fuli-context 0.11.0 → 0.12.0

package/graph-provider/fuli_graph/system_hr_identity.py

@@ -149,17 +149,31 @@ async def merge_legacy_hr(store, space_id):
         '''MATCH (space:FuliSpace {id: $space_id, kind: 'personal'})
            MATCH (n) WHERE n.group_id = space.group_id
              AND (n:Entity OR n:Episodic)
-           FOREACH (_ IN CASE WHEN n.fuli_project_agent_id = $legacy_id THEN [1] ELSE [] END |
-             SET n.fuli_project_agent_id = $canonical_id, n.hr_identity_original_agent_id = $legacy_id)
-           FOREACH (_ IN CASE WHEN n.fuli_preference_agent_id = $legacy_id THEN [1] ELSE [] END |
-             SET n.fuli_preference_agent_id = $canonical_id, n.hr_identity_original_agent_id = $legacy_id)''',
+             AND (n.fuli_project_agent_id = $legacy_id
+                  OR n.fuli_preference_agent_id = $legacy_id)
+           WITH n
+           ORDER BY CASE WHEN n:Entity THEN 'entity:' ELSE 'episodic:' END +
+                    coalesce(n.uuid, '')
+           SET n.fuli_ai_review_lock_version =
+                 coalesce(n.fuli_ai_review_lock_version, 0) + 1,
+               n.fuli_project_agent_id = CASE
+                 WHEN n.fuli_project_agent_id = $legacy_id
+                 THEN $canonical_id ELSE n.fuli_project_agent_id END,
+               n.fuli_preference_agent_id = CASE
+                 WHEN n.fuli_preference_agent_id = $legacy_id
+                 THEN $canonical_id ELSE n.fuli_preference_agent_id END,
+               n.hr_identity_original_agent_id = $legacy_id''',
         **scope,
     )
     await driver.execute_query(
         '''MATCH (space:FuliSpace {id: $space_id, kind: 'personal'})
            MATCH ()-[edge:RELATES_TO]->() WHERE edge.group_id = space.group_id
              AND edge.fuli_preference_agent_id = $legacy_id
-           SET edge.fuli_preference_agent_id = $canonical_id,
+           WITH edge
+           ORDER BY 'relationship:' + coalesce(edge.uuid, '')
+           SET edge.fuli_ai_review_lock_version =
+                 coalesce(edge.fuli_ai_review_lock_version, 0) + 1,
+               edge.fuli_preference_agent_id = $canonical_id,
                edge.hr_identity_original_agent_id = $legacy_id''', **scope,
     )
     await driver.execute_query(

package/graph-provider/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fuli-graph-provider"
-version = "0.11.0"
+version = "0.12.0"
 description = "Graphiti-backed personal and shared project provider for Fuli."
 requires-python = ">=3.12"
 dependencies = [

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "fuli-context",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "fuli-context",
-      "version": "0.11.0",
+      "version": "0.12.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@a2a-js/sdk": "1.3.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fuli-context",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Local-first collaboration relationship graph for AI agents.",
   "type": "module",
   "files": [
@@ -21,7 +21,8 @@
     "graph-provider/fuli_graph/*.py",
     "graph-provider/fuli_graph/**/*.py",
     "skills/",
-    "compose.graphiti.yml"
+    "compose.graphiti.yml",
+    "docs/judgment-and-autonomy.md"
   ],
   "bin": {
     "fl": "src/cli.js",

package/src/agent-roundtable/service.js

@@ -10,7 +10,7 @@ const NESTED_ASK_LIMIT = 3;
 // Agents talk to each other directly: an ask wakes the recipient in its own
 // client and returns its answer, or waits in its inbox for its next task.
 export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFactory = randomUUID,
-  locateCwd = sessionWorkingDirectory, clientAvailable = (client) => Boolean(resolveClientCommand(client)) }) {
+  env = process.env, locateCwd = sessionWorkingDirectory, clientAvailable = (client) => Boolean(resolveClientCommand(client)) }) {
   const spaceId = () => app.config.personal.spaceId;
   // Opened on first use: most MCP processes never touch the roundtable.
   let opened = null;
@@ -35,6 +35,9 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
     const all = await agents();
     const exact = all.find((agent) => agent.agentId === needle || agent.agentId === decodeURIComponent(needle));
     if (exact) return exact;
+    const number = needle.match(/^(?:FLA\s*)?(\d{6,})$/i)?.[1];
+    const numbered = number && all.find((agent) => agent.employeeNumber === number);
+    if (numbered) return numbered;
     const named = all.filter((agent) => [agent.profile.displayName, agent.profile.name]
       .some((name) => name?.toLowerCase() === needle.toLowerCase()));
     if (named.length === 1) return named[0];
@@ -53,11 +56,12 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
 
