fuli-context 0.11.0 → 0.12.0

package/graph-provider/fuli_graph/store_agent_verification.py

@@ -43,7 +43,7 @@ class StoreAgentVerification:
         task = await self._quality_task(actor, request)
         rows, _, _ = await self.runtime.driver.execute_query(
             'MATCH (t:FuliProjectAgentTask {task_id:$task, personal_space_id:$space})-[:HAS_VERIFICATION]->(v:FuliAgentVerification) '
-            'RETURN v.record_json AS record_json ORDER BY v.sequence', task=request.task_id, space=request.personal_space_id)
+            'RETURN v.record_json AS record_json, v.run_id AS run_id ORDER BY v.sequence', task=request.task_id, space=request.personal_space_id)
         models = await self._quality_models(actor, request, task)
         result = evaluate_quality_policy(complexity=task.get('complexity') or 'standard',
             current_strategy=json.loads(task.get('effective_model_strategy_json') or '{"mode":"adaptive"}'),
@@ -53,7 +53,12 @@ class StoreAgentVerification:
         if selected:
             selected['executor_id'] = next(model['executor_id'] for model in models
                 if all(model.get(key) == selected[key] for key in ('provider', 'model', 'capability_tier', 'cost_rank')))
-        return {**result, 'evidence_authority': 'host_reported_test_evidence',
+        verified = next((row for row in rows if json.loads(row['record_json']).get('attempt_id') == result['verified_attempt_id']), None)
+        attempt = json.loads(verified['record_json']) if verified else None
+        if attempt:
+            attempt = {key: attempt.get(key) for key in ('attempt_id', 'artifact_revision', 'outcome', 'evidence_refs', 'verifier_id', 'executor_id', 'provider', 'model')}
+            attempt['run_id'] = verified.get('run_id')
+        return {**result, 'verified_attempt': attempt, 'evidence_authority': 'host_reported_test_evidence',
             'execution_started': False, 'guidance': 'Only complete the task after passed for the current artifact revision. Blocked means no authorized preflighted model proves the required capability tier. Model selection does not prove execution.'}
 
     async def record_agent_verification(self, actor, request):
@@ -92,7 +97,8 @@ class StoreAgentVerification:
                 raise HTTPException(409, 'An execution run cannot count as two verification attempts')
             identifier = stable_uuid('verification', request.personal_space_id, request.task_id, request.attempt_id)
             record = dict(attempt_id=request.attempt_id, outcome=request.outcome, artifact_revision=request.artifact_revision,
-                evidence_refs=request.evidence_refs, capability_tier=observed['capability_tier'], verifier_id=context['project_agent_id'])
+                evidence_refs=request.evidence_refs, capability_tier=observed['capability_tier'], verifier_id=context['project_agent_id'],
+                executor_id=request.executor_id, provider=request.provider, model=request.model)
             fingerprint = store._payload_hash(request)
             rows, _, _ = await store.runtime.driver.execute_query(
                 'MATCH (t:FuliProjectAgentTask {task_id:$task, personal_space_id:$space}) '
@@ -106,6 +112,7 @@ class StoreAgentVerification:
             result = await store.query_agent_quality(actor, request)
             await store.runtime.driver.execute_query(
                 'MATCH (t:FuliProjectAgentTask {task_id:$task, personal_space_id:$space}) '
-                'SET t.quality_gate=$status, t.verified_artifact_revision=$revision',
-                task=request.task_id, space=request.personal_space_id, status=result['status'], revision=request.artifact_revision)
+                'SET t.quality_gate=$status, t.verified_artifact_revision=$revision, t.verified_attempt_id=$attempt',
+                task=request.task_id, space=request.personal_space_id, status=result['status'], revision=request.artifact_revision,
+                attempt=result.get('verified_attempt_id'))
             return result

