agentlas 1.0.12 → 1.0.15

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 1.0.15 — 2026-07-29
+
+- **Agent Cloud saves work from a new machine or fresh clone.** Before writing,
+  the terminal resolves the signed-in owner's exact asset revision by
+  `slug` and scope, then keeps the conditional-write guard on that revision.
+  A missing local receipt no longer turns an owned asset into a false create
+  conflict.
+- **A real stale-copy conflict stays fail-closed.** The terminal stops before
+  replacing a newer server revision, reports its identity, and offers an
+  explicit `--overwrite` only when the owner deliberately chooses the current
+  folder over the newer copy.
+- Conflict messages now describe ownership and the next command instead of
+  exposing storage precondition terminology.
+
+## 1.0.14 — 2026-07-29
+
+- **Write-capable commands now prepare every project automatically.** The first
+  `run`, `storm`, `swarm`, or workforce execution in any folder installs the
+  same private, merge-only Agentlas project infrastructure through Core. This
+  is based on the folder the user opened, not on the Agentlas source checkout.
+  Read-only commands remain passive and do not create files.
+- **Per-command help works before database startup.** Commands such as
+  `agentlas run --help` and `agentlas workforce --help` no longer require an
+  SQLite driver or open the project database just to print usage.
+
+## 1.0.13 — 2026-07-28
+
+- **MCP servers reach the chat again.** `runNativeTurn` only injects them at
+  `full` permission and that gate was right, but `sessions/session.cjs` never
+  put `mcpServers` in the request — zero callers — so no CLI ever received a
+  server. `agentlas mcp probe` printed "connected" while the turn that followed
+  could not use it. Turns now carry servers the user already consented to;
+  nothing new is asked mid-turn, because a turn is not a place a user can answer.
+- **The shared database stops taking a write lock every turn.** Four
+  `CREATE TABLE IF NOT EXISTS`, five indexes and an `ALTER TABLE` ran on every
+  single turn against the file Desktop also uses. All idempotent, all taking the
+  lock; during a Desktop migration that burns the 15s busy timeout and every
+  call site swallowed the failure. Schema repair is once per connection now, and
+  the three copies of `ensureMemoryContextColumn` are one function.
+- **Rows written here are checked for referential integrity.** `foreign_keys` is
+  a connection property, not a file property — Desktop opened with it ON and the
+  terminal did not, so terminal writes skipped the check on shared tables.
+- **A zero-byte database file no longer blocks first run forever.** One stray
+  `sqlite3 <missing-path>` left an empty file, and every run after that read
+  "already exists" and died on `no such table` with nothing visible to explain it.
+- **Bootstrap schema is current again** (v81; it was a v45 snapshot from
+  2026-07-07), and a mismatch with Desktop's migration target now fails a gate.
+- **An engine update landing mid-run cannot mix two releases.** Core roots
+  resolve to their real path, so a long run keeps the modules it started with.
+  The next call still picks up the new release.
+- `/ontology` says what it manages — this project's knowledge sources, not the
+  engine's knowledge runtime. The command itself is unchanged.
+
 ## 1.0.12 — 2026-07-28
 
 - **Orchestrator/worker model roles now resolve from ordered candidate

package/README.md

@@ -110,9 +110,11 @@ agentlas connect <sub>           # Telegram 등 플랫폼 연결 (무인자는 u
 agentlas import <폴더>            # 로컬 에이전트/팀 임포트
 agentlas native prepare <agent>  # 네이티브 CLI 문맥 파일 생성
 agentlas list                    # 설치 에이전트/회사 + 활성 런타임
-agentlas uninstall <agent>       # 설치 에이전트 제거 (빌트인 거부)
+agentlas uninstall <agent> [--yes]  # 설치 에이전트 제거 (빌트인 거부).
+                                 # 대화 이력이 있으면 건수를 보여주고 --yes 없이는 거절한다
+                                 # (챗/메시지가 CASCADE로 함께 영구 삭제되기 때문).
 agentlas experience <sub>        # list|inspect|validate|save|publish|status|export|unpublish|withdraw
-agentlas variant resolve         # 로컬 variant 호환성 프리뷰 (권위 없음)
+agentlas variant resolve --base-release <id>   # 로컬 variant 호환성 프리뷰 (권위 없음, `agentlas variant help`)
 ```
 
 ### EXECUTE

package/bin/agentlas.cjs

@@ -117,9 +117,23 @@ function bootstrapDbIfMissing() {
   const dir = path.dirname(p);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   securePrivateMode(dir, 0o700);
+  // 존재 여부만 보면 **0바이트 파일이 부트스트랩을 영구히 막는다.** 실측 2026-07-28:
+  // `sqlite3 <없는경로> 'PRAGMA user_version;'` 같은 무해한 명령 하나가 빈 파일을 남기고,
+  // 그 뒤 모든 실행이 "이미 있음"으로 판단해 스키마 없이 진행하다 `no such table` 로
+  // 죽는다. 사용자에게는 원인이 전혀 안 보이는 상태다.
