kodelyth-ecc 2.25.0 → 2.30.0

package/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-This file is read by AI agents (Cascade, Cursor, Codex, etc.) on every session. It tells them how to work in this repo and how to use the 70 specialist agents and 194 skills shipped with Kodelyth ECC.
+This file is read by AI agents (Cascade, Cursor, Codex, etc.) on every session. It tells them how to work in this repo and how to use the 71 specialist agents and 196 skills shipped with Kodelyth ECC.
 
 ---
 

package/CHANGELOG.md

@@ -2,6 +2,195 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.30.0 — Terse reaches Roo Code, Aider, Kimi; the CLI stops lying about its version (November 2026)
+
+**Terse was silently skipped on three IDEs.** The helpers that tell the terse
+installer where each IDE keeps its skills and commands (`getTargetSkillsDir` /
+`getTargetCommandsDir`) returned `null` for `roocode`, `aider`, and `kimi`. The
+caller guards on null, so there was no crash — `/terse` and `/terse-compress`
+just never installed on those three, quietly. They now resolve to the same
+`.roo/`, `.aider-ecc/`, and `.kimi/` directories the main installer writes to.
+`cline` (rules-only, no command system) and `kiro` (whose whole catalog is served
+over the MCP server, not copied as files) still return null — on purpose, and now
+with a comment saying why. The mapping moved out of `bin/` into a shared,
+unit-tested `scripts/lib/target-paths.js`, so a future target can't be added to
+the installer and forgotten here without a test going red.
+
+**`kodelythecc --version` reported 2.24.1 on a 2.29.0 install.** The CLI read a
+`VERSION` file and preferred it over `package.json`; releases v2.25 through v2.29
+bumped `package.json` but never the `VERSION` file, so the two drifted and the
+file won. Both version readers (the `--version` flag and the `doctor` update
+check) now prefer `package.json` — which is canonical for an npm package and can
+never be stale on a published tarball — and fall back to `VERSION` only if that
+read fails. `VERSION` is synced to the real version here, and the release process
+keeps both in step.
+
+**Brand and catalog counts swept current.** The social and poster SVGs, the wiki,
+`AGENTS.md`, the bundles, the install banners, and the npm description still read
+70 agents / 103 commands / 11 platforms. Everything that renders a count now says
+**71 agents · 196 skills · 104 commands · 12 platforms · 14 install targets · 389
+MCP resources**, with Kiro in the platform list. The ecc.kodelyth.com docs, home,
+install, and getting-started pages were refreshed to match, and a new
+`/docs/super-agent` page documents the orchestrator shipped in v2.28.
+
+## v2.29.0 — Publish fix: ajv was an undeclared dependency (November 2026)
+
+**What happened:** v2.26.0, v2.27.0, and v2.28.0 were tagged and released on GitHub,
+but their npm publishes all **failed** — so npm stayed at v2.25.0. The pre-publish
+test step crashed with `Cannot find module 'ajv'`: `scripts/lib/state-store/
+schema.js` required `ajv` at module load, but `ajv` was never a declared
+dependency. It was present on the maintainer's machine (transitively) so local
+tests passed, and absent in CI's clean install so the publish test failed. The
+new `state-store` test (added in v2.26.0) imports state-store at the top level,
+which is what surfaced it — the same undeclared-dependency bug class as sql.js.
+
+**The fix:** `ajv` is now loaded lazily inside `getAjv()` (not at import), with a
+clean `ECC_AJV_UNAVAILABLE` error if absent, and it is declared as an **optional**
+dependency alongside `sql.js` so it travels with the SQLite state-store it
+validates. Importing state-store no longer requires ajv; the module degrades the
+same way it does without sql.js.
+
+**This release rolls up everything from v2.26.0–v2.28.0** (Memory Core, Platform
+reach, Super Agent) — all of which is already on `main` — and is the first of
+them to actually reach npm. Because npm versions and GitHub tags are immutable,
+those three versions could not be re-published under their own numbers; v2.29.0
+carries their code to npm.
+
+## v2.28.0 — Super Agent (beta): the autonomous orchestrator (November 2026)
