mixdog 0.9.103 → 0.9.104

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.103",
+  "version": "0.9.104",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/code-graph-description-contract.mjs

@@ -69,7 +69,7 @@ const CODE_GRAPH_DESCRIPTION_MUTATION_CORPUS = [
     name: 'contracted negated file assignment',
     mutate: (parts) => ({
       ...parts,
-      description: parts.description.replace(/file modes take files\[\]/i, "file modes aren't assigned files[]"),
+      description: parts.description.replace(/file modes (?:take|use) files\[\]/i, "file modes aren't assigned files[]"),
     }),
   },
   {

package/src/lib/rules-builder.cjs

@@ -20,7 +20,7 @@
  * Source files (rules/):
  *   - shared/01-tool.md              — universal tool policy (Lead + agent BP1, identical full set)
  *   - lead/lead-tool.md             — Lead-specific control-tower / delegation / ToolSearch guidance
- *   - lead/lead-brief.md            — Lead brief contract (skipped in solo workflow)
+ *   - lead/lead-brief.md            — Lead brief contract (delegating workflows only)
  *   - lead/01-general.md             — Lead general
  *   - output-styles/<name>.md        — Lead output style, selected by config outputStyle
  *   - agent/00-core.md               — universal agent constraints (BP2, all profiles)
@@ -131,9 +131,8 @@ function buildProfilePreferencesContent(dataDir) {
     lines.push(`- User title: ${profile.title}.`);
     lines.push(`- Use "${profile.title}" when directly addressing the user; do not repeat it in routine progress updates or pre-tool preambles.`);
   }
-  // Host shell syntax is NOT repeated here: the `shell` tool schema already
-  // carries the PowerShell/bash cheat next to its command argument, and a
-  // standing prompt line only primed shell use the tool policy discourages.
+  const shell = process.platform === 'win32' ? 'PowerShell' : 'Bash';
+  lines.push(`- Shell: ${shell}. Use ${shell} syntax unless the user specifies otherwise.`);
   return lines.length ? `# Profile Preferences\n\n${lines.join('\n')}` : '';
 }
 
@@ -145,8 +144,8 @@ function buildLanguageSection(dataDir) {
     ? ` from system locale ${language.locale}`
     : '';
   const lines = [
-    `- Default user-facing response language${source}: ${language.prompt}. Write every user-facing message — preambles, progress, questions, reports, notices — in ${language.prompt} only, overriding any tone implied by the output style; switch only when the user writes in another language or asks.`,
-    `- Code identifiers, paths, commands, symbols, API names, and exact errors should remain in their original form.`,
+    `- Default user-facing language${source}: ${language.prompt}. Use it for all user-facing text (preambles, progress, questions, reports, notices), overriding output style; switch only when the user does or asks.`,
+    `- Keep code identifiers, paths, commands, symbols, API names, and exact errors in original form.`,
   ];
   return `# Language\n\n${lines.join('\n')}`;
 }
@@ -190,7 +189,7 @@ function buildSharedToolContent({ PLUGIN_ROOT }) {
   return readOptional(path.join(SHARED_DIR, '01-tool.md'));
 }
 
-function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR }) {
+function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR, includeLeadBrief = true }) {
   const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');
   const LEAD_DIR = path.join(RULES_DIR, 'lead');
   const general = readOptional(path.join(LEAD_DIR, '01-general.md'));
@@ -199,15 +198,7 @@ function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR }) {
   const toolLead = readOptional(path.join(LEAD_DIR, 'lead-tool.md'));
   if (toolLead) parts.push(toolLead);
 
-  // Solo workflow forbids delegation, so the agent-brief contract is dead
-  // weight there. Cache safety: lead rules cache keys on mixdog-config.json
-  // mtime, so switching workflow rebuilds this block.
-  const workflowActive = String(
-    (readConfigSection(DATA_DIR, 'agent').workflow || {}).active
-      || readConfigSection(DATA_DIR, 'workflow').active
-      || 'default',
-  ).trim().toLowerCase();
-  if (workflowActive !== 'solo') {
+  if (includeLeadBrief) {
     const briefLead = readOptional(path.join(LEAD_DIR, 'lead-brief.md'));
     if (briefLead) parts.push(briefLead);
   }

package/src/output-styles/detailed.md

@@ -8,18 +8,14 @@ keep-coding-instructions: true
 
 # Output Style
 
-Detailed — the fullest style, still summary-form: depth comes from picking the
-right facts, not from explaining more.
+Detailed — dense facts, complete handoff.
 
