melchizedek-agents 1.1.0 → 1.3.0

package/.env.example

@@ -1,3 +1,7 @@
+# Not sure which of these you need? `npx melchizedek-setup` (in a clone: `npm run setup`)
+# asks what you have and prints the names to set for it; --auto detects it.
+# Only names and shapes live here: type the values yourself, never commit .env.
+
 # ── Required for cloud models ─────────────────────────────────────────────────
 # Google AI Studio API key — powers all Gemini model inference.
 # Also required for the gemini-embedding-001 embedding model used by long-term memory.
@@ -50,6 +54,15 @@ ANTHROPIC_API_KEY=
 # Get your key at: https://platform.openai.com/api-keys
 OPENAI_API_KEY=
 
+# ── Optional: Sign in with ChatGPT, on your own machine only (ADR 0126) ───────
+# Instead of OPENAI_API_KEY: `npx melchizedek-setup --chatgpt-signin` opens your
+# browser, and OpenAI ids then run on your ChatGPT plan while no key is set.
+# The sign-in is stored OUTSIDE this file and the repository (mode 600); no
+# variable is needed. melchizedek-serve and melchizedek-worker refuse to start
+# while it is the OpenAI path.
+# MELCHIZEDEK_CHATGPT_SIGNIN_FILE=   # a path outside any git repository (default ~/.melchizedek/chatgpt-signin.json)
+# MELCHIZEDEK_CHATGPT_SIGNIN=off     # ignore a stored sign-in in this process (a served one on the same machine)
+
 # ── Optional: cloud platforms and proxies (ADR 0023) ─────────────────────────
 # The model id picks the provider; these pick how it is reached. Default:
 # the vendor's public API with the key above. Tested against mocks only.
@@ -262,6 +275,12 @@ PUBLIC_URL=
 # Unset: authorization_code grants are refused, client_credentials allowed.
 # Set: every grant's provider is listed and every host it calls is its own.
 # MELCHIZEDEK_OAUTH_HOSTS=tracker=api.tracker.example.com,auth.tracker.example.com
+# The hosts each static credential variable a YAML sends may be sent to
+# (ADR 0122): bearer_env, api_key.env and client_secret_env, each entry the
+# variable's name, '=', then its hosts (as above). Unset: each goes to the
+# host the YAML names, and the server and the doctor name it as unbound.
+# Set: it is the whole list; an unlisted variable is sent nowhere.
+# MELCHIZEDEK_CREDENTIAL_HOSTS=TRACKER_TOKEN=api.tracker.example.com;WEATHER_API_KEY=api.weather.example.com
 
 # ── Optional: Knowledge Bundle (wiki) ─────────────────────────────────────────
 # WIKI_ROOT: filesystem path of the OKF knowledge bundle the wiki tools serve.

package/AGENT_SETUP.md

@@ -26,7 +26,9 @@ Set up the melchizedek-agents framework on this machine.
    it. Never ask me to paste API keys into this chat, never read keys
    from elsewhere on my machine, and never commit .env.
 4. Run the offline test suite (`npm test`) and confirm every shipped
-   syndicate compiles.
+   syndicate compiles. Then run `npm run setup -- --auto`: it reports
+   which authentication level my environment is at, by variable name
+   only. Follow the melchizedek-onboard skill in skills/ to pick my level.
 5. Read README.md and QUICKSTART.md. Then report back with:
    - what you did and the test results,
    - the list of available syndicates (one line each, from the README

package/CHANGELOG.md

@@ -6,6 +6,379 @@ the starter pack and the templates), not the repo's full history.
 
 ## Unreleased
 
+## 1.3.0 — 2026-10-10
+
+Release 1.3.0 connects syndicates to the MCP ecosystem in both directions
+and adds a local sign-in for OpenAI models (ADRs 0124–0127).
+`melchizedek-mcp` serves each syndicate as an MCP tool to Claude Code, Codex
+and any MCP client; an agent reaches official remote MCP servers over
+Streamable HTTP, several at once, registering itself with an OAuth server
+that has no pre-issued client; and Sign in with ChatGPT runs OpenAI models on
+a person's own ChatGPT plan, on their own machine only. Server logs no longer
+carry tool arguments or a person's words.
