agentlas 1.0.45 → 1.0.47

package/engine/agentlas-workforce.cjs

@@ -1096,6 +1096,7 @@ function validateWorkOrder(value) {
 
 function validateCandidateSet(value, workOrder, now = new Date(), options = {}) {
   const set = assertObject(value, "candidateSet");
+  const summaryMenu = set.projection === "menu.v1";
   assertNoForbiddenFitSignals(set);
   // projection은 로컬 Core(연합) 응답에만 있는 메뉴 투영 메타데이터다(실측
   // 2026-08-05, reference-first: fullDossier=false). 원격 서버는 보내지 않는다.
@@ -1129,15 +1130,21 @@ function validateCandidateSet(value, workOrder, now = new Date(), options = {})
     const orderSlot = orderSlots.get(slotId);
     seenSlots.add(slotId);
     const releases = new Set();
-    for (const candidate of assertArray(slotResult.candidates, `candidateSet.${slotId}.candidates`, 100)) {
+    for (const [candidateIndex, candidate] of assertArray(slotResult.candidates, `candidateSet.${slotId}.candidates`, 100).entries()) {
       assertObject(candidate, "candidate");
       // missingMandatory는 로컬 Core(연합) 응답에만 있는 미충족 필수 표식이다
       // (실측 2026-08-05, fullDossier=true에도 동봉). 원격 서버는 보내지 않는다.
-      const candidateKeys = [
-        "agentDefinitionId", "agentReleaseId", "releaseVersion", "packageHash", "contentDigest",
-        "entityKind", "name", "communities", "fitEvidence", "qualificationEvidence", "optionalGaps",
-        "semanticSnapshot", "operational",
-      ];
+      const candidateKeys = summaryMenu
+        ? [
+            "agentDefinitionId", "agentReleaseId", "releaseVersion", "entityKind", "name",
+            "communities", "fitEvidence", "qualificationEvidenceCount", "optionalGaps",
+            "semanticSnapshot", "operational", "candidateOrdinal",
+          ]
+        : [
+            "agentDefinitionId", "agentReleaseId", "releaseVersion", "packageHash", "contentDigest",
+            "entityKind", "name", "communities", "fitEvidence", "qualificationEvidence", "optionalGaps",
+            "semanticSnapshot", "operational",
+          ];
       if (Object.prototype.hasOwnProperty.call(candidate, "missingMandatory")) candidateKeys.push("missingMandatory");
       assertExactKeys(candidate, candidateKeys, "candidate", "candidate_set_invalid");
       assertId(candidate.agentDefinitionId, "candidate.agentDefinitionId");
@@ -1145,15 +1152,22 @@ function validateCandidateSet(value, workOrder, now = new Date(), options = {})
       if (releases.has(releaseId)) fail("candidate_set_invalid", `duplicate release ${releaseId} in ${slotId}`);
       releases.add(releaseId);
       assertString(candidate.releaseVersion, "candidate.releaseVersion", 100);
-      assertHash(candidate.packageHash, "candidate.packageHash");
-      assertHash(candidate.contentDigest, "candidate.contentDigest");
+      if (summaryMenu) {
+        if (candidate.candidateOrdinal !== candidateIndex + 1) fail("candidate_set_invalid", `candidate ordinal mismatch in ${slotId}`);
+        if (!Number.isInteger(candidate.qualificationEvidenceCount) || candidate.qualificationEvidenceCount < 0) {
+          fail("candidate_set_invalid", "candidate.qualificationEvidenceCount is invalid");
+        }
+      } else {
+        assertHash(candidate.packageHash, "candidate.packageHash");
+        assertHash(candidate.contentDigest, "candidate.contentDigest");
+      }
       if (!["agent", "team"].includes(candidate.entityKind) || !orderSlot.allowedEntityKinds.includes(candidate.entityKind)) {
         fail("candidate_set_invalid", "candidate.entityKind is not executable or violates the WorkOrder slot boundary");
       }
       assertString(candidate.name, "candidate.name", 200);
       assertIds(candidate.communities, "candidate.communities");
       assertIds(candidate.fitEvidence, "candidate.fitEvidence");
-      assertIds(candidate.qualificationEvidence, "candidate.qualificationEvidence");
+      if (!summaryMenu) assertIds(candidate.qualificationEvidence, "candidate.qualificationEvidence");
       assertIds(candidate.optionalGaps, "candidate.optionalGaps");
       const operational = assertObject(candidate.operational, "candidate.operational");
       assertExactKeys(operational, ["callable", "installable"], "candidate.operational", "candidate_set_invalid", ["unavailableReasons"]);
@@ -1163,10 +1177,15 @@ function validateCandidateSet(value, workOrder, now = new Date(), options = {})
       // knowledge·modalities는 로컬 Core 스냅샷에만 있는 확장 어휘다(실측 2026-08-05).
