thoth-agents 0.1.11 → 0.1.16

package/README.md

@@ -2,6 +2,13 @@
   <img src="img/team.png" alt="thoth-agents agents" width="420">
   <p><i>Seven specialized agents, one delegate-first workflow across supported harnesses.</i></p>
   <p><b>thoth-agents</b> - Multi-harness orchestration - Thoth-mem persistence - Bundled SDD pipeline</p>
+  <p>
+    <a href="https://github.com/EremesNG/thoth-agents/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/EremesNG/thoth-agents/ci.yml?branch=master&label=CI" alt="CI status"></a>
+    <a href="https://www.npmjs.com/package/thoth-agents"><img src="https://img.shields.io/npm/v/thoth-agents?label=npm" alt="npm version"></a>
+    <a href="https://github.com/EremesNG/thoth-agents/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/thoth-agents" alt="MIT license"></a>
+    <img src="https://img.shields.io/node/v/thoth-agents" alt="Node.js version">
+    <img src="https://img.shields.io/badge/pnpm-11.2.2-F69220?logo=pnpm&logoColor=white" alt="pnpm 11.2.2">
+  </p>
 </div>
 
 ---

package/dist/{chunk-A753XXHX.js → chunk-HFKZF2ZB.js}

@@ -31,7 +31,7 @@ import {
   renderRolePrompt,
   writeConfig,
   writeLiteConfig
-} from "./chunk-R2AP6O5Q.js";
+} from "./chunk-XTLXC2CM.js";
 