+
+The driver the memory/orchestration audit found missing. ECC had the primitives —
+the `blueprint` DAG decomposer, the tmux+worktree swarm, the GAN evaluation loop,
+the Arena state machine — but nothing chained them, the swarm never merged its
+worker branches, and no run could resume. This adds the chain.
+
+**An Arena-style deterministic state machine.** `scripts/super-agent/`:
+
+- `dag.js` — the plan as a dependency graph: which steps are runnable now, is it
+  complete, is it stalled, is it a valid DAG (cycle/dep/self-dep checks).
+- `state.js` — resumable runs persisted after every step, plus the **budget
+  governor** (`--token-cap` / `--step-cap`) that bounds a whole run, not just one
+  session.
+- `orchestrator.js` — a **pure** `nextAction(run)` that decides the next move, and
+  `submit*` recorders that advance the phase. Because the decision function is
+  pure, the entire control plane is tested (20 tests) **without spawning an
+  agent**: decompose → dispatch (in dependency order, parallel where independent)
+  → integrate → verify → done.
+- `integrate.js` — the missing branch-merge piece: `mergeOrder` (dependency-first)
+  and `detectConflicts` via `git merge-tree --write-tree`, which finds conflicts
+  with **no working-tree side effects**.
+- `cli.js` + `kodelythecc super-agent …` — the drivable surface (start / next /
+  plan / step / integrate / verify / status / list / resume).
+
+**It cannot lie about its own state.** A step that didn't succeed is recorded
+`failed`, and a failed dependency stalls the run instead of building on it.
+Integration conflicts stop for a human. `verify --passed` requires real green
+tests. The budget cap halts the run rather than being worked around.
+
+**How it runs.** The state machine is tokenless; the driving LLM performs each
+action it names (blueprint to decompose, the swarm to dispatch, the GAN loop to
+evaluate, git to integrate) and reports back. New `super-agent` agent +
+`/super-agent` command + routing teach it the loop.
+
+*Beta:* the control plane, CLI, and branch integration are tested and working; the
+LLM-driven execution of each action is delegated (exercised by the agent persona,
+not CI). This is the 71st agent / 104th command — a count sweep across the
+hardcoded docs and brand assets is a tracked follow-up; the catalog and site
+derive their counts automatically.
+
+## v2.27.0 — Platform reach: Codex + Kiro get MCP & memory; Kiro is the 12th platform (November 2026)
+
+MCP — and therefore the whole tool surface plus **memory** — now auto-wires for
+**six** IDEs out of the box. Two releases ago it was Claude Code only.
+
+**Codex CLI gets MCP (TOML).** Codex stores MCP servers in `~/.codex/config.toml`,
+not JSON. A minimal, non-clobbering writer adds the `[mcp_servers."kodelyth-ecc"]`
+table only when it is absent and otherwise leaves the file exactly as it is
+(appending a table is order-independent in TOML, so other servers and settings
+survive). Wired into the Codex post-install.
+
+**Kiro is a first-class target now — the 12th platform.** `kodelythecc --target
+kiro` installs the rules as always-on **steering** docs (`.kiro/steering/`) and
+wires ECC's MCP server into `.kiro/settings/mcp.json`. Kiro is MCP-native, so the
+full catalog — 70 agents, 196 skills, memory — arrives over MCP on demand rather
+than as a 266-file dump into steering. Added to `install.sh`, `install.ps1`, and
+the interactive menu.
+
+**MCP auto-wiring now covers:** Claude Code, Cursor, Windsurf, Gemini CLI, Codex,
+and Kiro. The merge is the same hardened one that protects `~/.claude.json` —
+absent files created, present files merged without clobbering, unparseable files
+refused.
+
+**Honest limits (not papered over):** RTK upstream has no agent for Kiro or
+Aider, so those don't get RTK filtering (and ECC doesn't pretend they do).
+Cline / Roo Code MCP stays manual — their settings live in VS Code globalStorage
+at an editor-version-specific path ECC won't guess. The `terse enable` secondary
+flow still has project-vs-home path quirks for some IDEs (the main install copies
+Terse correctly); tracked as a follow-up.
+
+## v2.26.0 — Memory Core, first cut: identity, redaction, fused recall (November 2026)
