@wrongstack/core 0.302.2 → 0.305.0

package/dist/tools/index.js

@@ -496,9 +496,9 @@ function normalizeOptions(options) {
     ...option.consequence?.trim() ? { consequence: option.consequence.trim() } : {}
   }));
 }
-function requiredInstruction(path7) {
-  const text = readBundledInstructionText(path7);
-  if (!text) throw new Error(`Council instruction file is unavailable: ${path7}`);
+function requiredInstruction(path8) {
+  const text = readBundledInstructionText(path8);
+  if (!text) throw new Error(`Council instruction file is unavailable: ${path8}`);
   return text;
 }
 
@@ -614,17 +614,6 @@ var CouncilOrchestrator = class {
   fallbackProfileManager;
   seatCaller;
   judgeCaller;
-  /**
-   * Normalized ad-hoc profiles keyed by the caller's config object identity.
-   * The Brain adapter reuses ONE profile object for every decision, so this
-   * avoids re-validating + re-freezing it on every ask() without caching
-   * string-keyed registry lookups (those are already O(1)).
-   *
-   * Hosts must treat ad-hoc profile configs as IMMUTABLE once passed to
-   * ask(): the cache is keyed by object identity and never invalidated, so
-   * mutating a cached profile would silently serve the first snapshot.
-   */
-  profileCache = /* @__PURE__ */ new WeakMap();
   constructor(opts) {
     if (!opts.caller && !opts.seatCaller && !opts.judgeCaller) {
       throw new Error("CouncilOrchestrator: provide `caller`, `seatCaller`, or `judgeCaller`.");
@@ -644,8 +633,9 @@ var CouncilOrchestrator = class {
   /**
    * Resolve the effective profile for a question. String ids and the default
    * go through the registry (already O(1)); ad-hoc config objects are
-   * normalized once per stable object identity and cached, because hosts such
-   * as the Brain adapter pass the same profile object on every ask().
+   * normalized on each call. Callers are allowed to reuse and mutate an
+   * ad-hoc object between decisions, so object-identity caching would serve a
+   * stale snapshot.
    */
   resolveProfile(profile) {
     if (typeof profile === "string" || profile === void 0) {
@@ -655,15 +645,11 @@ var CouncilOrchestrator = class {
         defaultProfile: this.defaultProfile
       });
     }
-    const cached = this.profileCache.get(profile);
-    if (cached) return cached;
-    const resolved = resolveCouncilProfile(profile, {
+    return resolveCouncilProfile(profile, {
       registry: this.profiles,
       personas: this.personas,
       defaultProfile: this.defaultProfile
     });
-    this.profileCache.set(profile, resolved);
-    return resolved;
   }
   async ask(question) {
     const startedAt = Date.now();
@@ -2164,12 +2150,97 @@ var FallbackProfileManager = class {
     return this.resolveRefs([ref], exclude);
   }
   /**
-   * Resolve every usable configured target as an uncapped last-resort chain.
+   * Resolve every usable configured target as a bounded last-resort chain.
    * Normal smart defaults stay bounded; callers append this only after the
-   * preferred chain and only when automatic fallback is enabled.
+   * preferred chain and only when automatic fallback is enabled. The cap
+   * ({@link MAX_LAST_RESORT_CANDIDATES}) prevents a config with many providers
+   * from producing a degenerate chain of doomed requests during a systemic
+   * outage — by this point the smart default, bridge, and default profile
+   * have already failed.
    */
   resolveAllConfigured(exclude) {
-    return this.smartDefault(exclude, Number.POSITIVE_INFINITY);
+    return this.smartDefault(exclude, this.lastResortCap());
+  }
+  /**
+   * Effective cap for the last-resort append. Reads the user-configurable
+   * {@link Config.fallbackMaxLastResortCandidates} when set and valid;
+   * otherwise falls back to the compiled-in default
+   * {@link MAX_LAST_RESORT_CANDIDATES}.
+   */
+  lastResortCap() {
+    const configured = this.config.fallbackMaxLastResortCandidates;
+    if (typeof configured === "number" && Number.isFinite(configured) && configured >= 0) {
+      return Math.floor(configured);
+    }
+    return MAX_LAST_RESORT_CANDIDATES;
+  }
+  /**
+   * Build the complete fallback candidate chain shared by the agent-loop
+   * extension and the one-shot orchestrator. Centralizes the bridge → primary →
+   * selected → default-profile → all-configured ladder and the fromExplicitSource
+   * gate so both consumers produce identical ordering and depth semantics.
+   *
+   * Layering (each step deduped against all prior):
+   *  1. Bridge (emergency continuity route).
+   *  2. Configured primary, when the live context drifted from it.
+   *  3. The selected chain (explicit refs → named profile → smart default),
+   *     via {@link resolveEffective}.
+   *  4. The "default" profile — extra depth, ONLY when the chain was auto-derived.
+   *  5. Every other configured provider — last resort, ONLY when the chain was
+   *     auto-derived AND `effectiveFallbackAuto` is true.
+   *
+   * Returns the empty chain when `closedWorld` is true and no explicit
+   * refs/profile resolved — a model allowlist never leaks to unlisted models.
+   *
+   * @internal caller-aware options (primary, closedWorld) are accepted because
+   *   the agent loop has context the manager does not own; the resolution
+   *   pipeline itself is identical for both callers.
+   */
+  resolveCandidates(current, opts = {}) {
+    const configuredPrimary = opts.primary ?? {
+      providerId: this.config.provider,
+      model: this.config.model
+    };
+    const configFallbackAuto = this.config.fallbackAuto;
+    const effectiveFallbackAuto = configFallbackAuto !== void 0 && configFallbackAuto !== null ? configFallbackAuto : !opts.closedWorld;
+    const explicitRefs = opts.fallbackModels ?? this.config.fallbackModels;
+    const explicitUsable = explicitRefs !== void 0 && explicitRefs.length > 0 && this.resolveRefs(explicitRefs, current).length > 0;
+    const profileUsable = opts.fallbackProfile !== void 0 && this.hasProfile(opts.fallbackProfile) && this.resolve(opts.fallbackProfile, { exclude: current }).length > 0;
+    const fromExplicitSource = explicitUsable || profileUsable;
+    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : opts.fallbackProfile ? this.resolve(opts.fallbackProfile, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
+      fallbackModels: explicitRefs,
+      fallbackProfile: opts.fallbackProfile,
+      fallbackAuto: effectiveFallbackAuto,
+      exclude: current
+    });
+    const candidates = [];
+    if (opts.closedWorld) {
+      candidates.push(...selectedChain);
+    } else {
+      candidates.push(...this.resolveBridge(current));
+      if (!(configuredPrimary.providerId === current.providerId && configuredPrimary.model === current.model)) {
+        candidates.push({
+          providerId: configuredPrimary.providerId,
+          model: configuredPrimary.model,
+          providerSwitched: configuredPrimary.providerId !== current.providerId
+        });
+      }
+      candidates.push(...selectedChain);
+      if (!fromExplicitSource && effectiveFallbackAuto && opts.fallbackProfile !== "default") {
+        candidates.push(...this.resolve("default", { exclude: current }));
+      }
+      if (!fromExplicitSource && effectiveFallbackAuto) {
+        const cap = this.lastResortCap();
+        if (cap > 0) {
+          const usedKeys = new Set(
+            candidates.map((c) => `${c.providerId}/${c.model}`)
+          );
+          const lastResort = this.smartDefault(current, Number.POSITIVE_INFINITY).filter((c) => !usedKeys.has(`${c.providerId}/${c.model}`)).slice(0, cap);
+          candidates.push(...lastResort);
+        }
+      }
+    }
+    return dedupeChain(candidates, current);
   }
   // ── Provider availability (read-only) ──────────────────────────────────
   checkProvider(providerId) {
@@ -2293,7 +2364,20 @@ var FallbackProfileManager = class {
     );
   }
 };
+var MAX_LAST_RESORT_CANDIDATES = 12;
 var FREEZER_EMPTY = Object.freeze([]);
+function dedupeChain(entries, current) {
+  const seen = /* @__PURE__ */ new Set();
+  const currentKey = `${current.providerId}/${current.model}`;
+  return Object.freeze(
+    entries.filter((entry) => {
+      const key = `${entry.providerId}/${entry.model}`;
+      if (key === currentKey || seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    })
+  );
+}
 
 // src/core/fallback-model.ts
 function fallbackProfileChain(config, profileName) {
@@ -2304,8 +2388,8 @@ function fallbackProfileChain(config, profileName) {
 var DEFAULT_PRIMARY_COOLDOWN_MAX_MS = 10 * 6e4;
 
 // src/coordination/agents/agent-prompts.ts
-import { readFileSync as readFileSync6, statSync as statSync3 } from "node:fs";
-import * as path6 from "node:path";
+import { readFileSync as readFileSync7, statSync as statSync3 } from "node:fs";
+import * as path7 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/utils/wstack-paths.ts
@@ -2448,8 +2532,8 @@ function resolveWstackPaths(opts) {
 }
 
 // src/coordination/agents/project-agent-identity.ts
-import { existsSync as existsSync2, readFileSync as readFileSync5 } from "node:fs";
-import * as path5 from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync6 } from "node:fs";
+import * as path6 from "node:path";
 
 // src/security/capabilities.ts
 var ToolCapabilities = {
@@ -2816,22 +2900,6 @@ function inferRuntimeCapabilities(toolNames) {
   return [...ids];
 }
 
-// src/coordination/agents/project-agent-consolidation.ts
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync as readFileSync3,
-  rmSync
-} from "node:fs";
-import * as path4 from "node:path";
-
-// src/coordination/agents/project-agent-learning-entries.ts
-function splitLearnedEntries(body) {
-  return body.split(/\n---\n+/).map((entry) => entry.trim()).map(
-    (entry) => entry.replace(/^# Learned wisdom for .+$/im, "").replace(/<!--[\s\S]*?-->/g, "").trim()
-  ).filter(Boolean);
-}
-
 // src/coordination/agents/project-agent-paths.ts
 import * as path3 from "node:path";
 var AGENT_ROLE_PATTERN = /^[a-z0-9][a-z0-9._-]{0,95}$/i;
@@ -2853,6 +2921,201 @@ function learningPolicyPath(role, projectRoot) {
   return path3.join(roleDir(role, projectRoot), "learning.json");
 }
 