+
+### Upgrade first
+
+- **Log lines changed.** A tool call logs `→ Tool: <tool> by <agent> — args:
+  <key names> (<n> bytes)` instead of `→ Tool: name(args)`; questions, routes
+  and router fallbacks no longer quote text. Anything that parses the server
+  log should read the tool name before ` by `.
+- **A stored ChatGPT sign-in stops served surfaces.** If you sign in with
+  `--chatgpt-signin` on a machine that also runs `melchizedek-serve`,
+  `melchizedek-worker`, `createA2AApp` or `melchizedek-mcp --http`, they refuse
+  to start while the sign-in would carry OpenAI ids. Set `OPENAI_API_KEY`, or
+  `MELCHIZEDEK_CHATGPT_SIGNIN=off`, or sign out. Nothing changes without a
+  sign-in.
+- **`melchizedek-doctor --check` exits 1 on an unrecognised `MODEL_GATEWAY`.**
+- **MCP servers are reached over Streamable HTTP first.** An existing
+  `mcp_server_url` that only speaks SSE still works, after one extra request
+  that the server refuses; pin `mcp_transport: sse` to skip it.
+
+### Added
+
+- **`melchizedek-mcp`: syndicates as MCP tools** (ADR 0125). A new bin
+  serves each loaded syndicate as one MCP tool (`{ message, session_id? }`;
+  the answer, then its `session_id`; `structuredContent.output` for a
+  syndicate with an output schema) plus `melch_resume { session_id,
+  approve?, answer? }` for a turn that paused on an approval, an `ask_user`
+  question or an OAuth consent. stdio by default (`claude mcp add melch --
+  npx melchizedek-mcp`, or a Codex `[mcp_servers]` table); `--http` serves
+  Streamable HTTP at `/mcp` on 127.0.0.1:4100 and refuses a bind beyond
+  loopback without `MCP_SERVER_SECRET` (32+ characters). Every call is one
+  task through the A2A executor, so budgets, caps, the turn lock, deadlines,
+  cancel (`notifications/cancelled`), guards and the ledger match
+  `melchizedek-serve`; an approval is answered only by `melch_resume`'s
+  explicit `approve`. Surface addition: the `melchizedek-mcp` bin and the
+  `melchizedek-agents/mcp` export path (`createMcpServer`, `serveMcpStdio`,
+  `mcpHttpApp`, `mcpBindProblem`, `toolNameFor`, `RESUME_TOOL`).
+- **MCP over Streamable HTTP, several MCP servers per agent, and dynamic
+  client registration** (ADR 0124). The MCP client posts the initialize
+  request over Streamable HTTP, the spec's current transport, and falls back
+  to the legacy SSE transport when the server answers with the spec's signal
+  (a 4xx other than 401/403); existing SSE URLs keep working unchanged.
+  `mcp_transport:` (beside `mcp_server_url`) or an entry's `transport:` pins
+  `auto`, `streamable_http` or `sse`. New `mcp_servers:` lists several
+  servers, `{ name, url, tools, auth?, transport? }`, each with the tools the
+  agent may use from it; a tool name on two servers or shared with the
+  agent's own tools is refused at load, and `require_approval` may name any
+  server's tool. An MCP server's `authorization_code` grant may say
+  `client_registration: dynamic` with no client id or endpoints: the
+  authorization server is discovered (RFC 9728, RFC 8414), the deployment
+  registers itself as a public PKCE client (RFC 7591) for
+  `OAUTH_REDIRECT_URI`, the MCP server's URI goes as the RFC 8707 `resource`
+  parameter, and the registration is kept sealed in the credential store
+  (no migration). Every discovered host must be on `MELCHIZEDEK_OAUTH_HOSTS`
+  before any request reaches it. Additive API: `lib/tools/oauthDiscovery.ts`
+  (under the existing `./tools/*` export), `isSseFallbackSignal` and
+  `McpServerConfig` in `mcpToolFactory`, `dynamicOAuthGrantsFor` in
+  `oauthTools`, `OAuthClientSource` (accepted by `oauthConsent({ providers })`
+  and `oauthRefreshProviders`), `OAuthClientConfig.resource`, and the
+  `registration_failed` consent error. `OAuth2AuthConfig.token_url` is
+  optional in its type (the schema still requires it unless the grant is
+  dynamic). New example: `config/agents/examples/connectors.yaml`.
