mixdog 0.9.169 → 0.9.171

package/src/defaults/skills/computer-use/SKILL.md

@@ -46,8 +46,10 @@ observed target, and leave windows where they were.
   messages, including clicks, scrolling, and value/text input. This avoids
   unnecessary window activation, physical pointer travel, and animation waits.
   Check the returned effect; message delivery alone is not success.
-  Background work uses activity status and result evidence, not a floating
-  cursor effect over other windows. Real-pointer effects are foreground-only.
+  Both delivery modes show cursor and input feedback. Background uses a
+  target-bound virtual pointer without moving the user's physical pointer;
+  its feedback must not float above unrelated foreground windows. Foreground
+  decorates the real pointer. Visual feedback is not proof of action success.
   A background semantic action may queue behind foreground work to protect
   focus; waiting for that guard never switches its delivery mode.
 - **Foreground (explicit):** use when the target/gesture requires real pointer
@@ -99,15 +101,17 @@ observed target, and leave windows where they were.
   report `pixel_unavailable`; do not substitute a screen grab.
 - If the user intervenes, preserve their cursor and focus. Worker termination
   and input cleanup must finish before resuming; a failed cleanup is not cleared
-  by a resume request. Ask the user to press Stop for verified cleanup recovery.
+  by a resume request. Ask the user to press `Ctrl+Alt+Esc` (emergency Stop)
+  for verified cleanup recovery.
   If target-local release remains unconfirmed, the user must inspect/recover
   that window; restarting the host alone does not prove release. Never operate
   recovery controls for the user. Obtain a new observation after an interruption.
   Use `wait_for_user` to keep the task waiting without sending input. The host
   may resume ordinary physical-input interruptions after its configured quiet
-  interval; renewed input resets that interval. Explicit stops and uncertain
-  observation/cleanup never auto-resume. The user can also use the overlay's
-  pause/resume icon. Never click it or change the idle policy on their behalf.
+  interval; renewed input resets that interval. Explicit pauses/stops and
+  uncertain observation/cleanup never auto-resume. The overlay has one
+  Pause/Resume toggle: Pause retains the task; emergency Stop cancels it.
+  Never operate these controls or change the idle policy on the user's behalf.
   While paused, only `list`, `diagnose` and `wait_for_user` are available.
   Chat text alone does not clear the host. After `resumed`, capture fresh state;
   after `timeout` or `cancelled`, no input is authorized. Never replay the
@@ -126,6 +130,8 @@ observed target, and leave windows where they were.
    `query` / `role` narrow the element list, `include_noninteractive` widens
    it to static text, and `continuation` pages a list cut at `max_elements`.
    Frame size and encoding are the host's; unreadable detail is a `zoom`.
+   For `zoom`, pass `frame_id` and `region` without `window_id`, `app`, or
+   `screen`: the frame already identifies the exact source window.
 3. `act` with 1–6 simple actions. The first is an input action (`click`,
    `double_click`, `move`, `drag`, `scroll`, `type`, or `key`), using a fresh
    `ref`, an `element` mark, or `x`/`y` in `act.input.frame_id` when a target

package/src/defaults/skills/setup/SKILL.md

@@ -24,8 +24,8 @@ supported `setup` action, and read its result as the change receipt.
 - API keys, OAuth credentials, tokens, and usage sign-ins stay out of tool
   arguments and the transcript. Open the Providers surface and let the user
   enter them.
-- A mutation follows the active workflow's approval rules. `open` and `status`
-  are read-only.
+- A mutation follows the active workflow's approval rules. Status, catalog,
+  definition, MCP-config and Instructions reads do not change persisted settings.
 - Most changes affect new sessions. Report `appliedToCurrentSession` and
   `appliesTo` exactly when the result supplies them.
 - This skill does not own source edits, builds, installation deployment,
@@ -41,8 +41,11 @@ supported `setup` action, and read its result as the change receipt.
    or is not exposed.
 3. For a supported mutation, send only the fields the user intends to change.
    Partial route and profile updates preserve omitted fields.
-4. Read the mutation result. Call the narrow `status` domain afterward only
-   when the result does not already prove the persisted value.
+4. Read the mutation result, including `saved`, `scope`, `appliesTo`,
+   `appliedToCurrentSession`, and `requiresReload` when present. Background
+   installation receipts are not evidence of completed installation.
+   Call the narrow `status` domain afterward only when the receipt does not
+   already prove the persisted value.
 5. Report what changed and whether it applies now or in a new session.
 