+// src/coordination/agents/project-agent-consolidation.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync3, rmSync } from "node:fs";
+import * as path4 from "node:path";
+
+// src/coordination/agents/project-agent-learning-entries.ts
+function splitLearnedEntries(body) {
+  return body.split(/\n---\n+/).map((entry) => entry.trim()).map(
+    (entry) => entry.replace(/^#\s+Learned (?:wisdom|instructions) for .+$/im, "").replace(/^>\s*Project-specific learning data for[\s\S]*?$/im, "").replace(/^_No learned entries yet\._$/im, "").replace(/^\*Last capture:[^\n]*\*$/im, "").replace(/<!--[\s\S]*?-->/g, "").trim()
+  ).filter(Boolean);
+}
+
+// src/coordination/agents/project-agent-learning-normalize.ts
+var MIN_INSTRUCTIVE_LENGTH = 30;
+function classifyLearnedEntry(text) {
+  const lower = text.toLowerCase();
+  if (/\b(?:avoid|never|don'?t|do not|must not|prevent|watch out|beware|pitfall|gotcha|hazard|risk)\b/.test(
+    lower
+  ))
+    return "warning";
+  if (/\b(?:use|prefer|choose|adopt|leverage|apply|switch to|migrate to)\b/.test(lower) || /\b(?:pattern|approach|strategy|technique|idiom)\b/.test(lower))
+    return "pattern";
+  if (/\b(?:always|must|should|require|ensure|verify|check|run|execute|before|after|when)\b/.test(
+    lower
+  ))
+    return "convention";
+  return "fact";
+}
+function normalizeForComparison(text) {
+  return text.toLowerCase().replace(/[^\w\s]/g, " ").replace(/\s+/g, " ").trim().split(/\s+/).sort().join(" ");
+}
+
+// src/coordination/agents/project-agent-learning-structured.ts
+function directiveTrials(entry) {
+  const count = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0 ? Math.floor(n) : 0;
+  const applied = count(entry.applied);
+  const wins = Math.min(applied, count(entry.wins));
+  return { applied, wins, losses: applied - wins };
+}
+function parseLearnedEntryStamp(entry) {
+  const structuredMatch = entry.match(
+    /<!--\s*learned-stamp:\s*category=([\w-]+);\s*capturedAt=([^;]+?)\s*-->/
+  );
+  if (structuredMatch) {
+    const rawCategory = structuredMatch[1];
+    const candidate = parseLearnedCategory(rawCategory);
+    return {
+      capturedAt: typeof structuredMatch[2] === "string" ? structuredMatch[2].trim() : "",
+      category: candidate ?? null
+    };
+  }
+  const stampMatch = entry.match(/^>\s*(?:\[\s*([\w-]+)\s*\]\s+)?(?:Captured|Taught)\s+(\S+)/m);
+  if (!stampMatch) {
+    return { capturedAt: "", category: null };
+  }
+  return {
+    capturedAt: typeof stampMatch[2] === "string" ? stampMatch[2] : "",
+    category: parseLearnedCategory(stampMatch[1]) ?? null
+  };
+}
+function parseLearnedCategory(value) {
+  return value === "convention" || value === "pattern" || value === "warning" || value === "fact" ? value : void 0;
+}
+function stripStamp(entry) {
+  return entry.replace(/<!--\s*learned-stamp:[\s\S]*?-->/g, "").replace(/^>\s*(?:\[[\w-]+\]\s+)?(?:Captured|Taught)\s+.+$/m, "").replace(/\n{3,}/g, "\n\n").trim();
+}
+function directiveKey(text) {
+  return normalizeForComparison(text);
+}
+function decomposeLearnedEntry(text, category) {
+  const what = text;
+  const why = deriveWhy(category, text);
+  const how = extractHow(text);
+  return { what, why, how };
+}
+var WHY_BY_CATEGORY = {
+  convention: "Established convention for this codebase \u2014 skipping it risks regressions, merge friction, or out-of-sync state with peers.",
+  pattern: "This project's chosen approach \u2014 alternatives were considered and either conflict with existing architecture or were rejected for known reasons.",
+  warning: "Known failure mode \u2014 skipping this has caused real defects in this codebase. The cost of getting it wrong outweighs the cost of the check.",
+  fact: "Current state of the project \u2014 assumed by other conventions, build steps, or peers, so acting on a stale assumption wastes a cycle."
+};
+function deriveWhy(category, text) {
+  const base = WHY_BY_CATEGORY[category];
+  const signals = [];
+  const lower = text.toLowerCase();
+  if (/\bbefore\s+(?:merge|commit|deploy|release|shipping|publishing)\b/.test(lower))
+    signals.push("guard before shipping");
+  if (/\bto\s+avoid\b/.test(lower)) {
+    const m = text.match(/to avoid ([^.!?]+)/i);
+    if (m?.[1]) signals.push(`avoid ${m[1].trim()}`);
+  }
+  if (/\bso\s+(?:that|we|the project)\b/.test(lower)) {
+    const m = text.match(/so (?:that |we |the project )?([^.!?]+)/i);
+    if (m?.[1]) signals.push(`so ${m[1].trim()}`);
+  }
+  if (signals.length === 0) return base;
+  return `${base} Project signals: ${signals.join("; ")}.`;
+}
+function extractHow(text) {
+  const anchors = /* @__PURE__ */ new Set();
+  const backticked = text.match(/`([^`]+)`/g) ?? [];
+  for (const raw of backticked) {
+    const inner = raw.replace(/`/g, "").trim();
+    if (inner.length > 0 && inner.length <= 120) anchors.add(inner);
+  }
+  const pathMatches = text.match(
+    /(?:[a-zA-Z0-9_.-]+\/)+[a-zA-Z0-9_.-]+\.(?:tsx|jsonc|json|jsx|yaml|mjs|cjs|yml|ts|js|md)\b/g
+  ) ?? [];
+  for (const p of pathMatches) anchors.add(p);
+  const scoped = text.match(/@[a-z0-9][\w.-]*\/[a-z0-9][\w.-]*/gi) ?? [];
+  for (const p of scoped) anchors.add(p);
+  if (anchors.size === 0) return "";
+  return [...anchors].map((anchor) => `\`${anchor}\``).join("\n");
+}
+function cleanHowLine(line) {
+  let value = line.trim();
+  let previous;
+  do {
+    previous = value;
+    value = value.replace(/^[-*]\s+/, "").replace(/^\*How:\*\s*/i, "").trim();
+  } while (value !== previous);
+  return value;
+}
+function parseStampAttributes(body) {
+  const attributes = {};
+  for (const part of body.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    const key = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (key) attributes[key] = value;
+  }
+  return attributes;
+}
+function parseEntryBody(body) {
+  const lines = [];
+  for (const line of body.split("\n")) {
+    if (/^##\s/.test(line) || /^---\s*$/.test(line) || /^<!--/.test(line)) break;
+    lines.push(line);
+  }
+  const text = lines.join("\n");
+  const what = /^-\s+\*\*([\s\S]+?)\*\*\s*$/m.exec(text)?.[1]?.replace(/\s+/g, " ").trim() ?? "";
+  if (!what) return void 0;
+  const why = /^\s+-\s+\*Why:\*\s+(.+)$/m.exec(text)?.[1]?.trim() ?? "";
+  const how = lines.filter((line) => /^\s+-\s+\*How:\*/i.test(line)).map((line) => cleanHowLine(line)).filter(Boolean).join("\n");
+  return { what, why, how };
+}
+function parseStructuredLearnedEntriesFromContent(raw, legacyEntries = splitLearnedEntries(raw)) {
+  if (!raw) return [];
+  const structured = [];
+  const stampPattern = /<!--\s*learned-stamp:\s*([^>]*?)\s*-->/g;
+  const stamps = [...raw.matchAll(stampPattern)];
+  for (const [index, stamp] of stamps.entries()) {
+    const attributes = parseStampAttributes(stamp[1] ?? "");
+    const category = parseLearnedCategory(attributes["category"]) ?? "fact";
+    const capturedAt = attributes["capturedAt"] ?? "";
+    const skill = attributes["skill"];
+    const trials = directiveTrials({
+      applied: Number(attributes["applied"]),
+      wins: Number(attributes["wins"])
+    });
+    const start = (stamp.index ?? 0) + stamp[0].length;
+    const end = stamps[index + 1]?.index ?? raw.length;
+    const parsed = parseEntryBody(raw.slice(start, end));
+    if (!parsed || parsed.what.length < MIN_INSTRUCTIVE_LENGTH) continue;
+    structured.push({
+      key: directiveKey(parsed.what),
+      category,
+      what: parsed.what,
+      why: parsed.why || WHY_BY_CATEGORY[category],
+      how: parsed.how,
+      capturedAt,
+      ...skill ? { skill } : {},
+      ...trials.applied > 0 ? { applied: trials.applied, wins: trials.wins } : {}
+    });
+  }
+  if (structured.length === 0) {
+    for (const chunk of legacyEntries) {
+      const stamp = parseLearnedEntryStamp(chunk);
+      const directive = stamp.capturedAt || stamp.category ? stripStamp(chunk) : chunk;
+      if (directive.length < MIN_INSTRUCTIVE_LENGTH) continue;
+      const category = stamp.category ?? classifyLearnedEntry(directive);
+      const { what, why, how } = decomposeLearnedEntry(directive, category);
+      structured.push({
+        key: directiveKey(directive),
+        category,
+        what,
+        why,
+        how,
+        capturedAt: stamp.capturedAt
+      });
+    }
+  }
+  return structured;
+}
+
 // src/coordination/agents/project-agent-consolidation.ts
 function consolidationPath(role, projectRoot) {
   return path4.join(roleDir(role, projectRoot), "consolidated.md");
@@ -2960,213 +3223,532 @@ function loadProjectAgentLearningPolicy(role, projectRoot) {
       enabled: parsed.enabled !== false,
       lifetimeCaptureCount: typeof parsed.lifetimeCaptureCount === "number" && Number.isInteger(parsed.lifetimeCaptureCount) && parsed.lifetimeCaptureCount >= 0 ? parsed.lifetimeCaptureCount : 0,
       ...typeof parsed.lastCaptureAt === "string" ? { lastCaptureAt: parsed.lastCaptureAt } : {},
-      ...parsed.lastCaptureSource === "automatic" || parsed.lastCaptureSource === "manual" || parsed.lastCaptureSource === "taught" ? { lastCaptureSource: parsed.lastCaptureSource } : {}
+      ...parsed.lastCaptureSource === "automatic" || parsed.lastCaptureSource === "manual" || parsed.lastCaptureSource === "taught" ? { lastCaptureSource: parsed.lastCaptureSource } : {},
+      ...typeof parsed.lastOptimizeAt === "string" ? { lastOptimizeAt: parsed.lastOptimizeAt } : {}
     };
   } catch {
     return { ...DEFAULT_LEARNING_POLICY };
   }
 }
 