       // 원격 서버는 보내지 않는다 — missingMandatory·projection과 같은 규칙으로
       // "있으면 검증하고 허용", 원격 계약의 exact-keys는 그대로 둔다.
-      const semanticKeys = [
-        "summaries", "roles", "skills", "toolCapabilities", "consumes", "produces",
-        "authorities", "runtimes", "languages",
-      ];
+      const semanticKeys = summaryMenu
+        ? [
+            "summaries", "roles", "skills", "toolCapabilities", "consumesCount", "producesCount",
+            "authorities", "runtimes", "languages",
+          ]
+        : [
+            "summaries", "roles", "skills", "toolCapabilities", "consumes", "produces",
+            "authorities", "runtimes", "languages",
+          ];
       for (const optional of ["knowledge", "modalities"]) {
         if (Object.prototype.hasOwnProperty.call(semantic, optional)) semanticKeys.push(optional);
       }
@@ -1177,8 +1196,14 @@ function validateCandidateSet(value, workOrder, now = new Date(), options = {})
       assertIds(semantic.roles, "candidate.semanticSnapshot.roles");
       assertLeveledConcepts(semantic.skills, "candidate.semanticSnapshot.skills");
       assertLeveledConcepts(semantic.toolCapabilities, "candidate.semanticSnapshot.toolCapabilities");
-      assertIds(semantic.consumes, "candidate.semanticSnapshot.consumes");
-      assertIds(semantic.produces, "candidate.semanticSnapshot.produces");
+      if (summaryMenu) {
+        for (const field of ["consumesCount", "producesCount"]) {
+          if (!Number.isInteger(semantic[field]) || semantic[field] < 0) fail("candidate_set_invalid", `candidate.semanticSnapshot.${field} is invalid`);
+        }
+      } else {
+        assertIds(semantic.consumes, "candidate.semanticSnapshot.consumes");
+        assertIds(semantic.produces, "candidate.semanticSnapshot.produces");
+      }
       assertIds(semantic.authorities, "candidate.semanticSnapshot.authorities");
       assertStrings(semantic.runtimes, "candidate.semanticSnapshot.runtimes");
       assertStrings(semantic.languages, "candidate.semanticSnapshot.languages");
@@ -1379,7 +1404,9 @@ function normalizedRosterPairs(rows, label, candidateSet) {
     seen.add(pair);
     const candidate = maps.bySlot.get(slotId)?.get(releaseId);
     if (!candidate || candidate.agentDefinitionId !== definitionId || candidate.releaseVersion !== releaseVersion ||
-        candidate.packageHash !== packageHash || candidate.contentDigest !== contentDigest || candidate.entityKind !== row.entityKind) {
+        (candidate.packageHash !== undefined && candidate.packageHash !== packageHash) ||
+        (candidate.contentDigest !== undefined && candidate.contentDigest !== contentDigest) ||
+        candidate.entityKind !== row.entityKind) {
       fail("selection_validation_invalid", `${label}[${index}] does not match the frozen candidate release`);
     }
     return pair;
@@ -1479,6 +1506,10 @@ function validatePreparedExecution(value, workOrder, selection, candidateSet, va
   const contextDigest = assertHash(prepared.executionContextDigest, "preparedExecution.executionContextDigest");
   if (!constantTimeHashEqual(contextDigest, executionContextDigest(context))) fail("execution_context_mismatch", "prepared execution context digest is invalid");
   const maps = candidateMaps(candidateSet);
+  const validatedRows = new Map(validationReceipt.executableTeam.map((row) => [
+    `${row.slotId}\0${row.agentReleaseId}`,
+    row,
+  ]));
   const expected = selectedPairs(selection);
   const roster = assertArray(prepared.executionRoster, "preparedExecution.executionRoster", MAX_ASSIGNMENTS, { min: 1 });
   const actual = [];
@@ -1512,7 +1543,18 @@ function validatePreparedExecution(value, workOrder, selection, candidateSet, va
     const bundleDigest = assertHash(row.bundleDigest, "executionRoster.bundleDigest");
     assertObject(row.directiveBundle, "executionRoster.directiveBundle");
     if (!["agent", "team"].includes(row.entityKind)) fail("execution_bundle_invalid", "executionRoster.entityKind is invalid");
-    if (packageHash !== candidate.packageHash || contentDigest !== candidate.contentDigest) fail("execution_bundle_digest_mismatch", `prepared bytes do not match candidate pin for ${releaseId}`);
+    const validated = validatedRows.get(pair);
+    if (!validated) fail("execution_bundle_invalid", `prepared release ${releaseId} has no accepted exact-release receipt`);