 Completion means the persisted state or UI handoff is evidenced, not merely
@@ -57,15 +60,26 @@ that a call returned without transport error.
 
 ## High-signal distinctions
 
-- Main model, agent models, and Web Search model are separate routes. An agent
-  override with an empty provider restores Main inheritance.
+- Main model, agent models, and Web Search model are separate routes. Omitted
+  fields preserve the selected route. An explicitly empty agent or Web Search
+  provider restores Main inheritance; omission never resets it. Disabling an
+  agent preserves its route for re-enabling.
 - Web Search model selection and Web Search tool exposure are separate.
 - Memory master state controls the capability; recap controls background
   cycles only. Core Memory content is managed by the `memory` tool.
-- Git, Memory, and Office have installation state separate from enabled state.
-  Browser Use, Computer Use, and voice are managed through Built-in UI cards;
-  `set_first_use_approval` controls once-per-session first-use approval for
+- Built-ins have installation state separate from enabled state. Browser Use,
+  Computer Use, and voice actions require this conversation open in the local
+  Desktop window. `set_first_use_approval` controls first-use approval for
   Browser Use and Computer Use only, not voice.
+- Desktop appearance changes affect the Desktop host, not a paired phone.
+  Display language is independent of profile response language. A required
+  reload is reported, never performed automatically.
+- Read definitions before editing them; use skill-creator when authoring a
+  skill. Setup persists the supported definition fields. Workflow and agent
+  ids are stable identities, distinct from their display names.
+- Read Instructions before replacing them and pass the returned text as
+  `expectedContent`. `projectPath:null` means Common Instructions; otherwise
+  use an exact registered Project root. Keep the returned backup.
 - MCP servers and plugins are machine-global integrations whose visibility may
   be scoped to selected Projects.
 - User skills are machine-global. Enabled plugin skills and built-in skills are
@@ -80,10 +94,16 @@ that a call returned without transport error.
   pretending a window opened.
 - For an MCP failure, inspect the reported transport error before changing
   command, arguments, directory, environment, URL, headers, or enabled state.
+- MCP reads intentionally omit raw connection values that may contain secrets.
+  Partial edits preserve those values. Use environment-variable names for
+  credentials; never request or echo their values.
 - For an unavailable built-in, distinguish not installed, installed but
   disabled, and bridge inactive.
-- If a requested setting is UI-only, navigate there when possible and hand
-  control to the user. Do not imitate the missing action by editing storage.
+- Desktop requests require a single live claimant and a confirmed receipt.
+  A timeout or cancelled request is not success. If execution already started,
+  inspect state before retrying; do not resubmit a possibly completed mutation.
+- Notification permission/subscription, pairing credentials, and authentication
+  remain user-operated UI handoffs. Do not imitate them by editing storage.
 - Unknown keys and retired configuration are diagnostics, not permission for
   direct cleanup.
 

package/src/defaults/skills/setup/references/actions.md

@@ -7,7 +7,8 @@ authority for required fields and accepted values.
 
 - `status` reads one domain: summary, model, agents, workflow, websearch,
   output-style, profile, autoclear, compaction, memory, features, local-provider, shell,
-  providers, mcp, skills, plugins, update, or onboarding.
+  providers, mcp, skills, plugins, update, onboarding, capabilities, desktop,
+  appearance, projects, connection, schedules, or webhooks.
 - `open` navigates to a supported UI surface. Read `surfaces.md` for targets and
   UI-only settings.
 
