kenaz 0.3.5 → 0.3.7

package/core/.rule/general/system-invariants.yaml

@@ -90,19 +90,6 @@ invariants:
 # Parallel execution caps, locks, isolation boundaries
 # ============================================================================
 
-  - name: max_parallel_dispatches
-    category: concurrency
-    formula: "concurrent_worktree_dispatches ≤ MAX_PARALLEL"
-    bound: "MAX_PARALLEL = 5"
-    enforcement: |
-      Semaphore in formations.js dispatch loop — when count reaches
-      MAX_PARALLEL, new dispatches wait. Logs "Max parallel dispatches
-      reached (N/5), waiting...".
-    violation_detection: |
-      Count live worktree dispatches (.formation/worktrees/task_*/ with
-      active child processes); if > 5, semaphore leaked.
-    source: ".formation/tools/formations.js#L773-L810 (MAX_PARALLEL semaphore)"
-
   - name: worktree_isolation_boundary
     category: concurrency
     formula: |
@@ -111,17 +98,13 @@ invariants:
        repo paths)
     bound: "one worktree per active dispatch; no cross-worktree writes"
     enforcement: |
-      runner.js spawn-time prompt injection — spawnClaude() and spawnBifrost()
-      prepend "[WORKTREE] All file operations MUST use paths under:
-      <worktreeDir>" (the CONCRETE path) to the final prompt whenever
-      worktreeDir is set. Agent-tool dispatch additionally carries
-      SUBAGENT_PREFIX rule 11 (WORKTREE FILE PATH RULE) in prompt.js.
-      (TASK_1819: the former do.yaml worktree_path_rule field was a dead
-      field — never rendered by prompt.js — and has been removed.)
+      Agent-tool dispatch carries SUBAGENT_PREFIX rule 11 (WORKTREE FILE
+      PATH RULE) in prompt.js. (The former runner.js spawn-time "[WORKTREE]"
+      injection was removed with the headless path, TASK_2401.)
     violation_detection: |
       Agent Edits a path under main repo root while cwd is a worktree →
       `git add -A` in worktree finds no changes. See FAIL-013.
-    source: ".formation/tools/runner.js#L958,L1069 ([WORKTREE] prompt injection) + .formation/tools/prompt.js SUBAGENT_PREFIX rule 11"
+    source: ".formation/tools/prompt.js SUBAGENT_PREFIX rule 11"
     failure_witness: ".failure/agent-execution/FAIL-013-search-cwd-drift-and-case-mismatch.yaml"
 
   - name: per_project_dispatch_lock
@@ -129,13 +112,13 @@ invariants:
     formula: "per-project dispatch-lock serializes non-worktree dispatches"
     bound: "1 in-flight serial dispatch per project at a time"
     enforcement: |
-      Dispatch-lock fallback in formations.js — when worktree parallel
-      slot unavailable or task unsuitable for worktree, fall back to
-      per-project serial lock.
+      Dispatch-lock fallback in dispatch.js (tryAcquireDispatchLock) — when a
+      worktree is unavailable or the task is unsuitable for one, fall back
+      to the per-project serial lock.
     violation_detection: |
       Two concurrent non-worktree dispatches writing the same project
       state (e.g., task-api moves). Lock contention visible in logs.
-    source: ".formation/tools/formations.js#L773 (parallel semaphore + serial dispatch-lock fallback)"
+    source: ".formation/tools/dispatch.js (tryAcquireDispatchLock) + .formation/tools/utils.js (dispatchLockPath)"
 
 # ============================================================================
 # CATEGORY: cognitive

package/core/.specialist/Ansuz/SYSTEM_DOC.md

@@ -36,7 +36,7 @@
 身份: "Ansuz = 產品全生命週期引擎（PM + Lead 合一）"
 行為規則:
   ❌ 不 invoke 其他 Skill — 不切換身份
-  ✅ 需要執行時 → Formation 系統 dispatch（Task tool + headless.js）
+  ✅ 需要執行時 → Agent tool subagent dispatch（dispatch.js --dispatch-mode=subagent）
   ✅ 本體負責：需求理解、任務設計、陣型判斷、調度、追蹤、回報
   ❌ 不親自寫程式碼 — 只做決策和調度
 ```
@@ -44,7 +44,7 @@
 **工作模式**：
 - **Ansuz = 指揮官 + 調度者**，不是執行者
 - 所有實作交給 Formation 系統的 agent（developer, backend, designer...）
-- 通過 `.formation/tools/headless.js` 啟動獨立 Claude CLI 進程執行任務
+- 通過 `.formation/tools/dispatch.js` 組裝 prompt，再由 Agent tool subagent 執行任務
 
 ### 2. 事件驅動生命週期（7 Phases）
 
@@ -146,7 +146,7 @@ fi
 
 # 子專案範例
 node {CORE}/.collaboration/core/task-api.js --project-path {PROJECT_PATH} list
-node {CORE}/.formation/tools/headless.js --project-path {PROJECT_PATH} --skill=do --task=TASK_XXX
+node {CORE}/.formation/tools/dispatch.js --project-path {PROJECT_PATH} --skill=do --task=TASK_XXX --dispatch-mode=subagent
 node {CORE}/.formation/tools/post-complete.js --task=TASK_XXX --project-path={PROJECT_PATH}
 ```
 
@@ -154,48 +154,26 @@ node {CORE}/.formation/tools/post-complete.js --task=TASK_XXX --project-path={PR
 
 ### 2. Dispatch 執行機制
 
-**工具**: `.formation/tools/headless.js`
-**方法**: Bash tool → `node headless.js` → 啟動獨立 Claude CLI 進程
+**工具**: `.formation/tools/dispatch.js`
+**方法**: Bash tool → `node dispatch.js --dispatch-mode=subagent` → 取回 `promptText` + `agentParams` → Agent tool 開 subagent
+（headless CLI 進程、squad/legion 陣型已退役；只剩 unit/solo skill。）
 
