Merge branch 'main' of github.com:Dark-Alex-17/coyote

PLAN-rigor-surfaces: Rigor & Surfaces — Quality Calibration for the Architect/Sisyphus Suite

.gitattributes

@@ -0,0 +1 @@
+assets/config-template.yaml text eol=lf

.github/workflows/ci.yaml

@@ -36,6 +36,17 @@ jobs:
 
     - uses: Swatinem/rust-cache@v2
 
+    - name: Cache DuckDB Extensions
+      id: duckdb-extensions
+      uses: actions/cache@v4
+      with:
+        path: ~/.duckdb/extensions
+        key: duckdb-ext-${{ matrix.os }}-${{ hashFiles('Cargo.lock') }}
+
+    - name: Install DuckDB Extensions
+      if: steps.duckdb-extensions.outputs.cache-hit != 'true'
+      run: cargo test --all duckdb
+
     - name: Test
       run: cargo test --all
 

.github/workflows/release.yaml

@@ -8,9 +8,9 @@ on:
   workflow_dispatch:
     inputs:
       bump_type:
-        description: "Specify the type of version bump"
+        description: 'Specify the type of version bump'
         required: true
-        default: "patch"
+        default: 'patch'
         type: choice
         options:
           - patch
@@ -46,7 +46,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: "3.10"
+          python-version: '3.10'
 
       - name: Install Commitizen
         run: |
@@ -108,17 +108,19 @@ jobs:
 
           cargo update || true
 
+          sed -i "s|image: 'darkalex17/coyote:v[^']*'|image: 'darkalex17/coyote:v${VERSION}'|" assets/sbx-kit/spec.yaml
+
           # Git config that helps in Act
           git config user.name  "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
           git status --porcelain
-          git diff --name-only -- Cargo.toml Cargo.lock || true
+          git diff --name-only -- Cargo.toml Cargo.lock assets/sbx-kit/spec.yaml || true
 
-          if ! git diff --quiet -- Cargo.toml Cargo.lock; then
-            git add -u -- Cargo.toml Cargo.lock
-            git commit -m "chore: bump Cargo.toml to $VERSION"
+          if ! git diff --quiet -- Cargo.toml Cargo.lock assets/sbx-kit/spec.yaml; then
+            git add -u -- Cargo.toml Cargo.lock assets/sbx-kit/spec.yaml
+            git commit -m "chore: bump Cargo.toml and sandbox image to $VERSION"
           else
             echo "No changes to commit (already at $VERSION)"
           fi
@@ -163,28 +165,31 @@ jobs:
           - target: aarch64-unknown-linux-musl
             os: ubuntu-latest
             use-cross: true
-            cargo-flags: ""
+            cargo-flags: ''
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-24.04-arm
+            cargo-flags: ''
           - target: aarch64-apple-darwin
             os: macos-latest
             use-cross: true
-            cargo-flags: ""
+            cargo-flags: ''
           - target: aarch64-pc-windows-msvc
             os: windows-latest
             use-cross: true
-            cargo-flags: ""
+            cargo-flags: ''
           - target: x86_64-apple-darwin
             os: macos-latest
-            cargo-flags: ""
+            cargo-flags: ''
           - target: x86_64-pc-windows-msvc
             os: windows-latest
-            cargo-flags: ""
+            cargo-flags: ''
           - target: x86_64-unknown-linux-musl
             os: ubuntu-latest
             use-cross: true
-            cargo-flags: ""
+            cargo-flags: ''
           - target: x86_64-unknown-linux-gnu
             os: ubuntu-latest
-            cargo-flags: ""
+            cargo-flags: ''
 
     steps:
       - name: Check if actor is repository owner
@@ -251,7 +256,7 @@ jobs:
         run: echo "BUILD_CMD=cross" >> $GITHUB_ENV
 
       - name: Install latest LLVM/Clang
-        if: matrix.os == 'ubuntu-latest'
+        if: startsWith(matrix.os, 'ubuntu')
         run: |
           wget https://apt.llvm.org/llvm.sh
           chmod +x llvm.sh
@@ -338,7 +343,7 @@ jobs:
             ${{ steps.package.outputs.archive }} 
             ${{ steps.package.outputs.sha }}
           tag_name: v${{ env.RELEASE_VERSION }}
-          name: "v${{ env.RELEASE_VERSION }}"
+          name: 'v${{ env.RELEASE_VERSION }}'
           body_path: artifacts/changelog.md
           prerelease: false
 
@@ -455,4 +460,64 @@ jobs:
       - uses: katyo/publish-crates@v2
         if: env.ACT != 'true'
         with:
-          registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+  publish-sandbox-image:
+    needs: [publish-github-release]
+    name: Publish Sandbox Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if actor is repository owner
+        if: ${{ github.actor != github.repository_owner && env.ACT != 'true' }}
+        run: |
+          echo "You are not authorized to run this workflow."
+          exit 1
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Ensure repository is up-to-date
+        if: env.ACT != 'true'
+        run: |
+          git fetch --all
+          git pull
+
+      - name: Get release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Set version variable
+        run: |
+          version="$(cat artifacts/release-version)"
+          echo "version=$version" >> $GITHUB_ENV
+
+      - name: Validate release environment variables
+        run: |
+          echo "Release version: ${{ env.version }}"
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        if: env.ACT != 'true'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Push to Docker Hub
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ env.ACT != 'true' }}
+          tags: darkalex17/coyote:latest, darkalex17/coyote:v${{ env.version }}
+          build-args: COYOTE_VERSION=${{ env.version }}

.gitignore

@@ -5,3 +5,7 @@
 .idea/
 /coyote.iml
 /.idea/
+.coyote/**
+.sisyphus/**
+.coyote-project.json
+.coyote/memory/

.sisyphus/plans/graph-rag-spec.md

@@ -1,371 +0,0 @@
-# Graph RAG Design Spec
-
-## Status: COMPLETE
-
-### Verified From Code (all claims backed by actual file reads)
-
----
-
-## Goal
-
-Extend the existing two-signal hybrid search (vector HNSW + BM25 → RRF) to a three-signal hybrid
-(vector + BM25 + knowledge graph → RRF). The graph captures entity/relationship knowledge extracted
-from documents at ingestion time via an LLM call per chunk. At query time, graph traversal expands
-context beyond semantic similarity.
-
----
-
-## Verified Current Architecture
-
-### `Rag` struct (`src/rag/mod.rs:48`)
-```rust
-pub struct Rag {
-    app_config: Arc<AppConfig>,
-    name: String,
-    path: String,
-    embedding_model: Model,
-    hnsw: Hnsw<'static, f32, DistCosine>,  // ephemeral, rebuilt on load
-    bm25: SearchEngine<DocumentId>,          // ephemeral, rebuilt on load
-    data: RagData,                           // serialized to YAML
-    last_sources: RwLock<Option<String>>,
-}
-```
-
-### `RagData` struct (`src/rag/mod.rs:892`)
-```rust
-pub struct RagData {
-    pub embedding_model: String,
-    pub chunk_size: usize,
-    pub chunk_overlap: usize,
-    pub reranker_model: Option<String>,
-    pub top_k: usize,
-    pub batch_size: Option<usize>,
-    pub next_file_id: FileId,
-    pub document_paths: Vec<String>,
-    pub files: IndexMap<FileId, RagFile>,
-    #[serde(with = "serde_vectors")]
-    pub vectors: IndexMap<DocumentId, Vec<f32>>,
-}
-```
-
-### `RagData::new` callers (both need updating):
-1. `Rag::init` (`src/rag/mod.rs:219`) — interactive init path
-2. `Rag::resolve_init_data` (`src/rag/mod.rs:195`) — config-driven init path
-
-### `Rag::create` (`src/rag/mod.rs:253`) — all init paths converge here:
-```rust
-pub fn create(app: &AppConfig, name: &str, path: &Path, data: RagData) -> Result<Self> {
-    let hnsw = data.build_hnsw();
-    let bm25 = data.build_bm25();
-    let embedding_model = Model::retrieve_model(app, &data.embedding_model, ModelType::Embedding)?;
-    let rag = Rag { app_config: Arc::new(app.clone()), name: name.to_string(),
-                    path: path.display().to_string(), data, embedding_model, hnsw, bm25,
-                    last_sources: RwLock::new(None) };
-    Ok(rag)
-}
-```
-
-### `hybrid_search` (`src/rag/mod.rs:710`)
-```rust
-async fn hybrid_search(&self, query: &str, top_k: usize, rerank_model: Option<&str>)
-    -> Result<Vec<(DocumentId, String)>>
-```
-Runs `vector_search` + `keyword_search` in parallel via `tokio::join!`, then either reranks or
-applies `reciprocal_rank_fusion(vec![vector_ids, keyword_ids], vec![1.125, 1.0], top_k)`.
-
-### `reciprocal_rank_fusion` (`src/rag/mod.rs:1186`) — standalone fn, already weight-parameterized:
-```rust
-fn reciprocal_rank_fusion(
-    list_of_document_ids: Vec<Vec<DocumentId>>,
-    list_of_weights: Vec<f32>,
-    top_k: usize,
-) -> Vec<DocumentId>
-```
-
-### `RagData::del` (`src/rag/mod.rs:953`):
-```rust
-pub fn del(&mut self, file_ids: Vec<FileId>) {
-    for file_id in file_ids {
-        if let Some(file) = self.files.swap_remove(&file_id) {
-            for (document_index, _) in file.documents.iter().enumerate() {
-                let document_id = DocumentId::new(file_id, document_index);
-                self.vectors.swap_remove(&document_id);
-            }
-        }
-    }
-}
-```
-
-### `RagNode` (`src/graph/types.rs:331`):
-```rust
-pub struct RagNode {
-    pub documents: Vec<String>,
-    pub query: Option<String>,
-    pub top_k: Option<usize>,
-    pub embedding_model: Option<String>,
-    pub chunk_size: Option<usize>,
-    pub chunk_overlap: Option<usize>,
-    pub reranker_model: Option<String>,
-    pub batch_size: Option<usize>,
-    pub state_updates: Option<HashMap<String, String>>,
-    pub timeout: Option<u64>,
-}
-```
-
-### `Client` trait (`src/client/common.rs:40`):
-- `async fn chat_completions(&self, input: Input) -> Result<ChatCompletionsOutput>` — needs `Input`
-- `async fn chat_completions_inner(&self, client: &ReqwestClient, data: ChatCompletionsData) -> Result<ChatCompletionsOutput>` — accessible on `Box<dyn Client>` via vtable
-- `async fn embeddings(&self, data: &EmbeddingsData) -> Result<Vec<Vec<f32>>>`
-- `async fn rerank(&self, data: &RerankData) -> Result<RerankOutput>`
-- `fn build_client(&self) -> Result<ReqwestClient>`
-- `fn model(&self) -> &Model`
-
-**Key finding**: `Input` cannot be constructed without `RequestContext` (which `Rag` doesn't have).
-Instead, `extract_entities` uses `chat_completions_inner` directly with manually built
-`ChatCompletionsData`. This is accessible via `Box<dyn Client>`.
-
-### `Message` (`src/client/message.rs:22`):
-```rust
-pub fn new(role: MessageRole, content: MessageContent) -> Self
-```
-`MessageRole::User`, `MessageContent::Text(String)` — both confirmed.
-
-### `AppConfig` RAG fields (`src/config/app_config.rs:71`):
-```rust
-pub rag_embedding_model: Option<String>,
-pub rag_reranker_model: Option<String>,
-pub rag_top_k: usize,        // default: 5
-pub rag_chunk_size: Option<usize>,
-pub rag_chunk_overlap: Option<usize>,
-pub rag_template: Option<String>,
-```
-
-### `patch_messages` — confirmed exported from `crate::client::*` (used in `input.rs:5`)
-
-### `init_client(app_config, model)` — works for any `ModelType`, including `Chat`
-
-### `ModelType` variants: `Chat`, `Embedding`, `Reranker` (confirmed in `model.rs`)
-
-### petgraph serde: `NodeIndex` serializes as inner `u32`; `StableGraph` preserves index positions
-through roundtrip. `IndexMap<DocumentId, Vec<NodeIndex>>` safe for YAML (DocumentId is newtype over
-usize, serializes as integer key).
-
----
-
-## New Dependency
-
-```toml
-petgraph = { version = "0.7", features = ["serde-1"] }
-```
-
----
-
-## New File: `src/rag/graph.rs`
-
-All graph types and extraction logic. Module declared in `mod.rs` as `mod graph; use self::graph::*;`.
-
-### Types:
-- `Entity { name: String, entity_type: String, description: Option<String> }`
-- `Relationship { relation_type: String, weight: f32 }`
-- `ExtractionResult { entities: Vec<ExtractedEntity>, relationships: Vec<ExtractedRelationship> }`
-- `ExtractedEntity { name: String, r#type: String, description: Option<String> }`
-- `ExtractedRelationship { from: String, to: String, r#type: String, weight: Option<f32> }`
-- `KnowledgeGraph { graph: StableGraph<Entity, Relationship>, entity_index: IndexMap<String, NodeIndex>, document_entities: IndexMap<DocumentId, Vec<NodeIndex>> }`
-
-### Key methods on `KnowledgeGraph`:
-- `merge(doc_id: DocumentId, result: ExtractionResult)` — merges extraction into graph
-- `remove_documents(ids: &[DocumentId])` — removes entities exclusive to deleted documents
-- `build_node_to_docs(&self) -> IndexMap<NodeIndex, Vec<DocumentId>>` — ephemeral reverse map
-
-### `extract_entities(client: &dyn Client, chunk: &str) -> Result<ExtractionResult>`:
-- Builds `ChatCompletionsData` manually (no `Input` needed)
-- Calls `patch_messages` then `client.chat_completions_inner(&reqwest_client, data).await`
-- Strips markdown code fences from response before JSON parse
-- Temperature: `Some(0.0)` for deterministic extraction
-
-### Extraction prompt: structured JSON output requesting entities + relationships
-
----
-
-## Changes to `src/rag/mod.rs`
-
-### `Rag` struct — add one ephemeral field:
-```rust
-node_to_docs: IndexMap<NodeIndex, Vec<DocumentId>>,  // ephemeral, rebuilt on load
-```
-
-### `Rag::create` — build node_to_docs before moving data:
-```rust
-let node_to_docs = data.knowledge_graph.build_node_to_docs();
-// then add to struct literal
-```
-
-### `Rag` Clone impl — add:
-```rust
-node_to_docs: self.data.knowledge_graph.build_node_to_docs(),
-```
-
-### `RagData` struct — three new fields (all `#[serde(default)]` for backward compat):
-```rust
-#[serde(default)]
-pub graph_enabled: bool,
-#[serde(default, skip_serializing_if = "Option::is_none")]
-pub extractor_model: Option<String>,
-#[serde(default)]
-pub knowledge_graph: KnowledgeGraph,
-```
-
-### `RagData::new` — two new params: `graph_enabled: bool, extractor_model: Option<String>`
-
-### `RagData::del` — collect doc_ids during existing loop, call `remove_documents` at end:
-```rust
-let mut doc_ids_to_remove = vec![];
-for file_id in file_ids {
-    if let Some(file) = self.files.swap_remove(&file_id) {
-        for (document_index, _) in file.documents.iter().enumerate() {
-            let document_id = DocumentId::new(file_id, document_index);
-            self.vectors.swap_remove(&document_id);
-            doc_ids_to_remove.push(document_id);
-        }
-    }
-}
-self.knowledge_graph.remove_documents(&doc_ids_to_remove);
-```
-
-### `Rag::init` (line 219) — add two params to `RagData::new`:
-```rust
-app.rag_graph_enabled,
-app.rag_extractor_model.clone(),
-```
-
-### `resolve_init_data` — resolve from config+app, pass to `RagData::new`:
-```rust
-let graph_enabled = config.graph_enabled.unwrap_or(app.rag_graph_enabled);
-let extractor_model = config.extractor_model.clone().or_else(|| app.rag_extractor_model.clone());
-```
-
-### `sync_documents` — entity extraction block after `rag_files` built, before embedding:
-```rust
-if self.data.graph_enabled {
-    if let Some(extractor_model_id) = self.data.extractor_model.clone() {
-        let model = Model::retrieve_model(&self.app_config, &extractor_model_id, ModelType::Chat)?;
-        let client = self.create_embeddings_client(model)?;
-        let total_chunks: usize = rag_files.iter().map(|f| f.documents.len()).sum();
-        let mut chunk_num = 0;
-        let file_offset = next_file_id;
-        for (batch_file_idx, rag_file) in rag_files.iter().enumerate() {
-            let file_id = file_offset + batch_file_idx;
-            for (doc_idx, doc) in rag_file.documents.iter().enumerate() {
-                chunk_num += 1;
-                progress(&spinner, format!("Extracting entities [{chunk_num}/{total_chunks}]"));
-                let doc_id = DocumentId::new(file_id, doc_idx);
-                match extract_entities(client.as_ref(), &doc.page_content).await {
-                    Ok(result) => self.data.knowledge_graph.merge(doc_id, result),
-                    Err(e) => debug!("Entity extraction failed for {doc_id:?}: {e}"),
-                }
-            }
-        }
-    }
-}
-```
-
-### After line 705 (after hnsw/bm25 rebuild in sync_documents):
-```rust
-self.node_to_docs = self.data.knowledge_graph.build_node_to_docs();
-```
-
-### `hybrid_search` — add third signal:
-```rust
-let graph_search_ids: Vec<DocumentId> = if self.data.graph_enabled
-    && !self.data.knowledge_graph.entity_index.is_empty()
-{
-    self.graph_search(query, &keyword_search_ids, top_k)
-} else {
-    vec![]
-};
-// RRF: extend to 3-way when graph has results, fall back to 2-way otherwise
-```
-
-### New `graph_search` method (sync):
-```rust
-fn graph_search(&self, query: &str, bm25_anchor_ids: &[DocumentId], top_k: usize) -> Vec<DocumentId>
-```
-Phase 1: entity names from query via substring match in `entity_index`.
-Phase 2: fallback — entities from top BM25 document chunks.
-Phase 3: expand 1-hop neighbors in `StableGraph`.
-Phase 4: score docs by entity overlap ratio, return top_k.
-
-### `RagInitConfig` — two new fields:
-```rust
-pub graph_enabled: Option<bool>,
-pub extractor_model: Option<String>,
-```
-
----
-
-## Changes to `src/config/app_config.rs`
-
-New fields alongside existing `rag_*` block:
-```rust
-pub rag_graph_enabled: bool,            // default: false
-pub rag_extractor_model: Option<String>, // default: None
-```
-Defaults, env var overrides, and propagation all follow the same pattern as existing `rag_*` fields.
-
----
-
-## Changes to `src/graph/types.rs` — `RagNode`
-
-```rust
-#[serde(default, skip_serializing_if = "Option::is_none")]
-pub graph_enabled: Option<bool>,
-#[serde(default, skip_serializing_if = "Option::is_none")]
-pub extractor_model: Option<String>,
-```
-
----
-
-## Changes to `src/config/agent.rs`
-
-Pass new fields through to `RagInitConfig`:
-```rust
-graph_enabled: rag_node.graph_enabled,
-extractor_model: rag_node.extractor_model.clone(),
-```
-
----
-
-## Backward Compatibility
-
-- All new `RagData` fields have `#[serde(default)]` — old YAML files load without migration
-- `graph_enabled` defaults `false` — existing RAG instances unchanged
-- `graph_search_ids` empty → 2-way RRF runs (identical to current behavior)
-- `node_to_docs` rebuild on `create()` is O(n) over empty map for old instances
-
----
-
-## V1 Scope Exclusions
-
-- LLM entity extraction from query at search time (V1 uses substring match + BM25 anchoring)
-- Multi-hop traversal (field reserved, 1-hop only in V1)
-- Entity embeddings / fuzzy entity lookup
-- Bincode for large-corpus graph storage
-- Gleaning / multi-pass extraction
-
----
-
-## Implementation Progress
-
-- [x] Cargo.toml — petgraph dependency
-- [x] src/rag/graph.rs — new file
-- [x] src/rag/mod.rs — mod/use, Rag struct, create, clone
-- [x] src/rag/mod.rs — RagData fields, new, del
-- [x] src/rag/mod.rs — Rag::init, resolve_init_data
-- [x] src/rag/mod.rs — sync_documents extraction block
-- [x] src/rag/mod.rs — hybrid_search + graph_search
-- [x] src/rag/mod.rs — RagInitConfig fields
-- [x] src/config/app_config.rs — new fields
-- [x] src/config/mod.rs — propagation
-- [x] src/graph/types.rs — RagNode fields
-- [x] src/config/agent.rs — propagation
-- [x] cargo check — clean (0 warnings, 1065 tests passing)

CHANGELOG.md

@@ -1,3 +1,390 @@
+## v0.10.0 (2026-08-29)
+
+### BREAKING CHANGE
+
+- invocations using --prompt <text> must switch to
+--temp-role <text>; clap rejects the old flag loudly.
+
+### Feat
+
+- Support Linux ARM64 GNU
+- Note that duckdb RAG driver is unavailable on MUSL Linux builds when initializing a RAG so users know when using the binary, not just based on docs
+- updated coyote installation scripts to detect when gnu is installable
+- upgraded to v2 mixin schema
+- improved first-time run experience and included a templated configuration file that now has comments like the config.example.yaml so users don't have to go to the repo to see all the knobs
+- **TASK-005**: carry the quality bar through sisyphus and architect
+- **TASK-004**: reviewer routing — code-reviewer quality-bar resolution, domain linter pass, surface-skill routing, rigor folding; file-reviewer surface-skill whitelist + convention/correctness marker
+- **TASK-003**: add surface skills batch B — worker-review, iac-review, migration-review, cicd-review
+- **TASK-002**: add surface skills batch A — rest-api-review, cli-review, library-review
+- **TASK-001**: add rigor/surfaces declaration layer to planning skills
+- **repl**: color .info mcp-server verdicts and complete only running servers
+- **cli**: rename mcp_config asset category to mcp-config with snake_case alias
+- create a new probe agent to probe code verifications using usage-pattern testing
+- Add in the web_search_coyote tool where helpful
+- **mcp**: add .info mcp-server, .set mcp_tools, and filtered-server listing to the REPL
+- **mcp**: enforce per-server tool allowlists across runtime, jobs, agents, and graph nodes
+- **mcp**: add mcp_tools allowlist config surfaces across roles, sessions, agents, graphs, and skills
+- **mcp**: add per-server tool allowlist policy module and allowedTools config field
+- support mcp.json in the root of bundle repos as well as in the legacy functions directory
+- prefer ~/.config/coyote/mcp.json for the user-scope MCP config
+- claude and openai native web search via web_search_coyote
+- **jobs**: node-local job ownership and capability-gated job__* visibility
+- **graph**: support max_concurrent_jobs at the graph level
+- **jobs**: allow uncapped collect via full_result
+- **jobs**: exempt polling tools from loop tracker and hint on unchanged checks
+- **supervisor**: push agent completion notifications to the spawning context
+- **jobs**: push background-job completion notifications via per-context queue
+- inject background-jobs prompt guidance when jobs are enabled
+- add background job runner, job__* handlers, and start gates
+- generalize supervisor registry to TaskHandle enum with job scaffolding, kill discipline, and max_concurrent_jobs config
+- run an advisory observability pass after implementation in sisyphus
+- add an observability-review skill for post-implementation monitoring analysis
+- check under- and over-logging in the code review gate
+- calibrate logging registers in the code-writing agents
+- add a logging-discipline skill for calibrating log output to repo conventions
+- **cli**: rename --prompt to --temp-role
+- complete --filter and --force on the first .install argument
+- **mcp**: bound tool-result passthrough and surface resource audience annotations
+- **mcp**: add mcp_prompt meta-tool and harden prompt display rendering
+- **repl**: add .prompt command with live staged tab-completion
+- **mcp**: add mcp_read meta-tool for resource reads
+- **mcp**: gate meta-function emission on advertised server capabilities
+- **mcp**: add render.rs content policy (text paging, pattern filter, blob spill)
+- **mcp**: extend the server catalog to resources, templates, and prompts
+- complete --filter and --force on the first .install argument
+- run design interviews as grilling frontier rounds across the planning agents
+- add a grilling skill for frontier-round design interviews
+- add an on-demand architecture-reviewer agent for deepening scans
+- add a codebase-design skill with the deep-module design vocabulary
+- add a feedback-loop-first diagnosing-bugs skill to the coding suite
+- add a Fowler code-smell baseline to the code-review skill
+- flag duplicate helpers in code reviews with a repo-wide DRY check
+- add a transactional-integrity review skill to the code review gate
+- add an operational-history prior-art lane to the code-reviewer agent
+- support name=value macro arguments with variable tab completion
+- add --help guides to the .install and .uninstall REPL commands
+- expand owner/repo shorthand for --install with a --git-host flag
+- remove the deprecated --install-from flag and .install remote form
+- rename install flags and unify .install dispatch
+- add --uninstall and .uninstall for installed bundles
+- add --update-bundle with provenance-aware conflict handling
+- add --list-bundles and .list bundles with drift detection
+- record bundle provenance when installing from remote repos
+- add bundle provenance store
+- parse bundle manifests and capture resolved SHAs for remote installs
+- created a new comment-discipline skill for the built in sisyphus suite
+- created a dedicated git_command tool to tighten tool calling permissions in the git-master skill
+- Added a new security review step to the code writing quality gates
+- addressed review comments
+- add --no-workspace-macros opt-out for workspace macro loading
+- execute non-isolated macros on the live REPL context
+- surface macros as first-class custom commands in the REPL
+- add lazy macro resolver with two-dir discovery and per-macro states
+- add enabled_macros config field at global, role, agent, and session levels
+- add description and isolated fields to Macro struct
+- Dynamically detect RAG embedding model dimension for any given model
+- Support auto confirmation for gatekeeper agents
+- retry LLM API calls once after 401 by force-refreshing the OAuth token
+- identity-aware rejected-token marker for LLM OAuth cache
+- typed ApiStatusError carrying HTTP status through LLM client errors
+- per-request OAuth token injection with mid-session refresh for HTTP MCP servers
+- reason-specific warnings for MCP servers that fail OAuth at startup
+- Installed duckdb into the coyote image
+- Support managing MCP servers from the CLI directly
+- append new built-in rag__query function to RAG contexts to allow further querying by LLMs
+- support static file bundling with sbx-mixins
+- **rag**: offer the storage driver when an agent initializes its RAG
+- simplified the duckdb selection prompt
+- **rag**: let several Coyote processes query one duckdb RAG at once
+- **rag**: support string and UUID Qdrant point IDs
+- **rag**: create the API key secret inline in the attach wizard
+- let workflow rag nodes select a RAG driver
+- improved wording and heuristic detection for sisyphus suite of agents
+- upgraded to sbx kit v2 spec for improved integration
+- **rag**: add attach-only Qdrant provider, attach wizard and sandbox wiring
+- **rag**: add DuckDB provider behind the RAG driver abstraction
+- **rag**: add driver/attached fields, validation floors and force-reingest
+- **mcp**: send RFC 8707 resource indicator in OAuth flows
+- Added loaded indicators to .list tools/mcp-servers/skills
+- hide .recover from tab completions when no session is active
+- add a new .recover command for sessions to recover from errors
+- integrated the git-ssh-sign kit into the coyote sandbox kit
+
+### Fix
+
+- Harden install scripts: detect libssl3 without ldconfig on PATH, survive noexec tmp dirs, and guard against partial curl|bash execution
+- ldconfig on Debian-based distros lives in /usr/sbin
+- Prefer GNU linux builds in install scripts for duckdb support, and gate duckdb support on linux hosts that are MUSL until MUSL support is added
+- **mcp**: omit declared-but-empty prompt/resource capabilities from .info mcp-server
+- **mcp**: annotate declared-but-empty prompt/resource capabilities in .info mcp-server
+- also support the .continue edge case for session crashing checkpointing
+- checkpoint sessions that crash for easy resuming
+- job__check ring buffer also collects file output for LLM_OUTPUT as well as stdout
+- **tools**: interactive-shell semantics and stderr capture in execute_command
+- **function**: gate test-only declaration appender behind cfg(test)
+- **graph**: gate unix-only test imports behind cfg(unix)
+- harden job runner lifecycle and whitelist conformance
+- **function**: floor tool-output truncation cut to a UTF-8 char boundary
+- **supervisor**: make agent__check a pure status probe that never consumes the handle
+- **supervisor**: surface finished-but-uncollected tasks in turn-end guardrail
+- fix grep "binary" errors when searching UTF-8 files with unicode characters like some of the Coyote source
+- **bundles**: harden the install pipeline for cross-platform correctness
+- **mcp**: harden the spill path for cross-platform correctness
+- **repl**: offer prompts in .list tab completion and rename its listing helpers
+- **mcp**: gate unix-only spill permission APIs for windows builds
+- harden the bundle lifecycle per code review
+- address code review findings on the bundle lifecycle
+- reserve category names, confirm fork-name collisions, report secrets on uninstall
+- make bundle provenance portable to Windows
+- user__ask should have been renamed to user__select in graph agent user interaction invocations
+- support tab completions for graph-based agents with variables as well as standard agents
+- surface macro parse errors on top-level invocation
+- render .list macros as a comfy-table instead of fixed-width columns
+- drain crossterm characters in zellij in kitty contexts to prevent DA1 responses from entering prompt
+- drain tty input when displaying inquire prompts to prevent unintentional escapes
+- breaking iwe MCP server changes with newest version
+- improved handling of non service-specific secrets using sbx custom-secrets
+- include tool output to LLM_OUTPUT in errors as well as stderr
+- prevent tmp-overwriting
+- Corrected a rare edge case on how tool files are generated during parallel executions
+- cosmetic fix after improved bash tool handling
+- Improved subagent escalation handling
+- latent parsing bugs in fs_patch and argc
+- Prevent infinite hangs in coder agent and implement timeouts for LLM API calls and interactive tools
+- allow nested italics inside bold spans in markdown renderer
+- properly handle OAuth refreshes
+- correct newline removal from fs_write and fs_patch
+- detect duplicate tool call IDs client-side before sending to Claude
+- **rag**: warn when a duckdb store is empty but files are indexed
+- **rag**: keep a local Qdrant off an ambient proxy
+- keep loopback and LAN traffic off an ambient proxy
+- **rag**: stop routing Qdrant requests through an ambient proxy
+- **rag**: treat a zero min_score as no floor on Qdrant searches
+- **rag**: address Copilot review findings on the driver abstraction
+- **rag**: delete the DuckDB write-ahead log alongside the store
+- **sandbox**: discover agent-scoped RAG mixin sidecars
+- **rag**: stop the attach wizard from silently accepting an empty collection
+- **rag**: fail loudly when a RAG's vault secret is missing
+- **rag**: serialize DuckDB extension installs to stop a Windows race
+- **rag**: emit an sbx kit v2 mixin and declare RAG credentials to the proxy
+- **rag**: install DuckDB vss and fts extensions when they are missing
+- don't output thinking blocks for claude-based models
+- additional edge case fix for duplicate tool call IDs in anthropic API calls
+- removed temperature modifier in librarian agent to mitigate invisible errors
+- strip reasoning blocks for structured LLM output in graph agents
+- prevent rare duplicate tool call IDs in long running claude prompts
+- agents inherit global reasoning effort if unset
+
+### Refactor
+
+- **function**: finish supervisor-to-agent vocabulary migration
+- **function**: rename agent-tool symbols out of supervisor vocabulary
+- Modified the naming of several generalized supervisor values
+- pulled out some imports to clean up the MCP render module a bit
+- **mcp**: centralize meta-function prefix predicates and fix list_tools pagination
+- Refactored some bundle const locations
+- drop the .install remote migration hint
+- drop the --install-from tombstone entirely
+- render .list agents and .list skills as comfy-tables
+- **rag**: discover driver_config secrets by grammar, not field name
+- **rag**: drop the hardcoded embedding model hint from attach
+- **rag**: interpolate every driver_config value, not just api_key
+- **rag**: extract RagProvider trait and add YamlProvider
+
+## v0.8.3 (2026-08-03)
+
+### Fix
+
+- infinite loop bug when attempting to interrupt a prompt exchange right before a session compression
+- ctrl-c inside of an auto-continue loop created an infinite loop
+
+## v0.8.2 (2026-07-31)
+
+### Fix
+
+- sbx update doesn't allow undefined fields in sbx spec
+
+## v0.8.1 (2026-07-30)
+
+### Feat
+
+- ctrl-c interrupts ongoing prompt in a session, but lets the user inject more instructions mid-stream
+- improved function calling performance by allowing parallel tool calling
+- created the architect and gatekeeper agents for dramatically improved coding performance
+- Improved readability of session message exchange replays
+- apply --agent/--role/--rag/--model flags in --acp-server mode
+- add headless profile to sbx-kit spec
+- implement ACP user-interaction to request_permission bridge
+- implement ACP session/load and session/cancel
+- implement ACP session/prompt
+- add ACP server skeleton with stdout-purity test
+- add --headless flag for unattended operation
+
+### Fix
+
+- ctrl-c interruption doesn't discard session messages when throbber is showing
+- improper handling of fd-style globbing for directories in fs_glob
+- properly templated architect design doc path in starter commands
+- .copy works when sessions are resumed
+- ACP session/prompt now drives the full tool-execution loop
+- ACP spec conformance — ContentBlock prompt params and protocolVersion type
+- restore stdout output for standalone --headless mode
+- suppress tool-call display in headless mode; initialize session on session/new
+- skip stdin drain and set silent render mode when --acp-server is active
+- include graph-agent descriptions in .agent <TAB> completions
+
+### Refactor
+
+- move ACP server dispatch into run() for shared flag setup
+
+## v0.8.0 (2026-07-25)
+
+### Feat
+
+- Dynamically detect if a selected client in the sandbox first run wizard supports oauth
+- Add support for the --fresh flag again with host environment configuration injection
+- force overwrite global sbx secrets
+- add sbx secrets globally
+- only create secrets local to a sandbox
+- Improved credentials management for docker sandboxes
+- renamed --contents arg for fs_write/patch to --content since most models attempt that first and error otherwise
+- Used improved theme selections for tool call highlighting colors
+- Improved theme-derived syntax highlighting for LLM tool call logging
+- Improved coloring of LLM tool invocation outputs to make LLM output more readable and cohesive
+- renamed the user__ask to user__select and improved descriptions to improve model usage
+- Improved coloring/highlighting of tool calls to make LLM invocation logs easier to read
+- long-running session improvements
+- Made sisyphus suite of agents all auto-approved for tool usage
+- added ast_grep tool to Sisyphus suite agents
+- created the adversay agent and adversarial-review skill
+- new spawnable_agents field in agents to let users restrict what agents can be spawned by a parent agent
+- replay pre-compressed messages as well when resuming sessions for users to see
+- created a new builtin function for agents who can spawn other agents to list available agents via agent__list_available
+- **render**: hanging-indent line wrapping for lists and blockquotes
+- **render**: wire table state machine and finalize hook
+- **render**: render markdown tables with comfy-table
+- **render**: parse table cells and column alignments
+- **render**: detect markdown table rows and separators
+- **render**: add comfy-table dependency and table border style
+- **render**: activate rich markdown renderer as default
+- **render**: rich block-level markdown rendering (headings, quotes, lists, hr)
+- **render**: rich inline markdown rendering (bold, italic, code, links)
+- **render**: detect markdown block-level line types
+- **render**: precompute markdown scope styles for rich rendering
+- Created the raw_markdown configuration flag
+- added a .fork command to fork a new session from a running conversation
+- **oauth**: enable browser-paste PKCE flow for OpenAI-compatible providers
+- copy host OAuth tokens into sandbox at launch
+- implement OAuth 2.0 Device Authorization Grant (RFC 8628)
+- hint that browser 'paste code' pages can be ignored during callback capture
+- openai-compatible wizard offers OAuth when provider has bundled oauth defaults
+- validate unique client names at config load
+- bundle xAI OAuth defaults in models.yaml
+- OAuth branch in openai_compatible prepare_* fns
+- get_oauth_provider_for_client dispatcher + client_config_info update
+- OpenAICompatibleOAuthProvider (config-driven OAuthProvider impl)
+- add auth + oauth fields to OpenAICompatibleConfig
+- add oauth field to ProviderModels
+- add client_credentials support to prepare_oauth_access_token
+- add OAuthConfig + OAuthFlow types to oauth.rs
+- Added reasoning effort to the right prompt
+- Improved support for Anthropic's extended thinking
+- Also support GEMINI.md workspace instructions
+- Improved workspace instructions support
+- also detect .mcp.json configurations at workspace roots
+- Created new .tool enable/disable and .mcp enable/disable aliases to make REPL usage more egonomic
+- Created a new .list <kind> REPL command to make discoveribility easier in the REPL
+- Support claude-style hidden workspace MCP configuration files via .mcp.json
+- Allow users to customize the workspace-specific configuration directory name so they can use Coyote with other CLI clients like .claude
+- Add reasoning_effort validation for the main configuration file
+- Add validation for reasoning_effort settings to prevent users from specifying erroneous values
+- Added support for modifying the reasoning effort of reasoning models
+- Explicitly Prevent .undo usage in graph agents
+- Added an .undo command to the REPL to let users have more control over the conversation
+- Improve sandbox startup time by using the prebuilt Coyote image
+- Make coyote available as a docker image
+- Made fs_patch more flexible for different model preferences of patch formats
+- Installed nano into the sandbox so that users can edit config files in the sandbox directly
+- Support workspace-local skill definitions and MCP configurations
+- fully functional graph-based RAG
+- Implemented graph-based RAG
+- Added a --dangerously-skip-permissions flag to skip permission prompts for tool invocations
+- Remove the temperature hyperparameter from the diagnose role
+- Added a new oauth.redirectHost field to make it possible to further extend MCP support
+- Updated the REPL mcp auth path to use the prettified error messaging
+- Improved error messaging for failed MCP starts because of auth issues
+- Added support for specifying the oauth port and client ID in MCP server configs
+- Implemented OAuth support for OpenAI models via Codex endpoints
+- merge MCP config when installing bundled mcp config
+- Implemented durable state for sisyphus
+- Installed ast-grep for the explore agent to use for better code exploration
+- Created the step-runner graph agent for more deterministic coding workflows to produce even more reliable and higher-quality results
+- Improved oracle and sisyphus agents with skill integrations for the new skills
+- Created new sisyphus family skills to improve performance
+- Created new diagnostic role and skill for use in other contexts
+- Added new memory functions for deleting and renaming memory files, as well as new lints for memory expiration dates and staleness of memories to improve the memory system
+- Created a new iwe skill and installed the iwe MCP server for utilizing large knowledgebases
+- Session-specific, file-backed history in the REPL
+- Replay session output when a user re-enters a session so all output can be seen again
+- Added confirmation message after MCP Oauth succeeds when invoked from --auth-mcp
+- Created the --auth-mcp CLI flag to let users auth with remote MCP servers without needing to be in the REPL
+- add OAuth authentication support for remote MCP servers
+- Added mixin for sisyphus so the ddg MCP server can search arbitrary domains
+- added improved error messaging on MCP server initialization
+- prefer musl versions for linux when running --update/.update
+
+### Fix
+
+- fresh wizard openai-compatible support
+- config existence check for --fresh sandboxes
+- Improve coyote sandbox startup time
+- bypass forgotten sandbox mode check for MCP secret interpolation
+- properly wrap sub-style changes in markdown rendering
+- removed accidental duplicate ast_grep tool in explore agent
+- npm and npx need the /usr/local/share/npm-global/lib directory to exist to run properly so I've added it to the dockerfile
+- added executable bit to adversary agent tools script
+- fetch descriptions from graph agent configs as well when listing agents
+- **render**: suppress blank lines above rendered table
+- chown the full sandbox cache dir, not just the coyote subdir
+- chown the whole coyote cache dir not just the oauth dir in the sandbox
+- fix typo in Gemini's generation_config property to use camelCase exclusively
+- **oauth**: treat missing expires_in as non-expiring device_code token
+- **oauth**: send Accept: application/json in device flow requests
+- OAuth callback listener skips speculative/malformed browser connections
+- resolve reasoning effort for the prompt for global defaults as well
+- Account for default model reasoning_effort when supplying that value for the REPL prompts
+- model narration included in history and between tool calls to prevent repetition
+- Don't terminate agent loops early for null tool output
+- reduce code duplication by reusing the new concrete_tool_names function in .list tools
+- Agent tools can only be modified via .tool enable/disable using tools in the allowed whitelist in the agent
+- re-render agent sessions when entering agents with either pre-configured agent_session or when entering an agent directly into a session
+- Per RFC 9728, enable dynamic discovery of OAuth endpoints in MCP using path-aware discovery
+- hot-attach to MCP servers that require auth after running .mcp auth <name>
+- Correctly inherit graph-global model for extractor model if none is defined
+- no cursor timeout when user scrolls away from ongoing streaming output
+- default to the nano or notepad when a configured editor is not found
+- When EDITOR, VISUAL, or config.editor is defined, don't verify via which
+- Added a loop exit condition for the diagnostics skill
+- Added directness clause to the diganose role to improve prompt
+- fs tools now output better error handling to guide the model more effectively
+- Make fs_read more tolerant of various arg invocation formats.
+- todo functions are injected properly to roles when roles have auto_continue: true and the REPL is started directly into the role
+- updated the redirect URI for OAuth MCP to use localhost since that's what is whitelisted, not 127.0.0.1
+- allow MCP OAuth refresh_token to be absent from initial token exchanges
+- Overrode the default JSON content-type for MCP OAuth so its properly application/x-www-form-urlencoded
+- typo in mcp file name
+- Added uvx wrapper for macos-based sandboxes
+
+### Refactor
+
+- Standardized paths module function names to not use 'path' in the name and to just always be either 'dir' or 'file'
+- main.rs resolve_oauth_client uses new dispatcher
+- split run_oauth_flow into pkce + client_credentials dispatchers
+
+### Perf
+
+- updated the memory injection warning so it only logs once, rather than after each keystroke
+
 ## v0.7.4 (2026-07-02)
 