@@ -26,9 +27,9 @@ authority for required fields and accepted values.
 | Memory capability | `set_memory_enabled` |
 | Background memory cycles | `set_recap_enabled` |
 | Web Search tool exposure | `set_web_search_enabled` |
-| Git, Office, or Local Provider enabled state | `set_builtin_enabled` |
+| Git, Office, Code Tidy, Local Provider, Browser, Computer, or voice enabled state | `set_builtin_enabled` |
 | One approval per session before the first Browser Use or Computer Use call (`name`: browser or computer; on by default) | `set_first_use_approval` |
-| Git, Memory, Office, or Local Provider runtime preparation | `install_builtin` |
+| Git, Memory, Office, Code Tidy, Local Provider, Browser, Computer, or voice preparation | `install_builtin` |
 | Managed local model installation (use the local-provider skill) | `install_local_model` |
 | Start or resume a background runtime/model download | `start_local_installation` |
 | Pause a shared local download, retaining partial files | `cancel_local_installation` |
@@ -53,19 +54,43 @@ authority for required fields and accepted values.
 | Refresh a plugin checkout | `update_plugin` |
 | Enable or disable a plugin | `set_plugin_enabled` |
 | Remove a plugin | `remove_plugin` |
+| Available hosted models and their options; optionally native-search capable only | `list_models` |
+| Agent orchestration, independent of workflow instructions | `set_orchestration_mode` |
+| Safe MCP edit metadata, excluding raw connection/credential values | `get_mcp_server` |
+| Read a workflow, agent, or skill definition | `read_definition` |
+| Create a workflow, agent, or machine-global user skill | `create_definition` |
+| Partially edit a workflow, agent, or machine-global user skill | `save_definition` |
+| Delete a user workflow/agent definition or override | `delete_definition` |
+| Save a schedule/webhook; explicitly overwrite to edit | `save_automation` |
+| Delete an existing schedule/webhook | `delete_automation` |
+| Enable/disable a schedule/webhook | `set_automation_enabled` |
+| Webhook listener enabled state, port, or domain | `set_webhook_config` |
+| Desktop keep-awake, usage pin, or Computer observe-only state | `set_desktop_settings` |
+| Desktop theme, display language, side panels, or zoom | `set_appearance` |
+| Register a Project and optionally set its display alias | `save_project` |
+| Unregister a Project without deleting its files | `remove_project` |
+| Read Project/Common Instructions before editing | `get_instructions` |
+| Replace unchanged Project/Common Instructions and retain a backup | `set_instructions` |
+| Revoke one linked device; re-pairing restores access | `revoke_linked_device` |
+| Managed local model context allocation; null restores automatic | `set_local_context` |
 
 ## Routes and workflow
 
 Inspect `status model`, `status agents`, `status websearch`, or `status
 workflow` before changing the corresponding domain.
 
-- A partial route preserves omitted values.
+- A partial route preserves omitted values. Main routes also accept
+  `modelParameters` and `contextPercent`; agent routes accept `disabled`.
+  Use the model catalog for actual available options, not remembered model ids.
 - Setting an agent route provider to an empty string removes the override and
   restores Main inheritance.
 - A Web Search route must support native web search; tool exposure is changed
   separately.
-- Workflow definitions and custom agent definitions are edited through their
-  supported UI or file workflow, not through undocumented setup keys.
+- Definition actions use `definitionKind` (workflow, agent, skill). Read first,
+  then supply only changed fields. Workflow/agent ids cannot be renamed through
+  a save; change their display name instead. User skills may be renamed with
+  `originalName` and `name`. Skill deletion is not exposed; disable it instead.
+- Changing orchestration does not rewrite workflow instructions or agents.
 
 ## Providers and authentication
 
@@ -86,7 +111,11 @@ values through chat.
 
 - Output style changes do not rewrite the current answer already in progress.
 - Profile response language and Desktop display language are separate.
-- Auto-clear supports a global or provider-specific idle duration.
+- Auto-clear supports global/provider idle durations, `minContextPercent`,
+  `reset`, and `resetProvider`. A reset and a duration are mutually exclusive;
+  provider reset requires a provider.
+- Compaction supports `enabled` and either `mainBufferTokens` or
+  `mainBufferPercent`. Changing representation replaces the previous budget.
 - Memory master state controls tools, core injection, and background cycles.
   `set_recap_enabled` changes only the background cycles.
 - Core Memory entries are read and changed with the `memory` tool, not setup.
@@ -102,8 +131,10 @@ bridge state.
 - Git installation may prepare system Git.
 - Office installation may prepare LibreOffice dependencies and global Noto
   fonts as well as the runtime component.
-- Browser Use, Computer Use, and voice installation/toggles are UI-owned.
-  Computer Use is Windows-only.
+- Browser Use, Computer Use, and voice installation/toggles use the same
+  `install_builtin` and `set_builtin_enabled` actions through a live Desktop
+  receipt. Computer Use is Windows-only. These actions do not approve OS
+  permission dialogs or first-use tool approval on the user's behalf.
 - Environment feature overrides are diagnostics for headless or benchmark
   environments, not ordinary user settings.
 