+  //
+  // SQLite 파일은 최소 한 페이지(512바이트)를 갖는다. 0바이트는 DB 가 아니라 자리만
+  // 잡힌 파일이므로 없는 것으로 취급해 정상 부트스트랩 경로를 태운다. 내용이 있는데
+  // 손상된 경우는 여기서 판단하지 않는다 — 그건 복구지 부트스트랩이 아니고, 멀쩡한
+  // DB 를 빈 것으로 오판해 덮어쓰는 위험이 훨씬 크다.
   if (exists(p)) {
-    securePrivateMode(p, 0o600);
-    return { created: false, path: p };
+    let empty = false;
+    try { empty = fs.statSync(p).size === 0; } catch { empty = false; }
+    if (!empty) {
+      securePrivateMode(p, 0o600);
+      return { created: false, path: p };
+    }
+    try { fs.rmSync(p, { force: true }); } catch { /* 지울 수 없으면 아래 link 가 EEXIST 로 알려준다 */ }
   }
   const schemaFile = path.join(PKG_ROOT, "engine", "bootstrap-schema.sql");
   if (!exists(schemaFile)) {
@@ -172,7 +186,7 @@ function main() {
   let error = null;
   if (!engineFound) {
     error = "Engine not found (engine/agentlas.cjs). Reinstall with: npm i -g agentlas";
-  } else if (!sqliteDriver) {
+  } else if (!sqliteDriver && !metadataOnly) {
     error = `Node ${process.version} — no SQLite driver. Upgrade to Node 22.5+ or reinstall with 'npm i -g agentlas' to build better-sqlite3.`;
   }
 

package/engine/agentlas-cloud-runtime.cjs

@@ -74,7 +74,7 @@ function buildManifest(root, options = {}) {
     memoryPolicy: { writeBack: "ask", publicCopy: "reset" },
     memory: files.filter((file) => [".agentlas/memory-map.json", ".agentlas/agent-card.json"].includes(file.path)).map((file) => file.path),
     allowRead: ["README.md", "AGENTS.md", "agent.md", "skills/**", ".agentlas/*.json"],
-    denyRead: [".env", ".env.*", "**/secrets/**", "**/credentials/**", "**/cookies/**", "**/*token*", "**/*secret*"],
+    denyRead: [".env", ".env.*", "secrets/**", "**/secrets/**", "credentials/**", "**/credentials/**", "cookies/**", "**/cookies/**"],
     publicExportPolicy: "clean-copy",
     requiredRuntime: ["mcp-client"],
     license: "call-only-default",
@@ -92,7 +92,13 @@ function scanFiles(files) {
     findings.push({ verdict, type, path: file.path, ...(line ? { line } : {}), message, redacted: true });
   }
   for (const file of files) {
-    if ([".env", ".env.local"].includes(file.path) || /(?:^|\/)(secrets|credentials|cookies)\//i.test(file.path) || /token|secret/i.test(file.path)) {
+    // A credential store is a path SEGMENT, never a filename substring. The old
+    // `/token|secret/i` test blocked ordinary vocabulary — measured 2026-07-29,
+    // it gave the live `web-master` package a BLOCK verdict for its own design
+    // system (`token-architecture.md`, `reference-token-db.json`). Dropping it
+    // costs no coverage: the per-line SECRET_PATTERNS scan below reads every
+    // packaged file and is the check that actually looks at values.
+    if (/^\.env(\.|$)/.test(file.path.split("/").pop() || "") || /(?:^|\/)(secrets|credentials|cookies)\//i.test(file.path)) {
       add("BLOCK", "credential-path", file, null, "Credential-like file path is excluded from Cloud package and public publish.");
     }
     file.content.split(/\r?\n/).forEach((line, index) => {

package/engine/agentlas-config.cjs

@@ -100,28 +100,35 @@ function mergePrefs(base, patch) {
   return next;
 }
 
+/*
+ * Throws on failure (lock timeout, read-only data dir, ENOSPC …) — it used to
+ * swallow every error and return null, so `agentlas setup` announced "All set."
+ * and exited 0 while the user's language/runtime/permission were never written.
+ * A caller that cannot persist must be able to say so; use savePrefs for the
+ * best-effort boolean contract.