 **CLI 命令格式**：
 
 ```bash
 # Unit 陣型
-node .formation/tools/headless.js --skill=do --task=TASK_XXX
+node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent
 
 # Solo 陣型
-node .formation/tools/headless.js --formation=solo --skill=strategy --task=TASK_XXX
-
-# Squad 陣型
-node .formation/tools/headless.js --formation=squad --skill=blitz --task=TASK_XXX
-
-# Legion 陣型
-node .formation/tools/headless.js --formation=legion --skill=forge --task=TASK_XXX
-```
-
-**並行模式**：
-
-```javascript
-// 單任務（單一 Bash）
-Bash(run_in_background: true): node headless.js --task=TASK_148
-
-// 並行多任務（多個 Bash 同時啟動）
-Bash(run_in_background: true): node headless.js --task=TASK_148
-Bash(run_in_background: true): node headless.js --task=TASK_149
-Bash(run_in_background: true): node headless.js --task=TASK_150
-
-// 有依賴（順序執行）
-Bash: node headless.js --task=TASK_147
-// 等待完成後
-Bash: node headless.js --task=TASK_148
+node .formation/tools/dispatch.js --formation=solo --skill=strategy --task=TASK_XXX --dispatch-mode=subagent
 ```
 
 **關鍵規則**：
 - ✅ 所有調度必須經過 `.collaboration` 任務系統
-- ✅ 流程：create → claim → dispatch(headless.js) → complete
-- ✅ 用 Bash tool 呼叫 headless.js，`run_in_background=true` 實現並行
+- ✅ 流程：create → dispatch.js(subagent) → Agent tool → complete
+- ✅ 有依賴 → 前一個完成再 dispatch 下一個；同一 project 序列化
 - ❌ 不跳過任務系統直接 dispatch
-- ❌ 不用 Task tool 開 subagent 繞過 Formation（Formation 有 prompt 組裝、log、principles 注入）
+- ❌ 不手寫 subagent prompt — 用 dispatch.js 組裝（prompt 組裝、principles 注入）
 
 ### 3. Scope 安全保證
 
@@ -254,7 +232,7 @@ rigor: "medium"  # low | medium | high
 dependencies: ["TASK_147"]  # 真依賴（B 的輸入 = A 的輸出）
 scope_paths:  # 修改的檔案/目錄（用於衝突檢測）
   - "CLAUDE.md"
-  - ".formation/tools/runner.js"
+  - ".formation/tools/dispatch.js"
 requirements:
   - "新增 Lead Agent 開發流程章節"
   - "引用 .rule/pipeline/task-execution.yaml"
@@ -402,9 +380,8 @@ Step 2: 展示 Banner
 └── Ansuz.md             # 斜線指令觸發點
 
 .formation/tools/
-├── headless.js          # Formation 調度核心
+├── dispatch.js          # Formation 調度核心（subagent）
 ├── prompt.js            # Prompt 組裝 + principles 注入
-├── runner.js            # 執行引擎
 ├── post-complete.js     # 任務完成後自動化
 └── logger.js            # 日誌系統
 
@@ -439,11 +416,9 @@ Phase 3: 建立任務
   - node task-api.js create ... （x3 任務）
 
 Phase 4: 陣型判斷 + Dispatch
-  - 判斷：3 個獨立任務 → squad/blitz
+  - 判斷：3 個任務 → 各自 unit/do，序列化 dispatch
   - Dispatch:
-    Bash(bg): node headless.js --formation=squad --skill=blitz --task=TASK_151
-    Bash(bg): node headless.js --formation=squad --skill=blitz --task=TASK_152
-    Bash(bg): node headless.js --formation=squad --skill=blitz --task=TASK_153
+    node dispatch.js --skill=do --task=TASK_151 --dispatch-mode=subagent（完成後再下一個）
 
