atris 3.52.0 → 3.53.0

package/bin/atris.js

@@ -3140,7 +3140,7 @@ function inspectAgentCliWiring() {
     },
   ];
 
-  const binaries = ['atris', 'ax', 'claude', 'codex', 'cursor-agent', 'devin', 'droid'].map((name) => ({
+  const binaries = ['atris', 'ax', 'claude', 'codex', 'cursor-agent', 'devin', 'agy'].map((name) => ({
     name,
     path: commandOnPath(name),
   }));
@@ -3319,7 +3319,7 @@ async function chatAtris() {
   for (const arg of rawArgs) {
     if (arg === '--agent') {
       agentLane = true;
-    } else if (arg === '--print' || arg === '--headless') {
+    } else if (arg === '--print' || arg === '--headless' || arg === '--rapid' || arg === '--auto-approve') {
       fastLaneFlags.push(arg);
     } else {
       messageArgs.push(arg);
@@ -3332,9 +3332,12 @@ async function chatAtris() {
     console.log('Usage: atris chat ["message"]');
     console.log('');
     console.log('  Chat with Atris 2 Fast in this workspace: tools attached, same turn as `ax --fast`.');
+    console.log('  Pass --rapid to use Atris Rapid instead.');
     console.log('  Requires `atris login`.');
     console.log('');
     console.log('  atris chat                  Interactive chat (ax --fast --chat)');
+    console.log('  atris chat --rapid          Interactive Rapid chat (ax --rapid --chat)');
+    console.log('  atris chat --rapid --auto-approve   Rapid chat that auto-approves safe git push');
     console.log('  atris chat "what now?"      One-shot message (ax --fast)');
     console.log('  atris chat --print "..."    Headless JSON result (ax --fast --print)');
     console.log('  atris chat --agent [...]    Legacy cloud-agent lane (needs `atris agent`)');
@@ -3361,9 +3364,16 @@ async function chatAtris() {
   if (!agentLane) {
     try {
       const axPath = path.join(__dirname, '..', 'ax');
-      const axArgs = message || fastLaneFlags.length ? ['--fast', ...fastLaneFlags, message].filter(Boolean) : ['--fast', '--chat'];
+      const lane = fastLaneFlags.includes('--rapid') ? '--rapid' : '--fast';
+      const extraFlags = fastLaneFlags.filter((flag) => flag !== '--rapid');
+      const axArgs = message
+        ? [lane, ...extraFlags, message].filter(Boolean)
+        : [lane, ...extraFlags, '--chat'];
       const run = spawnSync(process.execPath, [axPath, ...axArgs], { stdio: 'inherit' });
-      process.exit(run.status || 0);
+      // spawnSync reports spawn failure via run.error (status stays null), and
+      // a signal-killed ax also leaves status null; neither is a success.
+      if (!run.error) process.exit(run.status ?? 1);
+      // ax unavailable: fall through to the agent lane.
     } catch {
       // ax unavailable: fall through to the agent lane.
     }
@@ -3632,7 +3642,9 @@ async function atrisFastChat() {
     const axModule = require('../ax');
     if (axModule.resolveRoute(message) === 'local') {
       const run = spawnSync(process.execPath, [path.join(__dirname, '..', 'ax'), '--fast', message], { stdio: 'inherit' });
-      process.exit(run.status || 0);
+      // Same rule as the chat lane: spawn failure or a signal kill leaves
+      // status null and must not read as success.
+      if (!run.error) process.exit(run.status ?? 1);
     }
   } catch {
     // ax unavailable: fall through to the plain cloud one-shot.