   async function findAgents({ query = null, personalProjectId = null } = {}) {
     const needle = query?.trim().toLowerCase();
-    const matches = (await agents()).filter((agent) => !needle || [agent.agentId, agent.profile.displayName,
+    const matches = (await agents()).filter((agent) => !needle || [agent.agentId,
+      agent.employeeNumber ? `FLA ${agent.employeeNumber}` : null, agent.profile.displayName,
       agent.profile.name, agent.profile.responsibility, ...(agent.profile.capabilities ?? [])]
       .some((value) => value?.toLowerCase().includes(needle)));
     return { agents: await Promise.all(matches.slice(0, 20).map(async (agent) => ({
-      agentId: agent.agentId, name: label(agent), responsibility: agent.profile.responsibility,
+      agentId: agent.agentId, employeeNumber: agent.employeeNumber, name: label(agent), responsibility: agent.profile.responsibility,
       clients: (agent.profile.allowedClients ?? []).filter((client) => WAKE_CLIENTS.includes(client)),
       recentConversations: await conversations(agent, personalProjectId)
     }))),
@@ -107,6 +111,7 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
       to: { agentId: target.agentId, name: label(target) } });
     const nested = history.filter((message) => message.kind === 'ask' && message.status === 'delivering').length;
     if (!wait || nested >= NESTED_ASK_LIMIT) return queued(thread, ask, target, nested ? 'nested_limit' : 'not_waiting');
+    if (!taskContextToken || !from.projectId) return queued(thread, ask, target, 'task_context_required');
     const attempts = await deliveryTargets(target, conversation, from.projectId, projectPath);
     if (!attempts.length) return queued(thread, ask, target, 'no_client');
     const prompt = wakePrompt({ thread, ask, target, senderName: ask.from_name, senderClient: from.client });
@@ -117,8 +122,20 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
       if (unusable.has(delivery.client)) continue;
       store.updateMessage(ask.id, { status: 'delivering', toClient: delivery.client, toSession: delivery.sessionId });
       let answer;
+      let grant;
       try {
-        answer = await wake({ client: delivery.client, sessionId: delivery.sessionId, cwd: delivery.cwd, timeoutMs, prompt });
+        grant = await app.personal.issueAgentDelegation({ personal_space_id: spaceId(),
+          task_context_token: taskContextToken, source_application: from.client, agent_id: target.agentId,
+          target_application: delivery.client,
+          // Claude resumes into a fork with a new ID. Only Codex resumes in place.
+          target_session_id: delivery.client === 'codex' ? delivery.sessionId : null,
+          lifetime_seconds: timeoutMs / 1000 });
+        answer = await wake({ client: delivery.client, sessionId: delivery.sessionId, cwd: delivery.cwd,
+          timeoutMs, prompt, delegationToken: grant.token });
+        const verified = answer.sessionId && await app.personal.verifyAgentDelegation({
+          personal_space_id: spaceId(), token: grant.token, session_id: answer.sessionId });
+        if (!verified?.redeemed) throw Object.assign(new Error('The receiving session did not restore the Agent'),
+          { code: 'delegation_not_redeemed' });
       } catch (error) {
         failure = error.code ?? 'wake_failed';
         // A missing or logged-out client cannot answer from any session. A conversation
@@ -127,6 +144,11 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
         // A timeout already used the caller's wait.
         if (failure === 'wake_timeout') break;
         continue;
+      } finally {
+        // Even failed or timed-out attempts lose their authority. Expiry remains
+        // the fail-closed backstop if the Provider is temporarily unreachable.
+        if (grant?.token) await app.personal.revokeAgentDelegation({
+          personal_space_id: spaceId(), token: grant.token }).catch(() => {});
       }
       const via = `${delivery.client}:${delivery.sessionId ? 'resume' : 'new'}`;
       store.updateMessage(ask.id, { status: 'answered', via });
@@ -187,7 +209,14 @@ export function createAgentRoundtable({ app, openStore, wake = wakeAgent, idFact
         to: { agentId: message.to_agent, name: message.to_name, client: message.to_client } })) };
   }
 
-  return { findAgents, messageAgent, readMessages, replyMessage, threads, thread,
+  function taskEntryDelegation({ sessionId }) {
+    // The public thread header is presentation only. The Provider validates this
+    // process-local capability, including project, recipient, client and session.
+    return env.FULI_ROUNDTABLE_DELEGATION
+      ? { token: env.FULI_ROUNDTABLE_DELEGATION, sessionId: sessionId ?? null } : null;
+  }
+
+  return { findAgents, messageAgent, readMessages, replyMessage, threads, thread, taskEntryDelegation,
     pending: (agentId) => store.pendingFor(spaceId(), agentId).map(inboxItem),
     close: () => opened?.close() };
 }

package/src/agent-roundtable/wake.js

@@ -33,10 +33,11 @@ export function sessionWorkingDirectory(client, sessionId, { home = homedir(), e
 }
 
 export async function wakeAgent({ client, sessionId = null, cwd, prompt, timeoutMs = 300_000,
-  env = process.env, run = runProcess } = {}) {
+  delegationToken = null, env = process.env, run = runProcess } = {}) {
   const command = resolveClientCommand(client, { env });
   if (!command) throw Object.assign(new Error(`${client} is not installed on this machine`), { code: 'client_unavailable' });
   const childEnv = Object.fromEntries(Object.entries(env).filter(([key]) => !key.startsWith('FULI_ROUNDTABLE_')));
+  if (delegationToken) childEnv.FULI_ROUNDTABLE_DELEGATION = delegationToken;
   const result = await run(command, wakeArguments(client, { sessionId, cwd }), { cwd, env: childEnv, input: prompt, timeoutMs });
   return parseFinalAnswer(client, result);
 }