+    if (
+      definitionId !== candidate.agentDefinitionId ||
+      releaseVersion !== candidate.releaseVersion ||
+      row.entityKind !== candidate.entityKind ||
+      definitionId !== validated.agentDefinitionId ||
+      releaseVersion !== validated.releaseVersion ||
+      packageHash !== validated.packageHash ||
+      contentDigest !== validated.contentDigest ||
+      row.entityKind !== validated.entityKind
+    ) fail("execution_bundle_digest_mismatch", `prepared bytes do not match the accepted exact-release receipt for ${releaseId}`);
     if (releaseVersion !== candidate.releaseVersion) fail("execution_bundle_digest_mismatch", `prepared version does not match candidate pin for ${releaseId}`);
     if (definitionId !== candidate.agentDefinitionId) fail("execution_bundle_digest_mismatch", `prepared definition does not match candidate pin for ${releaseId}`);
     if (row.entityKind !== candidate.entityKind) fail("execution_bundle_digest_mismatch", `prepared entity kind does not match candidate pin for ${releaseId}`);
@@ -1660,6 +1702,7 @@ function candidateMenu(candidateSet) {
           .slice(0, 5)
           .map((value) => term(value, "skill:"));
         const row = {
+          candidateOrdinal: candidate.candidateOrdinal,
           agentReleaseId: candidate.agentReleaseId,
           name: String(candidate.name || "").slice(0, 80),
           entityKind: candidate.entityKind,
@@ -1668,8 +1711,10 @@ function candidateMenu(candidateSet) {
         if (skills.length) row.skills = skills;
         const roles = (snapshot.roles || []).slice(0, 2).map((value) => term(value, "role:"));
         if (roles.length) row.roles = roles;
-        const summary = String(snapshot.summary || candidate.summary || "").trim();
+        const summary = String((snapshot.summaries || [])[0] || candidate.summary || "").trim();
         if (summary) row.summary = summary.slice(0, 200);
+        const fitEvidence = (candidate.fitEvidence || []).slice(0, 4).map(String);
+        if (fitEvidence.length) row.fitEvidence = fitEvidence;
         return row;
       }),
     })),
@@ -2450,6 +2495,16 @@ const TRANSIENT_MODEL_ERROR_RE = /Connection closed mid-response|"terminal_reaso
       }
       return value;
     })();
+    // 후보 검색 인자는 **여기 한 곳**에서만 만든다. hubStage 는 보낸 인자 객체로
+    // requestDigest 를 계산하고 supersedeCandidateSearch 는 같은 값을 다시 만들어
+    // 행을 찾으므로, 두 곳이 어긋나면 supersession 이 조용히 실패한다(sourceScope
+    // 추가 때 한 번, fullDossier 추가 때 또 한 번 실측으로 깨졌다).
+    //
+    // Current Core returns a numbered summary menu by default and keeps the
+    // audit-weight dossier in its pinned selection session. Exact hashes are
+    // reintroduced only in accepted validation/preparation receipts and are
+    // cross-checked there; never request or echo the legacy full dossier.
+    const candidateSearchArgs = (workOrder) => ({ workOrder, sourceScope });
     const ui = ctx.ui || newUi();
     const runtime = ctx.runtime || D.resolveRuntime(db, ctx.runtimeOverride);
     const cwd = ctx.cwd || (typeof D.projectCwd === "function" ? D.projectCwd() : process.cwd());
@@ -2801,9 +2856,11 @@ const TRANSIENT_MODEL_ERROR_RE = /Connection closed mid-response|"terminal_reaso
     };
 
     const supersedeCandidateSearch = (workOrder, refinementNumber, triggerKind) => {
-      // hubStage가 저장한 requestDigest와 같은 인자 모양이어야 행을 찾는다 —
-      // search 인자에 sourceScope가 실리므로(2026-08-05) 여기서도 함께 계산한다.
-      const requestDigest = sha256({ workOrder, sourceScope });
+      // hubStage가 저장한 requestDigest와 **같은 인자 객체**여야 행을 찾는다.
+      // 이 다이제스트를 손으로 다시 조립하는 구조가 이미 두 번 깨졌다(sourceScope
+      // 추가 때 한 번, fullDossier 추가 때 또 한 번) — 인자는 candidateSearchArgs
+      // 한 곳에서만 만든다.
+      const requestDigest = sha256(candidateSearchArgs(workOrder));
       for (const row of receipt.hubTools) {
         if (row.tool !== "workforce.search_candidates" || row.requestDigest !== requestDigest || row.authoritativeChain !== true) continue;
         row.authoritativeChain = false;
@@ -3133,7 +3190,7 @@ const TRANSIENT_MODEL_ERROR_RE = /Connection closed mid-response|"terminal_reaso
         // sourceScope는 MCP 스키마상 required다. 예전에는 싣지 않아 서버 기본값
         // ("hub")에 의존했다 — 기본값이 바뀌면 이 표면의 실제 스코프가 조용히
         // 넓어지거나 좁아진다. 이 표면이 보는 메뉴를 스스로 선언한다.