 // src/harness/adapters/codex.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
@@ -94,7 +94,7 @@ var AGENT_ROLES = [
     responsibility: "Provide strategic technical guidance anchored to evidence and review SDD plans.",
     toolGovernance: [
       "read-only analysis and review",
-      "no implementation or artifact-producing SDD phases",
+      "no implementation; may perform read-only SDD plan review and verification review, but does not persist artifacts",
       "no task delegation"
     ],
     verification: ["separates observations, risks, and recommendations"]
@@ -182,16 +182,24 @@ var READ_RECALL_CHAIN = [
   "mem_timeline",
   "mem_get_observation"
 ];
+var BOUNDED_CONTEXT_TOOLS = [
+  "mem_context",
+  "mem_project_summary",
+  "mem_project_graph",
+  "mem_topic_keys"
+];
 var WRITE_CAPABLE_DELEGATED_TOOLS = [
   "mem_save",
   "mem_search",
   "mem_get_observation",
   "mem_timeline",
+  ...BOUNDED_CONTEXT_TOOLS,
   "mem_suggest_topic_key"
 ];
 var ALL_MEMORY_TOOLS = [
   ...ROOT_OWNED_TOOLS,
   ...READ_RECALL_CHAIN,
+  ...BOUNDED_CONTEXT_TOOLS,
   "mem_suggest_topic_key",
   "mem_save"
 ];
@@ -203,20 +211,25 @@ function roleAllowedTools(role) {
     return uniqueTools([...ROOT_OWNED_TOOLS, ...WRITE_CAPABLE_DELEGATED_TOOLS]);
   }
   if (role.mode === "read-only") {
-    return [...READ_RECALL_CHAIN];
+    return [...READ_RECALL_CHAIN, ...BOUNDED_CONTEXT_TOOLS];
   }
   return [...WRITE_CAPABLE_DELEGATED_TOOLS];
 }
 function roleRules(role) {
   const sharedSubagentRules = [
     "Every subagent memory call requires the parent session_id and project from dispatch; if either is missing, do not call thoth-mem.",
+    "Delegated handoff recovery uses parent-scoped 3-layer recall with mem_search -> mem_timeline -> mem_get_observation before memory content is treated as source material.",
+    "Report missing, stale, contradictory, or insufficient recalled context instead of guessing through it.",
     "Never call mem_session_start, mem_session_summary, or mem_save_prompt; those tools are root/orchestrator-owned.",
+    "Never save generated subagent prompts as user intent.",
     "Protect the sdd/* topic namespace; SDD artifacts may use deterministic sdd/{change}/{artifact} topic keys only in persistence modes that include thoth-mem."
   ];
   if (role.name === "orchestrator") {
     return [
       "mem_session_start, mem_session_summary, and mem_save_prompt are root/main orchestrator-owned tools and responsibilities.",
       "In harnesses without an orchestrator-named agent, root/main orchestrator-owned means the initial/root agent when the harness does not expose an orchestrator-named agent.",
+      "Before delegation, save or refresh the handoff body with root-owned mem_session_summary when available; otherwise disclose that compaction could not be persisted.",
+      "Dispatch task instructions plus recovery instructions, not the handoff body, raw transcripts, or generated subagent prompts.",
       "Dispatch parent session_id and project when authorizing subagent memory use.",
       "Protect the sdd/* topic namespace and write SDD memory artifacts only in thoth-mem or hybrid persistence modes."
     ];
@@ -225,13 +238,17 @@ function roleRules(role) {
     return [
       ...sharedSubagentRules,
       "Read-only agents may only perform bounded, project-scoped recall with mem_search -> mem_timeline -> mem_get_observation when authorized.",
+      "Bounded context tools mem_context, mem_project_summary, mem_project_graph, and mem_topic_keys are allowed only with explicit delegated permission and parent session/project scope.",
+      "Project-scoped read tools require explicit delegated permission.",
       "Read-only agents must never write durable memory."
     ];
   }
   return [
     ...sharedSubagentRules,
-    "Write-capable agents may call mem_save only for delegated durable observations under the parent session/project.",
-    "For reads, use only mem_search -> mem_timeline -> mem_get_observation."
+    "Write-capable agents may call mem_save only for delegated durable observations or assigned deterministic SDD artifacts/apply-progress under the parent session/project.",
+    "For reads, use only mem_search -> mem_timeline -> mem_get_observation.",
+    "Bounded context tools mem_context, mem_project_summary, mem_project_graph, and mem_topic_keys are allowed only with explicit delegated permission and parent session/project scope.",
+    "Project-scoped read tools require explicit delegated permission."
   ];
 }
 function getRoleMemoryGovernance(role) {
@@ -279,7 +296,7 @@ function memoryGovernanceDiagnostics(input) {
     diagnostics.push({