-// src/coordination/agents/project-agent-identity.ts
-function loadProjectAgentIdentity(role, projectRoot) {
-  const identityPath = path5.join(roleDir(role, projectRoot), "identity.md");
-  try {
-    return readFileSync5(identityPath, "utf8").trim();
-  } catch {
-    return "";
-  }
-}
-function loadProjectAgentLearned(role, projectRoot) {
-  const learnedPath = path5.join(roleDir(role, projectRoot), "learned.md");
-  try {
-    return readFileSync5(learnedPath, "utf8").trim();
-  } catch {
-    return "";
-  }
-}
-function loadRoleKnowledgeManifest(role, projectRoot) {
-  const projectPath = path5.join(roleDir(role, projectRoot), "knowledge.json");
-  try {
-    const raw = readFileSync5(projectPath, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return BUILT_IN_KNOWLEDGE_MANIFESTS[role];
-  }
-}
-function buildProjectContextualizedPrompt(basePrompt, role, projectRoot, options = {}) {
-  const contextStart = "<!-- wrongstack:project-agent-context:start -->";
-  const contextEnd = "<!-- wrongstack:project-agent-context:end -->";
-  if (process.env["WRONGSTACK_AGENT_INSTRUCTIONS_DIR"]) return basePrompt;
-  const cleanBase = basePrompt.replace(
-    /\s*<!-- wrongstack:project-agent-context:start -->[\s\S]*?<!-- wrongstack:project-agent-context:end -->\s*/g,
-    "\n"
-  ).trim();
-  const parts = [cleanBase];
-  const identity = options.identityOverride ?? loadProjectAgentIdentity(role, projectRoot);
-  if (identity) {
-    parts.push(`
-
-# Project custom identity
-
-${identity}`);
-  }
-  const learningPolicy = loadProjectAgentLearningPolicy(role, projectRoot);
-  let learnedContent = "";
-  let learnedLabel = "";
-  if (learningPolicy.enabled) {
-    const consolidated = loadProjectAgentConsolidated(role, projectRoot);
-    if (consolidated) {
-      const meta = loadConsolidationMetadata(role, projectRoot);
-      const rawLearned = loadProjectAgentLearned(role, projectRoot);
-      const rawEntries = splitLearnedEntries(rawLearned);
-      const rawBytes = Buffer.byteLength(rawLearned, "utf8");
-      const stale = meta === void 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
-      if (stale) {
-        if (meta !== void 0 && meta.sourceEntryCount < rawEntries.length) {
-          const deltaEntries = rawEntries.slice(meta.sourceEntryCount);
-          learnedContent = `${consolidated}
-
----
-
-## Recently captured (pending next optimization)
-
-${deltaEntries.join("\n\n---\n\n")}`;
-        } else {
-          learnedContent = rawLearned;
-        }
-      } else {
-        learnedContent = consolidated;
-      }
-      learnedLabel = "Consolidated knowledge for this project";
-    } else {
-      learnedContent = loadProjectAgentLearned(role, projectRoot);
-      learnedLabel = "Learned instructions for this project (structured: what / why / how)";
-    }
-  }
-  if (learnedContent) {
-    const meaningful = learnedContent.replace(/<!--[\s\S]*?-->/g, "").trim();
-    if (meaningful.length > 0) {
-      parts.push(`
-
-# ${learnedLabel}
-
-${learnedContent}`);
-    }
-  }
-  const effectiveProjectRoot = projectRoot || process.cwd();
-  const learnedFilePath = path5.join(
-    effectiveProjectRoot,
-    ".wrongstack",
-    "agents",
-    role,
-    "learned.md"
-  );
-  if (learningPolicy.enabled) {
-    parts.push(
-      `
-
-## Knowledge capture
-
-The file below stores **learning data for this project's "${role}" agent** \u2014 not your memory, not a session log. It is read back into the system prompt of every future "${role}" invocation, so each entry must teach a future agent how to act. On every capture the runtime **merges your new entry with every prior entry and rewrites the whole buffer as a structured instruction list** \u2014 grouped by category ("What to do", "What to avoid", "Patterns to follow", "Project facts"), with each item decomposed into **what** (the rule), **why** (the reason), and **how** (the concrete commands, file paths, or package names that anchor the rule). When you discover a durable principle that future invocations should follow, end your response with a \`## LEARNED\` block. The runtime persists it to:
-
-  \`\`\`
-  ${learnedFilePath}
-  \`\`\`
-
-**Write directives, not narratives.** Each LEARNED entry should be:
-
-- A **rule or principle** that applies across sessions, not a description of what happened in this one.
-- A short **imperative or statement** (1\u20133 sentences), starting with a verb like "Always verify\u2026", "Use X for Y", "Avoid\u2026", "Never assume\u2026".
-- **Generic** \u2014 no commit SHAs, timestamps, specific line numbers, or PR/issue numbers. File paths, package names, and command names are fine when they anchor the lesson.
-- **Self-contained** \u2014 understandable without the surrounding session context.
-- **Front-load concrete anchors** \u2014 commands in backticks, package names like \`@wrongstack/core\`, file paths like \`packages/core/src/.../foo.ts\`. The structured-list renderer extracts these as the "how" for the entry.
-
-**Bad** (session log \u2014 rejected at capture time):
-
-\`\`\`
-## LEARNED
-When I worked on the telegram plugin today, commit 9c7682b84 had a race condition in poll-lock at line 42 because writeFileSync wasn't using the 'wx' flag.
-\`\`\`
-
-**Good** (directive \u2014 persists, then merges into the structured list):
-
-\`\`\`
-## LEARNED
-Always use the 'wx' (exclusive create) flag with writeFileSync when implementing concurrent lock acquisition in \`packages/core/src/.../poll-lock.ts\` \u2014 filesystem-level atomicity guarantees only one writer wins.
-\`\`\`
-
-Capture only durable, cross-session knowledge \u2014 never ephemeral task details.`
-    );
-  }
-  const knowledge = loadRoleKnowledgeManifest(role, projectRoot);
-  if (knowledge && knowledge.checklist.length > 0) {
-    const checklist = knowledge.checklist.map((item) => `- ${item}`).join("\n");
-    parts.push(
-      `
-
-## Current knowledge requirements
-
-Verify these before answering:
-${checklist}`
-    );
-  }
-  const additions = parts.slice(1).join("\n\n").trim();
-  if (!additions) return cleanBase;
-  return `${cleanBase}
-
-${contextStart}
-${additions}
-${contextEnd}`;
-}
-
-// src/coordination/agents/agent-prompts.ts
-var promptCache = /* @__PURE__ */ new Map();
-var candidateCache = /* @__PURE__ */ new Map();
-var TECH_VERSION_POLICY_KEY = "\0__tech_version_policy__";
-var techVersionPolicyBody;
-var INLINE_TECH_VERSION_POLICY = `# Mandatory modern technology policy
-
-You are bound to the current stable version of every library, framework and
-package you use. The latest stable is preferred; the latest *published* is
-*required*.
-
-## Non-negotiable rules
-
-1. **Verify the version, never trust a number from training data.** Before
-   recommending a package or framework version, fetch the live registry
-   (npm, PyPI, crates, Go proxy, GitHub releases). Treat the value you read
-   as the only acceptable reference; do not interpolate from memory.
-
-2. **Latest stable by default.** Pick the highest stable release that
-   satisfies the project runtime, the pinned peer-dependency range, and
-   the role's required APIs. Pin to \`^<major>.<minor>.0\` and report the
-   exact version.
-
-3. **Reject alpha / beta / RC / nightly** unless the user explicitly
-   requests a pre-release. State the rejection reason in the output.
-
-4. **Reject EOL, deprecated and unmaintained packages** \u2014 a package with
-   no release in >2 years **and** open critical issues is *dead*. Reject
-   it on the same day you find it and propose a maintained replacement.
-
-5. **Reject prehistoric technology.** The well-known blocklist:
-   - \`axios\` / \`node-fetch\` / \`got\` / \`request\` \u2192 native \`fetch\` (Node 18+).
-   - \`moment\` \u2192 \`date-fns\`, \`luxon\` or \`Temporal\`.
-   - jQuery on new projects \u2192 vanilla DOM or React.
-   - Gulp / Grunt \u2192 \`tsup\`, \`esbuild\` or \`vite\`.
-   - CoffeeScript / Flow \u2192 TypeScript.
-   - \`Bluebird\` \u2192 native Promises.
-   - \`crypto-js\` \u2192 \`node:crypto\` or Web Crypto.
-   - Bower \u2192 npm or pnpm.
-   - \`underscore\` \u2192 \`lodash\` or native ES2020+.
-   Use the intervention phrase: **"This isn't code, this is X-year-old
-   technology."** Follow with the modern replacement and a one-step
-   migration path.
+// src/coordination/agents/project-agent-skill-layer.ts
+import { readdirSync, readFileSync as readFileSync5, rmSync as rmSync2 } from "node:fs";
+import * as path5 from "node:path";
 
