@yemi33/minions 0.1.2453 → 0.1.2455

package/docs/named-agents.md

@@ -29,6 +29,48 @@ The `name`, `emoji`, `role`, and `expertise` fields are **human-facing metadata*
 label the agent in the dashboard and document intent. They do **not** drive dispatch (see
 §3) and the `expertise` array is not executable (see §4).
 
+### 1.1 Temporary agents and friendly call signs
+
+When every permanent agent is busy and `engine.allowTempAgents` is set, the engine
+spawns an **ephemeral agent** with a machine id of the form `temp-<uid>` (see
+[`engine/orchestration/routing.js`](../engine/orchestration/routing.js)). That canonical
+`temp-…` id is the **only** machine identity — it is unchanged for routing, SQL keys,
+filesystem paths, live-output logs, process ownership, APIs, per-agent memory rules
+(§8: `temp-*` ids are skipped for personal memory), and PR/reconciliation records.
+
+For display only, each temp agent also gets a stable, memorable **call sign** such as
+`Cosmic Comet`, rendered next to a visible `Temp` badge (`CallSign` + badge). This is
+an *additive display identity*, never a rename of the machine id.
+
+**Deterministic-from-id invariant (no persisted state).** The call sign is derived
+purely from the immutable canonical id by
+[`shared.tempAgentCallSign(id)`](../engine/core/shared.js): a single FNV-1a 32-bit hash of
+the lower-cased id selects an adjective from its low bits (`h % ADJ`) and a name from its
+high bits (`⌊h / ADJ⌋ % NAMES`), each drawn from a curated, roster-disjoint vocabulary.
+Because the derivation depends only on the id and nothing else:
+
+- **Restart- and history-stable** — the same id always yields the same call sign across
+  engine/dashboard restarts and for long-exited agents in archived/history views, so no
+  SQL migration or JSON runtime state is needed (and none is added). An already-assigned
+  name is preserved by construction — it cannot drift when the active set changes.
+- **Collision behavior is deterministic** — the ~24×24 adjective/name space plus the
+  single-hash bit-slice keeps concurrently-visible temp agents well-spread; the curated
+  `name` list is disjoint from the shipped roster (Ripley/Dallas/Lambert/Rebecca/Ralph)
+  so a call sign never equals a configured display name, and the always-visible `Temp`
+  badge disambiguates even a rare full collision.
+- **Case-insensitive** — legacy mixed-case `Temp-*` ids derive the same call sign as
+  their canonical lower-case form.
+
+The client mirrors this vocabulary + algorithm in
+[`dashboard/js/agent-identity.js`](../dashboard/js/agent-identity.js) (`MinionsAgentIdentity`),
+the single formatter every user-facing renderer calls, so a legacy record missing the
+server-stamped `agentName` still renders the identical stable call sign. Parity between
+the two implementations is asserted by
+[`test/unit/temp-agent-identity.test.js`](../test/unit/temp-agent-identity.test.js).
+API payloads expose structured fields (`id`, friendly `name`/`callSign`, `isTemp`) rather
+than replacing ids with formatted strings, and the canonical `temp-…` id stays discoverable
+in detail views/tooltips for debugging.
+
 ## 2. How an agent is configured
 
 The full per-agent config shape supported under `config.agents.<id>`:
@@ -123,6 +165,12 @@ context; `_any_` routes to any available idle agent (lowest error rate first).
 `implement:large` is selected for items with `estimated_complexity: "large"`. If both
 preferred and fallback are busy, the engine falls back to any idle agent.
 
+**Overflow → temp agents.** If no configured agent is idle and the operator has enabled
+`engine.allowTempAgents` (default off), the engine may spawn an ephemeral, personaless
+`temp-<uid>` agent as a last-resort fallback. Temp agents inherit fleet-default runtime/model/
+tools and shared/project memory but carry no charter and no personal memory. See
+[`temporary-agents.md`](temporary-agents.md).
+
 **Dispatch rules** (from `routing.md`):
 
 - **Eager by default** — the engine spawns every agent that can start work, not one at a time.