+- **Sign in with ChatGPT, on your own machine only** (ADR 0126). OpenAI's
+  documented plan-usage flow for open-source apps that run locally:
+  `melchizedek-setup --chatgpt-signin` (or `melchizedek-chat --chatgpt-signin`)
+  opens your browser, registers the engine as its own app with OpenAI
+  (PKCE S256, a 127.0.0.1 callback), and stores the tokens mode 600 at
+  `~/.melchizedek/chatgpt-signin.json` (`MELCHIZEDEK_CHATGPT_SIGNIN_FILE`),
+  never inside a git repository. With no `OPENAI_API_KEY`, `gpt-*` and
+  `o<digit>*` ids then run on your ChatGPT plan through the Responses API:
+  streamed, not stored, without `temperature`, `top_p` or `max_output_tokens`,
+  ranked above a gateway. Tokens refresh as they near expiry;
+  `--chatgpt-signout` revokes them and `--chatgpt-status` shows where they are.
+  `MELCHIZEDEK_CHATGPT_SIGNIN=off` ignores a stored sign-in. The engine never
+  reads another app's sign-in (the Codex CLI's included).
+- **Served surfaces refuse a ChatGPT sign-in.** `createA2AApp`,
+  `melchizedek-serve` and `melchizedek-worker` refuse to start while a stored
+  sign-in would carry OpenAI ids, naming the fixes; a call that reaches it on
+  a served process anyway ends in `CHATGPT_SIGNIN_LOCAL_ONLY`.
+  `melchizedek-doctor` prints a `chatgpt` line (`DoctorResult.chatgpt`, and
+  `credential: 'chatgpt-signin'` on the OpenAI provider path), and `--check`
+  fails when serving variables are set beside such a sign-in.
+- **Onboarding level 9, `chatgpt-signin`.** `melchizedek-setup` lists ten
+  levels: Sign in with ChatGPT is level 9 and detected by `--auto`; the
+  unsupported subscription entry is now level 10 (Claude.ai, Gemini CLI, the
+  Codex CLI's login) and routes OpenAI to level 9. `ONBOARDING.md` and the
+  onboarding skills follow.
+
+### Changed
+
+- **Releases are staged on npm for a maintainer's approval** (ADR 0127).
+  The tag-triggered `release.yml` now runs `npm stage publish --provenance`
+  through trusted publishing instead of `npm publish`; a maintainer releases
+  the staged version with `npx npm@11 stage approve <stage-id>` (2FA). No
+  change to the package itself.
+- **`melchizedek-doctor --check` fails on an unrecognised `MODEL_GATEWAY`.**
+  The doctor already reported a `MODEL_GATEWAY` that names no gateway; `--check`
+  now exits 1 on it too (`checkProblems` adds a `gateway:` line naming the
+  accepted values, `vercel` and `openrouter`). The value is never echoed, in
+  text, `--json` or the check line, since it may be a key pasted into the wrong
+  variable. A recognised gateway without `MODEL_GATEWAY_API_KEY`, and unset
+  per-grant variables, stay a report, not a failure.
+- **Server-side logs name tools, never their arguments.** The turn runner's
+  `log` line for a tool call (what `melchizedek-serve`, `melchizedek-mcp` and
+  `melchizedek-worker` print) is `→ Tool: <tool> by <agent> — args: <key
+  names> (<n> bytes)` instead of the arguments cut to 60 characters. A
+  question logs `⏸ <node> asks a question` without its text, a dispatch
+  route logs without the classifier's reason (the caller's progress line
+  keeps it), and a router fallback reason measures the router's text instead
+  of quoting it. The worker logs a job's size, not its title; the image,
+  inspect-image and X API tools and the memory service log sizes and ids
+  instead of prompts, paths, queries and facts. A consumer that parsed the
+  old `→ Tool: name(args)` line reads the tool name before ` by `. Results,
+  the ledger, the A2A status updates and `melchizedek-chat`'s own rendering
+  are unchanged.