-6. **Prefer built-in over third-party.** Before adding a dependency, check
-   the language or runtime native API. Examples:
-   - Node \u226522.19 \u2192 \`node:test\`, \`node:sqlite\`, \`node:fs/promises\`,
-     \`fetch\`, \`WebSocket\`, \`node:crypto\`, \`node:stream/web\`, AbortSignal.
+// src/coordination/agents/role-skills.ts
+var skillSet = (...names) => names;
+var ROLE_SKILL_SETS = {
+  explore: skillSet("research-web", "node-modern", "typescript-strict"),
+  search: skillSet("bug-hunter", "typescript-strict", "research-web"),
+  research: skillSet("research-web", "tech-stack", "security-scanner", "api-design"),
+  analyst: skillSet("sdd", "api-design", "testing", "security-scanner"),
+  planner: skillSet("sdd", "multi-agent", "refactor-planner", "testing"),
+  architect: skillSet("sdd", "api-design", "refactor-planner", "security-scanner", "observability"),
+  critic: skillSet("chimera", "bug-hunter", "security-scanner", "refactor-planner"),
+  "refactor-planner": skillSet(
+    "refactor-planner",
+    "sdd",
+    "typescript-strict",
+    "testing",
+    "bug-hunter"
+  ),
+  executor: skillSet("sdd", "typescript-strict", "node-modern", "testing", "git-flow"),
+  refactor: skillSet("refactor-planner", "typescript-strict", "testing", "bug-hunter"),
+  simplifier: skillSet("bug-hunter", "typescript-strict", "testing", "refactor-planner"),
+  migration: skillSet("tech-stack", "node-modern", "typescript-strict", "testing", "git-flow"),
+  vision: skillSet("react-modern", "testing", "typescript-strict", "security-scanner"),
+  debugger: skillSet("bug-hunter", "testing", "typescript-strict", "observability", "audit-log"),
+  tracer: skillSet("observability", "audit-log", "bug-hunter", "testing"),
+  verifier: skillSet("testing", "typescript-strict", "security-scanner", "chimera"),
+  test: skillSet("testing", "typescript-strict", "bug-hunter", "security-scanner"),
+  e2e: skillSet("testing", "react-modern", "api-design", "security-scanner"),
+  browser: skillSet("testing", "react-modern", "security-scanner", "research-web"),
+  performance: skillSet("observability", "testing", "node-modern", "audit-log"),
+  chaos: skillSet("testing", "observability", "security-scanner", "audit-log"),
+  "security-scanner": skillSet("security-scanner", "bug-hunter", "api-design", "tech-stack"),
+  "bug-hunter": skillSet("bug-hunter", "typescript-strict", "testing", "security-scanner"),
+  "audit-log": skillSet("audit-log", "observability", "bug-hunter", "output-standards"),
+  reviewer: skillSet("chimera", "bug-hunter", "security-scanner", "testing"),
+  "code-reviewer": skillSet("chimera", "bug-hunter", "typescript-strict", "testing"),
+  "security-reviewer": skillSet("security-scanner", "chimera", "api-design", "tech-stack"),
+  accessibility: skillSet("react-modern", "testing", "chimera", "security-scanner"),
+  compliance: skillSet("security-scanner", "audit-log", "tech-stack", "chimera"),
+  database: skillSet("api-design", "testing", "security-scanner", "observability"),
+  api: skillSet("api-design", "typescript-strict", "node-modern", "testing", "security-scanner"),
+  auth: skillSet("security-scanner", "api-design", "testing", "typescript-strict", "audit-log"),
+  data: skillSet("typescript-strict", "testing", "observability", "security-scanner"),
+  frontend: skillSet("react-modern", "typescript-strict", "testing", "security-scanner"),
+  backend: skillSet("node-modern", "typescript-strict", "api-design", "testing", "observability"),
+  designer: skillSet("react-modern", "prompt-engineering", "research-web", "output-standards"),
+  ios: skillSet("sdd", "testing", "security-scanner", "research-web"),
+  document: skillSet("output-standards", "research-web", "api-design", "prompt-engineering"),
+  uml: skillSet("sdd", "refactor-planner", "api-design", "output-standards"),
+  i18n: skillSet("react-modern", "testing", "typescript-strict", "output-standards"),
+  prompt: skillSet("prompt-engineering", "skill-creator", "output-standards", "testing"),
+  git: skillSet("git-flow", "chimera", "testing", "security-scanner"),
+  release: skillSet("git-flow", "tech-stack", "chimera", "security-scanner"),
+  devops: skillSet("docker-deploy", "observability", "security-scanner", "git-flow", "tech-stack"),
+  observability: skillSet("observability", "node-modern", "testing", "audit-log"),
+  dependency: skillSet("tech-stack", "security-scanner", "node-modern", "git-flow"),
+  "skill-manage": skillSet(
+    "skill-creator",
+    "prompt-engineering",
+    "security-scanner",
+    "output-standards"
+  ),
+  "self-improving": skillSet(
+    "audit-log",
+    "mnemosyne",
+    "prompt-engineering",
+    "bug-hunter",
+    "observability"
+  ),
+  context: skillSet("mnemosyne", "output-standards", "prompt-engineering", "audit-log"),
+  cost: skillSet("audit-log", "tech-stack", "observability", "research-web"),
+  "tech-stack": skillSet("tech-stack", "research-web", "security-scanner", "node-modern"),
+  // ── Wave 1: Platform and systems engineering ──────────────────────────
+  android: skillSet(
+    "react-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  desktop: skillSet(
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  realtime: skillSet(
+    "api-design",
+    "observability",
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "tech-stack"
+  ),
+  "distributed-systems": skillSet(
+    "api-design",
+    "observability",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  concurrency: skillSet(
+    "bug-hunter",
+    "typescript-strict",
+    "testing",
+    "observability",
+    "node-modern",
+    "tech-stack"
+  ),
+  "platform-engineer": skillSet(
+    "node-modern",
+    "typescript-strict",
+    "git-flow",
+    "docker-deploy",
+    "tech-stack"
+  ),
+  // ── Wave 3: Product and data specialists ──────────────────────────────
+  payments: skillSet(
+    "api-design",
+    "security-scanner",
+    "audit-log",
+    "testing",
+    "typescript-strict",
+    "tech-stack"
+  ),
+  messaging: skillSet(
+    "api-design",
+    "observability",
+    "node-modern",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "search-relevance": skillSet(
+    "api-design",
+    "observability",
+    "testing",
+    "typescript-strict",
+    "data-governance",
+    "tech-stack"
+  ),
+  storage: skillSet(
+    "api-design",
+    "security-scanner",
+    "testing",
+    "observability",
+    "node-modern",
+    "tech-stack"
+  ),
+  "ml-engineer": skillSet(
+    "observability",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "data-governance",
+    "tech-stack"
+  ),
+  "data-governance": skillSet(
+    "audit-log",
+    "security-scanner",
+    "observability",
+    "testing",
+    "output-standards",
+    "tech-stack"
+  ),
+  // ── Wave 4: Agent platform and quality ───────────────────────────────
+  "plugin-author": skillSet(
+    "plugin-author",
+    "node-modern",
+    "typescript-strict",
+    "testing",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "tool-author": skillSet(
+    "typescript-strict",
+    "security-scanner",
+    "testing",
+    "output-standards",
+    "tech-stack"
+  ),
+  "prompt-evaluator": skillSet(
+    "prompt-engineering",
+    "testing",
+    "output-standards",
+    "security-scanner",
+    "tech-stack"
+  ),
+  "benchmark-engineer": skillSet("observability", "testing", "output-standards", "tech-stack"),
+  "memory-curator": skillSet("mnemosyne", "audit-log", "testing", "output-standards", "tech-stack"),
+  "fleet-coordinator": skillSet("multi-agent", "sdd", "output-standards", "testing", "tech-stack"),
+  // ── Wave 2: Security, resilience, governance and agent platform ────────
+  "threat-modeler": skillSet(
+    "security-scanner",
+    "api-design",
+    "tech-stack",
+    "audit-log",
+    "testing"
+  ),
+  "secure-coding-coach": skillSet(
+    "security-scanner",
+    "testing",
+    "typescript-strict",
+    "api-design",
+    "tech-stack"
+  ),
+  "resilience-engineer": skillSet(
+    "observability",
+    "testing",
+    "typescript-strict",
+    "api-design",
+    "tech-stack"
+  ),
+  "chaos-engineer": skillSet(
+    "observability",
+    "testing",
+    "security-scanner",
+    "git-flow",
+    "tech-stack"
+  ),
+  "compliance-auditor": skillSet(
+    "audit-log",
+    "security-scanner",
+    "output-standards",
+    "testing",
+    "tech-stack"
+  ),
+  "privacy-engineer": skillSet(
+    "security-scanner",
+    "audit-log",
+    "api-design",
+    "data-governance",
+    "tech-stack"
+  )
+};
+var SHADOW_AGENT_SKILLS = skillSet(
+  "wrongstack-mailbox",
+  "multi-agent",
+  "audit-log",
+  "observability",
+  "security-scanner"
+);
+var MAX_EAGER_ROSTER_SKILLS = 3;
+function assignSkillsToAgents(definitions) {
+  return definitions.map((definition) => {
+    const role = definition.config.role;
+    if (!role || !Object.hasOwn(ROLE_SKILL_SETS, role)) {
+      throw new Error(
+        `Missing curated skill set for roster role: "${role ?? definition.config.name}"`
+      );
+    }
+    const skills = ROLE_SKILL_SETS[role];
+    return {
+      ...definition,
+      config: {
+        ...definition.config,
+        capabilities: inferRuntimeCapabilities(definition.config.tools ?? []),
+        skillNames: skills.slice(0, MAX_EAGER_ROSTER_SKILLS),
+        skillPool: [...skills]
+      }
+    };
+  });
+}
+
+// src/coordination/agents/project-agent-skill-layer.ts
+var SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+function isProjectSkillName(name) {
+  return SKILL_NAME_PATTERN.test(name);
+}
+function projectSkillsDir(role, projectRoot) {
+  return path5.join(roleDir(role, projectRoot), "skills");
+}
+function listProjectSkillAugmentations(role, projectRoot) {
+  try {
+    return readdirSync(projectSkillsDir(role, projectRoot)).filter((name) => name.endsWith(".md")).map((name) => name.slice(0, -3)).filter(isProjectSkillName).sort();
+  } catch {
+    return [];
+  }
+}
+
+// src/coordination/agents/project-agent-identity.ts
+function loadProjectAgentIdentity(role, projectRoot) {
+  const identityPath = path6.join(roleDir(role, projectRoot), "identity.md");
+  try {
+    return readFileSync6(identityPath, "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+function loadProjectAgentLearned(role, projectRoot) {
+  const learnedPath = path6.join(roleDir(role, projectRoot), "learned.md");
+  try {
+    return readFileSync6(learnedPath, "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+function loadRoleKnowledgeManifest(role, projectRoot) {
+  const projectPath = path6.join(roleDir(role, projectRoot), "knowledge.json");
+  try {
+    const raw = readFileSync6(projectPath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return BUILT_IN_KNOWLEDGE_MANIFESTS[role];
+  }
+}
+function buildProjectContextualizedPrompt(basePrompt, role, projectRoot, options = {}) {
+  const contextStart = "<!-- wrongstack:project-agent-context:start -->";
+  const contextEnd = "<!-- wrongstack:project-agent-context:end -->";
+  if (process.env["WRONGSTACK_AGENT_INSTRUCTIONS_DIR"]) return basePrompt;
+  const cleanBase = basePrompt.replace(
+    /\s*<!-- wrongstack:project-agent-context:start -->[\s\S]*?<!-- wrongstack:project-agent-context:end -->\s*/g,
+    "\n"
+  ).trim();
+  const parts = [cleanBase];
+  const identity = options.identityOverride ?? loadProjectAgentIdentity(role, projectRoot);
+  if (identity) {
+    parts.push(`
+
+# Project custom identity
+
+${identity}`);
+  }
+  const learningPolicy = loadProjectAgentLearningPolicy(role, projectRoot);
+  let learnedContent = "";
+  let learnedLabel = "";
+  if (learningPolicy.enabled) {
+    const consolidated = loadProjectAgentConsolidated(role, projectRoot);
+    const rawLearned = loadProjectAgentLearned(role, projectRoot);
+    if (consolidated) {
+      const meta = loadConsolidationMetadata(role, projectRoot);
+      const rawEntries = parseStructuredLearnedEntriesFromContent(
+        rawLearned,
+        splitLearnedEntries(rawLearned)
+      );
+      const rawBytes = Buffer.byteLength(rawLearned, "utf8");
+      const freshEntries = meta === void 0 ? [] : rawEntries.filter((entry) => entry.capturedAt > meta.consolidatedAt);
+      const stale = meta === void 0 || freshEntries.length > 0 || rawEntries.length > meta.sourceEntryCount || rawBytes > meta.sourceBytes;
+      if (!stale) {
+        learnedContent = consolidated;
+        learnedLabel = "Consolidated knowledge for this project";
+      } else if (freshEntries.length > 0) {
+        const delta = freshEntries.map((entry) => `- **${entry.what}**`).join("\n");
+        learnedContent = `${consolidated}
+
+---
+
+## Recently captured (pending next optimization)
+
+${delta}`;
+        learnedLabel = "Consolidated knowledge for this project";
+      } else {
+        learnedContent = rawLearned;
+        learnedLabel = "Learned instructions for this project (structured: what / why / how)";
+      }
+    } else {
+      learnedContent = rawLearned;
+      learnedLabel = "Learned instructions for this project (structured: what / why / how)";
+    }
+  }
+  if (learnedContent) {
+    const meaningful = learnedContent.replace(/<!--[\s\S]*?-->/g, "").trim();
+    if (meaningful.length > 0) {
+      parts.push(`
+
+# ${learnedLabel}
+
+${learnedContent}`);
+    }
+  }
+  const effectiveProjectRoot = projectRoot || process.cwd();
+  const learnedFilePath = path6.join(
+    effectiveProjectRoot,
+    ".wrongstack",
+    "agents",
+    role,
+    "learned.md"
+  );
+  if (learningPolicy.enabled) {
+    parts.push(
+      `
+
+## Knowledge capture
+
+The file below stores **learning data for this project's "${role}" agent** \u2014 not your memory, not a session log. It is read back into the system prompt of every future "${role}" invocation, so each entry must teach a future agent how to act. On every capture the runtime **merges your new entry with every prior entry and rewrites the whole buffer as a structured instruction list** \u2014 grouped by category ("What to do", "What to avoid", "Patterns to follow", "Project facts"), with each item decomposed into **what** (the rule), **why** (the reason), and **how** (the concrete commands, file paths, or package names that anchor the rule). When you discover a durable principle that future invocations should follow, end your response with a \`## LEARNED\` block. The runtime persists it to:
+
+  \`\`\`
+  ${learnedFilePath}
+  \`\`\`
+
+**Write directives, not narratives.** Each LEARNED entry should be:
+
+- A **rule or principle** that applies across sessions, not a description of what happened in this one.
+- A short **imperative or statement** (1\u20133 sentences), starting with a verb like "Always verify\u2026", "Use X for Y", "Avoid\u2026", "Never assume\u2026".
+- **Generic** \u2014 no commit SHAs, timestamps, specific line numbers, or PR/issue numbers. File paths, package names, and command names are fine when they anchor the lesson.
+- **Self-contained** \u2014 understandable without the surrounding session context.
+- **Front-load concrete anchors** \u2014 commands in backticks, package names like \`@wrongstack/core\`, file paths like \`packages/core/src/.../foo.ts\`. The structured-list renderer extracts these as the "how" for the entry.
+
+**Your directives are scored against real outcomes.** After every task the runtime checks which stored directives were actually exercised \u2014 it matches their anchors against the report \u2014 and folds that task's success or failure into each one's record. A directive that keeps correlating with success outlives newer arrivals and survives rewording; one that has been exercised repeatedly and kept correlating with failure is retired and stops being injected. Two consequences for how you write them: anchors are what make a directive *measurable*, not just runnable, so an anchorless directive can never earn a record; and a directive you are unsure about costs nothing to write, because the loop will find out.
+
+**Tag the skill you are developing.** When a directive refines one of your skills, mark it: \`## LEARNED [skill: testing]\`. Tagged directives are distilled into that skill's project addendum, so the lesson arrives as part of the skill itself on every future run instead of as a loose fact. Untagged directives are routed automatically when the wording makes the target obvious, and stay role-level otherwise.
+
+**Bad** (session log \u2014 rejected at capture time):
+
+\`\`\`
+## LEARNED
+When I worked on the telegram plugin today, commit 9c7682b84 had a race condition in poll-lock at line 42 because writeFileSync wasn't using the 'wx' flag.
+\`\`\`
+
+**Good** (directive \u2014 persists, then merges into the structured list):
+
+\`\`\`
+## LEARNED
+Always use the 'wx' (exclusive create) flag with writeFileSync when implementing concurrent lock acquisition in \`packages/core/src/.../poll-lock.ts\` \u2014 filesystem-level atomicity guarantees only one writer wins.
+\`\`\`
+
+Capture only durable, cross-session knowledge \u2014 never ephemeral task details.`
+    );
+  }
+  const knowledge = loadRoleKnowledgeManifest(role, projectRoot);
+  if (knowledge) {
+    const knowledgeSections = [];
+    if (knowledge.checklist.length > 0) {
+      knowledgeSections.push(
+        `Verify these before answering:
+${knowledge.checklist.map((item) => `- ${item}`).join("\n")}`
+      );
+    }
+    const liveQueries = Object.entries(knowledge.liveQueries ?? {});
+    if (liveQueries.length > 0) {
+      const threshold = Number.isFinite(knowledge.verifyThreshold) ? knowledge.verifyThreshold : 0.5;
+      knowledgeSections.push(
+        `When your confidence in any of the following is below ${threshold}, fetch the live value rather than recalling it:
+` + liveQueries.map(
+          ([topic, query]) => `- **${topic}** \u2014 ${query.description}: \`${query.registry}\` \u2192 field \`${query.key}\``
+        ).join("\n")
+      );
+    }
+    if (knowledgeSections.length > 0) {
+      parts.push(`
+
+## Current knowledge requirements
+
+${knowledgeSections.join("\n\n")}`);
+    }
+  }
+  const developedSkills = listProjectSkillAugmentations(role, projectRoot);
+  if (developedSkills.length > 0) {
+    parts.push(
+      `
+
+## Project-developed skills
+
+These skills have been extended with practice learned in this project: ${developedSkills.map((skill) => `\`${skill}\``).join(", ")}. Their project addendum is attached to the skill body \u2014 follow it over the generic method when the two differ.`
+    );
+  }
+  const additions = parts.slice(1).join("\n\n").trim();
+  if (!additions) return cleanBase;
+  return `${cleanBase}
+
+${contextStart}
+${additions}
+${contextEnd}`;
+}
+
+// src/coordination/agents/agent-prompts.ts
+var promptCache = /* @__PURE__ */ new Map();
+var candidateCache = /* @__PURE__ */ new Map();
+var TECH_VERSION_POLICY_KEY = "\0__tech_version_policy__";
+var techVersionPolicyBody;
+var INLINE_TECH_VERSION_POLICY = `# Mandatory modern technology policy
+
+You are bound to the current stable version of every library, framework and
+package you use. The latest stable is preferred; the latest *published* is
+*required*.
+
+## Non-negotiable rules
+
+1. **Verify the version, never trust a number from training data.** Before
+   recommending a package or framework version, fetch the live registry
+   (npm, PyPI, crates, Go proxy, GitHub releases). Treat the value you read
+   as the only acceptable reference; do not interpolate from memory.
+
+2. **Latest stable by default.** Pick the highest stable release that
+   satisfies the project runtime, the pinned peer-dependency range, and
+   the role's required APIs. Pin to \`^<major>.<minor>.0\` and report the
+   exact version.
+
+3. **Reject alpha / beta / RC / nightly** unless the user explicitly
+   requests a pre-release. State the rejection reason in the output.
+
+4. **Reject EOL, deprecated and unmaintained packages** \u2014 a package with
+   no release in >2 years **and** open critical issues is *dead*. Reject
+   it on the same day you find it and propose a maintained replacement.
+
+5. **Reject prehistoric technology.** The well-known blocklist:
+   - \`axios\` / \`node-fetch\` / \`got\` / \`request\` \u2192 native \`fetch\` (Node 18+).
+   - \`moment\` \u2192 \`date-fns\`, \`luxon\` or \`Temporal\`.
+   - jQuery on new projects \u2192 vanilla DOM or React.
+   - Gulp / Grunt \u2192 \`tsup\`, \`esbuild\` or \`vite\`.
+   - CoffeeScript / Flow \u2192 TypeScript.
+   - \`Bluebird\` \u2192 native Promises.
+   - \`crypto-js\` \u2192 \`node:crypto\` or Web Crypto.
+   - Bower \u2192 npm or pnpm.
+   - \`underscore\` \u2192 \`lodash\` or native ES2020+.
+   Use the intervention phrase: **"This isn't code, this is X-year-old
+   technology."** Follow with the modern replacement and a one-step
+   migration path.
+
+6. **Prefer built-in over third-party.** Before adding a dependency, check
+   the language or runtime native API. Examples:
+   - Node \u226522.19 \u2192 \`node:test\`, \`node:sqlite\`, \`node:fs/promises\`,
+     \`fetch\`, \`WebSocket\`, \`node:crypto\`, \`node:stream/web\`, AbortSignal.
    - Browsers \u2192 \`fetch\`, \`AbortController\`, \`structuredClone\`,
      \`URLPattern\`, Web Streams.
    - TypeScript \u22655.6 \u2192 \`using\` declarations, \`await using\`, the new
@@ -3196,38 +3778,38 @@ function loadTechVersionPolicy() {
   return techVersionPolicyBody;
 }
 function policyCandidateDirs() {
-  const here = path6.dirname(fileURLToPath2(import.meta.url));
+  const here = path7.dirname(fileURLToPath2(import.meta.url));
   const profileInstructions = resolveWstackPaths({ projectRoot: process.cwd() }).globalInstructions;
   return [
-    path6.resolve(here, "../../../../instructions/agents"),
-    path6.resolve(here, "../../../instructions/agents"),
-    path6.resolve(here, "../../instructions/agents"),
-    path6.resolve(here, "../instructions/agents"),
-    path6.resolve(here, "instructions/agents"),
-    path6.join(profileInstructions, "agents"),
+    path7.resolve(here, "../../../../instructions/agents"),
+    path7.resolve(here, "../../../instructions/agents"),
+    path7.resolve(here, "../../instructions/agents"),
+    path7.resolve(here, "../instructions/agents"),
+    path7.resolve(here, "instructions/agents"),
+    path7.join(profileInstructions, "agents"),
     profileInstructions
   ].filter((dir, index, all) => all.indexOf(dir) === index);
 }
 function policyBody() {
-  const here = path6.dirname(fileURLToPath2(import.meta.url));
+  const here = path7.dirname(fileURLToPath2(import.meta.url));
   const roots = [
-    path6.resolve(here, "_policy/tech-version.md"),
-    path6.resolve(here, "../_policy/tech-version.md"),
-    path6.resolve(here, "../../../instructions/agents/_policy/tech-version.md"),
-    path6.resolve(here, "../../instructions/agents/_policy/tech-version.md"),
-    path6.resolve(here, "../instructions/agents/_policy/tech-version.md"),
-    path6.resolve(here, "../../../../instructions/agents/_policy/tech-version.md"),
-    path6.resolve(here, "instructions/agents/_policy/tech-version.md")
+    path7.resolve(here, "_policy/tech-version.md"),
+    path7.resolve(here, "../_policy/tech-version.md"),
+    path7.resolve(here, "../../../instructions/agents/_policy/tech-version.md"),
+    path7.resolve(here, "../../instructions/agents/_policy/tech-version.md"),
+    path7.resolve(here, "../instructions/agents/_policy/tech-version.md"),
+    path7.resolve(here, "../../../../instructions/agents/_policy/tech-version.md"),
+    path7.resolve(here, "instructions/agents/_policy/tech-version.md")
   ];
   for (const file of roots) {
     try {
-      return readFileSync6(file, "utf8").trim();
+      return readFileSync7(file, "utf8").trim();
     } catch {
     }
   }
   for (const dir of policyCandidateDirs()) {
     try {
-      return readFileSync6(path6.join(dir, "_policy", "tech-version.md"), "utf8").trim();
+      return readFileSync7(path7.join(dir, "_policy", "tech-version.md"), "utf8").trim();
     } catch {
     }
   }
@@ -3238,14 +3820,15 @@ function agentPrompt(id) {
   const envDir = process.env["WRONGSTACK_AGENT_INSTRUCTIONS_DIR"] ?? "";
   const policyOn = process.env["WRONGSTACK_AGENT_POLICY"] === "on";
   const cacheBypass = globalThis.__WS_DISABLE_PROMPT_CACHE__ === true;
-  const cacheKey = `${envDir}\0${policyOn ? 1 : 0}\0${id}`;
+  const promptProjectRoot = process.env["WRONGSTACK_PROJECT_ROOT"] || process.cwd();
+  const cacheKey = `${envDir}\0${policyOn ? 1 : 0}\0${promptProjectRoot}\0${id}`;
   const cached = cacheBypass ? void 0 : promptCache.get(cacheKey);
   if (cached !== void 0) return cached;
   const fileName = `${id}.md`;
   let resolved = "";
   for (const dir of agentPromptDirCandidates(envDir)) {
     try {
-      resolved = readFileSync6(path6.join(dir, fileName), "utf8").trim();
+      resolved = readFileSync7(path7.join(dir, fileName), "utf8").trim();
       break;
     } catch {
     }
@@ -3262,8 +3845,7 @@ function agentPrompt(id) {
 ${policy}`;
     }
   }
-  const projectRoot = process.env["WRONGSTACK_PROJECT_ROOT"] || process.cwd();
-  resolved = buildProjectContextualizedPrompt(resolved, id, projectRoot);
+  resolved = buildProjectContextualizedPrompt(resolved, id, promptProjectRoot);
   if (!cacheBypass) promptCache.set(cacheKey, resolved);
   return resolved;
 }
@@ -3272,16 +3854,16 @@ function agentPromptDirCandidates(envDir) {
   const candKey = `${envDir}\0${profileInstructions}`;
   const cached = candidateCache.get(candKey);
   if (cached !== void 0) return cached;
-  const here = path6.dirname(fileURLToPath2(import.meta.url));
+  const here = path7.dirname(fileURLToPath2(import.meta.url));
   const explicitDir = envDir || void 0;
   const candidates = [
-    ...explicitDir ? [path6.resolve(explicitDir)] : [],
-    path6.join(profileInstructions, "agents"),
-    path6.resolve(here, "../../../../instructions/agents"),
-    path6.resolve(here, "../../../instructions/agents"),
-    path6.resolve(here, "../../instructions/agents"),
-    path6.resolve(here, "../instructions/agents"),
-    path6.resolve(here, "instructions/agents")
+    ...explicitDir ? [path7.resolve(explicitDir)] : [],
+    path7.join(profileInstructions, "agents"),
+    path7.resolve(here, "../../../../instructions/agents"),
+    path7.resolve(here, "../../../instructions/agents"),
+    path7.resolve(here, "../../instructions/agents"),
+    path7.resolve(here, "../instructions/agents"),
+    path7.resolve(here, "instructions/agents")
   ];
   const ordered = candidates.sort((a, b) => Number(!isDirectory2(a)) - Number(!isDirectory2(b)));
   candidateCache.set(candKey, ordered);
@@ -3338,8 +3920,16 @@ var TOOLS = {
     "test",
     "mailbox"
   ],
-  /** Version control. */
-  vcs: ["read", "grep", "glob", "git", "diff"],
+  /**
+   * Version control.
+   *
+   * `mailbox` is in every preset on purpose: a subagent that hits a wall must
+   * be able to say so. This was the one preset without it, which left the `git`
+   * and `release` roles able to fail but not to ask — the two roles whose work
+   * most often needs a decision from the leader (force-push, tag collision,
+   * dirty tree) and least often has a safe default.
+   */
+  vcs: ["read", "grep", "glob", "git", "diff", "mailbox"],
   /** Dependency management + CVE audit. */
   deps: ["read", "grep", "glob", "install", "outdated", "audit", "json", "mailbox"],
   /** Documentation authoring. */
@@ -5552,494 +6142,230 @@ var META_AGENTS = [
   }
 ];
 