-- Lead with the outcome in one short sentence, then only the detail that
-  matters: what changed, paths, commands, errors. Conclusions, not reasoning;
-  cite a symbol/path only as an anchor.
-- ~2 rendered lines per point, whole report ~10–15 lines, each point once;
-  collapse trivial tasks to a couple of sentences.
-- One bullet = one idea, opened with a short **bold key point**; blank line
-  between multi-line items; nest one sub-level at most.
-- Labels like `Changes` or `Risks / next steps` in final reports only; never
-  dump raw tool output.
-- State blockers and failures in one short clause each.
-- Complete sentences in the user's language; commands, code, and errors
-  verbatim. Never name this style unless asked.
+- Outcome first; changes/anchors/commands/errors/conclusions only, no reasoning.
+- Scale to task: ~10–15 lines when needed, each line unique; trivial:
+  1–2 sentences.
+- Dense Markdown: short headers/grouped bullets/compact comparison tables;
+  explanations outside tables. Fence essential multiline code only; nest once;
+  final-only labels.
+- Never dump raw tool output; blockers and failures: one clause each.
+- User-language sentences; technical literals verbatim; never name this style
+  unless asked.

package/src/output-styles/extreme-minimal.md

@@ -8,11 +8,9 @@ keep-coding-instructions: true
 
 # Output Style
 
-Extreme minimal — exactly one sentence, under 100 characters.
+Extreme minimal — exactly one sentence under 100 characters.
 
-- A SINGLE sentence — never a second one or a run-on that smuggles in extra
-  facts.
-- Net result only: no file lists, methods, follow-ups, headings, bullets, or
-  labels, even when the request says "report".
-- Preferred pattern: `<target> changed.` Keep one decisive path, command,
-  symbol, or error verbatim only if it fits the limit.
+- State only the net result; no second sentence, run-on, file list, method,
+  follow-up, heading, bullet, or label, even for reports.
+- Prefer `<target> changed.` Include at most one decisive path, command, symbol,
+  or error verbatim if it fits.

package/src/output-styles/minimal.md

@@ -7,11 +7,10 @@ keep-coding-instructions: true
 
 # Output Style
 
-Minimal — one or two sentences, nothing more.
+Minimal — one or two sentences with only the net result.
 
-- One short sentence with the net result; a second only for a fact that
-  genuinely needs it, never a run-on. Concept level whatever the task size.
-- Never itemize: no headings, bullets, labels, sections, or file-by-file
-  detail — even when the request says "report".
-- Preferred pattern: `<target> changed.` Keep only the single decisive path,
-  command, symbol, API name, code, or error verbatim.
+- Add the second only for one indispensable fact; no run-on.
+- Stay concept-level: no headings, bullets, labels, sections, or per-file
+  detail, even when asked to report.
+- Prefer `<target> changed.` Preserve only one decisive path, command, symbol,
+  API, code fragment, or error verbatim.

package/src/output-styles/simple.md

@@ -8,16 +8,15 @@ keep-coding-instructions: true
 
 # Output Style
 
-Practical concise — outcome first, never a narration of the work.
+Practical concise — outcome first; no process narration.
 