+ */
 function updatePrefs(userDataDir, patch) {
-  try {
-    fs.mkdirSync(userDataDir, { recursive: true });
-    return withPrefsLock(userDataDir, () => {
-      const file = prefsPath(userDataDir);
-      const currentWasValid = Boolean(readPrefsFile(file));
-      const current = loadPrefs(userDataDir);
-      if (fs.existsSync(file) && !currentWasValid) {
-        try { fs.renameSync(file, `${file}.corrupt-${Date.now()}-${process.pid}`); } catch { /* recover from backup */ }
-      }
-      const next = mergePrefs(current, patch);
-      if (currentWasValid) atomicWrite(backupPath(userDataDir), current);
-      atomicWrite(file, next);
-      return next;
-    });
-  } catch {
-    return null;
-  }
+  fs.mkdirSync(userDataDir, { recursive: true });
+  return withPrefsLock(userDataDir, () => {
+    const file = prefsPath(userDataDir);
+    const currentWasValid = Boolean(readPrefsFile(file));
+    const current = loadPrefs(userDataDir);
+    if (fs.existsSync(file) && !currentWasValid) {
+      try { fs.renameSync(file, `${file}.corrupt-${Date.now()}-${process.pid}`); } catch { /* recover from backup */ }
+    }
+    const next = mergePrefs(current, patch);
+    if (currentWasValid) atomicWrite(backupPath(userDataDir), current);
+    atomicWrite(file, next);
+    return next;
+  });
 }
 
 function savePrefs(userDataDir, prefs) {
-  return Boolean(updatePrefs(userDataDir, prefs));
+  try {
+    return Boolean(updatePrefs(userDataDir, prefs));
+  } catch {
+    return false;
+  }
 }
 
 module.exports = { prefsPath, loadPrefs, savePrefs, updatePrefs, mergePrefs };

package/engine/agentlas-core-harness.cjs

@@ -84,7 +84,20 @@ function resolveCoreRuntimeRootFromCandidates(candidateRoots, requiredMarkers =
         const version = readCoreRuntimeVersion(root);
         if (!version || compareSemVer(version, minVersion) < 0) continue;
       }
-      return root;
+      // `~/.agentlas/runtime/current` 는 업데이터가 원자적으로 갈아 끼우는 심볼릭
+      // 링크다. 그 경로를 그대로 넘기면 Python 이 import 를 늦게 해석하는 특성상,
+      // 긴 실행 도중 업데이트가 일어나면 **옛 버전 모듈과 새 버전 모듈이 한 프로세스에
+      // 섞여 로드된다** — 어떤 버전에서도 시험된 적 없는 조합이고 버전 번호로는
+      // 재현조차 못 한다(감사 D3).
+      //
+      // 실경로로 고정해도 라이브 버전 선택은 그대로다: **다음** 호출이 다시 해석해
+      // 새 릴리스를 집는다. 없어지는 것은 실행 중 교체뿐이다.
+      try {
+        return fs.realpathSync(root);
+      } catch {
+        // 링크를 읽을 수 없다고 실행을 거부할 이유는 없다 — 이전 동작대로 경로를 쓴다.
+        return root;
+      }
     } catch {
       // Continue to the next installed/bundled root.
     }

package/engine/agentlas-i18n.cjs

@@ -260,6 +260,7 @@ const STRINGS = {
     "wiz.default": "(Enter default)",
     "wiz.invalid": "Choose 1–%s.",
     "wiz.saved": "All set. You can change any of this later with /runtime, /permission.",
+    "wiz.saveFailed": "Could not save your choices (%s) — they apply to this session only, and setup will ask again next launch.",
     "wiz.changeLang": "Tip: re-run setup anytime with  agentlas setup",
   },
   ko: {
@@ -505,6 +506,7 @@ const STRINGS = {
     "wiz.default": "(Enter 기본값)",
     "wiz.invalid": "1–%s 중 고르세요.",
     "wiz.saved": "완료. 나중에 /runtime, /permission으로 언제든 바꿀 수 있어요.",
+    "wiz.saveFailed": "선택을 저장하지 못했습니다 (%s) — 이번 세션에만 적용되고, 다음 실행 때 다시 물어봅니다.",
     "wiz.changeLang": "팁: 언제든  agentlas setup  으로 다시 설정",
   },
 };

package/engine/agentlas-input.cjs

@@ -298,7 +298,7 @@ const SLASH_COMMAND_META = [
   { command: "/route", description: "Preview which agent/pipeline would take a request", category: "Engine", usage: "/route <request>", detail: "Runs the Hephaestus router without executing — shows the selected agent, candidates, and reasons." },
   { command: "/research", description: "Run the Hephaestus Research Engine", category: "Engine", usage: "/research search \"query\"", detail: "status|gather|search|read|plan — evidence-grade web research from the terminal." },
   { command: "/search", description: "Discover agents in the Hub", category: "Hub", usage: "/search <what you need>", detail: "Search the Agentlas Hub + local for an agent that fits the task (hep-search)." },
-  { command: "/install", description: "Install an agent from the Hub by slug", category: "Hub", usage: "/install <slug>", detail: "Install a marketplace agent into this terminal (hep-cloud)." },
+  { command: "/install", description: "Install an agent from the Hub by slug", category: "Hub", usage: "/install <slug>", detail: "Install a marketplace agent into this terminal." },
   { command: "/network", description: "Staff and execute an ontology-grounded task force", category: "Engine", usage: "/network <request> [--benchmark]", detail: "The active top host LLM creates the work order, searches the Hub workforce ontology, selects exact releases, and executes a receipt-backed task force.", aliases: ["/taskforce", "/workforce"] },
   { command: "/legacy-network", description: "Run the compatibility Hephaestus network route", category: "Engine", usage: "/legacy-network <request>", detail: "Explicit compatibility escape hatch; never used as a fallback by /network." },
   { command: "/browser", description: "Real browser execution hardpoint", category: "Engine", usage: "/browser [sub]", detail: "Runs the Agentlas browser hardpoint (hep-browser)." },

package/engine/agentlas-memory-governance.cjs

@@ -163,7 +163,17 @@ function tableExists(db, name) {
   }
 }
 
+// 커넥션당 1회. 이전에는 `beginTurn`/`listScopedTimeline` 이 부를 때마다, 즉 **매 턴**
+// 공유 DB 에 테이블 4개 + 인덱스 5개 DDL 과 `UPDATE … stale` 을 날렸다. 전부
+// IF NOT EXISTS 라 결과는 멱등이지만 쓰기 락을 잡는 것은 매번이었고, 데스크탑
+// 마이그레이션과 겹치면 15초 busy_timeout 을 소진했다(2026-07-28).