-// src/coordination/agents/phase9-wave4-platform-meta.ts
-var PROMPT_evaluator_META = {
-  rationale: "Prompt evaluator: builds rubrics, adversarial tests and regression suites. Independent measurement counterpart to the `prompt` author role.",
-  signals: [
-    "prompt eval",
-    "prompt regression",
-    "rubric",
-    "adversarial prompt",
-    "prompt benchmark",
-    "judge prompt",
-    "eval suite"
-  ],
-  differentiatesFrom: "prompt authors prompts; prompt-evaluator independently measures them with rubrics and adversarial inputs."
-};
-var BENCHMARK_ENGINEER_META2 = {
-  rationale: "Benchmark engineer: reproducible benchmark design and methodology. The measurement-infrastructure counterpart to `performance`.",
-  signals: [
-    "benchmark",
-    "reproducible",
-    "evaluation harness",
-    "regression suite",
-    "metric methodology",
-    "baseline",
-    "deterministic run"
-  ],
-  differentiatesFrom: "performance optimizes product code; benchmark-engineer builds the measurement infrastructure that supports comparison."
-};
-var MEMORY_CURATOR_META2 = {
-  rationale: "Memory curator: validates, merges and de-duplicates long-term memory with audience scope. Quality counterpart to `context`.",
-  signals: [
-    "memory",
-    "curate",
-    "memory audit",
-    "memory merge",
-    "memory expiry",
-    "audience scope",
-    "memory recall quality"
-  ],
-  differentiatesFrom: "context manages the active context window; memory-curator curates the long-term memory store for accuracy."
-};
-var FLEET_COORDINATOR_META2 = {
-  rationale: "Fleet coordinator: multi-agent job partitioning, capacity planning and result synthesis. Operational counterpart to `planner`.",
-  signals: [
-    "fleet",
-    "fan out",
-    "parallel agents",
-    "synthesis",
-    "subagent capacity",
-    "coordinator",
-    "result aggregation"
-  ],
-  differentiatesFrom: "planner designs ordered steps for one worker; fleet-coordinator runs many workers in parallel and merges their results."
-};
-var PLUGIN_AUTHOR_META2 = {
-  rationale: "Plugin author: build, package and ship runnable WrongStack plugins. The production counterpart to `skill-manage`.",
-  signals: [
-    "plugin",
-    "plugin api",
-    "lifecycle",
-    "health",
-    "teardown",
-    "packaging",
-    "distribution"
-  ],
-  differentiatesFrom: "skill-manage authors skills; plugin-author authors full lifecycle plugins with health and teardown."
-};
-var TOOL_AUTHOR_META2 = {
-  rationale: "Tool author: tool schema, capability declaration, permission and error contract. The narrow, security-focused counterpart to `plugin-author`.",
-  signals: [
-    "tool",
-    "tool schema",
-    "capability",
-    "permission",
-    "tool contract",
-    "tool error",
-    "tool lifecycle"
-  ],
-  differentiatesFrom: "plugin-author writes full plugin lifecycle; tool-author focuses on a single tool contract and capability set."
-};
-var WAVE4_AGENTS = [
-  {
-    config: {
-      id: "plugin-author",
-      name: "Plugin Author",
-      role: "plugin-author",
-      tools: [...TOOLS.write, "fetch"],
-      prompt: agentPrompt("plugin-author")
-    },
-    budget: MEDIUM_BUDGET,
-    capability: {
-      phase: "meta",
-      summary: "Plugin author: build, package and ship runnable WrongStack plugins with full lifecycle, health and teardown.",
-      keywords: [
-        ...PLUGIN_AUTHOR_META2.signals,
-        "plugin",
-        "plugin-author",
-        "lifecycle",
-        "health",
-        "teardown",
-        "plugin-packaging"
-      ]
-    }
-  },
-  {
-    config: {
-      id: "tool-author",
-      name: "Tool Author",
-      role: "tool-author",
-      tools: [...TOOLS.write, "install"],
-      prompt: agentPrompt("tool-author")
-    },
-    budget: LIGHT_BUDGET,
-    capability: {
-      phase: "meta",
-      summary: "Tool author: design tool schemas, capability declarations, permissions and error contracts with security as the first concern.",
-      keywords: [
-        ...TOOL_AUTHOR_META2.signals,
-        "tool",
-        "tool-author",
-        "capability",
-        "permission",
-        "tool-schema",
-        "tool-error"
-      ]
-    }
-  },
-  {
-    config: {
-      id: "prompt-evaluator",
-      name: "Prompt Evaluator",
-      role: "prompt-evaluator",
-      tools: [...TOOLS.read, "write"],
-      prompt: agentPrompt("prompt-evaluator")
-    },
-    budget: MEDIUM_BUDGET,
-    capability: {
-      phase: "meta",
-      summary: "Prompt evaluator: build rubrics, adversarial prompt tests and regression suites for independent measurement.",
-      keywords: [
-        ...PROMPT_evaluator_META.signals,
-        "prompt-evaluator",
-        "rubric",
-        "adversarial",
-        "regression",
-        "judge"
-      ]
-    }
-  },
-  {
-    config: {
-      id: "benchmark-engineer",
-      name: "Benchmark Engineer",
-      role: "benchmark-engineer",
-      tools: [...TOOLS.read, "write", "logs"],
-      prompt: agentPrompt("benchmark-engineer")
-    },
-    budget: MEDIUM_BUDGET,
-    capability: {
-      phase: "meta",
-      summary: "Benchmark engineer: design reproducible benchmarks and methodology with deterministic baselines.",
-      keywords: [
-        ...BENCHMARK_ENGINEER_META2.signals,
-        "benchmark-engineer",
-        "benchmark",
-        "baseline",
-        "eval-harness",
-        "deterministic"
-      ]
-    }
-  },
-  {
-    config: {
-      id: "memory-curator",
-      name: "Memory Curator",
-      role: "memory-curator",
-      tools: [...TOOLS.read, ...SPECIALIST_TOOLS.memory],
-      prompt: agentPrompt("memory-curator")
-    },
-    budget: LIGHT_BUDGET,
-    capability: {
-      phase: "meta",
-      summary: "Memory curator: validate, merge and de-duplicate long-term memory entries with audience scoping.",
-      keywords: [
-        ...MEMORY_CURATOR_META2.signals,
-        "memory-curator",
-        "curate",
-        "memory-audit",
-        "memory-merge",
-        "audience-scope"
-      ]
-    }
-  },
-  {
-    config: {
-      id: "fleet-coordinator",
-      name: "Fleet Coordinator",
-      role: "fleet-coordinator",
-      tools: [...TOOLS.read, "plan"],
-      prompt: agentPrompt("fleet-coordinator")
-    },
-    budget: MEDIUM_BUDGET,
-    capability: {
-      phase: "meta",
-      summary: "Fleet coordinator: own multi-agent job partitioning, capacity planning and result synthesis across many parallel workers.",
-      keywords: [
-        ...FLEET_COORDINATOR_META2.signals,
-        "fleet-coordinator",
-        "fan-out",
-        "parallel",
-        "synthesis",
-        "subagent-capacity"
-      ]
-    }
-  }
-];
-var WAVE4_ROLE_METAS = {
-  "plugin-author": PLUGIN_AUTHOR_META2,
-  "tool-author": TOOL_AUTHOR_META2,
-  "prompt-evaluator": PROMPT_evaluator_META,
-  "benchmark-engineer": BENCHMARK_ENGINEER_META2,
-  "memory-curator": MEMORY_CURATOR_META2,
-  "fleet-coordinator": FLEET_COORDINATOR_META2
-};
-var WAVE4_ROLES = new Set(Object.keys(WAVE4_ROLE_METAS));
-
-// src/coordination/agents/role-skills.ts
-var skillSet = (...names) => names;
-var ROLE_SKILL_SETS = {
-  explore: skillSet("research-web", "node-modern", "typescript-strict"),
-  search: skillSet("bug-hunter", "typescript-strict", "research-web"),
-  research: skillSet("research-web", "tech-stack", "security-scanner", "api-design"),
-  analyst: skillSet("sdd", "api-design", "testing", "security-scanner"),
-  planner: skillSet("sdd", "multi-agent", "refactor-planner", "testing"),
-  architect: skillSet("sdd", "api-design", "refactor-planner", "security-scanner", "observability"),
-  critic: skillSet("chimera", "bug-hunter", "security-scanner", "refactor-planner"),
-  "refactor-planner": skillSet(
-    "refactor-planner",
-    "sdd",
-    "typescript-strict",
-    "testing",
-    "bug-hunter"
-  ),
-  executor: skillSet("sdd", "typescript-strict", "node-modern", "testing", "git-flow"),
-  refactor: skillSet("refactor-planner", "typescript-strict", "testing", "bug-hunter"),
-  simplifier: skillSet("bug-hunter", "typescript-strict", "testing", "refactor-planner"),
-  migration: skillSet("tech-stack", "node-modern", "typescript-strict", "testing", "git-flow"),
-  vision: skillSet("react-modern", "testing", "typescript-strict", "security-scanner"),
-  debugger: skillSet("bug-hunter", "testing", "typescript-strict", "observability", "audit-log"),
-  tracer: skillSet("observability", "audit-log", "bug-hunter", "testing"),
-  verifier: skillSet("testing", "typescript-strict", "security-scanner", "chimera"),
-  test: skillSet("testing", "typescript-strict", "bug-hunter", "security-scanner"),
-  e2e: skillSet("testing", "react-modern", "api-design", "security-scanner"),
-  browser: skillSet("testing", "react-modern", "security-scanner", "research-web"),
-  performance: skillSet("observability", "testing", "node-modern", "audit-log"),
-  chaos: skillSet("testing", "observability", "security-scanner", "audit-log"),
-  "security-scanner": skillSet("security-scanner", "bug-hunter", "api-design", "tech-stack"),
-  "bug-hunter": skillSet("bug-hunter", "typescript-strict", "testing", "security-scanner"),
-  "audit-log": skillSet("audit-log", "observability", "bug-hunter", "output-standards"),
-  reviewer: skillSet("chimera", "bug-hunter", "security-scanner", "testing"),
-  "code-reviewer": skillSet("chimera", "bug-hunter", "typescript-strict", "testing"),
-  "security-reviewer": skillSet("security-scanner", "chimera", "api-design", "tech-stack"),
-  accessibility: skillSet("react-modern", "testing", "chimera", "security-scanner"),
-  compliance: skillSet("security-scanner", "audit-log", "tech-stack", "chimera"),
-  database: skillSet("api-design", "testing", "security-scanner", "observability"),
-  api: skillSet("api-design", "typescript-strict", "node-modern", "testing", "security-scanner"),
-  auth: skillSet("security-scanner", "api-design", "testing", "typescript-strict", "audit-log"),
-  data: skillSet("typescript-strict", "testing", "observability", "security-scanner"),
-  frontend: skillSet("react-modern", "typescript-strict", "testing", "security-scanner"),
-  backend: skillSet("node-modern", "typescript-strict", "api-design", "testing", "observability"),
-  designer: skillSet("react-modern", "prompt-engineering", "research-web", "output-standards"),
-  ios: skillSet("sdd", "testing", "security-scanner", "research-web"),
-  document: skillSet("output-standards", "research-web", "api-design", "prompt-engineering"),
-  uml: skillSet("sdd", "refactor-planner", "api-design", "output-standards"),
-  i18n: skillSet("react-modern", "testing", "typescript-strict", "output-standards"),
-  prompt: skillSet("prompt-engineering", "skill-creator", "output-standards", "testing"),
-  git: skillSet("git-flow", "chimera", "testing", "security-scanner"),
-  release: skillSet("git-flow", "tech-stack", "chimera", "security-scanner"),
-  devops: skillSet("docker-deploy", "observability", "security-scanner", "git-flow", "tech-stack"),
-  observability: skillSet("observability", "node-modern", "testing", "audit-log"),
-  dependency: skillSet("tech-stack", "security-scanner", "node-modern", "git-flow"),
-  "skill-manage": skillSet(
-    "skill-creator",
-    "prompt-engineering",
-    "security-scanner",
-    "output-standards"
-  ),
-  "self-improving": skillSet(
-    "audit-log",
-    "mnemosyne",
-    "prompt-engineering",
-    "bug-hunter",
-    "observability"
-  ),
-  context: skillSet("mnemosyne", "output-standards", "prompt-engineering", "audit-log"),
-  cost: skillSet("audit-log", "tech-stack", "observability", "research-web"),
-  "tech-stack": skillSet("tech-stack", "research-web", "security-scanner", "node-modern"),
-  // ── Wave 1: Platform and systems engineering ──────────────────────────
-  android: skillSet(
-    "react-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  desktop: skillSet(
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  realtime: skillSet(
-    "api-design",
-    "observability",
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "tech-stack"
-  ),
-  "distributed-systems": skillSet(
-    "api-design",
-    "observability",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  concurrency: skillSet(
-    "bug-hunter",
-    "typescript-strict",
-    "testing",
-    "observability",
-    "node-modern",
-    "tech-stack"
-  ),
-  "platform-engineer": skillSet(
-    "node-modern",
-    "typescript-strict",
-    "git-flow",
-    "docker-deploy",
-    "tech-stack"
-  ),
-  // ── Wave 3: Product and data specialists ──────────────────────────────
-  payments: skillSet(
-    "api-design",
-    "security-scanner",
-    "audit-log",
-    "testing",
-    "typescript-strict",
-    "tech-stack"
-  ),
-  messaging: skillSet(
-    "api-design",
-    "observability",
-    "node-modern",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "search-relevance": skillSet(
-    "api-design",
-    "observability",
-    "testing",
-    "typescript-strict",
-    "data-governance",
-    "tech-stack"
-  ),
-  storage: skillSet(
-    "api-design",
-    "security-scanner",
-    "testing",
-    "observability",
-    "node-modern",
-    "tech-stack"
-  ),
-  "ml-engineer": skillSet(
-    "observability",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "data-governance",
-    "tech-stack"
-  ),
-  "data-governance": skillSet(
-    "audit-log",
-    "security-scanner",
-    "observability",
-    "testing",
-    "output-standards",
-    "tech-stack"
-  ),
-  // ── Wave 4: Agent platform and quality ───────────────────────────────
-  "plugin-author": skillSet(
-    "plugin-author",
-    "node-modern",
-    "typescript-strict",
-    "testing",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "tool-author": skillSet(
-    "typescript-strict",
-    "security-scanner",
-    "testing",
-    "output-standards",
-    "tech-stack"
-  ),
-  "prompt-evaluator": skillSet(
-    "prompt-engineering",
-    "testing",
-    "output-standards",
-    "security-scanner",
-    "tech-stack"
-  ),
-  "benchmark-engineer": skillSet("observability", "testing", "output-standards", "tech-stack"),
-  "memory-curator": skillSet("mnemosyne", "audit-log", "testing", "output-standards", "tech-stack"),
-  "fleet-coordinator": skillSet("multi-agent", "sdd", "output-standards", "testing", "tech-stack"),
-  // ── Wave 2: Security, resilience, governance and agent platform ────────
-  "threat-modeler": skillSet(
-    "security-scanner",
-    "api-design",
-    "tech-stack",
-    "audit-log",
-    "testing"
-  ),
-  "secure-coding-coach": skillSet(
-    "security-scanner",
-    "testing",
-    "typescript-strict",
-    "api-design",
-    "tech-stack"
-  ),
-  "resilience-engineer": skillSet(
-    "observability",
-    "testing",
-    "typescript-strict",
-    "api-design",
-    "tech-stack"
-  ),
-  "chaos-engineer": skillSet(
-    "observability",
-    "testing",
-    "security-scanner",
-    "git-flow",
-    "tech-stack"
-  ),
-  "compliance-auditor": skillSet(
-    "audit-log",
-    "security-scanner",
-    "output-standards",
-    "testing",
-    "tech-stack"
-  ),
-  "privacy-engineer": skillSet(
-    "security-scanner",
-    "audit-log",
-    "api-design",
-    "data-governance",
-    "tech-stack"
-  )
+// src/coordination/agents/phase9-wave4-platform-meta.ts
+var PROMPT_evaluator_META = {
+  rationale: "Prompt evaluator: builds rubrics, adversarial tests and regression suites. Independent measurement counterpart to the `prompt` author role.",
+  signals: [
+    "prompt eval",
+    "prompt regression",
+    "rubric",
+    "adversarial prompt",
+    "prompt benchmark",
+    "judge prompt",
+    "eval suite"
+  ],
+  differentiatesFrom: "prompt authors prompts; prompt-evaluator independently measures them with rubrics and adversarial inputs."
 };
-var SHADOW_AGENT_SKILLS = skillSet(
-  "wrongstack-mailbox",
-  "multi-agent",
-  "audit-log",
-  "observability",
-  "security-scanner"
-);
-var MAX_EAGER_ROSTER_SKILLS = 3;
-function assignSkillsToAgents(definitions) {
-  return definitions.map((definition) => {
-    const role = definition.config.role;
-    if (!role || !Object.hasOwn(ROLE_SKILL_SETS, role)) {
-      throw new Error(
-        `Missing curated skill set for roster role: "${role ?? definition.config.name}"`
-      );
+var BENCHMARK_ENGINEER_META2 = {
+  rationale: "Benchmark engineer: reproducible benchmark design and methodology. The measurement-infrastructure counterpart to `performance`.",
+  signals: [
+    "benchmark",
+    "reproducible",
+    "evaluation harness",
+    "regression suite",
+    "metric methodology",
+    "baseline",
+    "deterministic run"
+  ],
+  differentiatesFrom: "performance optimizes product code; benchmark-engineer builds the measurement infrastructure that supports comparison."
+};
+var MEMORY_CURATOR_META2 = {
+  rationale: "Memory curator: validates, merges and de-duplicates long-term memory with audience scope. Quality counterpart to `context`.",
+  signals: [
+    "memory",
+    "curate",
+    "memory audit",
+    "memory merge",
+    "memory expiry",
+    "audience scope",
+    "memory recall quality"
+  ],
+  differentiatesFrom: "context manages the active context window; memory-curator curates the long-term memory store for accuracy."
+};
+var FLEET_COORDINATOR_META2 = {
+  rationale: "Fleet coordinator: multi-agent job partitioning, capacity planning and result synthesis. Operational counterpart to `planner`.",
+  signals: [
+    "fleet",
+    "fan out",
+    "parallel agents",
+    "synthesis",
+    "subagent capacity",
+    "coordinator",
+    "result aggregation"
+  ],
+  differentiatesFrom: "planner designs ordered steps for one worker; fleet-coordinator runs many workers in parallel and merges their results."
+};
+var PLUGIN_AUTHOR_META2 = {
+  rationale: "Plugin author: build, package and ship runnable WrongStack plugins. The production counterpart to `skill-manage`.",
+  signals: [
+    "plugin",
+    "plugin api",
+    "lifecycle",
+    "health",
+    "teardown",
+    "packaging",
+    "distribution"
+  ],
+  differentiatesFrom: "skill-manage authors skills; plugin-author authors full lifecycle plugins with health and teardown."
+};
+var TOOL_AUTHOR_META2 = {
+  rationale: "Tool author: tool schema, capability declaration, permission and error contract. The narrow, security-focused counterpart to `plugin-author`.",
+  signals: [
+    "tool",
+    "tool schema",
+    "capability",
+    "permission",
+    "tool contract",
+    "tool error",
+    "tool lifecycle"
+  ],
+  differentiatesFrom: "plugin-author writes full plugin lifecycle; tool-author focuses on a single tool contract and capability set."
+};
+var WAVE4_AGENTS = [
+  {
+    config: {
+      id: "plugin-author",
+      name: "Plugin Author",
+      role: "plugin-author",
+      tools: [...TOOLS.write, "fetch"],
+      prompt: agentPrompt("plugin-author")
+    },
+    budget: MEDIUM_BUDGET,
+    capability: {
+      phase: "meta",
+      summary: "Plugin author: build, package and ship runnable WrongStack plugins with full lifecycle, health and teardown.",
+      keywords: [
+        ...PLUGIN_AUTHOR_META2.signals,
+        "plugin",
+        "plugin-author",
+        "lifecycle",
+        "health",
+        "teardown",
+        "plugin-packaging"
+      ]
     }
-    const skills = ROLE_SKILL_SETS[role];
-    return {
-      ...definition,
-      config: {
-        ...definition.config,
-        capabilities: inferRuntimeCapabilities(definition.config.tools ?? []),
-        skillNames: skills.slice(0, MAX_EAGER_ROSTER_SKILLS)
-      }
-    };
-  });
-}
+  },
+  {
+    config: {
+      id: "tool-author",
+      name: "Tool Author",
+      role: "tool-author",
+      tools: [...TOOLS.write, "install"],
+      prompt: agentPrompt("tool-author")
+    },
+    budget: LIGHT_BUDGET,
+    capability: {
+      phase: "meta",
+      summary: "Tool author: design tool schemas, capability declarations, permissions and error contracts with security as the first concern.",
+      keywords: [
+        ...TOOL_AUTHOR_META2.signals,
+        "tool",
+        "tool-author",
+        "capability",
+        "permission",
+        "tool-schema",
+        "tool-error"
+      ]
+    }
+  },
+  {
+    config: {
+      id: "prompt-evaluator",
+      name: "Prompt Evaluator",
+      role: "prompt-evaluator",
+      tools: [...TOOLS.read, "write"],
+      prompt: agentPrompt("prompt-evaluator")
+    },
+    budget: MEDIUM_BUDGET,
+    capability: {
+      phase: "meta",
+      summary: "Prompt evaluator: build rubrics, adversarial prompt tests and regression suites for independent measurement.",
+      keywords: [
+        ...PROMPT_evaluator_META.signals,
+        "prompt-evaluator",
+        "rubric",
+        "adversarial",
+        "regression",
+        "judge"
+      ]
+    }
+  },
+  {
+    config: {
+      id: "benchmark-engineer",
+      name: "Benchmark Engineer",
+      role: "benchmark-engineer",
+      tools: [...TOOLS.read, "write", "logs"],
+      prompt: agentPrompt("benchmark-engineer")
+    },
+    budget: MEDIUM_BUDGET,
+    capability: {
+      phase: "meta",
+      summary: "Benchmark engineer: design reproducible benchmarks and methodology with deterministic baselines.",
+      keywords: [
+        ...BENCHMARK_ENGINEER_META2.signals,
+        "benchmark-engineer",
+        "benchmark",
+        "baseline",
+        "eval-harness",
+        "deterministic"
+      ]
+    }
+  },
+  {
+    config: {
+      id: "memory-curator",
+      name: "Memory Curator",
+      role: "memory-curator",
+      tools: [...TOOLS.read, ...SPECIALIST_TOOLS.memory],
+      prompt: agentPrompt("memory-curator")
+    },
+    budget: LIGHT_BUDGET,
+    capability: {
+      phase: "meta",
+      summary: "Memory curator: validate, merge and de-duplicate long-term memory entries with audience scoping.",
+      keywords: [
+        ...MEMORY_CURATOR_META2.signals,
+        "memory-curator",
+        "curate",
+        "memory-audit",
+        "memory-merge",
+        "audience-scope"
+      ]
+    }
+  },
+  {
+    config: {
+      id: "fleet-coordinator",
+      name: "Fleet Coordinator",
+      role: "fleet-coordinator",
+      tools: [...TOOLS.read, "plan"],
+      prompt: agentPrompt("fleet-coordinator")
+    },
+    budget: MEDIUM_BUDGET,
+    capability: {
+      phase: "meta",
+      summary: "Fleet coordinator: own multi-agent job partitioning, capacity planning and result synthesis across many parallel workers.",
+      keywords: [
+        ...FLEET_COORDINATOR_META2.signals,
+        "fleet-coordinator",
+        "fan-out",
+        "parallel",
+        "synthesis",
+        "subagent-capacity"
+      ]
+    }
+  }
+];
+var WAVE4_ROLE_METAS = {
+  "plugin-author": PLUGIN_AUTHOR_META2,
+  "tool-author": TOOL_AUTHOR_META2,
+  "prompt-evaluator": PROMPT_evaluator_META,
+  "benchmark-engineer": BENCHMARK_ENGINEER_META2,
+  "memory-curator": MEMORY_CURATOR_META2,
+  "fleet-coordinator": FLEET_COORDINATOR_META2
+};
+var WAVE4_ROLES = new Set(Object.keys(WAVE4_ROLE_METAS));
 