package/graph-provider/fuli_graph/store_knowledge.py

@@ -325,6 +325,8 @@ class StoreKnowledge:
             await self.runtime.driver.execute_query(
                 '''
                 UNWIND $entities AS row
+                WITH row
+                ORDER BY 'entity:' + row.uuid
                 MERGE (entity:Entity {uuid: row.uuid})
                 ON CREATE SET entity.group_id = $group_id,
                     entity.name = row.name,
@@ -365,6 +367,8 @@ class StoreKnowledge:
                     entity.fuli_preference_project_id = row.preference_project_id,
                     entity.fuli_preference_agent_id = row.preference_agent_id,
                     entity.fuli_attributes_json = row.attributes_json
+                SET entity.fuli_ai_review_lock_version =
+                      coalesce(entity.fuli_ai_review_lock_version, 0) + 1
                 WITH count(entity) AS entity_count
                 CREATE (episode:Episodic {
                   uuid: $episode_id,
@@ -392,12 +396,95 @@ class StoreKnowledge:
                 })
                 WITH episode
                 UNWIND $entities AS row
+                WITH episode, row
+                ORDER BY 'entity:' + row.uuid
                 MATCH (entity:Entity {uuid: row.uuid})
                 MERGE (episode)-[mention:MENTIONS {uuid: row.mention_uuid}]->(entity)
                 SET mention.group_id = $group_id,
                     mention.created_at = $created_at
                 WITH episode
+                CALL {
+                  WITH episode
+                  OPTIONAL MATCH ()-[old:RELATES_TO {group_id: $group_id}]->()
+                  WITH collect(old) AS candidate_olds
+                  UNWIND candidate_olds AS old
+                  WITH old
+                  WHERE old IS NOT NULL
+                    AND old.invalid_at IS NULL
+                    AND NOT (old.uuid IN $relationship_ids)
+                    AND (
+                      EXISTS {
+                        MATCH (:FuliSpace {id: $space_id})-
+                              [:HAS_KNOWLEDGE_ASSIGNMENT]->
+                              (assignment:FuliKnowledgeAssignment {
+                                item_kind: 'relationship',
+                                item_id: old.uuid
+                              })
+                        WHERE assignment.project_id = $personal_project_id
+                      }
+                      OR (
+                        NOT EXISTS {
+                          MATCH (:FuliSpace {id: $space_id})-
+                                [:HAS_KNOWLEDGE_ASSIGNMENT]->
+                                (:FuliKnowledgeAssignment {
+                                  item_kind: 'relationship',
+                                  item_id: old.uuid
+                                })
+                        }
+                        AND EXISTS {
+                          MATCH (old_episode:Episodic {group_id: $group_id})
+                          WHERE old_episode.uuid IN coalesce(old.episodes, [])
+                            AND (
+                              old_episode.fuli_personal_project_id =
+                                $personal_project_id
+                              OR (
+                                old_episode.fuli_personal_project_id IS NULL
+                                AND $personal_project_id IS NULL
+                              )
+                            )
+                        }
+                      )
+                    )
+                    AND EXISTS {
+                      MATCH (agent_episode:Episodic {group_id: $group_id})
+                      WHERE agent_episode.uuid IN coalesce(old.episodes, [])
+                        AND (
+                          agent_episode.fuli_project_agent_id = $project_agent_id
+                          OR (
+                            agent_episode.fuli_project_agent_id IS NULL
+                            AND $project_agent_id IS NULL
+                          )
+                        )
+                    }
+                    AND any(
+                      replacement IN $superseded_relationships
+                      WHERE replacement.key = old.fuli_key
+                    )
+                  WITH collect(old) AS superseded_edges
+                  OPTIONAL MATCH ()-[existing:RELATES_TO {
+                    group_id: $group_id
+                  }]->()
+                  WITH superseded_edges, collect(existing) AS candidate_existing
+                  RETURN superseded_edges,
+                         [edge IN candidate_existing
+                          WHERE edge IS NOT NULL
+                            AND edge.uuid IN $relationship_ids]
+                           AS existing_edges
+                }
+                CALL {
+                  WITH superseded_edges, existing_edges
+                  UNWIND superseded_edges + existing_edges AS lock_edge