 Phase 5: 結果處理
   - 驗證：檔案變更 + Git commit + 驗收標準
@@ -531,7 +506,7 @@ Phase 7: 回報
 ```yaml
 無衝突（可並行）:
   TASK_A: scope_paths: ["CLAUDE.md"]
-  TASK_B: scope_paths: [".formation/tools/runner.js"]
+  TASK_B: scope_paths: [".formation/tools/dispatch.js"]
 
 有衝突（必須順序執行）:
   TASK_A: scope_paths: [".rule/pipeline/"]
@@ -601,7 +576,7 @@ Phase 7: 回報
 | 能力定義 | `.specialist/Ansuz/capability.yaml` | 需求分析、任務設計、陣型判斷等能力 |
 | 執行模式 | `.specialist/Ansuz/workflow.yaml` | 事件驅動 7 phases 工作流程 |
 | 共享詞彙 | `.specialist/Ansuz/knowledge.yaml` | Formation、任務系統、Agent 類型 |
-| Formation 系統 | `.formation/tools/` | headless.js, prompt.js, runner.js... |
+| Formation 系統 | `.formation/tools/` | dispatch.js, prompt.js, post-complete.js... |
 | 任務系統 | `.collaboration/core/task-api.js` | 任務 API |
 | CLAUDE.md | `CLAUDE.md` | 專案級指令與工作流程 |
 

package/core/.specialist/Ansuz/capability.yaml

@@ -91,24 +91,17 @@ capabilities:
   # ─── 調度執行 ───
   # §dispatch
   dispatch:
-    description: "使用 Formation 系統調度 agent 執行任務"
-    tool: ".formation/tools/headless.js"
-    method: "Bash tool → node headless.js → 啟動獨立 claude CLI 進程"
+    description: "使用 Formation prompt 組裝 + Agent tool subagent 執行任務（headless CLI 進程已退役）"
+    tool: ".formation/tools/dispatch.js"
+    method: "Bash tool → node dispatch.js --dispatch-mode=subagent → 取回 assembled prompt → Agent tool 開 subagent"
     rules:
       - "✅ 所有調度必須經過 .collaboration 任務系統"
-      - "✅ create → claim → dispatch(headless.js) → complete"
-      - "✅ 用 Bash tool 呼叫 headless.js，run_in_background=true 實現並行"
-      - "⚠️ 同一 project 的 dispatch 必須序列化 — 一個 task 完成後再 dispatch 下一個"
-      - "⚠️ 原因：多個 agent 共用同一 git working directory，並行會 git 衝突 + agent stall"
-      - "⚠️ 有依賴鏈時：按依賴順序逐一 dispatch，等 TaskOutput/poll 確認前一個完成"
+      - "✅ create → dispatch.js(subagent) → Agent tool → complete"
+      - "⚠️ 同一 project 的 dispatch 必須序列化 — 多個 agent 共用同一 git working directory，並行會衝突"
+      - "⚠️ 有依賴鏈時：按依賴順序逐一 dispatch，確認前一個完成"
       - "❌ 不跳過任務系統直接 dispatch"
-      - "❌ 不用 Task tool 開 subagent 繞過 Formation — Formation 有 prompt 組裝、log、principles 注入"
-      - "❌ 禁止同時 dispatch 多個 task 到同一 project（即使它們沒有依賴關係）"
     commands:
-      unit: "node .formation/tools/headless.js --skill=do --task=TASK_XXX"
-      solo: "node .formation/tools/headless.js --formation=solo --skill=strategy --task=TASK_XXX"
-      squad: "node .formation/tools/headless.js --formation=squad --skill=blitz --task=TASK_XXX"
-      legion: "node .formation/tools/headless.js --formation=legion --skill=forge --task=TASK_XXX"
+      unit: "node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent"
 
   # ─── 結果追蹤 ───
   # §result_tracking

package/core/.specialist/Ansuz/concepts/formation_quick_ref.yaml

@@ -9,20 +9,13 @@ size_kb: 0.98
 evolution_status: reference
 ---
 formation_quick_ref:
-  principle: "Lightest viable formation: unit > solo > squad > legion"
+  principle: "Only unit/solo skills are dispatchable (squad/legion retired); dispatch = Agent-tool subagent"
   unit:
     when: "Clear goal, single scope, direct execution"
-    command: "node .formation/tools/headless.js --skill=do --task=TASK_XXX"
+    command: "node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent"
   solo:
     when: "Multi-perspective analysis needed"
-    command: "node .formation/tools/headless.js --formation=solo --skill=strategy --task=TASK_XXX"
-  squad:
-    when: "Independent parallel subtasks possible"
-    command: "node .formation/tools/headless.js --formation=squad --skill=blitz --task=TASK_XXX"
-  legion:
-    when: "Sequential dependencies or real-time coordination required"
-    command: "node .formation/tools/headless.js --formation=legion --skill=forge --task=TASK_XXX"
+    command: "node .formation/tools/dispatch.js --formation=solo --skill=strategy --task=TASK_XXX --dispatch-mode=subagent"
   dispatch_rules:
-    - "✅ Always background=true for parallel dispatch (Bash run_in_background=true)"
     - "⚠️ Same project: serialize dispatches — wait for each to complete (git conflicts)"
-    - "✅ create → claim → dispatch(headless.js) → complete lifecycle"
+    - "✅ create → dispatch.js(subagent) → Agent tool → complete lifecycle"

package/core/.specialist/Ansuz/elixir.yaml

@@ -54,13 +54,12 @@ mandates:
   - "Project pinning: when boot banner shows a `[pin:...]` line or session was started with --project-path, EVERY MCP call to synapse_*/hippocampus_*/cortex_* that accepts a projectPath param MUST pass projectPath=<pin>; every specialist tool CLI call (task-api, phase-gate, dispatch) MUST pass --project-path <pin>. Missing projectPath leaks memory into the wrong project graph."
   - "Verification policy (PARTIAL/UNVERIFIED/FIX-keeps-original/verified_uncommitted vs committed_unmerged vs merged): .specialist/Ansuz/VERIFY.md, loaded on demand at Phase 9."
   - "Landing mechanics for a verified card (branch check -> Rust/node suites -> optional negative control -> merge -> task-api complete -> mark-landed -> optional backend-restart wait): run .specialist/Ansuz/tools/verify-and-land.js instead of doing the same 10-20 tool calls by hand; it only executes, judgement (what to verify, scope) stays with you."