package/commands/computer.js

@@ -2141,7 +2141,7 @@ async function runBusinessPromptViaRunnerProxy(token, ctx, prompt, options = {})
   const payload = {
     prompt,
     permission_mode: 'bypassPermissions',
-    max_turns: Math.min(Math.max(Number(options.maxTurns || 12), 1), 25),
+    max_turns: Math.min(Math.max(Number(options.maxTurns || 40), 1), 100),
     reset_context: Boolean(options.resetContext),
   };
   if (options.worker) payload.worker = options.worker;
@@ -3399,7 +3399,7 @@ async function sendBusinessChat(token, ctx, message, sessionId, resetContext = f
     const fallback = await runBusinessPromptViaRunnerProxy(token, ctx, message, {
       ...options,
       resetContext,
-      maxTurns: 25,
+      maxTurns: 60,
     });
     if (!fallback.ok) {
       if (typeof options.onFailure === 'function') {

package/commands/mission.js

@@ -53,6 +53,7 @@ const {
   runsPruneLines,
   formatBytes,
 } = require('../lib/runs-prune');
+const { compactMissionLedger } = require('../lib/mission-ledger-compact');
 const autolandLib = require('../lib/autoland');
 const { gateForHuman, landingWhyClause } = require('../lib/voice-gate');
 const { operatorReady, hasAgentJargon } = require('./autoland');
@@ -1347,6 +1348,11 @@ function saveMission(mission, root = process.cwd(), eventType = 'mission_updated
     updated_at: stampIso(),
   });
   appendJsonLine(paths.missionsJsonl, next);
+  // Self-maintenance: once history outweighs live missions 4:1 the ledger is
+  // rewritten to one row per mission (latest state, first display number —
+  // exactly what loadMissionMap reconstructs). Every status/tick path parses
+  // this file several times, so unbounded snapshot history taxes everything.
+  try { compactMissionLedger(paths.missionsJsonl); } catch {}
   const event = appendEvent(eventType, next, payload, root);
   renderMissionStatus(root);
   renderMemberMissionState(next.owner, root);
@@ -4810,27 +4816,60 @@ function missionTickVerification(tick) {
   return { verified: false, state: ran ? 'unchecked' : 'skipped', unchecked: ran };
 }
 
-// Roll every ran tick for a mission into a verification-debt tally. `unchecked`
-// counts ran ticks that recorded no verifier result at all — the "tick recorded
-// but nothing was checked" red the report and now.md rollup surface and count
-// against the mission.
-function missionVerificationDebt(mission, root = process.cwd()) {
-  const paths = statePaths(root);
+// Per-process index of mission run receipts, keyed by runs dir. Reading and
+// parsing ~1400 receipt files per mission made `mission list` scale as
+// O(missions × runs-files); building the mission_id → receipts map once per
+// invocation keeps outputs identical while scanning the dir a single time.
+// The dir mtime guards the memo so a receipt written mid-process (new file in
+// the dir) invalidates it; malformed receipts stay silently skipped, matching
+// readJson's existing tolerance.
+const missionRunsIndexCache = new Map();
+
+function missionRunsReceiptIndex(root = process.cwd()) {
+  const runsDir = statePaths(root).runsDir;
+  let dirMtime = -1;
+  try {
+    dirMtime = fs.statSync(runsDir).mtimeMs;
+  } catch {
+    dirMtime = -1;
+  }
+  const cached = missionRunsIndexCache.get(runsDir);
+  if (cached && cached.dirMtime === dirMtime) return cached.byMission;
+
   let files = [];
   try {
-    files = fs.readdirSync(paths.runsDir)
+    files = fs.readdirSync(runsDir)
       .filter((file) => file.startsWith('mission-') && file.endsWith('.json'))
-      .map((file) => path.join(paths.runsDir, file));
+      .map((file) => path.join(runsDir, file));
   } catch {
     files = [];
   }
+  const byMission = new Map();
+  for (const file of files) {
+    const receipt = readJson(file);
+    if (!receipt || !receipt.mission_id) continue;
+    let bucket = byMission.get(receipt.mission_id);
+    if (!bucket) {
+      bucket = [];
+      byMission.set(receipt.mission_id, bucket);
+    }
+    bucket.push({ file, receipt });
+  }
+  missionRunsIndexCache.set(runsDir, { dirMtime, byMission });
+  return byMission;
+}
+
+// Roll every ran tick for a mission into a verification-debt tally. `unchecked`
+// counts ran ticks that recorded no verifier result at all — the "tick recorded
+// but nothing was checked" red the report and now.md rollup surface and count
+// against the mission.
+function missionVerificationDebt(mission, root = process.cwd()) {
+  const entries = missionRunsReceiptIndex(root).get(mission.id) || [];
   let ran = 0;
   let verified = 0;
   let unchecked = 0;
   const seen = new Set();
-  for (const file of files) {
-    const receipt = readJson(file);
-    if (!receipt || receipt.mission_id !== mission.id) continue;
+  for (const { receipt } of entries) {
     for (const tick of missionReceiptTicks(receipt)) {
       if (!tick || tick.status !== 'ran') continue;
       const key = `${tick.tick_index || ''}:${tick.finished_at || tick.started_at || ''}`;
@@ -4853,21 +4892,10 @@ function missionVerificationDebtLine(debt) {
 }
 