+
+The first cut of the Memory Core track. It fixes the memory data model's biggest
+correctness and safety gaps on the existing store, without the risk of a full
+substrate swap. Everything ships with tests (51 test files, all passing).
+
+**Memory stops orphaning on clone/move.** The store keyed each project by
+`sha256(absolute path)`, so moving, cloning, or renaming a repo changed its path
+and filed all future memories under a new id — hiding everything captured before.
+Memory now keys by the **normalized git remote** (git-remote-first, path
+fallback), which is stable where the path is not. `git@github.com:o/r.git`,
+`https://github.com/o/r`, and `ssh://…/o/r` all resolve to one id. Backward
+compatible by **read-both**: recall also matches the legacy path id, so nothing
+captured under the old scheme is lost. New `scripts/memory/project-id.js`.
+
+**Secrets never reach the memory log.** A captured memory is stored, recalled,
+and injected into future sessions — so a leaked key in a `problem`/`approach`
+would persist and re-surface. Capture now runs a shared credential redactor
+(`scripts/lib/redact.js`) over everything it stores: AWS, GitHub, OpenAI/
+Anthropic, Stripe, Slack, Google, npm tokens, JWTs, and PEM private-key blocks,
+plus `--token=`/`Authorization:`/`password=`/`api_key=` forms. Every pattern is
+linear (no ReDoS). The bash-command logger now shares the same redactor, which
+also widened its coverage.
+
+**Recall ranks by more than keywords.** BM25 still decides relevance, but among
+similarly-relevant memories a **recent, proven** one now outranks an old or
+failed one (relevance × recency × outcome). A memory whose approach didn't stick
+(`resolved:false`) sinks; a confirmed one rises. Relevance still dominates — a
+much more relevant memory is never buried by a newer one.
+
+**`state.db` actually works now.** The optional SQLite layer (session store,
+status DB, skill-evolution tracker) required `sql.js` at module load, but it was
+never a declared dependency — so importing it threw "Cannot find module 'sql.js'"
+on every install, before any caller's try/catch could run. `sql.js` is now a real
+**optional** dependency, loaded lazily; a missing module becomes a clean, coded
+error (`ECC_SQLITE_UNAVAILABLE`) that callers degrade on, and `isSqliteAvailable()`
+is a non-throwing probe for `doctor`. The core (memory, RTK, Terse, graph) never
+needed it and still doesn't.
+
+**Opt-in on-device semantic recall.** An optional semantic tier, **off by
+default**, that keeps the promise: the default session stays pure BM25, zero
+dependency, zero network. Turn it on with `KODELYTH_MEMORY_EMBEDDINGS=on` and the
+optional `@xenova/transformers` dependency, and recall blends BM25 with local,
+on-device embedding similarity (hybrid rank fusion); embeddings live in a sidecar,
+so `memories.jsonl` and its index are byte-for-byte unchanged. With it off — or
+the dependency absent, or any failure — recall is exactly BM25. Inference runs
+locally; only the first-ever model load touches the network. Pluggable provider
+interface, so the fusion/gating logic is fully tested with a stub and the heavy
+dependency is never required.
+
+**Auto-capture that respects consent.** The Stop hook already auto-extracted
+memory candidates from each finished session into a review queue — but nothing
+could read or promote them, so the queue was a dead end (the `/memory
+review-pending` it pointed at did not exist). Now `kodelythecc memory
+list-pending` shows what a session proposed, `promote-pending <id|all>` stores the
+ones you confirm (capture redacts them on the way in), and `discard-pending`
+drops the rest. Candidates are collected automatically; storing them is one
+explicit command, so nothing enters the recall store silently — the memory
+protocol's "never capture without confirmation" holds. The next session surfaces
+the pending count so proposals are not forgotten.
+
+**On the substrate:** the full 5-store merge is moot by design — the core stays
+pure-JS/JSONL and SQLite is an optional add-on, not the substrate.
+
 ## v2.25.0 — Foundations: honest numbers, a memory that learns, MCP beyond Claude (November 2026)
 
