@zaip-ai/cli 2.6.0 → 3.0.0

package/templates/.agents/README.md

@@ -8,7 +8,7 @@
 
 O ZAIP-AIOS é um sistema operacional para execução autônoma de trabalho com agentes de IA, que coordena 23 agentes especializados, organizados em 6 squads, dentro do Codex.
 
-Os agentes planejam, executam, revisam, testam e validam o trabalho sob coordenação do orquestrador. A execução autorizada avança até atender aos critérios definidos ou registrar um bloqueio, falha ou limite de orçamento. Dependências externas e decisões fora da autoridade recebida continuam exigindo intervenção humana; autonomia não significa execução indefinida nem garantia de acerto.
+Os agentes planejam, executam, revisam, testam e validam o trabalho sob coordenação do orquestrador. A execução autorizada avança até atender aos critérios ou registrar bloqueio/falha conforme evidências e orçamento. O perfil Persistente permite execução indefinida por escolha explícita; os demais têm cotas por Task. Nenhum perfil garante acerto nem amplia autoridade para ações externas.
 
 Essa abordagem busca reduzir intervenções, contexto desnecessário e retrabalho. Os percentuais de 34% e 62% apresentados adiante se referem a custo médio por tarefa e por hora nas séries históricas ilustradas, respectivamente; não medem diretamente redução de tokens nem garantem economia em uma nova entrega.
 
@@ -53,10 +53,16 @@ No ZAIP-AIOS, uma Task não é considerada concluída apenas porque um agente te
 
 ### Como interpretar esta documentação
 
+Os dois READMEs são mantidos em português e inglês. Na Ajuda do Dashboard,
+o README inglês vem de `README-ENG.md`; guias sem tradução mostram a fonte
+portuguesa atual com aviso de idioma, sem resumos paralelos desatualizados.
+
 Este README e o [handbook](zaip-aios/INDEX.md) descrevem o código-fonte deste repositório. Configuração efetiva, suporte do host, pacote instalado e candidato qualificado são dimensões distintas. `@latest` aponta para a versão publicada, que pode não conter alterações locais. As imagens do Dashboard são ilustrações de estados anteriores, não prova visual do candidato atual.
 
 A atualização documental não aprova uma release. Consulte o [registro de limites de qualificação](https://github.com/zaip-ai/zaip-aios/blob/main/docs/PRODUCTION-COMMERCIAL-READINESS.md#limites-conhecidos-da-qualificação) antes de promover o código; testes locais, paridade, CI e validação em produção devem ser comprovados separadamente.
 
+Na entrega v3, a bateria completa fica na preparação local assinada (`full-v2`). O GitHub verifica o pacote exato, sua instalação e a publicação, sem repetir a bateria de fonte a cada push. A ativação exige qualificação local completa e confiança cadastrada. Há um único smoke automático de instalação antes do npm; checks de fonte e matriz remota ficam manuais, sem teste sobre rascunho privado. Veja o [guia de qualidade e release](zaip-aios/guides/26-qualidade-e-release.md). Lacunas históricas de telemetria permanecem explícitas, sem inventar números ou dispensar testes de dados novos.
+
 ## Instalação em um comando
 
 Com Node.js 22.16.0 ou superior e npm, execute a instalação na raiz do projeto que receberá o ZAIP-AIOS. Em uma instalação nova, o `init` usa o perfil completo (`full`): instala as dependências ausentes da stack e prepara o Terraform. Todos os perfis verificam os runtimes distribuídos e preparam e validam o SQLite local, sem driver separado. Versões de pacotes existentes no projeto são preservadas, com aviso das versões atual e configurada no ZAIP-AIOS:
@@ -244,6 +250,42 @@ A configuração da plataforma apresenta o estado de ativação do ZAIP-AIOS e u
 
 <img src="https://raw.githubusercontent.com/zaip-ai/zaip-aios/main/.agents/config/src/dashboard_pt_configuracao_plataforma.png" alt="Dashboard ZAIP-AIOS, configuração da plataforma" width="100%">
 
