melchizedek-agents 0.16.2 → 0.17.0

package/dist/lib/a2a/app.d.ts

@@ -31,6 +31,7 @@ import type { BaseLlm, BaseMemoryService, BaseSessionService } from '@google/adk
 import type { SyndicateYamlConfig } from '../loadSyndicate.ts';
 import type { ProviderEndpoint, ProviderId } from '../models/registry.ts';
 import type { TurnLock } from './turnLock.ts';
+import type { RlsHardeningStatus } from '../storage/rlsStatus.ts';
 import type { EraseCounts } from '../memory/erase.ts';
 import type { Embedder, MemoryExtractor } from '../memory/providers.ts';
 import type { A2AContext } from './executor.ts';
@@ -68,6 +69,12 @@ export interface A2AAppOptions {
          * migrations this package ships (ADR 0021).
          */
         schemaVersion?: () => Promise<number | null>;
+        /**
+         * Whether db/hardening.sql is in force (postgresStorage supplies it).
+         * When given, the server checks it at boot like the supabase-js path:
+         * fatal with `requireHardenedDb`, a warning otherwise.
+         */
+        rlsHardening?: () => Promise<RlsHardeningStatus>;
         /**
          * One turn at a time per conversation across instances (postgresStorage
          * supplies an advisory lock). Default: a lock in this process.

package/dist/lib/a2a/app.js

@@ -187,11 +187,13 @@ export async function createA2AApp(options) {
     let memoryService;
     let erase;
     let readSchemaVersion;
+    let checkHardening;
     if (options.storage) {
         durableSessions = options.storage.sessionService;
         memoryService = options.storage.memoryService;
         erase = options.storage.erase;
         readSchemaVersion = options.storage.schemaVersion;
+        checkHardening = options.storage.rlsHardening;
     }
     else if (hasSupabaseCredentials()) {
         // ADR 0021 item 6: the supabase-js path stays for a transition period.
@@ -209,7 +211,11 @@ export async function createA2AApp(options) {
         memoryService = services.memoryService;
         erase = (scopeKey, eraseOpts) => eraseScope(services.rpcClient, scopeKey, eraseOpts);
         readSchemaVersion = services.schemaVersion;
-        const rls = await services.checkRlsHardening();
+        checkHardening = services.checkRlsHardening;
+    }
+    // Both storage paths: refuse a public deployment whose tables an API key can read.
+    if (checkHardening) {
+        const rls = await checkHardening();
         if (rls.applied) {
             log(`✓ DB hardening verified — ${rls.detail}.`);
         }

package/dist/lib/a2a/executor.js

@@ -19,6 +19,7 @@ import { turnLockKey } from './turnLock.js';
 import { ingestTurnMemory, runSyndicateTurn } from '../runtime/syndicateTurn.js';
 import { approvalResponsePart, describeApproval, pendingApproval } from '../runtime/approvals.js';
 import { declaresApprovals } from '../compile.js';
+import { describeInput } from '../runtime/syndicateTurn.js';
 export const requestContextStorage = new AsyncLocalStorage();
 /** The app name every A2A session and memory silo is stored under. */
 export const A2A_APP_NAME = 'melchizedek-a2a';
@@ -72,6 +73,9 @@ export function describeFailedTurn(result) {
     if (result.failedStage === 'dispatch' && result.route) {
         return `Error: [${error.code}] ${result.route.route} failed to answer — ${describeTurnError(error)}`;
     }
+    if (result.failedStage === 'workflow') {
+        return `Error: [${error.code}] The workflow failed — ${describeTurnError(error)}`;
+    }
     return `Error: [${error.code}] The agent run failed — ${describeTurnError(error)}`;
 }
 /**
@@ -209,6 +213,37 @@ function publishWorking(eventBus, taskId, contextId, text) {
         metadata: undefined,
     }));
 }
+/**
+ * A workflow paused on an `ask_user` node (lib/workflow.ts): the task ends
+ * input-required with the question, and a data part carrying it. The
+ * answer is simply the next message on the conversation; its text becomes
+ * the node's output and the graph resumes where it waited.
+ */
+function publishInputRequest(eventBus, taskId, contextId, input) {
+    const message = statusMessage(taskId, contextId, `Input needed: ${describeInput(input)}`);
+    message.parts.push({
+        content: {
+            $case: 'data',
+            value: {
+                type: 'input_request',
+                interrupt_id: input.id,
+                node: input.node,
+                message: input.message,
+                ...(input.payload !== undefined ? { payload: input.payload } : {}),
+                ...(input.schema !== undefined ? { schema: input.schema } : {}),
+            },
+        },
+        metadata: undefined,
+        filename: '',
+        mediaType: 'application/json',
+    });
+    eventBus.publish(AgentEvent.statusUpdate({
+        taskId,
+        contextId,
+        status: { state: TaskState.TASK_STATE_INPUT_REQUIRED, message, timestamp: new Date().toISOString() },
+        metadata: undefined,
+    }));
+}
 /**
  * The turn paused on a gated tool call (ADR 0028): the task ends
  * input-required, saying what is to be approved, with a data part a client
@@ -497,6 +532,12 @@ export class SyndicateExecutor {
                 await report(ctx, 'input-required', 'approval', u);
                 return;
             }
+            if (result.status === 'input-required' && result.input) {
+                log(`⏸ Task ${short} waiting for input from ${result.input.node} after ${spent}`);
+                publishInputRequest(eventBus, taskId, contextId, result.input);
+                await report(ctx, 'input-required', 'input', u);
+                return;
+            }
             if (result.status === 'failed') {
                 warn(`✗ Task ${short} failed [${result.error?.code}] after ${spent}`);
                 publishFinal(eventBus, taskId, contextId, 'failed', describeFailedTurn(result));