 The first cut of the v3.0 "Foundations" track. Almost no new surface area — this

package/CLAUDE.md

@@ -6,19 +6,19 @@ Guidance for Claude Code when working with this repository.
 
 **Kodelyth ECC** — a production-grade AI coding toolkit:
 
-- **70 specialist agents** — debug-detective, incident-commander, load-tester, image-architect, kodelyth-memory, security-reviewer, plus 8 adversarial devil-mode agents
+- **71 specialist agents** — debug-detective, incident-commander, load-tester, image-architect, kodelyth-memory, security-reviewer, the super-agent orchestrator, plus 8 adversarial devil-mode agents
 - **196 skills** — domain knowledge, patterns, testing, security, intent routing, local memory, swarm orchestration, MCP integration
-- **103 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, ...)
+- **104 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, `/super-agent`, ...)
 - **44 hook entries** across 8 events — quality gates, memory inject + capture, correction encoding, prompt-injection guard, token-budget enforcer
 - **15 rules** — always-on coding standards + semantic intent routing + memory protocol + self-improvement
 
-Works with Claude Code, Windsurf, Cursor, Codex CLI, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, and Gemini CLI — **11 platforms** (13 install targets).
+Works with Claude Code, Windsurf, Cursor, Codex CLI, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI, and Kiro — **12 platforms** (14 install targets). MCP (and therefore memory) auto-wires for Claude Code, Cursor, Windsurf, Gemini CLI, Codex, and Kiro.
 
 ## Architecture
 
 ```
-agents/      → 70 specialist subagents (planner, code-reviewer, debug-detective, devil-mode crew, ...)
-commands/    → 103 slash commands (8 parallel multi-agent, 1 adversarial loop, rest single-agent)
+agents/      → 71 specialist subagents (planner, code-reviewer, debug-detective, super-agent, devil-mode crew, ...)
+commands/    → 104 slash commands (8 parallel multi-agent, 1 adversarial loop, 1 orchestrator, rest single-agent)
 skills/      → 196 workflow + domain knowledge files (loadable via slash commands)
 hooks/       → 44 hook entries across 8 events, 9 scripts (memory inject/capture, prompt-injection guard, token-budget)
 rules/       → 15 always-on guidelines (agent-intent-routing, self-improvement, memory-protocol, ...)
@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 693 passing tests across 44 test files
+tests/       → 787 passing tests across 57 test files
 ```
 
 ## Running Tests
@@ -131,7 +131,7 @@ These fire multiple specialist agents simultaneously:
 - Agent format: Markdown with YAML frontmatter (name, description, tools, model)
 - Skill format: Markdown with clear sections (description, when to use, how it works)
 - Hook format: JSON with matcher conditions and command/notification hooks
-- No runtime deps in core — `@modelcontextprotocol/sdk` is an optionalDependency for MCP server only
+- No **required** runtime deps — the core (agents, skills, memory, RTK, Terse, graph) is pure-JS and runs on a default install with nothing installed. Three `optionalDependencies`: `@modelcontextprotocol/sdk` (MCP server), `sql.js` (optional SQLite for the session store / status DB / skill-evolution tracker), and `@xenova/transformers` (optional on-device memory embeddings, off by default). Each degrades cleanly to the pure-JS path when absent.
 
 ## Contributing
 

package/GITHUB_SETUP.md

@@ -51,7 +51,7 @@ rsvg-convert -w 1280 -h 640 \
 3. Set **Description** to exactly:
 
 ```
-70 agents · 194 skills · 97 commands · MCP server · devil mode · 11 platforms · zero telemetry
+71 agents · 196 skills · 104 commands · MCP server · devil mode · 12 platforms · zero telemetry
 ```
 
 4. Set **Website** to:
@@ -218,7 +218,7 @@ Create a new Discussion in **Announcements**:
 ```markdown
 Welcome!
 
-**Kodelyth ECC** gives your AI coding assistant 70 specialist agents, 194 skills, 97 commands, and self-learning memory. One install, 11 platforms.
+**Kodelyth ECC** gives your AI coding assistant 71 specialist agents, 196 skills, 104 commands, and self-learning memory. One install, 12 platforms.
 
 ## Quick links
 - [Installation Guide](https://github.com/sifxprime/kodelyth-ecc/wiki/Installation-Guide)
@@ -540,7 +540,7 @@ EOF
 Run through this after every major release:
 
 - [ ] Social preview PNG uploaded to GitHub Settings
-- [ ] About description updated (`70 agents · 194 skills · ...`)
+- [ ] About description updated (`71 agents · 196 skills · ...`)
 - [ ] Topics set (20 max)
 - [ ] Wiki pages pushed via `git push` to wiki repo
 - [ ] Discussions enabled + welcome post pinned

package/README.md

@@ -25,14 +25,14 @@ AI:    → Routing to debug-detective (your error + frustration matches the bug-
 ```
 