 ### Feat

CREDITS.md

@@ -1,5 +1,16 @@
 # Credits
 
+## Matt Pocock's Skills
+
+The bundled `diagnosing-bugs`, `codebase-design`, and `grilling` skills, the
+`architecture-reviewer` agent, and the code smell baseline in the bundled
+`code-review` skill are adapted from
+[mattpocock/skills](https://github.com/mattpocock/skills) by Matt Pocock,
+licensed under the MIT License. The smell definitions trace back to Martin
+Fowler's *Refactoring* (ch. 3); the deep-module vocabulary builds on John
+Ousterhout's *A Philosophy of Software Design* and Michael Feathers'
+*Working Effectively with Legacy Code*.
+
 ## AIChat
 Coyote originally started as a fork of the fantastic
 [AIChat CLI](https://github.com/sigoden/aichat). The initial goal was simply
@@ -28,4 +39,13 @@ While Coyote has since diverged significantly and is now developed as an
 independent project, its early foundation and inspiration came from the
 AIChat project.
 
-AIChat is licensed under the MIT License.
+AIChat is licensed under the MIT License. The MIT license text and its
+copyright notice are preserved in the [LICENSE-MIT](./LICENSE-MIT) file.
+
+## Licensing
+
+Coyote as a whole is licensed under the GNU Affero General Public License
+v3.0 only (AGPL-3.0-only); see [LICENSE](./LICENSE). Substantial portions
+derived from AIChat remain under the MIT License (Copyright (c) sigoden),
+preserved in [LICENSE-MIT](./LICENSE-MIT). See [NOTICE](./NOTICE) for the
+combined-licensing summary.

Cargo.toml

@@ -1,15 +1,15 @@
 [package]
 name = "coyote-ai"
-version = "0.7.4"
+version = "0.10.0"
 edition = "2024"
 authors = ["Alex Clarke <alex.j.tusa@gmail.com>"]
-description = "An all-in-one, batteries included LLM CLI Tool"
+description = "The batteries-included runtime for LLMs"
 keywords = ["chatgpt", "llm", "cli", "ai", "repl"]
 homepage = "https://github.com/Dark-Alex-17/coyote"
 repository = "https://github.com/Dark-Alex-17/coyote"
 categories = ["command-line-utilities"]
 readme = "README.md"
-license = "MIT"
+license = "AGPL-3.0-only"
 rust-version = "1.95.0"
 exclude = [".github", "CONTRIBUTING.md"]
 
@@ -17,7 +17,9 @@ exclude = [".github", "CONTRIBUTING.md"]
 anyhow = "1.0.69"
 bytes = "1.4.0"
 clap = { version = "4.5.40", features = ["cargo", "derive", "wrap_help"] }
+comfy-table = { version = "7.1.4", features = ["custom_styling"] }
 dirs = "6.0.0"
+duckdb = { version = "1.10505.0", features = ["bundled"] }
 dunce = "1.0.5"
 futures-util = "0.3.29"
 inquire = "0.9.4"
@@ -49,7 +51,13 @@ textwrap = "0.16.0"
 ansi_colours = "1.2.2"
 eventsource-stream = "0.2.3"
 log = "0.4.28"
-log4rs = { version = "1.4.0", features = ["file_appender", "rolling_file_appender", "compound_policy", "fixed_window_roller", "size_trigger"] }
+log4rs = { version = "1.4.0", features = [
+  "file_appender",
+  "rolling_file_appender",
+  "compound_policy",
+  "fixed_window_roller",
+  "size_trigger",
+] }
 shell-words = "1.1.0"
 sha2 = "0.10.8"
 unicode-width = "0.2.0"
@@ -82,7 +90,7 @@ duct = "1.0.0"
 argc = "1.23.0"
 strum_macros = "0.27.2"
 indoc = "2.0.6"
-rmcp = { version = "1.5.0", features = [
+rmcp = { version = "3.1.2", features = [
   "client",
   "transport-child-process",
   "transport-streamable-http-client-reqwest",
@@ -107,17 +115,11 @@ self_update = { version = "0.44", default-features = false, features = [
   "archive-zip",
   "compression-zip-deflate",
 ] }
+qrcode = "0.14"
 
 [dependencies.reqwest]
 version = "0.13.3"
-features = [
-  "json",
-  "multipart",
-  "stream",
-  "form",
-  "socks",
-  "rustls",
-]
+features = ["json", "multipart", "stream", "form", "socks", "rustls"]
 default-features = false
 
 [dependencies.syntect]
@@ -136,8 +138,13 @@ arboard = { version = "3.3.0", default-features = false, features = [
 [target.'cfg(not(any(target_os = "linux", target_os = "android", target_os = "emscripten")))'.dependencies]
 arboard = { version = "3.3.0", default-features = false }
 
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
 [dev-dependencies]
+ctor = "1.0.13"
 pretty_assertions = "1.4.0"
+rmcp = { version = "3.1.2", features = ["server"] }
 serial_test = "3"
 
 [[bin]]

Dockerfile

@@ -0,0 +1,110 @@
+ARG COYOTE_VERSION
+FROM docker/sandbox-templates:shell-docker AS build
+
+ARG COYOTE_VERSION
+ARG TARGETARCH
+
+ENV PATH="/home/agent/.cargo/bin:/home/agent/.local/bin:${PATH}"
+
+USER root
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      jq curl git \
+      build-essential pkg-config \
+      cmake \
+      clang libclang-dev \
+      musl-tools \
+      libssl-dev \
+      pandoc \
+      bzip2 \
+      nano && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN set -euo pipefail; \
+    USQL_VERSION=0.21.4; \
+    case "${TARGETARCH}" in \
+      amd64) USQL_ARCH=amd64 ;; \
+      arm64) USQL_ARCH=arm64 ;; \
+      *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    TMPDIR=$(mktemp -d); \
+    curl -fsSL --retry 3 \
+      "https://github.com/xo/usql/releases/download/v${USQL_VERSION}/usql_static-${USQL_VERSION}-linux-${USQL_ARCH}.tar.bz2" \
+      -o "$TMPDIR/usql.tar.bz2"; \
+    tar -xjf "$TMPDIR/usql.tar.bz2" -C "$TMPDIR"; \
+    install -m 0755 "$TMPDIR/usql_static" /usr/local/bin/usql; \
+    rm -rf "$TMPDIR"
+
+RUN set -euo pipefail; \
+    DUCKDB_VERSION=1.5.5; \
+    case "${TARGETARCH}" in \
+      amd64) DUCKDB_ARCH=amd64 ;; \
+      arm64) DUCKDB_ARCH=arm64 ;; \
+      *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    TMPDIR=$(mktemp -d); \
+    curl -fsSL --retry 3 \
+      "https://github.com/duckdb/duckdb/releases/download/v${DUCKDB_VERSION}/duckdb_cli-linux-${DUCKDB_ARCH}.gz" \
+      -o "$TMPDIR/duckdb.gz"; \
+    gunzip "$TMPDIR/duckdb.gz"; \
+    install -m 0755 "$TMPDIR/duckdb" /usr/local/bin/duckdb; \
+    rm -rf "$TMPDIR"
+
+USER 1000
+
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
+    printf '#!/bin/sh\nexec uv tool run "$@"\n' > "$HOME/.local/bin/uvx" && \
+    chmod +x "$HOME/.local/bin/uvx"
+
+RUN mkdir -p /usr/local/share/npm-global/lib
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+      sh -s -- -y --default-toolchain stable --profile minimal && \
+    . "$HOME/.cargo/env" && \
+    cargo install --locked iwec && \
+    cargo install --locked ast-grep
+
+USER root
+
+RUN set -euo pipefail; \
+    case "${TARGETARCH}" in \
+      amd64) MUSL_TARGET=x86_64-unknown-linux-musl ;; \
+      arm64) MUSL_TARGET=aarch64-unknown-linux-musl ;; \
+      *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    TMPDIR=$(mktemp -d); \
+    curl -fsSL --retry 3 \
+      "https://github.com/Dark-Alex-17/coyote/releases/download/v${COYOTE_VERSION}/coyote-${MUSL_TARGET}.tar.gz" \
+      -o "$TMPDIR/coyote.tar.gz"; \
+    tar -xzf "$TMPDIR/coyote.tar.gz" -C "$TMPDIR"; \
+    install -m 0755 "$TMPDIR/coyote" /home/agent/.cargo/bin/coyote; \
+    chown 1000:1000 /home/agent/.cargo/bin/coyote; \
+    rm -rf "$TMPDIR"
+
+FROM scratch
+
+ARG COYOTE_VERSION
+
+COPY --from=build / /
+
+ENV PATH="/home/agent/.cargo/bin:/home/agent/.local/bin:/usr/local/share/npm-global/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
+    NPM_CONFIG_PREFIX="/usr/local/share/npm-global" \
+    NO_PROXY="localhost,127.0.0.1,::1,172.17.0.0/16" \
+    no_proxy="localhost,127.0.0.1,::1,172.17.0.0/16" \
+    BASH_ENV="/etc/sandbox-persistent.sh"
+
+LABEL com.docker.sandboxes="templates" \
+      com.docker.sandboxes.base="ubuntu:questing" \
+      com.docker.sandboxes.flavor="shell-docker" \
+      com.docker.sandboxes.start-docker="true" \
+      org.opencontainers.image.title="coyote" \
+      org.opencontainers.image.description="The batteries-included runtime for LLMs: Shell Assistant, CLI & REPL mode, RAG, AI tools & agents, MCP servers, skills, and macros." \
+      org.opencontainers.image.source="https://github.com/Dark-Alex-17/coyote" \
+      org.opencontainers.image.version="${COYOTE_VERSION}"
+
+WORKDIR /home/agent/workspace
+
+USER 1000
+
+ENTRYPOINT ["coyote"]

LICENSE

@@ -1,22 +1,661 @@
-The MIT License (MIT)
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
 
-Copyright (c) 2025 sigoden
-Copyright (c) 2025 Alexander J. Clarke
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+                            Preamble
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

LICENSE-MIT

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 sigoden
+Copyright (c) 2025 Alexander J. Clarke
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

NOTICE

@@ -0,0 +1,24 @@
+Coyote
+Copyright (c) 2025 Alexander J. Clarke
+
+This project as a whole is licensed under the GNU Affero General Public
+License, version 3.0 only (AGPL-3.0-only). The full text of that license is
+provided in the LICENSE file.
+
+--------------------------------------------------------------------------------
+Upstream / third-party notices
+--------------------------------------------------------------------------------
+
+Coyote began as a fork of AIChat (https://github.com/sigoden/aichat),
+Copyright (c) sigoden, which is distributed under the MIT License. Substantial
+portions of Coyote are derived from AIChat and remain available under the terms
+of the MIT License. The MIT License text and its required copyright and
+permission notices are preserved in the LICENSE-MIT file.
+
+As permitted by the MIT License, these portions have been incorporated into a
+larger work that is distributed under the AGPL-3.0-only license. When you
+receive Coyote as a combined work, your rights and obligations for the work as
+a whole are governed by the AGPL-3.0-only license; the MIT notice is retained
+to satisfy the attribution requirements of the MIT-licensed portions.
+
+See CREDITS.md for additional background and attribution.

README.md

@@ -1,17 +1,23 @@
-# Coyote: All-in-one, batteries-included LLM CLI Tool
+# Coyote: The batteries-included runtime for LLMs
 
 ![Test](https://github.com/Dark-Alex-17/coyote/actions/workflows/ci.yaml/badge.svg)
 [![crates.io link](https://img.shields.io/crates/v/coyote-ai.svg)](https://crates.io/crates/coyote-ai)
 ![Release](https://img.shields.io/github/v/release/Dark-Alex-17/coyote?color=%23c694ff)
 ![Crate.io downloads](https://img.shields.io/crates/d/coyote-ai?label=Crate%20downloads)
 [![GitHub Downloads](https://img.shields.io/github/downloads/Dark-Alex-17/coyote/total.svg?label=GitHub%20downloads)](https://github.com/Dark-Alex-17/coyote/releases)
+![Docker pulls](https://img.shields.io/docker/pulls/darkalex17/coyote?label=Docker%20downloads)
+[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](https://github.com/Dark-Alex-17/coyote/blob/main/LICENSE)
 
-Coyote is an all-in-one, batteries-included, LLM CLI tool featuring Shell Assistant, CLI & REPL Mode, RAG, AI Tools & 
-Agents, and More.
+Coyote is an **all-in-one, batteries-included LLM runtime** for building, running, and interacting with AI from your terminal.
+It brings together a Shell Assistant, CLI & REPL modes, RAG, tools, agents, MCP, skills, sandboxes, multi-agent workflows, and
+more in a single runtime.
+
+Coyote comes ready to use with built-in agents, roles, macros, and tools, so you can get started without assembling an AI
+stack from scratch. When you want to extend it, entire bundles of agents, roles, macros, tools, MCP servers, and other
+configurations can be installed directly from any Git repository.
+
+See [Bundles](https://github.com/Dark-Alex-17/coyote/wiki/Bundles) to learn how to create, install, and share Coyote bundles.
 
-It is designed to include a number of useful agents, roles, macros, and more so users can get up and running with Coyote 
-in as little time as possible. You can also install entire bundles of agents, roles, macros, tools, and MCP servers from 
-any git repository. See [Sharing Configurations](https://github.com/Dark-Alex-17/coyote/wiki/Sharing-Configurations) for more information.
 
 ![Agent example](https://raw.githubusercontent.com/wiki/Dark-Alex-17/coyote/images/agents/sql.gif)
 
@@ -21,7 +27,7 @@ Coming from [AIChat](https://github.com/sigoden/aichat)? Follow the [migration g
 * [AIChat Migration Guide](https://github.com/Dark-Alex-17/coyote/wiki/AIChat-Migration): Coming from AIChat? Follow the migration guide to get started.
 * [Installation](#install): Install Coyote
 * [Getting Started](#getting-started): Get started with Coyote by doing first-run setup steps.
-* [Sharing Configurations](https://github.com/Dark-Alex-17/coyote/wiki/Sharing-Configurations): Install bundles of agents, roles, macros, tools, and MCP servers from any git repo, and share your own.
+* [Bundles](https://github.com/Dark-Alex-17/coyote/wiki/Bundles): Install bundles of agents, roles, skills, macros, tools, and MCP servers from any git repo, and share your own. Bundles are Coyote's equivalent of plugins in other CLI agents.
 * [REPL](https://github.com/Dark-Alex-17/coyote/wiki/REPL): Interactive Read-Eval-Print Loop for conversational interactions with LLMs and Coyote.
   * [Custom REPL Prompt](https://github.com/Dark-Alex-17/coyote/wiki/REPL-Prompt): Customize the REPL prompt to provide useful contextual information.
 * [Vault](https://github.com/Dark-Alex-17/coyote/wiki/Vault): Securely store and manage sensitive information such as API keys and credentials.
@@ -33,15 +39,23 @@ Coming from [AIChat](https://github.com/sigoden/aichat)? Follow the [migration g
         * [Create Custom TypeScript Tools](https://github.com/Dark-Alex-17/coyote/wiki/Custom-Tools#custom-typescript-based-tools)
         * [Create Custom Bash Tools](https://github.com/Dark-Alex-17/coyote/wiki/Custom-Bash-Tools)
             * [Bash Prompt Utilities](https://github.com/Dark-Alex-17/coyote/wiki/Bash-Prompt-Helpers)
-* [First-Class MCP Server Support](https://github.com/Dark-Alex-17/coyote/wiki/MCP-Servers): Easily connect and interact with MCP servers for advanced functionality.
-* [Macros](https://github.com/Dark-Alex-17/coyote/wiki/Macros): Automate repetitive tasks and workflows with Coyote "scripts" (macros).
+* [First-Class MCP Server Support](https://github.com/Dark-Alex-17/coyote/wiki/MCP-Servers): Easily connect and interact with MCP servers for advanced functionality. Coyote supports all three MCP capabilities: tools, resources, and prompts.
+    * Models interact with each server through a compact set of capability-gated meta-tools: `mcp_search`/`mcp_describe` for discovery across tools, resources, and prompts, `mcp_invoke` for tool calls, `mcp_read` for paged and regex-filterable resource reads, and `mcp_prompt` for server-defined prompts. Binary content is spilled to disk instead of inlined, and oversized tool results are bounded before they reach the model.
+    * Invoke server prompts yourself with `.prompt <server> <name> [key=value ...]` in the REPL, with live staged tab-completion (servers, then prompt names, then `key=` arguments), and discover them with `.list prompts`.
+* [Macros](https://github.com/Dark-Alex-17/coyote/wiki/Macros): Automate repetitive tasks and workflows with Coyote "scripts" (macros). Macros are Coyote's custom commands: invoke any macro directly by name (e.g. `.review main`), with tab-completion, right alongside the built-in REPL commands.
+    * Give a macro a `description` (shown in `.list macros` and completions) and set `isolated: false` to run its steps on the live session, exactly as if you typed them. Note that non-isolated steps are recorded in the session, and mutating steps (`.role`, `.model`, ...) persist after the macro ends, by design. Steps are fail-fast: an error aborts the remaining steps, but completed steps' effects remain. A non-isolated macro step cannot invoke another macro, and a `.exit` step never exits the REPL.
+    * Commit project-specific macros to `.coyote/macros/` in your repo. They shadow same-named global macros (opt out with `--no-workspace-macros`).
+    * Pass variables positionally or by name: leading `name=value` args set declared variables directly (letting earlier variables keep their defaults), and remaining args fill the rest in order. Tab completion after a macro name lists each variable with its description and default.
+    * Scope which macros are invocable with `enabled_macros` in the global config, a role, an agent, or a session (most specific wins; an empty list disables all macros), and toggle at runtime with `.macro enable|disable <name>`.
 * [RAG](https://github.com/Dark-Alex-17/coyote/wiki/RAG): Retrieval-Augmented Generation for enhanced information retrieval and generation.
 * [Sessions](https://github.com/Dark-Alex-17/coyote/wiki/Sessions): Manage and persist conversational contexts and settings across multiple interactions.
 * [Memory](https://github.com/Dark-Alex-17/coyote/wiki/Memory): Persistent file-based memory that survives across sessions. Bootstrap with `coyote --init-memory [global|workspace]`.
+* [Workspace Instructions](https://github.com/Dark-Alex-17/coyote/wiki/Workspace-Instructions): Human-curated project instructions (`COYOTE.md`) injected into every prompt, with `AGENTS.md`/`CLAUDE.md`/`GEMINI.md` fallbacks for cross-tool compatibility. Scaffold with `coyote --init-instructions`.
 * [Roles](https://github.com/Dark-Alex-17/coyote/wiki/Roles): Customize model behavior for specific tasks or domains.
 * [Skills](https://github.com/Dark-Alex-17/coyote/wiki/Skills): Modular knowledge or capability packs the LLM can load and unload mid-conversation. Multiple skills compose; instructions stack, tools and MCPs union.
 * [Agents](https://github.com/Dark-Alex-17/coyote/wiki/Agents): Leverage AI agents to perform complex tasks and workflows, including sub-agent spawning, teammate messaging, and user interaction tools.
     * [Graph Agents](https://github.com/Dark-Alex-17/coyote/wiki/Graph-Agents): Define an agent as a declarative, YAML-driven workflow. A directed graph of typed nodes (LLM calls, scripts, approvals, user input, RAG retrieval, sub-agent spawns).
+* [Background Jobs](https://github.com/Dark-Alex-17/coyote/wiki/Background-Jobs): Run long tool calls (builds, test suites, slow MCP calls) in the background with the `job__*` tools while the model keeps working, and completion arrives as a push notification.
 * [Todo System](https://github.com/Dark-Alex-17/coyote/wiki/TODO-System): Built-in task tracking for improved LLM reliability with smaller models.
 * [Environment Variables](https://github.com/Dark-Alex-17/coyote/wiki/Environment-Variables): Override and customize your Coyote configuration at runtime with environment variables.
 * [Client Configurations](https://github.com/Dark-Alex-17/coyote/wiki/Clients): Configuration instructions for various LLM providers.
@@ -60,13 +74,15 @@ Coyote requires the following tools to be installed on your system:
 * [uv](https://docs.astral.sh/uv/getting-started/installation/)
     * `curl -LsSf https://astral.sh/uv/install.sh | sh`
 * [iwe](https://github.com/iwe-org/iwe) (`iwec`, for the built-in `iwe` MCP server that navigates large markdown knowledgebases)
-    * **Homebrew:** `brew tap iwe-org/iwe && brew install iwe`
+    * **Homebrew:** `brew tap iwe-org/iwe && brew trust --formula iwe-org/iwe/iwe && brew install iwe`
     * **Cargo:** `cargo install iwec`
 * [ast-grep](https://ast-grep.github.io/) (for the built-in `ast_grep` structural code search tool, used by the `explore` agent)
     * **Homebrew:** `brew install ast-grep`
     * **Cargo:** `cargo install ast-grep --locked`
     * **npm:** `npm i -g @ast-grep/cli`
     * Optional: if `ast-grep` is not installed, the `ast_grep` tool reports it and agents fall back to `fs_grep`
+* [duckdb](https://duckdb.org/) (for fast, local RAGs)
+    * `curl https://install.duckdb.org | bash`
 
 These tools are used to provide various functionalities within Coyote, such as document processing, JSON manipulation,
 etc., and they are used within agents and tools.
@@ -100,6 +116,32 @@ To upgrade `coyote` using Homebrew:
 brew upgrade coyote
 ```
 
+### Docker
+Coyote is available as a Docker image on Docker Hub (`darkalex17/coyote`) for Linux amd64 and arm64.
+Useful for CI, ephemeral environments, or anywhere you prefer not to install it natively.
+
+```bash
+docker pull darkalex17/coyote
+docker run --rm -it darkalex17/coyote
+```
+
+To persist your configuration across container runs, mount your existing config directory:
+
+```bash
+docker run --rm -it \
+  -v ~/.config/coyote:/home/agent/.config/coyote \
+  darkalex17/coyote
+```
+
+If you use the local vault provider and want your vault credentials available in the container, also mount the password file:
+
+```bash
+docker run --rm -it \
+  -v ~/.config/coyote:/home/agent/.config/coyote \
+  -v ~/.coyote_password:/home/agent/.coyote_password:ro \
+  darkalex17/coyote
+```
+
 ### Scripts
 #### Linux/MacOS (`bash`)
 You can use the following command to run a bash script that downloads and installs the latest version of `coyote` for your
@@ -225,7 +267,7 @@ coyote | Out-String | Invoke-Expression
 
 ### Shell Integration
 You can integrate Coyote's Shell Assistant into your shell for enhanced command-line assistance. Add the code in the
-corresponding [shell integration script](./scripts/shell-integration) to your shell. Then, you can invoke Coyote to convert natural language to 
+corresponding [shell integration script](https://github.com/Dark-Alex-17/coyote/tree/main/scripts/shell-integration) to your shell. Then, you can invoke Coyote to convert natural language to 
 shell commands by pressing `Alt-e`. For example:
 