 function missionReportTimeline(mission, root = process.cwd(), limit = 6) {
-  const paths = statePaths(root);
-  let files = [];
-  try {
-    files = fs.readdirSync(paths.runsDir)
-      .filter((file) => file.startsWith('mission-') && file.endsWith('.json'))
-      .map((file) => path.join(paths.runsDir, file));
-  } catch {
-    files = [];
-  }
-
+  const entries = missionRunsReceiptIndex(root).get(mission.id) || [];
   const items = [];
   const seen = new Set();
-  for (const file of files) {
-    const receipt = readJson(file);
-    if (!receipt || receipt.mission_id !== mission.id) continue;
+  for (const { file, receipt } of entries) {
     const receiptPath = path.relative(root, file);
     for (const tick of missionReceiptTicks(receipt)) {
       const summary = missionTickReportSummary(tick);

package/commands/now.js

@@ -270,7 +270,13 @@ function taskReceiptTitle(row) {
 // one per receipt, landed result + human proof state. Shares the collector
 // with the count so the number and the visible list always match.
 function todayTaskReceiptLines(root = process.cwd(), date = new Date(), limit = 6) {
-  return collectTaskReceiptsToday(root, date)
+  return formatTaskReceiptLines(collectTaskReceiptsToday(root, date), limit);
+}
+
+// Format an already-collected receipt list, so a caller that needs both the
+// count and the lines (renderDefaultNow) parses the receipt files only once.
+function formatTaskReceiptLines(receipts, limit = 6) {
+  return receipts
     .slice(-limit)
     .reverse()
     .map((r) => {
@@ -411,7 +417,8 @@ function renderDefaultNow(root = process.cwd()) {
   const journalPath = currentJournalPath(root);
   const openTodoCount = countOpenWorkItems(root, todoPath);
   const inboxCount = countMatches(journalPath, /^-\s+\*\*I\d+:/gm);
-  const taskReceiptCount = countTaskReceiptsToday(root);
+  const taskReceipts = collectTaskReceiptsToday(root);
+  const taskReceiptCount = taskReceipts.length;
   const missionReceiptCount = countMissionReceiptsToday(root);
   const completedCount = taskReceiptCount + missionReceiptCount || countJournalCompletedReceipts(journalPath);
   const generated = formatLocalTimestamp();
@@ -419,7 +426,7 @@ function renderDefaultNow(root = process.cwd()) {
   const whatMattersNow = moveLine
     ? `${moveLine}\n\n- Run the named next action and leave proof before choosing another.`
     : '- Decide the next useful move before opening more context.';
-  const receiptLines = todayTaskReceiptLines(root);
+  const receiptLines = formatTaskReceiptLines(taskReceipts);
   const missionReceiptLines = todayMissionReceiptLines(root);
   const commitLines = landedCommitLines(root);
   const hiddenReceiptCount = Math.max(0, completedCount - missionReceiptLines.length - receiptLines.length);

package/commands/radar.js

@@ -54,23 +54,39 @@ function agentTypeForCommand(command) {
   if (/(^|\s|\/)claude(\s|$)/.test(cmd) && !/Claude\.app/.test(cmd)) return 'claude';
   if (/(^|\s|\/)opencode(\s|$)/.test(cmd)) return 'opencode';
   if (/(^|\s|\/)devin(\s|$)/.test(cmd)) return 'devin';
+  if (/(^|\s|\/)agy(\s|$)/.test(cmd)) return 'agy';
   if (/(^|\s|\/)droid(\s|$)/.test(cmd)) return 'droid';
   return null;
 }
 