+### Perfis de autonomia da v3
+
+As fontes em preparação para a v3 acrescentam um preset por Task, separado de
+instalação e assurance:
+
+| Perfil | Execuções de produto por Task | Replanejamentos | Modelos dos replanejamentos |
+| --- | --- | --- | --- |
+| Essencial (`essential`) | 4: 1 inicial + 3 reparações | 1 | Sol/high; nunca Astra automático |
+| Equilibrado (`balanced`, padrão novo) | 10: 1 inicial + 9 reparações | 3 | Sol/high → Astra/high → Astra/high |
+| Persistente (`persistent`, opt-in) | Sem teto | Sem teto | Sol/high primeiro; Astra/high nos seguintes |
+
+Mescle no arquivo `.agents/config/project.yaml` ou selecione **Perfil de
+autonomia** em **Configurações do projeto** no Dashboard e salve:
+
+```yaml
+autonomy:
+  version: 1
+  preset: balanced
+```
+
+O diário durável reserva antes do despacho gerenciado; reiniciar ou retomar
+não zera a quota. A alteração vale para novas Tasks. Não há abandono por tempo
+nem redução automática de critérios de aceite. Persistente pode consumir
+créditos indefinidamente até cancelamento humano; não amplia permissões.
+
+Uma SPEC de dez Tasks Equilibradas admite até 100 execuções (10 iniciais +
+90 reparações) e 30 replanejamentos; testes e Calls internas não são tentativas.
+A falta de verificação/conclusão segura termina `blocked`; impedimento técnico
+comprovado termina `failed`. Ramos independentes continuam elegíveis.
+
+**Limite atual:** os contadores são impostos no runtime gerenciado, não em
+`spawn_agent` externo feito diretamente pelo Codex. Novos projetos usam
+`execution.runtime: managed`: PRD/SPEC gerenciados e avulsas diretas. Salvar
+o preset não inicia provider. Legados exigem migração explícita, sem zerar
+consumo. Veja [autonomia e suas garantias](zaip-aios/guides/19-assurance-e-autonomia.md).
+
 ### Stack de desenvolvimento
 
 A stack de desenvolvimento descreve cada responsabilidade separadamente, com tecnologia, versão exata e referência do pacote, imagem ou serviço. No projeto, esse contrato inclui TypeScript, Node.js, Hono, Kysely, PostgreSQL via Supabase, Supabase Auth + Storage, Redis e BullMQ, permitindo que as escolhas de desenvolvimento permaneçam registradas junto da configuração do projeto.
@@ -283,7 +325,7 @@ Por padrão, cada PRD utiliza apenas uma SPEC, buscando economia.
 
 Uma nova SPEC só deve ser criada quando existir uma capacidade que possa ser implementada e validada de forma independente e paralela. Quando existe dependência entre partes do trabalho, elas permanecem na mesma SPEC e são organizadas pela DAG de Tasks.
 
-No runtime atual, um PRD materializa uma Execution-filho determinística para cada SPEC elegível: suas dependências permanecem dentro da SPEC e seus write scopes não conflitam com nenhum outro ramo. Cada filha executa com coordinator, estado, quota de orçamento e handoff próprios, sob uma fila limitada pelo paralelismo efetivo e por um ledger parental único de invocações; a Execution do PRD aguarda os estados terminais, integra os candidatos no handoff parental e só então aplica validação cross-SPEC e finalização. SPECs com dependência externa ou conflito de escopo permanecem na DAG global coordenadora.
+No runtime atual, um PRD materializa uma Execution-filho determinística para cada SPEC elegível: suas dependências permanecem dentro da SPEC e seus write scopes não conflitam com nenhum outro ramo. Cada filha executa com coordinator, estado e handoff próprios; em `autonomy-v1`, a quota de recuperação continua por Task estável, sob uma fila limitada pelo paralelismo efetivo e por um ledger parental único de invocações; a Execution do PRD aguarda os estados terminais, integra os candidatos no handoff parental e só então aplica validação cross-SPEC e finalização. SPECs com dependência externa ou conflito de escopo permanecem na DAG global coordenadora.
 
 Antes de o PRD chegar ao estado `ready`, as Tasks são apenas definições de trabalho, ainda sem execução.
 
@@ -320,6 +362,17 @@ Toda criação de PRD ou SPEC é vinculada à Run responsável por meio do campo
 
 Tempo, tokens e custo são agregados sempre que essas informações estiverem disponíveis ou forem reconciliadas. Quando não houver dados suficientes, os valores permanecem como `unknown` ou `null`.
 
+Na Visão geral, uma cobertura incompleta não esconde a soma disponível: o Dashboard
+mantém o cartão compacto **Custo Estimado**, sem ícone. A descrição acessível e o
+tooltip informam a cobertura. O subtítulo divide o subtotal conhecido pelo número
+de tarefas e pelas horas registradas no mesmo recorte: são taxas estimadas de
+alocação, não médias de custos completos por tarefa. Com cobertura parcial, não
+estima os valores ausentes. Cada taxa fica `—` apenas se sua base estiver indisponível
+ou for zero; uma taxa válida não é escondida porque a outra está indisponível.
+O subtotal não é o custo integral nem a fatura da conta. Zero observado continua sendo zero;
+ausência de medição continua indisponível. Rascunhos de Task ficam na lista de
+trabalho, fora do Kanban executável e dos indicadores operacionais sem rascunhos.
+
 