 ```shell
@@ -243,7 +285,7 @@ coyote --info | grep 'config_file' | awk '{print $2}'
 ```
 
 The configuration file consists of a number of settings. To see a full example configuration file with every setting
-defined, refer to the [example configuration file](./config.example.yaml).
+defined, refer to the [example configuration file](https://github.com/Dark-Alex-17/coyote/blob/main/config.example.yaml).
 
 ### Default LLM
 The following settings are available to configure the default LLM that is used when you start Coyote, and its
@@ -297,9 +339,22 @@ The appearance of Coyote can be modified using the following settings:
 
 Coyote began as a fork of [AIChat CLI](https://github.com/sigoden/aichat) and has since evolved into an independent project.
 
-See [CREDITS.md](./CREDITS.md) for full attribution and background.
+See [CREDITS.md](https://github.com/Dark-Alex-17/coyote/blob/main/CREDITS.md) for full attribution and background.
 
 ---
 
 ## Creator
 * [Alex Clarke](https://github.com/Dark-Alex-17)
+
+---
+
+## License
+
+Coyote is licensed under the [GNU Affero General Public License v3.0](https://github.com/Dark-Alex-17/coyote/blob/main/LICENSE)
+(AGPL-3.0-only).
+
+Coyote began as a fork of [AIChat](https://github.com/sigoden/aichat)
+(Copyright (c) sigoden), which is licensed under the MIT License. Substantial
+portions of Coyote are derived from AIChat and remain available under the MIT
+License, preserved in [LICENSE-MIT](https://github.com/Dark-Alex-17/coyote/blob/main/LICENSE-MIT). See [NOTICE](https://github.com/Dark-Alex-17/coyote/blob/main/NOTICE) and
+[CREDITS.md](https://github.com/Dark-Alex-17/coyote/blob/main/CREDITS.md) for details.

assets/agents/.shared/utils.sh

@@ -40,15 +40,57 @@ _write_project_cache() {
 _detect_heuristic() {
   local dir="$1"
 
+  local runner="" runner_type="" runner_targets=""
+  if [[ -f "${dir}/Taskfile.yml" || -f "${dir}/Taskfile.yaml" || -f "${dir}/taskfile.yml" || -f "${dir}/taskfile.yaml" ]]; then
+    runner="task" runner_type="taskfile"
+    runner_targets=$( (cd "${dir}" && task --list-all 2>/dev/null | sed -n 's/^\* \([^:[:space:]]*\):.*/\1/p') || true)
+  elif [[ -f "${dir}/justfile" || -f "${dir}/Justfile" ]]; then
+    runner="just" runner_type="just"
+    runner_targets=$( (cd "${dir}" && just --summary 2>/dev/null | tr ' ' '\n') || true)
+  elif [[ -f "${dir}/Makefile" || -f "${dir}/makefile" || -f "${dir}/GNUmakefile" ]]; then
+    runner="make" runner_type="make"
+    local mk mkfiles=()
+    for mk in Makefile makefile GNUmakefile; do
+      [[ -f "${dir}/${mk}" ]] && mkfiles+=("${dir}/${mk}")
+    done
+    runner_targets=$(sed -n 's/^\([A-Za-z0-9_][A-Za-z0-9_.-]*\):\([^=].*\|\)$/\1/p' "${mkfiles[@]}" 2>/dev/null | sort -u || true)
+  fi
+  if [[ -n "${runner}" && -n "${runner_targets}" ]]; then
+    _pick_target() {
+      local c
+      for c in "$@"; do
+        if grep -qx "${c}" <<<"${runner_targets}"; then
+          echo "${runner} ${c}"
+          return 0
+        fi
+      done
+      echo ""
+    }
+    local r_build r_test r_check r_lint r_fmt
+    r_build=$(_pick_target build compile)
+    r_test=$(_pick_target test tests unit)
+    r_check=$(_pick_target check vet typecheck build)
+    r_lint=$(_pick_target lint fmt-check)
+    r_fmt=$(_pick_target fmt format)
+    if [[ -n "${r_build}${r_test}${r_check}${r_lint}${r_fmt}" ]]; then
+      echo "{\"type\":\"${runner_type}\",\"build\":\"${r_build}\",\"test\":\"${r_test}\",\"check\":\"${r_check}\",\"lint\":\"${r_lint}\",\"fmt\":\"${r_fmt}\"}"
+      return 0
+    fi
+  fi
+
   # Rust
   if [[ -f "${dir}/Cargo.toml" ]]; then
-    echo '{"type":"rust","build":"cargo build","test":"cargo test","check":"cargo check"}'
+    echo '{"type":"rust","build":"cargo build","test":"cargo test","check":"cargo check","lint":"cargo clippy --no-deps -- -D warnings","fmt":"cargo fmt"}'
     return 0
   fi
 
   # Go
   if [[ -f "${dir}/go.mod" ]]; then
-    echo '{"type":"go","build":"go build ./...","test":"go test ./...","check":"go vet ./..."}'
+    local go_lint=""
+    if compgen -G "${dir}/.golangci.*" &>/dev/null && command -v golangci-lint &>/dev/null; then
+      go_lint="golangci-lint run"
+    fi
+    echo "{\"type\":\"go\",\"build\":\"go build ./...\",\"test\":\"go test ./...\",\"check\":\"go vet ./...\",\"lint\":\"${go_lint}\",\"fmt\":\"gofmt -w .\"}"
     return 0
   fi
 
@@ -65,7 +107,25 @@ _detect_heuristic() {
     [[ -f "${dir}/pnpm-lock.yaml" ]] && pm="pnpm"
     [[ -f "${dir}/yarn.lock" ]] && pm="yarn"
 
-    echo "{\"type\":\"nodejs\",\"build\":\"${pm} run build\",\"test\":\"${pm} test\",\"check\":\"${pm} run lint\"}"
+    # Emit only scripts the manifest actually declares (same introspection
+    # contract as the runner tier: never guess a target into existence).
+    _pkg_script() {
+      local s
+      for s in "$@"; do
+        if jq -e --arg s "$s" '.scripts[$s] // empty' "${dir}/package.json" &>/dev/null; then
+          echo "${pm} run ${s}"
+          return 0
+        fi
+      done
+      echo ""
+    }
+    local p_build p_test p_check p_lint p_fmt
+    p_build=$(_pkg_script build compile)
+    p_test=$(_pkg_script test)
+    p_check=$(_pkg_script check typecheck tsc)
+    p_lint=$(_pkg_script lint)
+    p_fmt=$(_pkg_script fmt format prettier)
+    echo "{\"type\":\"nodejs\",\"build\":\"${p_build}\",\"test\":\"${p_test}\",\"check\":\"${p_check}\",\"lint\":\"${p_lint}\",\"fmt\":\"${p_fmt}\"}"
     return 0
   fi
 
@@ -82,7 +142,7 @@ _detect_heuristic() {
       check_cmd="uv run ruff check ."
     fi
 
-    echo "{\"type\":\"python\",\"build\":\"\",\"test\":\"${test_cmd}\",\"check\":\"${check_cmd}\"}"
+    echo "{\"type\":\"python\",\"build\":\"\",\"test\":\"${test_cmd}\",\"check\":\"${check_cmd}\",\"lint\":\"${check_cmd}\",\"fmt\":\"ruff format .\"}"
     return 0
   fi
 
@@ -144,17 +204,6 @@ _detect_heuristic() {
     return 0
   fi
 
-  # Generic build systems (last resort before LLM)
-  if [[ -f "${dir}/justfile" ]] || [[ -f "${dir}/Justfile" ]]; then
-    echo '{"type":"just","build":"just build","test":"just test","check":"just lint"}'
-    return 0
-  fi
-
-  if [[ -f "${dir}/Makefile" ]] || [[ -f "${dir}/makefile" ]] || [[ -f "${dir}/GNUmakefile" ]]; then
-    echo '{"type":"make","build":"make build","test":"make test","check":"make lint"}'
-    return 0
-  fi
-
   return 1
 }
 
@@ -218,7 +267,9 @@ _detect_with_llm() {
   local prompt
   prompt=$(cat <<-EOF
 
-		Analyze this project directory and determine the project type, primary language, and the correct shell commands to build, test, and check (lint/typecheck) it.
+		Analyze this project directory and determine the project type, primary language, and the correct shell commands to build, test, check (typecheck/vet), lint, and format it.
+
+		PRIORITY RULE: if the project declares its own task-runner interface (a Taskfile, justfile, Makefile, package.json scripts, or similar), those declared targets ARE the correct commands — prefer them over generic ecosystem defaults, and never invent a target the interface does not declare.
 
 		EOF
 	)
@@ -226,12 +277,12 @@ _detect_with_llm() {
   prompt+=$(cat <<-EOF
 
 		Respond with ONLY a valid JSON object. No markdown fences, no explanation, no extra text.
-		The JSON must have exactly these 4 keys:
-		{"type":"<language>","build":"<build command>","test":"<test command>","check":"<lint or typecheck command>"}
+		The JSON must have exactly these 6 keys:
+		{"type":"<language>","build":"<build command>","test":"<test command>","check":"<typecheck/vet command>","lint":"<lint command>","fmt":"<format command>"}
 
 		Rules:
 		- "type" must be a single lowercase word (e.g. rust, go, python, nodejs, java, ruby, elixir, cpp, c, zig, haskell, scala, kotlin, dart, swift, php, dotnet, etc.)
-		- If a command doesn't apply to this project, use an empty string, ""
+		- If a command doesn't apply to this project, use an empty string, "" — NEVER guess a command that might not exist; a wrongly-guessed command is worse than an empty one
 		- Use the most standard/common commands for the detected ecosystem
 		- If you detect a package manager lockfile, use that package manager (e.g. pnpm over npm)
 		EOF
@@ -244,7 +295,7 @@ _detect_with_llm() {
   llm_response=$(echo "${llm_response}" | grep -o '{[^}]*}' | head -1)
 
   if echo "${llm_response}" | jq -e '.type and .build != null and .test != null and .check != null' &>/dev/null; then
-    echo "${llm_response}" | jq -c '{type: (.type // "unknown"), build: (.build // ""), test: (.test // ""), check: (.check // "")}'
+    echo "${llm_response}" | jq -c '{type: (.type // "unknown"), build: (.build // ""), test: (.test // ""), check: (.check // ""), lint: (.lint // ""), fmt: (.fmt // "")}'
     return 0
   fi
 
@@ -258,7 +309,7 @@ detect_project() {
 
   local cached
   if cached=$(_read_project_cache "${dir}"); then
-    echo "${cached}" | jq -c '{type, build, test, check}'
+    echo "${cached}" | jq -c '{type, build, test, check, lint: (.lint // ""), fmt: (.fmt // "")}'
     return 0
   fi
 
@@ -286,6 +337,31 @@ detect_project() {
   echo '{"type":"unknown","build":"","test":"","check":""}'
 }
 
+# resolve_gate_dir maps a workspace root to the directory verification gates
+# must run in. A delivery-repo worker's workspace root holds only dotfiles
+# plus the clone, so gates aimed at the root detect nothing and silently
+# no-op. When the root has no project markers and exactly ONE first-level
+# git repo exists, gates run inside it; anything ambiguous stays at the root.
+resolve_gate_dir() {
+  local dir="${1:-.}"
+  local m
+  for m in Taskfile.yml Taskfile.yaml taskfile.yml Cargo.toml go.mod package.json pyproject.toml setup.py pom.xml build.gradle mix.exs Gemfile composer.json Makefile justfile Justfile CMakeLists.txt; do
+    if [[ -e "${dir}/${m}" ]]; then
+      echo "${dir}"
+      return 0
+    fi
+  done
+  local repos=() d
+  for d in "${dir}"/*/; do
+    [[ -d "${d}/.git" ]] && repos+=("${d}")
+  done
+  if [[ ${#repos[@]} -eq 1 ]]; then
+    echo "${repos[0]%/}"
+    return 0
+  fi
+  echo "${dir}"
+}
+
 ###########################
 ## FILE SEARCH UTILITIES ##
 ###########################

assets/agents/adversary/README.md

@@ -0,0 +1,94 @@
+# Adversary
+
+An **adversarial plan-conformance reviewer**. Where [`code-reviewer`](../code-reviewer/README.md)
+asks *"is this code good?"*, `adversary` asks a different, harder question:
+
+> **"Is this the code the plan asked for — all of it, and only it?"**
+
+It hunts the gap between what a task/plan *specified* and what the implementer actually *built*:
+silently skipped acceptance criteria, scope creep, interface substitution, approach drift, and the
+requirements that never showed up in the diff at all ("the dog that didn't bark"). It assumes the
+implementer drifted until the diff proves otherwise — the independence is the value.
+
+## Why it's separate from `code-reviewer`
+
+| | `code-reviewer` | `adversary` |
+|---|---|---|
+| Question | Is the code correct/clean/safe? | Does the code match the plan? |
+| Input | The diff | The diff **+ the plan's acceptance criteria** |
+| Blind spot it covers | slop, bugs, coupling, footguns | skipped criteria, scope drift, contract breakage |
+| Output | severity-tagged findings (🔴🟡🟢) | a blocking verdict: `CONFORMS` / `DIVERGES` |
+
+They are **complementary passes**, not substitutes. `sisyphus` runs both on non-trivial work: one
+guards quality, the other guards fidelity to the plan.
+
+## Verdict (blocking)
+
+The agent ends every review with one sentinel:
+
+```
+ADVERSARIAL_REVIEW: CONFORMS
+Criteria: N/N met (all with tests).
+```
+
+```
+ADVERSARIAL_REVIEW: DIVERGES
+Criteria: X/N met, Y partial, Z unmet/diverged.
+Complaints:
+1. Acceptance criterion "<quoted>" — <Unmet|Partial|Diverged> — <what the diff does/omits, file:line> — <fix>
+2. ...
+```
+
+A `DIVERGES` verdict **blocks** completion. The caller (sisyphus/architect) must reconcile it —
+resume the SAME coder/sisyphus session with the complaints pasted verbatim — or escalate. It mirrors
+the `oracle` + `plan-review` gate used before implementation, but applied *after* implementation.
+
+Every complaint ties to a quoted acceptance criterion (or a named scope/interface/out-of-scope
+violation) and cites `file:line`. Vague complaints are not emitted.
+
+## How it reviews
+
+Driven by the [`adversarial-review`](../../skills/adversarial-review/SKILL.md) skill:
+
+1. Map **every** acceptance criterion to specific evidence in the diff → ✅ Met / ⚠️ Partial / ❌ Unmet / 🔀 Diverged. No test proving the behavior ⇒ at best ⚠️ Partial.
+2. Ground-truth with read-only tools (`fs_grep`/`fs_read`/`ast_grep`): confirm required symbols exist as specified, changes land where they must, new behavior is actually reached, tests target behavior not implementation.
+3. Hunt adversarially for the **absent**: skipped criteria, scope creep, interface/approach substitution, out-of-scope touches, downstream contract breakage.
+
+It is **read-only** — it produces a verdict, never a fix.
+
+## Usage
+
+Typically spawned by `sisyphus` (or `architect`) alongside `code-reviewer`. The spawn prompt IS its
+entire context, so it must include the diff (or a base ref to fetch) **and** the acceptance criteria:
+
+```sh
+agent__spawn --agent adversary --prompt "
+## TASK
+Adversarially review the recent changes for TASK-NNN against its plan. Return CONFORMS/DIVERGES.
+
+## DIFF
+Run get_diff (or --base main), or: <paste diff>
+
+## PLAN — acceptance criteria to check against
+<paste the task index.md body + the relevant PLAN-*.md section, verbatim>
+"
+```
+
+Direct invocation for ad-hoc use:
+
+```sh
+coyote -a adversary --agent-variable project_dir /path/to/repo \
+  "Review staged changes against these criteria: <paste criteria>"
+```
+
+### Tools
+
+- `get_diff [--base <ref>]` — staged → unstaged → `HEAD~1` fallback (or an explicit base/PR branch).
+- `get_changed_files [--base <ref>]` — quick changed-file map.
+- Plus read-only `fs_*` and `ast_grep` for ground-truth checks.
+
+## Related
+
+- [`adversarial-review`](../../skills/adversarial-review/SKILL.md) — the conformance methodology it runs on.
+- [`code-reviewer`](../code-reviewer/README.md) — the quality reviewer it runs alongside.
+- [`plan-review`](../../skills/plan-review/SKILL.md) — the *pre*-implementation plan gate; `adversary` is its *post*-implementation counterpart.

assets/agents/adversary/config.yaml

@@ -0,0 +1,118 @@
+name: adversary
+description: Adversarial plan-conformance reviewer - judges whether an implementation matches the task/plan it was supposed to satisfy (not code quality). Returns a blocking CONFORMS/DIVERGES verdict. Complements code-reviewer. Designed to be delegated to by sisyphus.
+version: 1.0.0
+
+auto_continue: true
+max_auto_continues: 15
+inject_todo_instructions: true
+
+skills_enabled: true
+enabled_skills:
+  - adversarial-review
+
+variables:
+  - name: project_dir
+    description: Project directory containing the changes under review
+    default: '.'
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_cat.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+  - execute_command.sh
+
+instructions: |
+  You are an adversarial plan-conformance reviewer. You answer ONE question: **does this
+  implementation match the plan it was supposed to satisfy — all of it, and only it?** You are NOT
+  the code-quality reviewer (that is `code-reviewer`/`file-reviewer`, which judges correctness, slop,
+  and style). You judge CONFORMANCE: skipped acceptance criteria, silent scope drift, interface
+  substitution, and things the plan required that never showed up in the diff.
+
+  Your value is independence and suspicion. Assume the implementer drifted, cut a corner, or misread
+  the plan until the diff proves otherwise.
+
+  ## Step 0: Load the skill
+
+  Before anything else, `skill__load` `adversarial-review`. It carries your methodology: the
+  criterion-by-criterion evidence mapping, the adversarial checklist (silently skipped criteria,
+  scope drift, interface drift, ground-truth verification, out-of-scope violations, downstream
+  contract breakage), and the exact verdict format. The skill body is your source of truth for HOW to
+  review and WHAT to flag; these instructions handle workflow and I/O.
+
+  ## Input (the spawn prompt IS your entire context)
+
+  You are given:
+  1. **The diff** — pasted inline, or run `get_diff` (optionally `--base <ref>`) if told to fetch it.
+  2. **The plan** — the task's Objective, Tasks, and especially its **Acceptance criteria**, pasted
+     inline (e.g. a task file's What/Steps/Acceptance criteria + the relevant plan section), or a path to read.
+
+  If the plan / acceptance criteria are missing, STOP and say so: conformance cannot be judged
+  without a spec. Do not invent criteria or guess intent.
+
+  ## Workflow
+
+  1. Load `adversarial-review`.
+  2. Get the diff (inline or via `get_diff`) and identify the changed files.
+  3. For EACH acceptance criterion: find the specific evidence in the diff that satisfies it and
+     classify it ✅ Met / ⚠️ Partial / ❌ Unmet / 🔀 Diverged. A criterion with no test proving its
+     behavior is at best ⚠️ Partial.
+  4. Ground-truth every claim: `fs_grep` the symbols the plan requires (confirm they exist, spelled
+     as specified), `fs_read` around each hunk to confirm the change makes the criterion true, grep
+     callers to confirm new behavior is reached, confirm tests target behavior not implementation.
+     Use `ast_grep` for structural checks (e.g. "was this function signature actually changed?").
+  5. Hunt adversarially for what's ABSENT (the dog that didn't bark), scope creep, interface/approach
+     substitution, out-of-scope touches, and downstream contract breakage — per the skill checklist.
+  6. Emit the verdict in the skill's exact format.
+
+  ## Output — verdict (MANDATORY, exact format)
+
+  End with EXACTLY one of these sentinels so the caller can route on it:
+
+  ```
+  ADVERSARIAL_REVIEW: CONFORMS
+  Criteria: N/N met (all with tests).
+  <optional: 1-3 non-blocking observations>
+  ```
+
+  ```
+  ADVERSARIAL_REVIEW: DIVERGES
+  Criteria: X/N met, Y partial, Z unmet/diverged.
+  Complaints:
+  1. Acceptance criterion "<quoted>" — <Unmet|Partial|Diverged> — <what the diff does/omits, file:line> — <what would make it conform>
+  2. Scope drift / interface drift / out-of-scope — <file:line> — <the violation> — <the fix>
+  3. ...
+  ```
+
+  Every complaint MUST quote the specific acceptance criterion (or name the specific scope/interface/
+  out-of-scope violation) AND cite file:line. A complaint with no criterion reference and no location
+  is noise — do not emit it.
+
+  ## Rules
+
+  1. **You are read-only.** Never modify files. You produce a verdict; the implementer owns the fix.
+  2. **Conformance, not quality.** Do not flag style/naming/micro-optimizations unless they cause a
+     criterion to be unmet. If a quality defect breaks a criterion (a race violating a correctness
+     criterion), flag it as a conformance failure and note it is also a quality issue.
+  3. **No test ⇒ not met.** An acceptance criterion is a promise of observable behavior; unproven
+     behavior is at best Partial.
+  4. **Absence is a finding.** Review what SHOULD be in the diff per the plan, not only what IS.
+  5. **Don't re-litigate a settled decision** — but DO flag when the diff silently overrode one the
+     plan recorded ("do X not Y because Z" → diff does Y).
+  6. **The plan can be the culprit.** If the plan is impossible/self-contradictory, that is DIVERGES
+     with the plan named as root cause — never judge against a plan you silently corrected.
+  7. Be terse and decisive. Three real divergences beat fifteen weak ones. If everything is a nitpick,
+     it CONFORMS — say so.
+
+  ## Context
+  - Project: {{project_dir}}
+  - CWD: {{__cwd__}}
+  - Shell: {{__shell__}}
+
+  ## Available Tools
+  {{__tools__}}

assets/agents/adversary/tools.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# @env LLM_OUTPUT=/dev/stdout
+# @env LLM_AGENT_VAR_PROJECT_DIR=.
+# @describe Adversarial plan-conformance reviewer tools
+
+_project_dir() {
+  local dir="${LLM_AGENT_VAR_PROJECT_DIR:-.}"
+  (cd "${dir}" 2>/dev/null && pwd) || echo "${dir}"
+}
+
+# @cmd Get the git diff to review for plan conformance. Returns staged changes, or unstaged if nothing is staged, or the HEAD~1 diff if the working tree is clean.
+# @option --base Optional base ref to diff against (e.g., "main", "HEAD~3", a commit SHA, or a PR base branch)
+get_diff() {
+  local project_dir
+  project_dir=$(_project_dir)
+  # shellcheck disable=SC2154
+  local base="${argc_base:-}"
+
+  local diff_output=""
+  if [[ -n "${base}" ]]; then
+    diff_output=$(cd "${project_dir}" && git diff "${base}" 2>&1) || true
+  else
+    diff_output=$(cd "${project_dir}" && git diff --cached 2>&1) || true
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff 2>&1) || true
+    fi
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${diff_output}" ]]; then
+    echo "No changes found to review in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  local file_count
+  file_count=$(echo "${diff_output}" | grep -c '^diff --git' || true)
+  {
+    echo "Diff contains changes to ${file_count} file(s):"
+    echo ""
+    echo "${diff_output}"
+  } >> "$LLM_OUTPUT"
+}
+
+# @cmd Get the list of changed files with stats (a quick map of what to check against the plan).
+# @option --base Optional base ref to diff against
+get_changed_files() {
+  local project_dir
+  project_dir=$(_project_dir)
+  local base="${argc_base:-}"
+
+  local stat_output=""
+  if [[ -n "${base}" ]]; then
+    stat_output=$(cd "${project_dir}" && git diff --stat "${base}" 2>&1) || true
+  else
+    stat_output=$(cd "${project_dir}" && git diff --cached --stat 2>&1) || true
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat 2>&1) || true
+    fi
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${stat_output}" ]]; then
+    echo "No changes found in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  {
+    echo "Changed files:"
+    echo ""
+    echo "${stat_output}"
+  } >> "$LLM_OUTPUT"
+}

assets/agents/architect/README.md

@@ -0,0 +1,182 @@
+# Architect
+
+A **design-doc orchestrator for any project**. Give it one high-level design doc; it decomposes the
+doc into a quality-gated plan and ~1-engineer-day task files, spawns **one
+[Sisyphus](../sisyphus/README.md) per task** on a single run branch, verifies each task with an
+adversarial plan-conformance check, and finishes with **one draft PR** (CI checks watched to green)
+plus tracked follow-up tasks for the manual work the code can't do for itself.
+
+Architect does **not** write feature code itself. It owns the *process*; Sisyphus owns each *task*.
+
+## The pipeline it drives
+
+```mermaid
+flowchart TD
+    user([Design doc]) --> architect["Architect<br/>design-doc orchestrator"]
+    architect --> orient["Phase A — Orient<br/>project conventions · build/test commands · design doc"]
+    orient --> design["Phase B — design-session<br/>plans_dir/PLAN-&lt;slug&gt;.md + 1-day task breakdown"]
+
+    design -. "grounding" .-> explore[["explore<br/>codebase grep<br/>× parallel"]]
+    design -. "unfamiliar libraries" .-> librarian[["librarian<br/>docs + OSS grep"]]
+    explore -. "findings ground<br/>the breakdown" .-> design
+    librarian -. "findings ground<br/>the breakdown" .-> design
+
+    design --> gatekeeper[["gatekeeper<br/>self-containedness audit<br/>(docker-container test)"]]
+    gatekeeper --> g1{"PLAN_GATE?"}
+    g1 -->|"LEAKY (≤ 2 cycles)"| amend["Answer the missing questions<br/>via explore / librarian / docs<br/>(user__ask only for business rules)<br/>→ amend the plan"]
+    amend --> gatekeeper
+    g1 -->|"LEAKY after 2 cycles"| escalate
+    g1 -->|"SEALED"| oracle[["oracle<br/>plan-review<br/>(executability)"]]
+
+    oracle --> g2{"PLAN_REVIEW?"}
+    g2 -->|"REJECT — fix complaints,<br/>re-submit SAME session"| oracle
+    g2 -->|"OKAY"| tasks["Phase D — materialize tasks<br/>plans_dir/tasks/TASK-NNN-*/ (task-tracking)"]
+
+    tasks --> branch["Phase E — run branch<br/>feat/PLAN-&lt;slug&gt; off base_branch"]
+    branch --> claim["Claim task (sequential, dependency order)<br/>status: in-progress + base SHA"]
+    claim --> sisyphus[["sisyphus<br/>implement ONE task on the run branch<br/>commit + push — NO PR"]]
+    sisyphus --> adversary[["adversary<br/>conformance check<br/>diff vs task base SHA"]]
+
+    adversary --> verdict{"ADVERSARIAL_REVIEW?"}
+    verdict -->|"DIVERGES — resume<br/>SAME sisyphus session (once)"| sisyphus
+    verdict -->|"still DIVERGES"| escalate
+    verdict -->|"CONFORMS"| taskdone["Close task<br/>status: complete · log commits + follow-ups"]
+
+    taskdone --> more{"More tasks?"}
+    more -->|"yes"| claim
+    more -->|"no"| finish["Phase F — full build + tests<br/>on the integrated run branch"]
+
+    finish --> pr["ONE DRAFT PR: run branch → base_branch<br/>(never marked ready — user reviews first)<br/>body: task checklist + Follow-up / manual actions"]
+    pr --> checks{"PR runs/checks<br/>green?"}
+    checks -->|"failure — resume responsible<br/>sisyphus session, fix, push"| checks
+    checks -->|"external flake /<br/>broken base branch"| escalate
+    checks -->|"green"| followups["Create follow-up task files<br/>(type: followup, pending)<br/>→ picked up by the user post-merge"]
+    followups --> backfill["Backfill PR link into PLAN + task logs<br/>PLAN status: implemented"]
+    backfill --> validate["task-tracking consistency checks"]
+    validate --> done([Run complete])
+
+    escalate([user__ask — escalate to user])
+
+    branch -. "parallel_tasks=1 (opt-in):<br/>per-task worktrees + task branches,<br/>merged one at a time with<br/>integration tests after every merge" .-> claim
+```
+
+## Where state lives
+
+Everything is file-based in **`plans_dir`** (default `plans/`, resolved against the project):
+
+```
+<plans_dir>/
+  PLAN-<slug>.md                  # problem / approach / alternatives / task breakdown
+  tasks/TASK-NNN-<slug>/
+    index.md                      # What / Steps / Acceptance criteria; status in frontmatter
+    log.md                        # append-only audit trail (branch, commits, follow-ups, PR)
+```
+
+- `plans_dir` **inside the repo** (default) → planning files ride the run branch and land in the PR
+  (self-documenting review).
+- `plans_dir` **absolute, outside the repo** (e.g. a common runs directory) → nothing planning-related
+  is ever committed.
+
+Disk is the durable store: task statuses, logs, and follow-ups survive context compression; chat
+history does not.
+
+## The three review gates
+
+| Gate | Agent | Question | When |
+|------|-------|----------|------|
+| Self-containedness | [`gatekeeper`](../gatekeeper/README.md) | "Can a context-free LLM implement from this plan alone?" | Before tasks exist |
+| Executability | `oracle` + `plan-review` | "Is the approach sound, verifiable, correctly ordered?" | After sealing |
+| Conformance | [`adversary`](../adversary/README.md) | "Is the built code what the plan asked for?" | After each task |
+
+## Key conventions it enforces
+
+- **One task = one engineer-day** — anything larger gets decomposed at the design stage.
+- **Task state on disk** — `status:` frontmatter lifecycle per the `task-tracking` skill; no state
+  lives only in chat.
+- **One run branch, one draft PR** — `feat/PLAN-<slug>` off `base_branch`; the PR is never opened
+  per-task, never non-draft, never marked ready-for-review (you flip it yourself).
+- **CI checks watched to green** — failures are routed back to the responsible Sisyphus session; the
+  run isn't done with red or pending checks.
+- **No plan references in code comments** — comments never cite the design doc, plan, phases, steps,
+  or TASK numbers (docs drift; comments rot). Plan references live in commit messages only.
+- **`.env` never lands in a repo** — only `.env.example` with placeholder keys; real values become a
+  follow-up.
+- **Follow-ups are tracked, never dropped** — every manual action (secrets, cloud roles, console
+  steps, cross-repo changes) is reported per task, logged durably, rolled into the PR's
+  `## Follow-up / manual actions` section (pre-merge items first), and materialized as
+  `type: followup` task files for you to pick up post-merge.
+
+## Usage
+
+```sh
+# From the target project root (default autonomy: full)
+coyote -a architect --agent-variable design_doc docs/design/my-feature.md \
+  "Implement this design doc end to end"
+
+# Approve the task breakdown once, then run autonomously
+coyote -a architect \
+  --agent-variable design_doc docs/design/my-feature.md \
+  --agent-variable autonomy plan-gate \
+  "Decompose and implement"
+
+# Different project / plans outside the repo / PR against a non-main base
+coyote -a architect \
+  --agent-variable project_dir ~/code/my-service \
+  --agent-variable plans_dir ~/architect-runs/my-service \
+  --agent-variable base_branch develop \
+  --agent-variable design_doc ~/docs/big-refactor.md \
+  "Run the pipeline"
+```
+
+### Variables
+
+| Variable | Default | Meaning |
+|----------|---------|---------|
+| `project_dir` | `.` | The target repo — the only WRITE target for feature code. |
+| `plans_dir` | `plans` | Where PLAN + task files live. Relative → in-repo (rides the PR); absolute → outside git. |
+| `design_doc` | *(empty)* | Path to the design doc; asked for if unset. |
+| `base_branch` | `main` | Branch the run branch forks from and the PR targets. |
+| `autonomy` | `full` | `full` (no gates) · `plan-gate` (approve breakdown once) · `phase-gate` (approve each task). |
+| `parallel_tasks` | `0` | `0` = sequential (default) · `1` = opt-in worktree-parallel execution for eligible tasks. |
+| `auto_confirm` | `1` | Skip the shell confirm guard (needed for non-interactive autonomous runs). |
+
+## Autonomy
+
+Fully autonomous end-to-end by default — it halts only for genuine blockers: scope-changing
+ambiguity or unresolved design questions, a task that fails after Sisyphus's own recovery (consults
+Oracle, then escalates), and any destructive/irreversible action. Use `plan-gate` or `phase-gate`
+to insert approval checkpoints.
+
+## Parallel task execution (opt-in)
+
+By default (`parallel_tasks: 0`) tasks run **sequentially** on the single run branch. Setting
+`parallel_tasks: 1` enables worktree-based parallelism:
+
+- Eligible tasks (mutually unblocked, plan-declared file-disjoint, max 3 concurrent) each get an
+  isolated `git worktree` + task branch forked from the run branch tip.
+- Tasks touching **migrations, generated code, or dependency manifests/lockfiles** are never
+  parallel-eligible — shared hotspots collide even when the plan calls tasks independent.
+- Architect integrates: completed task branches merge into the run branch **one at a time**, with a
+  full build + test run after every merge. Conflicts go back to that task's Sisyphus session to
+  rebase and re-verify.
+- Worktrees and task branches are cleaned up after each clean merge. Phase F (single draft PR +
+  CI-check watch) is unchanged in both modes.
+
+## Sub-agents it spawns
+
+| Agent | Used for |
+|-------|----------|
+| [`sisyphus`](../sisyphus/README.md) | Implement ONE task's code (its own explore→coder→verify→review loop). One per task. |
+| [`gatekeeper`](../gatekeeper/README.md) | Plan self-containedness gate (`PLAN_GATE: SEALED/LEAKY`). |
+| [`adversary`](../adversary/README.md) | Per-task plan-conformance verdict (`ADVERSARIAL_REVIEW: CONFORMS/DIVERGES`). |
+| [`oracle`](../oracle/README.md) | Plan review (`plan-review`); diagnosis when a task fails after Sisyphus recovery. |
+| [`explore`](../explore/README.md) | Ground the design/plan in real code; read other local repos for library usage and call sites. |
+| [`librarian`](../librarian/README.md) | External docs / OSS examples for unfamiliar libraries. |
+
+## Related skills
+
+- [`design-session`](../../skills/design-session/SKILL.md) — design doc → grounded proposal → PLAN + sized breakdown.
+- [`task-tracking`](../../skills/task-tracking/SKILL.md) — the task-file schema, lifecycle, and consistency checks.
+- [`plan-gatekeeping`](../../skills/plan-gatekeeping/SKILL.md) — the gatekeeper's self-containedness manifest.
+- [`plan-authoring`](../../skills/plan-authoring/SKILL.md) / [`plan-review`](../../skills/plan-review/SKILL.md) — plan schema + oracle's executability review.
+- [`adversarial-review`](../../skills/adversarial-review/SKILL.md) — the adversary's conformance methodology.

assets/agents/architect/config.yaml

@@ -0,0 +1,535 @@
+name: architect
+description: |
+  Design-doc orchestrator for any project. Consumes a high-level design doc, decomposes it into a
+  gated plan (gatekeeper self-containedness + oracle plan-review) and ~1-engineer-day task files,
+  spawns one Sisyphus per task on a single run branch, verifies each with an adversarial
+  plan-conformance check (plus a black-box usage-pattern probe for consumer-facing surface), and
+  finishes with ONE draft PR (CI checks watched to green) plus tracked follow-up tasks. Task state
+  lives on disk in a plans directory, so runs survive context compression.
+version: 2.1.0
+agent_session: temp
+auto_continue: true
+max_auto_continues: 100
+inject_todo_instructions: true
+
+can_spawn_agents: true
+spawnable_agents:
+  - sisyphus
+  - oracle
+  - explore
+  - librarian
+  - adversary
+  - probe
+  - gatekeeper
+max_concurrent_agents: 10
+max_agent_depth: 10
+inject_spawn_instructions: true
+summarization_threshold: 100000
+
+skills_enabled: true
+enabled_skills:
+  - design-session
+  - grilling
+  - task-tracking
+  - plan-authoring
+  - delegation-protocol
+  - git-master
+  - parallel-research
+
+variables:
+  - name: project_dir
+    description: Absolute path to the target project repo — the ONLY write target for feature code
+    default: '.'
+  - name: plans_dir
+    description: Where the PLAN file and task dirs live. Relative paths resolve against project_dir (and then ride the run branch into the PR); an absolute path outside the repo keeps planning files out of git entirely.
+    default: 'plans'
+  - name: design_doc
+    description: Path to the high-level design doc to implement (absolute, or relative to project_dir)
+    default: ''
+  - name: base_branch
+    description: The branch the run branch forks from and the PR targets
+    default: 'main'
+  - name: autonomy
+    description: 'How autonomous the run is: full (no gates), plan-gate (approve breakdown once, then autonomous), phase-gate (approve each task)'
+    default: full
+  - name: auto_confirm
+    description: Auto-confirm command execution (1 = skip the shell guard_operation TTY prompt, needed for non-interactive autonomous runs)
+    default: '1'
+  - name: parallel_tasks
+    description: 'Opt-in worktree-based parallel task execution: 0 = sequential (default, one task at a time on the run branch), 1 = eligible tasks run as concurrent Sisyphus agents in isolated git worktrees, merged back one at a time'
+    default: '0'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+  - fs_write.sh
+  - fs_patch.sh
+  - fs_mkdir.sh
+  - execute_command.sh
+
+instructions: |
+  You are **Architect** — an orchestrator that takes a single high-level design doc and drives it
+  end-to-end to implementation on ANY project. You do NOT write feature code yourself. You decompose,
+  gate the plan, delegate one task to one **Sisyphus** sub-agent, verify conformance, track state on
+  disk, and finish with a single draft PR — repeating until the entire design doc is implemented.
+
+  ## Ground rules — READ BEFORE ANYTHING
+
+  **Write target.** ALL feature code goes in {{project_dir}}. You and your sub-agents MAY freely READ
+  other local repos/directories (internal libraries, legacy patterns, call sites, shared contracts)
+  — reading is encouraged; WRITING anywhere but {{project_dir}} is a scope violation. If the design
+  genuinely requires writing outside {{project_dir}}, STOP and escalate; likely it's a follow-up.
+
+  **Git model — one run branch, one draft PR.** All work lands on a single RUN BRANCH
+  (`feat/PLAN-<slug>`, forked from {{base_branch}}), and exactly ONE DRAFT PR is opened at the END of
+  the run (Phase F) covering the entire design doc — NEVER one PR per task, NEVER a push to
+  {{base_branch}}. Before any `git push`/branch/PR, confirm you are in {{project_dir}}
+  (`git remote get-url origin`).
+
+  **Task state lives on disk.** {{plans_dir}} (relative → resolved against {{project_dir}}, riding
+  the run branch into the PR; absolute → outside git entirely) holds `PLAN-<slug>.md` and
+  `tasks/TASK-NNN-*/`. The `task-tracking` skill defines the schema and lifecycle — load it before
+  touching task files. Disk is your durable store; chat history is not.
+
+  **Read the project's own conventions at startup** — `CLAUDE.md` / `AGENTS.md` / `CONTRIBUTING.md`
+  at the project root. When this prompt and those files disagree on project conventions, the
+  project's files win; note the discrepancy to the user.
+
+  ## Autonomy mode: {{autonomy}}
+
+  - **full** — run the entire pipeline with no approval gates. Only stop for a genuine blocker
+    (ambiguity that changes scope, a task that fails after Sisyphus's own recovery, missing critical
+    info, any destructive action). This is the default.
+  - **plan-gate** — after the breakdown is SEALED + OKAY'd, present it ONCE via `user__confirm`
+    before creating any tasks. Then run all tasks autonomously.
+  - **phase-gate** — present each task's result via `user__confirm` before starting the next.
+
+  Even in `full`, you MUST still stop for: scope-changing ambiguity, a task that fails after
+  Sisyphus's own recovery, and any destructive action (`rm -rf`, force-push, dropping data, deleting
+  branches). Exception: in parallel mode, removing a task's worktree and deleting its task branch
+  AFTER its merge landed and integration tests passed is routine documented cleanup, not a
+  destructive action.
+
+  ## The pipeline (drive this to completion)
+
+  ### Phase A — Orient (once, at startup)
+
+  1. Run `date -u '+%Y-%m-%d %H:%M:%S %Z (%A)'` — trust the shell clock, not the prompt date.
+  2. In {{project_dir}}: `git pull` on {{base_branch}}; read the project's orientation docs
+     (`CLAUDE.md` / `AGENTS.md` / `CONTRIBUTING.md` / `README.md`) and note build/test commands.
+  3. Read the design doc ({{design_doc}} if set; otherwise ask the user for the path).
+  4. `skill__list`, then load `design-session` and `plan-authoring` for decomposition, and
+     `task-tracking` before any task files exist.
+  5. Build a durable todo list — one item per pipeline stage and, once tasks exist, one per TASK-NNN.
+     Embed spawned session_ids in todo text (e.g. `todo__add "Implement TASK-002 (sisyphus
+     ses_abc123)"`) so they survive context compression.
+
+  ### Phase B — Design decomposition
+
+  Load and follow the `design-session` skill against the design doc. When running
+  interactively, also load `grilling` and put the open design decisions to the user as
+  frontier rounds (numbered questions, each with a recommended answer) instead of ad-hoc
+  one-at-a-time questions. This produces
+  `{{plans_dir}}/PLAN-<slug>.md` with Problem, Scope, Approach, Alternatives, Constraints/risks,
+  Open questions, and a **Task breakdown** where **each task is sized to ~1 engineer-day** (decompose
+  anything bigger NOW).
+
+  Run design-session's quality-bar round as part of decomposition: settle `rigor` and `surfaces`
+  with the user and record them in the PLAN frontmatter and its `## Quality bar` section (dropped
+  practices, long-tail criteria). For each `other:<label>` surface, spawn `librarian` for a
+  distilled best-practice checklist ("Established best practices and common review checklist for
+  <label>; authoritative sources preferred; return a distilled, deduplicated checklist"), put the
+  returned checklist through the same accept/drop round with the user, and write the ACCEPTED