package/docs/pr-author-identity.md

@@ -62,8 +62,15 @@ agent id. `pr.agent` is now **never** a human login.
   non-empty incoming value wins, otherwise the existing value is preserved, so a
   **partial provider refresh never erases a richer author already stored**. A
   provider change trusts the newer identity wholesale.
-- `prAuthorLabel(author)` — human-readable label (displayName → login → id) for
-  the typed SQL column and filter/search text.
+- `prAuthorDisplayName(author)` — the **email-free** human-readable name every
+  surface should show. Prefers a real `displayName` → `login`, and only when the
+  sole usable identity is an email does it fall back to the **local-part** (domain
+  dropped). Any `@` anywhere forces local-part extraction, so a malformed value
+  (`"Name <a@b>"`, `weird@x@y`, a bare address) can never leak an `@`. Returns
+  `''` (→ **Unknown**) when nothing usable remains. Presentation only — the
+  structured `login`/`id`/`descriptor` fields are left untouched.
+- `prAuthorLabel(author)` — thin delegate to `prAuthorDisplayName` (kept for
+  callers wanting a "label"); therefore also email-free.
 
 `upsertPullRequestRecord` normalizes `author` on the create path and merges it
 via `mergePrAuthorIdentity` on the update path (and in `_mergeDuplicatePrInto`),
@@ -76,7 +83,11 @@ manual link, dashboard enrich, dedup — converge on one merge behavior.
 projection column (plus `idx_pr_author`). The canonical structured identity
 always lives in the row's `data` JSON; the column is a label projection for
 filters/sort. `engine/persistence/pull-requests-store.js` writes it via a local
-`_authorLabel(pr.author)` (displayName → login → id).
+`_authorLabel(pr.author)` (displayName → login → id). This column feeds only the
+`idx_pr_author` index for server-side filter/sort — it is **never selected back
+or surfaced to any client** (reads return the `data` JSON), so it may still
+contain an email and is deliberately left as machine-facing projection, not a
+display label.
 
 Backfill is **fail-closed**. A legacy row whose `agent` is a human login (i.e.
 not `'human'`, not a configured Minions agent id from `config.json`, not
@@ -96,14 +107,26 @@ alongside the existing `agent` field.
 
 ## Dashboard
 
+Every dashboard surface that shows a PR author routes through **one** shared
+browser formatter, `window.MinionsPrAuthor` (`dashboard/shared/pr-author.js`),
+which mirrors the engine `prAuthorDisplayName` so the operator-visible name is
+always **email-free** — an ADO author stored as `Name <email>` or a bare email
+`uniqueName` renders as the name / email local-part, never the address. It is
+listed in `DASHBOARD_SHARED_JS` before `pr-filters`, so classic and slim share it.
+
 `dashboard/js/render-prs.js` replaces the Pull Requests table's **Agent** column
-with **Author** (display name + `@login`, safely escaped, linked to the provider
-profile only when a validated `http(s)` URL is present). The Minions agent stays
-visible in the PR detail panel under **Minions agent**, next to a new **Author**
-line, so operators can still answer both "who is this for?" and "which agent
-handled it?". The shared author filter (`dashboard/shared/pr-filters.js`) now
-reads structured `pr.author` only and no longer falls back to `pr.agent`, so the
-filter and the displayed column stay aligned (legacy rows group as Unknown).
+with **Author** (`MinionsPrAuthor.display` → name + optional `@handle` — a handle
+is offered only for a real non-email login, safely escaped, linked to the
+provider profile only when a validated `http(s)` URL is present). The Minions
+agent stays visible in the PR detail panel under **Minions agent**, next to the
+**Author** line, so operators can still answer both "who is this for?" and "which
+agent handled it?". The shared author filter (`dashboard/shared/pr-filters.js`)
+shows the same email-free **label** while grouping on a stable machine **key**
+(`id` → `descriptor` → `login` → … via `_prAuthorMachineKey`), so two people who
+share a display name never collapse and the filter stays aligned with the column
+(legacy rows group as Unknown). The work-item follow-up chip
+(`dashboard/js/render-work-items.js`) strips the email from a
+`pr_followup.parent_comment_author` the same way.
 