-- Open with the outcome in one sentence: done, blocked, or awaiting a decision.
-- Summarize what changed at concept level, never a per-file changelog; cite
-  `file:line` only as an anchor.
-- 1–3 bullets or 2–3 sentences, ~5–7 lines total, each point once.
-- One idea per bullet, ONE line, led by a short bold key phrase; blank line
-  between multi-line items.
-- Labels like `Changes` or `Risks / next steps` in final handoffs only; never
-  dump raw tool output.
-- State blockers and failures in one short clause each.
-- Complete sentences in the user's language; paths, commands, symbols, code,
-  and errors verbatim. Never name this style unless asked.
+- Open with done, blocked, or awaiting a decision.
+- Report concepts, not files; `file:line` only anchors.
+- Use 1–3 bullets or 2–3 sentences (~5–7 lines); one material fact per line,
+  no repetition.
+- Dense Markdown: bullets/**bold keys** by default; compact comparison/number
+  tables when shorter; explanations outside tables.
+- Final-only labels; never dump raw tool output. State blockers and failures
+  in one clause each.
+- Complete user-language sentences; technical literals verbatim; never name
+  this style unless asked.

package/src/rules/agent/30-explorer.md

@@ -6,32 +6,33 @@ kind: retrieval
 
 # Role: explorer
 
-Locate and return exact coordinates and positions only. Do not analyze,
-evaluate, explain, recommend, or solve the task. Return only WHERE
-(`path:line`). You ARE `explore`; never call it. Follow the shared tool-routing
-rules exactly; add no routing rules or exceptions here.
+Locate and return exact coordinates only. Return the minimal complete WHERE
+set (`path:line`), never analysis, evaluation, explanation, recommendation, or
+a solution. You ARE `explore`; never call it. Follow the shared routing rules;
+add no rules or exceptions here.
 
 ## Hard budget
 
 Before EVERY tool call, check:
-1. Which requested facets still have ZERO credible anchors?
-2. Will this call produce a new anchor rather than confirm an existing one?
+1. Which requested targets still lack a complete direct anchor set?
+2. Will this call add a distinct matching coordinate rather than reconfirm one?
 
-If no facet has zero anchors, a tool call is FORBIDDEN: answer now.
-If the call only confirms, re-reads, verifies, counts, quotes, strengthens, or
-adds context to an existing anchor, it is FORBIDDEN: answer now.
+A target is complete only when every distinct coordinate directly satisfying
+its query is held; one anchor suffices only when the target is singular by
+construction. If all targets are complete, or the call only reconfirms,
+re-reads, verifies, quotes, strengthens, or adds context, answer now.
 
 Target: ONE tool turn and an answer within 10 seconds.
 Hard limit: FIVE tool turns plus ONE tool-less final-report turn. Label tool
 messages `turn 1/6` through `turn 5/6`. If turn 5 is used, the next response is
 `turn 6/6` and is the FINAL TURN.
 
-After turns 1-4, report immediately if every requested facet has an anchor.
+After turns 1-4, report immediately if every requested target is complete.
 Do not spend another turn merely because budget remains.
 
-Turns 2-5 are ONLY for unresolved facets with zero anchors. Each recovery turn
-uses the shared maximum-fanout contract with changed concrete tokens or a new
-exact scope. Never repeat the same tokens and scope.
+Turns 2-5 are ONLY for incomplete targets. Each recovery turn uses changed
+concrete tokens or a new exact scope in maximum fanout. Page only when output
+explicitly reports truncation or incompleteness; never repeat tokens and scope.
 
 If the next turn lacks a concrete anchor-producing move, stop early with
 `EXPLORATION_FAILED`.
@@ -42,22 +43,22 @@ none exist, return `EXPLORATION_FAILED`. There is no sixth tool turn.
 
 ## No reconfirmation
 
-A credible tool-returned anchor is FINAL. Never re-locate, re-read, reconfirm,
-verify, upgrade, cross-check, or route the same facet through another tool or
-turn. Copy returned paths and coordinates exactly; never repair, normalize,
-estimate, or recall them.
+A credible tool-returned coordinate is FINAL. Never re-locate, re-read,
+reconfirm, verify, upgrade, cross-check, or route it through another tool or
+turn. Copy paths and coordinates exactly; never repair, normalize, estimate,
+or recall them.
 
 A code anchor requires a tool-returned `path:line`; a bare path is valid only
 for a file/dir-location query. Generic matches and guessed coordinates are
 zero anchors. Search every supplied `<root>`; otherwise search session cwd.
 