+
+### Fixed
+
+- **Dynamic client registration finds an MCP server that publishes its
+  protected-resource metadata only in its 401** (ADR 0124). Discovery now
+  sends the MCP server an unauthenticated initialize first and, on a 401,
+  reads the Bearer challenge's `resource_metadata` in `WWW-Authenticate`
+  (RFC 9728 5.1) before the well-known URLs, which stay the fallback. The URL
+  the header names passes the operator's OAuth host allowlist and the SSRF
+  guard before any request, as every discovered host does, and is refused by
+  name when it does not. A grant that names no `scopes` registers and asks
+  with the challenge's `scope`. The header is read by a bounded, linear
+  tokenizer; a malformed or oversized one is ignored. Additive in
+  `melchizedek-agents/tools/oauthDiscovery`: `parseBearerChallenge`,
+  `BearerChallenge`, `MAX_CHALLENGE_HEADER`, and
+  `DiscoveredAuthorization.challengeScopes`. An allowlist or SSRF refusal of
+  the MCP server itself now names the role `MCP server`.
+
+## 1.2.0 — 2026-10-09
+
+Release 1.2.0 carries pauses and consent further down a turn and gives the
+YAML its last v2 keys (ADRs 0117–0123). A delegated subagent may run skill
+scripts and ask for OAuth consent; a nested workflow pauses the turn as a
+dispatch route or a workflow node; a nested dispatch syndicate routes as it
+does at the top; static credentials go only to hosts the operator binds;
+`tool_choice:` and `reasoning: xhigh | max` complete the provider-neutral
+keys; a background job's checkpoint has a cap, and a durable run resumes
+inside a dispatch route. `melchizedek-setup` is the new onboarding command.
+
+### Upgrade first
+
+Read this list before deploying 1.2.0 over 1.1.0.
+
+- **The older spelling's `reasoningEffort: xhigh` and `max` now reach the
+  provider** (ADR 0117). Since 1.0.0 they were read by nothing and sent
+  nowhere; an agent that still carries one now asks its model for that
+  effort (or the model's highest, see Added), and beside a `thinkingConfig`
+  that says `high` the word wins. Such an agent thinks harder and costs
+  more. Remove the word to keep the old behaviour.
+- **`ReasoningLevel` (`melchizedek-agents/models/contract`) gains `xhigh`
+  and `max`**, and `REASONING_BUDGETS` gains both keys (16,384 each,
+  `high`'s budget). An exhaustive `Record<ReasoningLevel, …>` or a `switch`
+  over the levels no longer type-checks without them (ADR 0117).
+- **A nested dispatch syndicate answers with its route's text, not its
+  classifier's JSON** (ADR 0120). A `yaml_reference` to a plan-dispatch
+  syndicate used to compile to its classifier alone, so its caller got the
+  routing verdict and its routes never ran; a prompt or parser that relied
+  on that verdict sees the specialist's answer now. A gate or skill scripts
+  on one of its routes is no longer a load error. `compileSubagentSpec`
+  refuses a reference to a dispatch syndicate by name: compile it with
+  `compileEntrySpec`.
+- **Child session keys for routes and nodes carry their kind and the agent
+  path** (ADR 0119, ADR 0120). A nested syndicate or nested workflow run as
+  a dispatch route is filed under `<app>/route:<route>`, and as a workflow
+  node under `<walk's app>/node:<node>` (`app/route:Writer/node:Inner` two
+  levels down), no longer under the entry's name alone, so it no longer
+  shares a row with a same-named entry of another syndicate, and neither
+  can share a key with a delegated subagent's (`<app>/<caller>/<subagent>`,
+  unchanged). A session 1.1.0 stored under the entry's name, or under
+  `<app>/<entry>`, is still continued when the entry ran in that
+  conversation before; nothing stored is rewritten. Code that read the
+  walk's events at `{ appName: '<entry>' }` or `<app>/<entry>` reads them
+  at the kind key now.
+- **`melchizedek-doctor --check` exits 1 on a grant whose hosts the OAuth
+  host allowlist refuses.** The doctor already printed each such grant
+  (`✗ … is not one of them`, `MELCHIZEDEK_OAUTH_HOSTS`, ADR 0114) and still
+  exited 0; a CI step that runs `--check` against a served syndicate now
+  fails on it. A blocked syndicate, a runtime problem and the OAuth and
+  credential setup's problems fail it as before.