+const { ensureOnce } = require("./core/schema-ensure.cjs");
+
 function ensureGovernanceSchema(db) {
+  return ensureOnce(db, "terminal_memory.schema", (conn) => ensureGovernanceSchemaOnce(conn));
+}
+
+function ensureGovernanceSchemaOnce(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS terminal_memory_turn_intents (
       turn_id TEXT PRIMARY KEY,

package/engine/agentlas-onboard.cjs

@@ -7,8 +7,13 @@ const i18n = require("./agentlas-i18n.cjs");
 const banner = require("./agentlas-banner.cjs");
 const { visWidth, wrapWidth } = require("./agentlas-composer.cjs");
 
-// req = { ui, rl, helpers }  → Promise<{ onboarded, lang, runtime, permission }>
-async function runOnboard({ ui, rl, helpers }) {
+/*
+ * req = { ui, rl, helpers, persist } → Promise<{ onboarded, saved, saveError, lang, runtime, permission }>
+ * `persist` writes the answers and must throw when it cannot. The wizard calls it
+ * itself, before announcing "All set." — the caller used to save afterwards, so a
+ * failed write (locked/read-only data dir) was announced as success and dropped.
+ */
+async function runOnboard({ ui, rl, helpers, persist }) {
   const H = helpers;
   const c = ui.c;
   const contentWidth = () => Math.max(20, (ui.out.columns || 80) - 5);
@@ -149,10 +154,22 @@ async function runOnboard({ ui, rl, helpers }) {
   const pi = await pickNum(permOpts.length);
   const permission = permOpts[pi - 1].v;
 
+    // Save first, then report what actually happened — never the other way round.
+    let saveError = null;
+    try {
+      if (typeof persist !== "function") throw new Error("no persistence handler");
+      await persist({ lang, runtime, permission });
+    } catch (error) {
+      saveError = error;
+    }
     ui.line("");
-    printSaved(ui.t("wiz.saved"));
-    printIndented(ui.t("wiz.changeLang"), c.faint);
-    return { onboarded: true, lang, runtime, permission };
+    if (saveError) {
+      ui.error(ui.t("wiz.saveFailed", String((saveError && saveError.message) || saveError)));
+    } else {
+      printSaved(ui.t("wiz.saved"));
+      printIndented(ui.t("wiz.changeLang"), c.faint);
+    }
+    return { onboarded: true, saved: !saveError, saveError, lang, runtime, permission };
   } finally {
     rl.removeListener("line", onLine);
     if (ownsSigint) rl.removeListener("SIGINT", onSigint);

package/engine/agentlas-sqlite-policy.cjs

@@ -6,15 +6,26 @@
 // fail immediately with SQLITE_BUSY even when busy_timeout is configured.
 const SQLITE_BUSY_TIMEOUT_MS = 15_000;
 
+// `foreign_keys` 는 파일이 아니라 **커넥션** 속성이다. 데스크탑은
+// `electron/store/db.ts` 에서 `foreign_keys = ON` 으로 열고, 터미널은 켜지 않아
+// **같은 테이블인데 터미널이 쓰는 행만 참조 무결성 검사를 건너뛰고 있었다**
+// (2026-07-28 확인). journal_mode 처럼 파일에 박히는 값이 아니라서 한쪽이 켠 것이
+// 다른 쪽에 전파되지 않는다. 스키마 소유는 데스크탑이므로 그 규칙을 그대로 따른다.
+const SQLITE_CONNECTION_PRAGMAS = [
+  `busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`,
+  "foreign_keys = ON",
+];
+
 function configureSqliteConnection(db) {
   if (!db) throw new TypeError("SQLite connection is required");
-  if (typeof db.pragma === "function") {
-    db.pragma(`busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`);
-  } else if (typeof db.exec === "function") {
-    db.exec(`PRAGMA busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`);
-  } else {
-    throw new TypeError("SQLite connection must expose pragma() or exec()");
-  }
+  const applyPragma =
+    typeof db.pragma === "function"
+      ? (statement) => db.pragma(statement)
+      : typeof db.exec === "function"
+        ? (statement) => db.exec(`PRAGMA ${statement}`)
+        : null;
+  if (!applyPragma) throw new TypeError("SQLite connection must expose pragma() or exec()");
+  for (const statement of SQLITE_CONNECTION_PRAGMAS) applyPragma(statement);
   return db;
 }
 

package/engine/agentlas-workforce.cjs

@@ -21,6 +21,7 @@ const fs = require("node:fs");
 const net = require("node:net");
 const path = require("node:path");
 const { Ui } = require("./agentlas-ui.cjs");
+const { recommendedConcurrency } = require("./workforce/concurrency.cjs");
 
 const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:/@-]{1,255}$/;
 const HASH_RE = /^sha256:[0-9a-f]{64}$/;
@@ -1516,7 +1517,9 @@ function validatePreparedExecution(value, workOrder, selection, candidateSet, va
 function validateDelegationPlan(value, selection) {
   const plan = assertObject(value, "delegationPlan");
   assertExactKeys(plan, ["schemaVersion", "planId", "packets", "synthesis", "verifier"], "delegationPlan", "planner_invalid");
-  if (plan.schemaVersion !== "agentlas.workforce-delegation-plan.v1") fail("planner_invalid", "unsupported workforce delegation plan schema");
+  // v2: 패킷에 doneWhen(검증 가능한 완료조건 체크리스트)이 필수가 됐다. 생산자(같은
+  // 파일의 플래너 프롬프트)와 검증자가 항상 함께 배포되므로 호환 창구는 없다.