package/dist/lib/compile.d.ts

@@ -28,8 +28,10 @@
  * Contract and rationale: lib/dispatch.ts.
  */
 import { FunctionTool, LlmAgent } from '@google/adk';
+import type { BaseTool } from '@google/adk';
 import type { BaseLlm } from '@google/adk';
 import type { SubagentYamlConfig, SyndicateYamlConfig } from './loadSyndicate.ts';
+import type { SkillsConfig } from './tools/skillToolset.ts';
 export interface CompileOptions {
     /**
      * Turns the YAML `model` string into what LlmAgent receives. Default:
@@ -48,7 +50,23 @@ export interface CompileOptions {
     onUnknownTool?: (name: string) => void;
     /** Progress/diagnostic line sink (nested loads, MCP discovery). */
     log?: (message: string) => void;
+    /**
+     * Node settings for an agent compiled as a workflow node (lib/workflow.ts):
+     * ADK's `retryConfig` and `timeout`, which an LlmAgent takes only at
+     * construction. Called with the agent's name; undefined means none.
+     */
+    nodeConfig?: (agentName: string) => Record<string, unknown> | undefined;
 }
+/** An agent's `context:` block: compact a long conversation into a summary (ADR 0033). */
+export interface ContextConfig {
+    /** Compact when the last request's prompt passed this many tokens. */
+    compact_after_tokens: number;
+    /** Events kept verbatim after the summary. Default 6. */
+    keep_recent_events?: number;
+    /** The model that writes the summary. Default: the agent's own. */
+    summary_model?: string;
+}
+export declare const DEFAULT_KEEP_RECENT_EVENTS = 6;
 /**
  * A copy of a FunctionTool that runs only after a person approves the call
  * (ADR 0028). ADK's own gate does the work: the call raises an
@@ -57,8 +75,29 @@ export interface CompileOptions {
  * ungated for every other agent that lists the same tool.
  */
 export declare function requireApprovalOn(tool: FunctionTool): FunctionTool;
-/** True when any agent of a syndicate declares an approval gate. */
+/**
+ * A copy of an OpenAPI tool (lib/tools/openapiTools.ts) that runs only after
+ * a person approves the call: the same confirmation interrupt FunctionTool's
+ * own gate raises, so the turn pauses and resumes exactly as ADR 0028 says.
+ */
+export declare function requireApprovalOnBaseTool<T extends BaseTool>(tool: T): T;
+/** True when any agent of a syndicate may pause for approval: a gated tool, or skill scripts. */
 export declare function declaresApprovals(config: SyndicateYamlConfig): boolean;
+/** An agent's `examples:` entry: one exchange the model should imitate. */
+export interface ExampleConfig {
+    input: string;
+    output: string;
+}
+/**
+ * ADK's ExampleTool from YAML pairs: never called by the model, it adds the
+ * exchanges to every request's instruction as few-shot examples.
+ */
+export declare function examplesTool(examples: ExampleConfig[] | undefined): unknown[];
+/** True when a turn running this agent directly may pause for a person (ADR 0028). */
+export declare function agentGates(agent: {
+    require_approval?: string[];
+    skills?: SkillsConfig;
+} | undefined): boolean;
 /**
  * Builds ONE runnable agent from a subagent entry. A `yaml_reference` entry
  * compiles the nested syndicate's whole graph under this entry's name and

