@prismer/runtime 2.0.8 → 2.2.63

package/built-in-skills/agent-coordination/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: agent-coordination
+scope: common
 description: Find other agents, list participants in a conversation, send routed messages, attach files, and recover earlier conversation context (history / resolve a fuzzy reference / read a quoted message / read compressed summaries). Use whenever you need to delegate to another agent, address a peer in a multi-agent conversation, send a message that carries a file, or pull context that scrolled out of your prompt window. Executes via `cloud discover`, `cloud im conversations`, `cloud send`, `cloud file send`, `cloud conversation history|resolve-identifier|summary`, and `cloud quote read` CLIs.
 ---
 
@@ -16,7 +17,16 @@ If you have an inline `Task` / `Subagent` / `ParallelAgents` / fan-out tool avai
 - never @-mention the supposed assignee in the conversation
 - finish in seconds, which to the user looks like you did the work yourself (because you did)
 
-For peer-agent delegation, the canonical paths are **`cloud task create --assignee-name <peer>`** (tracked deliverable; see the `tasks` skill) and **`cloud send <peer-username>`** (ad-hoc message; see below). Anything else — including inline subagents — is the wrong tool, and the user will notice (the supposed assignee was never @-mentioned in chat, and your response came back too fast).
+For peer-agent delegation, the canonical paths are **`cloud task create --assignee-name <peer>`** (tracked deliverable; see the `tasks` skill) and **`cloud send <peer-username> "<message>" --by-username --workspace-id "$PRISMER_WORKSPACE_ID"`** (ad-hoc message; see below). Anything else — including inline subagents — is the wrong tool, and the user will notice (the supposed assignee was never @-mentioned in chat, and your response came back too fast).
+
+### `cloud task create` vs `cloud send` — 选哪条 + 结果回流
+
+| 你想要的 | 用 | 结果怎么回来 |
+| --- | --- | --- |
+| **可追踪委派**（要交付物、要进度、要落看板） | `cloud task create --assignee-name <peer>` | **不自动回流**：peer 在独立 context 跑，产物落 task 卡；你须 `cloud task get <taskId>` 主动拉（`status=completed` 才算成）。详见 `tasks` skill 的「结果回流」段。 |
+| **即兴消息**（问一句、转一份、打个招呼） | `cloud send <peer-username> "<message>" --by-username --workspace-id "$PRISMER_WORKSPACE_ID"` | peer 若在**同一会话**，回复直接出现在这条会话里；不落看板、不可追踪。 |
+
+口诀：**要结果 / 要看板 → `cloud task create` 然后 `cloud task get` 取**；只是说句话 → `cloud send`。两者都不是 inline subagent。
 
 ## When to use
 
@@ -30,51 +40,79 @@ For peer-agent delegation, the canonical paths are **`cloud task create --assign
 ### Discover (workspace-wide directory)
 
 ```bash
-cloud discover                                    # all visible agents
-cloud discover --capability code-review           # filter by capability
-cloud discover --online-only                      # only online agents
-cloud im contacts                                 # your contact list
+cloud discover --workspace-id "$PRISMER_WORKSPACE_ID"                                  # all agents in this workspace
+cloud discover --workspace-id "$PRISMER_WORKSPACE_ID" --capability code-review         # filter by capability
+cloud discover --workspace-id "$PRISMER_WORKSPACE_ID" --online-only                    # only online agents
+cloud im contacts                                 # users you've chatted with (conversation-derived)
+cloud im contacts --external --workspace-id "$PRISMER_WORKSPACE_ID"  # your cross-workspace contact edges
 ```
 
+`cloud discover` is a workspace-scoped Agent Registry contract: every result
+is backed by an AgentCard in the requested workspace and carries its routing
+`userId`. Agents from other workspaces are NOT in this directory — the only
+legitimate cross-workspace targets are your **external contact edges**
+(`cloud im contacts --external`, built by the owner's 「添加外部联系人」+ 双侧
+approval): each entry carries the peer's `imUserId` (use it as the send
+target), its workspace name, and its lifecycle. If the user asks you to reach
+an agent outside this workspace, check that list first — if the peer is there,
+message it directly; if not, say plainly that no external contact edge exists
+and the owner must add the contact first. When the target is already in the
+current conversation, prefer the conversation members listing below instead
+of searching.
+
 ### List participants in a conversation (scoped)
 
 ```bash
 cloud im conversations                            # all your conversations
 cloud im conversations --unread                   # unread only
-cloud im conversations <conversationId> --members # agents + humans in this conversation
+cloud im conversations <conversationId> --members --json # exact agent + human participant fields
 ```
 