 ## Qualidade e evidências
 
@@ -468,24 +521,33 @@ Essa progressão permite começar de forma simples e acrescentar planejamento ap
 
 **Políticas técnicas de execução e assurance**
 
-Conversation e Task-first preservam a seleção manual do host; o default do projeto não é aplicado automaticamente a uma Task avulsa. A política automática aceita origens SPEC/PRD configuradas em `automatic_sources`, com velocidade `standard`. Modelo e effort ficam fixos em cada Run/Sub-Run; capacidade ou velocidade indisponível no host não pode ser presumida pelo ZAIP. Consulte a [política de modelos](zaip-aios/guides/23-orquestracao-de-modelos.md).
+Conversation e o principal de Task avulsa preservam a seleção manual do host, priorizando trabalho direto. Quando delegar for necessário, informe que os filhos podem usar modelos/esforços diferentes pela política ZAIP; não há obrigação de herdar o principal. Modelo e effort ficam fixos por Run, com observação efetiva separada da seleção planejada. A seleção automática solicita `standard`; capacidade não observada do host não pode ser presumida. Consulte a [política de modelos](zaip-aios/guides/23-orquestracao-de-modelos.md).
 
 ### Política Astra
 
-Luna, Terra e Sol permanecem as rotas de uso simples e de execução. Astra não executa produto, não faz revisão geral nem finaliza uma Task: é uma rota read-only de diagnóstico ou replanejamento, com effort `high` como teto. Ela só pode ser usada após sinais estruturados — tentativa executora com falha de raciocínio/hipótese e ambiguidade ou complexidade difícil, ou impacto crítico material acompanhado de diagnóstico difícil. Palavras como “crítico” ou “complexo”, departamento, tamanho ou risco isolado não a habilitam.
+No Essencial, Astra nunca é selecionado automaticamente, inclusive em filhos ou fallback. A única exceção é o principal avulso com Astra escolhido manualmente pelo usuário. No Equilibrado, os três replanejamentos usam Sol/high, Astra/high e Astra/high; no terceiro bloco Astra/high também pode executar a reparação, sem ampliar a quota. Persistente mantém essa progressão sem teto total.
+
+O replanejador é isolado e não edita produto; executor, revisor e Gui são papéis distintos. Astra automático usa somente `high`, não substitui revisão/finalização e depende do despacho gerenciado. A regra antiga de até três diagnósticos Astra somente leitura permanece apenas no contrato legado sem `autonomy`; não limita Persistente. Contexto e assurance seguem o domínio: conteúdo exige fontes/briefing, engenharia exige comportamento verificável. Economia real precisa ser medida, não inferida do preset.
 
-Há no máximo três ciclos Astra cumulativos por Task. Cada diagnóstico produz provas, findings, causa ou hipótese, rota recomendada, escopo, plano curto de teste/correção e handback para executor Luna, Terra ou Sol. Prova repetida ou falta de progresso bloqueia novo ciclo. Hosts manuais podem não permitir que o framework imponha a seleção; Conversations e Task-first preservam essa escolha. Contexto comercial é condicional ao pedido e não recebe requisitos técnicos por padrão. Métricas históricas de custo não prometem economia real em uma nova Task.
+O intake correlaciona o turno observável à Execution. `prepare` valida o plano, sem autorizar implementação; `ready` materializa trabalho preparado e `execute` inicia a entrega autorizada. Toda delivery e interaction delegada exige executor elegível (ou raiz Task direta autorizada) e `zaip-agent-finalizer` por último. Interaction read-only sem descendentes termina após a resposta, sem esse circuito. Publicação puramente Git é uma exceção: não materializa lifecycle. SPEC/PRD permanecem ativos entre Runs filhas e só são entregues por gates parentais.
 
-O intake correlaciona o turno observável à Execution. `prepare` valida o plano, sem autorizar implementação; `ready` materializa trabalho preparado e `execute` inicia a entrega autorizada. Toda delivery e interaction com descendentes exigem executor elegível e `zaip-agent-finalizer` por último. Interaction read-only sem descendentes termina após a resposta, sem esse circuito. Publicação puramente Git é uma exceção: não materializa lifecycle. SPEC/PRD permanecem ativos entre Runs filhas e só são entregues por gates parentais.
+Cada tentativa de Task tem exatamente um orquestrador responsável. Gui é seu
+último filho direto, irmão dos executores, não finalizador de cada trabalhador.
+O host persiste a decisão real antes do Stop canônico; pode retransmitir Gui
+já terminal enquanto o responsável estiver aberto, sem obrigá-lo a esperar
+recibos. Ausência de decisão não é aprovação. A preferência por execução
+avulsa direta usa uma raiz observada com `--direct-authorization REFERÊNCIA`
+explícita; não cria executor fictício nem dispensa Evidence e Gui. Veja
+[fechamento e recuperação](zaip-aios/guides/16-lifecycle-e-reconciliacao.md).
 