 // src/coordination/agents/index.ts
 var ALL_AGENT_DEFINITIONS = assignSkillsToAgents([
@@ -6772,7 +7098,9 @@ ${content}`);
         }
         if (typeof config.maxConcurrent === "number") {
           if (!Number.isFinite(config.maxConcurrent) || config.maxConcurrent < 0) {
-            issues.push(`maxConcurrent must be a non-negative number (got ${config.maxConcurrent})`);
+            issues.push(
+              `maxConcurrent must be a non-negative number (got ${config.maxConcurrent})`
+            );
           } else if (config.maxConcurrent === 0) {
             warnings.push("maxConcurrent is 0 \u2014 subagent concurrency effectively disabled");
           } else {
@@ -6784,12 +7112,28 @@ ${content}`);
             const v = fleetBudget[key];
             if (v === void 0) continue;
             if (typeof v !== "number" || !Number.isFinite(v) || v < 0) {
-              issues.push(`fleet.budget.${key} must be a non-negative number (got ${JSON.stringify(v)})`);
+              issues.push(
+                `fleet.budget.${key} must be a non-negative number (got ${JSON.stringify(v)})`
+              );
             } else {
               ok.push(`fleet.budget.${key} ${v}`);
             }
           }
         }
+        const lastResortCap = config.fallbackMaxLastResortCandidates;
+        if (lastResortCap !== void 0) {
+          if (typeof lastResortCap !== "number" || !Number.isFinite(lastResortCap) || lastResortCap < 0) {
+            issues.push(
+              `fallbackMaxLastResortCandidates must be a non-negative number (got ${String(lastResortCap)})`
+            );
+          } else if (Math.floor(lastResortCap) === 0) {
+            warnings.push(
+              `fallbackMaxLastResortCandidates is ${lastResortCap} \u2014 floors to 0, last-resort auto-discovery append is disabled`
+            );
+          } else {
+            ok.push(`fallbackMaxLastResortCandidates ${Math.floor(lastResortCap)}`);
+          }
+        }
         for (const [key, entry] of Object.entries(matrix)) {
           const eProvider = entry.provider ?? config.provider;
           const eModel = entry.model;
@@ -7747,21 +8091,21 @@ async function updateJsonObjectFile(filePath, mutator) {
 function isForbiddenSegment(segment) {
   return typeof segment === "string" && FORBIDDEN_PROTO_KEYS.has(segment);
 }
-function assertSafePath(path7) {
-  for (const segment of path7) {
+function assertSafePath(path8) {
+  for (const segment of path8) {
     if (isForbiddenSegment(segment)) {
       throw new Error(`Refusing to use reserved key "${String(segment)}" in a JSON path`);
     }
   }
 }
-function setJsonPath(root, path7, value) {
-  assertSafePath(path7);
-  if (path7.length === 0) {
+function setJsonPath(root, path8, value) {
+  assertSafePath(path8);
+  if (path8.length === 0) {
     if (!isJsonObject(value)) throw new Error("Root config value must be an object");
     return value;
   }
-  const parent = ensureJsonParent(root, path7);
-  const leaf = lastPathSegment(path7);
+  const parent = ensureJsonParent(root, path8);
+  const leaf = lastPathSegment(path8);
   if (typeof leaf === "number") {
     if (!Array.isArray(parent))
       throw new Error(`Cannot set numeric segment ${leaf} on non-array parent`);
@@ -7775,17 +8119,17 @@ function setJsonPath(root, path7, value) {
 function isJsonObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function lastPathSegment(path7) {
-  const segment = path7[path7.length - 1];
+function lastPathSegment(path8) {
+  const segment = path8[path8.length - 1];
   if (segment === void 0) throw new Error("Invalid empty JSON path");
   return segment;
 }
-function ensureJsonParent(root, path7) {
-  assertSafePath(path7);
+function ensureJsonParent(root, path8) {
+  assertSafePath(path8);
   let current = root;
-  for (let i = 0; i < path7.length - 1; i += 1) {
-    const segment = path7[i];
-    const nextSegment = path7[i + 1];
+  for (let i = 0; i < path8.length - 1; i += 1) {
+    const segment = path8[i];
+    const nextSegment = path8[i + 1];
     if (segment === void 0) throw new Error("Invalid empty JSON path segment");
     const nextContainer = typeof nextSegment === "number" ? [] : {};
     if (typeof segment === "number") {
@@ -8061,19 +8405,23 @@ function badge(state) {
 var GOVERNED_TOOL_EXECUTOR_META_KEY = "toolExecutor.executeGoverned";
 