 ### Send a message
 
 ```bash
 # Direct message to an agent
-cloud send <to-username> "Please review the PR"
-cloud send <to-username> "## Report" -t markdown
-cloud send <to-username> --reply-to <messageId> "Acknowledged"
+cloud send <to-username> "Please review the PR" --by-username --workspace-id "$PRISMER_WORKSPACE_ID"
+cloud send <to-username> "## Report" -t markdown --by-username --workspace-id "$PRISMER_WORKSPACE_ID"
+cloud send <to-username> "Acknowledged" --reply-to <messageId> --by-username --workspace-id "$PRISMER_WORKSPACE_ID"
 
 # Conversation-scoped (multi-agent group)
 cloud im groups send <groupId> "Team update: feature shipped"
 
 # With routing metadata
-cloud send <to-username> "Need approval" --conversation-id <convId>
+cloud send <to-username> "Need approval" --conversation-id <convId> --by-username --workspace-id "$PRISMER_WORKSPACE_ID"
+
+# Cross-workspace external contact (must appear in `cloud im contacts --external`)
+cloud im send <peer-imUserId> "hello across workspaces"
 ```
 
+**Deferred (202 ACTION_DEFERRED):** a cross-workspace send without an active
+contact edge does NOT deliver — it returns `deferred` with an `approvalId` and
+the message waits for contact approval (both-side owner approval). Report that
+plainly to the user: "已发起联系人请求，等待对方台审批（approvalId: …）；
+批准后重新发送。" Never report such a send as sent.
+
 ### Send with attached file
 
 > **决定怎么交付文件 — 先读这条:**
 >
-> - **你这次任务的最终交付物（要跟你的回复一起出现的产物）** → 写进
->   `${PRISMER_ARTIFACTS_DIR}`（当前 dispatch 的 `artifacts/` 目录）。
->   daemon artifacts-watcher 会自动归档并把 assetId **挂到你这条 dispatch
->   回复上**，于是「文件 + 你的总结文字」是**同一条消息**。这是默认路径。
+> - **用户明确要求随当前回复交付的文件** → 写入
+>   `${PRISMER_ARTIFACTS_DIR}`（当前 dispatch 的 `artifacts/` 目录），然后显式运行
+>   `cloud deliver <abs-path>`。auto-scan 默认 OFF；只写文件不算交付。
+> - **看板 task 的文件产物** → 显式运行 `cloud task attach <abs-path>`，并以
+>   命令返回的 assetId 为准。
 > - **`cloud file send` 会另起一条独立消息**（先于/晚于你的回复单独落），
 >   只适合「对话进行中临时丢个文件给对方看」这种 ad-hoc 分享，**不要**用它
 >   交付任务最终产物 —— 否则用户会看到「一条只有文件的消息」+「一条只有
 >   文字的消息」分裂开（release201/30 §4 + §7）。
 
 ```bash
-# 默认：最终交付物写进 artifacts/，随你的回复单条附带（无需任何 send 命令）
-cp ./report.pdf "${PRISMER_ARTIFACTS_DIR}/"     # 然后正常回复即可（平台自动收尾）
+# 当前回复的文件交付：写入 artifacts/ 后显式 deliver
+cp ./report.pdf "${PRISMER_ARTIFACTS_DIR}/"
+cloud deliver "${PRISMER_ARTIFACTS_DIR}/report.pdf"
+
+# 看板 task 文件产物：显式 attach
+cloud task attach "${PRISMER_ARTIFACTS_DIR}/report.pdf"
 
 # ad-hoc 临时分享（会另起独立消息 — 不要拿来交付最终产物）
 # 文字说明用 -c/--content（不是 --message —— 后者不存在，commander 会报
@@ -84,14 +122,15 @@ cloud file send <conversationId> ./report.pdf
 cloud file send <conversationId> ./report.pdf --content "Latest numbers, please review"
 cloud file send <conversationId> ./image.png --mime image/png
 
-# On hermes (no per-dispatch env): also pass --run-id "<run_id>" (copied from
-# <execution_context>) so the daemon proxy activates. Spawn adapters
-# (claude-code / codex) have the env set and don't need it.
-cloud file send <conversationId> ./report.pdf --run-id "<run_id>"
+# 常态（含 hermes）：直接 `cloud file send <conversationId> <path>` 即可——daemon
+# (release203/15c) 按 agent 身份自动关联你当前的 dispatch。仅当你要对另一个
+# (非当前) dispatch 交付、或 daemon 报 409 歧义时，才从 <execution_context> 抄
+# --run-id "<run_id>" 传入。Spawn 适配器 (claude-code / codex) env 已注入。
+cloud file send <conversationId> ./report.pdf --run-id "<run_id>"  # 仅跨-dispatch / 409 时
 
 # Or upload first, then send by asset id
 cloud file upload ./report.pdf                    # → returns assetId / uploadId
-cloud send <to-username> "See attached" --asset-id <assetId>
+cloud send <to-username> "See attached" --asset-id <assetId> --by-username --workspace-id "$PRISMER_WORKSPACE_ID"
 ```
 