+  if (plan.schemaVersion !== "agentlas.workforce-delegation-plan.v2") fail("planner_invalid", "unsupported workforce delegation plan schema");
   assertId(plan.planId, "executionPlan.planId");
   const assignments = new Map(selection.assignments.map((row) => [`${row.slotId}\0${row.agentReleaseId}`, row]));
   const packets = assertArray(plan.packets, "executionPlan.packets", MAX_ASSIGNMENTS, { min: 1 });
@@ -1534,6 +1537,9 @@ function validateDelegationPlan(value, selection) {
     assertString(packet.objective, "packet.objective", UNBOUNDED_EXPLANATION_FIELD);
     assertArray(packet.inputs, "packet.inputs", 64).forEach((item, index) => assertString(item, `packet.inputs[${index}]`, UNBOUNDED_EXPLANATION_FIELD));
     assertString(packet.expectedOutput, "packet.expectedOutput", UNBOUNDED_EXPLANATION_FIELD);
+    // 완료조건은 위임 계약의 필수 요소다(v2) — 각 항목이 워커 반환물만 보고 참/거짓
+    // 판정 가능한 문장이어야 하며, 검증자 criteria와 같은 개수·길이 상한을 쓴다.
+    assertArray(packet.doneWhen, "packet.doneWhen", 16, { min: 1 }).forEach((item, index) => assertString(item, `packet.doneWhen[${index}]`, 500));
   }
   if (pairs.size !== assignments.size || [...assignments.keys()].some((pair) => !pairs.has(pair))) fail("planner_missing_child", "planner must create one separate child packet for every accepted assignment");
   for (const key of ["synthesis", "verifier"]) {
@@ -1818,11 +1824,12 @@ function buildPrompts(task, identity) {
     requestExpansionForSlots: [],
   };
   const delegationPlanShape = {
-    schemaVersion: "agentlas.workforce-delegation-plan.v1",
+    schemaVersion: "agentlas.workforce-delegation-plan.v2",
     planId: "workforce-plan:<id>",
     packets: [{
       packetId: "packet:<id>", slotId: "<selected slot>", agentReleaseId: "<selected release>",
       objective: "bounded objective", inputs: [], expectedOutput: "concrete handoff",
+      doneWhen: ["checkable completion condition"],
     }],
     synthesis: { slotId: "<selected slot>", agentReleaseId: "<selected release>", brief: "integration brief" },
     verifier: { slotId: "<selected slot>", agentReleaseId: "<selected release>", brief: "verification brief", criteria: ["criterion"] },
@@ -1863,13 +1870,14 @@ function buildPrompts(task, identity) {
   const plannerSchemaRequirements = [
     `Return exactly one object: ${stableJson(plannerShape)}`,
     "Return agentlas.workforce-orchestration-plan.v2 with exactly delegationPlan and capabilityBindingPlan. Copy plannerInvocationId, executionContextDigest, and toolInventoryDigest exactly from PLANNER_LINEAGE_DATA. The host computes bindingPlanDigest after validating your choices; do not emit bindingPlanDigest.",
-    "Create exactly one delegationPlan packet for every accepted slot/release pair. Every packet must explicitly author packetId, slotId, agentReleaseId, objective, inputs, and expectedOutput.",
+    "Create exactly one delegationPlan packet for every accepted slot/release pair. Every packet must explicitly author packetId, slotId, agentReleaseId, objective, inputs, expectedOutput, and doneWhen.",
+    "doneWhen is that packet's acceptance checklist: 1..16 conditions, each independently checkable as true or false from the worker's returned handoff alone (name concrete artifacts, fields, counts, or observable facts — never vibes like 'high quality'). State the goal and required results, but do not over-specify the worker's method or ordering. The verifier receives every packet's doneWhen alongside its handoff.",
     "Choose capabilityBindingPlan.inventory only from POLICY_FILTERED_LOCAL_TOOL_MENU_DATA. Cover every requiredToolCapabilities id exactly once for each slot/release pair. One selected tool row may cover multiple capabilities. If a required capability has no exact ready tool, do not invent a binding; return the best schema-valid plan and allow deterministic validation to reject it.",
     "Each bound inventory row must explicitly contain slotId, agentReleaseId, permissionPolicyDigest, provider, toolId, capabilityIds, status=bound. An empty inventory is required when every slot has no required tool capability.",
     "synthesis must explicitly author slotId, agentReleaseId, and brief. verifier must explicitly author slotId, agentReleaseId, brief, and a non-empty criteria array. The host will not add, remove, normalize, or substitute a release or field.",
     // 호스트가 강제하는 상한을 미리 알려준다 — 알려주지 않은 상한은 첫 시도를 반드시
     // 깨고 교정 1회로도 회복되지 않는다(2026-07-27 라이브 실측, 중첩 매니저 동일 계열).