 // src/utils/tool-name.ts
+import { createHash as createHash2 } from "node:crypto";
 var WIRE_TOOL_NAME_MAX_LENGTH = 128;
-function sanitizeWireToolName(name) {
-  const replaced = name.replace(/[^a-zA-Z0-9_-]/g, "_");
-  const clamped = replaced.slice(0, WIRE_TOOL_NAME_MAX_LENGTH);
-  return clamped.length > 0 ? clamped : "tool";
+var MCP_SERVER_SEGMENT_MAX_LENGTH = 48;
+var MCP_IDENTITY_HASH_LENGTH = 10;
+function collisionSafeMcpSegment(value, maxLength) {
+  const replaced = value.replace(/[^a-zA-Z0-9_-]/g, "_") || "tool";
+  if (replaced === value && replaced.length <= maxLength) return replaced;
+  const suffix = `_${createHash2("sha256").update(value, "utf8").digest("hex").slice(0, MCP_IDENTITY_HASH_LENGTH)}`;
+  return `${replaced.slice(0, Math.max(1, maxLength - suffix.length))}${suffix}`;
 }
 function mcpServerToolPrefix(serverName) {
-  return `mcp__${sanitizeWireToolName(serverName)}__`;
+  return `mcp__${collisionSafeMcpSegment(serverName, MCP_SERVER_SEGMENT_MAX_LENGTH)}__`;
 }
 function mcpQualifiedToolName(serverName, toolName) {
-  return sanitizeWireToolName(
-    `${mcpServerToolPrefix(serverName)}${sanitizeWireToolName(toolName)}`
-  );
+  const prefix = mcpServerToolPrefix(serverName);
+  const toolSegment = collisionSafeMcpSegment(toolName, WIRE_TOOL_NAME_MAX_LENGTH - prefix.length);
+  return `${prefix}${toolSegment}`;
 }
 