       severity: input.parentContextInjection === "unknown" ? "error" : "warning",
       code: `${input.harness}.context.parent_injection.unvalidated`,
-      message: "Parent session_id/project injection is not runtime-enforced; subagents must be instructed not to use memory without explicit dispatch context.",
+      message: "Parent session_id/project injection is not runtime-enforced; subagents must be instructed not to use memory without explicit dispatch context and handoff recovery instructions.",
       harness: input.harness,
       capability: "parentContextInjection",
       fallback: "instruction-only"
@@ -289,7 +306,7 @@ function memoryGovernanceDiagnostics(input) {
     diagnostics.push({
       severity: "warning",
       code: `${input.harness}.permission.memory_write.enforcement_gap`,
-      message: "Runtime controls for delegated memory writes are unavailable; write-capable agents receive instruction-level mem_save limits only.",
+      message: "Runtime controls for delegated memory writes are unavailable; write-capable agents receive instruction-level mem_save limits for durable observations and deterministic SDD artifacts only.",
       harness: input.harness,
       capability: "memoryGovernanceEnforcement",
       fallback: "instruction-only"
@@ -1358,11 +1375,12 @@ function codexInternalHandoffGuidance() {
     "<codex-delegation-guidance>",
     "- The user has explicitly authorized this generated Codex orchestrator to use `multi_agent_v1.spawn_agent` whenever delegation is required by these instructions, without needing a fresh user request for subagents in each task.",
     "- Delegate by calling `multi_agent_v1.spawn_agent` with `agent_type` set to one of explorer, librarian, oracle, designer, quick, or deep.",
-    "- Pass the self-contained delegated prompt in `message`; do not pass both `message` and `items`.",
-    "- Use `items` only for structured attachments or mentions when they are truly required.",
-    "- Include the internal handoff in `message` for write-capable agents so they can act without rediscovering context.",
+    "- Pass the self-contained delegated task instructions plus handoff retrieval instructions in `message`; do not embed the root-owned handoff summary body in `message`.",
+    "- Do not include the handoff body in `message` or `items`, and do not pass both `message` and `items` for the same handoff.",
+    "- Use `items` only for structured attachments or mentions when they are truly required; do not use `items` as a handoff-summary payload.",
     "- Leave `fork_context` omitted or false by default; set `fork_context: true` only when the exact current thread history is required.",
     "- Use `multi_agent_v1.wait_agent` only when the root needs the result, `multi_agent_v1.send_input` for follow-up or redirect, `multi_agent_v1.resume_agent` only for a closed agent that must continue, and `multi_agent_v1.close_agent` after completion.",
+    "- Memory ownership, handoff recovery, permissions, and prompt-body exclusion are instruction-level unless the active Codex runtime documents stronger enforcement.",
     "</codex-delegation-guidance>"
   ].join("\n");
 }
@@ -1404,6 +1422,7 @@ function renderCodexRootInstructions(config) {
     "- The ambient Codex root session is the root/main orchestrator; orchestrator-only and root-owned instructions apply to it because Codex does not generate a selectable orchestrator agent TOML.",
     "- On each new root session, when thoth-mem tools are installed and session/project identity is known, call mem_session_start with the active project and session identity, then save the real user prompt with mem_save_prompt before later delegation.",
     "- If thoth-mem tools or identity values are unavailable, disclose that memory bootstrap could not run and continue without claiming memory was saved.",
+    "- Before delegating after meaningful context changes, save or refresh the handoff body with root-owned mem_session_summary when available; if unavailable, disclose that root-owned compaction could not be persisted.",
     "- Use the ambient Codex root session as the delegate-first root coordinator; do not generate or select an orchestrator TOML.",
     "- Delegate by invoking `multi_agent_v1.spawn_agent` for the installed Codex role agents: explorer, librarian, oracle, designer, quick, and deep.",
     "- After receiving a delegated subagent response, close that subagent session unless you will retry or intentionally keep using that exact same session; explorer and librarian sessions must always be closed immediately after their response, and retry sessions must be closed after the retry result unless explicit same-session reuse is still required.",