+                  WITH lock_edge
+                  WHERE lock_edge IS NOT NULL
+                  ORDER BY 'relationship:' + lock_edge.uuid
+                  SET lock_edge.fuli_ai_review_lock_version =
+                        coalesce(lock_edge.fuli_ai_review_lock_version, 0) + 1
+                  RETURN count(*) AS _locked_relationship_count
+                }
+                WITH episode, superseded_edges
                 UNWIND $relationships AS row
+                WITH episode, superseded_edges, row
+                ORDER BY 'relationship:' + row.uuid
                 MATCH (source:Entity {uuid: row.source_uuid})
                 MATCH (target:Entity {uuid: row.target_uuid})
                 MERGE (source)-[edge:RELATES_TO {uuid: row.uuid}]->(target)
@@ -435,73 +522,26 @@ class StoreKnowledge:
                     edge.fuli_workflow_confirmation_authority =
                       row.workflow_confirmation_authority,
                     edge.fuli_workflow_session_authority =
-                      row.workflow_session_authority
+                      row.workflow_session_authority,
+                    edge.fuli_ai_review_lock_version = 1
                 SET edge.episodes =
                   CASE WHEN $episode_id IN coalesce(edge.episodes, [])
                        THEN edge.episodes
                        ELSE coalesce(edge.episodes, []) + $episode_id END
-                WITH count(edge) AS edge_count
-                OPTIONAL MATCH ()-[old:RELATES_TO {group_id: $group_id}]->()
-                WHERE old.invalid_at IS NULL
-                  AND NOT (old.uuid IN $relationship_ids)
-                  AND (
-                    EXISTS {
-                      MATCH (:FuliSpace {id: $space_id})-
-                            [:HAS_KNOWLEDGE_ASSIGNMENT]->
-                            (assignment:FuliKnowledgeAssignment {
-                              item_kind: 'relationship',
-                              item_id: old.uuid
-                            })
-                      WHERE assignment.project_id = $personal_project_id
-                    }
-                    OR (
-                      NOT EXISTS {
-                        MATCH (:FuliSpace {id: $space_id})-
-                              [:HAS_KNOWLEDGE_ASSIGNMENT]->
-                              (:FuliKnowledgeAssignment {
-                                item_kind: 'relationship',
-                                item_id: old.uuid
-                              })
-                      }
-                      AND EXISTS {
-                        MATCH (old_episode:Episodic {group_id: $group_id})
-                        WHERE old_episode.uuid IN coalesce(old.episodes, [])
-                          AND (
-                            old_episode.fuli_personal_project_id =
-                              $personal_project_id
-                            OR (
-                              old_episode.fuli_personal_project_id IS NULL
-                              AND $personal_project_id IS NULL
-                            )
-                          )
-                      }
-                    )
-                  )
-                  AND EXISTS {
-                    MATCH (agent_episode:Episodic {group_id: $group_id})
-                    WHERE agent_episode.uuid IN coalesce(old.episodes, [])
-                      AND (
-                        agent_episode.fuli_project_agent_id = $project_agent_id
-                        OR (
-                          agent_episode.fuli_project_agent_id IS NULL
-                          AND $project_agent_id IS NULL
-                        )
-                      )
-                  }
-                  AND any(
+                WITH episode, superseded_edges, count(edge) AS edge_count
+                CALL {
+                  WITH superseded_edges
+                  UNWIND superseded_edges AS old
+                  WITH old, head([
                     replacement IN $superseded_relationships
-                    WHERE replacement.key = old.fuli_key
-                  )
-                WITH edge_count, old, head([
-                  replacement IN $superseded_relationships
-                  WHERE replacement.key = old.fuli_key | replacement
-                ]) AS replacement
-                FOREACH (_ IN CASE WHEN old IS NULL THEN [] ELSE [1] END |
+                    WHERE replacement.key = old.fuli_key | replacement
+                  ]) AS replacement
                   SET old.invalid_at = $reference_time,
                       old.expired_at = $created_at,
                       old.fuli_replaced_by_item_id = replacement.replacement_id,
                       old.fuli_replaced_by_item_kind = 'relationship'
-                )
+                  RETURN count(*) AS _superseded_relationship_count
+                }
                 RETURN edge_count
                 ''',
                 entities=[