 ### Attach a file to a message you ALREADY sent (`cloud attach`)
@@ -106,11 +145,11 @@ cloud send <to-username> "See attached" --asset-id <assetId>
 ```bash
 cloud attach <messageId> ./addendum.pdf
 
-# On hermes (no per-dispatch env): also pass --run-id "<run_id>" and
-# --conversation-id "<conversation_id>" (both copied from <execution_context>)
-# so the daemon proxy activates + the attach route knows which thread the
-# message lives in. Spawn adapters (claude-code / codex) have the env set.
-cloud attach <messageId> ./addendum.pdf --run-id "<run_id>" --conversation-id "<conversation_id>"
+# 常态（含 hermes）：直接 `cloud attach <messageId> <path>` 即可——daemon
+# (release203/15c) 按 agent 身份自动关联你当前的 dispatch（含 conversation）。
+# 仅当你要对另一个 (非当前) dispatch 操作、或 daemon 报 409 歧义时，才从
+# <execution_context> 抄 --run-id / --conversation-id 传入。
+cloud attach <messageId> ./addendum.pdf --run-id "<run_id>" --conversation-id "<conversation_id>"  # 仅跨-dispatch / 409 时
 ```
 
 ### Read earlier conversation context (on demand)
@@ -168,19 +207,19 @@ prismer session checkpoint restore <runId>   # re-apply a saved snapshot
 
 ## Workflow (delegating to another agent)
 
-1. **List conversation participants first.** `cloud im conversations <convId> --members` returns the `agents` array with `username`, `id`, `displayName`, `agentType`, `capabilities`. Don't `discover` if the target is already in the conversation — it leaks agents outside the routing scope into your candidate set.
-2. **Pick the target.** Match on capability + status. Exclude your own username. If multiple match, pick the most specific capability and surface the choice to the user if unclear.
+1. **List conversation participants first.** `cloud im conversations <convId> --members --json` returns a `participants` array. Each item has `{ id, role, user: { id, username, displayName, role, agentType } }`; it does not contain AgentCard capabilities or status. Don't `discover` if the intended target is already identifiable in this conversation.
+2. **Pick the target.** For an existing participant, select an agent by `user.role === "agent"` and use its exact `user.id` or `user.username`; exclude yourself. If the request instead requires capability/status-based selection, use the workspace-scoped Agent Registry with `cloud discover --workspace-id "$PRISMER_WORKSPACE_ID"`.
 3. **Compose a routed message** with: requested action, context, constraints, expected output. Don't bury the ask in pleasantries.
-4. **Send with the exact `to-username`** the listing returned. Don't transform "@Alice" → "alice" by yourself — use the exact string the service returned.
+4. **Send with the exact `username`** the listing returned via `cloud send <username> "<message>" --by-username --workspace-id "$PRISMER_WORKSPACE_ID"`. Don't transform "@Alice" → "alice" by yourself — use the exact string the service returned. Alternatively, pass the discovered `userId` directly and omit `--by-username`.
 5. **Check the return value.** `cloud send` may return `{ ok: false, error: 'agent_not_found' }` even when you got the username from listing (the agent may have left between calls). If `ok: false`, surface the error; don't pretend dispatch succeeded.
 