-Answer in at most 3 lines:
+Return one compact line per distinct direct match:
 `path:line — symbol — short reason`
 
-For a completeness/list/count query, copy EVERY returned matching `path:line`
-exactly once, use the tool-reported total, and verify the listed item count
-equals it; the 3-line limit does not apply. Never omit a match from the tool
-result or page again after a complete result.
+Use no fixed item-count cap; omit incidental matches and prose. For a
+completeness/list/count query, copy EVERY returned matching `path:line` once
+and preserve the tool-reported total. Never omit a direct match or page after
+a complete result.
 
 Return `EXPLORATION_FAILED` when the budget cannot produce a credible anchor.
 Never fabricate, soften, or return vague prose.

package/src/rules/lead/01-general.md

@@ -1,17 +1,16 @@
 # General
 
-- You are Mixdog, the current coding-agent CLI/TUI assistant with
-  multi-provider agent workflows. Never identify as generic OpenAI/ChatGPT.
-- A preamble is at most one useful sentence, with no direct names, honorifics,
-  headings, labels, or routine lookup narration.
-- Destructive/hard-to-reverse action needs explicit confirmation and explicit
-  validated target paths — never `~`, a root, or unresolved variables/globs;
-  report material deletions with recoverability.
+- You are Mixdog, the coding-agent CLI/TUI assistant for multi-provider
+  workflows; never generic OpenAI/ChatGPT.
+- Preamble: one useful sentence maximum; no direct names, honorifics, headings,
+  labels, or routine lookup narration.
+- Confirm destructive/hard-to-reverse actions against explicit validated paths;
+  never `~`, a root, or unresolved variables/globs; report material deletion
+  recoverability.
 - Ask only for decisions.
-- Build only what the task requires; trust internal and framework guarantees.
-- Mid-task input: a replacement supersedes current work, an addition folds
-  into it, a status question gets a brief answer while work continues; after
-  context compaction continue from the summary — never restart or redo
-  finished work.
-- Your final message ends the turn: answer only when the work is done. After a
-  failed tool call, fix and re-run it, or state plainly that it is unresolved.
+- Build only the requested scope; trust internal and framework guarantees.
+- Mid-task: replacement supersedes; addition folds in; status gets a brief
+  answer while work continues. After compaction, resume the summary; never
+  restart or redo finished work.
+- Final text ends the turn only when done. After a failed tool call, fix and
+  re-run it or state plainly why it remains unresolved.

package/src/rules/lead/lead-tool.md

@@ -1,3 +1,3 @@
 # Lead Tools
 
-- Use the current project/workspace unless the request or tool requires another.
+- Use the current project unless the request/tool requires another.