-    "Objectives, inputs, expectedOutput, and briefs have no character limit — write them as long as the work honestly needs. Only counts are bounded: at most 64 inputs per packet and at most 32 verifier criteria of at most 450 characters each.",
+    "Objectives, inputs, expectedOutput, and briefs have no character limit — write them as long as the work honestly needs. Only counts are bounded: at most 64 inputs per packet, 1..16 doneWhen conditions of at most 500 characters each, and at most 32 verifier criteria of at most 450 characters each.",
   ].join("\n");
   return {
     searchSystem: [
@@ -2012,6 +2020,71 @@ function create(deps = {}) {
     };
   }
 
+  // ── 격리 고지 + 토큰 계측 ───────────────────────────────────────────────
+  // 실행마다 어느 단계가 어느 런타임에서 얼마의 토큰을 썼는지 모은다. 새는 곳을
+  // 추측하지 않고 보기 위한 장부다 — 2026-07-28 실측에서 codex 리더가 사소한
+  // 프롬프트 하나에 입력 18,235 토큰을 실었고, 그 원인(스킬 라이브러리 전량 적재)은
+  // 합계를 보기 전까지 아무도 몰랐다.
+  const isolationNotices = new Map();
+  const tokenLedger = [];
+  // ui 는 실행 컨텍스트에만 있으므로 여기서는 버퍼에 모으고, 영수증 시점에 낸다.
+  function noteIsolationWeakness(kind, role) {
+    const key = `${kind}:${role || "stage"}`;
+    if (isolationNotices.has(key)) return;
+    isolationNotices.set(key, `${kind}(${role || "stage"} 단계)`);
+  }
+  /**
+   * 단계별 토큰 장부를 사람이 읽는 표로 낸다.
+   *
+   * 총합만 보면 "많이 썼다"밖에 모른다. 어느 단계가, 어느 런타임에서, 호출 하나당
+   * 얼마를 실었는지를 나란히 놓아야 새는 곳이 보인다 — 입력이 출력보다 자릿수로
+   * 크면 그건 작업이 아니라 적재다.
+   */
+  function reportTokenLedger(ui) {
+    if (!tokenLedger.length && !isolationNotices.size) return;
+    const byStage = new Map();
+    for (const row of tokenLedger) {
+      const key = `${row.role}·${row.runtime}${row.model ? `/${row.model}` : ""}`;
+      const acc = byStage.get(key) || { calls: 0, input: 0, output: 0, cached: 0 };
+      acc.calls += 1; acc.input += row.input; acc.output += row.output; acc.cached += row.cached;
+      byStage.set(key, acc);
+    }
+    const totalIn = tokenLedger.reduce((sum, row) => sum + row.input, 0);
+    const totalOut = tokenLedger.reduce((sum, row) => sum + row.output, 0);
+    for (const label of isolationNotices.values()) {
+      ui.warn(
+        `격리 고지: ${label}는 도구 인벤토리가 비었음을 증명하지 못합니다. 도구 호출은 차단되지만 `
+          + "이 런타임은 호스트의 스킬/플러그인 이름을 컨텍스트에 싣습니다(그래서 입력 토큰도 큽니다). "
+          + "강한 격리가 필요하면 그 단계를 claude-code로 배정하세요.",
+      );
+    }
+    ui.line("");
+    ui.info(`token ledger — 입력 ${totalIn.toLocaleString()} / 출력 ${totalOut.toLocaleString()} · 호출 ${tokenLedger.length}건`);
+    const rows = [...byStage.entries()].sort((a, b) => b[1].input - a[1].input);
+    for (const [key, acc] of rows) {
+      const perCall = Math.round(acc.input / Math.max(1, acc.calls));
+      const share = totalIn ? Math.round((acc.input / totalIn) * 100) : 0;
+      ui.line(
+        `  ${key.padEnd(34)} 호출 ${String(acc.calls).padStart(2)} · 입력 ${String(acc.input).padStart(8)}`
+          + ` (${String(share).padStart(2)}%, 호출당 ${perCall.toLocaleString()}) · 출력 ${acc.output}`,
+      );
+    }
+    // 입력이 출력의 100배를 넘는 단계는 일이 아니라 적재를 하고 있다.