package/dist/lib/compile.js

@@ -27,13 +27,16 @@
  * dispatches to is identical to the one DELEGATE would have wrapped.
  * Contract and rationale: lib/dispatch.ts.
  */
-import { AgentTool, FunctionTool, LlmAgent } from '@google/adk';
+import { AgentTool, BuiltInCodeExecutor, ExampleTool, FunctionTool, LLMRegistry, LlmAgent, LlmSummarizer, TokenBasedContextCompactor } from '@google/adk';
+import { relative } from 'node:path';
 import { isDispatchSyndicate } from './dispatch.js';
 import { loadSyndicate, nestedLoader } from './loadSyndicate.js';
 import { resolveTools as resolveNamedTools } from './toolRegistry.js';
 import { createMcpTools } from './tools/mcpToolFactory.js';
 import { capabilitySummary, describeCapabilities } from './models/capabilities.js';
 import { remoteAgentTool } from './a2a/remoteAgent.js';
+import { buildSkillHarness } from './tools/skillToolset.js';
+import { buildOpenApiTools, isOpenApiTool, namesTool } from './tools/openapiTools.js';
 /** generateContentConfig as every entrypoint has always sent it to ADK. */
 function withServerSideToolInvocations(generateContentConfig) {
     const cfg = (generateContentConfig ?? {});
@@ -68,6 +71,36 @@ function passthroughFields(cfg) {
         out.disallowTransferToPeers = cfg.disallowTransferToPeers;
     return out;
 }
+export const DEFAULT_KEEP_RECENT_EVENTS = 6;
+/**
+ * The LlmAgent fields the engine builds from YAML rather than passing
+ * through (ADR 0033): `code_execution: gemini` (Gemini's server-side
+ * sandbox runs the model's Python; nothing runs on this host), `context:`
+ * (ADK's token-based compactor with an LLM summarizer, so a long
+ * conversation is summarized instead of overflowing the window), and
+ * `mode: task` (the agent works until it calls finish_task; on a workflow
+ * node, its arguments become the node's output).
+ */
+function executionFields(cfg, opts) {
+    const out = {};
+    if (cfg.code_execution === 'gemini')
+        out.codeExecutor = new BuiltInCodeExecutor();
+    if (cfg.mode)
+        out.mode = cfg.mode;
+    if (cfg.context) {
+        const resolve = opts.resolveModel ?? ((m) => m);
+        const summaryModel = resolve(cfg.context.summary_model ?? cfg.model);
+        const llm = typeof summaryModel === 'string' || !summaryModel ? LLMRegistry.newLlm(String(summaryModel ?? cfg.model)) : summaryModel;
+        out.contextCompactors = [
+            new TokenBasedContextCompactor({
+                tokenThreshold: cfg.context.compact_after_tokens,
+                eventRetentionSize: cfg.context.keep_recent_events ?? DEFAULT_KEEP_RECENT_EVENTS,
+                summarizer: new LlmSummarizer({ llm }),
+            }),
+        ];
+    }
+    return out;
+}
 /**
  * Says, once per compiled agent, what its resolved path cannot honour — a
  * dropped server-side tool, a gateway stand-in, or no route at all. Quiet
@@ -95,17 +128,46 @@ export function requireApprovalOn(tool) {
     Object.defineProperty(gated, 'requireConfirmation', { value: true, enumerable: false });
     return gated;
 }
+/**
+ * A copy of an OpenAPI tool (lib/tools/openapiTools.ts) that runs only after
+ * a person approves the call: the same confirmation interrupt FunctionTool's
+ * own gate raises, so the turn pauses and resumes exactly as ADR 0028 says.
+ */
+export function requireApprovalOnBaseTool(tool) {
+    const gated = Object.create(tool);
+    Object.defineProperty(gated, 'runAsync', {
+        value: async (request) => {
+            const ctx = request.toolContext;
+            if (!ctx.toolConfirmation) {
+                ctx.requestConfirmation({ hint: `Approval is required before ${tool.name} runs.`, payload: request.args });
+                ctx.actions.skipSummarization = true;
+                return { error: 'This call requires approval, please approve or reject.' };
+            }
+            if (!ctx.toolConfirmation.confirmed)
+                return { error: 'This call was rejected.' };
+            return tool.runAsync(request);
+        },
+    });
+    return gated;
+}
 function gateTools(tools, names, agentName) {
     if (!names?.length)
         return tools;
     const wanted = new Set(names);
     const out = tools.map((t) => {
-        const name = t?.name;
-        if (!name || !wanted.has(name))
+        const tool = t;
+        const name = tool?.name;