 ## Workflow (file attachment)
 
 1. Confirm the file exists locally and is the artifact the user should receive.
-2. Prefer writing new outputs under `PRISMER_ARTIFACTS_DIR` (the current dispatch's `artifacts/` dir) — the daemon artifacts-watcher auto-archives every file there as an IMAsset and attaches the IDs to your dispatch reply. See release201/30 §4 for the full pipeline.
-3. Use this skill for **existing files elsewhere** or when you need an explicit message title alongside the attachment.
-4. Record the uploaded asset ID returned by the service.
-5. Mention the attachment in the user-facing reply **only after** the send/queue succeeded.
+2. Follow the Runtime carrier directive first. An inline PKF is not a file attachment and must not create a parallel file.
+3. For an explicitly requested file, write new output under `PRISMER_ARTIFACTS_DIR`, then run `cloud deliver <abs-path>` for the current reply or `cloud task attach <abs-path>` for a task. Auto-scan is OFF.
+4. Use `cloud file send` for **ad-hoc conversation sharing**, or `cloud attach` to add a file to an existing message.
+5. Record the asset ID returned by the service and mention the attachment only after the command succeeded.
 
 ## Operating Rules
 
@@ -188,8 +227,8 @@ prismer session checkpoint restore <runId>   # re-apply a saved snapshot
 
 - Choose capability filters based on the **actual task**, not broad role guesses. "Code review" not "developer".
 - Use `--online-only` only when immediate response is required — otherwise async agents can pick up the task.
-- Compare names, IDs, descriptions, capabilities, and status before picking. Identical display names exist.
-- Use returned IDs/usernames for routing — never invent or guess identifiers from chat text.
+- Compare `userId`, `username`, `name`, descriptions, capabilities, and status before picking. Identical names exist.
+- Use the returned `userId` directly, or resolve the returned `username` with `--by-username --workspace-id "$PRISMER_WORKSPACE_ID"` — never invent or guess identifiers from chat text.
 
 ### List participants
 
@@ -203,7 +242,7 @@ prismer session checkpoint restore <runId>   # re-apply a saved snapshot
 - **Never send to yourself.**
 - **Don't send to agents outside the conversation** unless this is a direct message (`cloud send <user-id>`).
 - Don't include secrets or **unrelated private context** in the routed message. The agent on the other end gets the full text.
-- If routing involves `@username` shorthand in the message body, prefer letting the CLI add it via `--to-username` over hand-writing the mention.
+- For username routing, pass the exact username as the first argument with `--by-username --workspace-id "$PRISMER_WORKSPACE_ID"`; do not hand-write an `@username` mention in the message body.
 
 ### File attach
 
@@ -222,9 +261,9 @@ prismer session checkpoint restore <runId>   # re-apply a saved snapshot
 
 ## Output reporting
 
-After discover: list each candidate as `<username> · <displayName> · capabilities=[a,b,c] · status=<online|offline>`.
+After discover: the default table exposes `User ID`, `Username`, `Name`, `Capabilities`, `Status`, and `Description`. Capability names may originate from either legacy strings or structured capability objects, but the table normalizes both to names.
 
-After listing participants: same format, scoped to the conversation.
+After listing participants: report `<user.id> · <user.username> · <user.displayName> · role=<user.role> · agentType=<user.agentType>`; participant rows do not contain AgentCard capabilities or status.
 
 After send: echo the returned `messageId` and `conversationId`. If the service returned a redacted version (signed/encrypted), surface that.
 

package/built-in-skills/agent-meta/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: agent-meta
+scope: common
 description: Inspect, snapshot, publish, and fork Prismer long-running agents through the cloud agent lifecycle API.
 allowed-tools: cloud.agent.spec cloud.agent.snapshot cloud.agent.snapshots cloud.agent.restore cloud.agent.publish cloud.agent.packs cloud.agent.fork prismer.agent.snapshot prismer.agent.publish prismer.agent.fork
 metadata:
@@ -10,6 +11,17 @@ metadata:
 
 # Agent Meta
 
+## Skill self-check
+
+Start from the current Runtime's effective skill list (Hermes skills_list or
+the registered skill surface), not a recursive disk count. Distinguish installed
+files, registered capabilities, and actual smoke-tested operations. Platform or
+session filtering is expected, not a damaged skill or a question for the user.
+For a full disk audit, classify excluded entries as informational and missing
+commands/credentials as not ready. Check prerequisites without printing secrets;
+command presence does not prove authentication. Report only actionable defects,
+and never claim all functions passed from frontmatter parsing alone.
+
 Use this skill when the user asks you to inspect, save, restore, publish, or fork a Prismer long-running agent.
 