-A profundidade de prova é adaptativa: Task standalone `lite` exige no mínimo uma validação tipada e uma Evidence, normalmente uma de cada, mas aceita provas adicionais legítimas. `standard` exige duas ou três validações conforme `verification_scope` e pelo menos uma Evidence consolidada; `critical` exige três ou mais, revisão independente e os sinais de risco persistidos que determinam controles adicionais. Entregas de SPEC e PRD acrescentam matriz parental, pelo menos três validações e três Evidences, integração real e revisão independente. O runtime manual continua padrão; a autonomia por Codex ou Claude é opt-in, isolada em worktrees e limitada por write scopes, commits, budgets e gates tipados. Consulte [Assurance adaptativa e autonomia opt-in](zaip-aios/guides/19-assurance-e-autonomia.md).
+A profundidade de prova é adaptativa: Task standalone `lite` exige no mínimo uma validação tipada e uma Evidence, normalmente uma de cada, mas aceita provas adicionais legítimas. `standard` exige duas ou três validações conforme `verification_scope` e pelo menos uma Evidence consolidada; `critical` exige três ou mais, revisão independente e os sinais de risco persistidos que determinam controles adicionais. Entregas de SPEC e PRD acrescentam matriz parental, pelo menos três validações e três Evidences, integração real e revisão independente. Novos projetos usam runtime gerenciado para PRD/SPEC e direto para avulsas; a execução por Codex ou Claude é autorizada por pedido, isolada em worktrees e limitada por write scopes, commits, budgets e gates tipados. Consulte [Assurance adaptativa e autonomia opt-in](zaip-aios/guides/19-assurance-e-autonomia.md).
 
 
 ## Princípios de engenharia autônoma
 
 O ZAIP-AIOS combina velocidade com limites explícitos. Seus princípios mantêm o código sustentável, distribuem apenas o contexto necessário e exigem comprovação proporcional ao risco.
 
-O padrão do schema é `execution.runtime: manual` quando a opção está ausente; este checkout optou por `autonomous` em `project.yaml`. A configuração não dispensa pedido de execução nem autoriza publicar. Consulte sempre o arquivo efetivo do projeto, não apenas o default descrito no guia.
+O padrão do schema é `execution.runtime: manual` quando a opção está ausente; este checkout usa `managed` em `project.yaml`. A configuração não dispensa pedido de execução nem autoriza publicar. Consulte sempre o arquivo efetivo do projeto, não apenas o default descrito no guia.
 
 - **Clean Architecture:** domínio, aplicação, adapters e infraestrutura permanecem separados; regras de negócio não dependem de frameworks ou detalhes externos, as dependências apontam para as camadas internas e composition roots conectam implementações concretas nas bordas.
 - **CQRS:** commands e queries seguem fluxos explícitos e independentes; comandos alteram estado por casos de uso e ports apropriados, enquanto consultas não produzem efeitos colaterais e retornam read models adequados à leitura.
@@ -506,7 +568,7 @@ O **Graph Engineering** transforma uma entrega complexa em uma sequência coorde
 
 Essa autonomia permanece governada: Dave coordena, cada executor recebe apenas o escopo necessário, Nanda realiza a revisão independente, especialistas adicionais entram quando existem sinais objetivos e Gui encerra o fluxo por último. O resultado é uma equipe ajustada à demanda, sem multiplicar agentes e custo sem necessidade.
 
-O **Loop Engineering** orienta o que acontece quando a primeira tentativa não satisfaz os critérios de qualidade. A falha ou o bloqueio é classificado, o próximo ciclo recebe uma configuração proporcional à dificuldade observada e cada tentativa permanece auditável. Em execuções originadas de PRD ou SPEC, o sistema pode evoluir de **Luna → Terra → Sol** e de **low → medium → high → xhigh**; Conversations e Tasks avulsas preservam a seleção manual do host/Codex. O modelo nunca muda silenciosamente dentro da mesma Run.
+O **Loop Engineering** usa o perfil congelado da Task para reservar execução e replanejamento antes do provider, registrar o resultado e escolher uma rota corrigida. No Equilibrado são 1 + 9 execuções e três planos Sol/high → Astra/high → Astra/high; Essencial não escala para Astra, Persistente não tem teto. O modelo não muda silenciosamente dentro da mesma Run. A preferência manual do principal avulso não obriga seus filhos a usar a mesma configuração.
 