package/src/agent-tools/graph-definitions.js

@@ -36,6 +36,7 @@ import {
 } from './project-agent-definitions.js';
 import { PROJECT_AGENT_MEMORY_DEFINITIONS, workingMemorySchema } from './project-agent-memory-definitions.js';
 import { EMPLOYEE_TOOL_DEFINITIONS } from './employee-definitions.js';
+import { JUDGMENT_TOOL_DEFINITIONS } from './judgment-definitions.js';
 import { AGENT_INTERFACE_DEFINITIONS } from './interface-definitions.js';
 import { AGENT_ATTENTION_DEFINITIONS } from './agent-attention-definitions.js';
 
@@ -287,6 +288,7 @@ export const GRAPH_TOOL_DEFINITIONS = [
   ...AGENT_ATTENTION_DEFINITIONS,
   ...AGENT_INTERFACE_DEFINITIONS,
   ...EMPLOYEE_TOOL_DEFINITIONS,
+  ...JUDGMENT_TOOL_DEFINITIONS,
   {
     name: 'begin_task_context',
     title: 'LIFECYCLE · Begin a Fuli-aware task',

package/src/agent-tools/graph-handlers.js

@@ -4,6 +4,13 @@ import { activeTestToolsEnabled } from '../app/agent-request-context.js';
 import { agentInterfaceCatalog } from './interface-catalog.js';
 
 const HANDLERS = Object.freeze({
+  get_judgment_policy: (app, input) => app.judgment.policy(input),
+  list_judgments: (app, input) => app.judgment.records(input),
+  review_with_tonborg: (app, input) => app.judgment.review(input),
+  assess_agent_action: (app, input) => app.judgment.assess(input),
+  assess_task_completion: (app, input) => app.judgment.accept(input),
+  get_agent_pins: (app, input) => app.judgment.pins(input),
+  pin_agent: (app, input) => app.judgment.pin(input),
   get_agent_quality_gate: (app, input) => app.agentVerification('query', input),
   record_agent_verification: (app, input) => app.agentVerification('record', input),
   plan_agent_collaboration: (app, input) => app.planAgentCollaboration(input),

package/src/agent-tools/interface-catalog.js

@@ -1,4 +1,10 @@
 const UI_MUTATION_PARITY = Object.freeze([
+  agent('PUT /api/agent-pins', 'pin_agent'),
+  local('PUT /api/judgment/policy', 'Autonomy grants delegated authority and requires the local user.'),
+  local('POST /api/judgment/feedback', 'Votes and reasons are human feedback, never model-generated approval.'),
+  agent('POST /api/judgment/review', 'review_with_tonborg'),
+  agent('POST /api/judgment/assess', 'assess_agent_action'),
+  agent('POST /api/judgment/accept', 'assess_task_completion'),
   agent('POST /api/agent-conversations/query', 'list_agent_conversations', 'read_agent_conversation', 'get_agent_conversation_policy'),
   agent('PUT /api/agent-conversations/policy', 'update_agent_conversation_policy'),
   agent('POST /api/agent-attention', 'request_agent_attention'),