+
+### Added
+
+- **Skill scripts on a delegated subagent.** `skills.scripts: local` is no
+  longer a load error on a delegated subagent (or a nested delegate
+  syndicate's): a `run_skill_script` call there pauses the turn
+  `input-required` with `approval.path`, and the decision runs or refuses the
+  script in the subagent before its caller continues. An agent a map node
+  runs still may not carry scripts (ADR 0118).
+- **OAuth consent inside a delegated subagent.** A subagent's
+  `authorization_code` tool (an `mcp_auth` or OpenAPI `auth.oauth2` grant)
+  now asks for a missing grant instead of answering `not_connected`: the turn
+  ends `input-required` with `consent`, whose new optional `path` names the
+  agents from the turn's own down to the one that asked (`PendingConsent.path`;
+  the A2A `consent_request` data part carries `path` too). The callback stores
+  the grant under the conversation's app, and the next message resumes the
+  subagent's call. The host allowlist's checks are unchanged. The
+  systems_operator template's comment says authorization_code works on its
+  Systems subagent (ADR 0118).
+- **Nested dispatch syndicates route as at the top**
+  ([ADR 0120](./wiki/decisions/0120-nested-dispatch-syndicates-route-as-at-the-top.md)).
+  A `yaml_reference` to a plan-dispatch syndicate runs as a turn of its own
+  on its own conversation, wherever it appears (a delegated subagent, a
+  dispatch route, a workflow node): its classifier picks one of its routes
+  and the route answers, under the turn's `max_steps`, deadline and cancel.
+  Approvals, `ask_user` questions and OAuth consent on its routes, and
+  inside a route's own delegation, pause the turn `input-required` with
+  the path (`["Boss", "Team", "Ops"]` delegated, `["Team", "Ops"]` as a
+  route), over `runSyndicateTurn` and A2A; the answer resumes that route
+  without classifying again. Its grants are stored under the root's app.
+  As a workflow node it fails on a consent pause. A route carrying the
+  entry's own name, a `map` node over one, and a reference cycle below it
+  are refused by name before any model call. Surface:
+  `melchizedek-agents/compile` gains the `DispatchSpec` type, a
+  `{ kind: 'dispatch'; dispatch: DispatchSpec }` variant on `EntrySpec` and
+  `SpecTool`, and an optional `WorkflowSpec.dispatches`; `melchizedek-agents/runtime/turnControl`
+  gains the optional `TurnControl.nestedDispatch` hook and the
+  `NestedDispatchRun` and `NestedDispatchEnd` types. The generated
+  `syndicate.schema.json` describes `yaml_reference` accordingly.
+- **Static credentials go only to hosts the operator binds** (ADR 0122).
+  `MELCHIZEDEK_CREDENTIAL_HOSTS="TRACKER_TOKEN=api.tracker.example.com;…"`,
+  or `createA2AApp({ credentialHosts })`, binds each credential variable a
+  YAML sends (`bearer_env`, `api_key.env`, `client_secret_env`) to its hosts.
+  Unset, nothing changes: `melchizedek-serve` warns at boot and
+  `melchizedek-doctor` shows a `credentials` warning naming each unbound
+  variable. Set, it is the whole list, checked when a syndicate loads, when
+  it compiles and before each send; a refused call sends nothing. New
+  modules `melchizedek-agents/tools/credentialHosts` and
+  `melchizedek-agents/tools/credentialUses` (through the existing
+  `./tools/*` export); `openApiServers` in `tools/openapiTools`;
+  `DoctorResult.credentials`; the server's banner gains a `creds` line,
+  and `oauthServerSetup` returns `credentialSummary`.
+- **`tool_choice:`**, a v2 agent key (ADR 0117): `auto` (the default),
+  `none`, `required` (some tool) or `{ name: <tool> }` (that tool). It
+  replaces `generateContentConfig.toolConfig.functionCallingConfig`, may not
+  sit beside it, and is refused on a `yaml_reference` or `a2a_agent_url`
+  subagent. Each provider sends it as before, weakening a forced choice
+  where it must (`llm.tool_choice.weakened`).