+        if (!name)
+            return t;
+        // An OpenAPI operation may be named as the YAML named it (its operationId).
+        const match = [...wanted].find((w) => w === name || (isOpenApiTool(t) && namesTool(w, { name, operation: tool.operation })));
+        if (!match)
             return t;
-        wanted.delete(name);
+        wanted.delete(match);
+        if (isOpenApiTool(t))
+            return requireApprovalOnBaseTool(t);
         if (!(t instanceof FunctionTool)) {
-            throw new Error(`${agentName}: '${name}' cannot require approval — only function tools from the registry can be gated (ADR 0028).`);
+            throw new Error(`${agentName}: '${name}' cannot require approval — only function tools from the registry and OpenAPI operations can be gated (ADR 0028).`);
         }
         return requireApprovalOn(t);
     });
@@ -116,12 +178,33 @@ function gateTools(tools, names, agentName) {
     }
     return out;
 }
-/** True when any agent of a syndicate declares an approval gate. */
+/** True when any agent of a syndicate may pause for approval: a gated tool, or skill scripts. */
 export function declaresApprovals(config) {
-    return !!config.orchestrator?.require_approval?.length || (config.subagents ?? []).some((s) => !!s.require_approval?.length);
+    return agentGates(config.orchestrator) || (config.subagents ?? []).some((s) => agentGates(s));
+}
+/**
+ * ADK's ExampleTool from YAML pairs: never called by the model, it adds the
+ * exchanges to every request's instruction as few-shot examples.
+ */
+export function examplesTool(examples) {
+    if (!examples?.length)
+        return [];
+    return [
+        new ExampleTool(examples.map((e) => ({ input: { role: 'user', parts: [{ text: e.input }] }, output: [{ role: 'model', parts: [{ text: e.output }] }] }))),
+    ];
 }
-async function resolveAgentTools(toolNames, mcpServerUrl, opts) {
-    const tools = resolveNamedTools(toolNames, opts.onUnknownTool);
+async function resolveAgentTools(toolNames, mcpServerUrl, opts, openapi, examples) {
+    const tools = [...resolveNamedTools(toolNames, opts.onUnknownTool), ...examplesTool(examples)];
+    // OpenAPI operations become tools here, so require_approval can name them.
+    for (const entry of openapi ?? []) {
+        const built = await buildOpenApiTools(entry);
+        opts.log?.(`openapi · ${relative(process.cwd(), entry.spec) || entry.spec}: ${built.map((t) => t.name).join(', ') || '(no operations)'}`);
+        for (const t of built) {
+            if (tools.some((existing) => existing?.name === t.name))
+                throw new Error(`openapi ${entry.spec}: tool '${t.name}' collides with another tool; set a prefix`);
+            tools.push(t);
+        }
+    }
     if (mcpServerUrl) {
         opts.log?.(`Loading MCP tools: ${mcpServerUrl}`);
         const mcpTools = await createMcpTools(mcpServerUrl);
@@ -132,6 +215,28 @@ async function resolveAgentTools(toolNames, mcpServerUrl, opts) {
     }
     return tools;
 }
+/**
+ * An agent's `skills:` block becomes one toolset among its tools and one
+ * block appended to its instruction (the frontmatter index, always in view).
+ * The registry tools a skill may unlock (`skills.tools`) are resolved here,
+ * by name, and handed to the toolset; they reach the model only after a
+ * skill naming them is loaded (lib/tools/skillToolset.ts).
+ */
+async function withSkills(instruction, tools, skills, agentName, opts) {
+    if (!skills)
+        return { instruction, tools };
+    const unlockable = resolveNamedTools(skills.tools, opts.onUnknownTool);
+    const harness = await buildSkillHarness(skills, unlockable);
+    const count = Object.keys(harness.skills).length;
+    opts.log?.(`skills · ${agentName}: ${count} skill${count === 1 ? '' : 's'} from ${skills.dir}${skills.scripts === 'local' ? ' · scripts run after approval' : ''}`);
+    for (const problem of harness.problems)
+        opts.log?.(`⚠ skills · ${skills.dir}: not loaded — ${problem}`);
+    return { instruction: `${instruction.trimEnd()}\n\n${harness.instruction}`, tools: [...tools, harness.toolset] };
+}
+/** True when a turn running this agent directly may pause for a person (ADR 0028). */
+export function agentGates(agent) {
+    return !!agent?.require_approval?.length || agent?.skills?.scripts === 'local';