 You never typed `use debug-detective`. You did not have to — ECC read the intent,
-picked the specialist out of 70, and told you which one it chose and why.
+picked the specialist out of 71, and told you which one it chose and why.
 
 ```bash
 npx kodelyth-ecc
 ```
 
 Works on **macOS, Linux and Windows** with Claude Code, Windsurf, Cursor, Codex CLI,
-Google Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi and Gemini CLI.
+Google Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI and Kiro.
 
 ---
 
@@ -50,7 +50,7 @@ Google Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi and Gemini CLI.
 ![Antigravity](https://img.shields.io/badge/Antigravity-Ready-00ADD8)
 ![Cursor](https://img.shields.io/badge/Cursor-Ready-3b82f6)
 ![Codex](https://img.shields.io/badge/Codex-Ready-10b981)
-![Agents](https://img.shields.io/badge/Agents-70-brightgreen)
+![Agents](https://img.shields.io/badge/Agents-71-brightgreen)
 ![Devil Mode](https://img.shields.io/badge/Devil%20Mode-new-red)
 ![Skills](https://img.shields.io/badge/Skills-196-brightgreen)
 ![Memory](https://img.shields.io/badge/Local%20Memory-on-blueviolet)
@@ -65,7 +65,7 @@ Google Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi and Gemini CLI.
 
 </div>
 
-**Kodelyth ECC** is a production-grade AI coding toolkit — **70 specialist agents (incl. an 8-agent devil-mode adversarial crew), 196 skills, 103 commands**, a god-tier **semantic intent-routing system**, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
+**Kodelyth ECC** is a production-grade AI coding toolkit — **71 specialist agents (incl. an 8-agent devil-mode adversarial crew), 196 skills, 104 commands**, a god-tier **semantic intent-routing system**, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
 
 Now bundled with:
 
@@ -93,22 +93,22 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
 | Layer | What it does | Other kits |
 |---|---|---|
 | **Intent routing** | Plain-language → right specialist via 10-tier priority rules | Mostly missing — you memorize names |
-| **70 agents** | Specialists with playbooks, severity calibration, real commands | Often persona-only ("you are a senior engineer...") |
+| **71 agents** | Specialists with playbooks, severity calibration, real commands | Often persona-only ("you are a senior engineer...") |
 | **196 skills** | Domain knowledge files agents read on demand | Rarely separated from agents |
-| **103 commands** | Slash workflows (`/tdd`, `/arena`, `/devil-mode`, `/team-review`) | Limited or none |
+| **104 commands** | Slash workflows (`/tdd`, `/arena`, `/devil-mode`, `/team-review`) | Limited or none |
 | **8 parallel commands** | Fire 3-8 agents simultaneously, aggregate results | Rare |
 | **Compound memory** | BM25 local recall + auto-inject + project lessons | Cloud-only or absent |
 | **44 hook entries** | Quality gates, secret scan, project-DNA detection | Often missing |
-| **11 IDE platforms** | Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI (13 install targets) | 1-2 platforms typical |
+| **12 IDE platforms** | Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI, Kiro (14 install targets) | 1-2 platforms typical |
 | **Zero telemetry** | Everything stays on your disk; verifiable | Many kits phone home |
 
 ### Quick Comparison vs Other Kits
 
 | Feature | **Kodelyth ECC** | `agency-agents` | `awesome-claude-agents` | Generic prompt libs |
 |---|---|---|---|---|
-| Specialist agents | **70** | ~30 | ~20 | Varies |
+| Specialist agents | **71** | ~30 | ~20 | Varies |
 | Skills as separate layer | ✓ 196 | ✗ | ✗ | ✗ |
-| Slash commands | ✓ 103 | Some | Some | ✗ |
+| Slash commands | ✓ 104 | Some | Some | ✗ |
 | **Parallel multi-agent commands** | ✓ 8 (incl. `/devil-mode`) | ✗ | ✗ | ✗ |
 | **Intent routing (plain language → agent)** | ✓ 10-tier rule | ✗ | ✗ | ✗ |
 | **Local BM25 self-learning memory** | ✓ | ✗ | ✗ | ✗ |
@@ -126,7 +126,7 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
 ## Install
 