@@ -118,8 +149,35 @@ bridge state.
   skills and MCP integrations it contributes.
 - MCP mutation results include reconnection state. Diagnose the returned error
   before making another change.
+- MCP add requires name plus command or URL. Save uses `originalName` (defaults
+  to name), so changing `name` with `originalName` renames the existing server.
+  Omitted fields remain unchanged. Switching transport requires a complete new
+  transport. Raw credential fields are not accepted; `env_vars`,
+  `bearer_token_env_var`, and `env_http_headers` reference existing environment
+  variables without exposing their values.
+- Environment/header maps are partial patches. Omitted keys are preserved;
+  `null` explicitly removes one key, including a stored credential.
 - Plugin enablement moves its contributed skills and MCP integrations together.
 
+## Desktop, Projects, and automation
+
+- `status capabilities` lists supported actions and deliberate handoffs.
+- Desktop-only operations require the owning conversation visible in the local
+  Desktop app. They affect the Desktop host, not a paired phone. Never claim a
+  persisted change from merely delivering a request.
+- A display-language change returns `requiresReload`; setup does not reload,
+  quit, deploy, or restart the app.
+- A Project removal unregisters it only. Instruction edits require the exact
+  previous content and return a retained backup path.
+- Inspect schedules/webhooks before editing. `overwrite:true` updates an
+  existing named entry and preserves omitted fields; a new schedule needs
+  instructions plus exactly one of cron `time` or one-shot `at`.
+- Attachment contents and webhook signing secrets are not returned by setup.
+  Omitted attachments and existing webhook secrets are preserved. Copy a
+  signing secret through the Webhooks UI, never chat.
+- Enabling or creating automation may start its background worker. This is a
+  persisted automation change, not permission to run an unrelated task now.
+
 ## Update
 
 Use `status update` and `set_auto_update` for persisted update settings. An

package/src/defaults/skills/setup/references/surfaces.md

@@ -48,25 +48,32 @@ execution returns `opened:false` with guidance to relay to the user.
 Provider authentication is intentionally hidden from the remote web app; guide
 the user to Desktop.
 
-## UI-owned settings
+## Desktop-backed settings
+
+Setup can read and change Desktop appearance, keep-awake, usage pin,
+Computer observe-only, Browser/Computer/voice installation and toggles,
+Projects, Instructions, and linked-device revocation through the attached
+Desktop. A receipt identifies `scope:desktop-host`; appearance is not applied
+to the paired browser. No Desktop claimant means no confirmed change.
+
+Schedules/webhooks and workflow/agent/skill definitions use their runtime
+actions directly. These do not require clicking their Desktop rails.
+
+## User-operated UI handoffs
 
 The setup tool does not mutate:
 
-- Desktop display language, theme, side panels, notifications, or keep-awake;
-- GitHub CLI connection;
-- web-app pairing and linked devices;
-- Project registration, naming, or Project/Common Instructions;
-- workflow-pack and agent-definition authoring;
-- Browser Use, Computer Use, or voice install/toggle state;
-- schedules and webhooks.
+- API keys, OAuth, usage sign-in, and GitHub CLI connection;
+- notification permission and subscription on the receiving device;
+- web-app pairing credentials and OS permission dialogs;
+- TUI-local theme palettes (use `/theme`; Desktop themes are separate).
 
-Use `open` where a target exists, then let the user act. Schedules and webhooks
-live on their Desktop rails and have no setup action. Never simulate a missing
-action by editing local storage, configuration files, or database rows.
+Use `open` where a target exists, then let the user act. Never simulate a
+missing or denied operation by editing storage or switching surfaces.
 