package/dist/{chunk-R2AP6O5Q.js → chunk-XTLXC2CM.js}

@@ -746,6 +746,186 @@ var CODEX_PROMPT_DIALECT = {
   }
 };
 
+// src/harness/core/sdd.ts
+var SDD_PHASES = [
+  {
+    id: "requirements-interview",
+    order: 0,
+    requiredFor: ["direct", "accelerated", "full"],
+    prerequisites: [],
+    producesArtifact: false,
+    owner: "orchestrator",
+    delegationReason: "Root-owned requirements discovery, scope calibration, and route approval."
+  },
+  {
+    id: "init",
+    order: 1,
+    requiredFor: [],
+    prerequisites: ["requirements-interview"],
+    producesArtifact: true,
+    owner: "write-capable-agent",
+    artifactSkill: "sdd-init",
+    condition: "Only when OpenSpec persistence is selected and openspec/ is missing.",
+    defaultAgentRole: "quick",
+    supportingAgentRoles: ["explorer"],
+    delegationReason: "Fast mechanical bootstrap, with explorer supplying repository facts when needed."
+  },
+  {
+    id: "explore",
+    order: 2,
+    requiredFor: ["accelerated", "full"],
+    prerequisites: ["requirements-interview"],
+    producesArtifact: false,
+    owner: "read-only-agent",
+    defaultAgentRole: "explorer",
+    supportingAgentRoles: ["librarian"],
+    delegationReason: "Read-only repository discovery before artifact-producing SDD phases."
+  },
+  {
+    id: "proposal",
+    order: 3,
+    requiredFor: ["accelerated", "full"],
+    prerequisites: ["requirements-interview", "explore"],
+    producesArtifact: true,
+    owner: "write-capable-agent",
+    artifactSkill: "sdd-propose",
+    defaultAgentRole: "deep",
+    supportingAgentRoles: ["oracle"],
+    delegationReason: "Structured technical reasoning and trade-off synthesis before implementation."
+  },
+  {
+    id: "spec",
+    order: 4,
+    requiredFor: ["full"],
+    prerequisites: ["proposal"],
+    producesArtifact: true,
+    owner: "write-capable-agent",
+    artifactSkill: "sdd-spec",
+    defaultAgentRole: "deep",
+    supportingAgentRoles: ["oracle"],
+    delegationReason: "High-quality requirement contract work where ambiguity propagates downstream."
+  },
+  {
+    id: "design",
+    order: 5,
+    requiredFor: ["full"],
+    prerequisites: ["proposal", "spec"],
+    producesArtifact: true,
+    owner: "write-capable-agent",
+    artifactSkill: "sdd-design",
+    artifactMeaning: "technical-solution-design",
+    defaultAgentRole: "deep",
+    supportingAgentRoles: ["designer"],
+    delegationReason: "Technical architecture and file-change design; designer only supports UI/UX concerns."
+  },
+  {
+    id: "tasks",
+    order: 6,
+    requiredFor: ["accelerated", "full"],
+    prerequisites: ["proposal", "spec", "design"],
+    producesArtifact: true,
+    owner: "write-capable-agent",
+    artifactSkill: "sdd-tasks",
+    defaultAgentRole: "quick",
+    alternateAgentRoles: ["deep"],
+    delegationReason: "Mechanical conversion of settled design into dependency-ordered execution tasks."
+  },
+  {
+    id: "plan-review",
+    order: 7,
+    requiredFor: ["accelerated", "full"],
+    prerequisites: ["tasks"],
+    producesArtifact: false,
+    gate: "oracle-review",
+    owner: "oracle",
+    defaultAgentRole: "oracle",
+    delegationReason: "Independent read-only executability review of tasks before implementation."
+  },
+  {
+    id: "implementation-confirmation",
+    order: 8,
+    requiredFor: ["accelerated", "full"],
+    prerequisites: ["plan-review"],
+    producesArtifact: false,
+    gate: "user-confirmation",
+    owner: "user",
+    delegationReason: "Human approval gate after reviewed tasks and before workspace implementation."
+  },
+  {
+    id: "apply",
+    order: 9,
+    requiredFor: ["direct", "accelerated", "full"],
+    prerequisites: ["implementation-confirmation"],
+    producesArtifact: false,
+    owner: "write-capable-agent",
+    defaultAgentRole: "deep",
+    alternateAgentRoles: ["quick", "designer"],
+    delegationReason: "Correctness-heavy implementation by default; quick handles mechanical batches and designer owns UI/visual work."
+  },
+  {
+    id: "verify",
+    order: 10,
+    requiredFor: ["accelerated", "full"],
+    prerequisites: ["apply"],
+    producesArtifact: true,
+    owner: "oracle",
+    artifactSkill: "sdd-verify",
+    defaultAgentRole: "oracle",
+    persistenceAgentRole: "quick",
+    delegationReason: "Independent verification review; quick persists the report when the selected store requires writes."
+  },
+  {
+    id: "archive",
+    order: 11,
+    requiredFor: ["accelerated", "full"],
+    prerequisites: ["verify"],