-  - "WISHING WELL (every incarnation, TASK_1997/TASK_2040): file a wish with kenaz_wish_create — BEFORE working around the problem — whenever the Kenaz app itself blocks or degrades the work: a Kenaz tool/route fails or returns wrong data, a capability you needed is missing, a UX confusion cost you a turn, or a task ends failed/blocked because of the app. wish_type=bug|feature|question, one-line repro + what you expected, task_id when there is one. SCOPE (required on every wish): scope 'kenaz' — the Kenaz app/tools/dispatch itself blocked or degraded the work; scope 'project' — an idea or problem specific to the project being worked on (still sent; the mother may adopt it globally when it benefits Kenaz overall). FEATURE PROPOSALS: when the work reveals a capability Kenaz itself lacks that would help beyond this one task (not only blockers), you may file kenaz_wish_create with wish_type=feature, scope=kenaz. Content, in this order, within ~3000 chars: need (what you were trying to do), why current Kenaz falls short (evidence), proposed shape, who else benefits. Propose only - do not build Kenaz-core changes from a branch instance; the mother decides whether and how. MOTHER-SIDE TRIAGE: on the mother machine, field-report cards tagged needs-triage (blockers, project-scope wishes, and feature proposals alike) are judged at boot — adopt (rewrite as a global card stating the Kenaz-wide benefit, cancel the original with a pointer) or decline (cancel with a one-line reason); a feature proposal may be reshaped rather than built as proposed; never implement a project-specific ask verbatim in core. EXAMPLES — blocker: scope=kenaz, wish_type=bug, 'kenaz_dispatch timed out on a cross-project worktree with no partial log, TASK_2011'. feature proposal: scope=kenaz, wish_type=feature, 'need: retry one failed sub-task without rerunning the whole formation; current Kenaz only retries the full formation; shape: kenaz_dispatch --retry-task <id>; benefits every multi-task formation'. project-specific: scope=project, wish_type=feature, 'this project needs a CSV importer for onboarding — project-specific, flagging in case it generalizes'. At session close, anything unfinished BECAUSE of the app also becomes a wish. This is the channel that feeds the mother from every branch (TASK_1994); a session that hit an app problem and filed no wish has skipped a mandate, not saved time. Boot banner shows the open-wish count (and needs-triage count when >0) so you can see the channel is live."
+  - "WISHING WELL (every incarnation, TASK_1997/TASK_2040): file a wish with kenaz_wish_create — BEFORE working around the problem — whenever the Kenaz app itself blocks or degrades the work: a Kenaz tool/route fails or returns wrong data, a capability you needed is missing, a UX confusion cost you a turn, or a task ends failed/blocked because of the app. wish_type=bug|feature|question, one-line repro + what you expected, task_id when there is one. SCOPE (required on every wish): scope 'kenaz' — the Kenaz app/tools/dispatch itself blocked or degraded the work; scope 'project' — an idea or problem specific to the project being worked on (still sent; the mother may adopt it globally when it benefits Kenaz overall). FEATURE PROPOSALS: when the work reveals a capability Kenaz itself lacks that would help beyond this one task (not only blockers), you may file kenaz_wish_create with wish_type=feature, scope=kenaz. Content, in this order, within ~3000 chars: need (what you were trying to do), why current Kenaz falls short (evidence), proposed shape, who else benefits. Propose only - do not build Kenaz-core changes from a branch instance; the mother decides whether and how. MOTHER-SIDE TRIAGE: on the mother machine, field-report cards tagged needs-triage (blockers, project-scope wishes, and feature proposals alike) are judged at boot — adopt (rewrite as a global card stating the Kenaz-wide benefit, cancel the original with a pointer) or decline (cancel with a one-line reason); a feature proposal may be reshaped rather than built as proposed; never implement a project-specific ask verbatim in core. EXAMPLES — blocker: scope=kenaz, wish_type=bug, 'dispatch.js timed out on a cross-project worktree with no partial log, TASK_2011'. feature proposal: scope=kenaz, wish_type=feature, 'need: retry one failed sub-task without rerunning the whole formation; current Kenaz only retries the full formation; shape: dispatch.js --retry-task <id>; benefits every multi-task formation'. project-specific: scope=project, wish_type=feature, 'this project needs a CSV importer for onboarding — project-specific, flagging in case it generalizes'. At session close, anything unfinished BECAUSE of the app also becomes a wish. This is the channel that feeds the mother from every branch (TASK_1994); a session that hit an app problem and filed no wish has skipped a mandate, not saved time. Boot banner shows the open-wish count (and needs-triage count when >0) so you can see the channel is live."
 dispatch_routing:
   paths:
     subagent: "Agent tool within interactive session — stays on subscription billing, results return directly, no log polling. Use: short/medium tasks (rigor:low/medium, same-project or trivial scope)."
-    formation: "kenaz_dispatch / claude -p — independent process, own log, subscription billing (the June 15 credit-pool split was rescinded, user 2026-10-02). Use: long tasks (rigor:high, multi-hour), cross-project (different cwd needed), or when no interactive session."