 ## Backward-compatible reads
 
@@ -112,3 +135,33 @@ filter and the displayed column stay aligned (legacy rows group as Unknown).
 author string keeps rendering. This is a tolerant read, not a retained
 compatibility shim — the overloaded `agent = login` write behavior was removed
 outright (no `docs/deprecated.json` entry required).
+
+## AutoFix foreign-author guardrail (W-msd8pr2300ev95e1)
+
+When AutoFix is enabled on a PR whose author is **not** the current authenticated
+identity for that provider/repo scope, the Pull Requests table's **AutoFix** cell
+renders a prominent warning icon beside the toggle: a red `⚠`
+("Auto-fix enabled for another author's PR", naming the author when known) or, if
+ownership cannot be established, a yellow `⚠` ("author ownership unknown"). This
+never changes behavior — enabling auto-fix on another author's PR stays an
+explicit operator action — it only surfaces the risk.
+
+Ownership is resolved by `shared.resolvePrAuthorOwnership(pr, selfByProvider)`
+(`self` | `foreign` | `unknown`) using **stable provider identities only** —
+GitHub canonical `login` / numeric `id`; ADO identity `id` / `descriptor`. Display
+names and emails are never compared, and the determination **fails closed** to
+`unknown` (shown as the neutral warning, never silently treated as self) whenever
+either side's stable identity is missing.
+
+`engine/core/queries.js#getPullRequests` stamps `pr._authorOwnership` once per
+build, resolving the current identity per provider:
+
+- **GitHub** — `operator-identity.resolveGithubViewerLoginStrict(config)`, which
+  accepts only `engine.operatorLogin` or `gh api user` (never a git-email / OS
+  fallback).
+- **ADO** — the optional operator-configured `engine.operatorAdoIdentity`
+  (`{ id?, descriptor? }`). There is no automatic ADO current-identity seam, so
+  when it is unset every ADO PR reports `unknown` (fail-closed). Set it under
+  **Settings → Operator & Comments → ADO identity id / descriptor**. It is a
+  read-only identity value (like `operatorLogin`), never an email — the ADO
+  `uniqueName`/login is deliberately excluded from both storage and comparison.

package/docs/runtime-adapters.md

@@ -108,6 +108,44 @@ marker and visible sign-off, and lifecycle persists the same value as
 `minionsReview.model`. Model catalogs are never used to guess an implicit
 runtime default.
 
+### Billable-unit usage accounting
+
+Some runtimes bill a native, non-USD unit — the GitHub Copilot CLI reports
+**premium requests** per session/turn. `parseOutput().usage` therefore carries a
+generic typed descriptor alongside the token/cost fields so the engine accounts
+for credits without ever branching on a runtime name:
+
+```js
+usage.billable = { unit: 'premiumRequests', value: <number|null>, reported: <bool> }
+```
+
+- **Authoritative, never derived.** `value` is the count the CLI reported; the
+  engine never estimates credits from tokens, model, elapsed time, or pricing.
+- **Unavailable ≠ 0.** When the installed CLI did not expose the field for a run,
+  the adapter emits `value: null, reported: false` (and Copilot leaves
+  `premiumRequests` / `costUsd` `null`, not `0`). Surfaces render unreported as
+  `N/A`, distinct from a genuine reported `0`.
+- **Already scoped — no delta diffing.** Copilot `parseOutput` reassigns
+  `usage` on each terminal `result` event, so the value is the finalized count
+  for THIS invocation / pooled turn, not a running session total. Downstream code
+  therefore **sums** per-invocation values; it does not diff cumulative counters.
+  This per-invocation scoping is what makes streamed, resumed, retried, and
+  pooled dispatches safe from double-counting.
+
+`shared.accumulateBillableUnits(target, usage.billable)` folds a descriptor into
+`target.billableUnits[unit] = { total, reported, unavailable }`, used by
+`engine/orchestration/lifecycle.js#updateMetrics` (per-agent / `_engine` /
+`_daily`) and `engine/agents/llm.js` (Command Center / doc-chat). USD is
+deliberately **excluded** from this path — dollar cost already flows through the
+richer `costUsd` + token accounting, so routing it here too would double-count.
+The map persists inside the existing metrics JSON blob (no migration; older rows
+simply lack the field), and `engine/core/queries.js#getMetrics` resolves
+`m.billableUnit` from the runtime capability so the dashboard keys off typed
+metadata, never the runtime name. A future adapter can surface its own unit by
+setting `capabilities.billableUnit` and emitting `usage.billable` — no call-site
+changes required.
+
+
 ## Capability Flags
 
