@tangle-network/agent-runtime 0.348.1 → 0.350.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.348.1",
+  "version": "0.350.2",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {
@@ -111,47 +111,47 @@
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@biomejs/biome": "^2.5.11",
-    "@modelcontextprotocol/sdk": "1.32.0",
-    "@tangle-network/agent-eval": "0.221.2",
-    "@tangle-network/agent-interface": "5.7.1",
+    "@biomejs/biome": "^2.6.3",
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "@tangle-network/agent-eval": "0.221.8",
+    "@tangle-network/agent-interface": "5.8.0",
     "@tangle-network/agent-provider-cli-bridge": "2.0.1",
     "@tangle-network/agent-provider-daytona": "0.6.0",
     "@tangle-network/agent-provider-e2b": "0.6.0",
     "@tangle-network/agent-provider-tangle": "4.4.7",
-    "@tangle-network/sandbox": "0.64.37",
-    "@types/node": "26.4.0",
-    "@types/tar-stream": "3.1.4",
-    "miniflare": "4.20260722.0",
-    "oxc-parser": "0.147.0",
-    "publint": "0.3.24",
-    "tsdown": "0.22.14",
-    "tsx": "4.23.12",
+    "@tangle-network/sandbox": "0.69.0",
+    "@types/node": "26.6.5",
+    "@types/tar-stream": "3.1.5",
+    "miniflare": "4.20260730.0",
+    "oxc-parser": "0.155.0",
+    "publint": "0.3.25",
+    "tsdown": "0.23.2",
+    "tsx": "4.23.15",
     "typedoc": "0.28.20",
-    "typedoc-plugin-markdown": "4.13.0",
+    "typedoc-plugin-markdown": "4.14.1",
     "typescript": "6.0.3",
     "typescript-consumer": "npm:typescript@7.0.2",
-    "vitest": "^4.1.11",
-    "wrangler": "4.127.0",
-    "yaml": "2.9.0"
+    "vitest": "^5.0.5",
+    "wrangler": "4.152.0"
   },
   "engines": {
     "node": ">=22.19.0"
   },
   "license": "MIT",
   "peerDependencies": {
-    "@tangle-network/agent-eval": ">=0.221.2 <0.222.0",
-    "@tangle-network/agent-interface": ">=5.7.1 <6.0.0",
-    "@tangle-network/sandbox": ">=0.61.1 <0.61.2 || >=0.62.2 <0.62.3 || >=0.62.14 <0.62.16 || >=0.63.10 <0.65.0"
+    "@tangle-network/agent-eval": ">=0.221.8 <0.222.0",
+    "@tangle-network/agent-interface": ">=5.8.0 <6.0.0",
+    "@tangle-network/sandbox": ">=0.61.1 <0.61.2 || >=0.62.2 <0.62.3 || >=0.62.14 <0.62.16 || >=0.63.10 <0.66.0 || >=0.66.3 <0.70.0"
   },
   "dependencies": {
-    "@earendil-works/pi-codemode": "1.0.4",
-    "@tangle-network/agent-core": ">=0.13.2 <0.14.0",
+    "@earendil-works/pi-codemode": "1.4.0",
+    "@tangle-network/agent-core": "^0.13.2",
     "@tangle-network/agent-knowledge": "^22.0.16",
-    "@tangle-network/agent-profile-materialize": ">=0.27.3 <0.28.0",
+    "@tangle-network/agent-profile-materialize": "^0.27.5",
     "@tangle-network/agent-trace-contract": "^2.1.0",
-    "tar-stream": "3.2.1",
-    "zod": "4.6.5"
+    "tar-stream": "3.2.2",
+    "zod": "4.6.7",
+    "yaml": "2.9.1"
   },
   "scripts": {
     "build": "tsdown",

package/skills/agent-graphs/SKILL.md

@@ -18,6 +18,21 @@ A request for review alone does not require a graph.
 Read the current [API decision table](https://github.com/tangle-network/agent-runtime/blob/main/docs/canonical-api.md), [AgentGraph contract](https://github.com/tangle-network/agent-runtime/blob/main/src/runtime/supervise/graph.ts), and a relevant [runnable example](https://github.com/tangle-network/agent-runtime/tree/main/examples/graphs).
 These distinguish the fixed AgentGraph API from other graph or supervision contracts.
 