-function processCwd(pid, deps) {
+// Resolve cwd for many pids at once: one lsof call on darwin instead of one
+// per process. Returns a Map of pid (string) -> cwd; missing pids stay absent.
+function processCwds(pids, deps) {
   const { platform, execFile } = deps;
-  try {
-    if (platform === 'linux') {
-      return deps.readlink(`/proc/${pid}/cwd`);
+  const byPid = new Map();
+  if (!pids.length) return byPid;
+  if (platform === 'linux') {
+    for (const pid of pids) {
+      try { byPid.set(String(pid), deps.readlink(`/proc/${pid}/cwd`)); } catch {}
+    }
+    return byPid;
+  }
+  if (platform === 'darwin') {
+    let out = '';
+    try {
+      out = execFile('lsof', ['-a', '-d', 'cwd', '-Fn', '-p', pids.map(String).join(',')], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] });
+    } catch (error) {
+      // lsof exits non-zero when any pid in the batch is gone; keep the rows it
+      // did print instead of losing every cwd.
+      out = error && error.stdout ? error.stdout : '';
     }
-    if (platform === 'darwin') {
-      const out = execFile('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] });
-      const line = String(out).split(/\r?\n/).find(value => value.startsWith('n'));
-      return line ? line.slice(1) : '';
+    let currentPid = '';
+    for (const line of String(out).split(/\r?\n/)) {
+      if (line.startsWith('p')) currentPid = line.slice(1).trim();
+      else if (line.startsWith('n') && currentPid) byPid.set(currentPid, line.slice(1));
     }
-  } catch {}
-  return '';
+  }
+  return byPid;
 }
 
 function gitBranch(cwd, execFile) {
@@ -93,22 +109,28 @@ function collectAgents(deps) {
     .map(row => ({ ...row, agent: agentTypeForCommand(row.command) }))
     .filter(row => row.agent);
   const parentPids = new Set(agentRows.map(row => String(row.ppid || '')).filter(Boolean));
-  return agentRows
-    .filter(row => !parentPids.has(String(row.pid)))
-    .map(row => {
-      const cwd = processCwd(row.pid, deps);
-      return {
-        pid: row.pid,
-        agent: row.agent,
-        command: row.command,
-        status: row.stat.includes('Z') ? 'zombie' : row.stat.includes('T') ? 'stopped' : 'active',
-        cwd,
-        repo: repoLabel(cwd),
-        branch: gitBranch(cwd, deps.execFile),
-        cpu: row.cpu,
-        mem: row.mem,
-      };
-    });
+  const topRows = agentRows.filter(row => !parentPids.has(String(row.pid)));
+  const cwdByPid = processCwds(topRows.map(row => row.pid), deps);
+  const branchByCwd = new Map();
+  const branchFor = (cwd) => {
+    if (!cwd) return '';
+    if (!branchByCwd.has(cwd)) branchByCwd.set(cwd, gitBranch(cwd, deps.execFile));
+    return branchByCwd.get(cwd);
+  };
+  return topRows.map(row => {
+    const cwd = cwdByPid.get(String(row.pid)) || '';
+    return {
+      pid: row.pid,
+      agent: row.agent,
+      command: row.command,
+      status: row.stat.includes('Z') ? 'zombie' : row.stat.includes('T') ? 'stopped' : 'active',
+      cwd,
+      repo: repoLabel(cwd),
+      branch: branchFor(cwd),
+      cpu: row.cpu,
+      mem: row.mem,
+    };
+  });
 }
 
 function loadTasks(root, deps) {
@@ -287,8 +309,11 @@ function loadTeam(root, deps) {
   };
 }
 