+}
 /**
  * Builds ONE runnable agent from a subagent entry. A `yaml_reference` entry
  * compiles the nested syndicate's whole graph under this entry's name and
@@ -154,18 +259,21 @@ export async function compileSubagent(subCfg, opts = {}) {
         }
         return compileGraph(nested, opts, subCfg.name, subCfg.description);
     }
-    const tools = gateTools(await resolveAgentTools(subCfg.tools, subCfg.mcp_server_url, opts), subCfg.require_approval, subCfg.name);
+    const gated = gateTools(await resolveAgentTools(subCfg.tools, subCfg.mcp_server_url, opts, subCfg.openapi, subCfg.examples), subCfg.require_approval, subCfg.name);
+    const { instruction, tools } = await withSkills(subCfg.instruction ?? '', gated, subCfg.skills, subCfg.name, opts);
     const resolveModel = opts.resolveModel ?? ((m) => m);
     logCapabilities(opts, subCfg.name, subCfg.model, subCfg.tools);
     return new LlmAgent({
         name: subCfg.name,
         description: subCfg.description,
         model: resolveModel(subCfg.model),
-        instruction: subCfg.instruction,
+        instruction,
         tools: tools.length > 0 ? tools : undefined,
         outputSchema: subCfg.outputSchema,
         generateContentConfig: withServerSideToolInvocations(subCfg.generateContentConfig),
         ...passthroughFields(subCfg),
+        ...executionFields(subCfg, opts),
+        ...(opts.nodeConfig?.(subCfg.name) ?? {}),
     });
 }
 /**
@@ -178,6 +286,14 @@ export async function compileGraph(config, opts = {}, overrideName, overrideDesc
     // A registry definition carries its nested syndicates (ADR 0018 item 6).
     if (config.bundled_references && !opts.loadNested)
         opts = { ...opts, loadNested: nestedLoader(config) };
+    // A graph has no orchestrator-with-tools shape to build: its agents are
+    // nodes (lib/workflow.ts). Nested as a yaml_reference, only its
+    // orchestrator runs, since ADK cannot yet make a Workflow a subagent.
+    if (config.workflow && !overrideName) {
+        throw new Error(`${config.syndicate_name}: a workflow syndicate is compiled with compileWorkflow (lib/workflow.ts), not compileGraph`);
+    }
+    if (config.workflow)
+        opts.log?.(`${config.syndicate_name}: nested as a subagent, so only its orchestrator runs (a Workflow cannot be a subagent yet)`);
     const compiledTools = isDispatchSyndicate(config)
         ? []
         : await Promise.all((config.subagents ?? []).map(async (subCfg) => {
@@ -190,17 +306,19 @@ export async function compileGraph(config, opts = {}, overrideName, overrideDesc
     // Orchestrator tools are registry names only — no entrypoint has ever
     // attached an MCP server to an orchestrator, and this compiler preserves
     // that exactly rather than widening the contract in passing.
-    compiledTools.push(...gateTools(await resolveAgentTools(config.orchestrator.tools, undefined, opts), config.orchestrator.require_approval, overrideName || config.orchestrator.name));
+    compiledTools.push(...gateTools(await resolveAgentTools(config.orchestrator.tools, undefined, opts, config.orchestrator.openapi, config.orchestrator.examples), config.orchestrator.require_approval, overrideName || config.orchestrator.name));
+    const { instruction, tools: orchestratorTools } = await withSkills(config.orchestrator.instruction, compiledTools, config.orchestrator.skills, overrideName || config.orchestrator.name, opts);
     const resolveModel = opts.resolveModel ?? ((m) => m);
     logCapabilities(opts, overrideName || config.orchestrator.name, config.orchestrator.model, config.orchestrator.tools);
     return new LlmAgent({
         name: overrideName || config.orchestrator.name,
         description: overrideDescription || config.orchestrator.description,
         model: resolveModel(config.orchestrator.model),
-        instruction: config.orchestrator.instruction,
-        tools: compiledTools.length > 0 ? compiledTools : undefined,
+        instruction,
+        tools: orchestratorTools.length > 0 ? orchestratorTools : undefined,
         outputSchema: config.orchestrator.outputSchema,
         generateContentConfig: withServerSideToolInvocations(config.orchestrator.generateContentConfig),
         ...passthroughFields(config.orchestrator),
+        ...executionFields(config.orchestrator, opts),
     });
 }