+- **`reasoning: xhigh` and `reasoning: max`** (ADR 0117). They reach the
+  models that take them: both as `output_config.effort` on Claude's adaptive
+  generations, `max` on Kimi K3 (and `xhigh` rounds up to it, so K3 can be
+  sent `max` again), `xhigh` on GPT-5.2 and later and on grok-4.7. Every
+  other path sends the model's highest setting (`high`, Gemini's `HIGH`,
+  or `high`'s 16,384-token budget on Claude 4.6 and earlier and Gemini 2.x;
+  `high` on a gateway for any id) and marks the `llm.request` span
+  `llm.reasoning.weakened` with the level asked for. The capability
+  matrix states each path: `REASONING_ABOVE_HIGH`
+  (`melchizedek-agents/models/capabilities`), rendered under
+  `npm run doctor -- --matrix`.
+- `melchizedek-agents/models/reasoning` exports `effortCeiling(model)`,
+  `effortWord(model, setting, ceiling?)`, `isAboveHigh` and
+  `REASONING_ORDER`. `ChatCompletionsAdapter` gains the protected hooks
+  `reasoningCeiling(model)` and `effortFor(model, setting)`.
+- **A cap on a background job's checkpoint**
+  ([ADR 0121](./wiki/decisions/0121-checkpoint-cap-and-dispatch-route-resume.md)).
+  A checkpoint above `MELCHIZEDEK_CHECKPOINT_MAX_BYTES` (the worker's
+  variable; a positive whole number of bytes of JSON, default 5 MiB) is
+  not stored: the job keeps its previous checkpoint, the save still reports
+  whether the claim holds (a cancel still stops the run), and one log line
+  names the job id and the sizes. New in `melchizedek-agents/tools/taskTools`:
+  `TaskBackendOptions` (`checkpointMaxBytes`, `log`), `fileTaskBackendWith`,
+  `checkpointJson`, `checkpointMaxBytesSetting`, `DEFAULT_CHECKPOINT_MAX_BYTES`
+  and `CHECKPOINT_MAX_BYTES_ENV`; `PostgresStorageOptions.taskQueue` passes
+  the options to the Postgres queue. The file store's checkpoint sidecar is
+  written compact; one written by 1.1.0 still reads.
+- **`melchizedek-setup`, the onboarding command** (new bin; `npm run setup`
+  in a clone). A menu of nine authentication levels (no key / local
+  Ollama, one provider's key, several, a gateway key, Vertex AI / Bedrock /
+  Azure credentials, per-caller keys when serving, caller identities
+  through `A2A_AUTH`, OAuth tool grants, and subscription sign-ins), each
+  with a startup guide: the variables to set (names and shapes only), the
+  doctor check, the shipped templates and examples that run there, and the
+  first commands. `--auto` reads the doctor's result and prints the guide
+  for the highest level it detects, never a value; `--level <id|n>` prints
+  one guide; `--write-env` creates `.env` from `.env.example` with the
+  level's names blank, never over an existing file and only when git
+  ignores `.env` (ADR 0123).
+- **`ONBOARDING.md`** ships in the package: the same guides, generated from
+  the same code (`npm run setup -- --markdown`).
+- **Five onboarding skills** in `skills/`: `melchizedek-onboard` (triage:
+  "what do you have?") and `melchizedek-onboard-local`, `-keys`, `-cloud`
+  and `-serve`. `npx melchizedek-skills install` puts them in
+  `.claude/skills/` and `.agents/skills/` with the rest of the suite.
+- **`melchizedek-skills install --agents-md`** also writes a pointer to the
+  skills into the project's `AGENTS.md` (created when absent; only the
+  block between its markers is ever rewritten).
+- **The doctor's `serving` line.** When any A2A identity or billing variable
+  is set, `npm run doctor` prints the `A2A_AUTH` mode, `A2A_KEY_MODE`,
+  which serving variables are set and what the server would refuse to start
+  on, by name. `--json` gains `providers` (the providers line as data) and
+  `serving`.
+- **`ToolCredentialError.allowlist`** (`melchizedek-agents/tools/auth`,
+  with the `HostAllowlist` type): on a `host_refused` error, `'oauth'` when
+  the OAuth host allowlist refused a token's host (ADR 0114) and
+  `'credential'` when the credential host allowlist refused a client
+  secret's (ADR 0122). The constructor takes it as an optional third
+  argument.