-function loadBrain(root, deps) {
-  const scorecards = readJsonLines(path.join(root, '.atris', 'state', 'scorecards.jsonl'), deps.readFile, deps.exists);
+function loadScorecards(root, deps) {
+  return readJsonLines(path.join(root, '.atris', 'state', 'scorecards.jsonl'), deps.readFile, deps.exists);
+}
+
+function loadBrain(root, deps, scorecards = loadScorecards(root, deps)) {
   const operatorDir = path.join(root, '.atris', 'state', 'operator-scorecards');
   let operatorScorecards = 0;
   try {
@@ -316,7 +341,7 @@ function countDirectoryEntries(dir, deps, predicate = () => true) {
   return listNames(dir, deps).filter(predicate).length;
 }
 
-function loadBusinessCollaboration(root, deps, team = {}) {
+function loadBusinessCollaboration(root, deps, team = {}, scorecardCount = countJsonLines(path.join(root, '.atris', 'state', 'scorecards.jsonl'), deps)) {
   const business = readJsonFile(path.join(root, '.atris', 'business.json'), deps, null);
   const runtime = readJsonFile(path.join(root, '.atris', 'state', 'runtime.json'), deps, null);
   const sync = readJsonFile(path.join(root, '.atris', 'state', '_sync.json'), deps, null);
@@ -335,7 +360,7 @@ function loadBusinessCollaboration(root, deps, team = {}) {
   const localReceipts = countDirectoryEntries(path.join(root, '.atris', 'receipts'), deps, name => /\.(json|md|txt)$/i.test(name));
   const events = countJsonLines(path.join(root, '.atris', 'state', 'events.jsonl'), deps);
   const episodes = countJsonLines(path.join(root, '.atris', 'state', 'episodes.jsonl'), deps);
-  const scorecards = countJsonLines(path.join(root, '.atris', 'state', 'scorecards.jsonl'), deps);
+  const scorecards = scorecardCount;
   const computerDirs = countDirectoryEntries(path.join(root, 'atris', 'computers'), deps, name => !name.startsWith('.'));
   const hasOnboarding = ingestPacks > 0 || starterBriefs > 0 || onePagers > 0;
   const hasProofLoop = events > 0 || episodes > 0 || scorecards > 0 || localReceipts > 0;
@@ -786,12 +811,18 @@ function collectRadar(options = {}) {
   const missions = loadMissions(root, deps, nowMs);
   identityCache.set(root, { missions, missionLocks: loadMissionLocks(path.join(root, '.atris', 'state'), deps), memberLocks: loadMemberLoopLocks(path.join(root, '.atris', 'state'), deps) });
   const worktrees = loadWorktrees(root, deps);
+  const branchIdentityCache = new Map();
+  const branchIdentityFor = (cwd) => {
+    if (!cwd) return null;
+    if (!branchIdentityCache.has(cwd)) branchIdentityCache.set(cwd, branchIdentityAtCwd(cwd, deps.execFile));
+    return branchIdentityCache.get(cwd);
+  };
   const agents = collectAgents(deps).map(agent => {
     const taskWorkspaceRoot = findTaskWorkspaceRoot(agent.cwd, deps);
     const agentTasks = taskWorkspaceRoot ? loadTasksCached(taskWorkspaceRoot, deps, taskCache) : [];
     const identity = taskWorkspaceRoot ? loadWorkspaceIdentity(taskWorkspaceRoot, deps, identityCache, nowMs) : { missions: [], missionLocks: [], memberLocks: [] };
     const sidecar = loadAgentWorktreeSidecar(agent.cwd, deps);
-    const branchIdentity = branchIdentityAtCwd(agent.cwd, deps.execFile);
+    const branchIdentity = branchIdentityFor(agent.cwd);
     const sessionId = parseSessionIdFromCommand(agent.command);
     const interactive = agent.agent === 'claude' && isInteractiveClaudeCommand(agent.command);
     const resolved = resolveAgentTaskBinding({
@@ -823,14 +854,15 @@ function collectRadar(options = {}) {
       task_action: task ? taskSessionAction(agent, task, taskWorkspaceRoot) : untaskedAction(agent, taskWorkspaceRoot, agentTasks, resolved),
     };
   });
+  const scorecards = loadScorecards(root, deps);
   const osState = {
     xp: loadXp(root, deps),
     team: loadTeam(root, deps),
-    brain: loadBrain(root, deps),
+    brain: loadBrain(root, deps, scorecards),
     swarlo: loadSwarlo(tasks),
     loop: loadLoop(missions, root, deps),
   };
-  osState.business = loadBusinessCollaboration(root, deps, osState.team);
+  osState.business = loadBusinessCollaboration(root, deps, osState.team, scorecards.length);
   return { root, generated_at: new Date(nowMs).toISOString(), summary: summarize(tasks, missions, worktrees, agents), os: osState, next_action: nextAction(tasks, missions, worktrees, agents, osState), agents, tasks, missions, worktrees };
 }
 