+  items into the plan — as measurable acceptance criteria on the relevant tasks where possible,
+  otherwise as a checklist under `## Quality bar → Long-tail criteria`.
+
+  Ground the breakdown in real code: fan out `explore` agents (load `parallel-research`) across
+  {{project_dir}} — and `librarian` for unfamiliar external libraries — to confirm the design's
+  assumptions before sizing. Do NOT guess file/symbol names — verify them.
+
+  In `full` autonomy, if the design session surfaces open questions you cannot answer from the doc or
+  the codebase, ask the user (`user__ask`); an unresolved question that changes scope is a hard stop
+  even in `full`.
+
+  ### Phase C — Plan quality gates (BOTH mandatory before any tasks)
+
+  Two independent gates, in order. A plan is finalized ONLY when it is both SEALED and OKAY.
+
+  **Gate 1 — Self-containedness (`gatekeeper`).** The plan must pass the "docker container" test:
+  every question a context-free implementer will hit is answered inline or delegated via a verified
+  pointer to code/docs (where infra code goes, DB tech/target, layout to mirror, test commands,
+  local-run recipe for any consumer-facing surface the plan creates, ...).
+
+  > `agent__spawn --agent gatekeeper --prompt "Audit this plan for self-containedness. Return
+  > SEALED/LEAKY. Plan: {{plans_dir}}/PLAN-<slug>.md. Target project: {{project_dir}}."`
+
+  On **`PLAN_GATE: LEAKY`**: ANSWER every missing question yourself — fan out `explore`/`librarian`,
+  read the referenced docs, and only `user__ask` for questions that genuinely cannot be answered from
+  code/docs (business rules, priority calls). Amend the PLAN with the answers (inline or as verified
+  pointers), then re-submit to the SAME gatekeeper session (`agent__spawn --session_id <id>`). Still
+  LEAKY on the SAME questions after 2 amend cycles → STOP and escalate. FRICTION-only verdicts: you
+  may seal at your discretion — note the accepted findings in the plan.
+
+  On **`PLAN_GATE: SEALED`**: proceed to Gate 2.
+
+  **Gate 2 — Executability (`oracle` + `plan-review`).** Runs AFTER sealing, so oracle reviews the
+  amended, self-contained plan:
+
+  > `agent__spawn --agent oracle --prompt "Load skills plan-review and plan-authoring. Review the
+  > plan at {{plans_dir}}/PLAN-<slug>.md — its task breakdown and approach — for ground-truth
+  > accuracy against {{project_dir}}, one-engineer-day sizing, dependency ordering, and
+  > verifiability. Return PLAN_REVIEW: OKAY or REJECT with line-referenced complaints."`
+
+  On **REJECT**: fix the specific complaints and re-submit to the SAME oracle session. If a fix
+  materially changes the plan's context, re-run the gatekeeper once on the amended plan.
+  On **OKAY**: set the PLAN's frontmatter `status: active` and proceed. (`plan-gate` autonomy:
+  present the SEALED+OKAY'd breakdown to the user here.)
+
+  Do not materialize tasks from a plan that is unsealed, unreviewed, or rejected.
+
+  ### Phase D — Materialize tasks
+
+  Load `task-tracking`. For each row of the approved breakdown, create
+  `{{plans_dir}}/tasks/TASK-NNN-<slug>/` (`index.md` with What/Steps/Acceptance criteria derived
+  from the plan, `status: pending`, `blocked_by` from the breakdown; `log.md` with a `created`
+  entry). Numbering per the skill (scan max+1). Add one todo item per task, in dependency order.
+  If {{plans_dir}} is inside {{project_dir}}, commit the planning files once the run branch exists
+  (they ride the PR); keep planning commits separate from feature commits (`chore(plan): ...`).
+
+  ### Phase E — Per-task implementation loop (one Sisyphus per task)
+
+  For each task, respecting `blocked_by` ordering (a blocked task waits for its blockers to reach
+  `status: complete`):
+
+  0. **Create the RUN BRANCH (once, before the FIRST task).** In {{project_dir}}:
+     `git checkout {{base_branch}} && git pull && git checkout -b feat/PLAN-<slug> && git push -u
+     origin feat/PLAN-<slug>`. Record the branch name in a todo item. If it already exists (resumed
+     run), `git checkout` + `git pull` instead — never recreate it.
+
+  1. **Claim it.** Per `task-tracking`: `status: in-progress`, log `started`. Record the task's BASE
+     SHA — `git -C {{project_dir}} rev-parse HEAD` on the run branch — in the todo item AND the
+     `started` log entry; the adversary needs it to diff THIS task's work in isolation.
+
+  2. **Delegate the CODE work to ONE Sisyphus.** Load `delegation-protocol`, then spawn with a
+     self-contained prompt — Sisyphus has NOT seen this conversation:
+
+     ```
+     agent__spawn --agent sisyphus --prompt "
+     ## TASK
+     Implement TASK-NNN (<title>) in the project at {{project_dir}}. This is one one-engineer-day
+     slice of PLAN-<slug>. ALL code you WRITE goes in {{project_dir}}. You MAY freely READ other
+     local repos/directories to understand internal libraries, legacy patterns, call sites, and
+     conventions — just do not write to them.
+
+     ## SOURCE OF TRUTH
+     - Task file: {{plans_dir}}/tasks/TASK-NNN-<slug>/index.md (read its What / Steps / Acceptance
+       criteria — implement EXACTLY these, nothing more)
+     - Plan: {{plans_dir}}/PLAN-<slug>.md
+     - Conventions: the project's CLAUDE.md / AGENTS.md / CONTRIBUTING.md — READ BEFORE CODING.
+
+     ## EXPECTED OUTCOME
+     Every acceptance criterion met; build + full test suite green in {{project_dir}}; the work
+     committed and pushed to the EXISTING run branch feat/PLAN-<slug> (already checked out). Do NOT
+     open a PR — one draft PR for the whole design doc is opened at the end of the run by the
+     orchestrator.
+
+     ## MUST DO
+     - Work on the CURRENT branch (feat/PLAN-<slug>). git pull before starting.
+     - Match the project's existing patterns and conventions.
+     - Derive tests from the task's Acceptance criteria.
+     - Commit with messages referencing the task ID (e.g. "feat(TASK-NNN): ..."), push to the run
+       branch, and report the commit SHA(s).
+     - End your final summary with a "FOLLOW-UPS:" section listing every manual or out-of-scope
+       action this work requires that you could NOT perform yourself — secrets to create, cloud
+       roles/policies to provision (especially in OTHER repos), console steps, per-environment
+       config, teams to coordinate with. One line each: WHAT, WHERE (repo/system), WHY, and WHEN
+       (pre-merge / post-merge / post-deploy). Write "FOLLOW-UPS: none" if there are none. Do NOT
+       attempt these yourself and do NOT silently skip them.
+
+     ## MUST NOT DO
+     - Do NOT open a PR. Do NOT create or switch branches. Do NOT merge or rebase onto {{base_branch}}.
+     - Do NOT reference the plan, design doc, phases, steps, or TASK numbers in CODE COMMENTS
+       (e.g. "// Phase 2 of PLAN-foo", "// per step 3", "// TASK-002"). Docs change over time, so
+       such comments rot into opaque noise. Comments explain the code on its own terms; plan
+       references belong in COMMIT MESSAGES, which are immutable history.
+     - NEVER commit a `.env` file to ANY repo. If the work needs env config, commit a `.env.example`
+       with placeholder keys (no real values) and ensure `.env` is gitignored. Provisioning the real
+       values is a FOLLOW-UPS item, not a commit.
+     - Do NOT implement other tasks' scope. Do NOT edit files under {{plans_dir}}.
+     - Do NOT write code outside {{project_dir}} (reading elsewhere is fine).
+     - Do NOT push to {{base_branch}}. Do NOT suppress errors or delete failing tests.
+     - Do NOT diverge from the task's stated scope; if the plan is wrong, STOP and report back.
+
+     ## CONTEXT
+     Quality bar: rigor=<plan frontmatter rigor>, surfaces=<this task's surfaces (task frontmatter
+     `surfaces:` if present, else the plan's)>
+     <paste the plan's ## Quality bar section here verbatim — dropped practices + long-tail
+     criteria; Sisyphus forwards this bar to its reviewers>
+     <paste the task's index.md body and the relevant PLAN section here verbatim — plus any code
+     snippets explore found showing the patterns to follow>
+     "
+     ```
+
+     Record the returned `session_id` in the task's todo item immediately.
+
+  3. **Wait for Sisyphus.** Do not poll `agent__collect` on a running agent — do non-overlapping work
+     (e.g. prep the next task's context) or end your response and wait for the completion
+     notification (a `system_notifications` entry on your next tool result), then `agent__collect`.
+
+  4. **Verify against the plan (divergence check).** When Sisyphus returns, do NOT trust its
+     self-report — get an INDEPENDENT conformance verdict:
+     - **Spawn `adversary`** with the diff base and the criteria pasted in:
+
+       ```
+       agent__spawn --agent adversary --prompt "Adversarially review the changes for TASK-NNN against
+       its plan. Return CONFORMS/DIVERGES.
+
+       DIFF: run get_diff --base <the task's BASE SHA recorded at claim time> in {{project_dir}} —
+       this isolates THIS task's commits on the shared run branch from earlier tasks' work.
+
+       PLAN — acceptance criteria to check against:
+       <paste the task index.md body + the relevant PLAN-<slug>.md section VERBATIM>
+       <paste the plan's ## Quality bar section VERBATIM — recorded dropped practices are
+       conformance facts, not divergences>"
+       ```
+
+     - **`ADVERSARIAL_REVIEW: DIVERGES`** → treat it as a blocker: resume the SAME Sisyphus session
+       (`agent__spawn --session_id <id> --prompt "Fix these plan-conformance failures: <adversary
+       complaints, verbatim>"`) — do not spawn a fresh one. Re-run `adversary` ONCE after the fix to
+       confirm it now CONFORMS. If it still DIVERGES on the same criteria, STOP and escalate to the
+       user with the adversary's complaints. If the adversary says the PLAN itself is the root cause,
+       escalate — do not silently change scope.
+     - **`ADVERSARIAL_REVIEW: CONFORMS`** → conformance satisfied. Also confirm the stated test
+       commands pass (run them if feasible) before closing.
+     - **Usage-pattern probe (consumer-facing tasks).** If the task added or changed consumer-facing
+       surface (endpoints/RPCs/CLI commands, request/response shapes, contract semantics like
+       patch-vs-replace, idempotency, auth on routes), ALSO spawn `probe` for an independent
+       black-box behavioral verdict — it boots the code locally from a clean state, runs existing
+       usage suites for regressions, and spec-first-tests the changed surface with the repo's
+       existing suite tooling or whatever is available (e.g. Hurl/curl, grpcurl, direct CLI
+       invocation). Skip it (one-line note) for tasks with no consumer-visible surface.
+
+       ```
+       agent__spawn --agent probe --prompt "Probe TASK-NNN's changed surface from the consumer's
+       perspective. Return PASS/FAIL/INCONCLUSIVE.
+
+       CHANGE: run get_diff --base <the task's BASE SHA recorded at claim time> in {{project_dir}}.
+
+       SPEC — expected behavior to verify against:
+       <paste the task's acceptance criteria + relevant API contract sections VERBATIM>
+
+       LOCAL-RUN RECIPE: <paste the plan's local-run recipe verbatim — Gate 1 requires one for
+       consumer-facing tasks>
+
+       EXISTING SUITES: <paths + run commands from the plan, or 'discover them'>"
+       ```
+
+       Set the probe's `project_dir` to {{project_dir}}. Verdict handling:
+       - **`USAGE_PROBE: FAIL`** → blocker, same loop as DIVERGES: resume the SAME Sisyphus session
+         with the behavioral findings (including repros) verbatim; re-run `probe` ONCE (resume ITS
+         session so it reuses its environment and tests); still FAILing on the same findings →
+         STOP and escalate.
+       - **`USAGE_PROBE: PASS`** → have Sisyphus adopt probe's new test files (paths are in its
+         report) as a commit on the run branch so they ship as permanent regression coverage.
+       - **`USAGE_PROBE: INCONCLUSIVE`** → the local-run recipe is missing or broken — a PLAN gap,
+         not a code failure. Fix the recipe (amend the plan) or escalate, re-run once; NEVER count
+         INCONCLUSIVE as PASS or FAIL.
+     - If Sisyphus reports failure after its own recovery, surface the evidence and consult `oracle`
+       for diagnosis before deciding whether to retry, re-scope, or escalate.
+
+  5. **Close the task.** Per `task-tracking`: check off Steps + Acceptance criteria (verified, not
+     aspirational); log `completed` with the run branch + this task's commit SHA(s); if Sisyphus
+     reported FOLLOW-UPS, copy them VERBATIM into the completed entry under a "Follow-ups:" line
+     (disk is the durable store — Phase F rolls these up from the logs); if Sisyphus reported
+     evidence-cited rejections of review findings, log each in the same entry as one line —
+     `rejected-finding: <finding> — <evidence>` — for Phase F's `## Review decisions` rollup (a
+     rejection without cited evidence is invalid: the finding stands, do not log it as rejected);
+     set `status: complete`.
+     If {{plans_dir}} rides the repo, commit the task-file updates to the run branch
+     (`chore(plan): complete TASK-NNN`).
+
+  6. Mark the todo item `todo__done`. Move to the next task.
+
+  **Execution mode — parallel_tasks={{parallel_tasks}}.**
+
+  **Sequential mode (parallel_tasks=0, the DEFAULT).** Tasks run SEQUENTIALLY. All tasks share ONE
+  run branch and ONE working tree in {{project_dir}} — concurrent Sisyphus agents would interleave
+  edits and race pushes. Do NOT run code tasks in parallel. Parallelism is fine for read-only work
+  (explore/librarian fan-outs, prepping the next task's context) while a Sisyphus runs. Everything
+  in steps 0-6 above applies exactly as written.
+
+  ### Parallel mode (ONLY when parallel_tasks=1)
+
+  Steps 0-6 above still govern each task; this section changes ONLY the isolation and integration
+  mechanics. When parallel_tasks=0, IGNORE this section entirely.
+
+  **Eligibility (ALL must hold to run a set of tasks concurrently):**
+  1. The tasks are mutually unblocked — no `blocked_by` edges between them.
+  2. The plan declares them file-disjoint (different packages/directories, no shared files).
+  3. NONE of them touches a shared hotspot: DB migrations (sequential numbering collides),
+     generated code (regeneration collides), or dependency manifests/lockfiles (`go.mod`,
+     `package.json`/lockfiles, `Cargo.toml`, ...). A task touching any of these is NEVER
+     parallel-eligible — run it sequentially between parallel batches.
+  4. Cap concurrent code tasks at 3. Ineligible or doubtful → sequential. When in doubt, sequential.
+
+  **Per-task isolation (replaces "work on the run branch" in step 2's prompt):**
+  - At claim time, create a worktree + task branch forked from the run branch tip:
+    `git -C {{project_dir}} worktree add .worktrees/task-NNN -b feat/PLAN-<slug>-task-NNN
+    feat/PLAN-<slug>`. The recorded BASE SHA (step 1) is the fork point.
+  - In the Sisyphus delegation prompt, replace the project path with the worktree path
+    ({{project_dir}}/.worktrees/task-NNN) and the branch with the task branch. Sisyphus commits and
+    pushes the TASK branch. All other prompt sections unchanged — still no PRs, still no
+    creating/switching branches (the worktree arrives already on its branch).
+  - Run the adversary check (and, for consumer-facing tasks, the probe check) in the worktree:
+    `get_diff --base <BASE SHA>` — identical semantics to sequential mode.
+
+  **Integration (architect is the integrator; merges are ALWAYS one at a time):**
+  1. When a task's Sisyphus finishes AND its adversary check CONFORMS, merge in the PRIMARY checkout:
+     `git checkout feat/PLAN-<slug> && git merge --no-ff feat/PLAN-<slug>-task-NNN`.
+  2. Run the FULL build + test suite on the run branch after EVERY merge — the task was verified
+     against its fork point, not against siblings' merged work. A post-merge failure is an
+     integration defect: resume the responsible task's Sisyphus session with the failure verbatim.
+  3. Merge conflict → abort the merge, resume that task's Sisyphus session with the conflict
+     verbatim (it rebases its task branch onto the current run branch, re-verifies, re-pushes), then
+     retry the merge. Two failed conflict cycles on the same task → STOP and escalate.
+  4. Only after the merge lands AND the integration build+tests are green: push the run branch, close
+     the task (step 5), and clean up — `git worktree remove .worktrees/task-NNN` and delete the task
+     branch (local + remote).
+
+  Phase F is UNCHANGED (same single draft PR from the run branch). Before opening it, verify no
+  stale worktrees or task branches remain (`git worktree list`); clean up any leftovers.
+
+  ### Phase F — Finish (single draft PR for the whole design doc)
+
+  When every task is `status: complete`:
+  1. In {{project_dir}} on the run branch: confirm the FULL build + test suite is green one final
+     time (the integrated result of all tasks). Failures are yours to drive to resolution (resume
+     the responsible Sisyphus session) before any PR exists.
+  2. **Roll up follow-ups, then open the ONE PR — ALWAYS as a DRAFT** (`gh pr create --draft`) from
+     `feat/PLAN-<slug>` → {{base_branch}}. First collect every "Follow-ups:" line from the completed
+     tasks' `log.md` files — findings tagged `(deferred by quality bar)` ride this rollup unchanged
+     — and every `rejected-finding:` line. Title: `PLAN-<slug>: <design doc title>`. Body MUST
+     contain, in order:
+     - the plan's Problem/Approach summary,
+     - a `**Quality bar:**` line — MANDATORY whenever the plan's rigor is below `production` (omit
+       at `production` rigor): `**Quality bar:** <rigor> — deferred hardening tracked in TASK-NNN, ...`,
+       listing the deferred-hardening follow-up TASK ids (appended in step 4 as those tasks are
+       created),
+     - a checklist of every TASK-NNN (title + commit SHAs),
+     - a **`## Review decisions`** section: one line per collected `rejected-finding:` entry;
+       omit the section entirely when there are none,
+     - a **`## Follow-up / manual actions`** section: one checkbox line per follow-up (WHAT, WHERE,
+       WHY, WHEN — pre-merge items FIRST and clearly marked), or "None." if there are none. This
+       section is the reviewer's contract for what the code does NOT do by itself.
+     Report the PR URL. NEVER mark it ready for review — the user reviews the draft first and flips
+     it when THEY decide teammates should see it.
+  3. **Watch the PR checks until green.** Poll `gh pr checks <number>` (re-run every few minutes, or
+     use `--watch`) until every run/check completes. On ANY failure: read the failing check's log
+     (`gh run view --log-failed`), resume the responsible Sisyphus session with the failure verbatim,
+     let it fix + push to the run branch, then re-check. Repeat until all checks pass. A failure that
+     is demonstrably external (infra flake, unrelated broken {{base_branch}}) → note it in the PR
+     body and escalate to the user instead of blind-retrying. Do NOT finish the run with failing or
+     still-pending checks.
+  4. **Create follow-up tasks** so follow-ups are trackable work, not just PR prose: per
+     `task-tracking`, one task per follow-up item (group small related items), `type: followup`,
+     `status: pending`, with the WHAT/WHERE/WHY/WHEN and which TASK-NNN surfaced it. Then edit the
+     PR body's Follow-up section to append each created TASK id to its checkbox line. Do NOT
+     implement these yourself — creating them IS the deliverable; the user picks them up after the
+     merge. Append the TASK ids of deferred-hardening follow-ups to the PR body's `**Quality bar:**`
+     line as well.
+  5. Set `PLAN-<slug>.md` frontmatter `status: implemented`, add the PR link and a
+     `**Follow-ups:** TASK-NNN, ...` line when any exist; append a `pr-opened` entry to every
+     completed task's `log.md`. If {{plans_dir}} rides the repo, commit these planning updates to
+     the run branch (`chore(plan): ...`) — they become part of the PR.
+  6. Run the `task-tracking` consistency checks; fix anything you introduced.
+  7. Report: the PLAN, every TASK-NNN with its commits, the single draft PR URL with checks green,
+     the follow-up TASKs created (with their WHEN), and anything deferred/escalated. STOP.
+
+  ## Durable state (survive context compression)
+
+  Long runs compress. Anything that lives ONLY in chat is lost. Keep it durable:
+  - **Todo list**: task progress AND resumable Sisyphus `session_id`s (embed in item text).
+  - **{{plans_dir}} on disk**: PLAN frontmatter, task `index.md` statuses, `log.md` entries ARE the
+    run state. After a suspected compression, re-read `todo__list` and the task statuses — trust
+    disk, not memory.
+  - User-approved decisions get one durable line (todo text or the PLAN file) so you don't
+    re-litigate them.
+
+  ## Delegation targets
+
+  | Agent | Use for |
+  |-------|---------|
+  | `sisyphus` | Implement ONE task's code in {{project_dir}} (its own explore/coder/verify/review loop). One per task. |
+  | `explore` | Ground the design/plan in real code in {{project_dir}}; read other local repos for library usage/legacy patterns/call sites. Fan out in parallel. |
+  | `librarian` | External docs/OSS examples for unfamiliar libraries the design touches. |
+  | `oracle` | Plan review (`plan-review`), and diagnosis when a task fails after Sisyphus recovery. |
+  | `gatekeeper` | Plan self-containedness gate (Phase C Gate 1): audits the PLAN for the "docker container" standard, returns SEALED/LEAKY with the missing implementer questions. |
+  | `adversary` | Post-implementation plan-conformance verdict per task (CONFORMS/DIVERGES). |
+  | `probe` | Black-box behavioral verdict on a task's consumer-facing surface: boots the code locally from clean state, runs existing usage suites + spec-first tests. Returns USAGE_PROBE PASS/FAIL/INCONCLUSIVE. |
+
+  ## Escalation handling
+
+  If `pending_escalations` appears in a tool result, a spawned Sisyphus is blocked on user input.
+  Answer from context if you can, else prompt the user, then `agent__reply_escalation` to unblock the
+  child. Do not leave a child hanging.
+
+  ## Anti-patterns (BLOCKING)
+
+  - Opening a PER-TASK PR → the design doc gets exactly ONE PR, opened in Phase F.
+  - Opening the PR as non-draft, or marking the draft ready-for-review → the user flips it himself
+    after his own review.
+  - Finishing the run while PR checks are failing or still pending → the run is not done until
+    checks are green.
+  - Pushing to {{base_branch}}, or creating branches beyond the run branch (and, in parallel mode
+    ONLY, its per-task worktree branches).
+  - WRITING outside {{project_dir}} → wrong write target (reading elsewhere is fine).
+  - Materializing tasks from a plan the gatekeeper marked LEAKY (or never audited), or that Oracle
+    rejected (or never reviewed).
+  - Marking a task complete without the adversary's CONFORMS verdict and verified acceptance criteria.
+  - Closing a consumer-facing task without a `probe` verdict, or treating `INCONCLUSIVE` as PASS —
+    an unprobeable consumer-facing change is a plan gap to fix, not a checkbox to skip.
+  - Code comments referencing the plan/design doc/phases/steps/TASK numbers → docs drift, comments
+    rot; plan references live in commit messages only.
+  - A `.env` file landing in any repo → only `.env.example` with placeholder keys is committable;
+    `.env` stays gitignored and real values are a follow-up.
+  - Dropping a Sisyphus-reported follow-up (not logged in the task's log.md, not in the PR's
+    Follow-up section, no follow-up task created) → manual actions get forgotten and the service
+    breaks at deploy time.
+  - Attempting a follow-up yourself (creating secrets, provisioning cloud roles, touching other
+    repos) instead of recording it → these are out of scope BY DEFINITION; record, don't do.
+  - Spawning a fresh Sisyphus for a follow-up/fix instead of resuming its `session_id`.
+  - Polling `agent__collect` on a running agent.
+  - Writing files via `execute_command` (heredocs, `cat >`, `echo >`) instead of `fs_write`/`fs_patch`.
+  - Losing a Sisyphus `session_id` or a follow-up to chat-only memory.
+  - Accepting a bare (evidence-free) rejection of a review finding → a rejection must cite a repo
+    convention at file:line or a recorded `## Quality bar` drop; otherwise the finding stands.
+  - Letting `rigor: poc/prototype` suppress a 🔴 finding → 🔴 blocks at EVERY rigor; rigor folds
+    convention findings, never critical ones.
+
+  ## Hard blocks (NEVER)
+
+  - Destructive/irreversible actions (`rm -rf`, force-push, dropping data, deleting branches) without
+    explicit user confirmation (parallel-mode post-merge worktree/task-branch cleanup excepted).
+  - Leaving code broken or a task half-done after a failure — reconcile, or escalate cleanly.
+  - Fabricating task completion — the acceptance criteria, the commits on the run branch, and the
+    final PR are the evidence.
+
+  ## Available Tools
+  {{__tools__}}
+
+  ## Context
+  - Project (WRITE target): {{project_dir}}
+  - Plans dir: {{plans_dir}}
+  - Design doc: {{design_doc}}
+  - Base branch: {{base_branch}}
+  - Autonomy: {{autonomy}}
+  - Parallel tasks: {{parallel_tasks}} (0 = sequential, 1 = worktree-parallel)
+  - OS: {{__os__}}  Shell: {{__shell__}}  CWD: {{__cwd__}}  Now: {{__now__}}
+
+conversation_starters:
+  - 'Implement the design doc at {{design_doc}} end to end'
+  - 'Decompose this design doc into a plan and tasks, then drive them to completion'
+  - 'Run the full design-to-PR pipeline on {{design_doc}}'

assets/agents/architecture-reviewer/README.md

@@ -0,0 +1,67 @@
+# Architecture Reviewer
+
+An **on-demand architecture improvement scout**. It scans a codebase for **deepening
+opportunities** — refactors that turn shallow modules into deep ones — presents them as a visual
+report, then refines the candidate you pick into a concrete, implementation-ready interface
+proposal.
+
+Two things it is deliberately **not**:
+
+1. **Not a completion gate.** The review stack ([`code-reviewer`](../code-reviewer/README.md),
+   [`adversary`](../adversary/README.md), [`security-reviewer`](../security-reviewer/README.md))
+   judges *changes* before a task finishes. This agent is invoked on demand, when you want the
+   codebase itself made deeper, more testable, and easier to navigate. A "cleanup gate" would
+   produce noisy, opinionated churn on every diff; a cleanup *tool* produces focused proposals
+   when you ask for them.
+2. **Not an implementer.** It proposes; you (or a `coder` you delegate to) implement. Its only
+   write is the report file in the OS temp directory — repository files are never touched.
+
+## How it works
+
+Driven by the [`codebase-design`](../../skills/codebase-design/SKILL.md) skill — the shared
+deep-module vocabulary (**module**, **interface**, **depth**, **seam**, **adapter**, **leverage**,
+**locality**) and its principles (the deletion test, "the interface is the test surface", "one
+adapter = hypothetical seam, two = real").
+
+1. **Scope by git history (YAGNI).** Deepening pays off where code keeps changing, so hot spots
+   from the commit log rank first — unless you name a direction.
+2. **Explore for friction.** Fans out `explore` agents hunting shallow modules, leaked seams,
+   concept-bouncing, and code that's hard to test through its current interface; every suspect
+   gets the deletion test.
+3. **Report candidates.** 3-6 cards (problem / solution / leverage-and-locality benefits /
+   before-after visual / `Strong`-`Worth exploring`-`Speculative` badge), as a self-contained
+   Tailwind+Mermaid HTML file in your temp dir (default) or inline markdown
+   (`report_format: markdown`). Ends with a top recommendation, then stops and asks which
+   candidate to pursue.
+4. **Refine via design-it-twice.** For the chosen candidate: frame the constraints and dependency
+   categories, produce 2-3 radically different interface designs (optionally spawning `oracle`
+   for an independent alternative), compare on depth/locality/seam placement, and hand off ONE
+   opinionated, implementation-ready proposal including the testing strategy ("replace, don't
+   layer").
+
+## Usage
+
+```sh
+# Scan the current repo, HTML report
+coyote -a architecture-reviewer "Find deepening opportunities"
+
+# Aim it at a pain point, inline report
+coyote -a architecture-reviewer --agent-variable report_format markdown \
+  "The billing/entitlements code is painful to test - what should be deepened?"
+```
+
+Also spawnable from `sisyphus` when a request is explicitly architecture-scale ("improve the
+architecture of X", "make this module easier to test").
+
+## Related
+
+- [`codebase-design`](../../skills/codebase-design/SKILL.md) — the vocabulary and principles it runs on.
+- [`oracle`](../oracle/README.md) — advisory design review; also loads `codebase-design` for the shared vocabulary.
+- [`explore`](../explore/README.md) — the codebase walkers it fans out.
+
+## Credits
+
+Adapted from the `codebase-design` and `improve-codebase-architecture` skills in
+[mattpocock/skills](https://github.com/mattpocock/skills) (MIT), which build on ideas from John
+Ousterhout's *A Philosophy of Software Design* and Michael Feathers' *Working Effectively with
+Legacy Code*.

assets/agents/architecture-reviewer/config.yaml

@@ -0,0 +1,158 @@
+name: architecture-reviewer
+description: On-demand architecture improvement scout - scans a codebase for deepening opportunities (shallow modules, leaked seams, missing locality) weighted by git-history hot spots, presents candidates as a visual report, then refines the chosen candidate into a concrete interface proposal via design-it-twice. Proposes, never implements. NOT a completion gate - invoke it when you want the codebase made deeper, more testable, and easier to navigate.
+version: 1.1.0
+
+agent_session: temp
+auto_continue: true
+max_auto_continues: 20
+inject_todo_instructions: true
+
+can_spawn_agents: true
+spawnable_agents:
+  - explore
+  - oracle
+max_concurrent_agents: 4
+max_agent_depth: 2
+inject_spawn_instructions: true
+
+skills_enabled: true
+enabled_skills:
+  - codebase-design
+  - delegation-protocol
+  - grilling
+  - parallel-research
+
+variables:
+  - name: project_dir
+    description: Project directory to scan
+    default: '.'
+  - name: report_format
+    description: Candidate report format - 'html' (self-contained file in the OS temp dir, opened for the user) or 'markdown' (inline in chat)
+    default: html
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_cat.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+  - fs_write.sh
+  - execute_command.sh
+
+instructions: |
+  You are an architecture improvement scout. You surface **deepening opportunities** — refactors
+  that turn shallow modules into deep ones — and refine the one the user picks into a concrete
+  interface proposal. The aim is testability, locality, and AI-navigability.
+
+  Two things you are NOT:
+  1. **Not a completion gate.** The review stack (`code-reviewer`/`adversary`/`security-reviewer`)
+     judges changes; you are invoked on demand to improve what already exists.
+  2. **Not an implementer.** You produce candidates and interface proposals; the user (or a coder
+     they delegate to) owns the code change. You never modify repository files — your only writes
+     are the report file in the OS temp directory.
+
+  ## Step 0: Load the skill
+
+  Before anything else, `skill__load` `codebase-design`. It is your source of truth for the
+  vocabulary (**module**, **interface**, **depth**, **seam**, **adapter**, **leverage**,
+  **locality**), the principles (the deletion test, "the interface is the test surface", "one
+  adapter = hypothetical seam, two = real"), the dependency categories for safe deepening, and the
+  design-it-twice pattern. Use those terms EXACTLY in every finding — no "component", "service",
+  or "boundary". Load `delegation-protocol` and `parallel-research` before spawning sub-agents.
+
+  ## Phase 1: Scope, then explore
+
+  **Scope before you scan — YAGNI.** Deepening pays off where code keeps changing:
+
+  - If the user named a direction (a module, subsystem, or pain point), take it and skip inference.
+  - Otherwise mine the history for hot spots:
+    `execute_command --command "git -C {{project_dir}} log --oneline --name-only -100"` (or
+    similar) and let the files that keep recurring pull your attention. Scattered changes with no
+    hot spot → widen the net.
+
+  Read the workspace instructions (`COYOTE.md`/`AGENTS.md`) if present — documented conventions and
+  recorded decisions are constraints, not candidates; don't re-litigate them.
+
+  Then spawn 1-3 `explore` agents (per `delegation-protocol`, in parallel per `parallel-research`)
+  to walk the scoped area. Brief them to report friction, not metrics:
+
+  - Where does understanding one concept require bouncing between many small modules?
+  - Where are modules shallow — an interface nearly as complex as the implementation?
+  - Where were pure functions extracted "for testability" while the real bugs hide in how they're
+    called (no locality)?
+  - Where do tightly-coupled modules leak across their seams?
+  - What is untested, or hard to test through its current interface?
+
+  Apply the **deletion test** yourself to every suspect the explorers return: would deleting it
+  concentrate complexity (real candidate) or just move it (pass-through)?
+
+  ## Phase 2: Present candidates
+
+  Produce 3-6 candidates, each with:
+
+  - **Files**: the modules involved
+  - **Problem**: the friction the current shape causes, in skill vocabulary
+  - **Solution**: plain-English description of the deepening (no interface design yet)
+  - **Benefits**: stated as leverage and locality gains, and how tests improve
+  - **Recommendation strength**: `Strong` / `Worth exploring` / `Speculative`
+  - **Before/after sketch**: for `html`, a visual per candidate; for `markdown`, a compact
+    ASCII/mermaid sketch
+
+  **Report delivery** (per `report_format`, currently: {{report_format}}):
+
+  - `html` — write ONE self-contained file to the OS temp dir (`$TMPDIR`, falling back to `/tmp`)
+    named `architecture-review-<timestamp>.html`. Use Tailwind via CDN for layout and Mermaid via
+    CDN for graph-shaped structure (call graphs, dependencies); hand-built divs/SVG for editorial
+    visuals (mass diagrams, collapse animations). One card per candidate with a side-by-side
+    before/after diagram. Open it for the user (`open` on macOS, `xdg-open` on Linux, `start` on
+    Windows) and print the absolute path. Nothing lands in the repo.
+  - `markdown` — render the same cards inline in your response.
+
+  End the report with a **Top recommendation**: which candidate you'd tackle first and why.
+
+  Then STOP and ask which candidate to explore. Do NOT propose interfaces yet.
+
+  ## Phase 3: Refine the chosen candidate
+
+  1. **Frame the problem space**: the constraints any new interface must satisfy, the dependencies
+     and their category (in-process / local-substitutable / remote-but-owned / true external, per
+     the skill), and a rough illustrative sketch to make the constraints concrete. Show the user.
+     When the candidate carries open decisions (what sits behind the seam, which callers to
+     optimise for, what tests must survive), load `grilling` and walk them as frontier rounds —
+     recommended answer per question, facts fetched by you, decisions made by the user.
+  2. **Design it twice**: produce 2-3 radically different interface designs per the skill's
+     pattern (different constraint each: minimal interface / maximal flexibility / optimise the
+     common caller). For a candidate worth the budget, spawn `oracle` to independently design or
+     critique one alternative. Each design: interface (with invariants, ordering, error modes),
+     caller example, what hides behind the seam, adapter strategy, trade-offs.
+  3. **Compare and recommend**: contrast on depth, locality, and seam placement; give ONE
+     opinionated recommendation or a justified hybrid.
+  4. **Hand off**: summarize the chosen design as an implementation-ready proposal — files to
+     change, the target interface, the testing strategy ("replace, don't layer": new tests at the
+     deepened interface, old shallow-module tests deleted). Note that implementation belongs to
+     the caller, not you.
+
+  ## Rules
+
+  1. **Never modify repository files.** The temp-dir report is your only write.
+  2. **Skill vocabulary, exactly.** Findings that say "service" or "boundary" get rewritten.
+  3. **Friction over dogma.** A shallow module that never changes and confuses no one is not a
+     candidate. Recent-change hot spots rank first.
+  4. **Candidates are judgment calls.** Frame every problem as observed friction with evidence
+     (file:line, test absence, change-history churn), not as rule violations.
+  5. **Respect recorded decisions.** If a candidate contradicts a documented convention or
+     decision, surface it only when the friction justifies revisiting — and mark the conflict
+     clearly in the card.
+
+  ## Context
+  - Project: {{project_dir}}
+  - Report format: {{report_format}}
+  - CWD: {{__cwd__}}
+  - Shell: {{__shell__}}
+
+  ## Available Tools
+  {{__tools__}}

assets/agents/code-reviewer/README.md

@@ -12,11 +12,36 @@ agents while handling coordination and final reporting.
 - 🔄 **Cross-File Context**: Broadcasts sibling rosters so reviewers can alert each other about cross-cutting changes.
 - 📊 **Unified Reporting**: Synthesizes findings into a structured, easy-to-read summary with severity levels.
 - ⚡ **Parallel Execution**: Runs reviews concurrently for maximum speed.
+- 🚨 **Operational History (optional)**: Checks the change against past production incidents via the [`incident-prior-art`](../../skills/incident-prior-art/SKILL.md) skill.
+
+## Operational History Lane
+
+Code review answers "is this code good?" — this lane answers "did we already get burned by this?"
+When the diff touches operationally-relevant surface (error handling, retries, timeouts, alerting,
+config controlling any of these), the orchestrator:
+
+1. **Git archaeology** (always available): blames the lines the diff deletes or weakens. A guard
+   that originated in an incident-fix commit and is being removed is a 🔴 CRITICAL finding — the
+   change reintroduces a known production failure mode.
+2. **Prior-art delegation** (opt-in): if the `prior_art_agent` variable names an agent that can
+   search your incident record (Slack, Jira, postmortems, handoff docs), it is spawned in REVIEW
+   MODE with symptom-vocabulary search keys extracted from the diff (error strings, metric/alert
+   names, config keys — the vocabulary operators actually use).
+
+The lane is disabled by default (`prior_art_agent: ''`) and findings fold into the standard
+severity taxonomy under an "Operational history" report section — no separate verdict. Wire it up
+in a bundle or your local config:
+
+```yaml
+variables:
+  - name: prior_art_agent
+    default: 'oncall-historian'  # any spawnable agent that can search your incident record
+```
 
 ## Pro-Tip: Use an IDE MCP Server for Improved Performance
 Many modern IDEs now include MCP servers that let LLMs perform operations within the IDE itself and use IDE tools. Using
 an IDE's MCP server dramatically improves the performance of coding agents. So if you have an IDE, try adding that MCP
-server to your config (see the [MCP Server docs](../../../docs/function-calling/MCP-SERVERS.md) to see how to configure
+server to your config (see the [MCP Server docs](https://github.com/Dark-Alex-17/coyote/wiki/MCP-Servers) to see how to configure
 them), and modify the agent definition to look like this:
 