package/src/agent-tools/judgment-definitions.js

@@ -0,0 +1,12 @@
+import { objectSchema, stringSchema, integerSchema, booleanSchema } from './schema.js';
+const id = { ...stringSchema(), minLength: 1, maxLength: 256 };
+const scope = { personalSpaceId: id, personalProjectId: { ...id, type: ['string', 'null'] } };
+export const JUDGMENT_TOOL_DEFINITIONS = [
+  { name: 'get_judgment_policy', title: 'READ · Tonborg autonomy', description: 'Read effective autonomy and quality preferences, including project inheritance. Only the user changes autonomy in Settings. Never infer permission from a recommendation.', inputSchema: objectSchema(scope, ['personalSpaceId']) },
+  { name: 'list_judgments', title: 'READ · Tonborg decisions', description: 'Read scoped decisions, execution receipts and human feedback. A recommendation is not evidence of execution. Feedback is scoped evidence, not a new global instruction.', inputSchema: objectSchema({ ...scope, limit: integerSchema({ minimum: 1, maximum: 100 }) }, ['personalSpaceId']) },
+  { name: 'review_with_tonborg', title: 'WRITE · Tonborg review', description: 'Run a bounded real-model review under the saved autonomy policy. Manual mode only analyzes. AI-reviewed never asserts human confirmation. Reuse requestId on retries; failures and stale evidence remain visible. May invoke the locally configured judgment client.', inputSchema: objectSchema({ ...scope, requestId: id, limit: integerSchema({ minimum: 1, maximum: 10 }) }, ['personalSpaceId', 'requestId']) },
+  { name: 'assess_agent_action', title: 'READ · Tonborg executor judgment', description: 'Before a new subagent, session or client choice, ask Tonborg whether to continue, delegate, reuse a verified conversation or open a new session, and select from authorized, preflighted executors and their available models using scoped preferences and feedback. Respect locked Agent policies and user rules. The host still validates and starts workers. Report actual runtime separately; this does not grant permission or claim execution.', inputSchema: objectSchema({ ...scope, requestId: id, objective: { ...stringSchema(), minLength: 1, maxLength: 8000 }, agentId: id, workKind: id, taskId: id, requiredCapabilities: { type: 'array', items: id, maxItems: 32 }, action: { type: 'string', enum: ['subagent', 'session', 'client'] } }, ['personalSpaceId', 'personalProjectId', 'requestId', 'objective', 'agentId', 'workKind']) },
+  { name: 'assess_task_completion', title: 'WRITE · Tonborg task acceptance', description: 'The accountable lead asks Tonborg to assess an awaiting-review FULI task at its exact revision. Saved autonomy may complete it only with a passed real verification by another Agent. Preserves Jefa human acceptance and never approves publication or new permissions. Reuse requestId on retries; inspect the actual execution receipt.', inputSchema: objectSchema({ ...scope, requestId: id, taskContextToken: id, taskId: id, artifactRevision: { ...id, maxLength: 160 }, expectedRevision: integerSchema({ minimum: 0 }) }, ['personalSpaceId', 'personalProjectId', 'requestId', 'taskContextToken', 'taskId', 'artifactRevision', 'expectedRevision']) },
+  { name: 'get_agent_pins', title: 'READ · Pinned Agents', description: 'Read the user’s pinned Agent IDs and revision. An explicit empty list remains empty.', inputSchema: objectSchema({ personalSpaceId: id }, ['personalSpaceId']) },
+  { name: 'pin_agent', title: 'WRITE · Pin an Agent', description: 'On the user’s request pin or unpin an existing Agent in navigation. Preserve the current revision and reload after conflicts.', inputSchema: objectSchema({ personalSpaceId: id, agentId: id, pinned: booleanSchema(), expectedRevision: integerSchema({ minimum: 0 }) }, ['personalSpaceId', 'agentId', 'pinned', 'expectedRevision']) },
+];

package/src/agents/claude-code/wake.js

@@ -8,6 +8,13 @@ import { firstField, listDirectory } from '../session-log.js';
 export const claudeCodeWake = Object.freeze({
   id: 'claude_code',
 
+  judgmentArgs({ quality }) {
+    return ['-p', '--output-format', 'stream-json', '--verbose', '--safe-mode',
+      '--tools', '', '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}',
+      '--setting-sources', '', '--no-session-persistence', '--permission-mode', 'dontAsk',
+      '--effort', quality === 'economy' ? 'low' : quality === 'balanced' ? 'medium' : 'high'];
+  },
+
   resolveCommand({ env, which, platform }) {
     return env.FULI_CLAUDE_BIN || which('claude', platform);
   },

package/src/agents/codex/wake.js

@@ -9,6 +9,13 @@ import { findFile, firstField, listDirectory } from '../session-log.js';
 export const codexWake = Object.freeze({
   id: 'codex',
 
+  judgmentArgs({ cwd, quality }) {
+    return ['exec', '--json', '--ephemeral', '--ignore-user-config', '--ignore-rules',
+      '--skip-git-repo-check', '--sandbox', 'read-only', '-C', cwd,
+      '-c', 'project_doc_max_bytes=0', '-c', 'features.shell_tool=false',
+      '-c', `model_reasoning_effort="${quality === 'economy' ? 'low' : quality === 'balanced' ? 'medium' : 'high'}"`, '-'];
+  },
+
   resolveCommand({ env, which, platform, fileExists = existsSync }) {
     if (env.FULI_CODEX_BIN) return env.FULI_CODEX_BIN;
     const found = which('codex', platform);

package/src/agents/identity-receipt.js

@@ -22,14 +22,14 @@ function agentLink(application, agentId, name) {
 // The reply's attribution line: who led the task and who actually helped.
 export function taskAgentReceipt(application, { projectId, agentId, name = null,
   sourceApplication = null, workStatus = null, conversationId = null, persistence = null,
-  collaborators = [] }) {
+  collaborators = [], assignmentStatus = null, assignmentReason = null }) {
   const owner = agentId ? { agent_id: agentId, name,
     profile_url: agentProfileUrl(application, agentId), source_application: sourceApplication } : null;
   const helpers = owner ? collaborators.filter(item => item.agentId !== agentId) : [];
   const markdown = owner
     ? `FULI Agent：负责人 ${agentLink(application, agentId, name)}`
       + (helpers.length ? ` · 协作 ${helpers.map(item => agentLink(application, item.agentId, item.name)).join('、')}` : '')
-    : 'FULI Agent：未选定';
+    : unassignedReceipt(assignmentStatus, assignmentReason);
   return { required: true, markdown, owner,
     collaborators: helpers.map(item => ({ agent_id: item.agentId, name: item.name,
       profile_url: agentProfileUrl(application, item.agentId) })),
@@ -38,6 +38,24 @@ export function taskAgentReceipt(application, { projectId, agentId, name = null,
     guidance: 'MUST end every final user-visible reply with agent_receipt.markdown unchanged, exactly once, including greetings, status and errors, even when capture is disabled or nothing is retained. The receipt returned by checkpoint_task_knowledge supersedes the entry receipt because it names actual collaborators. Never invent an owner or a collaborator.' };
 }
 