 ### Fluxo resumido
 
@@ -695,7 +757,7 @@ Antes de integrar uma mudança relevante ou preparar um release, `pnpm verify` e
 
 Use a versão de pnpm fixada em `packageManager` (`corepack pnpm` quando disponível). Para uma alteração delimitada, selecione os checks pertinentes ao risco e ao diff; a lista acima não exige repetir todos os testes a cada edição documental. Qualificação de release usa os gates completos do [guia 26](zaip-aios/guides/26-qualidade-e-release.md) no candidato exato. Não confunda `validate:github:prepared`, execução local, push e CI terminal verde.
 
-O pacote público `@zaip-ai/cli` usa a versão de produto `2.2`; nos metadados npm e nos artefatos SemVer ela é registrada como `2.2.0`. Consulte o npm para identificar o `latest` publicado. A versão em um checkout não comprova publicação: a qualificação deve registrar a revisão exata, o resultado terminal do CI, a integridade do TGZ e uma instalação nova do registro. Publicação manual com token autorizado não equivale a atestado OIDC. Resultados e ressalvas ficam nas evidências da Change de release, preservando as tentativas anteriores.
+Os manifests deste checkout registram o candidato `3.0.0` (produto `3.0`). A identificação do candidato não significa que o `latest` já foi publicado nem certifica produção. A release exige revisão exata, CI terminal, integridade do TGZ e instalação real do artefato. Tentativas e limitações ficam nas evidências da Change; resultados locais e publicação são estados distintos.
 
 A arquitetura detalhada está resumida na seção [Arquitetura das aplicações](#arquitetura-das-aplicações) deste README.
 

package/templates/.agents/config/agents/catalog.yaml

@@ -19,6 +19,9 @@ agents:
     execution_eligibility: []
     tools:
       - zaip-cli
+      - shell-read
+      - tool-discovery
+      - native-collaboration
     skills:
       - zaip-skill-execution
     write_scopes: []

package/templates/.agents/config/agents/discovery.json

@@ -1,11 +1,11 @@
 {
-  "_zaip_managed": "zaip-managed generated-do-not-edit source=agent-discovery version=2.6.0 sha256=40be3aeb752ad44bd335529659f4235344b6285d67fee2c53230fc44152140cf",
+  "_zaip_managed": "zaip-managed generated-do-not-edit source=agent-discovery version=3.0.0 sha256=a44942a0f46acb69ef70da671c8a2eb1cae985abf30fa7dcad59cab4bfbd1034",
   "schema_version": 1,
   "source": {
     "path": ".agents/config/agents/catalog.yaml",
     "kind": "canonical-catalog",
     "revision": "catalog-schema-1",
-    "sha256": "c4c95cc324cd7103b45e3270bd12713b19f7f5880342c1b509866c0c9cf02adf"
+    "sha256": "a78893da85121d2a4110c8d4f10bbdc88533149f624c3d79357485a42aa6e658"
   },
   "excluded_path_prefixes": [".local/", ".agents/config/clients/", ".codex/", ".claude/"],
   "agents": [

package/templates/.agents/config/clients/codex/agents/zaip-agent-analyst.toml

@@ -22,7 +22,7 @@ Do not use when: SPEC, implementation, technical approval, or deployment..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-analyst and task_name must be exactly bia_product_manager_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-analyst. If the native tool exposes task_name use bia_product_manager_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-auditor.toml

@@ -22,7 +22,7 @@ Do not use when: Implementation, correction, or authorship of the evidence..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-auditor and task_name must be exactly ana_quality_auditor_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-auditor. If the native tool exposes task_name use ana_quality_auditor_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You may approve only roles outside: auditor.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-backend.toml

@@ -22,7 +22,7 @@ Do not use when: Frontend, website, or central visual design..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-backend and task_name must be exactly will_backend_specialist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-backend. If the native tool exposes task_name use will_backend_specialist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-brand-strategist.toml

@@ -23,7 +23,7 @@ Interaction: answer the bounded question from relevant sources without product m
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-brand-strategist and task_name must be exactly sarah_branding_specialist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-brand-strategist. If the native tool exposes task_name use sarah_branding_specialist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-builder.toml

@@ -23,7 +23,7 @@ Generic delivery includes .agents/dashboard/** and .local/** when no mandatory s
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-builder and task_name must be exactly rafa_tech_lead_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-builder. If the native tool exposes task_name use rafa_tech_lead_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-cloud-engineer.toml

@@ -27,7 +27,7 @@ This AWS allowance is separate from `cloud-runner.mjs`: do not require or read t
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-cloud-engineer and task_name must be exactly dan_cloud_engineer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-cloud-engineer. If the native tool exposes task_name use dan_cloud_engineer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-data-analyst.toml

@@ -23,7 +23,7 @@ Interaction: answer the bounded question from relevant sources without product m
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-data-analyst and task_name must be exactly gabi_data_analyst_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-data-analyst. If the native tool exposes task_name use gabi_data_analyst_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-designer.toml