-  how: "Run `node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent` (include the project pin when present). Read the assembled prompt from top-level promptText and pass it as the Agent tool prompt alongside agentParams. Top-level isolation is orchestration metadata, NOT an Agent tool argument: cross-project worktreePath specifies the target cwd; serialLock specifies required serialization and release. agentParams.isolation is present only for the native same-project worktree route. agentParams.model is ALREADY translated to the Agent tool enum (sonnet|opus|haiku|fable, TASK_1815) — pass it verbatim to a compatible Agent tool, do NOT re-translate or improvise. LIMIT: the Agent tool expresses family names ONLY, so dashboard version/speed picks (claude-opus-5[1m] vs claude-opus-4-8[1m], [1m] modifiers) all degrade to the family name; the payload's modelTranslation {requested, agentToolModel, granularityLoss} shows exactly what was lost — if the exact version matters, use the formation path (kenaz_dispatch → headless.js --dispatch-model accepts full model ids). Unmappable dispatchModel values make dispatch.js exit 1 loudly; never substitute a model silently. For formation path, use kenaz_dispatch MCP as before."
-  mandate: "ALWAYS evaluate both paths before dispatching. Check .kenaz/dashboard-models.json dispatchMode for the user override (set from the Dashboard Model Selection panel > Dispatch Routing, persisted by dashboard_settings.rs since TASK_1814): 'formation' or 'subagent' = hard override, route ALL dispatches through that path; 'auto' = no forced route, apply the heuristic (subagent when within interactive session unless task requires cross-project cwd or is rigor:high, else formation); key missing = dispatch.js falls back to 'formation' (TASK_1813 contract) — treat missing the same as no override and apply the heuristic at the Ansuz level."
+  how: "Run `node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent` (include the project pin when present). Read the assembled prompt from top-level promptText and pass it as the Agent tool prompt alongside agentParams. Top-level isolation is orchestration metadata, NOT an Agent tool argument: cross-project worktreePath specifies the target cwd; serialLock specifies required serialization and release. agentParams.isolation is present only for the native same-project worktree route. agentParams.model is ALREADY translated to the Agent tool enum (sonnet|opus|haiku|fable, TASK_1815) — pass it verbatim to a compatible Agent tool, do NOT re-translate or improvise. LIMIT: the Agent tool expresses family names ONLY, so dashboard version/speed picks (claude-opus-5[1m] vs claude-opus-4-8[1m], [1m] modifiers) all degrade to the family name; the payload's modelTranslation {requested, agentToolModel, granularityLoss} shows exactly what was lost. Unmappable dispatchModel values make dispatch.js exit 1 loudly; never substitute a model silently."
+  mandate: "Subagent is the only dispatch path (Formation headless/kenaz_dispatch retired, TASK_2359/2401/2402). dispatchMode in .kenaz/dashboard-models.json no longer selects a route."
 exo_cortex:
   opening_move: synapse_recall + kenaz_lsp_callers
   anti_pattern: "Bash grep/rg/find for source archaeology — prefer Grep/Glob (and kenaz_lsp_symbols for symbols); the hook nudge is downstream of you knowing the tool exists"

package/core/.specialist/Ansuz/identity_contract.yaml

@@ -339,7 +339,7 @@ cross_model:
     - "ME-001 governance (immutable rules cannot be deleted) must hold"
     - "AskUserQuestion tool must be available and used for all user-response questions"
     - "Phase sequence 0-11 must be respected; phase-gate.js must be callable"
-    - "Formation dispatch must work (headless.js must be callable)"
+    - "Subagent dispatch must work (.formation/tools/dispatch.js --dispatch-mode=subagent must be callable)"
     - "Task-api.js must be callable for task lifecycle management"
 
   acceptable_substrate_drift:

package/core/.specialist/Ansuz/knowledge.yaml

@@ -34,9 +34,8 @@ formation:
     - "Squad ≠ 開會。Squad = 多個獨立 subagent 並行，零溝通"
     - "Legion ≠ 大號 Squad。Legion = 持久化團隊，成員間即時通訊"
   key_files:
-    headless: ".formation/tools/headless.js"
+    dispatch: ".formation/tools/dispatch.js"
     prompt: ".formation/tools/prompt.js"
-    runner: ".formation/tools/runner.js"
     logs: ".formation/logs/{formation}/"
     post_complete: ".formation/tools/post-complete.js"
   research_notes:
@@ -49,12 +48,10 @@ formation:
         - "Better mapping: represent agent-role reliability and coordination cost as factorised hidden states, then evaluate a whole formation against task context."
         - "Keep a collective dispatch objective separate from per-agent or per-symbol EFE because ensemble-level EFE is not guaranteed to be aggregate-optimal."
   dispatch_mechanism:
-    how: "Bash tool → node headless.js → runner.js → spawn claude CLI 獨立進程"
-    why: "headless.js 統一處理 prompt 組裝（prompt.js）、principles 注入、log 管理"
-    anti_pattern: "❌ 禁止用 Task tool 直接開 subagent — 繞過 Formation 會失去 prompt 組裝和 log"
-    parallel: "多個 Bash(run_in_background=true) 同時啟動 → 真正的進程級並行"
-    max_parallel: 5  # 同時最多 5 個 headless 進程，超過排隊等空位
-    monitoring: "讀 .formation/logs/{formation}/ 下的 log 確認結果"
+    how: "Bash tool → node dispatch.js --dispatch-mode=subagent → Agent tool subagent"
+    why: "dispatch.js 統一處理 prompt 組裝（prompt.js）、principles 注入"
+    anti_pattern: "❌ 不手寫 subagent prompt — 用 dispatch.js 組裝"
+    monitoring: "Agent tool 結果直接返回"
 
 # ═══════════════════════════════════════
 #  任務系統
@@ -89,10 +86,10 @@ task_system:
     project_yaml: ".kenaz/project.yaml"
     rule: |
       子專案的任務存在 .kenaz/tasks/，不是 .collaboration/tasks/。
-      所有 task-api.js、headless.js、post-complete.js 呼叫都必須加 --project-path。