package/graph-provider/fuli_graph/store_project_agent_attention.py

@@ -24,7 +24,7 @@ class StoreProjectAgentAttention:
             self, actor, space, request.personal_project_id, agent_id,
             require_active=True,
             allow_unassigned=agent_id in {
-                'employee.bole', 'employee.jefa', 'fuli-project-coordinator',
+                'employee.bole', 'employee.jefa', 'employee.tonborg', 'fuli-project-coordinator',
             },
         )
         if request.task_id:

package/graph-provider/fuli_graph/store_project_agent_context.py

@@ -4,16 +4,21 @@ from .personal_project_access import authorize_personal_project
 from .project_agent_context_models import ProjectAgentContextResolution
 from .project_agent_task_models import ProjectAgentTaskSubmit
 from .task_context_temporary_owner import temporary_task_owner
+from .project_agent_delegations import StoreAgentDelegations
 
 
-class StoreProjectAgentContext:
+class StoreProjectAgentContext(StoreAgentDelegations):
     async def resolve_project_agent_context(self, actor, request):
         self._require_personal()
         space = await self.authorize(actor, request.personal_space_id, 'reader')
         await authorize_personal_project(self, actor, space, request.personal_project_id)
-        temporary_owner = await temporary_task_owner(self, actor, request)
+        temporary_owner = await temporary_task_owner(self, actor, request) if not request.delegation_token else None
         if temporary_owner is not None:
             return temporary_owner
+        policy = await self.get_project_agent_coordination_policy(
+            actor, request.personal_space_id, request.personal_project_id,
+        )
+        project_lead = getattr(policy, 'team_lead_agent_id', None)
         owner = None
         if request.session_id and not request.agent_id:
             rows, _, _ = await self.runtime.driver.execute_query(
@@ -39,7 +44,8 @@ class StoreProjectAgentContext:
             idempotency_key='read-only-task-context',
             title='Resolve task context', objective='Select one existing durable role.',
             work_kind=request.work_kind, required_capabilities=request.required_capabilities,
-            lead_agent_id=request.agent_id or owner, source_application=request.source_application,
+            lead_agent_id=request.agent_id or (project_lead if owner else None),
+            source_application=request.source_application,
             routing_reason='Read-only task-entry context recovery',
         )
         if owner and not request.agent_id:
@@ -71,16 +77,58 @@ class StoreProjectAgentContext:
                     'using project_context for continuity only',
                     *basis,
                 ]
-        if owner and selected:
+        requested_agent_id = None
+        reporting_lead_agent_id = None
+        peer_request = bool(request.agent_id and selected and self._is_implicit_peer(selected[0]))
+        delegated = bool(request.delegation_token)
+        if delegated and (not selected or selected[0]['agent_id'] != request.agent_id):
+            return ProjectAgentContextResolution(status='agent_unavailable', reason='delegation_invalid')
+        if not peer_request:
+            if not project_lead:
+                if delegated:
+                    return ProjectAgentContextResolution(status='agent_unavailable', reason='delegation_invalid')
+                return ProjectAgentContextResolution(
+                    status='unassigned', reason='project_lead_required',
+                    requested_agent_id=request.agent_id,
+                    match_basis=['Every project requires one accountable lead before work begins.'],
+                )
+            if selected and selected[0]['agent_id'] != project_lead:
+                # Validate the named specialist first, then route accountability
+                # through the lead. Never load the specialist's private memory here.
+                rows = await self._assignment_candidates(request.personal_space_id, request.personal_project_id)
+                lead = next((row for row in rows if row['agent_id'] == project_lead
+                             and (delegated or self._agent_client_allowed(row, request.source_application))), None)
+                if not lead:
+                    return ProjectAgentContextResolution(status='agent_unavailable',
+                        reason='team_lead_unavailable', match_basis=['The configured project lead is unavailable.'])
+                if delegated:
+                    # A real lead-to-member worker invocation keeps the member's
+                    # isolated identity; its result returns to the project lead.
+                    reporting_lead_agent_id = project_lead
+                    reason = 'delegated_member'
+                    basis = ['This member worker reports to the configured project lead.']
+                else:
+                    requested_agent_id = request.agent_id
+                    selected = [lead]
+                    reason = 'project_lead_reporting'
+                    basis = ['The project lead owns the task; requested members report results to this lead.']
+        if owner and selected and owner == selected[0]['agent_id']:
             reason, basis = 'active_task_owner', ['reuse the owner of this host session task']
         agent = await self.get_project_agent(
             actor, request.personal_space_id, request.personal_project_id,
             selected[0]['agent_id'],
         ) if selected else None
+        # A reporting lead does not execute in the member's client. Acknowledge
+        # the capability only after the executing role passes selection, so a
+        # failed resolution cannot be accepted as that member's answer.
+        if delegated and (not agent or not await self.redeem_agent_delegation(request, project_lead)):
+            return ProjectAgentContextResolution(status='agent_unavailable', reason='delegation_invalid')
         return ProjectAgentContextResolution(
             status='ready' if agent else (
                 'manual_selection' if reason == 'manual_agent_selection'
                 else 'agent_unavailable' if reason == 'agent_unavailable' else 'unassigned'
             ),
             agent=agent, reason=reason, match_basis=basis, candidate_count=len(candidates),
+            requested_agent_id=requested_agent_id,
+            reporting_lead_agent_id=reporting_lead_agent_id,
         )