@@ -23,7 +23,7 @@ Own .agents/design/** as the central visual rule. Do not implement product-local
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-designer and task_name must be exactly manu_product_designer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-designer. If the native tool exposes task_name use manu_product_designer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-finalizer.toml

@@ -19,11 +19,11 @@ Outputs: terminal-outcome, status-reason, evidence-refs.
 Evidence: finalization-decision.
 Use when: Mandatorily as the final Sub-Run of interaction or delivery..
 Do not use when: Before executor or reviewer finishes, or to correct code..
-Do not approve product work. Before returning, persist exactly one restricted terminal outcome with `node .agents/runtime/bin/zaip.mjs run finalization ROOT --task-outcome completed|blocked|failed|cancelled --summary ... --evidence ...`, using the real root Run ID supplied by the orchestrator. If the host exposes only your terminal path, give the same immutable outcome, summary, evidence, and changed files to the orchestrator for its exact `subagent capture-terminal` call instead. Then emit the same outcome, status reason, and evidence references for the orchestrator to apply. If the decision cannot be persisted, report blocked and do not claim completion.
+Evaluate closure evidence without writing product or lifecycle files. Return exactly one real terminal decision: outcome (completed, blocked, failed, cancelled), observed reason, evidence references, summary, owned changed files and responsible Run ID. Do not poll start/decision receipts or wait to stay active: the authorized host persists your actual decision with rich stop capture before closing the responsible Run. Capture latency is not a product defect or a reason to invent a blocked technical judgment. Missing proof remains blocked; cancelled requires explicit human intent. A native completed status is not persisted Task approval. Never invent metadata or convert UUID into agent_path.
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-auditor.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-finalizer and task_name must be exactly gui_quality_assurance_lead_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-finalizer. If the native tool exposes task_name use gui_quality_assurance_lead_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You do not grant product approval; your sole approval-like action is the restricted terminal outcome above.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-frontend.toml

@@ -23,7 +23,7 @@ Work in apps/frontend/** and dashboard React surfaces only; never dashboard runt
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-frontend and task_name must be exactly doug_frontend_specialist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-frontend. If the native tool exposes task_name use doug_frontend_specialist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-general-operations.toml

@@ -23,7 +23,7 @@ Interaction: answer the bounded question from relevant sources without product m
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-general-operations and task_name must be exactly clara_operations_generalist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-general-operations. If the native tool exposes task_name use clara_operations_generalist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-governance-compliance.toml

@@ -22,7 +22,7 @@ Do not use when: Binding legal advice, legal representation, external filings or
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-governance-compliance and task_name must be exactly renata_governance_compliance_specialist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-governance-compliance. If the native tool exposes task_name use renata_governance_compliance_specialist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-growth-strategist.toml

@@ -23,7 +23,7 @@ Interaction: answer the bounded question from relevant sources without product m
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-growth-strategist and task_name must be exactly robert_growth_strategist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-growth-strategist. If the native tool exposes task_name use robert_growth_strategist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-integrator.toml

@@ -22,7 +22,7 @@ Do not use when: Before review or to create requirements..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-integrator and task_name must be exactly dani_integration_engineer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-integrator. If the native tool exposes task_name use dani_integration_engineer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-marketing-analyst.toml