+    producesArtifact: true,
+    owner: "write-capable-agent",
+    artifactSkill: "sdd-archive",
+    defaultAgentRole: "quick",
+    delegationReason: "Mechanical closeout, summary, and archive movement after verification passes."
+  }
+];
+var SDD_WORKFLOW_CONTRACT = {
+  phases: [...SDD_PHASES],
+  routingRules: [
+    "Requirements interview is step zero for all non-trivial work.",
+    "Scope-faithful invariant: accepted user intent/scope is preserved; unresolved affected areas remain explicit as deferred/discovery follow-up.",
+    "Direct implementation is reserved for low-complexity work.",
+    "Accelerated SDD follows explore -> proposal -> tasks before execution.",
+    "Full SDD follows explore -> proposal -> spec -> design -> tasks before execution."
+  ],
+  artifactRules: [
+    "SDD delegation defaults are phase-specific: sdd-propose, sdd-spec, and sdd-design default to deep.",
+    "sdd-tasks defaults to quick with deep as fallback when the task plan is complex.",
+    "sdd-verify defaults to oracle for independent review; quick persists the report when repository or memory writes are required.",
+    "sdd-archive defaults to quick for mechanical closeout.",
+    "OpenSpec design.md is technical solution design, not UI/UX design; sdd-design itself never routes to designer.",
+    "Designer participates during apply only for user-facing UI, visual work, screenshots, or visual QA.",
+    "Full-pipeline tasks require proposal, spec, and design artifacts.",
+    "Oracle is read-only and performs plan review plus independent verification review; it does not persist artifacts."
+  ],
+  verificationRules: [
+    "Plan review must complete before implementation confirmation.",
+    "User confirmation is required after plan-review approval and before apply.",
+    "Apply is followed by verify and archive for SDD pipelines."
+  ]
+};
+function getSddWorkflowContract() {
+  return {
+    phases: SDD_WORKFLOW_CONTRACT.phases.map((phase) => ({
+      ...phase,
+      requiredFor: [...phase.requiredFor],
+      prerequisites: [...phase.prerequisites],
+      alternateAgentRoles: phase.alternateAgentRoles ? [...phase.alternateAgentRoles] : void 0,
+      supportingAgentRoles: phase.supportingAgentRoles ? [...phase.supportingAgentRoles] : void 0
+    })),
+    routingRules: [...SDD_WORKFLOW_CONTRACT.routingRules],
+    artifactRules: [...SDD_WORKFLOW_CONTRACT.artifactRules],
+    verificationRules: [...SDD_WORKFLOW_CONTRACT.verificationRules]
+  };
+}
+
 // src/agents/prompt-sections.ts
 function createQuestionProtocolSection() {
   return {
@@ -802,6 +982,43 @@ function createModelFamilySection(role, model) {
 function roleText(template) {
   return { kind: "role-text", template };
 }
+function roleTemplate(role) {
+  return `{{role.${role}}}`;
+}
+function renderRoleList(roles) {
+  return roles.map(roleTemplate).join(", ");
+}
+function getDelegatedSddPhase(id) {
+  const phase = getSddWorkflowContract().phases.find(
+    (candidate) => candidate.id === id
+  );
+  if (!phase?.defaultAgentRole) {
+    throw new Error(`Missing SDD delegation role for ${id}`);
+  }
+  return phase;
+}
+function primarySddRole(id) {
+  return roleTemplate(getDelegatedSddPhase(id).defaultAgentRole);
+}
+function alternateSddRoles(id) {
+  const phase = getDelegatedSddPhase(id);
+  return phase.alternateAgentRoles?.length ? renderRoleList(phase.alternateAgentRoles) : "";
+}
+function supportSddRoles(id) {
+  const phase = getDelegatedSddPhase(id);
+  return phase.supportingAgentRoles?.length ? renderRoleList(phase.supportingAgentRoles) : "";
+}
+function persistenceSddRole(id) {
+  const phase = getDelegatedSddPhase(id);
+  return phase.persistenceAgentRole ? roleTemplate(phase.persistenceAgentRole) : "";
+}
+function renderSddDelegationMatrix() {
+  return `<sdd-delegation-matrix>
+- sdd-init -> ${primarySddRole("init")} (+${supportSddRoles("init")}, if openspec/ missing); sdd-explore -> ${primarySddRole("explore")} (+${supportSddRoles("explore")})
+- sdd-propose/sdd-spec/sdd-design -> ${primarySddRole("proposal")}; sdd-tasks -> ${primarySddRole("tasks")} (fallback: ${alternateSddRoles("tasks")})
+- plan-reviewer -> ${primarySddRole("plan-review")}; sdd-apply -> ${primarySddRole("apply")} (fallback: ${alternateSddRoles("apply")}); sdd-verify -> ${primarySddRole("verify")} (persistence: ${persistenceSddRole("verify")}); sdd-archive -> ${primarySddRole("archive")}
+</sdd-delegation-matrix>`;
+}
 function specialistSections({
   role,
   mode,
@@ -912,11 +1129,15 @@ Tiebreakers:
 </subagent-prompts>
 