 ## Commands

package/built-in-skills/assets/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: assets
+scope: common
 description: Locate, inspect, and read content-addressed workspace assets — search by filename/metadata, describe before reading bytes, then read bounded ranges. Use whenever the user references an uploaded file, when you need to cite file evidence, or when a task input/output is an asset URI. Executes via the `cloud asset` CLI and tools.
 ---
 
@@ -74,7 +75,7 @@ cloud asset sync                                          # refresh local cache
 - **Always describe before reading.** Metadata tells you whether reading is safe (text vs binary, size, encoding).
 - Don't treat metadata as proof of file contents — title and MIME can lie. The content hash is the only authoritative identity.
 - If multiple locators disagree (e.g. filename matches two assets with different hashes), **stop and re-search** rather than reading the wrong file.
-- Avoid reading binary or image-heavy assets directly. For images, use `cloud parse` (OCR) or a vision-capable downstream tool; for PDFs, use `cloud parse`.
+- Avoid reading binary or image-heavy assets as text. Use the `liteparse` local `lit` workflow for supported parsing/OCR, `office-artifacts` for document-specific operations, or an available vision tool for images. Do not invoke `cloud parse`: the cloud heavy-format parser is not available.
 
 ### Read
 
@@ -106,11 +107,10 @@ pre-signed URL into prose:
 { "kind": "image", "assetId": "<assetId>", "mediaType": "image/png", "alt": "<one-line desc>" }
 ```
 
-When it resolves a **file** asset (PDF, CSV, archive) the reply should include
-the asset as an attachment (auto-handled by writing into
-`$PRISMER_ARTIFACTS_DIR` — daemon's artifacts-watcher scans the dispatch's
-`artifacts/` dir and auto-archives + attaches per release201/30 §4 — or
-explicitly as):
+When it resolves an existing **file** asset (PDF, CSV, archive), do not copy it
+into `$PRISMER_ARTIFACTS_DIR` or create a duplicate upload. Return the existing
+asset through the structured ContentBlock attachment using its authoritative
+`assetId`:
 
 ```json
 { "kind": "file", "assetId": "<assetId>", "mediaType": "application/pdf", "filename": "<original>" }
@@ -119,7 +119,9 @@ explicitly as):
 Do NOT paste raw bytes or `data:` URIs into the reply body — they bypass the
 content-addressed store, defeat caching, and make follow-up retrieval
 impossible. The chat renderer reads ContentBlock attachments and surfaces
-them as previews automatically.
+them as previews. If the user explicitly requests a newly generated local
+file, that is a separate file carrier: write it under `artifacts/` and run
+`cloud deliver <abs-path>` or `cloud task attach <abs-path>` explicitly.
 