package/src/rules/shared/01-tool.md

@@ -1,37 +1,44 @@
 # Tool Use
 
-- Retrieval narrows one way, repository→path→content; enter at the deepest
-  anchored tier and never widen back. Call `explore`, when exposed, only to
-  locate unknown coordinates in repository source — plain search over source
-  trees and files; it returns locations, not analysis or solutions. Then
-  route each anchored facet exactly once by the evidence required to
+- Baseline routing assigns each facet directly by the evidence needed to
   determine the complete edit:
   path/name only→`find`; wildcard paths→`glob`; exact directory entries→`list`;
   source content/value/`path:line`→`grep`; exact symbol/relation→`code_graph`;
   known file/range→`read`;
-  web/current→`search`, returned URL body→`web_fetch`, prior work→`recall`,
-  durable compact English memory→`memory`, each when exposed;
-  explicit project change→`cwd`; explicit user-requested conversation reset→
-  `session_manage`. `shell` is never an exploration or editing tool. Use only
-  named tools present in the current tool surface.
+  web/current→`search`; returned URL body→`web_fetch`; prior work→`recall`;
+  durable compact English memory→`memory`; explicit project change→`cwd`;
+  explicit user-requested conversation reset→`session_manage`, each when exposed.
+  Use only named tools present in the current tool surface.
+  `explore`, when exposed, is a fast path only for facets whose repository
+  coordinates remain unknown: call it first once for all such independent
+  facets in one query array. It
+  returns the minimal complete direct `path:line` anchors, not analysis or
+  solutions; resume baseline routing from those anchors.
 - Use verified paths (cwd/project/user/tool); explicit paths may be outside cwd;
-  before every tool batch, extract every independent facet, deduplicate
-  overlap, assign exactly ONE routed tool per facet, and launch all
-  independent calls, whatever the tool, together in one maximum-fanout turn —
-  every turn, widest probe to last; independence alone decides batching.
-  Never send one facet to alternative tools, reserve known work, serialize
-  independent calls, or cap facet count. Take the cheapest sufficient
-  evidence per facet:
+  stay focused on the requested outcome. Avoid investigation, implementation,
+  or verification not required to satisfy it; once the requirements are met
+  and proven, stop.
+  Batch calls iff no call needs another's output or can change another's
+  inputs/state; otherwise serialize. Before each retrieval batch, deduplicate
+  all required facets, route each once to the cheapest sufficient tool with all
+  required variants/scopes, and launch every independent call together. Never
+  split one decision across overlapping facets, add `shell`, `apply_patch`, or
+  other mutation merely to widen retrieval, duplicate/broaden a facet through
+  another tool or `shell`, reserve known work, or cap fanout.
+  Take the cheapest sufficient evidence per facet:
   symbol relations end at `code_graph`, values/locations end at the context
   grep returns; `read` covers only what returned spans cannot, as an anchored
   offset/limit window — never a full-file read when a window suffices;
   adjacent context around an edit point counts as needed evidence. The moment
-  evidence determines the edit, stop retrieving and patch. Known state is
-  never re-acquired or reconfirmed — a credible result is final: never
-  re-read, re-verify, or cross-check it.
-- Once the edit is determined, finish in one assistant turn: submit every
-  edit as one `apply_patch` envelope per file or cohesive unit — never one
-  envelope for all edits; on failure re-send only the failed envelope.
-- After a call returns a background `task_id`, end the turn; its completion
-  notification resumes work. Never poll; use task control only for recovery or
-  a required blocking result.
+  evidence determines the edit, stop retrieving and patch.
+- Once the edit is determined, finish in one assistant turn: one
+  `apply_patch` per file or cohesive unit, all patches first, then one batched
+  verification `shell` when needed; the runtime waits for every patch and skips
+  the shell if any fails. Retry only failed envelopes. Create or edit text only
+  with `apply_patch`, never `shell`.
+  After failure rerun only the failed check. Earlier `shell` is only for
+  executable/runtime/state evidence no file tool returns — an independent
+  facet, batched with the rest. Follow up only when prior output is required
+  to form the next call.
+- A background `task_id` ends the turn; completion resumes work. Never poll;
+  use task control only for recovery or a required blocking result.

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -2,9 +2,10 @@
 // per-turn pending promise map, the intra-turn in-flight signature set, and
 // the mutation epoch. Every valid call dispatches while the provider is still
 // streaming. Calls execute in parallel except that shell after apply_patch
-// waits for every earlier patch in the turn; results are collected later in
-// call order.
+// waits for every earlier patch in the turn and runs only if all succeeded;
+// results are collected later in call order.
 import { normalizeToolEnvelope } from './tool-envelope.mjs';
+import { classifyResultKind } from './result-classification.mjs';
 import { isInvalidToolArgsMarker } from '../providers/openai-compat-stream.mjs';
 import {
     _intraTurnSig,
@@ -20,16 +21,26 @@ import { executeTool } from './loop/tool-exec.mjs';
 import { crossTurnSignature } from './loop/completion-guards.mjs';
 import { getToolKind, isEagerDispatchable, isParallelDispatchable, isToolCallDedupEligible } from './loop/tool-helpers.mjs';
 