@@ -23,7 +23,7 @@ Interaction: answer the bounded question from relevant sources without product m
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-marketing-analyst and task_name must be exactly lucia_marketing_analyst_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-marketing-analyst. If the native tool exposes task_name use lucia_marketing_analyst_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-orchestrator.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=96867d56bb23ed456ebec62cd78f97dd36e156ad1c4a44a188ec4d75e5db881c
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=ebd7b96af1a3cb59b8ccb61949d8b75bd7b190c9800713db8433fcc336f49073
 name = "zaip-agent-orchestrator"
 description = "Resolve the DAG and delegate only to capable least-privilege agents."
 nickname_candidates = ["dave_product_owner_zaip_agent"]
@@ -9,7 +9,7 @@ developer_instructions = """
 Operate as Codex agent zaip-agent-orchestrator (ZAIP catalog id agent-orchestrator) with role orchestrator.
 Resolve the DAG and delegate only to capable least-privilege agents.
 Capabilities: dag-orchestration, lifecycle-governance.
-Allowed tools: zaip-cli.
+Allowed tools: zaip-cli, shell-read, tool-discovery, native-collaboration.
 Available skills: zaip-skill-execution; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: read-only.
@@ -22,18 +22,21 @@ Do not use when: Direct implementation, independent review, or approval..
 Keep orchestrator and delegated Run telemetry distinct; preserve observed duration, tokens, and cost as unavailable when not captured.
 Coordinate bounded independent branches, then wait for terminal events; do not poll delegated agents or implement Task work directly.
 Load .agents/rules/specialist-routing.md before selecting commercial specialists; it defines the primary-output decision matrix and minimal-executor invariant.
-For an evidenced difficult Astra escalation only, load RULE-ASTRA-DIAGNOSTIC; diagnose at high, reserve at most three diagnostics per Task, then hand back to Luna/Terra/Sol.
-You are the first catalog subagent of a delegated Execution and its sole dispatcher. Select and start all subsequent catalog Sub-Runs yourself; the root host must not dispatch peer roles directly.
-For every Execution, identify the primary requested decision or output, then delegate one bounded Sub-Run to an eligible catalog specialist. References, inputs, and approved artifacts never select the executor. For an unambiguous domain, Interaction and delivery use its eligible specialist; use the analyst only for generic or unclassified Interaction. Never select an executor by a fixed identity rule.
+Load RULE-AUTONOMY-DECISION for a frozen autonomy-v1 Task: essential forbids automatic Astra, balanced uses Sol/high then two Astra/high replans (Astra executor eligible in the third block), persistent has no total cap. Legacy Tasks alone follow RULE-ASTRA-DIAGNOSTIC and its diagnostic-only quota. Never infer deterministic enforcement from this prompt: the host must reserve and validate the effective dispatch before calling a model.
+You are the dispatcher for your Task attempt. If the physical root already owns exactly this Task, it is the responsible orchestrator: it dispatches executors/reviewers and Gui directly, without an extra Dave child. A macro root dispatches one Task orchestrator per eligible Task and must not dispatch that Task's workers itself. Never create two responsible orchestrators or require two Guis for the same Task attempt. Never reassign your invocation to another Task.
+Tool names in the catalog are capability labels, not literal host tool names. Native collaboration permits spawn_agent, send_input, wait_agent and close_agent for authorized descendants. Discover deferred native tools through the host tool registry before declaring them unavailable. Read-only filesystem permissions do not prohibit native delegation or waiting; do not use discovery to run persistence commands, bypass permissions or create independent chats.
+Report child IDs and intermediate results as non-terminal progress, not a final response. Keep your native invocation open until the executor/reviewer and last Gui child have terminated. If you cannot remain active or complete that sequence, report an explicit blocked interruption; do not claim the attempt is finalized.
+Identify the requested output and its domain. Under autonomy-v1, standalone Tasks prefer direct work with the user's selected principal model/effort; delegate only for a concrete specialist, isolation, review or finalization need. Before delegation disclose that ZAIP policy may select different child models/efforts. Otherwise preserve the legacy specialist routing contract. References and titles never select an executor or justify escalation.
 Default to one domain executor per bounded result. Bring a secondary specialist only when its unresolved domain decision is necessary to the primary output; split independent outputs into sequential Tasks and preserve a true mixed-output conflict instead of codispatching.
-Subagent lifecycle hooks are best-effort. Immediately after every observed spawn and terminal of every Sub-Run, also run idempotent `zaip subagent capture` for start and stop with the real host metadata. Explicit capture uses the child session and turn, `agent-id=agent_path`, `parent-agent-id` equal to the root Run `client_thread_id`, and `parent-run-id` when roots in that thread can be concurrent; successive calls on the same `agent_path` use distinct child turn IDs. If the host exposes only a terminal agent_path, terminal status, exact parent, and catalog identity, use `zaip subagent capture-terminal` only for zaip-agent-finalizer or a delivery-eligible executor with `task-delivery`; pass the exact active root as `parent-run-id` and ensure the path ends in its canonical `codex_task_name`. It records unavailable session, turn, model, provider, and usage and never replaces rich hook capture. Do not skip explicit capture because a hook is configured, and never invent missing model, effort, token, or cost fields.
+Subagent lifecycle hooks are best-effort. You are read-only: relay observed session/thread/turn metadata and events to the authorized host; do not invoke CLI persistence. Canonical order is start -> actual Gui decision -> stop -> finish. The rich stop capture accepts the exact decision in task-outcome/summary/evidence/changed-files and persists it before Stop; Gui need not wait alive for a receipt. Never infer decisions from completed status. Preserve observed ancestry/model/effort; unavailable stays unavailable. UUID is not agent_path and cannot authorize path-only fallback.
 Reviewer, auditor, and integrator Sub-Runs are permitted when their capabilities match the work.
-After all other descendants finish, delegate one real final Sub-Run to zaip-agent-finalizer with agent_type zaip-agent-finalizer and task_name gui_quality_assurance_lead_zaip_agent. Do not finish the root Run or report a terminal Execution outcome before that Sub-Run has completed.
-Give Gui the real root Run ID. After Gui persists its decision and stops, immediately apply that same immutable result with `node .agents/runtime/bin/zaip.mjs run finish ROOT --task-outcome completed|blocked|failed|cancelled`, using the same evidence plus summary and changed files. This applies to a cancelled Run too; Task/SPEC/PRD commands cannot bypass Gui. Never use a global `zaip` binary for this closure.
+After all other descendants finish, delegate one real final direct Sub-Run to zaip-agent-finalizer. Use its cataloged agent_type; pass task_name gui_quality_assurance_lead_zaip_agent only when the native tool schema supports that argument. Do not finish the responsible Run or report a terminal Execution outcome before that Sub-Run has completed.
+Give Gui the real responsible Run ID and exact candidate proof. It returns one immutable outcome, reason, evidence references and owned changed files. Do not require receipt polling or an active-turn handshake. The host persists the real decision through rich stop capture before closing the responsible Run. A terminal rich Gui with open parent is eligible; a closed parent without decision requires an authorized new attempt. Never invent approval or reuse another attempt's decision.
 Escalate only to catalog identities: zaip-agent-auditor.
-Delegate only registered catalog identities: agent_type uses codex_name and task_name uses codex_task_name. Never add a work title, purpose label, or other suffix.
+Delegate only registered catalog identities: agent_type uses codex_name. Send task_name equal to codex_task_name only if the native tool schema exposes task_name; otherwise omit it. nickname_candidates belongs to the generated profile, not a substitute spawn argument. Do not require an exact nickname because the host may add a generated suffix.
+Own exactly one Task attempt when Task-scoped. Dispatch executors and reviewers, then Gui as your last direct child; never ask a worker to spawn its own finalizer. Macro coordinators dispatch Task orchestrators and retain separate integration gates. Preserve actual native ancestry, depth and global budgets.
 For Codex delegation, a ZAIP Sub-Run exists only when started with the native collaboration subagent mechanism (`spawn_agent`). `create_thread` and `fork_thread` create independent chats and require an explicit user request; never use either as a Sub-Run, fallback, retry, or evidence of delegation. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt never proves native ancestry. Before retrying the same bounded dispatch, await or reuse its pending child; do not duplicate an unresolved startup. Capture only ancestry and metadata observed from native host spawn/terminal results or SubagentStart/SubagentStop events.
-When this agent is delegated, agent_type must be exactly zaip-agent-orchestrator and task_name must be exactly dave_product_owner_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-orchestrator. If the native tool exposes task_name use dave_product_owner_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-refactoring-specialist.toml