 ## Backing capabilities (D22 mapping)
 

package/built-in-skills/browser-use/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: browser-use
+scope: common
+description: LLM-driven browser automation via the pre-installed browser-use library (chromium already in the image). Use whenever the task needs to interact with web pages beyond a single fetch — multi-step navigation, form filling, clicking, scrolling, structured data extraction, screenshots, or tasks the plain web tools can't complete. Runs as a Python script against the built-in chromium; LLM goes through the Prismer gateway (no external LLM key needed).
+---
+
+# Browser-Use (Web Automation)
+
+The sandbox image ships `browser-use` (installed in `/home/user/.venv`) and a full
+chromium build (playwright). This skill drives them: write a short Python script
+with `Agent(task=..., llm=..., browser=...)`, run it, report the result.
+
+## When to use
+
+- Multi-step web tasks: search → open → extract → compare → download
+- Form filling / login flows / clicking through pages
+- Structured extraction (tables, listings, prices) that a single fetch can't parse
+- Screenshots / visual confirmation of a page state
+- Anything needing JS-rendered content (SPA pages the fetch tools miss)
+
+For a single plain fetch, prefer the existing web tools (lighter). Reach for
+browser-use when they come back empty or the task is interactive.
+
+## How to run
+
+```bash
+# chromium executable (version dir may change — resolve dynamically):
+CHROME="$(find /home/user/.cache/ms-playwright -name chrome -type f | head -1)"
+
+# LLM = our gateway (OpenAI-compatible). PRISMER_BASE_URL / PRISMER_API_KEY
+# are already in the environment; never hardcode them in the script.
+cat > /tmp/bu_task.py <<'PY'
+import os, asyncio
+from browser_use import Agent, ChatOpenAI, Browser
+
+async def main():
+    llm = ChatOpenAI(
+        base_url=f"{os.environ['PRISMER_BASE_URL']}/api/v1",
+        api_key=os.environ['PRISMER_API_KEY'],
+        model=os.environ.get('PRISMER_MODEL', 'deepseek-v4-flash'),
+        temperature=0.0,
+        # REQUIRED for the Prismer gateway: browser-use defaults to forcing
+        # JSON-schema structured output (response_format=json_schema) which
+        # our upstream models reject with 400 "response_format type
+        # unavailable" (verified 2026-08-07). Disable it; the agent still
+        # extracts via its normal flow.
+        dont_force_structured_output=True,
+    )
+    browser = Browser(
+        headless=True,
+        executable_path=os.environ['CHROME'],
+    )
+    agent = Agent(
+        task="<TASK>",  # be specific: steps, URLs, what to extract, output format
+        llm=llm,
+        browser=browser,
+    )
+    history = await agent.run(max_steps=30)
+    print("RESULT:", history.final_result())
+    print("URLS:", history.urls())
+    print("ERRORS:", history.errors())
+    await browser.close()
+
+asyncio.run(main())
+PY
+CHROME="$CHROME" /home/user/.venv/bin/python /tmp/bu_task.py
+rm -f /tmp/bu_task.py
+```
+
+## Task-writing rules (from browser-use docs)
+
+- **Be specific**: `"Go to https://…, use extract with query 'first 3 quotes and their authors', save to quotes.csv via write_file"` — open-ended tasks fail.
+- **Name actions**: "use search action for …", "use click to open first result in a new tab", "use send_keys with 'Tab Tab Enter'" — the agent maps these to its built-in tools.
+- **Error recovery**: if navigation is blocked, fall back to a search engine; if a click fails, use keyboard navigation (`send_keys`).
+- **max_steps**: default 100; keep 30 for focused tasks, raise for long flows.
+- **Anti-bot**: if a page blocks automation, try `use_cloud=True` — NOT available here (no Browser-Use Cloud key). Fall back to search/cache.
+
+## Environment facts
+
+| Item | Value |
+| --- | --- |
+| Python | `/home/user/.venv/bin/python` (browser-use installed here) |
+| Chromium | `$(find /home/user/.cache/ms-playwright -name chrome -type f \| head -1)` |
+| LLM | Prismer gateway (`PRISMER_BASE_URL` + `PRISMER_API_KEY`, OpenAI-compatible) |
+| Model | `PRISMER_MODEL` env (default `deepseek-v4-flash`) — adjust for the task |
+| Telemetry | browser-use collects anonymous telemetry by default — set `ANONYMIZED_TELEMETRY=false` |
+
+## Output contract
+
+Report to the user: `history.final_result()` (the extracted answer), the URLs
+visited, and any errors. If `history.is_successful()` is False, say so plainly
+with `history.errors()` — do not invent a completion. Attach screenshots
+(`history.screenshot_paths()`) as task assets when they matter.

package/built-in-skills/canvas-design/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: canvas-design
+scope: persistence
 description: Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
 license: Complete terms in LICENSE.txt
 ---
@@ -133,7 +134,7 @@ To create museum or magazine quality work, use the design philosophy as the foun
 
 **Text as a contextual element**: Text is always minimal and visual-first, but let context guide whether that means whisper-quiet labels or bold typographic gestures. A punk venue poster might have larger, more aggressive type than a minimalist ceramics studio identity. Most of the time, font should be thin. All use of fonts must be design-forward and prioritize visual communication. Regardless of text scale, nothing falls off the page and nothing overlaps. Every element must be contained within the canvas boundaries with proper margins. Check carefully that all text, graphics, and visual elements have breathing room and clear separation. This is non-negotiable for professional execution. **IMPORTANT: Use different fonts if writing text. Search the `./canvas-fonts` directory. Regardless of approach, sophistication is non-negotiable.**
 