 <internal-handoff>
-Before dispatching {{role.designer}}, {{role.quick}}, or {{role.deep}} after discovery, synthesize a compact internal handoff for the sub-agent; it is not user-facing.
+Before dispatching {{role.designer}}, {{role.quick}}, or {{role.deep}} after discovery, synthesize a compact internal handoff body for root-owned session context; it is not user-facing and must not be embedded in the initial sub-agent prompt.
+
+Internal handoff fields: Goal, Decision, Evidence, Scope, Steps, Verification, Uncertainty, relevant files or symbols, suggested skills when applicable, constraints, non-goals, escalation conditions, and next focus.
 
-Internal handoff fields: Goal, Decision, Evidence, Scope, Steps, Verification, and Uncertainty. Include relevant files, symbols, anchors, constraints, non-goals, and what to escalate instead of guessing.
+When thoth-mem session-summary tooling and parent session/project identity are available, save or refresh that handoff body with root-owned \`mem_session_summary\` before dispatch. If the tooling or identity is unavailable, disclose that root-owned compaction could not be persisted and continue with explicit task instructions and local context; do not invent a fallback session or ask a sub-agent to create one.
 
-Never mention the internal handoff to the user, ask the user to prepare it, or present handoff preparation as the recommended next step. Describe the actual work instead.
+The delegated prompt carries task instructions plus handoff recovery instructions only: parent \`session_id\`, project, persistence mode, memory permissions, bounded 3-layer recall steps, non-goals, escalation conditions, and redaction requirements. It must not include the handoff body, raw transcripts, file dumps, secrets, credentials, irrelevant context, or generated sub-agent prompts as memory source material.
+
+Never mention internal handoff preparation to the user, ask the user to prepare it, or present handoff preparation as the recommended next step. Describe the actual work instead.
 
 For {{role.explorer}}/{{role.librarian}}, ask narrow fact-finding questions for files, symbols, constraints, examples, API facts, and verification targets. Require decision-ready findings, not raw context.
 </internal-handoff>
@@ -932,21 +1153,25 @@ For {{role.explorer}}/{{role.librarian}}, ask narrow fact-finding questions for
 - If a named subagent hits capacity, retry that same role up to 3 attempts.
 - Never switch to \`default\`, \`worker\`, or any other role.
 - After 3 failures, stay on the same role; if a same-role model override exists, use it. Otherwise report a capacity blocker.
-- Write-capable dispatches must include the internal handoff when one exists, so implementers can edit instead of rediscovering the plan.
+- Write-capable dispatches must include task instructions and handoff retrieval instructions when a root-owned handoff summary exists, so implementers can recover context without rediscovering settled scope.
 - Never tell sub-agents to discard working-tree changes.
 </dispatch>
 
 <sdd>
 All work always starts with requirements-interview skill.
+Scope-faithful invariant: accepted user intent and scope must not be silently narrowed; unresolved affected areas stay visible as deferred/discovery follow-up, not hidden as out-of-scope.
 