+    for (const [key, acc] of rows) {
+      if (acc.output > 0 && acc.input / acc.output > 100) {
+        ui.warn(`토큰 누수 의심: ${key} — 입력이 출력의 ${Math.round(acc.input / acc.output)}배. 컨텍스트 적재를 확인하세요.`);
+      }
+    }
+  }
+
+  function recordStageTokens(role, runtimeKind, modelPin, usage) {
+    if (!usage) return;
+    const input = Number(usage.inputTokens ?? usage.input_tokens ?? 0) || 0;
+    const output = Number(usage.outputTokens ?? usage.output_tokens ?? 0) || 0;
+    const cached = Number(usage.cachedInputTokens ?? usage.cached_input_tokens ?? 0) || 0;
+    tokenLedger.push({ role: role || "stage", runtime: runtimeKind || "?", model: modelPin || null, input, output, cached });
+  }
+
   async function runModel(runtime, system, prompt, context) {
     const invocation = stageInvocation(runtime, context);
     const executionRuntime = invocation.executionRuntime;
@@ -2041,19 +2114,32 @@ function create(deps = {}) {
     }
     if (executionRuntime.mode === "cli") {
       const authorityMode = context.authorityMode || "no-authority";
-      if (executionRuntime.kind === "codex" && authorityMode === "no-authority") {
-        fail(
-          "workforce_runtime_isolation_unverified",
-          "Codex CLI workforce execution is blocked until this host proves an empty built-in, collaboration, and MCP tool inventory; feature-disable flags and an isolated CODEX_HOME are not sufficient proof",
-        );
-      }
-      if (executionRuntime.kind === "gemini" && authorityMode === "no-authority") {
-        fail(
-          "workforce_runtime_isolation_unverified",
-          "Gemini CLI workforce execution is blocked until this host proves an empty built-in and MCP tool inventory",
-        );
+      // 격리 강도는 런타임마다 다르다. claude-code는 `--tools ""`로 도구 인벤토리가
+      // 비었음을 증명할 수 있고, codex/gemini는 못 한다 — 2026-07-28 실측: 모든
+      // 격리 플래그(--ephemeral --ignore-user-config --ignore-rules --disable
+      // plugins/tool_suggest/...)를 준 codex가 사용자의 개인 스킬 이름을 전부
+      // 열거했고 사소한 프롬프트에 입력 18,235 토큰을 실었다.
+      //
+      // 그런데 그걸 이유로 실행을 통째로 거부하면 그 런타임을 오케스트레이터로
+      // 고른 사용자는 네트워크 전체를 잃는다. 실제로 새는 것은 "스킬 이름 목록"이고,
+      // 그것도 사용자 본인 기계에서 본인이 시작한 실행이다 — 도구 호출은 여전히
+      // 막혀 있다. 비례가 맞지 않는 차단이었고, 우회 수단조차 없었다.
+      //
+      // 그래서 거부 대신 고지한다: 무엇이 격리되지 않는지 이름을 대고, 실행은 한다.
+      // 강한 격리가 필요한 호스트는 AGENTLAS_WORKFORCE_REQUIRE_PROVEN_ISOLATION=1로
+      // 예전 동작(거부)을 되찾을 수 있다.
+      const provenIsolation = executionRuntime.kind === "claude-code";
+      if (!provenIsolation && authorityMode === "no-authority") {
+        if (String(process.env.AGENTLAS_WORKFORCE_REQUIRE_PROVEN_ISOLATION || "") === "1") {
+          fail(
+            "workforce_runtime_isolation_unverified",
+            `${executionRuntime.kind} cannot prove an empty tool inventory, and this host requires proven isolation. `
+              + "Assign claude-code for this stage, or unset AGENTLAS_WORKFORCE_REQUIRE_PROVEN_ISOLATION.",
+          );
+        }
+        noteIsolationWeakness(executionRuntime.kind, invocation.role);
       }
-      return normalizeModelResult(await D.captureRuntime(executionRuntime.kind, effectiveSystem, prompt, {
+      const captured = normalizeModelResult(await D.captureRuntime(executionRuntime.kind, effectiveSystem, prompt, {
         cwd: context.cwd,
         env: context.env,
         permission: context.permission,
@@ -2066,14 +2152,18 @@ function create(deps = {}) {
         outputLimitBytes: authorityMode === "read-only" ? 24 * 1024 * 1024 : undefined,
         envelope: true,
       }));
+      recordStageTokens(invocation.role, executionRuntime.kind, invocation.modelPin, captured.usage);
+      return captured;
     }
-    return normalizeModelResult(await D.runApi(
+    const viaApi = normalizeModelResult(await D.runApi(
       executionRuntime.backend,
       invocation.modelPin,
       effectiveSystem,
       prompt,
       { effort: invocation.effort, envelope: true },
     ));
+    recordStageTokens(invocation.role, executionRuntime.backend, invocation.modelPin, viaApi.usage);
+    return viaApi;
   }
 
   async function callHubTool(name, args) {
@@ -3331,7 +3421,10 @@ function create(deps = {}) {
       }
 
       const slotById = new Map(workOrder.roleSlots.map((slot) => [slot.slotId, slot]));
-      const concurrency = Math.max(1, Math.min(8, Number(ctx.concurrency) || 3));
+      // 사용자가 --parallel/-n을 명시하면 그 값(상한만 적용), 아니면 사양 기반 추천값.
+      const concurrency = Number.isFinite(Number(ctx.concurrency)) && Number(ctx.concurrency) > 0
+        ? Math.max(1, Math.min(8, Number(ctx.concurrency)))
+        : recommendedConcurrency();
       let cursor = 0;
       const outputs = new Array(delegationPlan.packets.length);
       const publicWorkers = new Array(delegationPlan.packets.length);
@@ -3680,6 +3773,9 @@ function create(deps = {}) {
                   `PINNED_PACKAGE_HASH=${pinned.packageHash}`,
                   `PINNED_CONTENT_DIGEST=${pinned.contentDigest}`,
                   "Do only your packet. Do not select or summon another agent. Return a concrete handoff artifact for the manager.",
+                  // 산출물과 한계·상태를 분리해야 검증자가 판정할 근거가 생긴다(위임
+                  // 계약 7요소 중 상태·증거). COMPLETED는 워커의 주장일 뿐이다.