package/dist/lib/config.d.ts

@@ -59,6 +59,23 @@ export declare const DEFAULT_GROK_MODEL = "grok-4.7";
  * accept the param and never receive it (lib/models/grokLlm.ts).
  */
 export declare const DEFAULT_GROK_REASONING_EFFORT = "medium";
+/**
+ * Default Moonshot model used when a kimi-* model is requested but no
+ * specific identifier is provided. Requires MOONSHOT_API_KEY
+ * (lib/models/kimiLlm.ts). kimi-k3 is the flagship, priced like a mid-tier
+ * closed model ($3 / $15, Claude Sonnet 4.6's price; Sonnet 5.5 is cheaper);
+ * kimi-k2.6 is the general tier at a quarter of that (the family table and
+ * the cost note are in the adapter's header).
+ */
+export declare const DEFAULT_KIMI_MODEL = "kimi-k3";
+/**
+ * Reasoning effort sent with kimi-k3 requests: 'low' | 'high' | 'max'
+ * (Moonshot's own default is 'max'; K3 always thinks and has no off switch).
+ * Pinned to HIGH — one step below max, which is the benchmark setting and
+ * the slowest; an agent sets generateContentConfig.reasoningEffort to
+ * override. Source: platform.moonshot.ai › Guides › Reasoning effort.
+ */
+export declare const DEFAULT_KIMI_REASONING_EFFORT = "high";
 /**
  * Default open-weight model, served locally by Ollama (lib/models/ollamaLlm.ts).
  * qwen3:8b is the smallest pulled model that supports tool calling — the

package/dist/lib/config.js

@@ -60,6 +60,23 @@ export const DEFAULT_GROK_MODEL = 'grok-4.7';
  * accept the param and never receive it (lib/models/grokLlm.ts).
  */
 export const DEFAULT_GROK_REASONING_EFFORT = 'medium';
+/**
+ * Default Moonshot model used when a kimi-* model is requested but no
+ * specific identifier is provided. Requires MOONSHOT_API_KEY
+ * (lib/models/kimiLlm.ts). kimi-k3 is the flagship, priced like a mid-tier
+ * closed model ($3 / $15, Claude Sonnet 4.6's price; Sonnet 5.5 is cheaper);
+ * kimi-k2.6 is the general tier at a quarter of that (the family table and
+ * the cost note are in the adapter's header).
+ */
+export const DEFAULT_KIMI_MODEL = 'kimi-k3';
+/**
+ * Reasoning effort sent with kimi-k3 requests: 'low' | 'high' | 'max'
+ * (Moonshot's own default is 'max'; K3 always thinks and has no off switch).
+ * Pinned to HIGH — one step below max, which is the benchmark setting and
+ * the slowest; an agent sets generateContentConfig.reasoningEffort to
+ * override. Source: platform.moonshot.ai › Guides › Reasoning effort.
+ */
+export const DEFAULT_KIMI_REASONING_EFFORT = 'high';
 /**
  * Default open-weight model, served locally by Ollama (lib/models/ollamaLlm.ts).
  * qwen3:8b is the smallest pulled model that supports tool calling — the

package/dist/lib/doctor.js

@@ -84,6 +84,7 @@ export const CONSOLE_URLS = {
     anthropic: 'https://console.anthropic.com',
     openai: 'https://platform.openai.com/api-keys',
     xai: 'https://console.x.ai',
+    moonshot: 'https://platform.moonshot.ai',
     ollama: 'https://ollama.com',
 };
 // ── Discovery ────────────────────────────────────────────────────────────────
@@ -162,8 +163,9 @@ function walk(config, prefix, opts, rows) {
     const orchModel = orch?.model;
     if (orch && orchModel) {
         // In DELEGATE mode the orchestrator calls its subagents as tools; under
-        // plan-dispatch it is a tool-less classifier and code runs the route.
-        const delegates = !config.dispatch && (config.subagents ?? []).length > 0;
+        // plan-dispatch it is a tool-less classifier and code runs the route; in
+        // a workflow it is one node of the graph.
+        const delegates = !config.dispatch && !config.workflow && (config.subagents ?? []).length > 0;
         rows.push({
             agent: prefix + orch.name,
             role: 'orchestrator',
@@ -390,6 +392,15 @@ const ANSI = {
     red: '\x1b[31m',
     cyan: '\x1b[36m',
 };
+/** One id per provider, in that provider's own prefix, for the providers line. */
+const PROBE_ID = {
+    gemini: 'gemini-x',
+    anthropic: 'claude-x',
+    openai: 'gpt-x',
+    xai: 'grok-x',
+    moonshot: 'kimi-x',
+    ollama: 'ollama/x',
+};
 function pad(s, n) {
     return s.length >= n ? s.slice(0, n - 1) + '…' : s.padEnd(n);
 }
@@ -405,9 +416,11 @@ export function renderDoctor(result, opts = {}) {
             : `${c.green}${text}${c.reset}`;
     lines.push(`${c.bold}melchizedek doctor${c.reset} ${c.dim}· ${result.agentsDir}${c.reset}`);
     lines.push('');
-    // Provider line: what is funded, and how.
+    // Provider line: what is funded, and how. Each provider is probed with an
+    // id of its own prefix, so the line names ITS key (a fallthrough once put
+    // xAI's key beside Moonshot).
     const providerBits = Object.keys(PROVIDERS).map((p) => {
-        const r = describeCapabilities(p === 'ollama' ? 'ollama/x' : p === 'gemini' ? 'gemini-x' : p === 'anthropic' ? 'claude-x' : p === 'openai' ? 'gpt-x' : 'grok-x');
+        const r = describeCapabilities(PROBE_ID[p]);
         const mark = !r.funded ? `${c.red}✗${c.reset}` : r.transport === 'gateway' ? `${c.yellow}◇${c.reset}` : `${c.green}✓${c.reset}`;
         const how = !r.funded ? `${c.dim}${r.keyEnv} not set${c.reset}` : r.transport === 'gateway' ? `${c.dim}via gateway:${r.gateway}${c.reset}` : p === 'ollama' ? `${c.dim}local${c.reset}` : `${c.dim}${r.platform ?? 'direct'}${c.reset}`;
         return `${mark} ${PROVIDERS[p].label} ${how}`;