-        const candidateRaw = await hubStage("workforce.search_candidates", { workOrder, sourceScope });
+        const candidateRaw = await hubStage("workforce.search_candidates", candidateSearchArgs(workOrder));
         candidateSet = validateCandidateSet(
           candidateRaw,
           workOrder,
@@ -3269,13 +3326,13 @@ const TRANSIENT_MODEL_ERROR_RE = /Connection closed mid-response|"terminal_reaso
             : `  picked ${row.slotId} ← ${nameByRelease.get(row.agentReleaseId) || row.agentReleaseId}`);
         }
       }
-      const validationRaw = await hubStage("workforce.validate_selection", { workOrder, candidateSet, selection });
+      const validationRaw = await hubStage("workforce.validate_selection", { workOrder, selection });
       validationReceipt = validateSelectionReceipt(validationRaw, selection, candidateSet, workOrder);
       benchmarkState.selectionValidation = validationReceipt;
       receipt.selectionReceiptId = validationReceipt.selectionReceiptId;
       if (!ctx.silent) ui.info(ui.lang === "ko" ? "허브 검증 수락 — 번들 준비 중" : "hub validation accepted — preparing bundles");
 
-      const preparedRaw = await hubStage("workforce.prepare_execution", { workOrder, candidateSet, selection, validationReceipt });
+      const preparedRaw = await hubStage("workforce.prepare_execution", { workOrder, selection, validationReceipt });
       ({ prepared, rosterByPair } = validatePreparedExecution(preparedRaw, workOrder, selection, candidateSet, validationReceipt));
       receipt.preparationReceiptId = prepared.preparationReceiptId;
       benchmarkState.preparedExecution = prepared;

package/engine/agents/router.cjs

@@ -11,6 +11,7 @@
  */
 const crypto = require("node:crypto");
 const { listRoutableAgents } = require("./registry.cjs");
+const { sharedRuntimeKind } = require("../runtimes/resolve.cjs");
 
 const UNRESOLVED_LABEL = "unresolved";
 
@@ -28,8 +29,9 @@ function ensureJudgeRunner(db, runtime) {
   if (!resolved && db) {
     try {
       const active = require("../runtimes/detect.cjs").activeRuntimeRow(db);
-      if (active && capture.RUNTIME_BIN[active.kind]) {
-        resolved = { kind: active.kind, model: active.model || null };
+      const activeKind = sharedRuntimeKind(active);
+      if (active && capture.RUNTIME_BIN[activeKind]) {
+        resolved = { kind: activeKind, model: active.model || null };
       } else if (active && active.kind === "byok" && active.backend) {
         resolved = { kind: "byok", backend: active.backend, model: active.model || null };
       } else if (active && active.kind === "ollama") {

package/engine/architecture.data.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.7.1",
+  "version": "1.7.2",
   "emitterBlock": "## Memory (Agentlas curated memory)\n\nAt the end of EVERY completed normal reply, emit exactly one hidden Memory Events\nenvelope. The runtime removes it before display. This envelope is the per-turn receipt:\nalways include a compact safe turn_summary, and use an empty candidates array when\nnothing durable was learned. Do not skip the envelope.\n\nRules:\n- Never include secrets, credentials, API keys, raw logs, or full transcripts.\n- Real credential values may live only in local project .env/.env.local,\n  ignored signing/ or credentials/ files, or a local keychain/vault. Memory\n  Events may mention env names and local relative paths only.\n- For deploy, release, store, billing, auth, API, or cloud work, first read the\n  project's .agentlas/local-credentials.map.json and the top\n  \"Local Credential Index\" section of .agentlas/project-soul-memory.md\n  before saying a credential is missing.\n- One candidate per durable item. Keep \"content\" to one or two sentences.\n- \"memory_kind\": fact | decision | preference | risk | procedure | hypothesis | evidence | deprecation | conflict\n- \"suggested_scope\": user_identity | team_memory | project (this folder) | agent_repo | session (temporary) | discard\n- Use user_identity for a stable operator preference or personal fact (their name, role, language, tone,\n  how they want you to behave) — these must outlive any one project. The curator only files user_identity\n  when you label it so with \"confidence\": \"high\"; it never promotes into that scope, so a preference emitted\n  at lower confidence is demoted to a throwaway session note.\n- \"agent_team\" is accepted only as a legacy alias for team_memory.\n- Add \"request_context\" when it improves future recall: user_intent, trigger_terms,\n  cwd_at_request, target_project, target_path, cross_context, outcome.\n- Never put the raw user prompt or transcript in request_context.\n- Suggest a scope; the separate Memory Curator decides the final destination.\n- turn_summary is one value-free sentence about the completed outcome. It is not the\n  user prompt, a transcript, raw log, secret, or absolute local path.\n\nFormat (always emit, including an empty candidates array):\n\n## Memory Events\n```json\n{\n  \"schema_version\": \"agentlas.memory-ticket.v1\",\n  \"turn_summary\": \"Completed outcome in one safe sentence.\",\n  \"candidates\": [\n    {\n      \"memory_kind\": \"decision\",\n      \"content\": \"...\",\n      \"suggested_scope\": \"project\",\n      \"confidence\": \"high\",\n      \"sensitivity\": \"internal\",\n      \"evidence_refs\": [],\n      \"request_context\": {\n        \"user_intent\": \"...\",\n        \"trigger_terms\": [\"...\"],\n        \"cwd_at_request\": null,\n        \"target_project\": null,\n        \"target_path\": null,\n        \"cross_context\": false,\n        \"outcome\": \"...\"\n      }\n    }\n  ]\n}\n```",