+
+### Changed
+
+- **A nested workflow run as a dispatch route or a workflow node pauses the
+  turn** ([ADR 0119](./wiki/decisions/0119-workflow-routes-and-nodes-pause-the-turn.md)).
+  Its `ask_user` nodes and gated agent nodes (`require_approval`, skill
+  scripts) are no longer a load error there: the turn ends `input-required`
+  with `result.input` or `result.approval`, whose `path` runs from the route
+  or node down to the node that asked (`["Writer", "Send"]`, and further
+  down through a node that is itself a nested workflow), over
+  `runSyndicateTurn` and A2A. The next message answers it: a decision, or a
+  plain-text reply to the question, resumes a paused route without running
+  the classifier (`route.decidedBy` `approval` or `answer`); any other
+  message while an approval waits repeats the request and runs nothing. A
+  workflow node resumes inside the caller's walk. The conversation of a
+  paused route ends on the route's pause record (no content, the walk's
+  open interrupt ids in `longRunningToolIds`) in place of its answer.
+- `compileEntrySpec` and `compileWorkflowSpec` still accept their
+  `delegated` argument; it no longer changes what compiles.
+- **`melchizedek-codemod` converts the rest of `generateContentConfig`**
+  (ADR 0117): `toolConfig` becomes `tool_choice:` (mode `ANY` with several
+  allowed names becomes `required`, which is what the engine already sent,
+  with a note), `reasoningEffort: xhigh | max` becomes `reasoning:`, and
+  `thinkingConfig.includeThoughts` is dropped whatever its value: nothing
+  reads it, and the Gemini adapter asks for the thought trace whenever
+  reasoning is not `none` (a `true` gets a note). Only `toolConfig` mode
+  `VALIDATED` and `thinkingBudget: -1` stay, with a note.
+- **The council example's Moderator consults both subagents in one step**
+  (`config/agents/examples/council.yaml`). Its instruction asks for the
+  Advocate and the Skeptic together, both function calls in one response,
+  each given the user's full claim verbatim, so the two run at once under
+  `max_concurrency` (ADR 0116). Its role, its three-part verdict and its
+  guardrails are unchanged; the YAML keeps its v2 keys. A project that
+  copied the example keeps the old prompt until it copies it again.
+- The header comments of `examples/critic.yaml`, `examples/image_production.yaml`
+  and `templates/intake_extractor.yaml` say that a schema on a leaf is
+  their choice, not a rule: an orchestrator that delegates may hold one
+  (ADR 0109). Comments only; the agents are unchanged.
+
+### Fixed
+
+- **A durable dispatch run resumes inside its agent route** (ADR 0121). A
+  background job killed mid-step inside a plan-dispatch route used to start
+  over (its checkpoint was set aside); it now resumes from its checkpoint,
+  classifying again and storing what an uninterrupted run stores. A nested
+  dispatch syndicate's route resumes the same way, and checkpoints 1.1.0
+  saved inside a route restore.
+- **An unrecognised `MODEL_GATEWAY` is never echoed.** The doctor (its
+  `gateway` line and `--json`), `gatewayProblem()` and the boot log said
+  the value back, which may be a key pasted into the wrong variable. They
+  now say `MODEL_GATEWAY is set to an unrecognised value (not shown)` and
+  name the accepted values (`vercel`, `openrouter`).
+- **A `host_refused` refusal names the allowlist that refused.** A client
+  secret refused by the credential host allowlist was reported as the OAuth
+  host allowlist's refusal. The message now names
+  `MELCHIZEDEK_OAUTH_HOSTS` for a token's host and
+  `MELCHIZEDEK_CREDENTIAL_HOSTS` for a client secret's.
+
+### Not supported, on purpose
+
+- ChatGPT / Codex, Claude.ai and Gemini CLI subscription sign-ins are not a
+  way to fund the engine, and nothing reads their tokens. The setup menu's
+  level 9 says so and routes to each vendor's API key or cloud platform.
+
 ## 1.1.0 — 2026-10-09
 
 Release 1.1.0 closes workstream 6 of the ADK-independence plan (ADRs