 // src/tools/mcp-use.ts
@@ -8345,52 +8693,24 @@ var OneShotOrchestrator = class {
   }
   /**
    * Build the fallback model chain from input + config + current target.
+   * Delegates to {@link FallbackProfileManager.resolveCandidates} — the
+   * shared constructor used by both the agent loop and the one-shot path,
+   * so both produce identical ordering, depth, and fromExplicitSource
+   * semantics.
+   *
    * The injected {@link OneShotOrchestratorOptions.fallbackProfileManager}
    * is the only allowed manager — OneShot never owns a private snapshot
    * so a live `ConfigStore` change reaches every call without rebuilding
    * the manager.
    */
   resolveFallbackChain(input, config, target) {
-    const mgr = this.opts.fallbackProfileManager;
-    let fromExplicitSource = false;
-    let selected = mgr.resolveEffective({
-      fallbackAuto: false,
-      exclude: target
+    return this.opts.fallbackProfileManager.resolveCandidates(target, {
+      fallbackModels: input.fallbackModels && input.fallbackModels.length > 0 ? input.fallbackModels : config.fallbackModels,
+      // The one-shot already tried `target` as the primary before entering
+      // the chain. Passing it as `primary` suppresses the primary-insertion
+      // step in resolveCandidates (primary === current → not pushed).
+      primary: target
     });
-    if (input.fallbackModels && input.fallbackModels.length > 0) {
-      const resolved = mgr.resolveEffective({
-        fallbackModels: input.fallbackModels,
-        fallbackAuto: false,
-        exclude: target
-      });
-      selected = resolved;
-      fromExplicitSource = resolved.length > 0;
-    } else if (config.fallbackModels && config.fallbackModels.length > 0) {
-      const resolved = mgr.resolveEffective({
-        fallbackModels: config.fallbackModels,
-        fallbackAuto: false,
-        exclude: target
-      });
-      selected = resolved;
-      fromExplicitSource = resolved.length > 0;
-    } else if (config.fallbackAuto !== false) {
-      selected = mgr.resolveEffective({
-        fallbackAuto: true,
-        exclude: target
-      });
-    }
-    if (config.fallbackAuto === false) return selected;
-    if (fromExplicitSource) return selected;
-    const combined = [...selected, ...mgr.resolveAllConfigured(target)];
-    const seen = /* @__PURE__ */ new Set();
-    return Object.freeze(
-      combined.filter((entry) => {
-        const key = `${entry.providerId}/${entry.model}`;
-        if (seen.has(key)) return false;
-        seen.add(key);
-        return true;
-      })
-    );
   }
   /** Attempt a provider call while preserving the actual failure for callers. */
   async tryCall(provider, request, signal, providerId, model) {
@@ -8644,10 +8964,10 @@ function validateAgainstSchema(value, schema) {
   return { ok: errors.length === 0, errors };
 }
 var MAX_SCHEMA_DEPTH = 64;
-function walk(value, schema, path7, errors, depth) {
+function walk(value, schema, path8, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path7 || "<root>",
+      path: path8 || "<root>",
       message: `schema nesting exceeds maximum depth (${MAX_SCHEMA_DEPTH})`
     });
     return;
@@ -8655,7 +8975,7 @@ function walk(value, schema, path7, errors, depth) {
   if (schema.enum !== void 0) {
     if (!enumIncludes(schema.enum, value)) {
       errors.push({
-        path: path7 || "<root>",
+        path: path8 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -8664,7 +8984,7 @@ function walk(value, schema, path7, errors, depth) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path7 || "<root>",
+        path: path8 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)} (${previewValue(value)})`
       });
       return;
@@ -8676,7 +8996,7 @@ function walk(value, schema, path7, errors, depth) {
       if (!(req in obj)) {
         const expected = schema.properties?.[req]?.type;
         errors.push({
-          path: joinPath(path7, req),
+          path: joinPath(path8, req),
           message: `required property missing${typeof expected === "string" ? ` (expected ${expected})` : ""}`
         });
       }
@@ -8684,14 +9004,14 @@ function walk(value, schema, path7, errors, depth) {
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path7, key), errors, depth + 1);
+          walk(obj[key], subSchema, joinPath(path8, key), errors, depth + 1);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path7}[${i}]`, errors, depth + 1);
+      walk(value[i], schema.items, `${path8}[${i}]`, errors, depth + 1);
     }
   }
 }