+      所有 task-api.js、dispatch.js、post-complete.js 呼叫都必須加 --project-path。
     cli_pattern:
       task_api: "node {CORE}/.collaboration/core/task-api.js --project-path {PROJECT_PATH} <command>"
-      headless: "node {CORE}/.formation/tools/headless.js --project-path {PROJECT_PATH} --skill=do --task=TASK_XXX"
+      dispatch: "node {CORE}/.formation/tools/dispatch.js --project-path {PROJECT_PATH} --skill=do --task=TASK_XXX --dispatch-mode=subagent"
       post_complete: "node {CORE}/.formation/tools/post-complete.js --task=TASK_XXX --project-path={PROJECT_PATH}"
 
 # ═══════════════════════════════════════

package/core/.specialist/Ansuz/rule.yaml

@@ -35,7 +35,7 @@ allow:
   - "讀取專案內所有原始碼"
   - "讀寫 specialist/Ansuz/ 下所有檔案"
   - "使用 .collaboration/core/task-api.js 管理任務"
-  - "使用 .formation/tools/headless.js 調度執行"
+  - "使用 .formation/tools/dispatch.js --dispatch-mode=subagent 調度執行"
   - "使用 .formation/tools/post-complete.js 完成後自動化"
   - "執行 git 操作（建立分支、commit、merge 到用戶分支）"
 
@@ -51,7 +51,7 @@ identity:
   symbol: "ᚨ — 神諭符文：理解意圖，傳遞給執行層"
   rules:
     - "❌ 不 invoke 其他 Skill — 不切換身份"
-    - "✅ 需要執行時 → 用 Formation 系統 dispatch（Task tool + headless.js）"
+    - "✅ 需要執行時 → 用 Agent tool subagent dispatch（dispatch.js --dispatch-mode=subagent）"
     - "✅ Ansuz 本體負責：需求理解、任務設計、陣型判斷、調度、追蹤、回報"
     - "❌ 不親自寫程式碼 — 只做決策和調度"
     - "✅ Task-First — 預設先建立任務卡再 dispatch，除非是極簡單的單檔修改（< 20 行）"

package/core/.specialist/Ansuz/tools/verify-and-land.js

@@ -147,6 +147,8 @@ function buildPlan(config) {
     plan.push({ name: 'negative-control', kind: 'neg' });
   }
   if (!config.noMerge) {
+    // TASK_2400: ARCH-001 file-size gate, cheap and deterministic, so before the heavy checks.
+    plan.push({ name: 'file-size', kind: 'file-size' });
     // TASK_2176: the authoritative, serialized heavyweight check runs right
     // before merge, on the main tree (config.repo) -- gates the merge that
     // follows it, same as the worktree-side negative control gates it above.
@@ -759,6 +761,24 @@ function coreToolPath(config, rel) {
   return path.join(__dirname, '..', '..', '..', rel);
 }
 
+/**
+ * TASK_2400: ARCH-001 gate. Runs the core's check-file-size.js on branch vs merge-base
+ * (--repo = the project, so a user project uses its own .rule yaml or the built-in
+ * defaults). BLOCK -> step fails, merge never runs; WARN lines go into the step summary.
+ */
+function stepFileSize(config, deps, ctx) {
+  const script = coreToolPath(config, path.join('dev', 'scripts', 'check-file-size.js'));
+  if (!fs.existsSync(script)) return { ok: true, summary: 'check-file-size.js not found in core, skipped', log: '' };
+  const base = git(deps, config.repo, ['merge-base', 'HEAD', ctx.branch]);
+  const res = deps.spawnSync('node', [script, '--base', base, '--head', ctx.branch, '--repo', config.repo], { encoding: 'utf8' });
+  const output = (res.stdout || '') + (res.stderr || '');
+  const found = output.split('\n').filter((l) => /ARCH-001 (BLOCK|WARN)/.test(l)).map((l) => l.trim());
+  if (res.status === 0) {
+    return { ok: true, summary: found.length ? `${found.length} warning(s): ${found.join(' | ')}`.slice(0, 600) : 'within thresholds', log: output };
+  }
+  return { ok: false, summary: `ARCH-001 blocked (exit ${res.status}): ${found.join(' | ') || output.trim()}`.slice(0, 800), log: output };
+}
+
 function writeLandingInfo(config, deps, ctx) {
   if (!ctx || !ctx.postMergeHead) return; // no merge landed (--no-merge etc.) -- nothing to record
   const shortSha = ctx.postMergeHead.slice(0, 8);
@@ -845,6 +865,7 @@ async function executeStep(stepDef, config, deps, ctx) {
     case 'rust': return stepRust(config, deps, ctx, stepDef.filter);
     case 'node': return stepNode(config, deps, ctx, stepDef.file);
     case 'neg': return stepNegativeControl(config, deps, ctx);
+    case 'file-size': return stepFileSize(config, deps, ctx);
     case 'verify-offline': return stepVerifyOffline(config, deps);
     case 'merge': return stepMerge(config, deps, ctx);
     case 'task-complete': return stepTaskComplete(config, deps, ctx);
@@ -1000,6 +1021,7 @@ module.exports = {
   latestStartedAtAfter,
   resolveRepoFromWorktree,
   coreToolPath,
+  stepFileSize,
   assertRepoOwnsWorktree,
   resolveRepo,
   UsageError,

package/core/.specialist/Ansuz/tools/verify-and-land.test.js

@@ -33,6 +33,7 @@ const {
   DEFAULT_RUST_MAX_S,
   resolveVerifyOfflineCmd,
   stepVerifyOffline,
+  stepFileSize,
 } = require('./verify-and-land.js');
 
 // Same shared list verify-and-land.js reads (TASK_2069) — tests assert
@@ -273,6 +274,7 @@ test('buildPlan: fixed step order for a full config (default warm route — no c
     'rust:foo',
     'node:t.js',
     'negative-control',
+    'file-size',
     'merge',
     'task-complete',
     'mark-landed',
@@ -362,6 +364,8 @@ test('success path: runs steps in order (rust via the warm rust-verify-worktree.
         return ok('test result: ok. 5 passed; 0 failed\n');
       }
       if (cmd === 'node' && args[0] === '--test') return ok('ℹ pass 2\nℹ fail 0\n');
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === 'HEAD') return ok('basesha\n');
+      if (cmd === 'node' && args[0].includes('check-file-size.js')) return ok('');
       if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) {
         mergeCount++;
         return ok('Merge made by the recursive strategy.\n');
@@ -386,7 +390,7 @@ test('success path: runs steps in order (rust via the warm rust-verify-worktree.
   // copies its own resources into the fixed verify worktree.