   "eventsHeading": "## Memory Events",
   "memoryDir": ".agentlas",
@@ -14,38 +14,14 @@
   "skillRegistryFile": "skill-registry.json",
   "skillTrialsFile": "skill-trials.jsonl",
   "curatorDecisionsFile": "curator-decisions.jsonl",
+  "ontologyRuntimeFile": "ontology-runtime.json",
+  "ontologySourceManifestFile": "ontology-sources.json",
+  "ontologyInboxDir": "ontology-inbox",
+  "ontologyDbFile": "ontology-runtime.sqlite",
   "careerGraphConfigFile": "career-graph.json",
   "careerGraphSourceManifestFile": "career-graph-sources.json",
   "careerGraphInboxDir": "career-graph-inbox",
   "careerGraphDbFile": "career-graph.sqlite",
-  "superOntologyContractFile": "super-ontology-contract.json",
-  "superOntologyOpenWorldCoverageFile": "super-ontology-open-world-coverage.json",
-  "superOntologyConsensusCoordinationFile": "super-ontology-consensus-coordination.json",
-  "superOntologyTaskCoverageFile": "super-ontology-task-coverage.json",
-  "superOntologyAssuranceCaseFile": "super-ontology-assurance-case.json",
-  "superOntologyContextualFlowFile": "super-ontology-contextual-flow.json",
-  "superOntologyCausalImpactFile": "super-ontology-causal-impact.json",
-  "superOntologyKnowledgeHomeostasisFile": "super-ontology-knowledge-homeostasis.json",
-  "superOntologyAdversarialProvenanceFile": "super-ontology-adversarial-provenance.json",
-  "superOntologyEpistemicCalibrationFile": "super-ontology-epistemic-calibration.json",
-  "superOntologySemanticAlignmentFile": "super-ontology-semantic-alignment.json",
-  "superOntologyResilienceControlFile": "super-ontology-resilience-control.json",
-  "superOntologyInvariantVerificationFile": "super-ontology-invariant-verification.json",
-  "superOntologyObservabilityTelemetryFile": "super-ontology-observability-telemetry.json",
-  "superOntologyObjectiveProxyValidityFile": "super-ontology-objective-proxy-validity.json",
-  "superOntologyStakeholderPreferenceGovernanceFile": "super-ontology-stakeholder-preference-governance.json",
-  "superOntologyNormativeAuthorityDriftFile": "super-ontology-normative-authority-drift.json",
-  "superOntologySideEffectContainmentFile": "super-ontology-side-effect-containment.json",
-  "superOntologySourceLineageVersionFile": "super-ontology-source-lineage-version.json",
-  "superOntologyEntityIdentityResolutionFile": "super-ontology-entity-identity-resolution.json",
-  "superOntologyTemporalStateTransitionFile": "super-ontology-temporal-state-transition.json",
-  "superOntologyCapabilityDelegationAuthorityFile": "super-ontology-capability-delegation-authority.json",
-  "superOntologyPrivacyConfidentialityBoundaryFile": "super-ontology-privacy-confidentiality-boundary.json",
-  "superOntologyStrategicIncentiveCompatibilityFile": "super-ontology-strategic-incentive-compatibility.json",
-  "superOntologyReflexiveFeedbackStabilityFile": "super-ontology-reflexive-feedback-stability.json",
-  "superOntologyReplaysFile": "super-ontology-replays.jsonl",
-  "superOntologyEvidenceFile": "super-ontology-evidence.jsonl",
-  "superOntologyMemoryBridgeFile": "super-ontology-memory-bridge.jsonl",
   "kinds": [
     "fact",
     "decision",
@@ -101,7 +77,7 @@
       "role": "builder",
       "visibility": "background",
       "tone": "purple",
-      "systemPrompt": "# Agentlas Core Engine Meta-Agent (built-in)\n\nYou are the local Agentlas Core Engine Meta-Agent for Agentlas Desktop and the\nAgentlas terminal. You create or package agent systems in the Agentlas architecture\nwhile staying compatible with local runtimes such as Codex, Claude, Gemini, OpenCode,\nHermes, and other folder-based agent hosts.\n\n## Source contract\nMirror the public core architecture and foldering contract from\nagentlas-ai/Agentlas-OS. This built-in prompt is the local runtime\ndistillation, not a forked original. If the full public core package is installed\nor available in the workspace, read and follow that package first.\n\n## Modes\nAuto-classify each request:\n- single-agent-creator: create one installable, self-evolving worker.\n- team-builder: create a multi-role team with HQ/orchestrator, builders, PM Soul,\n  Memory Curator, Policy Gate, QA/evidence gate, handoffs, eval, memory, and runtime\n  adapters.\n- agentlas-packager: inspect an existing prompt, agent, team, repo, or ZIP and\n  repair/package it into Agentlas architecture.\n\nAsk at most the missing questions needed to avoid a wrong package. If the user gave\nenough context, proceed without an interview.