+                  "End your handoff with two labeled sections: LIMITATIONS (what you could not verify or complete — write 'none' only if truly none) and STATUS (COMPLETED, PARTIAL, or FAILED; for PARTIAL/FAILED name each unmet doneWhen condition from your packet). Claiming COMPLETED does not finish the run — a pinned verifier accepts or rejects your claim.",
                 ].join("\n\n"),
                 prompt: stableJson({
                   sharedTask: workOrder.taskBrief,
@@ -3749,6 +3845,11 @@ function create(deps = {}) {
                 system: [
                   pinned.executionGraph.manager.content,
                   "You are the pinned manager synthesizing every declared worker handoff. Do not omit a worker or claim an undeclared worker ran.",
+                  // 팀 합성물은 최상위 패킷의 핸드오프가 된다 — 직접 워커와 동일한 반환
+                  // 계약을 적용해야 검증자가 판정 근거를 얻는다. (2026-07-28 라이브 A/B
+                  // 실측: 최상위 패킷 2개가 모두 중첩 팀이라 이 요구가 어디에도 적용되지
+                  // 않았다 — 직접 워커 경로에만 넣은 커버리지 갭.)
+                  "End your synthesis with two labeled sections: LIMITATIONS (what the team could not verify or complete — write 'none' only if truly none) and STATUS (COMPLETED, PARTIAL, or FAILED; for PARTIAL/FAILED name each unmet doneWhen condition from the parent packet). Claiming COMPLETED does not finish the run — a pinned verifier accepts or rejects the claim.",
                 ].join("\n\n"),
                 prompt: stableJson({ parentPacket: packet, synthesisBrief: manager.plan.synthesisBrief, handoffs: graphWorkerOutputs.map((row) => ({ id: row.graphWorker.id, text: row.text })) }),
               });
@@ -4108,14 +4209,25 @@ function create(deps = {}) {
               system: [
                 pinned.instructions,
                 "VERIFIER ESCALATION MODE: this exact worker packet was identified as failed by two independent verifier rounds. You are the single allowed orchestrator retry for this packet. Produce one replacement handoff, preserve the packet scope and pinned release, and do not delegate or retry again.",
+                // 수정 지시는 전체 재작성 지시가 아니다 — 통과분(preserve)을 명시하지
+                // 않으면 정확했던 부분이 재작성 과정에서 손상된다(위임 계약 수정 규칙).
+                "Repair, do not rewrite from scratch: preservedChecks lists verifier checks that already PASSED — keep the prior handoff's content that satisfied them and do not regress it. defects lists what failed — change only what those defects require. End with the same LIMITATIONS and STATUS sections required of every worker handoff.",
               ].join("\n\n"),
               prompt: stableJson({
                 sharedTask: workOrder.taskBrief,
                 roleSlot: slotById.get(packet.slotId),
                 packet,
                 priorHandoff: output.text,
-                verifierFailures: receipt.correctiveHistory.map((row) => ({
+                preservedChecks: receipt.correctiveHistory.flatMap((row) =>
+                  (row.verification.checks || [])
+                    .filter((check) => check.status === "passed")
+                    .map((check) => ({ checkId: check.checkId, evidence: check.evidence })),
+                ),
+                defects: receipt.correctiveHistory.map((row) => ({
                   issues: row.verification.issues,
+                  failedChecks: (row.verification.checks || [])
+                    .filter((check) => check.status === "failed")
+                    .map((check) => ({ checkId: check.checkId, evidence: check.evidence })),
                   failedPacketIds: row.verification.failedPacketIds,
                 })),
               }),
@@ -4316,6 +4428,7 @@ function create(deps = {}) {
         ui.line("");
         ui.markdown(finalText);
         ui.info(`workforce receipt: ${runId} · roster ${receipt.workers.length}/${delegationPlan.packets.length} · verifier passed`);
+        reportTokenLedger(ui);
         if (benchmarkArtifactPath) ui.info(`workforce benchmark artifacts: ${benchmarkArtifactPath}`);
       }
       return {
@@ -4368,6 +4481,10 @@ function create(deps = {}) {
           for (const issue of issues.slice(0, 16)) ui.error(`  - ${String(issue).slice(0, 400)}`);
           if (issues.length > 16) ui.error(`  … ${issues.length - 16} more issues in the persisted receipt`);
         }
+        // 실패한 실행이야말로 토큰이 어디로 갔는지 알아야 하는 순간이다. issues 유무와
+        // 무관하게 낸다 — 첫 배선이 이 블록 안에 들어가는 바람에 issues 없는 실패에서는
+        // 장부가 통째로 사라졌다.
+        reportTokenLedger(ui);
       }
       return { ok: false, error: receipt.failure, receipt, benchmarkArtifactPath };
     }