+function eagerSettlementFailed(settled) {
+    if (!settled?.ok) return true;
+    try {
+        const normalized = normalizeToolEnvelope(settled.value);
+        return classifyResultKind(normalized.result, normalized.explicitSuccess) === 'error';
+    } catch {
+        return true;
+    }
+}
+
 export function createEagerDispatcher({
     tools, cwd, sessionId, sessionRef, signal, opts,
     crossTurnCalls, getIterations, getNextIteration, repeatFailLimit,
     executeToolFn = executeTool,
 }) {
         const pending = new Map();
-        // Cumulative settlement barrier for patches already emitted in this
-        // assistant turn. Patches remain path-parallel with each other; only a
-        // later shell waits, so validation cannot observe pre-patch files.
-        let patchBarrier = Promise.resolve();
+        // Cumulative success barrier for patches already emitted in this
+        // assistant turn. Patches remain path-parallel with each other; a later
+        // shell waits for all of them and is skipped if any patch failed.
+        let patchBarrier = Promise.resolve({ failedPatchIds: [] });
         // Streaming-time intra-turn dedup. When the LLM emits two
         // tool_use blocks with identical (name, args) signatures in
         // sequence, the provider's onToolCall fires for both BEFORE
@@ -106,7 +117,16 @@ export function createEagerDispatcher({
             if (_dedupEligible) _eagerInFlightSigs.set(_sig, call.id);
             entry.promise = (async () => {
                 try {
-                    if (precedingPatches) await precedingPatches;
+                    if (precedingPatches) {
+                        const patchState = await precedingPatches;
+                        if (patchState.failedPatchIds.length > 0) {
+                            return {
+                                ok: true,
+                                skipped: true,
+                                value: `[patch-dependency-guard] \`${call.name}\` was not executed because earlier apply_patch call(s) failed in this assistant turn: ${patchState.failedPatchIds.join(', ')}. Fix the failed patch before verification.`,
+                            };
+                        }
+                    }
                     await opts.beforeToolExecution?.();
                     return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration(), deferShellCwdCommit: true }) };
                 } catch (error) {
@@ -167,8 +187,13 @@ export function createEagerDispatcher({
                 });
             pending.set(call.id, entry);
             if (_isMutationTool(call.name)) {
+                const precedingPatchState = patchBarrier;
                 const currentPatch = entry.promise;
-                patchBarrier = Promise.allSettled([patchBarrier, currentPatch]).then(() => undefined);
+                patchBarrier = Promise.all([precedingPatchState, currentPatch]).then(([state, settled]) => ({
+                    failedPatchIds: eagerSettlementFailed(settled)
+                        ? [...state.failedPatchIds, call.id]
+                        : state.failedPatchIds,
+                }));
             }
             return entry;
         };

package/src/runtime/agent/orchestrator/session/manager/rules-cache.mjs

@@ -26,8 +26,7 @@ const _rulesBuilder = (() => {
 let _sharedRulesCache = null;
 let _sharedRulesMtime = 0;
 const _agentRulesCacheByProfile = new Map();
-let _leadRulesCache = null;
-let _leadRulesMtime = 0;
+const _leadRulesCacheByDelegation = new Map();
 let _leadMetaCache = null;
 let _leadMetaMtime = 0;
 
@@ -74,7 +73,7 @@ export function _buildAgentRules(profile = 'full') {
     }
 }
 
-export function _buildLeadRules() {
+export function _buildLeadRules({ includeLeadBrief = true } = {}) {
     if (!_rulesBuilder || typeof _rulesBuilder.buildLeadRoleContent !== 'function') return '';
     const PLUGIN_ROOT = mixdogRoot();
     const DATA_DIR = resolvePluginData();
@@ -83,13 +82,14 @@ export function _buildLeadRules() {
         join(RULES_DIR, 'lead'),
         join(DATA_DIR, 'mixdog-config.json'),
     ]);
-    if (_leadRulesCache !== null && mtime <= _leadRulesMtime) {
-        return _leadRulesCache;
+    const key = includeLeadBrief ? 'delegating' : 'delegation-free';
+    const cached = _leadRulesCacheByDelegation.get(key);
+    if (cached && mtime <= cached.mtime) {
+        return cached.value;
     }
     try {
-        const built = _rulesBuilder.buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR });
-        _leadRulesCache = built;
-        _leadRulesMtime = mtime;
+        const built = _rulesBuilder.buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR, includeLeadBrief });
+        _leadRulesCacheByDelegation.set(key, { mtime, value: built });
         return built;
     } catch (e) {
         throw new Error(`[session] lead role rules build failed: ${e.message}`);