+function unassignedReceipt(status, reason) {
+  if (!status) return 'FULI Agent：分配未完成（任务没有可用负责人）';
+  if (status === 'project_unresolved') {
+    return reason === 'ambiguous' ? 'FULI Agent：分配待确认（项目归属待确认）'
+      : reason === 'session_identity_required' ? 'FULI Agent：分配失败（缺少会话标识）'
+        : 'FULI Agent：分配失败（项目归属未能恢复）';
+  }
+  const labels = {
+    unavailable: '分配失败（服务或身份恢复不可用）',
+    agent_unavailable: '分配失败（指定 FLA 不可用）',
+    agent_not_found: '分配失败（指定 FLA 不存在）',
+    ambiguous_agent: '分配待确认（存在同名 FLA）',
+    agent_selection_conflict: '分配待确认（FLA 选择冲突）',
+    manual_selection: '分配待确认（需要选择负责人）'
+  };
+  return `FULI Agent：${labels[status] ?? '分配未完成（HR 尚未返回负责人）'}`;
+}
+
 export function employeeCollaborationReceipt(application, context, { tool, permission, sourceApplication }) {
   return { agent_id: context.agentId, name: context.name, role: context.role,
     profile_url: agentProfileUrl(application, context.agentId),

package/src/employees/catalog/tonborg.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": 1,
+  "id": "tonborg",
+  "version": "1.0.0",
+  "name": "Tonborg",
+  "role": "判断官",
+  "description": "根据你的偏好与判断记录处理日常审核，为任务建议客户端和模型。",
+  "occupationEmoji": "⚖️",
+  "defaultProjectScope": "all",
+  "workbench": { "kind": "native", "view": "judgment" },
+  "capabilities": ["判断审核", "执行器选择", "判断反馈", "fuli.employee:tonborg"],
+  "workKinds": ["judgment", "knowledge-review", "executor-selection"],
+  "initialPreferences": [
+    "优先考虑用户明确偏好和当前任务证据；反馈只用于适用的范围。",
+    "记录判断依据与执行结果，权限不足或证据不足时交给用户。",
+    "保持项目负责人的汇报关系，不越过项目管理。"
+  ],
+  "permissions": ["judgment.read", "judgment.review"],
+  "runtime": null
+}

package/src/employees/manifest.js

@@ -29,7 +29,7 @@ export const employeeManifestSchema = z.object({
   }).strict().optional(),
   workbench: z.object({
     kind: z.literal('native'),
-    view: z.literal('people')
+    view: z.enum(['people', 'judgment'])
   }).strict().optional(),
   runtime: z.object({
     apiVersion: z.literal(1),
@@ -45,7 +45,7 @@ export function parseEmployeeManifest(value) {
 }
 
 // Built-in roles every personal space has; the Provider provisions their identities.
-export const FIXED_EMPLOYEE_AGENT_TYPES = Object.freeze({ jefa: 'coordinator', bole: 'hr' });
+export const FIXED_EMPLOYEE_AGENT_TYPES = Object.freeze({ jefa: 'coordinator', bole: 'hr', tonborg: 'durable' });
 
 export const employeeAgentId = (id) => `employee.${identifier.parse(id)}`;
 export const employeeCapability = (id) => `fuli.employee:${identifier.parse(id)}`;