-Download and use whatever fonts are needed to make this a reality. Get creative by making the typography actually part of the art itself -- if the art is abstract, bring the font onto the canvas, not typeset digitally.
+Use fonts with a verified redistribution/embedding license. Bundled `canvas-fonts` TTFs do not cover Chinese; check the cmap for all requested characters and select an installed licensed CJK fallback when needed (for example an available Noto CJK family). Never silently render missing-glyph boxes. Inspect the rendered output and retain each font's OFL/copyright notice when distributing it. Download additional fonts only from a trusted source with its license, not arbitrary font mirrors.
 
 To push boundaries, follow design instinct/intuition while using the philosophy as a guiding principle. Embrace ultimate design freedom and choice. Push aesthetics and design to the frontier. 
 
@@ -145,7 +146,7 @@ Output the final result as a single, downloadable .pdf or .png file, alongside t
 
 ## FINAL STEP
 
-**IMPORTANT**: The user ALREADY said "It isn't perfect enough. It must be pristine, a masterpiece if craftsmanship, as if it were about to be displayed in a museum."
+**IMPORTANT**: Perform a final quality pass against the user's actual brief. Do not invent user feedback or override requested content, style, accessibility, or scope.
 
 **CRITICAL**: To refine the work, avoid adding more graphics; instead refine what has been created and make it extremely crisp, respecting the design philosophy and the principles of minimalism entirely. Rather than adding a fun filter or refactoring a font, consider how to make the existing composition more cohesive with the art. If the instinct is to call a new function or draw a new shape, STOP and instead ask: "How can I make what's already here more of a piece of art?"
 
@@ -153,4 +154,4 @@ Take a second pass. Go back to the code and refine/polish further to make this a
 
 ## MULTI-PAGE OPTION
 
-To create additional pages when requested, create more creative pages along the same lines as the design philosophy but distinctly different as well. Bundle those pages in the same .pdf or many .pngs. Treat the first page as just a single page in a whole coffee table book waiting to be filled. Make the next pages unique twists and memories of the original. Have them almost tell a story in a very tasteful way. Exercise full creative freedom.
+To create additional pages when requested, create more creative pages along the same lines as the design philosophy but distinctly different as well. Bundle those pages in the same .pdf or many .pngs. Treat the first page as just a single page in a whole coffee table book waiting to be filled. Make the next pages unique twists and memories of the original. Have them almost tell a story in a very tasteful way. Exercise full creative freedom.

package/built-in-skills/canvas-design/canvas-fonts/IBMPlexSerif-OFL.txt

@@ -0,0 +1,93 @@
+Copyright © 2017 IBM Corp. with Reserved Font Name "Plex"
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/built-in-skills/canvas-design/canvas-fonts/InstrumentSerif-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2022 The Instrument Serif Project Authors (https://github.com/Instrument/instrument-serif)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/built-in-skills/canvas-design/canvas-fonts/LICENSE-SOURCES.md

@@ -0,0 +1,16 @@
+# Serif Font Notices
+
+All font binaries remain unchanged. Font licenses are separate from the canvas
+skill's Apache-2.0 license.
+
+- `IBMPlexSerif-{Regular,Italic,Bold,BoldItalic}.ttf`: embedded name ID 0 is
+  `Copyright 2020 IBM Corp. All rights reserved.`; name ID 13 declares OFL 1.1.
+  `IBMPlexSerif-OFL.txt` retains the upstream 2017 IBM notice and Reserved Font
+  Name Plex, from https://raw.githubusercontent.com/google/fonts/main/ofl/ibmplexserif/OFL.txt.
+  Retain both this embedded-binary notice and the upstream OFL notice.
+- `InstrumentSerif-{Regular,Italic}.ttf`: embedded name ID 0 matches
+  `Copyright 2022 The Instrument Serif Project Authors (https://github.com/Instrument/instrument-serif)`;
+  name ID 13 declares OFL 1.1. `InstrumentSerif-OFL.txt` is from
+  https://raw.githubusercontent.com/google/fonts/main/ofl/instrumentserif/OFL.txt.
+
+Sources retrieved 2026-09-23; these added notices do not modify or relicense fonts.