 Routes:
 - Direct implementation for low-complexity work.
-- Accelerated SDD: propose -> tasks.
-- Full SDD: propose -> spec -> design -> tasks.
+- Accelerated SDD: explore -> propose -> tasks.
+- Full SDD: explore -> propose -> spec -> design -> tasks.
+
+${renderSddDelegationMatrix()}
 
 Hard gates:
-- Artifact-producing SDD phases are dispatched to {{role.deep}} or {{role.quick}} with the matching skill loaded.
-- {{role.oracle}} is read-only and only handles plan-reviewer.
+- Use the SDD delegation matrix as canonical phase routing.
+- Load the matching skill when a phase has one.
+- {{role.oracle}} is read-only for plan-reviewer and sdd-verify review; {{role.quick}} persists verify reports when writes are required.
 - Never skip artifacts or jump from requirements-interview to implementation when SDD is selected.
 - Before SDD execution, load \`executing-plans\`; then track progress in {{progressTool}} plus the persistent artifact.
 - If openspec persistence is selected and openspec/ is missing, dispatch sdd-init first.
@@ -1148,18 +1373,31 @@ function renderSubagentRules(section, dialect) {
   ];
   if (section.memoryAccess === "readonly") {
     rules.push(
-      "- Use read-only thoth-mem only when dispatch gives session_id/project: `mem_search` -> `mem_timeline` -> `mem_get_observation`.",
+      "- Use read-only thoth-mem only when dispatch gives parent session_id/project and handoff recovery instructions: `mem_search` -> `mem_timeline` -> `mem_get_observation`.",
+      "- The canonical recall path remains `mem_search` -> `mem_timeline` -> `mem_get_observation`; use bounded context tools only as supplemental context when explicitly allowed.",
+      "- If either parent session_id or project is missing, do NOT call thoth-mem; rely on explicit task instructions and local evidence.",
+      "- Recover the parent-session handoff summary through bounded 3-layer recall before treating memory as source material.",
+      "- Report when recalled context is missing, stale, contradictory, or insufficient.",
+      "- Use project-scoped read tools (`mem_context`, `mem_project_summary`, `mem_project_graph`, `mem_topic_keys`) only when explicitly allowed by the delegated task instructions and bounded to the parent session/project scope.",
       "- Never call `mem_session_start`, `mem_session_summary`, or `mem_save_prompt`; those tools are orchestrator-owned.",
+      "- Never save generated subagent prompts as user intent.",
       "- Never write memory; memory writes are orchestrator-owned."
     );
   }
   if (section.memoryAccess === "writable") {
     rules.push(
-      "- Use delegated thoth-mem tools only (mem_save, mem_search, mem_get_observation, mem_timeline, mem_suggest_topic_key).",
+      "- Use delegated thoth-mem tools only (mem_save, mem_search, mem_get_observation, mem_timeline, mem_context, mem_project_summary, mem_project_graph, mem_topic_keys, mem_suggest_topic_key).",
       "- Never call `mem_session_start`, `mem_session_summary`, or `mem_save_prompt`; those tools are orchestrator-owned.",
       "- Always use the parent session_id/project from dispatch for every thoth-mem call.",
       "- If either is missing, do NOT call thoth-mem.",
-      "- For reads, use only `mem_search` -> `mem_timeline` -> `mem_get_observation`.",
+      "- Follow handoff recovery instructions from the delegated task before using persisted memory.",
+      "- For reads, use only `mem_search` -> `mem_timeline` -> `mem_get_observation` and recover the parent-session handoff summary before treating memory as source material.",
+      "- Keep 3-layer recall canonical; use `mem_context`, `mem_project_summary`, `mem_project_graph`, and `mem_topic_keys` only as bounded supplemental context when the dispatch explicitly permits project-scoped reads.",
+      "- Report when recalled context is missing, stale, contradictory, or insufficient.",
+      "- Use project-scoped read tools only when explicitly allowed by the delegated task instructions and bounded to the parent session/project scope.",
+      "- `mem_save` is allowed only for delegated durable implementation observations or assigned SDD artifacts/apply-progress under the parent session/project.",
+      "- Protect the `sdd/*` namespace: deterministic SDD artifacts use `sdd/{change}/{artifact}`; general durable observations must stay outside `sdd/*`.",
+      "- Never save generated subagent prompts as user intent.",
       "- You do not own durable memory of your own; `mem_save` writes under the orchestrator's session/project only."
     );
   }