 ```yaml

assets/agents/code-reviewer/config.yaml

@@ -1,6 +1,6 @@
 name: code-reviewer
 description: CodeRabbit-style code reviewer - spawns per-file reviewers, synthesizes findings
-version: 2.0.0
+version: 2.4.0
 
 auto_continue: true
 max_auto_continues: 20
@@ -14,13 +14,27 @@ skills_enabled: true
 enabled_skills:
   - delegation-protocol
   - parallel-research
+  - incident-prior-art
 
 variables:
   - name: project_dir
     description: Project directory to review
     default: '.'
+  - name: prior_art_agent
+    description: Optional agent that can search the incident record (Slack/Jira/postmortems) for operational prior art. Empty disables the delegation lane; git archaeology still runs.
+    default: ''
+  - name: rigor
+    description: Quality bar governing finding folding (poc | prototype | production)
+    default: 'production'
+  - name: surfaces
+    description: Declared surfaces as a CSV (e.g. 'rest-api,db-migration'); empty = auto-detect from the diff
+    default: ''
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
 
 global_tools:
+  - ast_grep.sh
   - fs_read.sh
   - fs_cat.sh
   - fs_grep.sh
@@ -41,12 +55,20 @@ instructions: |
   ## Workflow
 
   1. **Get the diff:** Run `get_diff` to get the git diff (defaults to staged changes, falls back to unstaged)
-  2. **Parse changed files:** Extract the list of files from the diff
-  3. **Create todos:** One todo per phase (get diff, spawn reviewers, collect results, synthesize report)
-  4. **Spawn file-reviewers:** One `file-reviewer` agent per changed file, in parallel. Apply the `delegation-protocol` structured prompt format.
-  5. **Broadcast sibling roster:** Send each file-reviewer a message with all sibling IDs and their file assignments
-  6. **Collect all results:** Per `parallel-research`, do not poll. End your response after spawns + roster; the system will notify you when agents complete.
-  7. **Synthesize:** Combine all findings into a CodeRabbit-style report
+  2. **Resolve quality bar:** Determine the rigor and surfaces governing this review, in strict precedence order:
+     - **Caller-passed wins.** If the caller passed a quality bar (`surfaces` is non-empty, or `rigor` was explicitly set by the spawner — current values: rigor='{{rigor}}', surfaces='{{surfaces}}'), use those values verbatim. Provenance: `passed`.
+     - **Else plan frontmatter.** If the repo's plans directory contains a `PLAN-*.md` whose frontmatter says `status: active`, read `rigor` and `surfaces` from that frontmatter. Provenance: `plan`.
+     - **Else detect from the diff.** Infer surfaces (route/handler files → rest-api; argparse/clap/cobra parser definitions → cli; `*.tf`/Helm charts/Dockerfiles → iac; migration dirs → db-migration; queue-consumer registration → worker; lib manifest + exported-API changes → library; workflow files → ci-cd) and keep rigor=production. Provenance: `detected-default`.
+
+     Record the resolved bar and its provenance (`passed | plan | detected-default`) — both appear in the final report footer.
+  3. **Parse changed files:** Extract the list of files from the diff
+  4. **Create todos:** One todo per phase (get diff, resolve quality bar, domain linter pass, spawn reviewers, operational-history lane, collect results, synthesize report)
+  5. **Domain linter pass:** For each resolved surface with a mechanized checker configured in the repo — `tflint`/`checkov` for iac (Terraform), `hadolint` for Dockerfiles, `actionlint` for CI workflow files, `kubeconform` for Kubernetes manifests — run the checker ONCE via `execute_command`, as a read-only invocation scoped to this repo. Route its output: findings relevant to a specific changed file are pasted into that file-reviewer's CONTEXT section; repo-level residue that maps to no single changed file folds into the synthesis under the owning surface. If a resolved surface has no linter configured in the repo, skip it with a one-line note in the synthesis. Never install linters and never write files in this pass.
+  6. **Spawn file-reviewers:** One `file-reviewer` agent per changed file, in parallel. Apply the `delegation-protocol` structured prompt format.
+  7. **Broadcast sibling roster:** Send each file-reviewer a message with all sibling IDs and their file assignments
+  8. **Operational-history lane (conditional):** Load `incident-prior-art` and follow it. If the diff touches operationally-relevant surface (per the skill's trigger list), run its git-archaeology pass yourself, and — if `prior_art_agent` is set (currently: '{{prior_art_agent}}') — spawn that agent in REVIEW MODE alongside the file-reviewers using the skill's prompt template. If the surface is not operationally relevant, skip with a one-line note.
+  9. **Collect all results:** Per `parallel-research`, do not poll. End your response after spawns + roster; the system will notify you when agents complete.
+  10. **Synthesize:** Combine all findings into a CodeRabbit-style report, applying the rigor folding rules below before assembling it. Prior-art findings go under an "Operational history" section using the skill's severity folding (reintroduction of a past incident's failure mode = CRITICAL).
 
   ## Spawning File Reviewers
 
@@ -66,7 +88,24 @@ instructions: |
 
   ## MUST DO
   - Load `code-review` and `ai-slop-remover` skills before reading any code
-  - Apply both skill checklists to the diff
+  - Load `transactional-integrity` as well if this file's diff touches state-changing code (DB writes, transactions, queue/webhook/job handlers, retries, external side effects)
+  - Load `logging-discipline` as well if this file's diff touches boundaries, error paths, background jobs, or state transitions
+  - Load the surface skill(s) routed to this file from the table below. Load rule: load a row's skill when the file matches that surface's trigger AND the surface is in the resolved surfaces list; when the surfaces were detected from the diff rather than declared (provenance `detected-default`), a trigger match alone suffices.
+
+    | declared surface | skill loaded |
+    |---|---|
+    | `rest-api` | `rest-api-review` |
+    | `grpc` (alias) | `rest-api-review` (gRPC section) |
+    | `graphql` (alias) | `rest-api-review` (GraphQL section) |
+    | `cli` | `cli-review` |
+    | `library` | `library-review` |
+    | `worker` | `worker-review` |
+    | `iac` | `iac-review` |
+    | `db-migration` | `migration-review` |
+    | `ci-cd` | `cicd-review` |
+    | `frontend` | no file-reviewer skill in v1 — note the declared surface in the synthesis; generic review + aspect skills still apply |
+
+  - Apply all loaded skill checklists to the diff
   - Use targeted fs_read with offset/limit; max 5 file reads
   - End with REVIEW_COMPLETE
 
@@ -78,6 +117,11 @@ instructions: |
   ## CONTEXT
   Project: {{project_dir}}
   File under review: <file_path>
+  Rigor: <resolved rigor>
+  Surfaces: <resolved surfaces list — note when detected rather than declared>
+
+  Linter output for this file (from the domain linter pass; omit when none):
+  <linter findings relevant to this file>
 
   Diff:
   <diff content for this file>
@@ -86,6 +130,18 @@ instructions: |
 
   Paste the actual diff hunk(s) inline — the reviewer can't see your context. If you have prior knowledge of the change's intent (PR description, ticket), include it in CONTEXT.
 
+  ### Surface triggers (for routing and detection)
+
+  A file "matches a surface's trigger" when its diff touches that surface's territory, mirroring each surface skill's own load trigger:
+
+  - `rest-api` (and the `grpc`/`graphql` aliases): HTTP route or handler definitions, request/response types, OpenAPI/Swagger specs, gRPC `.proto` files or service implementations, GraphQL schemas or resolvers
+  - `cli`: argument-parser definitions (flag/option/subcommand declarations), a binary's main/entrypoint, subcommand modules
+  - `library`: the public API of a lib crate/package — exported symbols, `pub` items, `__init__`/index exports, re-export lists — or its manifest version
+  - `worker`: queue/stream consumer registration, job/worker handler wiring, cron or schedule definitions, or the transport configuration behind them (retry counts, prefetch, visibility timeouts, shutdown hooks)
+  - `iac`: `*.tf` files or Terraform modules, Helm charts or values files, Kubernetes manifests, Dockerfiles, compose files
+  - `db-migration`: migration directories or files, schema definition files, ORM model changes that generate schema changes
+  - `ci-cd`: workflow/pipeline files — `.github/workflows/*`, GitLab CI config, or equivalent pipeline definitions
+
   ## Sibling Roster Broadcast
 
   After spawning ALL file-reviewers (collecting their IDs), send each one a message with the roster:
@@ -106,6 +162,23 @@ instructions: |
 
   Skip binary files and files with only whitespace changes.
 
+  ## Rigor Folding (synthesis)
+
+  Before assembling the final report, fold findings by the resolved quality bar. Folding operates on severity plus the optional `[convention]`/`[correctness]` marker file-reviewers emit in finding titles:
+
+  - **🔴 CRITICAL never folds** — at any rigor, regardless of marker.
+  - **`production`**: nothing folds; report every finding as-is.
+  - **`prototype`**: 🟡 `[convention]` findings and all 🟢 findings move to `## Deferred by quality bar`.
+  - **`poc`**: 🟡 `[convention]` findings move to `## Deferred by quality bar`; 🟢 and 💡 `[convention]` findings are dropped from the report entirely.
+
+  Rules:
+
+  - Folding moves findings between sections; it never rewrites their severity tags.
+  - The `## Deferred by quality bar` section is excluded from the blocking counts (the footer's tallies) and from any block/no-block verdict.
+  - Rigor never suppresses 🔴/🟡 visibility — below-threshold 🟡s are deferred, not deleted. poc's 🟢/💡 `[convention]` drop is the one deliberate visibility exception.
+  - **Dedup:** an identical finding reported by two skills (e.g. a surface skill and an aspect skill like `transactional-integrity` or `logging-discipline`) → keep the aspect skill's copy and drop the duplicate.
+  - Repo-level residue from the domain linter pass lands under the owning surface in Detailed Findings (or Cross-File Concerns when it spans files) and folds by the same rules.
+
   ## Final Report Format
 
   After collecting all file-reviewer results, synthesize into:
@@ -134,8 +207,15 @@ instructions: |
   ## Cross-File Concerns
   <any cross-cutting issues identified by the teammate pattern>
 
+  ## Operational history
+  <only when the lane ran: archaeology + prior-art findings with incident/commit references, or "no relevant incident history found">
+
+  ## Deferred by quality bar
+  <findings folded out of the blocking sections by the resolved rigor, severity tags preserved — excluded from the counts below; omit this section at production or when nothing folded>
+
   ---
-  *Reviewed N files, found X critical, Y warnings, Z suggestions, W nitpicks*
+  *Reviewed N files, found X critical, Y warnings, Z suggestions, W nitpicks (D deferred by quality bar)*
+  *Quality bar: <resolved rigor> — provenance: <passed | plan | detected-default>; surfaces: <resolved surfaces>*
   ```
 
   ## Edge Cases
@@ -150,7 +230,7 @@ instructions: |
   1. **Always use `get_diff` first:** Don't assume what changed
   2. **Spawn in parallel:** All file-reviewers should be spawned before collecting any
   3. **Don't review code yourself:** Delegate ALL review work to file-reviewers
-  4. **Preserve severity tags:** Don't downgrade or remove severity from file-reviewer findings
+  4. **Preserve severity tags:** Don't downgrade or remove severity from file-reviewer findings — rigor folding relocates or (at poc) drops findings per its rules, but never rewrites a severity
   5. **Include ALL findings:** Don't summarize away specific issues
   6. **File reads:** If you do read a file directly (e.g. to verify a finding before synthesis), `fs_read` returns a TRUNCATED view with line numbers (default 2000 lines, long lines cut at 2000 chars). Use `fs_cat` only when you need the FULL untruncated contents of a file.
 
@@ -158,6 +238,6 @@ instructions: |
   - Project: {{project_dir}}
   - CWD: {{__cwd__}}
   - Shell: {{__shell__}}
-  
+
   ## Available Tools:
   {{__tools__}}

assets/agents/coder/README.md

@@ -10,22 +10,30 @@ implement-fix loop enforced as graph edges rather than prose.
 
 ## Workflow
 
-```
-analyze_request (llm + output_schema)   plan + complexity extraction
-        ↓
-route_complexity (script)               opt-out approval gate (complexity ≥ 7)
-        ↓
-gate_approval (approval, optional)
-        ↓
-implement (llm + fs tools)              actual file edits
-        ↓
-verify_build (script)
-        ↓
-verify_tests (script)
-        ↓
-fix_loop_gate (script)                  back-edge to implement (bounded)
-        ↓
-end_success / end_rejected / end_failure
+```mermaid
+flowchart TD
+    resolve_paths{"resolve_paths<br/>script"} --> analyze_request
+    analyze_request["analyze_request<br/>llm + output_schema"] --> route_complexity
+    route_complexity{"route_complexity<br/>script"}
+    route_complexity -->|"complexity ≥ 7"| gate_approval
+    route_complexity -->|else| implement
+    gate_approval{{"gate_approval<br/>approval"}}
+    gate_approval -->|yes| implement
+    gate_approval -->|no| end_rejected
+    implement["implement<br/>llm + fs tools"] --> verify_build
+    verify_build{"verify_build<br/>script"}
+    verify_build -->|pass| verify_tests
+    verify_build -->|fail| fix_loop_gate
+    verify_tests{"verify_tests<br/>script"}
+    verify_tests -->|pass| end_success
+    verify_tests -->|fail| fix_loop_gate
+    fix_loop_gate{"fix_loop_gate<br/>script"}
+    fix_loop_gate -->|"budget left"| implement
+    fix_loop_gate -->|"budget spent"| end_failure
+
+    end_success(["end_success<br/>CODER_COMPLETE"])
+    end_rejected(["end_rejected<br/>CODER_REJECTED"])
+    end_failure(["end_failure<br/>CODER_FAILED"])
 ```
 
 End nodes emit one of three sentinel outcomes for the caller:

assets/agents/coder/graph.yaml

@@ -2,9 +2,9 @@ name: coder
 description: |
   Implementation agent. Plans, implements, and runs build + tests in a
   bounded fix-loop until verified. Designed to be delegated to by sisyphus.
-version: "1.0"
-
+version: '1.0'
 global_tools:
+  - ast_grep.sh
   - fs_cat.sh
   - fs_ls.sh
   - fs_write.sh
@@ -15,6 +15,9 @@ skills_enabled: true
 enabled_skills:
   - ai-slop-remover
   - code-review
+  - comment-discipline
+  - diagnosing-bugs
+  - logging-discipline
   - git-master
   - frontend-ui-ux
   - verification-gates
@@ -25,23 +28,23 @@ variables:
       Absolute path to the project directory. Defaults to "." which is the
       directory you invoked `coyote` from. Override at runtime with
       `coyote -a coder --agent-variable project_dir /abs/path "..."`.
-    default: "."
+    default: '.'
 
 settings:
   max_loop_iterations: 20
   log_state_snapshots: true
   validate_before_run: true
-  timeout: 1800
+  timeout: 14400
 
 initial_state:
-  project_dir: ""
+  project_dir: ''
   fix_attempts: 0
   max_fix_attempts: 3
-  fix_instructions: ""
-  build_output: ""
-  tests_output: ""
-  last_node_output: ""
-  plan_summary: ""
+  fix_instructions: ''
+  build_output: ''
+  tests_output: ''
+  last_node_output: ''
+  plan_summary: ''
   files_to_modify: []
   files_to_create: []
   risks: []
@@ -49,7 +52,7 @@ initial_state:
   review_attempts: 0
   max_review_attempts: 1
   review_clean: true
-  review_notes: ""
+  review_notes: ''
 
 start: resolve_paths
 
@@ -88,8 +91,9 @@ nodes:
       etc. Empty list is fine.
 
       Project directory: {{project_dir}}
-    prompt: "{{initial_prompt}}"
+    prompt: '{{initial_prompt}}'
     tools: []
+    timeout: 300
     output_schema:
       type: object
       properties:
@@ -98,20 +102,27 @@ nodes:
           description: 1-3 sentences summarizing what will be done
         files_to_modify:
           type: array
-          items: {type: string}
+          items: { type: string }
         files_to_create:
           type: array
-          items: {type: string}
+          items: { type: string }
         complexity_score:
           type: integer
           minimum: 1
           maximum: 10
         risks:
           type: array
-          items: {type: string}
-      required: [plan_summary, files_to_modify, files_to_create, complexity_score, risks]
+          items: { type: string }
+      required:
+        [
+          plan_summary,
+          files_to_modify,
+          files_to_create,
+          complexity_score,
+          risks,
+        ]
     state_updates:
-      last_node_output: "{{output}}"
+      last_node_output: '{{output}}'
     fallback: end_failure
     next: route_complexity
 
@@ -144,11 +155,11 @@ nodes:
 
       Approve this plan?
     options:
-      - "yes"
-      - "no"
+      - 'yes'
+      - 'no'
     routes:
-      "yes": implement
-      "no": end_rejected
+      'yes': implement
+      'no': end_rejected
     on_other: end_rejected
 
   implement:
@@ -159,6 +170,9 @@ nodes:
     enabled_skills:
       - ai-slop-remover
       - code-review
+      - comment-discipline
+      - diagnosing-bugs
+      - logging-discipline
       - git-master
       - frontend-ui-ux
       - verification-gates
@@ -169,9 +183,10 @@ nodes:
       ## Skills
 
       Use `skill__list` to see what's available, then `skill__load` the ones
-      that fit the work: `ai-slop-remover` always, `frontend-ui-ux` when
-      touching UI, `git-master` when touching history, `verification-gates`
-      to remember what evidence is required. Unload when a phase ends.
+      that fit the work: `ai-slop-remover` and `comment-discipline` always,
+      `frontend-ui-ux` when touching UI, `git-master` when touching history,
+      `verification-gates` to remember what evidence is required. Unload when
+      a phase ends.
 
       ## Writing code
 
@@ -204,7 +219,16 @@ nodes:
       Before writing ANY file:
       1. Find a similar existing file (grep, then read).
       2. Match its style: imports, naming, structure, error handling.
-      3. Follow the same patterns exactly. Do not invent new ones.
+      3. While reading it, note the repo's comment register per
+         `comment-discipline` (self-documenting / api-documented /
+         comment-heavy) and write comments to match. When the signal is
+         weak, write NO comment.
+      4. If the change touches boundaries, error paths, jobs, or state
+         transitions, also note the logging register per
+         `logging-discipline` (logger, message style, payload vs IDs,
+         level semantics) and match it; with no signal, use its
+         best-judgment defaults.
+      5. Follow the same patterns exactly. Do not invent new ones.
 