package/src/employees/recruitment.js

@@ -186,7 +186,8 @@ export function createEmployeeRecruitment({ app, registry, managementStore }) {
     // All-project policy also covers projects without a materialized assignment.
     const agents = await app.listProjectAgents({ personalSpaceId: spaceId });
     const agent = agents.find((entry) => entry.agentId === employeeAgentId(manifest.id));
-    const management = managementFor(manifest, agent, managementStore.read(spaceId, manifest.id));
+    const stored = managementStore.read(spaceId, manifest.id);
+    const management = managementFor(manifest, agent, stored);
     if (input.sourceApplication && Array.isArray(agent?.profile.allowedClients) && !agent.profile.allowedClients.includes(input.sourceApplication)) {
       throw new EmployeeError('This employee is not enabled for the current Agent client', 403, 'assignment_required');
     }
@@ -196,6 +197,24 @@ export function createEmployeeRecruitment({ app, registry, managementStore }) {
       (management.mode !== 'all' && !(agent.assignments ?? []).some((entry) => entry.personalProjectId === selectedProject.id && entry.status === 'active'))) {
       throw new EmployeeError('Recruit this employee into the selected project first', 403, 'assignment_required');
     }
+    if (manifest.id === 'tonborg' && input.ensureAssignment === true &&
+      !activeEmployeeAssignments(agent).some(entry => entry.personalProjectId === selectedProject.id)) {
+      // Provider memory is project-scoped. Preserve the already authorized all
+      // rule before its first concrete assignment, without launching a worker.
+      if (!stored) managementStore.write(spaceId, manifest.id, managementWithoutRevision(management), 0);
+      const history = (agent.assignments ?? []).filter(entry => entry.personalProjectId === selectedProject.id);
+      const generation = history.map(entry => `${entry.assignmentId}:${entry.revision ?? 0}`).sort();
+      const key = createHash('sha256').update(JSON.stringify([manifest.id, selectedProject.id, generation])).digest('hex');
+      await app.createProjectAgentAssignment({
+        personalSpaceId: spaceId, personalProjectId: selectedProject.id, agentId: agent.agentId,
+        idempotencyKey: `employee-assignment:${key}`, responsibility: agent.profile.responsibility,
+        workKinds: agent.profile.workKinds ?? manifest.workKinds, capabilities: agent.profile.capabilities,
+        reason: 'Initialize authorized Tonborg project memory',
+      });
+      // Assignment storage is asynchronous; a concurrent scope/client change
+      // must be observed before any judgment evidence is read.
+      return authorize({ ...input, ensureAssignment: false });
+    }
     return { personalSpaceId: spaceId, project: selectedProject, agentId: agent.agentId, management };
   }
 

package/src/graphiti/agent-collaboration.js

@@ -30,11 +30,17 @@ export async function planAgentCollaboration(application, input) {
   }
   candidates.sort((a, b) => Number(a.requiresLoan) - Number(b.requiresLoan) || Number(b.workMatch) - Number(a.workMatch)
     || a.activeTasks - b.activeTasks || a.agentId.localeCompare(b.agentId));
+  const preferencePrompt = verificationPreference({ executors, rules, projectId: task.personalProjectId,
+    lockedExecutorIds: currentAgent.profile?.executorPolicy?.mode === 'locked' ? currentAgent.profile.executorPolicy.lockedExecutorIds : null });
+  const judgmentPolicy = await application.judgment?.policy({ personalSpaceId: spaceId, personalProjectId: task.personalProjectId });
+  if (judgmentPolicy && judgmentPolicy.mode !== 'manual' && preferencePrompt.choiceSource !== 'user_rule') {
+    Object.assign(preferencePrompt, { shouldAsk: false, recommendedExecutorId: null, choiceSource: 'tonborg',
+      guidance: 'The user delegated routine executor choices to Tonborg. Call assess_agent_action for the selected specialist before dispatch; ask only when its outcome requires user input. Recheck runtime availability and preserve the real execution receipt.' });
+  }
   return { teamLeadId: policy.team_lead_agent_id, currentAgentId: task.projectAgentId,
     candidates: candidates.slice(0, 8), pendingLoans: loans.loans?.filter(loan => loan.status === 'requested') ?? [],
     executionStarted: false,
-    preferencePrompt: verificationPreference({ executors, rules, projectId: task.personalProjectId,
-      lockedExecutorIds: currentAgent.profile?.executorPolicy?.mode === 'locked' ? currentAgent.profile.executorPolicy.lockedExecutorIds : null }),
+    preferencePrompt,
     guidance: 'Keep the project lead as owner. Choose a qualified specialist. For another project, the destination lead calls request_agent_loan; the source lead approves with decide_agent_loan in its own scoped task. Then coordinate_project_agent_task with the borrowed Agent. Share only the bounded task brief and authorized artifacts. Record actual workers. Verify each artifact; use record_agent_verification. Two failed attempts at one capability tier require escalation, not another identical retry. A selected model is not proof of execution or success.' };
 }
 

package/src/graphiti/federated-application.js

@@ -2,6 +2,9 @@ import { dirname, join } from 'node:path';
 import { createEmployeeService } from '../employees/service.js';
 import { createAgentRoundtable } from '../agent-roundtable/service.js';
 import { createRoundtableStore } from '../agent-roundtable/store.js';
+import { createJudgmentService } from '../judgment/service.js';
+import { JudgmentStore } from '../judgment/store.js';
+import { createJudgmentEngine } from '../judgment/engine.js';
 