 <div align="center">
-<img src="social/section-install.svg" alt="Install — One command, 11 platforms, any OS" width="900"/>
+<img src="social/section-install.svg" alt="Install — One command, 12 platforms, any OS" width="900"/>
 </div>
 
 ### The lazy install (one command, everything wired up)
@@ -140,7 +140,7 @@ kodelythecc --target claude-code --codebase-graph
 That's it. This single flow:
 
 1. Installs both binaries (`kodelyth-ecc` and short-form `kodelythecc`) to your PATH
-2. Copies 70 agents + 196 skills + 103 commands + 44 hook entries + 15 rules into your AI tool's config dir
+2. Copies 71 agents + 196 skills + 104 commands + 44 hook entries + 15 rules into your AI tool's config dir
 3. Auto-installs **RTK** binary and wires its PreToolUse hook (input compression starts on next AI restart)
 4. Installs **Terse mode** skill + `/terse` and `/terse-compress` slash commands (dormant — user types `/terse` to activate)
 5. Auto-installs **codebase-memory-mcp** and registers its MCP entries in your AI tool (with `--codebase-graph`)
@@ -227,8 +227,8 @@ PowerShell 5.1 that ships with the OS. The installer tries `pwsh` first and fall
 back automatically, and it passes `-ExecutionPolicy Bypass` for its own process
 only, so you do not need to change your machine's execution policy.
 
-**Everything installs automatically**, same as macOS and Linux: the 70 agents,
-196 skills, 103 commands, 15 rules, all 44 hook entries registered into
+**Everything installs automatically**, same as macOS and Linux: the 71 agents,
+196 skills, 104 commands, 15 rules, all 44 hook entries registered into
 `settings.json`, the ECC MCP server (16 tools), Terse mode, **RTK**, and the
 **codebase graph**.
 