package/graph-provider/fuli_graph/store_project_agent_coordination_policy.py

@@ -93,6 +93,8 @@ class StoreProjectAgentCoordinationPolicy:
         members = (request.team_member_agent_ids if 'team_member_agent_ids' in request.model_fields_set
                    else current.team_member_agent_ids)
         auto_grow = current.auto_grow_team if request.auto_grow_team is None else request.auto_grow_team
+        if 'team_lead_agent_id' in request.model_fields_set and not lead:
+            raise HTTPException(status_code=422, detail='each project requires a lead; select a replacement instead of clearing the lead')
         if members and not lead:
             raise HTTPException(status_code=422, detail='select a team lead before adding members')
         if lead in members:
@@ -115,9 +117,21 @@ class StoreProjectAgentCoordinationPolicy:
         updated_at = now_utc()
         written, _, _ = await self.runtime.driver.execute_query(
             '''
-            MATCH (:FuliSpace {id: $personal_space_id, kind: 'personal'})-
+            MATCH (space:FuliSpace {id: $personal_space_id, kind: 'personal'})-
                   [:CONTAINS_PROJECT]->
                   (project:FuliPersonalProject {project_id: $personal_project_id})
+            OPTIONAL MATCH (space)-[:HAS_PROJECT_AGENT_IDENTITY]->(role:FuliProjectAgent)
+            WHERE role.agent_id IN $team_agent_ids
+            WITH project, role ORDER BY role.agent_id
+            FOREACH (locked IN CASE WHEN role IS NULL THEN [] ELSE [role] END |
+              SET locked._task_lifecycle_lock = true
+              REMOVE locked._task_lifecycle_lock)
+            WITH project, collect(role) AS roles
+            WHERE size(roles) = size($team_agent_ids)
+              AND all(role IN roles WHERE role.status = 'active' AND EXISTS {
+                MATCH (project)-[:HAS_PROJECT_AGENT_ASSIGNMENT]->
+                      (:FuliProjectAgentAssignment {status: 'active'})-[:ASSIGNED_AGENT]->(role)
+              })
             MERGE (policy:FuliProjectAgentCoordinationPolicy {
               policy_id: $policy_id
             })
@@ -147,6 +161,7 @@ class StoreProjectAgentCoordinationPolicy:
             auto_grow_team=auto_grow,
             team_lead_agent_id=lead,
             team_member_agent_ids=members,
+            team_agent_ids=([lead] if lead else []) + members,
             expected_updated_at=current.updated_at,
             updated_at=updated_at,
         )