+Production designs: search [Factory’s design catalog](https://github.com/tangle-network/factory/blob/main/README.md) before authoring a new graph.
+
+## Graph files and placement
+
+Keep one canonical YAML or JSON graph file; Runtime's `loadGraphFile` owns parsing, parameters, profiles, topology and digest generation.
+The consumer supplies Bridge-owned seat resolution and connection bindings; the designer authors data rather than another parser or runner.
+Use the existing `graph run --dry-run` consumer to qualify the file, repair its concrete diagnostics, then run that same file through the admitted execution path.
+Read the installed CLI help for accepted options and the current loader contract for supported expressions and vertices; proposed later milestones are not executable capabilities.
+
+Use one Sandbox for the graph run and Bridge to execute its agent nodes through their complete materialized profiles.
+Parallel nodes share that admitted Sandbox through the supported Bridge sessions; a node is not a request for another Sandbox.
+The local path uses the same Bridge transport against its caller-owned workspace.
+Keep backend placement, authentication and environment lifecycle in the consumer's existing runtime composition.
+Inspect model identity, native usage and transcripts from the actual path before calling the graph qualified.
+
 ## Design a factory
 
 Use the vocabulary from the [software-factory design reference](https://github.com/mattpocock/skills/pull/1316) when a consumer needs recurring work across graph executions.
@@ -60,15 +75,15 @@ Define the artifact and independent completion check before choosing roles.
 Give each required role a complete AgentProfile and capabilities appropriate to its task.
 Preserve requested parallel instances and independent reviewers rather than collapsing their distinct work into a root prompt.
 
-When authoring nodes, directives, routes, traversal limits, or analyst routes, read [the graph contract](references/authoring.md).
+When authoring nodes, directives, routes, traversal limits, or analyst routes, read [the graph contract](https://github.com/tangle-network/agent-runtime/blob/main/skills/agent-graphs/references/authoring.md).
 The runtime validates structure and prompt references before execution.
 Keep the shared budget, per-worker allocation, concurrency, and supported limits in their actual API fields.
 Use measured execution cost when available; do not turn a prior run into a universal minimum budget.
 
 ## Prove the graph
 
-Use the maintained example pattern with injected test execution to check routes, directives, traversal limits, and both successful and rejected completion.
-Then exercise the intended backend, profiles, tools, and completion check on a real representative task.
+Use the maintained loader and topology admission to check profiles, routes, directives and traversal limits before model execution.
+Then exercise the intended Bridge backend, profiles, tools, and completion check on a real representative task, including a rejected completion.
 Offline control-flow tests do not establish that a real agent solves the task.
 
 Inspect the terminal result, complete cost and token accounting, edge delivery records, exhausted edges, and journal evidence.
@@ -78,7 +93,7 @@ Each gate visit is one `gate:<id>` ledger row whose `gate.by` names who decided.
 Unknown usage is missing evidence, not zero cost.
 A passing check proves only the outcome it actually tests.
 
-When measuring a proposed change to this skill, read [measurement](references/measurement.md) before reusing its historical cases or results.
+When measuring a proposed change to this skill, read [measurement](https://github.com/tangle-network/agent-runtime/blob/main/skills/agent-graphs/references/measurement.md) before reusing its historical cases or results.
 Ordinary graph construction does not require an optimization campaign.
 
 ## Then consider

package/skills/be-ambitious/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: be-ambitious
+description: Deepen the same task with expert methods, primary sources and an independent acceptance check.
+---
+
+# Be ambitious
+
+Portable snapshot of the [canonical skill](https://github.com/drewstone/dotfiles/blob/6d3df4680c420cf870646bd00e5dc91ac213b4e8/claude/skills/be-ambitious/SKILL.md).
+The methods and rewrite procedure retain that owner; recording uses the consumer's existing task journal.
+
+Make the task deeper, not bigger: the same goal and scope, held to a higher standard through better sources, sharper methods and an outside check.
+Drop any suggestion that adds a deliverable, feature or side quest.
+
+The task is the text after the invocation, else the latest request in the conversation; with neither, ask for it in one line.
+
+## Answer four questions
+
+Name the field first (SRE incident response, clinical pharmacology, zero-knowledge proof engineering), then answer for that field with the actual thing, not its category:
+
+1. **Expert moves not asked for.** The two or three moves that separate expert from competent work here, such as naming the decision the work serves, checking base rates, reproducing before fixing, or writing the strongest counter-argument.
+2. **Rawest material.** The primary source the expert starts from instead of a digest: the dataset, not the chart; the filing, not the article; the logs and code, not the bug report; the methods section, not the abstract. Say where it lives: here that is often a trace, a run's journal, `origin/<default>` or the served endpoint.
+3. **Named methods and tools.** Techniques, instruments, libraries or commands, each with the reason it fits this task.
+4. **Outside check.** What, other than the user or the model, shows the result is right: a test suite, benchmark, reproduction, ground-truth data, known answer, measurement, independent reviewer or real user behavior. State the pass line and the failure line, as numbers where the check allows.
+
+Where the field is beyond what you know, say so instead of inventing a source or tool.
+The step is done when each question has a concrete answer or a named unknown.
+
+## Rewrite
+
+Write the rewritten prompt in one fenced block, in the user's voice.
+It asks for exactly what the four answers describe: start from the raw material, use the named methods, and end on the outside check and its pass line.
+Keep the user's acceptance criteria and named levers unchanged.
+
+When the request asked only for the rewrite, stop after it.
+When the task is already authorized work, because the user asked for it to be done or another skill invoked this one for its own task, carry out the rewritten version.
+
+## Record the result
+
+Retain the rewritten task, its primary sources, the outside check's pass line and actual result in the consumer's existing task or run journal.
+Keep unknown evidence and pending qualification explicit.
+
+## Then consider
+
+- `report` when the rewritten task requires research from primary sources.
+- `eval-engineering` when the outside check must be built; carry its pass and failure lines.
+- `grilling` when the rewrite leaves a consequential decision only the user can make.