 Engine code branches on consumed flags, never on runtime names. A capability
@@ -122,6 +160,7 @@ to act on that behavioral split.
 | `systemPromptFile` | ✓ | ✗ | ✗ | sysprompt via `--system-prompt-file` (else inlined into stdin by `buildPrompt`). |
 | `effortLevels` | ✓ | ✓ | ✓ | Runtime reasoning-effort controls. Codex maps through `--config model_reasoning_effort=...`; Copilot maps `'max'` to `'xhigh'`; Claude leaves `'max'` alone. |
 | `costTracking` | ✓ | ✗ | ✗ | USD + token counts in the result event. Copilot only emits `premiumRequests`; Codex accounting is not assumed. |
+| `billableUnit` | `usd` | `premiumRequests` | `usd` | Typed native billable unit for the display layer. The dashboard renders THIS unit in the same position a USD runtime shows dollar cost, switching labels/units/tooltips off the metadata — never a runtime-name branch. Adapters with no native credit unit default to `'usd'`. |
 | `modelShorthands` | ✓ | ✗ | ✗ | Bare `sonnet`/`opus`/`haiku` accepted by Claude only. |
 | `modelDiscovery` | ✗ | ✓ | ✓ | `listModels()` returns a real catalog when supported (Copilot API, Codex `debug models --bundled`). |
 | `strictModelCatalog` | — | — | ✗ | An explicit false lets the runtime validate IDs missing from its cached catalog; Codex uses this because bundled catalogs can lag staged/custom models. |