       ## Fix loop
 
@@ -212,6 +236,11 @@ nodes:
       the previous attempt failed verification. Read the error, identify
       the minimal fix, apply it. Do not refactor while fixing.
 
+      If the fix is not obvious from the error, or a previous fix attempt
+      for the SAME failure did not stick, `skill__load` `diagnosing-bugs`
+      and follow it: build a red-capable reproduction loop before forming
+      any hypothesis. Do not spend a second attempt on a blind retry.
+
       ## Rules
 
       1. Match existing patterns - read examples first.
@@ -220,6 +249,11 @@ nodes:
          on unfamiliar lints, etc.).
       4. No dead code, no commented-out blocks, no premature abstractions.
       5. End your turn when editing is done. The graph runs verification next.
+      6. VERIFICATION HONESTY: never state that a check, lint, build, or test
+         passed unless you paste its literal command and exit code. A gate
+         that did not run is UNVERIFIED — say so. An honest failure report
+         always beats a success-shaped one; a false "passed" poisons every
+         downstream consumer of your report.
 
       Project directory: {{project_dir}}
     prompt: |
@@ -241,9 +275,10 @@ nodes:
       - fs_write
       - fs_patch
       - execute_command
-    max_iterations: 30
+    max_iterations: 100
+    timeout: 1800
     state_updates:
-      last_node_output: "{{output}}"
+      last_node_output: '{{output}}'
     fallback: end_failure
     next: verify_build
 
@@ -315,6 +350,7 @@ nodes:
       - fs_ls
       - execute_command
     max_iterations: 15
+    timeout: 600
     output_schema:
       type: object
       properties:
@@ -326,7 +362,7 @@ nodes:
           description: Concrete issues found, one per line as file:line - description. Empty when review_clean is true.
       required: [review_clean, review_notes]
     state_updates:
-      last_node_output: "{{output}}"
+      last_node_output: '{{output}}'
     fallback: end_success
     next: route_review_result
 
@@ -372,4 +408,4 @@ nodes:
       {{build_output}}
 
       Last tests output:
-      {{tests_output}}
+      {{tests_output}}

assets/agents/coder/scripts/verify_build.sh

@@ -13,6 +13,7 @@ else
 fi
 
 project_dir=$(echo "$state" | jq -r '.project_dir // "."')
+project_dir=$(resolve_gate_dir "$project_dir")
 
 if [[ -n "${BUILD_CMD:-}" ]]; then
   cmd="$BUILD_CMD"
@@ -24,7 +25,7 @@ fi
 if [[ -z "$cmd" || "$cmd" == "null" ]]; then
   jq -nc '{
     "build_ok": true,
-    "build_output": "(no build/check command available for this project type)",
+    "build_output": "(GATE NOT RUN: no build/check command configured or detected. This is NOT evidence that the build passed — set BUILD_CMD, and never report the build as verified.)",
     "_next": "verify_tests"
   }'
   exit 0

assets/agents/coder/scripts/verify_tests.sh

@@ -13,6 +13,7 @@ else
 fi
 
 project_dir=$(echo "$state" | jq -r '.project_dir // "."')
+project_dir=$(resolve_gate_dir "$project_dir")
 
 if [[ -n "${TEST_CMD:-}" ]]; then
   cmd="$TEST_CMD"
@@ -24,7 +25,7 @@ fi
 if [[ -z "$cmd" || "$cmd" == "null" ]]; then
   jq -nc '{
     "tests_ok": true,
-    "tests_output": "(no test command available for this project type)",
+    "tests_output": "(GATE NOT RUN: no test command configured or detected. This is NOT evidence that tests passed — set TEST_CMD, and never report the suite as green.)",
     "_next": "self_review"
   }'
   exit 0

assets/agents/deep-research/README.md

@@ -22,28 +22,43 @@ agent, this is the file to read alongside the
 
 ## Workflow
 
-17 nodes. `->` is the static route; a script node can also route
-dynamically via `_next`. The `▶▶` line is a parallel super-step —
-those branches run concurrently:
+17 nodes. Solid arrows are static `next` / `routes` edges declared in
+`graph.yaml`; script nodes can also route dynamically via `_next` (shown as
+labeled branches out of the diamond). Dotted arrows show `map` fan-out — the
+`research_each_question` node spawns one `research_one_question` branch per
+sub-question and joins them before continuing.
 
-```
-parse_request (script)              -> bootstrap_research   (or -> ask_topic if no topic)
-ask_topic (input)                   -> bootstrap_research
-bootstrap_research (script)         -> [plan, knowledge_lookup]   ▶▶ parallel
-plan (llm + output_schema)          -> research_each_question
-knowledge_lookup (rag)              -> research_each_question
-research_each_question (map)        -> combine_findings    (spawns one branch per question)
-  └─ research_one_question (llm)    (atomic; runs N×, joins at map)
-combine_findings (script)           -> vet_sources
-vet_sources (llm + custom tool)     -> critique
-critique (llm)                      -> reflexion_gate
-reflexion_gate (script)             -> synthesize  (or -> research_each_question: reflexion loop)
-synthesize (agent: report-writer)   -> verify_sources
-verify_sources (script)             -> approve
-approve (approval)                  -> end_accepted          ("accept")
-                                    -> end_rejected          ("reject")
-                                    -> incorporate_feedback   (any free-form answer)
-incorporate_feedback (script)       -> research_each_question (the human-feedback loop)
+```mermaid
+flowchart TD
+    parse_request{"parse_request<br/>script"}
+    parse_request -->|"topic given"| bootstrap_research
+    parse_request -->|"no topic"| ask_topic
+    ask_topic[/"ask_topic<br/>input"/] --> bootstrap_research
+    bootstrap_research{"bootstrap_research<br/>script"}
+    bootstrap_research --> plan
+    bootstrap_research --> knowledge_lookup
+    plan["plan<br/>llm + output_schema"] --> research_each_question
+    knowledge_lookup[("knowledge_lookup<br/>rag")] --> research_each_question
+    research_each_question[\research_each_question<br/>map/]
+    research_each_question -. "spawns × N" .-> research_one_question["research_one_question<br/>llm + web tools"]
+    research_each_question --> combine_findings
+    combine_findings{"combine_findings<br/>script"} --> vet_sources
+    vet_sources["vet_sources<br/>llm + classify_source"] --> critique
+    critique["critique<br/>llm"] --> reflexion_gate
+    reflexion_gate{"reflexion_gate<br/>script"}
+    reflexion_gate -->|"PASS"| synthesize
+    reflexion_gate -->|"REVISE (budget left)"| research_each_question
+    reflexion_gate -->|"REVISE (budget spent)"| synthesize
+    synthesize[["synthesize<br/>agent → report-writer"]] --> verify_sources
+    verify_sources{"verify_sources<br/>script"} --> approve
+    approve{{"approve<br/>approval"}}
+    approve -->|"accept"| end_accepted
+    approve -->|"reject"| end_rejected
+    approve -->|"other (free-form feedback)"| incorporate_feedback
+    incorporate_feedback{"incorporate_feedback<br/>script"} --> research_each_question
+
+    end_accepted(["end_accepted<br/>report"])
+    end_rejected(["end_rejected"])
 ```
 
 ### Node-type breakdown

assets/agents/explore/config.yaml

@@ -1,5 +1,5 @@
 name: explore
-description: Fast codebase exploration agent - finds patterns, structures, and relevant files. Designed to be fanned out 2-5 in parallel by orchestrators.
+description: Fast codebase exploration agent - finds patterns, structures, and relevant files. Designed to be fanned out in parallel by orchestrators — scale to the number of distinct search angles the task requires.
 version: 3.1.0
 
 skills_enabled: true
@@ -10,16 +10,20 @@ variables:
   - name: project_dir
     description: Project directory to explore
     default: '.'
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
 
 mcp_servers:
   - ddg-search
 global_tools:
+  - web_search_coyote.sh
+  - ast_grep.sh
   - fs_read.sh
   - fs_cat.sh
   - fs_grep.sh
   - fs_glob.sh
   - fs_ls.sh
-  - ast_grep.sh
 
 instructions: |
   You are a codebase explorer. Your job: Search, find, report. Nothing else.
@@ -34,7 +38,7 @@ instructions: |
 
   ## You may be one of many parallel explorers
 
-  Orchestrators (like Sisyphus) often fan out 2-5 explore agents at once, each covering a different angle of the same question. Assume you are ONE narrow slice of a larger investigation. Stay strictly within YOUR slice as defined by the prompt — don't broaden scope to cover what other parallel explorers might be handling.
+  Orchestrators (like Sisyphus) fan out as many explore agents as the task warrants — one per distinct search angle, module boundary, or concern. You may be one of many running in parallel. Assume you are ONE narrow slice of a larger investigation. Stay strictly within YOUR slice as defined by the prompt — don't broaden scope to cover what other parallel explorers might be handling.
 
   If the prompt says "find auth middleware", you find auth middleware. You do NOT also tour the routing layer, the error system, and the database connection pool. Narrow scope is the contract.
 

assets/agents/file-reviewer/README.md

@@ -16,7 +16,7 @@ one file while communicating with sibling agents to catch issues that span multi
 ## Pro-Tip: Use an IDE MCP Server for Improved Performance
 Many modern IDEs now include MCP servers that let LLMs perform operations within the IDE itself and use IDE tools. Using
 an IDE's MCP server dramatically improves the performance of coding agents. So if you have an IDE, try adding that MCP
-server to your config (see the [MCP Server docs](../../../docs/function-calling/MCP-SERVERS.md) to see how to configure
+server to your config (see the [MCP Server docs](https://github.com/Dark-Alex-17/coyote/wiki/MCP-Servers) to see how to configure
 them), and modify the agent definition to look like this:
 
 ```yaml

assets/agents/file-reviewer/config.yaml

@@ -1,16 +1,28 @@
 name: file-reviewer
 description: Reviews a single file's diff for bugs, style issues, and cross-cutting concerns
-version: 2.0.0
+version: 2.3.0
 
 skills_enabled: true
 enabled_skills:
   - code-review
   - ai-slop-remover
+  - transactional-integrity
+  - logging-discipline
+  - rest-api-review
+  - cli-review
+  - library-review
+  - worker-review
+  - iac-review
+  - migration-review
+  - cicd-review
 
 variables:
   - name: project_dir
     description: Project directory for context
     default: '.'
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
 
 global_tools:
   - fs_read.sh
@@ -26,7 +38,11 @@ instructions: |
 
   Before reading any code, call `skill__load` for `code-review` and `ai-slop-remover`. They carry your detailed review methodology — the categories to check (correctness, tests, clarity, coupling, footguns), the investigation workflow (how to use the fs tools to build context before reviewing), the slop checklist (useless comments, dishonest naming, defensive handling of impossible cases), and the standard for when to flag vs. skip.
 
-  Apply BOTH checklists in every review. Skill bodies are your source of truth for what to flag; this agent's instructions handle workflow and output shape.
+  Additionally load `transactional-integrity` when the diff touches state-changing code — database writes, transaction blocks, queue/webhook/job handlers, retry logic, or calls to external state-holding systems. It carries the atomicity/race/idempotency/dual-write checklist that generic correctness review misses. Skip it for pure reads, UI, and stateless computation.
+
+  Also load `logging-discipline` when the diff touches boundaries, error paths, background jobs, or state transitions. It carries the under-/over-logging checks (silent new failure paths, log-and-rethrow duplication, register mismatches, deleted log lines operators may grep for). Skip it for diffs with no operational surface.
+
+  Apply every loaded checklist in every review. Skill bodies are your source of truth for what to flag; this agent's instructions handle workflow and output shape.
 
   ## Your Mission
 
@@ -109,6 +125,10 @@ instructions: |
   - **🟢 SUGGESTION** — Clarity, coupling, naming, footgun mitigations, missing tests for the change
   - **💡 NITPICK** — Style if no formatter enforces it, minor naming, slop-remover findings on prose-style comments
 
+  ### The `[convention]` / `[correctness]` marker
+
+  Finding titles may optionally carry a `[convention]` or `[correctness]` marker (e.g. `#### [convention] Collection endpoint without pagination`). Emit a marker only when a loaded skill instructs you to: `[convention]` tags contract/convention-adherence findings, `[correctness]` tags contract-breaking findings such as a semver violation or an exit-code inversion. The marker rides in the title verbatim and changes nothing about how you assign severity — folding and rejection semantics live downstream in the orchestrators, not here. The severity mapping above is unchanged.
+
   ## Rules
 
   1. **Be specific.** Reference exact line numbers and code.

assets/agents/gatekeeper/README.md

@@ -0,0 +1,77 @@
+# Gatekeeper
+
+A **plan self-containedness gate**. Audits a plan against the "sealed container" standard before it
+is finalized:
+
+> A context-free LLM implementer must be able to execute the plan using ONLY what is on the page —
+> every question it will hit mid-implementation is either **answered inline** or **delegated via a
+> verified pointer** to the exact code/docs where the answer lives.
+
+Where [`plan-review`](../../skills/plan-review/SKILL.md) (via `oracle`) judges the *approach*
+(executability, verifiability, ordering), `gatekeeper` audits the *context*: does the implementer
+know where infrastructure code goes, what DB tech to use (RDS vs in-cluster Postgres), which
+directory layout to mirror, what commands verify the work — or at least where to look?
+
+## The three review gates
+
+| Gate | Agent | Question | When |
+|------|-------|----------|------|
+| Self-containedness | `gatekeeper` | "Can a context-free LLM implement from this file alone?" | Before the plan is finalized |
+| Executability | `oracle` + `plan-review` | "Is the approach sound, verifiable, correctly ordered?" | Before the plan is promoted |
+| Conformance | [`adversary`](../adversary/README.md) | "Is the built code what the plan asked for?" | After implementation |
+
+## How it audits
+
+Driven by the [`plan-gatekeeping`](../../skills/plan-gatekeeping/SKILL.md) skill:
+
+1. Walks a 10-category manifest: code placement, infrastructure, data layer, interfaces/contracts,
+   conventions/tooling, testing/verification, dependencies/ordering, config/secrets, scope
+   boundaries, settled decisions.
+2. For each category: answered inline, delegated via pointer, or **missing**.
+3. **Verifies every pointer** with read-only tools — the path exists AND actually covers the claimed
+   topic. A pointer to a file that never mentions the topic is a leak wearing a pointer costume.
+4. Phrases each gap as the question the implementer would actually ask, tagged **BLOCKING** (will
+   guess wrong) or **FRICTION** (will waste time rediscovering).
+
+## Verdict (blocking)
+
+```
+PLAN_GATE: SEALED
+Categories audited: N applicable, all answered or pointed.
+```
+
+```
+PLAN_GATE: LEAKY
+Missing questions (N):
+1. [infrastructure] Where do I put the Terraform for the new service DB — infra/rds/ or a separate repo? — BLOCKING — plan says "provision a database" with no target — add inline: "RDS via infra/rds/, mirror rate_cards.tf"
+Broken pointers (if any):
+- "see docs/db.md for conventions" — path missing
+```
+
+`LEAKY` blocks finalization. The caller (typically `architect`) answers the questions — by exploring
+the code repos, reading docs, or asking the user — amends the plan, and re-submits to the SAME
+gatekeeper session until it seals.
+
+## Usage
+
+Spawned by `architect` during design-doc decomposition (Phase B/C), before the `oracle` plan-review:
+
+```sh
+agent__spawn --agent gatekeeper --prompt "Audit this plan for self-containedness. Return SEALED/LEAKY.
+
+Plan: <plans_dir>/PLAN-<slug>.md
+Target project: <project_dir>"
+```
+
+Ad-hoc use against any plan file:
+
+```sh
+coyote -a gatekeeper --agent-variable project_dir ~/code/my-service \
+  "Audit plans/PLAN-my-feature.md for self-containedness"
+```
+
+## Related
+
+- [`plan-gatekeeping`](../../skills/plan-gatekeeping/SKILL.md) — the manifest + methodology it runs on.
+- [`architect`](../architect/README.md) — the orchestrator that gates plans through it.
+- [`adversary`](../adversary/README.md) — the post-implementation conformance counterpart.

assets/agents/gatekeeper/config.yaml

@@ -0,0 +1,102 @@
+name: gatekeeper
+description: Plan self-containedness gate - audits a plan against the "sealed container" standard (every implementer question answered inline or via a verified pointer to code/docs) and returns a blocking PLAN_GATE SEALED/LEAKY verdict with the missing questions. Designed to be delegated to by architect before plans are finalized.
+version: 2.0.0
+
+auto_continue: true
+max_auto_continues: 15
+inject_todo_instructions: true
+
+skills_enabled: true
+enabled_skills:
+  - plan-gatekeeping
+
+variables:
+  - name: project_dir
+    description: Absolute path to the project the plan targets - the ground truth for pointer verification
+    default: '.'
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_cat.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+
+instructions: |
+  You are the plan gatekeeper. You audit ONE plan for **self-containedness** before it is finalized:
+  the "sealed container" test. A context-free LLM implementer must be able to execute the plan using
+  ONLY what is on the page — every question it will hit mid-implementation must be answered inline or
+  delegated via a verified pointer to the exact code/docs where the answer lives. Your output is the
+  list of questions the plan FAILS to answer, and a blocking verdict.
+
+  You are NOT the approach reviewer (`plan-review` judges executability/verifiability of the design).
+  You audit completeness of CONTEXT. A brilliant approach with no answer to "where does the infra
+  code go?" or "managed RDS or an in-cluster Postgres container?" fails your gate.
+
+  ## Step 0: Load the skill
+
+  Before anything else, `skill__load` `plan-gatekeeping`. It carries your methodology: the
+  answer-or-pointer rule, the 10-category manifest (code placement, infrastructure, data layer,
+  interfaces, conventions, testing, dependencies, config/secrets, scope, settled decisions), pointer
+  verification, severity tagging, and the exact verdict format. The skill body is your source of
+  truth; these instructions handle workflow and I/O.
+
+  ## Input (the spawn prompt IS your entire context)
+
+  You are given a plan to audit — pasted inline or as a path to read. You may also be told which
+  project the plan targets; default ground truth is {{project_dir}}. Any other local repos/docs the
+  plan points into are readable for pointer verification.
+
+  If no plan is provided, STOP and say so.
+
+  ## Workflow
+
+  1. Load `plan-gatekeeping`.
+  2. Read the plan in full (`fs_cat` for the whole file — do not audit a truncated view).
+  3. Walk EVERY manifest category. For each: answered inline, delegated via pointer, or MISSING.
+     Mark inapplicable categories explicitly.
+  4. Verify every pointer with the read-only tools: the path exists AND the target actually covers
+     the claimed topic. Check "mirror the layout of X" claims against X itself.
+  5. Phrase each gap as the QUESTION the implementer would actually ask, tag it BLOCKING or
+     FRICTION, and suggest the fix — an inline answer or a pointer you have VERIFIED resolves.
+  6. Emit the verdict in the skill's exact format.
+
+  ## Output — verdict (MANDATORY, exact format)
+
+  End with EXACTLY one of these sentinels so the caller can route on it:
+
+  ```
+  PLAN_GATE: SEALED
+  Categories audited: N applicable, all answered or pointed.
+  ```
+
+  ```
+  PLAN_GATE: LEAKY
+  Missing questions (N):
+  1. [category] <implementer's actual question> — [BLOCKING|FRICTION] — <why they get stuck> — <suggested fix>
+  Broken pointers (if any):
+  - <pointer> — <path missing | doesn't cover topic>
+  ```
+
+  ## Rules
+
+  1. **You are read-only.** Never modify the plan. You produce questions; the author owns the fixes.
+  2. **Questions, not complaints.** "Infra section is thin" is noise. "Where do I put the Terraform
+     for the new database — {{project_dir}}/infra/ or a separate repo?" is signal.
+  3. **Verify every pointer you check AND every pointer you suggest.** Recommending an unverified
+     pointer is the same leak you exist to catch.
+  4. **BLOCKING findings always mean LEAKY.** Only-FRICTION findings: note the caller may seal at
+     their discretion.
+  5. **Do not re-litigate the approach.** Coherent-but-underdocumented means the fix is context.
+  6. Be terse and decisive. Three BLOCKING questions beat fifteen nitpicks.
+
+  ## Context
+  - Project (ground truth): {{project_dir}}
+  - CWD: {{__cwd__}}
+
+  ## Available Tools
+  {{__tools__}}

assets/agents/librarian/README.md

@@ -10,13 +10,26 @@ library, API, or framework is involved.
 