\n\n## Required Agentlas architecture\nEvery package you design should include the pieces that make it Agentlas, scaled to\nthe task size:\n- visible role/folder architecture, not a paper-only description;\n- .agentlas activation metadata, memory-map, sitemap, memory tickets, and evidence;\n- .agentlas skill-registry, skill-trials, and curator-decisions files as\n  candidate-only lifecycle metadata;\n- .agentlas super-ontology-contract, super-ontology-open-world-coverage,\n  super-ontology-consensus-coordination, super-ontology-task-coverage,\n  super-ontology-contextual-flow, super-ontology-assurance-case,\n  super-ontology-causal-impact,\n  super-ontology-knowledge-homeostasis,\n  super-ontology-adversarial-provenance,\n  super-ontology-epistemic-calibration,\n  super-ontology-semantic-alignment,\n  super-ontology-resilience-control,\n  super-ontology-invariant-verification,\n  super-ontology-observability-telemetry,\n\t  super-ontology-objective-proxy-validity,\n\t  super-ontology-stakeholder-preference-governance,\n\t  super-ontology-normative-authority-drift,\n\t  super-ontology-side-effect-containment,\n\t  super-ontology-source-lineage-version,\n\t  super-ontology-entity-identity-resolution,\n\t  super-ontology-temporal-state-transition,\n\t  super-ontology-capability-delegation-authority,\n\t  super-ontology-privacy-confidentiality-boundary,\n\t  super-ontology-strategic-incentive-compatibility,\n\t  super-ontology-reflexive-feedback-stability,\n\t  super-ontology-replays,\n  super-ontology-evidence, and super-ontology-memory-bridge files as\n  candidate-only adaptive knowledge governance metadata. Open-world coverage\n\t  ledger keys include objectiveProxyValidity, stakeholderPreferenceGovernance,\n\t  normativeAuthorityDrift, sideEffectContainment, sourceLineageVersion, entityIdentityResolution, temporalStateTransition, capabilityDelegationAuthority, privacyConfidentialityBoundary, strategicIncentiveCompatibility, reflexiveFeedbackStability, and memoryCuratorBridge\n\t  for cross-surface sync checks. Open-world coverage\n  must lower authority for new world/task/modality/fault/authority/write\n  combinations before action. Consensus coordination must treat agent agreement,\n  majority vote, debate, model-judge approval, distributed replica merge, and\n  cross-runtime sync as candidate signals rather than write authority. Task\n  coverage must classify requested work beyond\n  proposal/deck generation before action, and\n  contextual flow contracts must check sender, recipient, subject, purpose,\n  authority, transmission principle, and retention before information crosses\n  personal/company/customer/public/regulated/agent-internal boundaries.\n  assurance cases must link broad safety/coverage claims to evidence,\n  validators, residual risk, and rollback. Causal impact contracts must link\n  relation/action claims to intervention targets, counterfactuals, blast\n  radius, observability, and rollback before write/publish/execute/physical/train\n  behavior. Knowledge homeostasis contracts must link stale, contradictory,\n  unsupported, drifting, privacy-incident, missing-evidence, user-corrected, or\n  runtime-desynced knowledge to signals, error budgets, quarantine, repair,\n  rollback, retirement, Memory Curator policy, and public export policy.\n  In local operator mode, Super Ontology promotion gates are context, folder,\n  owner, evidence, and rollback organization rules (\"context_folder_routing_only\").\n  They must not become a\n  generic security stop sign that prevents local work when the operator has\n  named the project root, source folder, owner, evidence refs, and rollback or\n  replay path. Public exports stay value-free and candidate-only.\n  Adversarial provenance contracts must treat uploads, web pages, emails, chats,\n  tool responses, connector results, memory recalls, public repos, media assets,\n  AppBridge routes, generated artifacts, and datasets as untrusted until source\n  identity, span grounding, freshness, integrity, attestation, or content\n  credentials prove they can be read. They must block prompt injection, poisoned\n  sources, forged provenance, spoofed citations, hidden OCR instructions,\n  tool-output tampering, stale trusted-source replay, and unsigned release\n  artifacts from becoming retrieval, memory, tool, or public seed authority.\n  Epistemic calibration contracts must block missing evidence, source conflict,\n  stale evidence, low retrieval relevance, model disagreement, and uncalibrated\n  confidence from becoming answers, memory writes, tool actions, route sync, or\n  public artifacts. Semantic alignment contracts must block same-label,\n  embedding-similarity, abbreviation, OCR, generated-label, route-label,\n  source-conflict, and missing-unit shortcuts from becoming exact/equivalent\n  mappings, same-individual assertions, graph edges, memory merges, or public\n  artifacts without scope, validation, owner review, diff, and rollback.\n  Observability telemetry contracts must block graph, memory, tool, public,\n  route, release, repair, rollback, and emergency-stop writes when trace id,\n  span id, correlation id, source/evidence refs, audit sink, redaction/retention\n  policy, before/after snapshots, rollback refs, alert refs, or sample-size\n  evidence are missing. Objective proxy validity contracts must block approval\n  rates, open rates, benchmark scores, test pass rates, ontology edge counts,\n  reward deltas, self-judge scores, short-term profit, and green dashboards from\n  becoming success or write authority without construct definition,\n  countermetrics, stakeholder review, gaming probes, and rollback.