package/graph-provider/fuli_graph/store_project_agent_task_activity.py

@@ -41,6 +41,19 @@ class StoreProjectAgentTaskActivity:
             space,
             request.personal_project_id,
         )
+        if request.judgment_task_context_token:
+            # Match the task-context lifecycle lock order: session, then task.
+            # A new host turn cannot supersede the checked token before commit.
+            contexts, _, _ = await self.runtime.driver.execute_query(
+                '''
+                MATCH (:FuliSpace {id: $space_id, kind: 'personal'})-
+                      [:HAS_TASK_CONTEXT_SESSION]->(session:FuliTaskContextSession)-
+                      [:HAS_CONTEXT]->(context:FuliTaskContext {token: $token})
+                SET session.write_serial = coalesce(session.write_serial, 0) + 1
+                RETURN context.token AS token
+                ''', space_id=request.personal_space_id, token=request.judgment_task_context_token)
+            if not contexts:
+                raise HTTPException(403, 'Judgment acceptance context is unavailable')
         # Acquire the task's write lock before reading its revision, transition
         # state or idempotency events. A transaction alone permits two concurrent
         # readers to validate the same revision before either obtains a lock.
@@ -96,6 +109,19 @@ class StoreProjectAgentTaskActivity:
             if (not request.artifact_revision or raw_task.get('quality_gate') != 'passed'
                 or raw_task.get('verified_artifact_revision') != request.artifact_revision):
                 raise HTTPException(409, 'Verify this exact artifact revision before completing the task')
+        if request.expected_verification_attempt_id is not None:
+            if (request.status != 'completed' or raw_task.get('quality_gate') != 'passed'
+                or raw_task.get('verified_attempt_id') != request.expected_verification_attempt_id
+                or raw_task.get('verified_artifact_revision') != request.artifact_revision):
+                raise HTTPException(409, 'Verification evidence changed before task acceptance')
+            if not request.judgment_task_context_token or not request.source_application:
+                raise HTTPException(403, 'Judgment acceptance requires a current lead context')
+            context = await self.get_task_context(actor, request.personal_space_id,
+                request.judgment_task_context_token, request.source_application)
+            if (context.get('personal_project_id') != request.personal_project_id
+                or context.get('project_agent_id') != raw_task.get('lead_agent_id')
+                or request.agent_id != raw_task.get('lead_agent_id')):
+                raise HTTPException(403, 'Judgment acceptance requires the current accountable lead')
         self._validate_task_transition(
             raw_task.get('status'),
             request.status,

package/graph-provider/fuli_graph/store_project_agent_task_staffing.py

@@ -13,10 +13,11 @@ from .system_hr_identity import LEGACY_HR_AGENT_ID
 
 IMPLICIT_PEER_AGENT_IDS = frozenset({
     'employee.jefa',
+    'employee.tonborg',
     SYSTEM_HR_AGENT_ID.casefold(),
     LEGACY_HR_AGENT_ID.casefold(),
 })
-IMPLICIT_PEER_CAPABILITIES = frozenset({'fuli.employee:jefa', 'fuli.employee:bole'})
+IMPLICIT_PEER_CAPABILITIES = frozenset({'fuli.employee:jefa', 'fuli.employee:bole', 'fuli.employee:tonborg'})
 IMPLICIT_PEER_AGENT_TYPES = frozenset({'hr'})
 
 
@@ -54,14 +55,15 @@ class StoreProjectAgentTaskStaffing:
             row for row in assignment_rows
             if self._agent_client_allowed(row, request.source_application)
         ]
-        if request.staffing_intent in {'new_durable', 'temporary'}:
+        if request.staffing_intent in {'new_durable', 'temporary', 'default_lead'}:
             return (
                 [],
                 rows,
                 'explicit_temporary_agent'
                 if request.staffing_intent == 'temporary'
                 else 'explicit_new_agent',
-                ['user explicitly requested recruitment'],
+                ['project requires an accountable lead' if request.staffing_intent == 'default_lead'
+                 else 'user explicitly requested recruitment'],
             )
         policy = await self.get_project_agent_coordination_policy(
             actor,