package/skills/graph-designer/SKILL.md

@@ -10,14 +10,23 @@ that does the work, run it under your granted permissions, and record what happe
 Every execution is fully traced like any graph run — the registry plus the run's journal
 is the knowledge.
 
+Apply `be-ambitious` to sharpen the methods and outside check while keeping the user's goal and acceptance fixed.
+Apply `agent-graphs` for the executable graph contract; keep these capabilities as separate profile skill resources.
+For a file consumer, deliver one canonical YAML or JSON graph, qualify it through the existing dry-run path, and use that same file for the authorized real run.
+Runtime owns loading and content addressing; Bridge owns native execution and seat inventory.
+One Sandbox hosts the graph's Bridge sessions, including parallel nodes; placement belongs to the caller rather than the topology.
+Read the current API and CLI help for supported behavior; explicitly retain an unsupported requirement instead of claiming a future vertex or expression works.
+
+Production designs: search [Factory’s design catalog](https://github.com/tangle-network/factory/blob/main/README.md) before authoring; record a delivered Factory run through `recordGraphRun` like any graph.
+
 ## The loop (every input)
 
 1. Compute the task shape: the durable description you will look this kind of work up by
    (kind, source, constraints — stable fields, not the payload itself). Hash it.
 2. `lookupGraph(registry, taskDigest)` over YOUR WORKSPACE's registry:
    - **replay** → run the stored graph verbatim. Re-bind the deliverable's check from the
-     environment (oracles are never stored). Record the run. This path spends near-zero
-     inference: no re-authoring, no redesign — the graph IS the answer.
+     environment: functions stay environment-owned, while supported data check definitions remain part of the stored graph. Record the run.
+     Replay avoids design inference; the graph's own agent execution still consumes its admitted resources.
    - **author** (with the stated reason) → design per the `agent-graphs` skill, run it,
      record it. If a prior graph failed to deliver for this shape, mutate deliberately
      (budget, directives as new prompt-registry versions, model mix, an added analyst),
@@ -41,6 +50,10 @@ one axis at a time so the next record attributes the difference. When an optimiz
 (agent-eval) is available, feed it the losing graph's journal; otherwise your reasoned
 mutation IS the search step.
 
+When the registry promotes a winning topology for a task type, retain a case under
+`skills/agent-graphs/cases/` citing the run and its measured outcome. The cited record
+provides the evidence; a descriptive ranking alone does not establish a win.
+
 ## Profiles improve the same way graphs do
 
 A worker profile is named and content-addressed; when a mutation rewrites a node's

package/skills/profile-authoring/SKILL.md

@@ -13,7 +13,7 @@ Do not constrain agents with prohibitions: change what is rewarded and who is in
 ## A profile that starts
 
 A refused profile fails before its first model turn, and it fails the same way on every retry.
-On 2026-10-10 Discovery lost 20 driver attempts to unpublished tool names and 3 spawns to a missing subscription source.
+Discovery lost 20 driver attempts to unpublished tool names and 3 spawns to a missing subscription source.
 Start from a profile that already ran (in a Discovery play, `inputs/profile-examples/<family>.json`) and change only `name`, `description` and `prompt.instructions`.
 
 | Field | Rule |