   assert.deepEqual(
     result.steps.map(s => s.name),
-    ['preflight', 'rust:foo', 'node:test/a.test.js', 'merge', 'task-complete', 'mark-landed']
+    ['preflight', 'rust:foo', 'node:test/a.test.js', 'file-size', 'merge', 'task-complete', 'mark-landed']
   );
   assert.ok(result.steps.every(s => s.ok === true));
   assert.equal(mergeCount, 1, 'merge must run exactly once');
@@ -416,6 +420,8 @@ test('TASK_2142 R2: task-complete bakes landed commit sha + verification summary
       if (cmd === 'git' && args[2] === 'status') return ok('');
       if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
       if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') return ok('test result: ok. 3 passed; 0 failed\n');
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === 'HEAD') return ok('basesha\n');
+      if (cmd === 'node' && args[0].includes('check-file-size.js')) return ok('');
       if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) return ok('Merge made by the recursive strategy.\n');
       if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'HEAD') {
         headCount++;
@@ -772,7 +778,7 @@ test('dry-run: resolves/validates --repo via read-only git (same guard as a real
   assert.equal(result.repo, config.repo, 'dry-run output includes the resolved repo path');
   assert.deepEqual(
     result.steps.map(s => s.name),
-    ['preflight', 'rust:foo', 'node:t.js', 'negative-control', 'merge', 'task-complete', 'mark-landed', 'wait-backend', 'live']
+    ['preflight', 'rust:foo', 'node:t.js', 'negative-control', 'file-size', 'merge', 'task-complete', 'mark-landed', 'wait-backend', 'live']
   );
   assert.ok(result.steps.every(s => s.planned === true));
 });
@@ -923,6 +929,8 @@ test('merge verification: "Already up to date" (unchanged HEAD) fails the merge
       if (cmd === 'git' && args[2] === 'status') return ok('');
       if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
       if (cmd === 'node' && args[0].includes('rust-verify-worktree.js') && args[1] === 'run') return ok('test result: ok. 1 passed; 0 failed\n');
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === 'HEAD') return ok('basesha\n');
+      if (cmd === 'node' && args[0].includes('check-file-size.js')) return ok('');
       if (cmd === 'git' && args[2] === 'merge' && args.includes('--no-ff')) return ok('Already up to date.\n');
       // HEAD is the SAME before and after — this is the exact bug that shipped.
       if (cmd === 'git' && args[2] === 'rev-parse' && args[3] === 'HEAD') return ok('deadbeef\n');
@@ -934,7 +942,7 @@ test('merge verification: "Already up to date" (unchanged HEAD) fails the merge
   const result = await runVerifyAndLand(config, deps);
   assert.equal(result.ok, false);
   assert.equal(result.failed_step, 'merge');
-  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'rust:foo', 'merge']);
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'rust:foo', 'file-size', 'merge']);
   assert.match(result.steps[result.steps.length - 1].summary, /unchanged|did not land/);
   assert.equal(taskCompleteCalled, false, 'task-api complete must never run after a merge that did not actually land');
 });
@@ -958,7 +966,7 @@ test('resolveVerifyOfflineCmd: project.yaml without the key -> null', () => {
 
 test('buildPlan: verify-offline step is included only when verifyOfflineCmd is set, placed right before merge', () => {
   const withCmd = buildPlan(baseConfig({ verifyOfflineCmd: 'node fake-unity.js' }));
-  assert.deepEqual(withCmd.map(s => s.name), ['preflight', 'verify-offline', 'merge', 'task-complete', 'mark-landed']);
+  assert.deepEqual(withCmd.map(s => s.name), ['preflight', 'file-size', 'verify-offline', 'merge', 'task-complete', 'mark-landed']);
   const withoutCmd = buildPlan(baseConfig({ verifyOfflineCmd: null }));
   assert.ok(!withoutCmd.some(s => s.kind === 'verify-offline'), 'no key in project.yaml -> no step, unaffected');
 });
@@ -1028,6 +1036,8 @@ test('runVerifyAndLand: verify_offline failure blocks landing (full pipeline, re
       if (cmd === 'git' && args[2] === 'status') return ok('');
       if (cmd === 'git' && args[2] === 'rev-list') return ok('1\n');
       if (cmd === 'node fake-unity.js --break') return bad(1, '', 'compile error'); // shell:true -- cmd is the whole command string, args is []
+      if (cmd === 'git' && args[2] === 'merge-base' && args[3] === 'HEAD') return ok('basesha\n');
+      if (cmd === 'node' && args[0].includes('check-file-size.js')) return ok('');
       if (cmd === 'git' && args[2] === 'merge') { mergeCalled = true; return ok('merged\n'); }
       throw new Error('unexpected spawnSync in verify_offline-blocks-landing test: ' + JSON.stringify({ cmd, args }));
     },
@@ -1035,7 +1045,7 @@ test('runVerifyAndLand: verify_offline failure blocks landing (full pipeline, re
   const result = await runVerifyAndLand(config, deps);
   assert.equal(result.ok, false);
   assert.equal(result.failed_step, 'verify-offline');
-  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'verify-offline']);
+  assert.deepEqual(result.steps.map(s => s.name), ['preflight', 'file-size', 'verify-offline']);
   assert.equal(mergeCalled, false, 'verify_offline failure must block the merge that follows it');
 });
 
@@ -1097,3 +1107,47 @@ test('coreToolPath: a sub-project repo (only .kenaz/) resolves core tools via pr
     fs.rmSync(tmp, { recursive: true, force: true });
   }
 });
+