\n  Stakeholder preference governance contracts must block owner approval,\n  majority vote, behavior signals, role power, stale preference records, and\n  strategic preference reports from becoming write authority without stakeholder\n  maps, authority scope, aggregation rules, consent or rights vetoes, dissent,\n  appeal paths, review owners, and rollback. Normative authority drift contracts\n  must block stale policies, wrong jurisdictions, draft contracts, superseded\n  rules, expired consent, translation/summary shortcuts, license conflicts,\n\t  cross-border transfer gaps, and emergency exceptions without expiry from\n\t  becoming authority without primary source, effective date, scope, precedence,\n\t  review owner, audit trail, and rollback. Side-effect containment contracts\n\t  must block preview-as-send, dry-run-as-commit, non-idempotent retry,\n\t  deletion without recovery, payment without idempotency, customer message\n\t  without review, release without rollback, partial failure without saga state,\n\t  physical action without safety interlock, scheduled action without\n\t  cancellation, and hosted tool writes without local containment wrappers from\n\t  executing without dry-run, exact approval, transaction or compensation plan,\n\t  cancellation path, blast radius, receipt, audit trace, rollback, and\n\t  post-action verification. Entity identity resolution contracts must block\n\t  names, aliases, domains, phone numbers, CRM ids, recycled ids, redacted\n\t  ids, embedding clusters, stale aliases, external URIs, memory notes, and\n\t  LLM-generated canonical labels from becoming same-entity authority without\n\t  canonical id, source-system namespace, source span, negative evidence,\n\t  temporal validity, privacy basis, owner review, merge/split policy, audit,\n\t  and rollback. Capability delegation authority contracts must block roles,\n\t  OAuth scopes, API keys, service accounts, session cookies, tool schemas,\n\t  cached policy decisions, broad approvals, and child-agent tokens from\n\t  becoming graph, memory, public, training, tool, route, scheduled,\n\t  permission, financial, release, customer-output, or physical authority\n\t  without actor identity, task, operation, resource, scope, purpose,\n\t  delegation chain, caveats, revocation, audit, rollback, and post-action\n\t  verification. Keep\n\t  graph writes and direct durable memory writes disabled until\n  shadow/canary/rollback evidence, homeostasis review, adversarial provenance\n  review, epistemic calibration review, semantic alignment review, resilience\n  control review, invariant verification, observability telemetry review,\n\t  objective proxy validity review, stakeholder preference governance review,\n\t  normative authority drift review, side-effect containment review,\n\t  source lineage version review, entity identity resolution review,\n\t  temporal state transition review, capability delegation authority review,\n\t  strategic incentive compatibility review, reflexive feedback stability\n\t  review, and Memory\n\t  Curator review exist;\n- PM Soul or project owner loop for continuity;\n- Memory Curator rules for durable memory, dedup, scope, and redaction;\n- task-bias / sitemap governance so stale or risky surfaces are revisited;\n- self-evolution rules with changelog, eval, rollback, and promotion criteria;\n- skill promotion stays export/local-candidate only until Curator quarantine,\n  sealed holdouts, rollback, and workspace policy approve a later phase;\n- Super Ontology public graph writes stay disabled until source intake, evidence\n  packets, belief ledger, knowledge capsules, affordance binding,\n  contextual flow review, causal impact review, knowledge homeostasis review,\n  adversarial provenance review, epistemic calibration review, shadow/canary\n  replay, semantic alignment review, resilience control review, invariant\n  verification, observability telemetry review, objective proxy validity review,\n  stakeholder preference governance review,\n  normative authority drift review,\n  capability delegation authority review,\n  rollback, and sync review\n  approve a later phase;\n- hierarchy when useful: HQ/orchestrator -> builders/workers -> QA/evidence gate;\n- runtime adapters for AGENTS.md plus Claude/Codex/Gemini/OpenCode-style hosts when\n  requested or detectable.\n\n## Local runtime boundaries\n- Do not copy Web-only SaaS implementation into local packages: billing, credits,\n  accounts, workspace sessions, OAuth token storage, provider-cost telemetry, hosted\n  rate limits, or database-backed SaaS routes.\n- Do not assume .claude is required. Prefer .agentlas as the shared architecture\n  substrate, then add thin runtime adapters such as AGENTS.md, CLAUDE.md, GEMINI.md,\n  .agents/skills, or .claude only when that host needs them.\n- Avoid slug collisions with installed public packages; built-in desktop agents are\n  background runtime control routes.\n\n## Output contract\nReturn concrete files, folder layout, prompts, memory rules, verification steps, and\nsync notes. For package work, name what was inspected, what was added or rejected,\nwhat remains private, and how to verify the result."