 ## TUI notes
 
-The TUI settings hub exposes system shell and Memory cycle controls in addition
-to common settings. A visible control does not imply a setup mutation exists;
-use the tool schema as the API boundary.
+The TUI settings hub exposes system shell in addition to common settings.
+Desktop-host actions need the Desktop app; opening the TUI is not a substitute.
+Use the schema and `status capabilities` as the supported API boundary.
 

package/src/headless-exec.mjs

@@ -9,6 +9,7 @@ import {
 } from './runtime/shared/pristine-execution.mjs';
 import { hasActiveBackgroundTasks } from './runtime/shared/background-tasks.mjs';
 import { installProcessSignalCleanup } from './runtime/shared/process-shutdown.mjs';
+import { closeUsageLedgers } from './runtime/shared/llm/usage-ledger.mjs';
 import { stopStandaloneMemoryRuntimesForProcess } from './standalone/memory-runtime-proxy.mjs';
 import { shutdownDaemonForRuntimeRoot } from './standalone/session-client.mjs';
 import { applyUsageDelta, createSessionStats } from './ui/session-stats.mjs';
@@ -563,6 +564,7 @@ export async function runHeadlessExec({
   runtimeFactory = null,
   memoryRuntimeCleanup = stopStandaloneMemoryRuntimesForProcess,
   daemonRuntimeCleanup = shutdownDaemonForRuntimeRoot,
+  usageLedgerCleanup = closeUsageLedgers,
   hasActiveTasks = hasActiveBackgroundTasks,
   installSignalCleanupFn = installProcessSignalCleanup,
 } = {}) {
@@ -629,6 +631,14 @@ export async function runHeadlessExec({
       } catch (error) {
         errors.push(error);
       }
+      try {
+        // The usage ledger lives inside the pristine root. Its open SQLite
+        // handle blocks the root removal below on Windows (EBUSY) for the whole
+        // rmSync retry budget, so release it once the last usage row is in.
+        usageLedgerCleanup();
+      } catch (error) {
+        errors.push(error);
+      }
       let resourceCleanupFailed = false;
       if (boundary?.runtimeRoot) {
         try {
@@ -650,8 +660,14 @@ export async function runHeadlessExec({
         }
       }
       try {
+        // The answer is already final here. A root whose memory daemon is still
+        // winding down (its pg.log stays open for a while) must not hold the
+        // exit for the default ≈128s retry budget; 10 linear retries ≈ 5.5s,
+        // and the periodic orphan sweep reclaims whatever is left.
         const cleanupResult = boundary?.cleanup(
-          resourceCleanupFailed ? { preserveRoot: true } : { tolerateRootRemovalFailure: true }
+          resourceCleanupFailed
+            ? { preserveRoot: true }
+            : { tolerateRootRemovalFailure: true, rootRemovalRetries: 10 }
         );
         if (cleanupResult?.rootRemovalError) {
           writeErr(

package/src/lib/rules-builder.cjs

@@ -19,14 +19,10 @@
  *
  * Source files (rules/):
  *   - shared/*.md                    — ordered universal policies (Lead + agent BP1, identical full set)
- *   - lead/lead-tool.md             — Lead-specific control-tower / delegation / ToolSearch guidance
- *   - lead/lead-brief.md            — Lead brief contract (delegating workflows only)
- *   - lead/01-general.md             — Lead general
- *   - lead/02-persona.md             — Lead communication personality
+ *   - lead/LEAD.md                   — Lead role: user communication, agent briefing (agent-gated), tone
  *   - output-styles/common.md        — shared built-in output composition policy
  *   - output-styles/<name>.md        — selected built-in depth variant or standalone user style
- *   - agent/00-core.md               — universal agent constraints (BP3, all profiles)
- *   - agent/00-common.md             — public-agent-only extras (BP3 full profile)
+ *   - agent/AGENT.md                 — common agent contract: chain of command, handoff (BP3, all profiles)
  *   - agent/10..50-*.md              — per-hidden-agent bodies (consumed by loadScopedRoleInstructions)
  *
  * Core memory snapshot is injected separately from the memory worker (pgdata)
@@ -274,25 +270,119 @@ function buildSharedToolContent({ PLUGIN_ROOT, omitTools = [], allowTools = null
   return omitToolRoutes(readMarkdownDirectory(SHARED_DIR), omitTools, allowTools);
 }
 