@@ -284,7 +284,7 @@ npx kodelyth-ecc --bundle red-team        # Security engineer — devil-mode + a
 npx kodelyth-ecc --bundle enterprise      # Compliance / audit team — SBOM, license, supply chain
 ```
 
-Each bundle installs the full ECC toolkit (all 70 agents, 196 skills, 103 commands, 44 hook entries), adds a `BUNDLE.md` cheat sheet, and biases the AI toward audience-fit workflows on every session.
+Each bundle installs the full ECC toolkit (all 71 agents, 196 skills, 104 commands, 44 hook entries), adds a `BUNDLE.md` cheat sheet, and biases the AI toward audience-fit workflows on every session.
 
 Combine with any target:
 
@@ -327,7 +327,7 @@ What it exposes (all local, zero telemetry):
 
 - **16 tools** — `route_intent`, `recall_memory`, `capture_memory`, `list_agents`, `get_skill`, `audit_skill_match`, …
 - **6 prompts** — full intent routing rule, agents/skills/commands overviews, handoff chains, devil-mode
-- **365 resources** — every agent, skill, command, rule, and bundle addressable via `kodelyth://...` URIs
+- **389 resources** — every agent, skill, command, rule, and bundle addressable via `kodelyth://...` URIs
 
 Drop into Claude Desktop in 30 seconds:
 
@@ -481,7 +481,7 @@ What's inside:
 | **Overview** | Agent count, memory stats, session count, recent activity |
 | **Memory** | Browse, search, and manage your local BM25 memory store |
 | **Evolve** | Self-improving memory — review AI-proposed refinements |
-| **Catalog** | Full searchable index of all 70 agents, 196 skills, 103 commands |
+| **Catalog** | Full searchable index of all 71 agents, 196 skills, 104 commands |
 | **Sessions** | **Live IDE activity** (Claude Code, Windsurf, Windsurf-Next, Cursor, Antigravity) + orchestration/swarm sessions |
 
 Real-time:
@@ -769,7 +769,7 @@ Month 3:    You try another tool
 |---|---|---|---|
 | **Project Lessons** | `tasks/lessons.md` | Per-project | Hard rules from your corrections. Injected at session start as mandatory context. |
 | **Global Memory** | `~/.kodelyth/memory/` | Cross-project | BM25 fuzzy recall of past solutions. Auto-fires on every prompt you type. |
-| **Intent Routing** | 70 agents | Always-on | Routes your message to the right specialist from the first word. No names needed. |
+| **Intent Routing** | 71 agents | Always-on | Routes your message to the right specialist from the first word. No names needed. |
 
 ### How it works under the hood
 
@@ -806,7 +806,7 @@ Project: **my-app**
 
 | Component | Count | Description |
 |---|---|---|
-| Agents | **70** | Specialist subagents — reviewers, planners, debuggers, architects, devil-mode adversarial crew, incident-commander, load-tester, memory, image-architect |
+| Agents | **71** | Specialist subagents — reviewers, planners, debuggers, architects, the super-agent orchestrator, devil-mode adversarial crew, incident-commander, load-tester, memory, image-architect |
 | Skills | **194** | Domain knowledge — patterns, testing, security, DevOps, intent routing, memory |
 | Commands | **97** | Slash command workflows (`/tdd`, `/plan`, `/memory`, `/devil-mode`, `/doctor`, `/update`, etc.) |
 | Parallel commands | **8** | `/devil-mode`, `/team-review`, `/security-audit`, `/debug-blitz`, `/refactor-sprint`, `/pre-release`, `/onboard`, `/project-launch` |
@@ -819,11 +819,11 @@ Project: **my-app**
 ## Agent Arsenal
 
 <div align="center">
-<img src="social/section-agents.svg" alt="70 specialist agents — one for every situation" width="900"/>
+<img src="social/section-agents.svg" alt="71 specialist agents — one for every situation" width="900"/>
 </div>
 
 <div align="center">
-<img src="social/readme-agents.svg" alt="70 specialist agents — agent grid preview" width="900"/>
+<img src="social/readme-agents.svg" alt="71 specialist agents — agent grid preview" width="900"/>
 </div>
 
 ### Kodelyth Exclusives — The 16 Agents That Make ECC
@@ -954,7 +954,7 @@ The intent router will route you to the right one. The AI announces who's taking
 
 | Source | Destination | What it does |
 |---|---|---|
-| `agents/` | `~/.claude/agents/` | All 70 subagents available globally |
+| `agents/` | `~/.claude/agents/` | All 71 subagents available globally |
 | `skills/` | `~/.claude/skills/` | All 196 skills loadable via commands |
 | `hooks/hooks.json` | `~/.claude/hooks/` | Automated quality gates |
 | `rules/` | `~/.claude/rules/` | Always-on standards + intent routing |
@@ -1081,7 +1081,7 @@ v1.7.3 highlights:
 
 v1.7.0 highlights:
 
-- **MCP Server** — 16 tools, 6 prompts, 377 resources; stdio JSON-RPC; zero telemetry; works with Claude Desktop, LangGraph, AutoGen, CrewAI, OpenAI Agents SDK
+- **MCP Server** — 16 tools, 6 prompts, 389 resources; stdio JSON-RPC; zero telemetry; works with Claude Desktop, LangGraph, AutoGen, CrewAI, OpenAI Agents SDK
 - **Dashboard hardening** — DNS rebinding protection, shell injection fix (`execFileSync`), CSP on all responses, SSE client cap (max 10), TOCTOU fixes