 ## Workflow
 
+```mermaid
+flowchart TD
+    triage["triage<br/>llm"] --> search
+    triage --> search_oss
+    triage -.->|"fallback"| end_failure
+    search["search<br/>llm + ddg-search MCP"] --> synthesize
+    search_oss["search_oss<br/>llm + personal-github MCP"] --> synthesize
+    synthesize["synthesize<br/>llm + fetch_url_via_curl"] --> final_format
+    final_format{"final_format<br/>script"} --> end_success
+
+    end_success(["end_success<br/>LIBRARIAN_COMPLETE"])
+    end_failure(["end_failure<br/>LIBRARIAN_FAILED"])
 ```
-search (llm + ddg-search)         identify 3-5 authoritative sources
-   ↓
-synthesize (llm + fetch_url_via_curl)   fetch, extract, cite, synthesize
-   ↓
-end_success / end_failure         LIBRARIAN_COMPLETE / LIBRARIAN_FAILED
-```
+
+`triage` parses the prompt into language / doc-domain / query hints, then fans
+out to `search` (authoritative docs via `ddg-search`) and `search_oss`
+(production OSS examples via the `personal-github` MCP) in parallel. Both feed
+into `synthesize`, which fetches each URL and produces a citation-backed
+findings block. `final_format` (script) trims any LLM preamble before the
+`LIBRARIAN_COMPLETE` sentinel is emitted.
 
 Iteration 1 (this) is the happy-path MVP: single search pass, single synthesis
 pass, no quality-check loop. Future iterations may add:

assets/agents/librarian/graph.yaml

@@ -8,11 +8,10 @@ description: |
   sisyphus alongside explore when unfamiliar libraries/APIs/frameworks are
   involved.
 
-  Iteration 3: smart triage node up front + final-format trim of LLM
-  narrative leakage.
-version: "1.0"
+version: '1.0'
 
 global_tools:
+  - web_search_coyote.sh
   - fetch_url_via_curl.sh
 
 mcp_servers:
@@ -37,13 +36,13 @@ reducers:
   output: overwrite
 
 initial_state:
-  language_ecosystem: "general"
-  doc_domain_hints: ""
-  refined_search_query: ""
-  question_type: "concept"
-  search_output: ""
-  oss_output: ""
-  findings: ""
+  language_ecosystem: 'general'
+  doc_domain_hints: ''
+  refined_search_query: ''
+  question_type: 'concept'
+  search_output: ''
+  oss_output: ''
+  findings: ''
 
 start: triage
 
@@ -90,7 +89,6 @@ nodes:
     prompt: |
       Research prompt: {{initial_prompt}}
     tools: []
-    temperature: 0.1
     output_schema:
       type: object
       properties:
@@ -107,9 +105,15 @@ nodes:
           type: string
           enum: [api_reference, best_practice, debugging, concept]
           description: The kind of question being asked.
-      required: [language_ecosystem, doc_domain_hints, refined_search_query, question_type]
+      required:
+        [
+          language_ecosystem,
+          doc_domain_hints,
+          refined_search_query,
+          question_type,
+        ]
     state_updates:
-      last_node_output: "{{output}}"
+      last_node_output: '{{output}}'
     fallback: end_failure
     next: [search, search_oss]
 
@@ -177,14 +181,15 @@ nodes:
         - Refined query: {{refined_search_query}}
         - Question type: {{question_type}}
 
-      Use the ddg-search tool. Prioritize the hinted doc domains when present
-      (e.g., search with `site:docs.python.org pathlib` style queries).
+      Use the ddg-search tool or the web_search_coyote tool. Prioritize the
+      hinted doc domains when present (e.g., search with `site:docs.python.org
+      pathlib` style queries).
     tools:
       - mcp:ddg-search
+      - web_search_coyote
     max_iterations: 15
-    temperature: 0.1
     state_updates:
-      search_output: "{{output}}"
+      search_output: '{{output}}'
     fallback: synthesize
     next: synthesize
 
@@ -253,9 +258,8 @@ nodes:
     tools:
       - mcp:personal-github
     max_iterations: 15
-    temperature: 0.1
     state_updates:
-      oss_output: "{{output}}"
+      oss_output: '{{output}}'
     fallback: synthesize
     next: synthesize
 
@@ -340,9 +344,8 @@ nodes:
     tools:
       - fetch_url_via_curl
     max_iterations: 20
-    temperature: 0.1
     state_updates:
-      findings: "{{output}}"
+      findings: '{{output}}'
     fallback: final_format
     next: final_format
 

assets/agents/oracle/config.yaml

@@ -1,11 +1,12 @@
 name: oracle
 description: High-IQ advisor for architecture, debugging, and complex decisions. Blocking by design - the orchestrator is waiting on you.
-version: 2.1.0
+version: 2.2.0
 
 skills_enabled: true
 enabled_skills:
   - code-review
   - ai-slop-remover
+  - codebase-design
   - plan-review
   - plan-authoring
   - iwe-knowledge-base
@@ -14,10 +15,15 @@ variables:
   - name: project_dir
     description: Project directory for context
     default: '.'
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
 
 mcp_servers:
   - ddg-search
 global_tools:
+  - web_search_coyote.sh
+  - ast_grep.sh
   - fs_read.sh
   - fs_cat.sh
   - fs_grep.sh
@@ -57,6 +63,7 @@ instructions: |
 
   - `skill__load code-review` — when reviewing a diff or existing code; gives you a focused review checklist.
   - `skill__load ai-slop-remover` — when judging code quality (especially for advising on cleanups).
+  - `skill__load codebase-design` — when advising on module/interface design, seam placement, testability, or refactoring structure; gives you the deep-module vocabulary (module, interface, depth, seam, adapter, leverage, locality) and its principles. Use those terms exactly.
   - `skill__load plan-review` — when asked to review an implementation plan; adversarial checklist plus the PLAN_REVIEW verdict format. Load `plan-authoring` alongside it — it defines the plan schema you are checking against.
   - `skill__load iwe-knowledge-base` — when the plans live in a large markdown corpus; navigate it structurally instead of globbing.
 

assets/agents/probe/README.md

@@ -0,0 +1,124 @@
+# Probe
+
+A **black-box usage-pattern verifier**. Where every other reviewer reads *text* — the diff
+([`code-reviewer`](../code-reviewer/README.md)), the plan ([`adversary`](../adversary/README.md)),
+the attack surface ([`security-reviewer`](../security-reviewer/README.md)) — `probe` asks the one
+question none of them can answer without running the thing:
+
+> **"Does the changed consumer-facing surface actually behave as the spec promises when used,
+> starting from nothing?"**
+
+It boots the system locally from a clean slate, runs any existing usage suites first (regression
+check), derives expected behaviors from the **spec** — never the implementation — and authors
+tests for the uncovered usage patterns: cold-start/empty-state calls, idempotent re-calls, invalid
+input, auth on new routes, partial-update (patch-vs-replace) semantics, serialization edges,
+pagination limits, error-shape consistency. These are exactly the defects invisible to static
+review.
+
+## Why it's separate from the other reviewers
+
+| | `code-reviewer` | `adversary` | `security-reviewer` | `probe` |
+|---|---|---|---|---|
+| Question | Is the code good? | Does it match the plan? | Can it be abused? | Does it *work* when used? |
+| Method | Reads the diff | Diff vs. criteria | Source→sink tracing | **Runs the system**, black-box |
+| Blind spot it covers | slop, bugs, coupling | skipped criteria, drift | injection, authz gaps | behavioral quirks, regressions, contract surprises |
+| Output | severity findings | `CONFORMS`/`DIVERGES` | `PASS`/`FAIL` | `PASS`/`FAIL`/`INCONCLUSIVE` |
+
+The independence is behavioral: expectations are written from the spec/contract **before** reading
+handler code, so the implementer's misreadings can't become the probe's assertions — the same
+principle that makes `adversary` valuable, applied to runtime behavior.
+
+## Verdict (blocking, three-way)
+
+```
+USAGE_PROBE: PASS
+Surface: <...>. Existing suites: <N run, all green | none found>. New tests: <M authored at <path>, all green>.
+```
+
+```
+USAGE_PROBE: FAIL
+Behavioral findings:
+1. <surface + case> — <spec'd behavior> — <observed behavior> — REPRO: <exact request + response> — <test file>
+```
+
+```
+USAGE_PROBE: INCONCLUSIVE
+Could not establish a clean local environment: <verbatim error>. Missing: <the recipe/fixture that would unblock>.
+```
+
+- **`FAIL` blocks completion** — the caller resumes the SAME implementer session with the findings
+  pasted verbatim, then re-runs `probe` once to confirm.
+- **`INCONCLUSIVE` is the honest third state**: the environment, not the code, is the blocker. It
+  routes the fix to the local-run recipe (often a plan gap the `gatekeeper` should have caught) and
+  is never disguised as `PASS` or `FAIL`.
+
+Every `FAIL` finding carries an exact reproduction (request/command + response received) and the
+test file that proves it.
+
+## How it probes
+
+Driven by the [`usage-pattern-testing`](../../skills/usage-pattern-testing/SKILL.md) skill:
+
+1. **Spec first** — expected behaviors written from acceptance criteria + API contract before any
+   implementation reads.
+2. **Regression first** — discover and run existing usage suites; every failure classified as
+   BUG / EXPECTED-CHANGE / ENV before anything new is authored.
+3. **Delta only** — new tests cover only the usage patterns existing suites miss, written in the
+   repo's suite conventions so they're adoptable as permanent regression coverage.
+4. **Clean, local, isolated** — ephemeral state, mocked externals, full teardown; bounded retries
+   for startup only, never to mask flakiness.
+
+Toolbox by surface — the repo's existing suite format always comes first, and these are examples,
+not requirements: [Hurl](https://hurl.dev) or `curl` scripts for HTTP/REST/JSON (Hurl files double
+as committed suites), `grpcurl` for pure gRPC, direct invocation for CLIs.
+
+Unlike the read-only reviewers, `probe` **writes test files** (and only test files) — the tests
+are a deliverable alongside the verdict. It never modifies implementation code.
+
+## Usage
+
+Spawned by `sisyphus` (post-coder, when the change touches consumer-facing surface) or `architect`
+(Phase E, alongside `adversary`). The spawn prompt IS its entire context — include the change, the
+spec, and the local-run recipe:
+
+```sh
+agent__spawn --agent probe --prompt "
+## TASK
+Probe the changed API surface for TASK-NNN from the consumer's perspective. Return PASS/FAIL/INCONCLUSIVE.
+
+## CHANGE
+Run get_diff --base <ref>, or: <paste the changed-surface summary>
+
+## SPEC — expected behavior to verify against
+<paste acceptance criteria + API contract sections (or contract file paths) VERBATIM>
+
+## LOCAL-RUN RECIPE
+<how to boot the stack clean: build, deps/stubs, ports, migrations, teardown — or the doc that has it>
+
+## EXISTING SUITES
+<paths + run commands, or 'discover them'>
+"
+```
+
+Direct invocation for ad-hoc use:
+
+```sh
+coyote -a probe --agent-variable project_dir /path/to/repo \
+  "Probe the /widgets endpoints changed in the last commit against this spec: <paste spec>"
+```
+
+### Tools
+
+- `get_diff [--base <ref>]` — staged → unstaged → `HEAD~1` fallback (or an explicit base SHA/branch) to locate the changed surface.
+- `get_changed_files [--base <ref>]` — quick changed-file map.
+- Plus `fs_*`/`ast_grep` for suite discovery and contract reads, `fs_write`/`fs_patch` for authoring test files, and `execute_command` for booting the stack and running suites.
+- Probing tools (`curl`, Hurl, grpcurl, the repo's own harness) are invoked via `execute_command`
+  (no wrapper tool — probing needs their full CLI surface), and none is a hard requirement: the
+  [`usage-pattern-testing`](../../skills/usage-pattern-testing/SKILL.md) skill has probe reuse the repo's existing suite tooling first and fall back to what's available.
+  The optional [`sbx-mixin.yaml`](sbx-mixin.yaml) preinstalls Hurl + grpcurl for sandbox runs.
+
+## Related
+
+- [`usage-pattern-testing`](../../skills/usage-pattern-testing/SKILL.md) — the methodology it runs on.
+- [`adversary`](../adversary/README.md) — static plan-conformance counterpart (text), where `probe` is dynamic (behavior).
+- [`gatekeeper`](../gatekeeper/README.md) — ensures plans ship the local-run recipe `probe` consumes.

assets/agents/probe/config.yaml

@@ -0,0 +1,129 @@
+name: probe
+description: Black-box usage-pattern verifier - exercises a change's consumer-facing surface (HTTP APIs, RPCs, CLIs) as a real cold-start consumer against a locally running instance with clean, isolated state. Runs existing usage suites first for regressions (whatever format the repo uses - Hurl files, curl scripts, collections), authors spec-first tests for uncovered patterns in the repo's suite conventions (tools like Hurl and grpcurl are examples, not requirements), and returns a blocking USAGE_PROBE PASS/FAIL/INCONCLUSIVE verdict. Complements code-reviewer (quality), adversary (plan conformance), and security-reviewer (abuse). Designed to be delegated to by sisyphus and architect.
+version: 1.0.0
+
+auto_continue: true
+max_auto_continues: 25
+inject_todo_instructions: true
+
+skills_enabled: true
+enabled_skills:
+  - usage-pattern-testing
+
+variables:
+  - name: project_dir
+    description: Project directory containing the change under test - where suites are discovered, the stack is booted, and new tests are written
+    default: '.'
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_cat.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+  - fs_write.sh
+  - fs_patch.sh
+  - execute_command.sh
+
+instructions: |
+  You are the usage-pattern probe. You answer ONE question: **does the changed consumer-facing
+  surface actually behave as the spec promises when used, starting from a clean slate?** Every
+  other reviewer reads text — the diff, the plan, the code. You are the only gate that BOOTS the
+  system locally and exercises it the way a consumer will: cold, black-box, spec-first.
+
+  You are NOT the code-quality reviewer (`code-reviewer`), NOT the plan-conformance reviewer
+  (`adversary`), and NOT the security reviewer (`security-reviewer`). You judge observable
+  behavior. Your value is behavioral independence: expectations derived from the spec BEFORE
+  reading the implementation, so the implementer's misreadings cannot become your assertions.
+
+  ## Step 0: Load the skill
+
+  Before anything else, `skill__load` `usage-pattern-testing`. It carries your methodology: the
+  spec-first independence rule, the regression-first protocol (find and run existing suites before
+  authoring anything), the usage-pattern checklist (cold start, idempotency, invalid input, auth,
+  partial-update semantics, serialization edges, pagination, error shapes), the clean-environment
+  discipline, the failure-classification table (BUG / EXPECTED-CHANGE / ENV), the per-surface
+  toolbox (the repo's existing suite tooling comes first; Hurl/curl for HTTP, grpcurl for gRPC,
+  and direct invocation for CLIs are examples, not requirements), and the exact verdict format.
+  The skill body is your source of truth for HOW to probe; these instructions handle
+  workflow and I/O.
+
+  ## Input (the spawn prompt IS your entire context)
+
+  You are given:
+  1. **The change** — a diff pasted inline, a summary of the changed surface, or an instruction to
+     run `git diff`/`get_diff` (optionally against a base ref) in {{project_dir}}.
+  2. **The spec** — acceptance criteria, plan section, or API contract (or paths to the contract
+     files: IDL/schema/OpenAPI/proto). This is what you derive expected behaviors FROM.
+  3. **A local-run recipe** (strongly preferred) — how to boot the system locally from a clean
+     state: build command, dependencies to start/stub, ports, migration/seed steps, teardown. If
+     absent, look for one in the repo's contributor docs and dev scripts before inventing your own.
+  4. **Pointers to existing usage suites** (optional) — where black-box tests already live and how
+     to run them. If absent, discover them per the skill.
+
+  If the spec is missing, STOP and say so: behavior cannot be judged without a promise to judge
+  against. Do not infer the spec from the implementation.
+
+  ## Workflow
+
+  1. Load `usage-pattern-testing`.
+  2. Identify the changed consumer-facing surface from the diff/summary. No consumer-facing surface
+     → return PASS with a one-line "no probeable surface" note; do not boot anything.
+  3. **Spec first:** write down expected behaviors as concrete request→response pairs from the
+     spec/contract, BEFORE reading handler code (implementation reads are for ports/config/startup
+     wiring only).
+  4. Discover existing usage suites; bring up the clean local environment per the recipe; run the
+     existing suites FIRST and classify every failure (regression vs expected contract change vs
+     environment).
+  5. Map existing coverage against your expected behaviors; author tests for the uncovered
+     patterns only, in the repo's suite location and conventions, walking the skill's
+     usage-pattern checklist.
+  6. Run the new tests. Classify every failure. Reproduce non-deterministic results twice and read
+     the server logs before classifying.
+  7. Tear the environment down. Emit the verdict in the skill's exact format.
+
+  ## Output — verdict (MANDATORY, exact format)
+
+  End with EXACTLY one of the skill's three sentinels so the caller can route on it:
+
+  - `USAGE_PROBE: PASS` — existing suites green (or none), new spec-first tests green. List
+    surface probed, suites run, and tests authored (with paths, so the caller can adopt them).
+  - `USAGE_PROBE: FAIL` — behavioral findings, each with the spec'd behavior quoted, the observed
+    behavior, the EXACT reproduction (request/command + response received), and the test file.
+  - `USAGE_PROBE: INCONCLUSIVE` — a clean local environment could not be established. State what
+    failed verbatim and EXACTLY what recipe/fixture/mock would unblock. Include any partial
+    results. INCONCLUSIVE is honest and routes the fix to the environment recipe — NEVER disguise
+    it as PASS or FAIL.
+
+  ## Rules
+
+  1. **Never modify implementation code.** Your only writes are new/updated TEST files (in the
+     repo's suite conventions) and throwaway environment scaffolding you tear down. The
+     implementer owns all fixes.
+  2. **Spec-first or nothing.** Expectations written from the spec before implementation reads.
+     If the spec and the contract files disagree, that is a finding — report it, don't pick one
+     silently.
+  3. **Regressions before new coverage.** Existing suites run first; a regression is only
+     acceptable when the spec explicitly changed that contract (then flag the stale test for
+     update — never delete or silence it).
+  4. **Clean, local, isolated.** Fresh ephemeral state, mocked externals, no dependence on
+     pre-existing data or running services, full teardown. Bounded retries for startup only —
+     never to mask a flaky assertion.
+  5. **Classify every failure** as BUG / EXPECTED-CHANGE / ENV per the skill table. The verdict
+     depends on the classification being honest.
+  6. **Committed tests are the deliverable** alongside the verdict: write them where the repo's
+     suites live so the caller can adopt them as permanent regression coverage. Report their paths.
+  7. Be terse and decisive. Three reproducible behavioral findings beat fifteen speculative ones.
+     If everything works as spec'd, it PASSes — say so.
+
+  ## Context
+  - Project: {{project_dir}}
+  - CWD: {{__cwd__}}
+  - Shell: {{__shell__}}
+
+  ## Available Tools
+  {{__tools__}}

assets/agents/probe/sbx-mixin.yaml

@@ -0,0 +1,77 @@
+schemaVersion: '2'
+kind: mixin
+name: agent-probe
+description: >
+  Optional convenience for the probe agent: preinstalls Hurl (HTTP
+  usage-pattern tests) and grpcurl (gRPC probing) — the example tools its
+  skill reaches for — and allows the GitHub release endpoints the fallback
+  installers download from. Neither tool is required: probe reuses the repo's
+  existing suite tooling first and falls back to what's available. Hurl
+  prefers the distro package: the prebuilt GitHub tarball dynamically links
+  libxml2.so.2, which newer distros no longer ship (e.g. Ubuntu 26.04 moved
+  to libxml2.so.16). The services under probe run on localhost, which needs
+  no network allowance. POSIX-only: sbx runs these commands with /bin/sh (dash).
+
+permissions:
+  network:
+    allow:
+      # Latest-release lookup + tarball downloads (GitHub redirects release
+      # assets to *.githubusercontent.com object hosts)
+      - 'api.github.com:443'
+      - 'github.com:443'
+      - 'objects.githubusercontent.com:443'
+      - 'release-assets.githubusercontent.com:443'
+
+setup:
+  install:
+    - command: |
+        set -eu
+        if command -v hurl >/dev/null 2>&1; then
+          hurl --version
+          exit 0
+        fi
+        if command -v apt-get >/dev/null 2>&1; then
+          sudo apt-get update
+          if apt-cache policy hurl 2>/dev/null | grep -q 'Candidate: [0-9]'; then
+            sudo apt-get install -y --no-install-recommends hurl
+            hurl --version
+            exit 0
+          fi
+        fi
+        arch="$(uname -m)"
+        case "$arch" in
+          aarch64|arm64) arch="aarch64" ;;
+          *) arch="x86_64" ;;
+        esac
+        curl -fsSL https://api.github.com/repos/Orange-OpenSource/hurl/releases/latest -o /tmp/hurl-release.json
+        ver="$(sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p' /tmp/hurl-release.json | head -1)"
+        curl -fsSL "https://github.com/Orange-OpenSource/hurl/releases/download/${ver}/hurl-${ver}-${arch}-unknown-linux-gnu.tar.gz" -o /tmp/hurl.tgz
+        mkdir -p /tmp/hurl-extract
+        tar -xzf /tmp/hurl.tgz -C /tmp/hurl-extract
+        bin="$(find /tmp/hurl-extract -type f -name hurl | head -1)"
+        sudo install -m 0755 "$bin" /usr/local/bin/hurl
+        rm -rf /tmp/hurl.tgz /tmp/hurl-extract /tmp/hurl-release.json
+        hurl --version
+      user: '1000'
+      description: Install Hurl (distro package preferred, GitHub tarball fallback) for the probe agent's HTTP usage-pattern tests
+    - command: |
+        set -eu
+        if command -v grpcurl >/dev/null 2>&1; then
+          grpcurl -version
+          exit 0
+        fi
+        arch="$(uname -m)"
+        case "$arch" in
+          aarch64|arm64) arch="arm64" ;;
+          *) arch="x86_64" ;;
+        esac
+        curl -fsSL https://api.github.com/repos/fullstorydev/grpcurl/releases/latest -o /tmp/grpcurl-release.json
+        ver="$(sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p' /tmp/grpcurl-release.json | head -1)"
+        curl -fsSL "https://github.com/fullstorydev/grpcurl/releases/download/v${ver}/grpcurl_${ver}_linux_${arch}.tar.gz" -o /tmp/grpcurl.tgz
+        mkdir -p /tmp/grpcurl-extract
+        tar -xzf /tmp/grpcurl.tgz -C /tmp/grpcurl-extract
+        sudo install -m 0755 /tmp/grpcurl-extract/grpcurl /usr/local/bin/grpcurl
+        rm -rf /tmp/grpcurl.tgz /tmp/grpcurl-extract /tmp/grpcurl-release.json
+        grpcurl -version
+      user: '1000'
+      description: Install grpcurl (static GitHub release binary) for the probe agent's gRPC probes

assets/agents/probe/tools.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# @env LLM_OUTPUT=/dev/stdout
+# @env LLM_AGENT_VAR_PROJECT_DIR=.
+# @describe Usage-pattern probe tools
+
+_project_dir() {
+  local dir="${LLM_AGENT_VAR_PROJECT_DIR:-.}"
+  (cd "${dir}" 2>/dev/null && pwd) || echo "${dir}"
+}
+
+# @cmd Get the git diff whose consumer-facing surface is under probe. Returns staged changes, or unstaged if nothing is staged, or the HEAD~1 diff if the working tree is clean.
+# @option --base Optional base ref to diff against (e.g., "main", "HEAD~3", a commit SHA, or a task's base SHA)
+get_diff() {
+  local project_dir
+  project_dir=$(_project_dir)
+  # shellcheck disable=SC2154
+  local base="${argc_base:-}"
+
+  local diff_output=""
+  if [[ -n "${base}" ]]; then
+    diff_output=$(cd "${project_dir}" && git diff "${base}" 2>&1) || true
+  else
+    diff_output=$(cd "${project_dir}" && git diff --cached 2>&1) || true
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff 2>&1) || true
+    fi
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${diff_output}" ]]; then
+    echo "No changes found to probe in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  local file_count
+  file_count=$(echo "${diff_output}" | grep -c '^diff --git' || true)
+  {
+    echo "Diff contains changes to ${file_count} file(s):"
+    echo ""
+    echo "${diff_output}"
+  } >> "$LLM_OUTPUT"
+}
+
+# @cmd Get the list of changed files with stats (a quick map for locating the changed consumer-facing surface).
+# @option --base Optional base ref to diff against
+get_changed_files() {
+  local project_dir
+  project_dir=$(_project_dir)
+  local base="${argc_base:-}"
+
+  local stat_output=""
+  if [[ -n "${base}" ]]; then
+    stat_output=$(cd "${project_dir}" && git diff --stat "${base}" 2>&1) || true
+  else
+    stat_output=$(cd "${project_dir}" && git diff --cached --stat 2>&1) || true
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat 2>&1) || true
+    fi
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${stat_output}" ]]; then
+    echo "No changes found in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  {
+    echo "Changed files:"
+    echo ""
+    echo "${stat_output}"
+  } >> "$LLM_OUTPUT"
+}

assets/agents/security-reviewer/README.md

@@ -0,0 +1,125 @@
+# Security Reviewer
+
+A **security analyst** for code changes. Where [`code-reviewer`](../code-reviewer/README.md) asks
+*"is this code good?"* and [`adversary`](../adversary/README.md) asks *"is this the code the plan
+asked for?"*, `security-reviewer` asks the third orthogonal question:
+
+> **"Can this code be abused?"**
+
+It traces untrusted data from sources (CLI args, HTTP input, file contents, LLM outputs) to
+dangerous sinks (shell, SQL, file paths, deserializers, network) and hunts the classic classes:
+injection, committed secrets, missing authn/authz, path traversal, SSRF, unsafe deserialization,
+supply-chain hazards, weak crypto, and sensitive-data exposure.
+
+## Why it's a third reviewer
+
+| | `code-reviewer` | `adversary` | `security-reviewer` |
+|---|---|---|---|
+| Question | Is the code correct/clean? | Does the code match the plan? | Can the code be abused? |
+| Unit of analysis | per-file diffs (fan-out) | criteria ↔ diff mapping | **data flows across files** |
+| Blind spot it covers | slop, bugs, coupling | skipped criteria, scope drift | source→sink paths, secrets, authz gaps |
+| Output | severity-tagged findings | `CONFORMS` / `DIVERGES` | `PASS` / `FAIL` (posture-gated) |
+
+Security flaws live in the path between an input in one file and a sink in another —
+exactly what a per-file review fans out past, and what acceptance criteria almost never mention.
+
+## Posture-gated blocking
+
+Not every project needs production strictness — a POC shouldn't be blocked on missing rate
+limiting. The `security_posture` variable (or an explicit posture in the spawn prompt) sets the
+blocking threshold:
+
+| Posture | Blocks (FAIL) | Intended for |
+|---|---|---|
+| `prototype` | 🔴 Critical only | POCs, spikes, demos, localhost-only tools |
+| `standard` (default) | 🔴 Critical + 🟠 High | Anything deployed, shared, or built upon |
+| `hardened` | 🔴 + 🟠 + 🟡 Medium | Auth, payments, secrets handling, public-facing, multi-tenant |
+
+Two invariants that do not bend with posture:
+
+1. **Critical always blocks.** A committed secret is Critical in a prototype too — git history
+   outlives the prototype. Same for code that endangers the host machine or third-party systems.
+2. **Posture gates the verdict, not the report.** Non-blocking findings are still listed; the
+   posture only decides PASS/FAIL.
+
+Severity itself is calibrated by **reachability × blast radius**, not vulnerability class: SQL
+injection in a localhost-only debug script is not High, and a "small" secret in a repo is Critical.
+
+## Verdict (blocking on FAIL)
+
+The agent ends every review with one sentinel:
+
+```
+SECURITY_REVIEW: PASS
+Posture: standard. Findings: 0 critical, 0 high, 2 medium, 1 low (none at or above the blocking threshold).
+```
+
+```
+SECURITY_REVIEW: FAIL
+Posture: standard. Findings: 0 critical, 1 high, 1 medium, 0 low.
+Blocking findings:
+1. 🟠 Path traversal — export.rs:88 — 'name' from the HTTP body is joined into the output path with no canonicalization; '../../.ssh/authorized_keys' escapes the export root — canonicalize and verify the prefix before writing
+Non-blocking findings:
+1. 🟡 Sensitive data in logs — auth.rs:41 — bearer token logged at debug level — redact before logging
+```
+
+A `FAIL` verdict **blocks** completion, exactly like adversary's `DIVERGES`. The caller
+(sisyphus/architect) resumes the SAME coder session with the blocking findings pasted verbatim,
+then re-runs `security-reviewer` ONCE to confirm the fix.
+
+Every finding cites `file:line` and articulates the concrete attack path. Vague findings are not
+emitted.
+
+## How it reviews
+
+Driven by the [`security-review`](../../skills/security-review/SKILL.md) skill:
+
+1. **Source→sink tracing** per hunk: where does untrusted data enter, what does it reach, and is
+   the mediation between them real (read the sanitizer, don't trust its name)?
+2. **Ground-truth with read-only tools** (`fs_grep`/`fs_read`/`ast_grep`): confirm the vulnerable
+   path is reachable, confirm callers can deliver untrusted data, compare sibling code for the
+   security controls the new code should have mirrored.
+3. **Posture gating**: severities assigned by exploitability, verdict decided by the threshold.
+
+It is **read-only** — it produces a verdict, never a fix.
+
+## Usage
+
+Typically spawned by `sisyphus` alongside `code-reviewer`/`adversary`. The spawn prompt IS its
+entire context, so include the diff (or a base ref), the posture, and any deployment context:
+
+```sh
+agent__spawn --agent security-reviewer --prompt "
+## TASK
+Security-review the recent changes. Return PASS/FAIL.
+
+## POSTURE
+standard  # or: prototype (this is a throwaway POC) / hardened (this touches auth)
+
+## DIFF
+Run get_diff (or --base main), or: <paste diff>
+
+## DEPLOYMENT CONTEXT
+<what this code is for, who can reach it, whether it will be deployed/shared>
+"
+```
+
+Direct invocation for ad-hoc use:
+
+```sh
+coyote -a security-reviewer --agent-variable security_posture prototype \
+  --agent-variable project_dir /path/to/repo \
+  "Review the staged changes. This is a localhost-only spike."
+```
+
+### Tools
+
+- `get_diff [--base <ref>]` — staged → unstaged → `HEAD~1` fallback (or an explicit base/PR branch).
+- `get_changed_files [--base <ref>]` — quick map of the attack surface.
+- Plus read-only `fs_*` and `ast_grep` for ground-truth checks.
+
+## Related
+
+- [`security-review`](../../skills/security-review/SKILL.md) — the methodology it runs on.
+- [`code-reviewer`](../code-reviewer/README.md) — the quality reviewer it runs alongside.
+- [`adversary`](../adversary/README.md) — the plan-conformance reviewer it runs alongside.

assets/agents/security-reviewer/config.yaml

@@ -0,0 +1,121 @@
+name: security-reviewer
+description: Security analyst - hunts exploitable flaws in a code change (injection, secrets, authz gaps, SSRF, supply chain) by tracing untrusted data to dangerous sinks. Returns a posture-gated PASS/FAIL verdict so POCs aren't held to production strictness. Complements code-reviewer (quality) and adversary (plan conformance). Designed to be delegated to by sisyphus.
+version: 1.0.0
+
+auto_continue: true
+max_auto_continues: 15
+inject_todo_instructions: true
+
+skills_enabled: true
+enabled_skills:
+  - security-review
+
+variables:
+  - name: project_dir
+    description: Project directory containing the changes under review
+    default: '.'
+  - name: security_posture
+    description: Blocking threshold - prototype (Critical only), standard (Critical+High), hardened (Critical+High+Medium)
+    default: standard
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_cat.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+  - execute_command.sh
+
+instructions: |
+  You are a security reviewer. You answer ONE question: **can this code be abused?** You are NOT
+  the code-quality reviewer (that is `code-reviewer`/`file-reviewer`) and NOT the plan-conformance
+  reviewer (that is `adversary`). You hunt exploitable flaws in the CHANGE: injection, committed
+  secrets, missing auth, path traversal, SSRF, unsafe deserialization, supply-chain hazards.
+
+  Your value is attacker mindset applied to fresh code with zero stake in the implementation. The
+  implementer thought about the happy path; you think about the input that lies.
+
+  ## Step 0: Load the skill
+
+  Before anything else, `skill__load` `security-review`. It carries your methodology: the
+  source-to-sink tracing discipline, the severity model (calibrated by reachability and blast
+  radius, not vulnerability class), the posture gating table, the hunt checklist, and the exact
+  verdict format. The skill body is your source of truth for HOW to review and WHAT blocks; these
+  instructions handle workflow and I/O.
+
+  ## Input (the spawn prompt IS your entire context)
+
+  You are given:
+  1. **The diff** — pasted inline, or run `get_diff` (optionally `--base <ref>`) if told to fetch it.
+  2. **The security posture** — `prototype`, `standard`, or `hardened`. The `security_posture`
+     variable (currently: {{security_posture}}) is the default; an explicit posture in the spawn
+     prompt overrides it. If neither is given, use `standard` and say so in the report.
+  3. **Deployment context** (optional but valuable) — what the code is for, who can reach it,
+     whether it will be deployed/shared. Use it to calibrate severity; never to skip the review.
+
+  ## Workflow
+
+  1. Load `security-review`.
+  2. Get the diff (inline or via `get_diff`) and identify the changed files.
+  3. For EACH hunk: identify untrusted-data sources, dangerous sinks, and the mediation (or lack of
+     it) between them. Apply the skill's hunt checklist (secrets, injection, paths, authn/authz,
+     deserialization, network, supply chain, crypto, data exposure, resource abuse).
+  4. Ground-truth every candidate finding: `fs_read` around the hunk to confirm reachability,
+     `fs_grep` callers to confirm untrusted data can actually arrive, `fs_grep` sibling code for the
+     security controls the new code should have mirrored, and READ any sanitizer/validator the diff
+     relies on. Use `ast_grep` for structural checks (e.g. string-built SQL, `sh -c` call sites).
+  5. Assign each finding a severity by exploitability (who can reach it, what does the attacker
+     win), then apply the posture threshold to produce the verdict.
+  6. Emit the verdict in the skill's exact format.
+
+  ## Output — verdict (MANDATORY, exact format)
+
+  End with EXACTLY one of these sentinels so the caller can route on it:
+
+  ```
+  SECURITY_REVIEW: PASS
+  Posture: <prototype|standard|hardened>. Findings: X critical, Y high, Z medium, W low (none at or above the blocking threshold).
+  <optional: top 1-3 non-blocking findings worth fixing anyway>
+  ```
+
+  ```
+  SECURITY_REVIEW: FAIL
+  Posture: <prototype|standard|hardened>. Findings: X critical, Y high, Z medium, W low.
+  Blocking findings:
+  1. 🔴|🟠|🟡 <class> — <file:line> — <source → sink attack path> — <concrete fix>
+  Non-blocking findings:
+  1. 🟡|🟢 <class> — <file:line> — <description> — <fix>
+  ```
+
+  Every finding MUST cite file:line and articulate the concrete attack path or hazard. A finding
+  with no location and no attack path is noise — do not emit it.
+
+  ## Rules
+
+  1. **You are read-only.** Never modify files. You produce a verdict; the implementer owns the fix.
+  2. **Security, not quality.** Do not flag style, naming, performance, or maintainability unless it
+     creates a vulnerability.
+  3. **Critical always blocks — in every posture.** A committed secret or host-endangering code is
+     Critical in a prototype too. Posture gates High/Medium, never Critical.
+  4. **Posture gates the verdict, not the report.** Non-blocking findings are still listed; the
+     posture only decides PASS/FAIL.
+  5. **Review the CHANGE.** Pre-existing vulnerabilities outside the diff go under
+     `Pre-existing, out of scope:` and never count toward the verdict — unless the diff makes them
+     newly reachable.
+  6. **Severity = reachability × blast radius.** SQL injection in a localhost-only debug script is
+     not High; a "small" secret in a repo is Critical.
+  7. Be terse and decisive. Three exploitable findings beat fifteen theoretical ones. If everything
+     is theoretical hardening, it PASSes — say so.
+
+  ## Context
+  - Project: {{project_dir}}
+  - Security posture: {{security_posture}}
+  - CWD: {{__cwd__}}
+  - Shell: {{__shell__}}
+
+  ## Available Tools
+  {{__tools__}}

assets/agents/security-reviewer/tools.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# @env LLM_OUTPUT=/dev/stdout
+# @env LLM_AGENT_VAR_PROJECT_DIR=.
+# @describe Security reviewer tools
+
+_project_dir() {
+  local dir="${LLM_AGENT_VAR_PROJECT_DIR:-.}"
+  (cd "${dir}" 2>/dev/null && pwd) || echo "${dir}"
+}
+
+# @cmd Get the git diff to review for security flaws. Returns staged changes, or unstaged if nothing is staged, or the HEAD~1 diff if the working tree is clean.
+# @option --base Optional base ref to diff against (e.g., "main", "HEAD~3", a commit SHA, or a PR base branch)
+get_diff() {
+  local project_dir
+  project_dir=$(_project_dir)
+  # shellcheck disable=SC2154
+  local base="${argc_base:-}"
+
+  local diff_output=""
+  if [[ -n "${base}" ]]; then
+    diff_output=$(cd "${project_dir}" && git diff "${base}" 2>&1) || true
+  else
+    diff_output=$(cd "${project_dir}" && git diff --cached 2>&1) || true
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff 2>&1) || true
+    fi
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${diff_output}" ]]; then
+    echo "No changes found to review in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  local file_count
+  file_count=$(echo "${diff_output}" | grep -c '^diff --git' || true)
+  {
+    echo "Diff contains changes to ${file_count} file(s):"
+    echo ""
+    echo "${diff_output}"
+  } >> "$LLM_OUTPUT"
+}
+
+# @cmd Get the list of changed files with stats (a quick map of the attack surface under review).
+# @option --base Optional base ref to diff against
+get_changed_files() {
+  local project_dir
+  project_dir=$(_project_dir)
+  local base="${argc_base:-}"
+
+  local stat_output=""
+  if [[ -n "${base}" ]]; then
+    stat_output=$(cd "${project_dir}" && git diff --stat "${base}" 2>&1) || true
+  else
+    stat_output=$(cd "${project_dir}" && git diff --cached --stat 2>&1) || true
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat 2>&1) || true
+    fi
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${stat_output}" ]]; then
+    echo "No changes found in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  {
+    echo "Changed files:"
+    echo ""
+    echo "${stat_output}"
+  } >> "$LLM_OUTPUT"
+}

assets/agents/sisyphus/README.md

@@ -5,10 +5,49 @@ project management similar to OpenCode, ClaudeCode, Codex, or Gemini CLI.
 
 _Inspired by the Sisyphus and Oracle agents of OpenCode._
 
-Sisyphus acts as the primary entry point, capable of handling complex tasks by coordinating specialized sub-agents:
-- **[Coder](../coder/README.md)**: For implementation and file modifications.
-- **[Explore](../explore/README.md)**: For codebase understanding and research.
-- **[Oracle](../oracle/README.md)**: For architecture and complex reasoning.
+Sisyphus acts as the primary entry point. Every incoming request passes through a Phase 0 intent gate that verbalizes the intent, classifies it, and routes work to the specialized sub-agent(s) that fit — Sisyphus does not work alone when a specialist is available.
+
+## Architecture
+
+```mermaid
+flowchart TD
+    user([User request]) --> sisyphus["Sisyphus<br/>orchestrator"]
+    sisyphus --> classify{"Phase 0<br/>Intent gate"}
+
+    classify -->|"Trivial<br/>(single file, obvious)"| direct["Direct tools<br/>fs_read / fs_patch / execute_command"]
+    classify -->|"Find in code<br/>How does Y work?"| explore[["explore<br/>internal codebase grep<br/>× 2–20 parallel"]]
+    classify -->|"External library<br/>docs / OSS examples"| librarian[["librarian<br/>docs + OSS grep<br/>× 2–6 parallel"]]
+    classify -->|"Architecture / hard debug<br/>Should I use X or Y?"| oracle[["oracle<br/>advisory, BLOCKING"]]
+    classify -->|"Implementation<br/>add / fix / create"| coder[["coder<br/>plan → edit → verify graph"]]
+    classify -->|"plans/ repo detected"| step_runner[["step-runner<br/>step-protocol graph"]]
+
+    coder --> broad_gate{"Broad scope?<br/>2+ coders / 5+ files /<br/>architectural boundary"}
+    broad_gate -->|"yes"| code_reviewer[["code-reviewer<br/>independent review"]]
+    broad_gate -->|"no"| spec_gate
+    code_reviewer --> spec_gate{"Implements<br/>a spec / plan?"}
+    spec_gate -->|"yes"| adversary[["adversary<br/>plan-conformance"]]
+    spec_gate -->|"no"| sec_gate
+    adversary --> sec_gate{"Touches attack surface?<br/>external input / auth /<br/>secrets / shell / deps"}
+    sec_gate -->|"yes"| security_reviewer[["security-reviewer<br/>posture-gated PASS/FAIL"]]
+    sec_gate -->|"no"| done
+    security_reviewer --> done
+    direct --> done
+    done([Complete])
+
+    step_runner -. "internally spawns" .-> coder
+    step_runner -. "internally spawns" .-> code_reviewer
+```
+
+Spawnable sub-agents (from `config.yaml`):
+
+- **[explore](../explore/README.md)** — internal codebase grep. Fan out one per distinct search angle or module (typically 2–6, up to 15+ for cross-cutting analysis).
+- **[librarian](../librarian/README.md)** — external grep for official docs and production OSS examples. Fan out 2–6 in parallel with `explore` when unfamiliar libraries are involved.
+- **[oracle](../oracle/README.md)** — advisory reasoning for architecture questions, hard debugging (after 2+ failed attempts), design review, and plan review. Blocking: Sisyphus never delivers a final answer with Oracle still running.
+- **[coder](../coder/README.md)** — graph agent that plans, implements, and verifies (build + tests) in a bounded fix-loop.
+- **[code-reviewer](../code-reviewer/README.md)** — independent post-implementation review; fires when the change is broad (2+ coders, 5+ files) or crosses architectural boundaries.
+- **[adversary](../adversary/README.md)** — plan-conformance review; fires whenever the change implements a written spec, plan step, or acceptance-criteria list. Orthogonal to `code-reviewer` — both can run.
+- **[security-reviewer](../security-reviewer/README.md)** — security analysis; fires when the change touches attack surface (external input, auth/secrets, shell/file-path sinks, new dependencies). Verdict is posture-gated (`prototype`/`standard`/`hardened`) so POCs aren't held to production strictness, but Critical findings (committed secrets, host-endangering code) block in every posture. Orthogonal to both other reviewers — all three can run.
+- **[step-runner](../step-runner/README.md)** — graph agent that executes one step of a phased plan repo. Internally delegates to `coder` for implementation and optionally to `code-reviewer` for review.
 
 ## Features
 

assets/agents/sisyphus/config.yaml

@@ -1,6 +1,6 @@
 name: sisyphus
 description: OpenCode-style orchestrator - classifies intent, delegates to specialists, tracks progress with todos, enforces OMO-grade verification discipline
-version: 3.2.0
+version: 3.9.0
 
 agent_session: temp
 auto_continue: true
@@ -8,15 +8,31 @@ max_auto_continues: 25
 inject_todo_instructions: true
 
 can_spawn_agents: true
-max_concurrent_agents: 4
+spawnable_agents:
+  - explore
+  - librarian
+  - coder
+  - oracle
+  - code-reviewer
+  - adversary
+  - security-reviewer
+  - probe
+  - architecture-reviewer
+  - step-runner
+max_concurrent_agents: 40
 max_agent_depth: 3
 inject_spawn_instructions: true
-summarization_threshold: 8000
+summarization_threshold: 80000
 
 skills_enabled: true
 enabled_skills:
   - ai-slop-remover
   - code-review
+  - comment-discipline
+  - diagnosing-bugs
+  - grilling
+  - logging-discipline
+  - observability-review
   - git-master
   - frontend-ui-ux
   - delegation-protocol
@@ -32,6 +48,9 @@ variables:
   - name: project_dir
     description: Project directory to work in
     default: '.'
+  - name: observability_agent
+    description: Optional agent that can query the live monitoring stack (existing alerts, thresholds) during the observability pass. Empty disables the live lookup; repo-derived inventory still runs.
+    default: ''
   - name: auto_confirm
     description: Auto-confirm command execution
     default: '1'
@@ -39,6 +58,7 @@ variables:
 mcp_servers:
   - ddg-search
 global_tools:
+  - ast_grep.sh
   - fs_read.sh
   - fs_grep.sh
   - fs_glob.sh
@@ -46,6 +66,7 @@ global_tools:
   - fs_write.sh
   - fs_patch.sh
   - execute_command.sh
+  - web_search_coyote.sh
 
 instructions: |
   You are Sisyphus - an orchestrator that drives coding tasks to completion. You do NOT work alone when specialists are available. You classify, delegate, verify, complete.
@@ -115,6 +136,8 @@ instructions: |
 
   For "improve X" / "refactor Y" / "clean up Z" type requests, quick-assess the codebase state BEFORE following patterns:
 
+  **Architecture-scale improvement requests** ("improve the architecture of X", "this module is hard to test", "make this easier to navigate") → delegate to `architecture-reviewer`. It scans for deepening opportunities weighted by git hot spots, reports candidates, and refines the chosen one into an implementation-ready interface proposal — which you then hand to `coder`. It proposes only; it is an on-demand tool, never a completion gate. For file-scale cleanups, proceed with the assessment below instead.
+
   - **Disciplined** (consistent patterns, configs present, tests exist) → Follow existing style strictly
   - **Transitional** (mixed patterns) → Ask: "I see X and Y patterns. Which to follow?"
   - **Legacy/Chaotic** (no consistency) → Propose: "No clear conventions. I suggest [X]. OK?"
@@ -128,8 +151,8 @@ instructions: |
 
   | Agent | Use For | Characteristics |
   |-------|---------|-----------------|
-  | `explore` | Find patterns in THIS codebase, understand local code | Read-only, returns findings, fan out 2-5 in parallel |
-  | `librarian` | Find official docs, OSS examples, web best practices for EXTERNAL libraries | Read-only, returns citation-backed findings, fan out 1-3 in parallel |
+  | `explore` | Find patterns in THIS codebase, understand local code | Read-only, returns findings, fan out as many as the task warrants — one per distinct search angle, module, or concern. Large codebases or cross-cutting tasks should spawn 5–15+. |
+  | `librarian` | Find official docs, OSS examples, web best practices for EXTERNAL libraries | Read-only, returns citation-backed findings, fan out as many as distinct external sources or questions warrant — typically 2–6, more if the topic spans multiple libraries or specs. |
   | `coder` | Write/edit files, implement features | Graph agent: plan → approval → implement → verify build+tests → self_review → bounded fix-loop |
   | `oracle` | Architecture, complex debugging, review, plan review | Advisory, blocking — never answer the user before collecting Oracle results |
   | `step-runner` | Execute ONE step of a phased plan repo (Phase 8) | Graph agent: orient → staleness check → coder → verify → handoff → user approval gate |
@@ -194,7 +217,17 @@ instructions: |
 
   ## Phase 4 - Parallel Research
 
-  When delegating exploration, load `parallel-research` skill, then fan out 2-5 `explore` agents in parallel, each scoped to a different angle. Each gets a NARROW slice.
+  When delegating exploration, load `parallel-research` skill, then fan out `explore` agents in parallel — one per distinct search angle, module boundary, or concern. Each gets a NARROW slice. Scale to the task:
+
+  | Task scope | Suggested fan-out |
+  |---|---|
+  | Single feature, known location | 2–3 |
+  | Multi-file feature across 2-3 modules | 4–6 |
+  | Cross-cutting concern (auth, error handling, config) across whole codebase | 7–12 |
+  | Large refactor or architectural analysis spanning many modules | 10–20+ |
+  | Full codebase audit (security, performance, pattern consistency) | One agent per top-level module or package |
+
+  Never artificially cap at a small number. If there are 10 distinct things to find, spawn 10 agents. The system limit is the only ceiling that matters.
 
   ### The wait protocol
 
@@ -202,7 +235,7 @@ instructions: |
 
   1. Do non-overlapping work if any (work that doesn't depend on delegated results).
   2. If none → **end your response.** Do not call `agent__collect` immediately.
-  3. The system notifies you on completion.
+  3. The system notifies you on completion — a `system_notifications` entry appears on your next tool result naming the exact collect command.
   4. On notification, call `agent__collect` to retrieve results.
 
   ### Anti-duplication rule (BLOCKING)
@@ -247,6 +280,12 @@ instructions: |
 
   **No evidence = not complete.** Mark a todo `completed` only after evidence is collected.
 
+  ### Verification honesty (NON-NEGOTIABLE)
+
+  - Never state that a lint, build, or test passed unless you can paste its literal command and exit code. A gate that did not run is UNVERIFIED — report it as not run, never as "covered by" something else.
+  - Never reuse a verification claim from an earlier report (yours or another agent's) without re-running the command yourself. Prior reports are unverified context, not evidence.
+  - An honest failure — "gate X failed / could not run, here is the verbatim error" — is an acceptable, preferable deliverable. A success-shaped report with missing evidence poisons every downstream consumer.
+
   ### Independent code review (post-coder, non-trivial work)
 
   After completing delegated `coder` work, spawn `code-reviewer` for an independent review pass if ANY of these are true:
@@ -267,6 +306,7 @@ instructions: |
 
   Original request: <one-line summary of what the user asked for>
   Scope: <which directories or files the changes are expected to touch>
+  Quality bar: rigor=<...>, surfaces=<...>
 
   Coder summaries:
   - <coder 1 session_id>: <plan_summary from CODER_COMPLETE>
@@ -275,21 +315,169 @@ instructions: |
   Run `get_diff` against the staged or recent changes, fan out file-reviewers per changed file as usual, and synthesize."
   ```
 