-function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR, includeLeadBrief = true }) {
-  const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');
-  const LEAD_DIR = path.join(RULES_DIR, 'lead');
-  const general = readOptional(path.join(LEAD_DIR, '01-general.md'));
-  const persona = readOptional(path.join(LEAD_DIR, '02-persona.md'));
+// Route policy: `rules/routes/*.md` files bound to a provider and/or model
+// family through frontmatter (`providers: a, b` exact ids; `models: gemini-*`
+// lowercase globs tested against the model id and its `/`-leaf). A listed key
+// restricts; an unlisted key is unrestricted, so a file without frontmatter
+// applies to every route. The body is static rules appended to BP1;
+// `turn-reminder: <one line>` rides the user turn's trailing <system-reminder>
+// block (read once before the turn's first response); `round-reminder: <one
+// line>` is appended after every tool round (delivered as the provider's
+// turn-scoped system message where it supports one, else as the runtime
+// <system-reminder>). Frontmatter never reaches the model.
+function parseRouteFrontmatter(markdown) {
+  const match = String(markdown || '').match(/^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/);
+  const meta = {};
+  if (!match) return meta;
+  for (const line of match[1].split(/\r?\n/)) {
+    const kv = line.match(/^([A-Za-z0-9_-]+):\s*(.*?)\s*$/);
+    if (kv) meta[kv[1].toLowerCase()] = kv[2];
+  }
+  return meta;
+}
+
+function routeList(value) {
+  return String(value || '')
+    .split(',')
+    .map((item) => item.trim().replace(/^['"]|['"]$/g, '').toLowerCase())
+    .filter(Boolean);
+}
+
+function routePatternMatches(pattern, value) {
+  const source = pattern
+    .split('*')
+    .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+    .join('.*');
+  return new RegExp(`^${source}$`).test(value);
+}
+
+function routeRulesApply(meta, provider, model) {
+  const providers = routeList(meta.providers);
+  const models = routeList(meta.models);
+  const providerId = String(provider || '')
+    .trim()
+    .toLowerCase();
+  const modelId = String(model || '')
+    .trim()
+    .toLowerCase();
+  const modelLeaf = modelId.split('/').pop() || '';
+  if (providers.length && !providers.includes(providerId)) return false;
+  if (models.length && !models.some((p) => routePatternMatches(p, modelId) || routePatternMatches(p, modelLeaf))) {
+    return false;
+  }
+  return true;
+}
+
+// The route files that apply to this provider/model, in name order.
+function matchingRouteFiles({ PLUGIN_ROOT, provider, model }) {
+  const ROUTES_DIR = path.join(PLUGIN_ROOT, 'rules', 'routes');
+  let names;
+  try {
+    names = fs
+      .readdirSync(ROUTES_DIR)
+      .filter((name) => name.endsWith('.md'))
+      .sort();
+  } catch {
+    return [];
+  }
+  const files = [];
+  for (const name of names) {
+    const raw = readOptional(path.join(ROUTES_DIR, name));
+    if (!raw) continue;
+    const meta = parseRouteFrontmatter(raw);
+    if (routeRulesApply(meta, provider, model)) files.push({ raw, meta });
+  }
+  return files;
+}
+
+function buildRouteRulesContent({ PLUGIN_ROOT, provider = null, model = null, omitTools = [], allowTools = null } = {}) {
   const parts = [];
+  for (const { raw } of matchingRouteFiles({ PLUGIN_ROOT, provider, model })) {
+    const body = stripFrontmatter(raw);
+    if (body) parts.push(body);
+  }
+  return omitToolRoutes(parts.join('\n'), omitTools, allowTools);
+}
 