 import { GraphitiProviderClient } from './provider-client.js';
 import {
@@ -81,6 +84,7 @@ import {
 import { buildUserTasteSkill } from './user-taste-skill.js';
 import { taskEntryPreferences } from './task-entry-preferences.js';
 import { TASK_ENTRY_TOOLS, registerRepositoryProject } from './repository-project-registration.js';
+import { resolveTaskEntryProject } from './task-entry-project-scope.js';
 import { getWritingTasteProfile as getWritingTasteProfileWorkflow } from './writing-taste-profile-workflow.js';
 import {
   groupSubscriptions,
@@ -119,7 +123,9 @@ export function openFederatedGraphApplication({
       fetchImpl
     });
     app.employees = createEmployeeService({ app, runtimeConfigPath });
-    app.roundtable = createAgentRoundtable({ app,
+    app.judgment = createJudgmentService({ app, engine: createJudgmentEngine({ app }),
+      openStore: () => new JudgmentStore(join(dirname(runtimeConfigPath), 'judgment.sqlite')) });
+    app.roundtable = createAgentRoundtable({ app, env,
       openStore: () => createRoundtableStore(join(dirname(runtimeConfigPath), 'agent-roundtable.sqlite')) });
   }
   return app;
@@ -267,6 +273,9 @@ export class FederatedGraphApplication extends ProjectAgentControlPlaneApplicati
       // Every task gets a FULI Agent, so a task in an unregistered repository registers it.
       projectResolution = await registerRepositoryProject(this, projectResolution);
     }
+    projectResolution = await resolveTaskEntryProject(this, projectResolution, {
+      sessionId, sourceSessionId, sourceApplication, agentInvocation, agentToolName
+    });
     return taskEntryPreferences(this, projectResolution, {
       personalProjectId, projectAgentId, projectPath, taskPrompt, sourceApplication,
       sourceSessionId, sessionId, turnId, workKind, requiredCapabilities,
@@ -1160,7 +1169,7 @@ export class FederatedGraphApplication extends ProjectAgentControlPlaneApplicati
     };
   }
 
-  close() { this.roundtable?.close(); return this.employees?.close(); }
+  close() { this.judgment?.close(); this.roundtable?.close(); return this.employees?.close(); }
 
   async #recordAgentViews(items, toolName) {
     const unique = new Map(items.map((item) => [

package/src/graphiti/knowledge-review.js

@@ -3,7 +3,8 @@ export function startKnowledgeReview(app, input) {
   return app.personal.startKnowledgeReview({
     personal_space_id: input.personalSpaceId,
     scope: input.scope,
-    personal_project_id: input.personalProjectId ?? null
+    personal_project_id: input.personalProjectId ?? null,
+    ...(input.reviewer ? { reviewer: input.reviewer } : {})
   });
 }
 
@@ -12,7 +13,8 @@ export function listKnowledgeReviewCandidates(app, input) {
   return app.personal.listKnowledgeReviewCandidates({
     personal_space_id: input.personalSpaceId,
     review_id: input.reviewId,
-    limit: input.limit
+    limit: input.limit,
+    ...(input.offset !== undefined ? { offset: input.offset } : {})
   });
 }
 
@@ -23,7 +25,9 @@ export function recordKnowledgeReviewProgress(app, input) {
     review_id: input.reviewId,
     candidate_key: input.candidateKey,
     outcome: input.outcome,
-    note: input.note ?? null
+    note: input.note ?? null,
+    ...(input.aiReviewEvidenceToken ? { ai_review_evidence_token: input.aiReviewEvidenceToken } : {}),
+    ...(input.aiAssessment ? { ai_assessment: input.aiAssessment } : {})
   });
 }
 

package/src/graphiti/project-agent-mapping.js

@@ -71,6 +71,8 @@ export function projectAgentRecord(value) {
     Object.hasOwn(profile, 'display_name'));
   copyOptional(result, 'legacyAgentIds', value.legacy_agent_ids,
     Object.hasOwn(value, 'legacy_agent_ids'));
+  copyOptional(result, 'employeeNumber', value.employee_number,
+    Object.hasOwn(value, 'employee_number'));
   copyOptional(result.profile, 'workKinds', profile.work_kinds,
     Object.hasOwn(profile, 'work_kinds'));
   copyOptional(
@@ -341,6 +343,8 @@ export function projectAgentTokenUsage(value) {
 export function providerProjectAgentTaskActivity(input) {
   const result = withoutUndefined({
     artifact_revision: input.artifactRevision ?? input.artifact_revision,
+    expected_verification_attempt_id: input.expectedVerificationAttemptId,
+    judgment_task_context_token: input.judgmentTaskContextToken,
     personal_space_id: input.personalSpaceId ?? input.personal_space_id,
     personal_project_id: input.personalProjectId ?? input.personal_project_id,
     task_id: input.taskId ?? input.task_id,

package/src/graphiti/project-agent-task-entry.js

@@ -8,7 +8,11 @@ const ENTRY_TOOLS = new Set(['begin_task_context', 'get_collaboration_preference
 