 - **Devil Mode** — 8 adversarial agents, `--pre-public` / `--pre-launch` / `--all` flags, real bash-grep patterns and remediation playbooks
 - **336 tests** passing across 25 test files (now 373 at v1.8.0)

package/VERSION

@@ -1 +1 @@
-2.24.1
+2.30.0

package/agents/super-agent.md

@@ -0,0 +1,102 @@
+---
+name: super-agent
+description: Autonomous multi-step orchestrator — Kodelyth. Takes a single large objective and drives it to done through a deterministic state machine: decompose into a dependency DAG, route and dispatch each step (parallel where independent), evaluate against exit criteria, merge the worker branches with conflict detection, and verify. Resumable and budget-governed. Use for objectives that are too big for one pass and decompose into dependent steps. NOT for a single edit or a one-file change.
+tools: Read, Grep, Glob, Bash, Write, Edit, Task
+model: opus
+---
+
+# Super Agent — the autonomous orchestrator
+
+You are the driver of a tokenless state machine. You do **not** improvise the
+control flow — the machine owns it, so a run is deterministic, resumable, and
+bounded. Your job is to perform each action the machine asks for, using ECC's
+existing primitives, and report the result back.
+
+The machine lives in `scripts/super-agent/` and is driven entirely through:
+
+```bash
+kodelythecc super-agent <command> ...
+```
+
+## The loop
+
+1. **Start** a run from the objective:
+   ```bash
+   kodelythecc super-agent start --goal "<objective>" [--token-cap N] [--step-cap N] [--scope .]
+   ```
+   Always set a `--step-cap` or `--token-cap`. An autonomous run without a budget
+   is how costs run away. The output gives you a `runId` and the first action.
+
+2. **Ask what to do next**, and do exactly that:
+   ```bash
+   kodelythecc super-agent next <runId>
+   ```
+   The JSON `action` is one of:
+
+   - **`decompose`** — Break the goal into a dependency DAG. Use the `blueprint`
+     skill to produce it: each step is `{ id, description, deps: [ids],
+     contextBrief, exitCriteria }`. `contextBrief` must let a fresh agent execute
+     the step cold. Write the array to a file and install it:
+     ```bash
+     kodelythecc super-agent plan <runId> --file plan.json
+     ```
+
+   - **`dispatch`** — The listed steps are ready (their dependencies are done).
+     For a single small step, do it yourself or with one subagent. For several
+     independent steps, run them in parallel (the Task tool, or
+     `kodelythecc swarm` for isolated git worktrees). Each step does its work on
+     its **own branch**. As each finishes, report it:
+     ```bash
+     kodelythecc super-agent step <runId> <stepId> --status done --branch <branch> [--tokens N]
+     # or, if it could not be completed:
+     kodelythecc super-agent step <runId> <stepId> --status failed
+     ```
+     A failed step whose result others depend on stalls the run — that is the
+     machine protecting you from building on a broken foundation.
+
+   - **`integrate`** — All steps are done. Merge the worker branches. Detect
+     conflicts first, without touching the tree, via
+     `scripts/super-agent/integrate.js` (`mergeOrder` for the order,
+     `detectConflicts` for the check). If clean, merge in that order and:
+     ```bash
+     kodelythecc super-agent integrate <runId>
+     ```
+     If branches conflict, do **not** force it — report the conflicting files and
+     stop for a human:
+     ```bash
+     kodelythecc super-agent integrate <runId> --conflicts path/a,path/b
+     ```
+
+   - **`verify`** — Run the real verification gate (tests, build, type-check — use
+     `/verify`). Then:
+     ```bash
+     kodelythecc super-agent verify <runId> --passed --detail "693 tests pass"
+     # or --failed --detail "2 tests red"
+     ```
+
+   - **`halt`** — The budget cap was reached or the plan stalled. Stop and report
+     the reason. Do not work around the cap.
+
+   - **`report`** — The run is done, failed, or stopped. Summarize with
+     `kodelythecc super-agent status <runId>`.
+
+3. **Repeat** `next` → act → submit until the action is `report`.
+
+## Resuming
+
+A run persists after every step. To pick up a crashed or earlier run:
+`kodelythecc super-agent list`, then `kodelythecc super-agent next <runId>` — it
+continues from exactly where it stopped.
+
+## Rules
+
+- Never fabricate a step result. If a step did not actually succeed, submit it as
+  `--status failed` — the machine handles the consequences honestly.
+- Never bypass the budget or an `integrate` conflict. Those stops exist on purpose.
+- The verification gate is real: only submit `--passed` when tests/build actually
+  pass, with evidence in `--detail`.
+- Decompose into the smallest steps that still make sense as a unit of work, with
+  honest dependency edges — parallelism and correct integration both depend on
+  the edges being right.
+
+You are the calm operator of a machine that cannot lie about its own state.