package/docs/temporary-agents.md

@@ -0,0 +1,172 @@
+# Temporary Agents — ephemeral `temp-<uid>` fallback dispatch
+
+Minions normally dispatches work to a fixed roster of **named agents** (Ripley, Dallas, …;
+see [`named-agents.md`](named-agents.md)). When every eligible named agent is busy and the
+operator has opted in, the engine can spawn a **temporary agent** — a one-shot, unnamed
+`temp-<uid>` identity that exists only to absorb overflow work so the queue does not stall.
+
+This document describes the complete temp-agent behavior, verified against the current
+implementation. Temp agents are deliberately minimal: they have **no charter, no persona,
+no personal memory, and no persistent config record**. They are a scheduling escape valve,
+not a sixth teammate.
+
+> Orientation only — the load-bearing contracts live in code. Cross-references:
+> [`named-agents.md`](named-agents.md), [`team-memory.md`](team-memory.md),
+> [`workspace-manifests.md`](workspace-manifests.md), [`runtime-adapters.md`](runtime-adapters.md),
+> and [`../CLAUDE.md`](../CLAUDE.md).
+
+## 1. When and why a temp agent is created
+
+Temp agents are an **opt-in, last-resort** step of agent resolution in
+`resolveAgent(workType, config, opts)` (`engine/orchestration/routing.js`). Resolution tries,
+in order: agent hints → routing `preferred` → routing `fallback` → any idle configured agent
+(lowest error rate first). Only if **all** of those miss does it consider a temp agent, and
+only when every one of these gates passes:
+
+1. **Config gate — `engine.allowTempAgents`.** Defaults to **`false`**
+   (`ENGINE_DEFAULTS.allowTempAgents`, `engine/core/shared.js`). With it off, `resolveAgent`
+   returns `null` and the work item simply stays `pending` until a named agent frees up — no
+   temp is ever created (`engine/orchestration/routing.js`, the `if (config.engine?.allowTempAgents)`
+   branch). It is exposed as a Settings toggle ("Allow Temp Agents", `set-allowTempAgents`) in
+   `dashboard/js/settings.js` and surfaced on `GET /api/*` status via `dashboard.js`.
+2. **Concurrency gate — per-tick temp budget.** The engine calls `setTempBudget(maxConcurrent - activeCount)`
+   once per tick (`engine.js`), so temps count against `engine.maxConcurrent` exactly like
+   named agents. When the budget is exhausted, `resolveAgent` logs
+   `Temp agent refused … per-tick budget exhausted` and returns `null`. This guard stops a
+   mass-discovery pass (e.g. a PR-poll sweep over 20 failing PRs) from registering one temp per
+   pending item and spawning far more processes than `maxConcurrent` allows (closes #1209).
+
+Because a `temp-<uid>` id is by construction never equal to a named author agent, a temp is
+always a valid **non-author** reviewer under the self-review ban, and a valid reassignment
+target under `excludeAgent`. Temp creation is also the documented fallback for the
+**decompose** flow: when `engine.autoDecompose` splits an `implement:large` item and all
+permanent agents are busy, the engine can spawn a `temp-<uid>` to run a sub-task
+(see [`../CLAUDE.md`](../CLAUDE.md) → "Decomposition").
+
+## 2. Naming and runtime/state representation
+
+- **Id:** `temp-${shared.uid()}` — e.g. `temp-mscilxge004b1de2`. The `temp-` prefix is a
+  reserved sentinel checked throughout the engine; a configured agent id may not collide with
+  it (`docs/specs/agent-configurability.md`).
+- **Display name / role:** `{ name: "Temp-<4chars>", role: "Temporary Agent" }`, derived from
+  characters 5–8 of the id (`engine/orchestration/routing.js`).
+- **In-memory only:** the record lives in a module-level `Map` `tempAgents` in
+  `engine/orchestration/routing.js` (`tempAgentId → { name, role, createdAt }`). It is **not**
+  written to `config.json`, and **not** persisted to SQLite. The authoritative agent identity
+  for the work travels on the work item / dispatch record (`item.agent`, `item.agentName`,
+  `item.agentRole`), which persist normally.
+- **Dashboard/API:** an *active* temp agent is added to the agent roster snapshot by
+  `engine/core/queries.js#getAgents` with `emoji: 💨`, `expertise: []`, and `_temp: true`, so
+  it shows up as a tile while it runs. Temp agents are deliberately **excluded** from per-agent
+  aggregate metrics — PR counts and runtime-by-agent skip `temp-*` ids
+  (`engine/core/queries.js`).
+
+## 3. Charter / persona — not inherited
+
+A temp agent does **not** inherit, copy, or reference the charter or persona of any permanent
+agent. It has no `charter.md`: `buildSystemPrompt` reads
+`agents/<id>/charter.md`, which returns empty for a temp id, and falls back to a bare identity
+of `{ name, role: "Temporary Agent", expertise: [] }` (`engine/agents/playbook.js`). The system
+prompt therefore carries only the generic role label and the shared team rules — no expertise
+tags, no voice, no boundaries section.
+
+## 4. Memory, notes, and pinned context — retrieved, not inherited
+
+Temp agents get the **shared, non-personal** context every dispatch gets, but accrue and read
+**no personal memory**. Exact behavior (`engine/agents/playbook.js`):
+
+| Context source | Temp agent behavior |
+|----------------|---------------------|
+| `pinned.md` (operator pinned context) | **Injected** — unconditional, same as any agent. |
+| Task-selected **Relevant Memory** pack (`memoryRetrieval` on) | **Injected** — the retrieval query is keyed on the **work item / project**, not the agent persona, so temps get the same project-scoped pack. |
+| `notes.md` (team notes) | **Injected** (when the Relevant Memory pack did not already replace legacy injection). Not gated on agent id. |
+| Applicable **review-learning** lessons | **Injected** — project/file-scoped recall, agent-independent. |
+| Per-agent memory `knowledge/agents/<id>.md` | **NOT injected** — the injection is explicitly skipped for ids starting with `temp-` (`engine/agents/playbook.js`), and no such file exists for a temp anyway. |
+
+It does **not** inherit a *specific* permanent agent's `knowledge/agents/<agentId>.md`