-  if (includeLeadBrief) {
-    const briefLead = readOptional(path.join(LEAD_DIR, 'lead-brief.md'));
-    if (briefLead) parts.push(briefLead);
+// One frontmatter line for the route: the unrestricted files (`common.md`)
+// come first, then whatever a file naming `models:` or `providers:` adds for
+// that key — additions extend the common line, they never replace it.
+function routeFrontmatterLine({ PLUGIN_ROOT, provider, model }, key) {
+  const lines = { general: [], specific: [] };
+  for (const { meta } of matchingRouteFiles({ PLUGIN_ROOT, provider, model })) {
+    const line = String(meta[key] || '').trim();
+    if (!line) continue;
+    lines[routeList(meta.models).length || routeList(meta.providers).length ? 'specific' : 'general'].push(line);
   }
+  return [...lines.general, ...lines.specific].join(' ');
+}
 
-  // Delegation-free workflows (Solo, headless) never expose the `agent` tool,
-  // so Lead guidance marked `<!-- tools: agent -->` is dropped there and kept
-  // verbatim for delegating workflows.
-  if (general) parts.push(omitToolRoutes(general, includeLeadBrief ? [] : ['agent']));
-  if (persona) parts.push(persona);
+function buildRouteRoundReminderContent({ PLUGIN_ROOT, provider = null, model = null } = {}) {
+  return routeFrontmatterLine({ PLUGIN_ROOT, provider, model }, 'round-reminder');
+}
 
-  return parts.join('\n\n');
+function buildRouteTurnReminderContent({ PLUGIN_ROOT, provider = null, model = null } = {}) {
+  return routeFrontmatterLine({ PLUGIN_ROOT, provider, model }, 'turn-reminder');
+}
+
+function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR, includeLeadBrief = true }) {
+  const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');
+  const lead = readOptional(path.join(RULES_DIR, 'lead', 'LEAD.md'));
+  if (!lead) return '';
+  // Delegation-free workflows (Solo, headless) never expose the `agent` tool,
+  // so Lead guidance marked `<!-- tools: agent -->` (briefing, completion
+  // notifications) is dropped there and kept verbatim for delegating workflows.
+  return omitToolRoutes(lead, includeLeadBrief ? [] : ['agent']);
 }
 
 function buildLeadMetaContent({ PLUGIN_ROOT, DATA_DIR }) {
@@ -371,9 +461,7 @@ function buildAgentRoleContent({ PLUGIN_ROOT, profile = 'full' }) {
   if (String(profile || 'full') === 'retrieval') {
     return buildAgentRetrievalInjectionContent({ PLUGIN_ROOT });
   }
-  const core = readOptional(path.join(AGENT_DIR, '00-core.md'));
-  const common = readOptional(path.join(AGENT_DIR, '00-common.md'));
-  return [core, common].filter(Boolean).join('\n\n');
+  return readOptional(path.join(AGENT_DIR, 'AGENT.md')) || '';
 }
 
 /**
@@ -386,7 +474,7 @@ function buildAgentRoleContent({ PLUGIN_ROOT, profile = 'full' }) {
  */
 function buildAgentRetrievalInjectionContent({ PLUGIN_ROOT }) {
   const AGENT_DIR = path.join(PLUGIN_ROOT, 'rules', 'agent');
-  const core = readOptional(path.join(AGENT_DIR, '00-core.md'));
+  const core = readOptional(path.join(AGENT_DIR, 'AGENT.md'));
   // Full ordered shared policy now ships via BP1 for retrieval
   // roles too; no compact duplicate here.
   const parts = [];
@@ -397,6 +485,9 @@ function buildAgentRetrievalInjectionContent({ PLUGIN_ROOT }) {
 
 module.exports = {
   buildSharedToolContent,
+  buildRouteRulesContent,
+  buildRouteRoundReminderContent,
+  buildRouteTurnReminderContent,
   buildLeadRoleContent,
   buildLeadMetaContent,
   buildLeadLanguageContent,

package/src/output-styles/common.md

@@ -16,4 +16,4 @@ partial: true
 - Follow explicit requests for depth; never pad. Omit tangents, unsolicited
   advice or offers, raw dumps, and process recaps.
 - Apply the selected depth to substantive answers, not preambles or progress
-  updates. Progress reports only new material findings, not a full summary.
+  updates.

package/src/output-styles/detailed.md

@@ -5,7 +5,7 @@ description: Concrete explanation with full requested depth
 aliases: verbose, full
 ---
 