package/dist/lib/index.d.ts

@@ -19,6 +19,8 @@ export type { PendingApproval } from './runtime/approvals.ts';
 export type { DrainedRun, MessagePart, TurnUsage, RouteDecision, SyndicateTurnOptions, SyndicateTurnResult, TraceOptions, TurnEvents, TurnStage, } from './runtime/syndicateTurn.ts';
 export { compileGraph, compileSubagent } from './compile.ts';
 export type { CompileOptions } from './compile.ts';
+export { compileWorkflow, isWorkflowSyndicate, describeInput } from './workflow.ts';
+export type { WorkflowConfig, WorkflowNodeYaml, EdgeElement, PendingInput, CompiledWorkflow } from './workflow.ts';
 export { createA2AApp, compileAgentCard, currentRequestContext } from './a2a/app.ts';
 export type { A2AApp, A2AAppOptions, RequestIdentity } from './a2a/app.ts';
 export type { A2AContext } from './a2a/executor.ts';

package/dist/lib/index.js

@@ -17,6 +17,7 @@ export { loadSyndicate, loadSyndicateFromRegistry, parseCliBindings, validateReg
 export { runSyndicateTurn, ingestTurnMemory } from './runtime/syndicateTurn.js';
 export { approvalResponsePart, pendingApproval, APPROVAL_REQUEST } from './runtime/approvals.js';
 export { compileGraph, compileSubagent } from './compile.js';
+export { compileWorkflow, isWorkflowSyndicate, describeInput } from './workflow.js';
 // ── Serve it over A2A, or call a remote A2A agent ───────────────────────────
 export { createA2AApp, compileAgentCard, currentRequestContext } from './a2a/app.js';
 export { callerTokens, firstOf, hashCallerToken, jwtIdentity, parseCallers, scopeSegment, sharedSecret, trustedHeader, } from './a2a/identity.js';