+notebook — there is no "borrow Ripley's memory" path. A temp reads shared/project memory only.
+
+**Write side (consolidation).** A temp agent's findings never become durable personal memory.
+The consolidation pipeline (`engine/memory/consolidation.js`) skips `temp-*` authors in
+`appendToAgentMemory`, `reconcileAndAppendToAgentMemory`, and `maybeSummarizeAgentMemory`, and
+memory routing treats `temp-*` as an ineligible route. Team-wide consolidation into `notes.md`
+and the categorized `knowledge/` KB still happens from any inbox note the temp writes (those
+are team-scoped, not per-agent), but nothing is filed under a `temp-*` identity.
+
+## 5. Runtime, CLI, model, tools, and workspace manifest
+
+Because a temp agent has **no `config.agents.<id>` entry**, every per-agent override resolves to
+`null` and falls through to the **engine fleet defaults** (`engine.js#spawnAgent`, with
+`agentConfig = config.agents?.[agentId] || null`):
+
+- **CLI runtime:** `resolveAgentCli(null, engine)` → `engine.defaultCli` → `'copilot'`.
+- **Model:** `resolveAgentModel(null, engine)` → `engine.defaultModel` → runtime default.
+- **Budget:** `resolveAgentMaxBudget(null, engine)` → `engine.maxBudgetUsd`.
+- **Bare mode:** `resolveAgentBareMode(null, engine)` → `engine.claudeBareMode` → `false`.
+- **Workspace manifest:** `resolveAgentManifest(null)` returns the **permissive default** — no
+  `allowed_repos` gate, no `allowed_tools` narrowing (`engine/core/shared.js`,
+  [`workspace-manifests.md`](workspace-manifests.md)). A temp therefore inherits the fleet
+  `--allowedTools` set unmodified and is never blocked by the repo gate.
+- **Session resume:** temp ids are excluded from session persistence in every runtime adapter
+  (`getResumeSessionId` / session save short-circuit on `temp-*` in
+  `engine/runtimes/{claude,copilot,codex}.js`), so a temp never resumes a prior session.
+
+Spawn otherwise follows the normal path — worktree allocation, prompt build, and
+`engine/agents/spawn-agent.js` — identical to a named agent.
+
+## 6. Routing, retries, and permanent-agent availability
+
+- **Overflow only.** A temp is only ever chosen after hints, preferred, fallback, and any idle
+  configured agent all miss. The moment a named agent is idle, routing prefers it — temps are
+  never chosen ahead of an available permanent.
+- **API validation.** `POST /api/work-items` accepts an explicit `temp-*` agent id **only when
+  `allowTempAgents` is true**; otherwise it is rejected as an unknown agent
+  (`engine/planning/work-item-validation.js`; the `tempAllowed` check).
+- **Retry / reassignment.** The per-agent retry-reassignment machinery
+  ([`named-agents.md` §3](named-agents.md)) treats a temp id like any other agent for
+  `excludeAgent` purposes. If `allowTempAgents` is off (or the budget is exhausted) and no
+  alternate named agent exists, the engine writes a deduped inbox note advising the operator to
+  enable `allowTempAgents` or add another routing target, then re-dispatches to the same agent to
+  avoid deadlock (`engine.js`).
+- **Unknown-agent guard.** A pending dispatch whose `item.agent` is a `temp-*` id is **not**
+  treated as an "unknown configured agent" and is not re-routed on that basis (`engine.js`), so a
+  temp assignment survives to spawn even though it is absent from `config.agents`.
+
+## 7. Lifecycle and cleanup
+
+- **Ephemeral by design.** `cleanupTempAgent(agentId)` (`engine.js`) runs on **every**
+  dispatch-completion path (success, failure, timeout, orphan recovery, …). It deletes the id
+  from the in-memory `tempAgents` map and removes the `agents/<temp-id>/` directory (live-output
+  log etc.), wrapped in `shared._retryFsOp` so Windows `EBUSY`/`EPERM` from AV/file-indexer locks
+  are retried (regression test: `test/unit/cleanup-temp-agent-retry.test.js`).
+- **Orphan sweep.** As a backstop, the periodic cleanup pass
+  (`engine/orchestration/cleanup.js`) reaps `agents/temp-*` directories that are no longer
+  referenced by any dispatch record, using a **1-hour mtime gate** so a still-spawning temp is
+  never reaped mid-launch.
+- **Restart behavior.** The `tempAgents` map is in-memory, so an engine restart discards the
+  `{ name, role }` record. The persisted work-item/dispatch fields (`item.agent`,
+  `item.agentName`, `item.agentRole`) survive, and if a pending temp dispatch is resumed after
+  restart, `buildSystemPrompt` degrades gracefully to the default `Temporary Agent` identity
+  (`engine/agents/playbook.js`). No temp identity is re-registered or "revived" — it simply runs
+  out its one dispatch and is cleaned up.
+- **Retained artifacts.** Only team-scoped artifacts a temp produced during its run persist:
+  inbox notes it wrote (subject to normal team consolidation), tracked PRs it opened (attributed
+  to the `temp-*` id but excluded from per-agent PR metrics), and the work item's own history.
+  No personal memory, charter, or config record is retained.
+
+## 8. Limitations and isolation implications
+
+- **Off by default; overflow only.** With `allowTempAgents: false` (the default) temps never
+  exist; enabling them is an explicit operator decision (config + Settings toggle).
+- **Fleet-default permissions.** A temp runs with the fleet-default runtime, model, budget, and
+  tool set, and a **permissive** workspace manifest (no repo gate, no tool narrowing). If your
+  isolation model depends on per-agent `workspace_manifest` restrictions, note that a temp agent
+  bypasses them by construction — it has no manifest to enforce. Constrain temps through
+  fleet-level `engine.*` defaults (e.g. `engine.maxBudgetUsd`, `engine.allowedTools`) rather than
+  per-agent config.
+- **No accountable persona / no learning.** Temps carry no charter and accrue no personal
+  memory, so their work is not shaped by, and does not feed back into, any named agent's memory.
+  They are appropriate for burst capacity, not for work that should build durable per-agent
+  context.
+- **Concurrency-bounded.** The per-tick temp budget ties temp creation to `engine.maxConcurrent`;
+  temps cannot exceed the global concurrency cap.