@@ -27,7 +27,7 @@ Block and report incomplete inventory coverage, unresolved dependency or case-in
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-refactoring-specialist and task_name must be exactly tati_refactoring_specialist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-refactoring-specialist. If the native tool exposes task_name use tati_refactoring_specialist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-reviewer.toml

@@ -22,7 +22,7 @@ Do not use when: Implementing its own correction or integrating worktrees..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-auditor.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-reviewer and task_name must be exactly nanda_principal_engineer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-reviewer. If the native tool exposes task_name use nanda_principal_engineer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You may approve only roles outside: reviewer.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-sales-specialist.toml

@@ -23,7 +23,7 @@ Interaction: answer the bounded question from relevant sources without product m
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-sales-specialist and task_name must be exactly aaron_sales_specialist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-sales-specialist. If the native tool exposes task_name use aaron_sales_specialist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-security-auditor.toml

@@ -22,7 +22,7 @@ Do not use when: Implementation, remediation authorship, or deployment..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-security-auditor and task_name must be exactly luiz_security_auditor_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-security-auditor. If the native tool exposes task_name use luiz_security_auditor_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You may approve only roles outside: auditor.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-task-executor.toml

@@ -23,7 +23,7 @@ Execute generic dashboard/local Tasks only when their scopes do not select a man
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-task-executor and task_name must be exactly leo_software_engineer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-task-executor. If the native tool exposes task_name use leo_software_engineer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-website-developer.toml

@@ -22,7 +22,7 @@ Do not use when: Product app, backend, or central design-rule changes..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-website-developer and task_name must be exactly jonny_website_developer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-website-developer. If the native tool exposes task_name use jonny_website_developer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-writer.toml

@@ -24,7 +24,7 @@ For delivery documentation, write only inside the declared scope; validate links
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-writer and task_name must be exactly lia_technical_writer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-writer. If the native tool exposes task_name use lia_technical_writer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/project.yaml

@@ -52,7 +52,16 @@ deploy:
   production_branch: main
   allow_production: false
 execution:
-  runtime: manual
+  # Managed PRD/SPEC dispatch; standalone Tasks stay direct.
+  runtime: managed
+  autonomous:
+    provider: codex
+    model: gpt-5.6-terra
+    max_parallelism: 1
+    lease_ms: 60000
+autonomy:
+  version: 1
+  preset: balanced
 assurance:
   version: 1
   standard_depth: auto