package/commands/youtube.js

@@ -1263,25 +1263,17 @@ module.exports = {
   shouldRetryWithLocalTranscript,
   formatYoutubeResult,
   fileBriefFromNotes,
-  looksLikeYoutubeUrl,
   isPlaylistUrl,
   parseNotesArgs,
   expandNotesTargets,
   runYoutubeNotesBatch,
-  runYoutubeNotes,
   parseDigestArgs,
   collectVideoBriefs,
   buildDigestPrompt,
-  runYoutubeDigest,
   normalizeWatchChannel,
   channelVideosUrl,
   parseFlatPlaylist,
   loadWatchState,
-  saveWatchState,
-  addWatchChannel,
-  listWatchChannels,
-  removeWatchChannel,
-  tickWatch,
   watchCommand,
   youtubeCommand,
 };

package/lib/auto-accept-certified.js

@@ -1099,7 +1099,8 @@ function evaluateAutoAccept(task, options = {}) {
       if ((tierRequiresStrictVerify && !verifyResult.ok)
         || verifyResult.reason === 'verify_failed'
         || verifyResult.reason === 'verify_unrunnable'
-        || verifyResult.reason === 'verify_worktree_missing') {
+        || verifyResult.reason === 'verify_worktree_missing'
+        || verifyResult.reason === 'verify_workdir_missing') {
         return { eligible: false, ref, reason: verifyResult.reason, verify, ...verifyResult };
       }
     }

package/lib/engine-ask.js

@@ -29,7 +29,7 @@ const MAX_ASK_PROMPT_BYTES = 16 * 1024;
 const MAX_ASK_TOTAL_PROMPT_BYTES = 64 * 1024;
 const MAX_ASK_OUTPUT_BYTES = 1024 * 1024;
 const ASK_STOP_GRACE_MS = 250;
-const ASK_MODEL_ENGINES = new Set(['claude', 'fable', 'haiku', 'codex', 'cursor', 'devin', 'grok']);
+const ASK_MODEL_ENGINES = new Set(['claude', 'fable', 'haiku', 'codex', 'cursor', 'devin', 'grok', 'agy']);
 const READ_ONLY_PREAMBLE = [
   'This is a read-only request.',
   'Do not modify files, create worktrees, start background agents, or run commands with side effects.',
@@ -241,8 +241,16 @@ function buildReadOnlyEngineInvocation(engineName, prompt, modelName = '') {
       args: ['--no-memory', '--no-subagents', '--permission-mode', 'plan', '--sandbox', 'read-only', ...(model ? ['--model', model] : []), '-p', request],
     };
   }
-  if (engine === 'droid') {
-    return { engine, bin: profile.bin, args: ['exec', '--disable-builtin-skills', request] };
+  if (engine === 'agy') {
+    // agy prompts for tool permission even in plan mode and a headless ask
+    // has no one to answer, so it denies itself `ls` and fails every ask
+    // (verified live 2026-08-19). The sandbox keeps the run read-only while
+    // skip-permissions lets sandboxed reads proceed unattended.
+    return {
+      engine,
+      bin: profile.bin,
+      args: ['--mode', 'plan', '--sandbox', '--dangerously-skip-permissions', ...(model ? ['--model', model] : []), '-p', request],
+    };
   }
   throw new Error(`engine ask has no read-only command for ${engine}`);
 }