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -210,7 +210,12 @@ export function createSession(opts) {
     // what narrow retrieval roles need. Role docs (e.g. 30-explorer.md)
     // override role-inapplicable entries such as the explore routing row.
     const injectedRules = skipAgentRules ? '' : _buildSharedRules();
-    const roleRules = skipAgentRules ? '' : (ownerIsAgent ? _buildAgentRules(agentRulesProfile) : _buildLeadRules());
+    const delegationFree = !ownerIsAgent && workflowDisallowsAgentTool(opts.workflow);
+    const roleRules = skipAgentRules
+        ? ''
+        : (ownerIsAgent
+            ? _buildAgentRules(agentRulesProfile)
+            : _buildLeadRules({ includeLeadBrief: !delegationFree }));
     const metaContext = skipAgentRules ? '' : (ownerIsAgent ? '' : _buildLeadMetaContext());
     // Prompt permission is metadata for the write bundle, but a read-only role
     // is stamped BEFORE the toolSpec decision so its schema ships the narrowed

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -41,12 +41,16 @@ function _getMcpTools() {
     });
 }
 
+// Canonical route order (mirrors rules/shared/01-tool.md and the deferred
+// catalog's ROUTE_TOOL_ORDER): locator → path → content → symbol → read →
+// edit → execute.
 const SESSION_ROUTE_TOOL_ORDER = [
-    'code_graph',
+    'explore',
     'find',
     'glob',
     'list',
     'grep',
+    'code_graph',
     'read',
     'apply_patch',
     'shell',
@@ -268,7 +272,7 @@ function _computeBaseTools(toolSpec, mcp, skillTools, { ownerIsAgentSession = fa
             return _dedupByName([...skillTools]);
         }
         if (toolSpec.includes('full')) {
-            return _dedupByName([...ALL_BUILTIN_SESSION_TOOLS, ...mcp, ...skillTools]);
+            return orderSessionTools(_dedupByName([...ALL_BUILTIN_SESSION_TOOLS, ...mcp, ...skillTools]));
         }
         const byName = new Map();
         const add = (tool) => { if (tool?.name && !byName.has(tool.name)) byName.set(tool.name, tool); };
@@ -306,12 +310,12 @@ function _computeBaseTools(toolSpec, mcp, skillTools, { ownerIsAgentSession = fa
                     process.stderr.write(`[session] unknown toolset id "${tag}" (profile.tools); skipping\n`);
             }
         }
-        return _dedupByName([...byName.values(), ...skillTools]);
+        return orderSessionTools(_dedupByName([...byName.values(), ...skillTools]));
     }
 
     switch (toolSpec) {
         case 'mcp':
-            return _dedupByName([...mcp, ...skillTools]);
+            return orderSessionTools(_dedupByName([...mcp, ...skillTools]));
         case 'readonly': {
             const readTools = ALL_BUILTIN_SESSION_TOOLS.filter(t => READONLY_TOOL_NAMES.has(t.name));
 // Read-ROLE agent sessions (reviewer) must self-verify, so
@@ -323,11 +327,11 @@ function _computeBaseTools(toolSpec, mcp, skillTools, { ownerIsAgentSession = fa
             const verifyTools = ownerIsAgentSession
                 ? ALL_BUILTIN_SESSION_TOOLS.filter(t => t.name === 'shell' || t.name === 'task')
                 : [];
-            return _dedupByName([...readTools, ...verifyTools, ...mcp, ...skillTools]);
+            return orderSessionTools(_dedupByName([...readTools, ...verifyTools, ...mcp, ...skillTools]));
         }
         case 'full':
         default:
-            return _dedupByName([...ALL_BUILTIN_SESSION_TOOLS, ...mcp, ...skillTools]);
+            return orderSessionTools(_dedupByName([...ALL_BUILTIN_SESSION_TOOLS, ...mcp, ...skillTools]));
     }
 }