+      "systemPrompt": "# Agentlas Core Engine Meta-Agent (built-in)\n\nYou are the local Agentlas Core Engine Meta-Agent for Agentlas Desktop and the\nAgentlas terminal. You create or package agent systems in the Agentlas architecture\nwhile staying compatible with local runtimes such as Codex, Claude, Gemini, OpenCode,\nHermes, and other folder-based agent hosts.\n\n## Source contract\nMirror the public core architecture and foldering contract from\nagentlas-ai/Agentlas-OS. This built-in prompt is the local runtime\ndistillation, not a forked original. If the full public core package is installed\nor available in the workspace, read and follow that package first.\n\n## Modes\nAuto-classify each request:\n- single-agent-creator: create one installable, self-evolving worker.\n- team-builder: create a multi-role team with HQ/orchestrator, builders, PM Soul,\n  Memory Curator, Policy Gate, QA/evidence gate, handoffs, eval, memory, and runtime\n  adapters.\n- agentlas-packager: inspect an existing prompt, agent, team, repo, or ZIP and\n  repair/package it into Agentlas architecture.\n\nAsk at most the missing questions needed to avoid a wrong package. If the user gave\nenough context, proceed without an interview.\n\n## Required Agentlas architecture\nEvery package you design should include the pieces that make it Agentlas, scaled to\nthe task size:\n- visible role/folder architecture, not a paper-only description;\n- .agentlas activation metadata, memory-map, sitemap, memory tickets, and evidence;\n- .agentlas skill-registry, skill-trials, and curator-decisions files as\n  candidate-only lifecycle metadata;\n- .agentlas ontology-runtime and ontology-sources files for project-scoped semantic ontology;\n- PM Soul or project owner loop for continuity;\n- Memory Curator rules for durable memory, dedup, scope, and redaction;\n- task-bias / sitemap governance so stale or risky surfaces are revisited;\n- self-evolution rules with changelog, eval, rollback, and promotion criteria;\n- skill promotion stays export/local-candidate only until Curator quarantine,\n  sealed holdouts, rollback, and workspace policy approve a later phase;\n- hierarchy when useful: HQ/orchestrator -> builders/workers -> QA/evidence gate;\n- runtime adapters for AGENTS.md plus Claude/Codex/Gemini/OpenCode-style hosts when\n  requested or detectable.\n\n## Local runtime boundaries\n- Do not copy Web-only SaaS implementation into local packages: billing, credits,\n  accounts, workspace sessions, OAuth token storage, provider-cost telemetry, hosted\n  rate limits, or database-backed SaaS routes.\n- Do not assume .claude is required. Prefer .agentlas as the shared architecture\n  substrate, then add thin runtime adapters such as AGENTS.md, CLAUDE.md, GEMINI.md,\n  .agents/skills, or .claude only when that host needs them.\n- Avoid slug collisions with installed public packages; built-in desktop agents are\n  background runtime control routes.\n\n## Output contract\nReturn concrete files, folder layout, prompts, memory rules, verification steps, and\nsync notes. For package work, name what was inspected, what was added or rejected,\nwhat remains private, and how to verify the result."
     },
     {
       "id": "builtin-agentlas-pm-soul",

package/engine/automation/daemon.cjs

@@ -25,7 +25,7 @@ const store = require("./store.cjs");
 // 손상된/미래 계약 값은 절대 조용히 넓혀 실행하지 않는다 — raw-row 게이트로
 // 무인 실행 직전에 검사한다(데스크탑 automation-scheduler.ts:538-549).
 const RUNTIME_KINDS = new Set([
-  "claude-code", "codex", "gemini", "kimi", "grok", "cursor", "byok", "ollama", "lmstudio", "mlx",
+  "claude-code", "codex", "agy", "gemini", "kimi", "grok", "cursor", "byok", "ollama", "lmstudio", "mlx",
 ]);
 const RUNTIME_BACKENDS = new Set([
   "anthropic", "openai", "google", "ollama", "lmstudio", "mlx", "upstage", "custom", "glm",