package/graph-provider/fuli_graph/store_project_agents.py

@@ -5,6 +5,9 @@ from fastapi import HTTPException
 
 from .personal_project_access import authorize_personal_project
 from .project_agent_access import authorize_project_agent
+from .project_agent_employee_numbers import (
+    ASSIGN_EMPLOYEE_NUMBERS, EMPLOYEE_NUMBER_LOCK, employee_number_label,
+)
 from .project_agent_models import (
     ProjectAgentAssignmentCreate,
     ProjectAgentAssignmentEnd,
@@ -134,6 +137,7 @@ class StoreProjectAgents:
         records, _, _ = await self.runtime.driver.execute_query(
             '''
             MATCH (space:FuliSpace {id: $personal_space_id, kind: 'personal'})
+            ''' + EMPLOYEE_NUMBER_LOCK + '''
             MERGE (agent:FuliProjectAgent {id: $id})
             ON CREATE SET agent.agent_id = $agent_id,
                           agent.created_at = $updated_at,
@@ -143,7 +147,12 @@ class StoreProjectAgents:
             SET agent._profile_upsert_lock = true
             REMOVE agent._profile_upsert_lock
             WITH space, agent
-            WHERE agent.status IS NULL OR agent.status <> 'archived'
+            WHERE (agent.status IS NULL OR agent.status <> 'archived')
+              AND ($status = 'active' OR NOT EXISTS {
+                MATCH (space)-[:CONTAINS_PROJECT]->(:FuliPersonalProject)-
+                      [:HAS_PROJECT_AGENT_COORDINATION_POLICY]->(policy:FuliProjectAgentCoordinationPolicy)
+                WHERE policy.team_lead_agent_id = agent.agent_id
+              })
             SET agent.profile_json = $profile_json,
                 agent.name = $name,
                 agent.occupation_emoji = $occupation_emoji,
@@ -159,6 +168,7 @@ class StoreProjectAgents:
                   agent.recruitment_id, $recruitment_id),
                 agent.updated_at = $updated_at
             MERGE (space)-[:HAS_PROJECT_AGENT_IDENTITY]->(agent)
+            ''' + ASSIGN_EMPLOYEE_NUMBERS + '''
             RETURN agent
             ''',
             personal_space_id=request.personal_space_id,
@@ -182,7 +192,7 @@ class StoreProjectAgents:
             raise HTTPException(
                 status_code=409,
                 detail=(
-                    'archived Project Agents require a dedicated restore operation'
+                    'archived Agents require a dedicated restore operation; project leads must hand off before deactivation'
                 ),
         )
         if request.personal_project_id:
@@ -420,7 +430,12 @@ class StoreProjectAgents:
                              'awaiting_recruitment', 'queued', 'running',
                              'paused', 'blocked', 'awaiting_review'
                            ]] AS open_tasks
-            WHERE agent.status = 'archived' OR size(open_tasks) = 0
+            WHERE (agent.status = 'archived' OR size(open_tasks) = 0)
+              AND NOT EXISTS {
+                MATCH (space)-[:CONTAINS_PROJECT]->(:FuliPersonalProject)-
+                      [:HAS_PROJECT_AGENT_COORDINATION_POLICY]->(policy:FuliProjectAgentCoordinationPolicy)
+                WHERE policy.team_lead_agent_id = agent.agent_id
+              }
             SET agent.status = 'archived',
                 agent.archive_reason = coalesce(agent.archive_reason, $reason),
                 agent.archived_at = coalesce(agent.archived_at, $updated_at),
@@ -446,7 +461,7 @@ class StoreProjectAgents:
         if not records:
             raise HTTPException(
                 status_code=409,
-                detail='Agent is missing or still has non-terminal task work',
+                detail='Agent is missing, has non-terminal task work, or is a project lead; hand off before archiving',
             )
         return await self.get_project_agent(
             actor,
@@ -768,6 +783,11 @@ class StoreProjectAgents:
             WITH project, assignment, agent
             WHERE assignment.status = 'active'
               AND coalesce(assignment.revision, 0) = $expected_revision
+              AND NOT EXISTS {
+                MATCH (project)-[:HAS_PROJECT_AGENT_COORDINATION_POLICY]->
+                      (policy:FuliProjectAgentCoordinationPolicy)
+                WHERE policy.team_lead_agent_id = agent.agent_id
+              }
             SET assignment.status = 'ended',
                 assignment.end_reason = $reason,
                 assignment.ended_at = $updated_at,
@@ -786,7 +806,7 @@ class StoreProjectAgents:
         if not records:
             raise HTTPException(
                 status_code=409,
-                detail='assignment is not active or revision is stale',
+                detail='assignment is not active, revision is stale, or project leadership requires a handoff',
             )
         row = records[0]
         return self._assignment(
@@ -851,6 +871,11 @@ class StoreProjectAgents:
             REMOVE lifecycle_agent._task_lifecycle_lock
             WITH project, ended, ended_agent, replacement_agent,
                  collect(lifecycle_agent) AS locked_agents
+            WHERE ended.status <> 'active' OR NOT EXISTS {
+              MATCH (project)-[:HAS_PROJECT_AGENT_COORDINATION_POLICY]->
+                    (policy:FuliProjectAgentCoordinationPolicy)
+              WHERE policy.team_lead_agent_id = ended_agent.agent_id
+            }
             OPTIONAL MATCH (existing_replacement:FuliProjectAgentAssignment {
               id: $replacement_id
             })
@@ -1075,6 +1100,7 @@ class StoreProjectAgents:
         })
         return ProjectAgentRecord(
             agent_id=raw['agent_id'],
+            employee_number=employee_number_label(raw.get('employee_number')),
             legacy_agent_ids=list(raw.get('legacy_agent_ids') or []),
             personal_space_id=personal_space_id,
             personal_project_id=projection_project_id,