package/dist/cli/index.js

@@ -25,7 +25,7 @@ import {
   getOperationHarness,
   installRecommendedSkill,
   listOperationHarnesses
-} from "../chunk-A753XXHX.js";
+} from "../chunk-HFKZF2ZB.js";
 import {
   ALL_AGENT_NAMES,
   CUSTOM_SKILLS,
@@ -37,7 +37,7 @@ import {
   getExistingLiteConfigPath,
   installCustomSkills,
   writeLiteConfig
-} from "../chunk-R2AP6O5Q.js";
+} from "../chunk-XTLXC2CM.js";
 
 // src/cli/index.ts
 import { pathToFileURL } from "url";

package/dist/cli/tui/index.js

@@ -15,13 +15,13 @@ import {
   getOpenCodeStatus,
   listOperationHarnesses,
   parseRoleTomlModel
-} from "../../chunk-A753XXHX.js";
+} from "../../chunk-HFKZF2ZB.js";
 import {
   ALL_AGENT_NAMES,
   DEFAULT_MODELS,
   getExistingLiteConfigPath,
   parseConfig
-} from "../../chunk-R2AP6O5Q.js";
+} from "../../chunk-XTLXC2CM.js";
 
 // src/cli/tui/index.tsx
 import { render } from "ink";

package/dist/harness/core/agent-pack.d.ts

@@ -51,7 +51,7 @@ export declare const AGENT_ROLES: readonly [{
     readonly canMutateWorkspace: false;
     readonly scope: "advice, diagnosis, architecture, code review, and plan review";
     readonly responsibility: "Provide strategic technical guidance anchored to evidence and review SDD plans.";
-    readonly toolGovernance: ["read-only analysis and review", "no implementation or artifact-producing SDD phases", "no task delegation"];
+    readonly toolGovernance: ["read-only analysis and review", "no implementation; may perform read-only SDD plan review and verification review, but does not persist artifacts", "no task delegation"];
     readonly verification: ["separates observations, risks, and recommendations"];
 }, {
     readonly name: "designer";

package/dist/harness/core/memory-governance.d.ts

@@ -1,7 +1,7 @@
 import type { HarnessPromptDialect } from '../../agents/prompt-dialects';
 import type { HarnessCapabilityStatus, HarnessDiagnostic } from '../types';
 import type { AgentRoleContract, AgentRoleName } from './agent-pack';
-export type MemoryToolName = 'mem_session_start' | 'mem_session_summary' | 'mem_save_prompt' | 'mem_search' | 'mem_timeline' | 'mem_get_observation' | 'mem_suggest_topic_key' | 'mem_save';
+export type MemoryToolName = 'mem_session_start' | 'mem_session_summary' | 'mem_save_prompt' | 'mem_search' | 'mem_timeline' | 'mem_get_observation' | 'mem_context' | 'mem_project_summary' | 'mem_project_graph' | 'mem_topic_keys' | 'mem_suggest_topic_key' | 'mem_save';
 export type MemoryRuntimeEnforcement = 'runtime' | 'instruction-only';
 export interface RoleMemoryGovernance {
     role: AgentRoleName;