại, trần một helper,
-review lens, writer policy và bằng chứng dispatch/skip mà không tạo model turn.
-`piagent-setup` chỉ cài `pi-subagents` như runtime tương thích tùy chọn với preset
-`safe` đã bị clamp; `/subagents-doctor` dùng để kiểm tra health. Chi tiết nằm tại
-[Subagents và multi-agent](docs/subagents-and-multiagent.md).
+Nhập yêu cầu bằng lời thường trong Pi hoặc WebUI. Từ bản 1.9.0 không còn bước `/task` hay `/workflow`, không còn task contract và không còn ngưỡng tiết kiệm token.
+
+## Agent Watch Auto trên macOS
+
+Admin cấu hình model cho main, khảo sát và review trong Studio. Thành viên nhập URL/key ở Watch, chọn Piagent rồi Import. Mở **Piagent công ty** từ Watch hoặc chạy `piagent studio`; thêm `--web` để mở dashboard. Người dùng chọn mức suy luận; context theo model thực tế. Phiên cá nhân tiếp tục dùng `pi` và chọn model/OAuth riêng.
+
+Key công ty cần loại **Piagent công ty**. Key CLI trực tiếp cũ giữ nguyên; Studio có nút tạo key đi kèm dùng chung hạn mức. Không đổi tài khoản công ty sang cá nhân trong cùng hội thoại.
+
+Main có tối đa hai trợ lý chỉ đọc; không sinh nhánh con tiếp. Review gắn với bản chụp patch và báo hết hiệu lực khi code đổi. UI hiển thị token từng trợ lý. Bản macOS managed dùng công cụ cách ly và quyền ngắn hạn theo lượt; chế độ cá nhân vẫn là thực thi trên host.
+
+Bản local này chưa phải bản phát hành có Developer ID. [Trạng thái nghiệm thu](docs/managed-local-acceptance.md) phân biệt test nội bộ, gọi provider thật và phần còn thiếu.
 
 ## Web search và vision
 
@@ -87,27 +54,36 @@ trực tiếp vẫn nằm trong workspace của project thay vì bị nhét vào
 tiếp tục áp protected path, redaction, session binding và attachment ref dùng một
 lần.
 
-Session Hub cũng đưa các workflow Terminal lên UI: task, scout, BE → FE,
-discuss, plan, review, commit, PR, onboard và platform-improve. Màn hình New chat
-hiển thị preflight workflow/change mode/quyền trước khi gửi. Trong **Cài đặt →
-Điều khiển project**, operator có thể xem runtime/usage, onboarding/profile,
-Context Engine, memory và MCP governance mà không cần nhớ slash command. WebUI
-gửi đúng command vào Pi runtime; thao tác read-only được kiểm tra là 0 model
-token, còn thao tác ghi hoặc semantic compact bắt buộc xác nhận rõ ràng.
+Màn hình New chat gửi đúng nội dung người dùng nhập; WebUI không còn bộ chọn
+workflow. Trong **Cài đặt → Điều khiển project**, operator có thể xem
+runtime/usage, profile, Context Engine, memory và MCP governance mà không cần nhớ
+slash command. WebUI gửi đúng command vào Pi runtime; thao tác read-only được
+kiểm tra là 0 model token, còn thao tác ghi hoặc semantic compact bắt buộc xác
+nhận rõ ràng. Muốn onboard project, hãy nhờ agent trong chat đọc project (chỉ
+đọc) và ghi lại context.
 
 ## Command chính
 
+Công việc được yêu cầu bằng lời thường; các command dưới đây là thiết lập và màn
+hình chỉ đọc, không command nào mở lượt model.
+
 | Command | Mục đích |
 |---|---|
-| `/workflow` | Chọn workflow task, scout, plan, review, commit, PR hoặc onboarding |
-| `/profile` | Xem hoặc đổi project profile |
+| `/profile` | Xem hoặc đổi project profile; `/profile setup` chọn tech cho từng vai trò |
 | `/permission` | Đổi permission mode trong session |
 | `/context` | Xem Context Engine, index, retrieval và telemetry |
 | `/usage` | Xem session, model, thinking và context usage |
 | `/piagent-inspector` | Mở menu read-only để xem task diff, command fail/block, safety warning và context budget; panel bốn dòng tự hiện sát footer native, `toggle` để ẩn trong session |
 | Pi native `/name` | Đặt tên session; Piagent nhận rename event để map Agent Watch/report |
 | `/memory` | Xem hoặc cập nhật explicit project memory |
-| `/onboard` | Khởi tạo project profile và context |
+| `/piagent-mcp` | Xem và quản lý MCP server, scope và phê duyệt |
+| `/piagent-status` | Xem profile, guard, runtime và trạng thái model đã xác thực |
+
+Các command workflow (`/workflow`, `/task`, `/scout`, `/fresh`, `/onboard`,
+`/commands`, `/model-options`) đã bỏ từ bản 1.9.0. Hãy nói điều mình cần, ví dụ
+"scout luồng thanh toán, chỉ đọc, không sửa", "review diff hiện tại", "commit hai
+file này". Session đã nặng thì mở session mới bằng `/new` của Pi. `git push`,
+thao tác ghi lên GitHub và publish đều hỏi xác nhận trước.
 
 ## Architecture
 
@@ -115,7 +91,7 @@ Code được quản lý theo các layer:
 
 1. Composition root đăng ký Pi extension.
 2. Runtime adapter xử lý Pi hook, command, tool và session UI.
-3. Core service xử lý policy, task, context và state.
+3. Core service xử lý policy, context và state (bản ghi task cũ chỉ còn để đọc lịch sử).
 4. Integration quản lý MCP, capability và security primitive.
 5. CLI trong `scripts/` chỉ parse argument và gọi use case.
 
@@ -144,7 +120,7 @@ piagent/
 ├─ evals/                             kịch bản đánh giá có governance
 ├─ packs/                             capability manifest và recipe có version
 ├─ packages/
-│  ├─ piagent-core/                   Pi package: extension, runtime, prompt, skill
+│  ├─ piagent-core/                   Pi package: extension, runtime, skill, managed harness
 │  └─ piagent-webui/                  dashboard: contract, client, server, gateway, ownership
 ├─ schemas/                           JSON schema
 ├─ scripts/                           setup, doctor và helper kiểm tra
@@ -163,9 +139,6 @@ Adaptive model routing cho fresh task dùng `piagent-route --prompt "<task>" --j
 Chỉ `--execute --yes` mới mở provider-backed Pi process; `/model`/CLI pin luôn
 được giữ và extension không đổi model giữa conversation.
 
-Khi session đã nặng, `/fresh <workflow> <request>` mở session mới cho bất kỳ
-workflow canonical nào và replay prompt gọn; `/fresh help` liệt kê catalog hiện hành.
-
 ## Verification
 
 ```bash
@@ -202,7 +175,7 @@ Xem [bằng chứng benchmark](https://piagent.io.vn/benchmark) và
 
 Gate này chạy architecture check, test, typecheck, capability validation, runtime smoke và docs consistency trước khi release.
 
-Bản phát hành hiện tại là `v1.7.1`. Với team hoặc production, hãy pin tag này
+Bản phát hành hiện tại là `v1.9.0`. Với team hoặc production, hãy pin tag này
 hoặc một commit đã review thay vì dựa vào nguồn package không cố định.
 
 ## Security