+// ── TASK_2400: ARCH-001 file-size gate (real temp repo, real check-file-size.js) ──
+
+function makeSizeFixture(extraFiles) {
+  const fsr = require('node:fs');
+  const os = require('node:os');
+  const repo = fsr.mkdtempSync(path.join(os.tmpdir(), 'size-gate-'));
+  const run = (...a) => { const r = realSpawnSync('git', ['-C', repo, ...a], { encoding: 'utf8' }); assert.equal(r.status, 0, r.stderr); return r.stdout; };
+  const body = n => Array.from({ length: n }, (_, i) => `const v${i} = ${i};`).join('\n') + '\n';
+  run('init', '-q', '-b', 'main');
+  run('config', 'user.email', 't@t'); run('config', 'user.name', 't');
+  fsr.writeFileSync(path.join(repo, 'big.js'), body(2100)); // over the 2000 hard limit: grandfathered debt
+  run('add', '-A'); run('commit', '-q', '-m', 'base');
+  run('checkout', '-q', '-b', 'task');
+  fsr.writeFileSync(path.join(repo, 'big.js'), body(2200)); // +100 lines
+  for (const [name, n] of Object.entries(extraFiles || {})) fsr.writeFileSync(path.join(repo, name), body(n));
+  run('add', '-A'); run('commit', '-q', '-m', 'grow');
+  run('checkout', '-q', 'main');
+  return { repo, cleanup: () => fsr.rmSync(repo, { recursive: true, force: true }) };
+}
+
+test('stepFileSize: growing an over-limit file without an extraction is refused (BLOCK)', () => {
+  const fx = makeSizeFixture();
+  try {
+    const res = stepFileSize({ repo: fx.repo }, { spawnSync: realSpawnSync }, { branch: 'task' });
+    assert.equal(res.ok, false);
+    assert.match(res.summary, /ARCH-001 blocked/);
+    assert.match(res.summary, /big\.js/);
+  } finally { fx.cleanup(); }
+});
+
+test('stepFileSize: same growth paired with a new extracted module passes', () => {
+  const fx = makeSizeFixture({ 'extracted.js': 60 });
+  try {
+    const res = stepFileSize({ repo: fx.repo }, { spawnSync: realSpawnSync }, { branch: 'task' });
+    assert.equal(res.ok, true, res.summary);
+  } finally { fx.cleanup(); }
+});
+
+test('buildPlan: file-size runs before merge, and not at all with --no-merge', () => {
+  const names = buildPlan(baseConfig({})).map(s => s.name);
+  assert.deepEqual(names, ['preflight', 'file-size', 'merge', 'task-complete', 'mark-landed']);
+  assert.ok(!buildPlan(baseConfig({ noMerge: true })).some(s => s.name === 'file-size'));
+});

package/core/.specialist/Ansuz/workflow.yaml

@@ -94,7 +94,7 @@ phase_0_initialization:
       1. 檢查當前工作目錄（cwd）是否有 .kenaz/project.yaml
       2. 如果有 → 子專案模式：設定 PROJECT_PATH = cwd, CORE = project.yaml 的 core_path
       3. 如果沒有 → Core 模式：PROJECT_PATH 為空，不需要 --project-path
-      4. 後續所有 task-api.js / headless.js / post-complete.js 呼叫都根據此結果決定是否加 --project-path
+      4. 後續所有 task-api.js / dispatch.js / post-complete.js 呼叫都根據此結果決定是否加 --project-path
     check: |
       # 子專案偵測（在 cwd 執行）
       if [ -f .kenaz/project.yaml ]; then
@@ -753,19 +753,15 @@ phase_8_dispatch:
 
   # ─── Dispatch 執行 ───
   execution:
-    tool: ".formation/tools/headless.js"
-    method: "Bash tool → node headless.js → 啟動獨立 claude CLI 進程"
-    max_parallel: 5
+    tool: ".formation/tools/dispatch.js"
+    method: "Bash tool → node dispatch.js --dispatch-mode=subagent → 取回 promptText + agentParams → Agent tool 開 subagent"
     patterns:
-      single: "一個任務 → Bash(run_in_background=true): node headless.js --task=TASK_XXX [--project-path ...]"
-      parallel: "多個無依賴 → 多個 Bash(background) 同時啟動（上限 5，超過排隊）"
+      single: "一個任務 → node dispatch.js --task=TASK_XXX --dispatch-mode=subagent [--project-path ...] → Agent tool"
       sequential: "有依賴 → 前一個完成再 dispatch 下一個"
     cli:
-      unit: "node {CORE}/.formation/tools/headless.js --skill=do --task=TASK_XXX [--project-path {PROJECT_PATH}]"
-      solo: "node {CORE}/.formation/tools/headless.js --formation=solo --skill=strategy --task=TASK_XXX [--project-path {PROJECT_PATH}]"
-      squad: "node {CORE}/.formation/tools/headless.js --formation=squad --skill=blitz --task=TASK_XXX [--project-path {PROJECT_PATH}]"
-      legion: "node {CORE}/.formation/tools/headless.js --formation=legion --skill=forge --task=TASK_XXX [--project-path {PROJECT_PATH}]"
-    anti_pattern: "❌ 禁止用 Task tool 直接開 subagent — 繞過 Formation 會失去 prompt 組裝、principles 注入和 log"
+      unit: "node {CORE}/.formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent [--project-path {PROJECT_PATH}]"
+      solo: "node {CORE}/.formation/tools/dispatch.js --formation=solo --skill=strategy --task=TASK_XXX --dispatch-mode=subagent [--project-path {PROJECT_PATH}]"
+    anti_pattern: "❌ 不手寫 subagent prompt — 用 dispatch.js 組裝（prompt 組裝、principles 注入）"
 
   # ─── Scope 安全 ───
   scope:

package/core/.specialist/Forseti/core.yaml

@@ -162,7 +162,7 @@ degradation:
 # ═══════════════════════════════════════
 invocation:
   via_formation:
-    command: "node .formation/tools/headless.js --skill=do --task={FORSETI_TASK_ID} --project-path={path}"
+    command: "node .formation/tools/dispatch.js --skill=do --task={FORSETI_TASK_ID} --project-path={path} --dispatch-mode=subagent"
     context_required:
       - "task_id: 被驗證的 Dev Task ID（必填）"
       - "project_path: /absolute/path/to/project（必填）"

package/core/.specialist/Heimdall/SKILL.md

@@ -49,7 +49,7 @@ post_complete_verdict: RECORDED | delta: {N.NN|n/a} | reason: {text}
 | 項目 | 說明 |
 |------|------|
 | 路徑 | `.kenaz/health_snapshots/{taskId}_before.json` / `_after.json` |
-| 寫入者 | `headless.js`（dispatch 時）或首次運行時由 post-complete.js 寫入 |
+| 寫入者 | 首次運行時由 post-complete.js 寫入 |
 | 格式 | `{ "score": 82, "grade": "B", "timestamp": "..." }` |
 | 無快照時 | 保存當前分數為基線 |