 export async function resolveTaskEntryAgent(application, resolution, input) {
   if (!input.agentInvocation || !ENTRY_TOOLS.has(input.agentToolName)) return null;
-  if (!resolution.personalProjectId) return { status: 'project_unresolved', worker_started: false };
+  if (!resolution.personalProjectId) return {
+    status: resolution.status === 'unavailable' ? 'unavailable' : 'project_unresolved',
+    reason: resolution.reason ?? resolution.status,
+    worker_started: false
+  };
   try {
     const mention = await resolveTaskAgentMention(application, resolution.personalProjectId, input);
     if (mention?.status) return mention;
@@ -18,19 +22,33 @@ export async function resolveTaskEntryAgent(application, resolution, input) {
       personal_project_id: resolution.personalProjectId,
       source_application: input.sourceApplication ?? 'other'
     };
-    let value = await application.personal.resolveProjectAgentContext({
+    const contextRequest = {
       ...scope,
       agent_id: mention?.agentId ?? input.projectAgentId ?? null,
       session_id: input.sessionId ?? null,
       turn_id: input.turnId ?? null,
       work_kind: workKind,
       required_capabilities: input.requiredCapabilities ?? []
+    };
+    const delegation = application.roundtable?.taskEntryDelegation?.({
+      sessionId: input.receivingSessionId ?? input.sessionId
     });
+    if (delegation) {
+      contextRequest.delegation_token = delegation.token;
+      contextRequest.delegation_session_id = delegation.sessionId;
+    }
+    let value = await application.personal.resolveProjectAgentContext(contextRequest);
+    if (value?.reason === 'project_lead_required') {
+      await application.personal.staffDefaultProjectLead(scope);
+      // Re-resolve after staffing so a requested specialist is not lost and a
+      // concurrent successful hire is handled without selecting another owner.
+      value = await application.personal.resolveProjectAgentContext(contextRequest);
+    }
     if (!value?.status) throw new Error('Role resolution is unavailable');
     let agent = value.agent ? projectAgentRecord(value.agent) : null;
     const implicit = !mention?.agentId && !input.projectAgentId;
     const peerOnly = agent && implicit && unrelatedPeer(agent, workKind, input.requiredCapabilities);
-    if (implicit && (peerOnly || value.status === 'unassigned')) {
+    if (implicit && value.reason !== 'project_lead_required' && (peerOnly || value.status === 'unassigned')) {
       // Every task gets a FULI Agent: a project without a lead has HR hire one.
       const staffed = await application.personal.staffDefaultProjectLead(scope).catch(() => null);
       if (staffed?.agent) {
@@ -141,8 +159,8 @@ function boundedRoleText(value, limit) {
 function unrelatedPeer(agent, workKind, required = []) {
   const profile = agent.profile;
   const capabilities = (profile.capabilities ?? []).map(value => value.toLowerCase());
-  const peer = ['employee.jefa', 'employee.bole', 'fuli-project-hr'].includes(agent.agentId)
-    || profile.agentType === 'hr' || capabilities.some(value => ['fuli.employee:jefa', 'fuli.employee:bole'].includes(value));
+  const peer = ['employee.jefa', 'employee.bole', 'employee.tonborg', 'fuli-project-hr'].includes(agent.agentId)
+    || profile.agentType === 'hr' || capabilities.some(value => ['fuli.employee:jefa', 'fuli.employee:bole', 'fuli.employee:tonborg'].includes(value));
   return peer && !(profile.workKinds ?? []).some(kind => kind.toLowerCase() === workKind.toLowerCase())
     && !(required.length && required.every(value => capabilities.includes(value.toLowerCase())));
 }

package/src/graphiti/project-agent-team-context.js

@@ -15,7 +15,10 @@ export async function loadProjectTeamContext(application, personalSpaceId, proje
         && assignment.status === 'active')?.responsibility || agent.profile?.responsibility,
       role: agent.agent_id === policy.team_lead_agent_id ? 'lead' : 'member' }));
   return { lead_agent_id: policy.team_lead_agent_id, roster,
+    user_facing_agent_id: policy.team_lead_agent_id,
+    reporting_lines: roster.filter(agent => agent.role === 'member')
+      .map(agent => ({ agent_id: agent.agent_id, reports_to_agent_id: policy.team_lead_agent_id })),
     unavailable_agent_ids: ids.filter(id => !roster.some(agent => agent.agent_id === id)),
     peer_roles: ['hr', 'project_manager'], worker_started: false,
-    guidance: 'The team lead is the user-facing owner. Split bounded work among team members through an authorized coordination plan; report real worker evidence. HR and project managers remain peers. Team membership grants no new tool, data, executor, or publication permissions.' };
+    guidance: 'The project lead is the sole user-facing owner. Members report results and blockers to this lead; do not skip reporting levels or replace the lead when a member is named. The lead integrates and verifies member reports before reporting to the user. Split bounded work through an authorized coordination plan; report real worker evidence. HR and project managers remain peers. Team membership grants no new tool, data, executor, or publication permissions.' };
 }

package/src/graphiti/provider-client.js

@@ -153,6 +153,15 @@ export class GraphitiProviderClient {
   resolveProjectAgentContext(input) {
     return this.#request('/v1/project-agent-context/resolve', { method: 'POST', body: input });
   }
+  issueAgentDelegation(input) {
+    return this.#request('/v1/project-agent-context/delegations', { method: 'POST', body: input });
+  }
+  verifyAgentDelegation(input) {
+    return this.#request('/v1/project-agent-context/delegations/verify', { method: 'POST', body: input });
+  }
+  revokeAgentDelegation(input) {
+    return this.#request('/v1/project-agent-context/delegations/revoke', { method: 'POST', body: input });
+  }
   recentAgentSessions({ personalSpaceId, agentId, personalProjectId = null, limit = 5 }) {
     const query = new URLSearchParams({ personal_space_id: personalSpaceId, project_agent_id: agentId, limit: String(limit) });
     if (personalProjectId) query.set('personal_project_id', personalProjectId);