package/dist/lib/loadSyndicate.d.ts

@@ -1,5 +1,12 @@
 import type { DispatchConfig } from './dispatch.ts';
 export type { DispatchConfig } from './dispatch.ts';
+import type { SkillsConfig } from './tools/skillToolset.ts';
+import type { OpenApiConfig } from './tools/openapiTools.ts';
+import type { ContextConfig, ExampleConfig } from './compile.ts';
+export type { OpenApiConfig } from './tools/openapiTools.ts';
+export type { SkillsConfig } from './tools/skillToolset.ts';
+import type { WorkflowConfig } from './workflowConfig.ts';
+export type { WorkflowConfig } from './workflowConfig.ts';
 export interface ThinkingConfig {
     /** Token budget for internal reasoning. 0 = off, -1 = dynamic. */
     thinkingBudget?: number;
@@ -81,6 +88,26 @@ export interface AgentYamlConfig {
      */
     outputSchema?: Record<string, unknown>;
     mcp_server_url?: string;
+    /**
+     * Agent Skills (SKILL.md directories) this agent holds the way a coding
+     * harness does: the index in its instruction, a skill read on demand, its
+     * scripts run only after approval. lib/tools/skillToolset.ts.
+     */
+    skills?: SkillsConfig;
+    /**
+     * HTTP APIs this agent may call, each from an OpenAPI 3 spec file: one tool
+     * per operation, the GET operations unless `operations` names others, auth
+     * from environment variables. lib/tools/openapiTools.ts.
+     */
+    openapi?: OpenApiConfig[];
+    /** `gemini`: the model's Python runs in Gemini's server-side sandbox (ADR 0033). Gemini models only. */
+    code_execution?: 'gemini';
+    /** Compact a long conversation into a summary past a token threshold (ADR 0033). Delegate orchestrator only. */
+    context?: ContextConfig;
+    /** `task`: the agent works until it calls finish_task; its arguments are the node's output. Workflow nodes only. */
+    mode?: 'task';
+    /** Few-shot exchanges added to every request's instruction (ADK's ExampleTool). */
+    examples?: ExampleConfig[];
     orchestration?: {
         role?: 'primary' | 'sub-agent';
         delegates?: string[];
@@ -121,6 +148,24 @@ export interface SyndicateYamlConfig {
      * See lib/dispatch.ts for the full contract.
      */
     dispatch?: DispatchConfig;
+    /**
+     * Self-correction (ADK's reflect-and-retry plugins), on by default:
+     * `model_errors` retries a model reply ADK marks malformed (default 2),
+     * `tool_errors` caps a tool's retries after it throws, with structured
+     * guidance to the model (default 3). 0 turns either off. ADR 0034.
+     */
+    retries?: {
+        model_errors?: number;
+        tool_errors?: number;
+    };
+    /**
+     * Opts this syndicate into a WORKFLOW: a graph whose nodes are its agents
+     * (plus join, map, tool and ask_user nodes) and whose edges say what runs
+     * after what and on which route. The orchestrator is a node like any
+     * other; nothing delegates. Cannot be combined with `dispatch`.
+     * Contract: lib/workflow.ts.
+     */
+    workflow?: WorkflowConfig;
     /** Optional default variable definitions for {{token}} interpolation. */
     variables?: VariableMap;
     /** Defines the persistence and semantic memory layer for the syndicate. */
@@ -237,6 +282,7 @@ export declare function loadSyndicate(filename: string, options?: LoadSyndicateO
 export declare function readSyndicateFile(filename: string, options?: Pick<LoadSyndicateOptions, 'agentsDir' | 'shippedFallback'>): {
     raw: unknown;
     label: string;
+    filePath: string;
 };
 /**
  * Every nested `yaml_reference:` a syndicate reaches, read raw from the agents

package/dist/lib/loadSyndicate.js

@@ -228,8 +228,24 @@ export function collectGuards(config, loadNested = nestedLoader(config), seen =
 }
 export function loadSyndicate(filename, options = {}) {
     const { bindings = {}, overrides } = options;
-    const { raw, label } = readSyndicateFile(filename, options);
-    return resolveAndValidate(raw, label, { bindings, overrides });
+    const { raw, label, filePath } = readSyndicateFile(filename, options);
+    return anchorSpecPaths(resolveAndValidate(raw, label, { bindings, overrides }), path.dirname(filePath));
+}
+/**
+ * An `openapi:` spec path is written relative to the syndicate file, so a
+ * file copied with its specs keeps working from any working directory. A
+ * definition from the registry has no file and resolves against the cwd.
+ */
+function anchorSpecPaths(config, dir) {
+    const anchor = (agent) => {
+        for (const entry of agent?.openapi ?? [])
+            if (!path.isAbsolute(entry.spec))
+                entry.spec = path.resolve(dir, entry.spec);
+    };
+    anchor(config.orchestrator);
+    for (const sub of config.subagents ?? [])
+        anchor(sub);
+    return config;
 }
 /**
  * Read one syndicate file, unparsed values and all, from the agents root (the
@@ -266,7 +282,7 @@ export function readSyndicateFile(filename, options = {}) {
     // is under it), so a multi-file nested load says WHICH file is wrong.
     const rel = path.relative(process.cwd(), filePath);
     const label = rel && !rel.startsWith('..') && !path.isAbsolute(rel) ? rel : filePath;
-    return { raw: parse(fileContent), label };
+    return { raw: parse(fileContent), label, filePath };
 }
 /**
  * Every nested `yaml_reference:` a syndicate reaches, read raw from the agents

package/dist/lib/memory/erase.d.ts

@@ -8,6 +8,11 @@
  * markers, and (without a namespace) its task tools' list and jobs
  * (migration 0010), in one transaction. Returns what each store lost.
  *
+ * With a namespace, ledger turns and A2A tasks are kept only when their
+ * conversation is still live in another namespace (migration 0011): they do
+ * not record the namespace, and a conversation whose session expired must
+ * not survive an erase.
+ *
  * Throws on any failure: a deletion request that silently did nothing is
  * worse than an error the caller can surface and retry.
  */