-## Depth Variation
+## Depth
 
 - Explain the reasoning, mechanisms, evidence, trade-offs, and implications
   supporting the answer. Include relevant examples and edge cases.

package/src/output-styles/extreme-minimal.md

@@ -5,7 +5,7 @@ description: Final decision or direct answer in one or two sentences
 aliases: extreme, extreme-simple, one-line, mono
 ---
 
-## Depth Variation
+## Depth
 
 - Give the direct answer or result; for a cause question, give the
   determining cause.

package/src/output-styles/minimal.md

@@ -5,7 +5,7 @@ description: Conclusion, core cause, and one decisive fact
 aliases: brief, short
 ---
 
-## Depth Variation
+## Depth
 
 - State the conclusion and determining cause, adding one decisive fact or
   immediate consequence when useful.

package/src/output-styles/simple.md

@@ -5,7 +5,7 @@ description: Concise summary with the essential explanation
 aliases: default, concise, handoff
 ---
 
-## Depth Variation
+## Depth
 
 - Give a self-contained summary: answer, core causal sequence, strongest
   evidence, and direct consequences.

package/src/rules/agent/40-cycle1-agent.md

@@ -29,4 +29,4 @@ For `SECOND_LAYER`, output only a shorter narrative in the source language.
 This is intentionally lossy compression: about half the input length is a
 target, not a pass/fail threshold. Prioritize main flow, latest conclusions,
 corrections and conditions; omit secondary detail. Do not output JSON, indexes,
-search metadata, a verification report, fences or preamble. Make no tool calls.
+search metadata, a verification report, fences or preamble.

package/src/rules/agent/AGENT.md

@@ -0,0 +1,13 @@
+# Agent
+
+- Lead's latest brief is your request and overrides any internal rule; Lead
+  owns user approval. Execute within the assigned scope and permissions without
+  reapproval; escalate only scope changes, unapproved destructive actions or
+  blockers to Lead.
+- Do not review or verify unless your `AGENT.md` assigns it; Lead owns
+  verification.
+- Communicate in English. Call tools immediately, with no preamble or progress
+  text; your only text is the final handoff, sent once the work is done.
+- Handoff: outcome, key `file:line`, material risk or blocker, unresolved tool
+  failures, and the assigned verification result — fragments, max 30 lines;
+  never raw logs, process narration, or brief restatement.

package/src/rules/lead/LEAD.md

@@ -0,0 +1,30 @@
+# Lead
+
+- You are Mixdog, a coding agent.
+- The user's latest explicit request overrides any internal rule; drive it to
+  completion.
+- The user sees only your text, not tool calls or thinking. Before the first
+  tool call, state in one line what you are about to do; afterwards bring the
+  user only material findings, direction or scope changes, unapproved
+  destructive actions, blockers or meaningful delays — never per-call
+  narration or plan repeats.
+- Mid-task: a replacement supersedes, an addition folds in, a status question
+  gets a brief answer while work continues.
+- Context is managed automatically: never propose stopping or stop on your own
+  judgment.
+- Be a grounded, candid, and attentive collaborator: natural and respectful,
+  without flattery, forced humor, mimicry, or stereotyping.
+<!-- tools: agent -->
+- An agent sees only its brief, never this conversation. Brief the task,
+  purpose, scope and completion criteria in the user's exact terms, plus the
+  context it needs — findings synthesized into paths, lines and the exact
+  change or question, never "based on your findings". Assign within each
+  agent's role and permissions, never the same work twice. Fresh or respawned
+  agents get a complete brief, continuing agents only what changed; interrupt
+  only to cancel. Clear English, no fixed fields or repeated rules.
+<!-- tools: agent -->
+- Agent completion arrives by automatic notification: when an agent tool
+  result says so, finish other work not waiting on it and end the turn instead
+  of waiting in-turn; never predict or fabricate an agent's result. Resume
+  collection and review when the notification arrives; pending agent work is
+  not a completed request.

package/src/rules/routes/common.md

@@ -0,0 +1,4 @@
+---
+turn-reminder: Batch: all independent calls in one response; several targets → one array argument.
+round-reminder: Batch: all independent calls in one response; several targets → one array argument.
+---