package/lib/engine-registry.js

@@ -34,7 +34,8 @@ function engineFailureHealthStatus(result) {
     return 'credit_out';
   }
   if (/not installed|command not found|\benoent\b/.test(signalText)) return 'not_installed';
-  if (/timeout|model-unavailable/.test(signalText)) return 'not_installed';
+  // Timeouts and unavailable models are transient: 'error' keeps the engine
+  // routable, while 'not_installed' would drop it from routing until a doctor run.
   return 'error';
 }
 
@@ -48,7 +49,19 @@ const ENGINE_SEED_META = Object.freeze({
   fable: Object.freeze({ tier: 'max', roles: Object.freeze(['validator', 'executor']), models: Object.freeze(['opus 5', 'opus 4.8', 'fable', 'haiku']), duty: 'leader', fallback_order: 50 }),
   composer: Object.freeze({ tier: 'fast', roles: Object.freeze(['navigator', 'executor']), models: Object.freeze(['composer 2.5']), fallback_order: 60 }),
   haiku: Object.freeze({ tier: 'fast', roles: Object.freeze(['validator']), models: Object.freeze(['haiku']), fallback_order: 70 }),
-  droid: Object.freeze({ tier: 'pro', roles: Object.freeze(['executor']), models: Object.freeze(['built-in router']), duty: 'errands', fallback_order: 90 }),
+  agy: Object.freeze({
+    tier: 'pro',
+    roles: Object.freeze(['executor']),
+    models: Object.freeze([
+      'gemini-3.7-flash-high',
+      'gemini-3.1-pro-high',
+      'claude-sonnet-4-6',
+      'claude-opus-4-6-thinking',
+      'gpt-oss-120b-medium',
+    ]),
+    duty: 'errands',
+    fallback_order: 90,
+  }),
 });
 
 function engineRegistryFile(root = process.cwd()) {
@@ -144,9 +157,9 @@ function normalizeEngineEntry(id, saved = {}) {
   };
 }
 
-function seededRegistry(root = process.cwd()) {
+function seededRegistry(root = process.cwd(), preloadedRaw = null) {
   const file = engineRegistryFile(root);
-  const raw = readRawRegistry(file);
+  const raw = preloadedRaw || readRawRegistry(file);
   const savedById = new Map();
   for (const entry of raw.engines || []) {
     const id = canonicalEngineName(entry && (entry.id || entry.name));
@@ -162,7 +175,11 @@ function seededRegistry(root = process.cwd()) {
 function writeEngineRegistry(root, registry) {
   const file = engineRegistryFile(root);
   fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, `${JSON.stringify(registry, null, 2)}\n`, 'utf8');
+  // Atomic write: a concurrent reader must never see a torn file, because a
+  // failed parse falls back to the seed registry and erases operator policy.
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(registry, null, 2)}\n`, 'utf8');
+  fs.renameSync(tmp, file);
 }
 
 function setEngineOverrides(name, overrides = {}, root = process.cwd()) {
@@ -221,9 +238,17 @@ function setEngineOverrides(name, overrides = {}, root = process.cwd()) {
   return { id, ...nextOverrides };
 }
 
+// A read only writes when normalization actually changed the saved engines
+// (first seed, schema drift). Settled registries stay untouched, so read
+// paths cannot stomp a mutation another process just landed. The comparison
+// uses the same raw snapshot the seed was built from: one read, one decision.
 function readEngineRegistry(root = process.cwd(), options = {}) {
-  const registry = seededRegistry(root);
-  if (options.persist !== false) writeEngineRegistry(root, registry);
+  const raw = readRawRegistry(engineRegistryFile(root));
+  const registry = seededRegistry(root, raw);
+  const needsPersist = JSON.stringify(raw.engines || []) !== JSON.stringify(registry.engines);
+  if (options.persist !== false && needsPersist) {
+    writeEngineRegistry(root, registry);
+  }
   return registry;
 }