package/graph-provider/fuli_graph/system_agents.py

@@ -1,4 +1,4 @@
-"""The two fixed roles every personal space has: Jefa (project manager) and Bole (HR).
+"""Fixed roles: Jefa (project manager), Bole (HR), and Tonborg (judgment).
 
 Jefa also coordinates task routing, replacing the earlier separate coordinator
 identity. That legacy node is retired, not deleted, so old tasks keep their
@@ -8,11 +8,13 @@ original coordinator reference.
 import json
 
 from .project_agent_models import ProjectAgentProfile
+from .project_agent_employee_numbers import ASSIGN_EMPLOYEE_NUMBERS, EMPLOYEE_NUMBER_LOCK
 from .provider_values import now_utc, stable_uuid
 
 SYSTEM_COORDINATOR_AGENT_ID = 'employee.jefa'
 LEGACY_COORDINATOR_AGENT_ID = 'fuli-project-coordinator'
 SYSTEM_HR_AGENT_ID = 'employee.bole'
+SYSTEM_JUDGMENT_AGENT_ID = 'employee.tonborg'
 
 
 def coordinator_profile() -> ProjectAgentProfile:
@@ -47,9 +49,27 @@ def hr_profile() -> ProjectAgentProfile:
     )
 
 
+def judgment_profile() -> ProjectAgentProfile:
+    return ProjectAgentProfile(
+        name='Tonborg',
+        occupation_emoji='⚖️',
+        responsibility='判断官：依照用户偏好审核日常事项、建议客户端和模型，保留判断依据与反馈。',
+        agent_type='durable',
+        work_kinds=['judgment', 'knowledge-review', 'executor-selection'],
+        capabilities=['判断审核', '执行器选择', '判断反馈', 'fuli.employee:tonborg'],
+        initial_preferences=[
+            '用户明确偏好优先；只把相关范围的历史反馈用于当前判断。',
+            '不把模型建议当作已执行，不把 AI 审核冒充用户确认。',
+            '保持项目总负责人与汇报关系。',
+        ],
+        status='active',
+    )
+
+
 SYSTEM_PROFILES = {
     SYSTEM_COORDINATOR_AGENT_ID: coordinator_profile,
     SYSTEM_HR_AGENT_ID: hr_profile,
+    SYSTEM_JUDGMENT_AGENT_ID: judgment_profile,
 }
 
 
@@ -75,6 +95,7 @@ async def ensure_system_identity(driver, provider_id, space_id, agent_id):
     await driver.execute_query(
         '''
         MATCH (space:FuliSpace {id: $space_id, kind: 'personal'})
+        ''' + EMPLOYEE_NUMBER_LOCK + '''
         MERGE (agent:FuliProjectAgent {id: $id})
         ON CREATE SET agent.agent_id = $agent_id,
                       agent.name = $name,
@@ -90,7 +111,7 @@ async def ensure_system_identity(driver, provider_id, space_id, agent_id):
             agent.status = 'active',
             agent.system_managed = true
         MERGE (space)-[:HAS_PROJECT_AGENT_IDENTITY]->(agent)
-        ''',
+        ''' + ASSIGN_EMPLOYEE_NUMBERS + ' RETURN agent',
         space_id=space_id,
         id=node_id,
         agent_id=agent_id,