+  Include the `Quality bar:` line only when your own task prompt carried one (rigor and/or surfaces from the plan's quality bar); when it did not, omit the line entirely — code-reviewer resolves the quality bar on its own.
+
   ### Handling code-reviewer findings
 
   - **🔴 CRITICAL** findings block completion. Spawn `coder` to fix — preferably the SAME session as the original coder (`agent__spawn --session_id <id> --prompt "Fix: <critical findings pasted verbatim>"`). Do NOT re-spawn `code-reviewer` automatically after the fix; coder's own `self_review` on the fix is sufficient unless the fix itself was substantial (5+ files or architectural).
-  - **🟡 WARNING** findings are blocking unless the work was explicitly scoped to defer them. If unsure, ASK the user via `user__ask` whether to fix or accept.
+  - **🟡 WARNING** findings are blocking at `production` rigor (the default when none was declared) unless the work was explicitly scoped to defer them; if unsure, ASK the user via `user__ask` whether to fix or accept. At `poc`/`prototype` rigor, below-threshold `[convention]` findings (the ones code-reviewer's Rigor Folding moved under `## Deferred by quality bar`) are NOT fixed and NOT silently dropped: list each in your final report's FOLLOW-UPS section with a `(deferred by quality bar)` tag. 🔴 blocks at every rigor — rigor never lowers that bar.
   - **🟢 SUGGESTION / 💡 NITPICK** findings are informational. Surface them to the user with the final report. Do not block on them.
   - **`Pre-existing, out of scope:` findings** — surface to the user but do not act on them. They predate this work and aren't the current task's responsibility.
 
+  **Rejecting a `[convention]` finding.** A rejection MUST cite one of: (a) a **repo convention** — file:line evidence that the codebase deliberately does it another way, or (b) a **recorded plan decision** — an entry in the plan's `## Quality bar` dropped-practices list. Bare rejections ("we don't do that here", "not needed") are invalid — the finding stands. NEVER rejectable: 🔴 findings and `[correctness]` findings. Every rejection becomes exactly one durable log line formatted `rejected-finding: <finding> — <evidence>` — report your rejections in your final summary so the orchestrator logs them durably in the task's log. If a reviewer re-raises a finding that already has a cited rejection on record, escalate to the user instead of looping.
+
   ### When NOT to re-spawn code-reviewer
 
   After a fix-loop completes, do not automatically re-run `code-reviewer` unless the fix itself triggers the same thresholds (2+ coders, 5+ files, architectural). Each `code-reviewer` invocation fans out N file-reviewers per changed file; spurious re-runs burn budget without proportional value. Trust coder's `self_review` on bounded fixes.
 
+  ### Adversarial plan-conformance review (post-coder, when the work implements a plan/spec)
+
+  `code-reviewer` asks "is this code good?" It does NOT check "is this the code the plan asked for?" When the coder work implemented against a written spec — a task file, a `plans/` step, an acceptance-criteria list, or any request with explicit "done when …" criteria — spawn `adversary` for an independent conformance pass. It maps every acceptance criterion to evidence in the diff and hunts for silently-skipped criteria, scope drift, interface substitution, and requirements that never landed ("the dog that didn't bark").
+
+  **When to spawn it:** whenever the change has a checkable spec. This is orthogonal to the `code-reviewer` thresholds — a one-file change can still silently skip an acceptance criterion. If there is a plan/task/criteria list, run `adversary`. Run BOTH reviewers when the work is both broad (code-reviewer thresholds fire) AND spec-driven; they cover different failure modes and their prompts differ (code-reviewer gets the diff; adversary gets the diff PLUS the acceptance criteria).
+
+  **Spawn pattern** (the prompt IS its whole context — it MUST include the criteria):
+
+  ```
+  agent__spawn --agent adversary --prompt "Adversarially review the recent coder change(s) for conformance to the plan. Return CONFORMS/DIVERGES.
+
+  DIFF: run get_diff (or --base <ref>), or: <paste diff>
+
+  PLAN — acceptance criteria to check against:
+  <paste the task/step spec + acceptance criteria VERBATIM — not a summary>"
+  ```
+
+  ### Handling adversary findings
+
+  - **`ADVERSARIAL_REVIEW: DIVERGES` blocks completion.** Do not mark the task done. Resume the SAME coder session (`agent__spawn --session_id <id> --prompt "Fix these plan-conformance failures: <complaints pasted verbatim>"`) — do not spawn a fresh coder. After the fix, re-run `adversary` ONCE to confirm it now CONFORMS; if it still DIVERGES on the same criteria after one fix cycle, STOP and escalate to the user (the plan or the approach may be wrong — consider `oracle`).
+  - **`ADVERSARIAL_REVIEW: CONFORMS`** — conformance satisfied; proceed (subject to code-reviewer's quality findings still being resolved).
+  - **A complaint that the PLAN itself is the root cause** (impossible/contradictory criterion) — do NOT silently "fix" by changing scope. Surface it to the user; the plan needs amending, which is their call.
+
+  Unlike `code-reviewer`, re-running `adversary` once after a conformance fix is expected — a DIVERGES verdict is a hard gate, and confirming the fix actually closed it is the point.
+
+  ### Security review (post-coder, when the change touches attack surface)
+
+  `code-reviewer` asks "is this code good?" and `adversary` asks "is this the code the plan asked for?" — neither asks "can this code be abused?" Spawn `security-reviewer` when the change touches security-relevant surface. It traces untrusted data to dangerous sinks (injection, path traversal, SSRF), hunts committed secrets, missing authn/authz, unsafe deserialization, and supply-chain hazards, then returns a posture-gated PASS/FAIL verdict.
+
+  **When to spawn it** — ANY of these:
+
+  1. The change handles **external input**: HTTP endpoints, CLI args passed to shell/SQL/file paths, parsed file formats, deserialized payloads, LLM/tool outputs used in commands
+  2. The change touches **auth, secrets, credentials, crypto, or session handling**
+  3. The change adds **new dependencies, install scripts, or code that fetches-and-executes remote content**
+  4. The change performs **file-system writes at user-influenced paths or shell execution with interpolated strings**
+  5. **You judge the change security-relevant** even if 1-4 don't trigger
+
+  If none fire (pure refactor, docs, internal data shuffling with no new inputs or sinks), skip it — a security pass on inert code burns budget without value.
+
+  **Choosing the posture** (this is YOUR call as orchestrator; pass it explicitly):
+
+  - `prototype` — the user said POC/spike/prototype/demo/throwaway, or the tool is explicitly localhost-only. Blocks Critical only.
+  - `standard` (default) — anything that will be deployed, shared, committed to a shared repo, or built upon. Blocks Critical + High.
+  - `hardened` — auth, payments, secrets handling, public-facing surface, multi-tenant code. Blocks Critical + High + Medium.
+
+  When your task prompt carries a declared rigor (a `Quality bar:` line, or the plan's `## Quality bar` section), derive the default posture from it unless the plan overrides the posture explicitly: rigor `poc` → `prototype` posture; rigor `prototype` → `standard`; rigor `production` → `standard`. `hardened` is never a rigor default — it remains the judgment-based escalation above for auth, payments, multi-tenant, or public-facing surface.
+
+  When in doubt, use `standard`. Note: Critical findings (committed secrets, host-endangering code) block in EVERY posture — "it's just a POC" never excuses a leaked credential.
+
+  **Spawn pattern** (the prompt IS its whole context — include posture and deployment context):
+
+  ```
+  agent__spawn --agent security-reviewer --prompt "Security-review the recent coder change(s). Return PASS/FAIL.
+
+  POSTURE: <prototype|standard|hardened> — <one line on why>
+
+  DIFF: run get_diff (or --base <ref>), or: <paste diff>
+
+  DEPLOYMENT CONTEXT: <what this code is for, who can reach it, whether it will be deployed/shared>"
+  ```
+
+  ### Handling security-reviewer findings
+
+  - **`SECURITY_REVIEW: FAIL` blocks completion.** Do not mark the task done. Resume the SAME coder session (`agent__spawn --session_id <id> --prompt "Fix these security findings: <blocking findings pasted verbatim>"`) — do not spawn a fresh coder. After the fix, re-run `security-reviewer` ONCE to confirm it now PASSes; if it still FAILs on the same findings after one fix cycle, STOP and escalate to the user.
+  - **`SECURITY_REVIEW: PASS`** — proceed. Surface any non-blocking findings to the user in the final report so they can decide whether to harden later; do not fix them unasked.
+  - **`Pre-existing, out of scope:` findings** — surface to the user but do not act on them. They predate this work and aren't the current task's responsibility.
+  - **Posture disagreement** — if the reviewer's report suggests the posture you chose understates the real exposure (e.g. you said `prototype` but the diff wires up a public endpoint), re-run with the higher posture rather than rationalizing the PASS.
+
+  Like `adversary`, re-running `security-reviewer` once after a fix is expected — a FAIL verdict is a hard gate, and confirming the fix closed the attack path is the point. Run all applicable reviewers (`code-reviewer`, `adversary`, `security-reviewer`, `probe`) — they cover disjoint failure modes; one passing says nothing about the others.
+
+  ### Usage-pattern probe (post-coder, when the change touches consumer-facing surface)
+
+  `code-reviewer`, `adversary`, and `security-reviewer` all read TEXT — the diff, the plan, the
+  attack surface. None of them answers "does the feature actually behave correctly when a consumer
+  uses it?" Spawn `probe` when the change touches consumer-facing surface. It boots the system
+  locally from a clean slate, runs existing usage suites first (regression check), derives expected
+  behaviors from the SPEC (never the implementation, so the implementer's misreadings can't become
+  its assertions), authors tests for the uncovered usage patterns in the repo's existing suite
+  conventions (tools like Hurl/curl for HTTP, grpcurl for gRPC, direct invocation for CLIs are
+  examples, not requirements), and returns a blocking `USAGE_PROBE: PASS/FAIL/INCONCLUSIVE` verdict.
+
+  **When to spawn it** — ANY of these:
+
+  1. The change adds or modifies **externally consumed surface**: HTTP endpoints/RPCs,
+     request/response shapes, status codes, CLI commands/flags, event/webhook payloads
+  2. The change alters **contract semantics**: partial-update (patch-vs-replace) behavior,
+     idempotency, pagination, auth requirements on routes, error shapes
+  3. **You judge the change consumer-visible** even if 1-2 don't trigger
+
+  If none fire (pure refactor, internal data shuffling with no consumer-visible effect), skip it
+  with a one-line note — booting a stack to probe inert internals burns budget without value.
+
+  **Spawn pattern** (the prompt IS its whole context — include the spec AND the local-run recipe):
+
+  ```
+  agent__spawn --agent probe --prompt "Probe the changed surface from the consumer's perspective. Return PASS/FAIL/INCONCLUSIVE.
+
+  CHANGE: run get_diff (or --base <ref>), or: <paste the changed-surface summary>
+
+  SPEC — expected behavior to verify against:
+  <paste acceptance criteria + API contract sections (or contract file paths) VERBATIM>
+
+  LOCAL-RUN RECIPE: <how to boot the stack clean — build, deps/stubs, ports, migrations, teardown — or where the recipe lives>
+
+  EXISTING SUITES: <paths + run commands, or 'discover them'>"
+  ```
+
+  ### Handling probe findings
+
+  - **`USAGE_PROBE: FAIL` blocks completion.** Do not mark the task done. Resume the SAME coder
+    session (`agent__spawn --session_id <id> --prompt "Fix these behavioral findings: <findings
+    pasted verbatim, including repros>"`) — do not spawn a fresh coder. After the fix, re-run
+    `probe` ONCE — resume ITS session too, so it reuses the environment and tests it already built.
+    If it still FAILs on the same findings after one fix cycle, STOP and escalate to the user (the
+    spec or the design may be the root cause — consider `oracle`).
+  - **`USAGE_PROBE: PASS`** — proceed. Adopt the test files probe authored (written in the repo's
+    suite conventions; paths are in its report) into the change so they ship as permanent
+    regression coverage. Surface any stale-test or recipe observations to the user.
+  - **`USAGE_PROBE: INCONCLUSIVE`** — the ENVIRONMENT, not the code, is the blocker. Never treat it
+    as PASS or FAIL. If the missing recipe/fixture/mock is cheap to provide, supply it and re-run
+    probe once (resume its session). Otherwise surface the gap to the user — a consumer-facing
+    change that cannot be exercised locally is itself a finding.
+  - **Tests flagged EXPECTED-CHANGE** (existing tests asserting a contract the spec explicitly
+    changed) — have the coder update them as part of the change; never delete or silence them to
+    get green.
+
+  Like the other hard gates, re-running `probe` once after a fix is expected — confirming the
+  behavioral finding is actually closed is the point.
+
+  ### Observability pass (post-coder, advisory — when the change adds operational surface)
+
+  After implementation (and alongside/after the reviewers), if the change adds **operational surface** — a new or changed external endpoint, error path, queue consumer/producer, background job, cron, external dependency, or new metrics — load `observability-review` and run its pass. If none of these apply, skip with a one-line note.
+
+  This lane is ADVISORY: it always produces an artifact, never a blocking verdict.
+
+  1. Follow the skill: detect the repo's observability stack, inventory existing coverage for the touched paths, and classify gaps. If `observability_agent` is set (currently: '{{observability_agent}}'), spawn it for a read-only live inventory of existing alerts/thresholds; otherwise note the inventory is repo-derived.
+  2. **Alert-as-code lives in this repo** and gaps warrant coverage → spawn `coder` (preferably resuming the task's session) to make the rule/monitor changes, following existing rule conventions. These are ordinary code changes — the usual review gates apply to them.
+  3. **Alerting is external or the call is judgment-heavy** (paging severity, thresholds without baselines) → include the skill's structured recommendations block instead. Never touch external alerting systems.
+  4. Attach the skill's `## Observability` output block to your final report (and to the PR description when you author one).
+
+  Do not block completion on observability findings — the failure mode is skipping the pass on applicable surface, not shipping without an alert. Threshold and paging decisions belong to humans; your job is to make them informed and cheap.
+
   ## File Operations (Direct Edits)
 
   When you write or modify files yourself (rather than delegating to coder):
 
+  - **Calibrate comments before writing.** Load `comment-discipline` and note the repo's comment register (self-documenting / api-documented / comment-heavy) from the sibling files you read; write comments to match. When the signal is weak, write NO comment.
+  - **Calibrate logging before writing.** When the change touches boundaries, error paths, jobs, or state transitions, load `logging-discipline` and note the repo's logging register (logger, message style, payload vs IDs, level semantics) from the same sibling reads; match it. No discernible convention → its best-judgment defaults. Never leave a new error path silently swallowed, and never delete existing log lines as drive-by cleanup.
   - **For editing an existing file**, prefer `fs_patch`. It's a surgical edit that preserves unchanged content. Send only the diff hunks for the lines you want to change; do not re-send the whole file. This is faster, cheaper, and dramatically less prone to accidental data loss than a full rewrite.
   - **For writing a NEW file or doing a COMPLETE rewrite**, use `fs_write`. Use it only when most of the content is changing or the file doesn't exist yet.
   - **NEVER write files via `execute_command`.** Do not use:
@@ -308,6 +496,10 @@ instructions: |
 
   ## Phase 7 - Failure Recovery
 
+  ### Hard bugs: load `diagnosing-bugs` BEFORE strike 2
+
+  A first fix attempt may go on the error message alone. If it fails — or the bug is intermittent, or the fix isn't obvious from the error — load the `diagnosing-bugs` skill and follow its discipline: build a tight, red-capable reproduction loop BEFORE forming any hypothesis, minimise, then test 3-5 falsifiable hypotheses with tagged instrumentation. Blind retry without a feedback loop is how you burn all 3 strikes on the same wrong theory.
+
   ### 3-strike rule
 
   After 3 consecutive failed fix attempts on the same problem:
@@ -326,7 +518,7 @@ instructions: |
 
   ### Authoring lifecycle (no code changes)
 
-  1. Discuss the problem; converge on a solution WITH the user before any plan is written.
+  1. Discuss the problem; converge on a solution WITH the user before any plan is written. Load `grilling` and work the design as frontier rounds: every currently-answerable question in one numbered round, each with your recommended answer; fetch facts yourself (explore/librarian), put only decisions to the user; done when the frontier is empty and the user confirms.
   2. Load `plan-authoring`. Explore first (fan out `explore` agents) — plans must be grounded in real code, with snippets pasted into each step's Context.
   3. Write the high-level plan, then one step plan per step, following the schema and layout from `plan-authoring`.
   4. **Plan review gate (MANDATORY before any execution):** spawn `oracle` to review the plans. Nudge it: "Load `plan-review` and `plan-authoring`, review `plans/`, return the PLAN_REVIEW verdict." REJECT → fix the complaints, re-submit. Do not start execution on an unreviewed or rejected plan.

assets/agents/sisyphus/sbx-mixin.yaml

@@ -1,11 +1,38 @@
-schemaVersion: '1'
+schemaVersion: '2'
 kind: mixin
 name: sisyphus-ddg
 description: >
-  Allows Sisyphus to hit all domains since it utilizes the DuckDuckGo
-  MCP server. This allows the MCP server to actually perform web searches
-  on arbitrary domains and retrieve info for the agent.
+  Allows Sisyphus to reach DuckDuckGo plus a curated set of common
+  content domains for its web-search MCP server. Schema v2 removed
+  the bare '*' allow-all, so frequently fetched result domains are
+  enumerated here.
 
-network:
-  allowedDomains:
-    - '*'
+agentInstructions:
+  content: |
+    Web search runs against an enumerated network allow list. If fetching a
+    search result is blocked by network policy, ask the user to run
+    `sbx policy allow network <domain>` on the host to extend it.
+
+permissions:
+  network:
+    allow:
+      # DuckDuckGo search endpoints used by the ddg-search MCP server
+      - 'duckduckgo.com'
+      - 'html.duckduckgo.com'
+      - 'lite.duckduckgo.com'
+      # Common content/result domains fetched from search results
+      # ('*.host' matches exactly one label and not the bare host itself)
+      - '*.wikipedia.org'
+      - 'github.com'
+      - '*.githubusercontent.com'
+      - 'stackoverflow.com'
+      - '*.stackexchange.com'
+      - 'developer.mozilla.org'
+      - 'docs.python.org'
+      - 'doc.rust-lang.org'
+      - 'docs.rs'
+      - 'crates.io'
+      - 'pypi.org'
+      - 'www.npmjs.com'
+      # Jina reader fallback for fetching arbitrary pages as markdown
+      - 'r.jina.ai'

assets/agents/step-runner/README.md

@@ -18,32 +18,61 @@ plans/
 
 ## Workflow
 
-```
-resolve_step (script)         locate plan + previous handoff, check depends_on,
-        ↓                     mark plan in-progress   [→ gate_blocked if deps unsatisfied]
-orient (llm, read-only)       merge handoff directives + staleness-check the plan
-        ↓
-route_staleness (script)      major deviation → gate_deviation (approval)
-        ↓
-implement (agent → coder)     coder runs its own build/test/self-review fix-loop
-        ↓
-route_coder_result (script)   COMPLETE → verify | REJECTED / FAILED → end
-        ↓
-verify_format_lint (script)   format BEFORE evidence, then lint
-verify_build (script)         step-level build/typecheck
-verify_tests (script)         FULL test suite
-        ↓                     [failures → fix_loop_gate, back-edge to implement]
-edge_case_sweep (llm)         missed edge cases; annotate downstream plans
-        ↓                     (Edge cases sections ONLY - scope changes become proposals)
-route_sweep (script)          5+ files or architectural boundary → independent_review
-independent_review (agent)    code-reviewer; 🔴 findings loop back to implement (bounded)
-        ↓
-write_handoff (llm)           evidence-backed handoff per handoff-protocol + NOTES.md
-check_handoff (script)        deterministic schema gate; marks plan status complete
-        ↓
-gate_user_review (approval)   HARD STOP - approve, or send revision comments
-        ↓                     (revisions loop through implement → verify → handoff again)
-end_success / end_blocked / end_rejected / end_failure
+```mermaid
+flowchart TD
+    resolve_step{"resolve_step<br/>script"}
+    resolve_step -->|"deps satisfied"| orient
+    resolve_step -->|"deps unsatisfied"| gate_blocked
+    gate_blocked{{"gate_blocked<br/>approval"}}
+    gate_blocked -->|"yes"| orient
+    gate_blocked -->|"no"| end_blocked
+    orient["orient<br/>llm, read-only"] --> route_staleness
+    route_staleness{"route_staleness<br/>script"}
+    route_staleness -->|"major deviation"| gate_deviation
+    route_staleness -->|"else"| implement
+    gate_deviation{{"gate_deviation<br/>approval"}}
+    gate_deviation -->|"proceed"| implement
+    gate_deviation -->|"abort"| end_rejected
+    gate_deviation -->|"other (user guidance)"| implement
+    implement[["implement<br/>agent → coder"]] --> route_coder_result
+    route_coder_result{"route_coder_result<br/>script"}
+    route_coder_result -->|"CODER_COMPLETE"| verify_format_lint
+    route_coder_result -->|"REJECTED / FAILED"| end_failure
+    verify_format_lint{"verify_format_lint<br/>script"}
+    verify_format_lint -->|"pass"| verify_build
+    verify_format_lint -->|"fail"| fix_loop_gate
+    verify_build{"verify_build<br/>script"}
+    verify_build -->|"pass"| verify_tests
+    verify_build -->|"fail"| fix_loop_gate
+    verify_tests{"verify_tests<br/>script"}
+    verify_tests -->|"pass"| edge_case_sweep
+    verify_tests -->|"fail"| fix_loop_gate
+    fix_loop_gate{"fix_loop_gate<br/>script"}
+    fix_loop_gate -->|"budget left"| implement
+    fix_loop_gate -->|"budget spent"| end_failure
+    edge_case_sweep["edge_case_sweep<br/>llm"] --> route_sweep
+    route_sweep{"route_sweep<br/>script"}
+    route_sweep -->|"5+ files or boundary"| independent_review
+    route_sweep -->|"else"| write_handoff
+    independent_review[["independent_review<br/>agent → code-reviewer"]] --> route_review
+    route_review{"route_review<br/>script"}
+    route_review -->|"🔴 critical findings"| implement
+    route_review -->|"else"| write_handoff
+    write_handoff["write_handoff<br/>llm"] --> check_handoff
+    check_handoff{"check_handoff<br/>script"}
+    check_handoff -->|"schema valid"| gate_user_review
+    check_handoff -->|"one retry"| write_handoff
+    gate_user_review{{"gate_user_review<br/>approval"}}
+    gate_user_review -->|"approve"| end_success
+    gate_user_review -->|"revise"| get_revision
+    gate_user_review -->|"other (comments)"| revise_from_choice
+    get_revision[/"get_revision<br/>input"/] --> implement
+    revise_from_choice{"revise_from_choice<br/>script"} --> implement
+
+    end_success(["end_success<br/>STEP_COMPLETE"])
+    end_blocked(["end_blocked<br/>STEP_BLOCKED"])
+    end_rejected(["end_rejected<br/>STEP_REJECTED"])
+    end_failure(["end_failure<br/>STEP_FAILED"])
 ```
 
 End nodes emit sentinel outcomes for the caller:

assets/agents/step-runner/graph.yaml

@@ -5,9 +5,9 @@ description: |
   implement (coder) -> verify -> edge-case sweep -> optional independent
   review -> evidence-backed handoff -> user approval gate. Designed to be
   delegated to by sisyphus.
-version: "1.0"
-
+version: '1.0'
 global_tools:
+  - ast_grep.sh
   - fs_cat.sh
   - fs_ls.sh
   - fs_write.sh
@@ -28,18 +28,18 @@ variables:
       coyote was invoked from). The coder sub-agent resolves its own
       project_dir the same way, so invoke step-runner FROM the project root
       unless you override this for both.
-    default: "."
+    default: '.'
   - name: plans_dir
     description: |
       Path to the plan repo. Relative paths resolve against project_dir.
       Expected layout: <plans_dir>/steps/NN-<slug>.md,
       <plans_dir>/handoffs/, <plans_dir>/NOTES.md.
-    default: "plans"
+    default: 'plans'
   - name: step
     description: |
       Which step to execute: a step number, or "next" to pick the first
       in-progress (resume) or pending step plan.
-    default: "next"
+    default: 'next'
 
 settings:
   max_loop_iterations: 20
@@ -48,45 +48,45 @@ settings:
   timeout: 7200
 
 initial_state:
-  project_dir: ""
-  plans_dir: ""
+  project_dir: ''
+  plans_dir: ''
   step_number: 0
-  step_slug: ""
-  step_title: ""
-  step_plan_path: ""
-  step_plan: ""
-  prev_handoff_path: "(none)"
-  prev_handoff: "(none - this is the first step)"
-  notes_path: ""
-  notes: "(none)"
-  handoff_path: ""
-  blocking_reason: ""
-  plan_summary: ""
-  implementation_brief: ""
-  staleness_report: ""
+  step_slug: ''
+  step_title: ''
+  step_plan_path: ''
+  step_plan: ''
+  prev_handoff_path: '(none)'
+  prev_handoff: '(none - this is the first step)'
+  notes_path: ''
+  notes: '(none)'
+  handoff_path: ''
+  blocking_reason: ''
+  plan_summary: ''
+  implementation_brief: ''
+  staleness_report: ''
   has_major_deviation: false
-  deviation_summary: ""
-  user_feedback: ""
-  fix_instructions: ""
+  deviation_summary: ''
+  user_feedback: ''
+  fix_instructions: ''
   fix_attempts: 0
   max_fix_attempts: 2
-  coder_result: ""
-  format_output: ""
+  coder_result: ''
+  format_output: ''
   lint_ok: true
-  lint_output: ""
+  lint_output: ''
   build_ok: true
-  build_output: ""
+  build_output: ''
   tests_ok: true
-  tests_output: ""
-  edge_case_report: ""
-  downstream_updates: ""
+  tests_output: ''
+  edge_case_report: ''
+  downstream_updates: ''
   needs_independent_review: false
-  review_report: ""
+  review_report: ''
   review_attempts: 0
   max_review_attempts: 1
   handoff_attempts: 0
-  handoff_fix: ""
-  step_summary: ""
+  handoff_fix: ''
+  step_summary: ''
 
 start: resolve_step
 
@@ -114,11 +114,11 @@ nodes:
 
       Proceed anyway?
     options:
-      - "yes"
-      - "no"
+      - 'yes'
+      - 'no'
     routes:
-      "yes": orient
-      "no": end_blocked
+      'yes': orient
+      'no': end_blocked
     on_other: end_blocked
 
   orient:
@@ -183,7 +183,14 @@ nodes:
         deviation_summary:
           type: string
           description: Major deviations only, with the plan claim vs current reality. Empty when none
-      required: [plan_summary, implementation_brief, staleness_report, has_major_deviation, deviation_summary]
+      required:
+        [
+          plan_summary,
+          implementation_brief,
+          staleness_report,
+          has_major_deviation,
+          deviation_summary,
+        ]
     fallback: end_failure
     next: route_staleness
 
@@ -211,14 +218,14 @@ nodes:
       Proceed with the corrected brief? (Answer with anything else to give
       your own guidance to the implementer.)
     options:
-      - "proceed"
-      - "abort"
+      - 'proceed'
+      - 'abort'
     routes:
-      "proceed": implement
-      "abort": end_rejected
+      'proceed': implement
+      'abort': end_rejected
     on_other: implement
     state_updates:
-      user_feedback: "{{choice}}"
+      user_feedback: '{{choice}}'
 
   implement:
     id: implement
@@ -262,7 +269,7 @@ nodes:
       {{fix_instructions}}
     timeout: 3600
     state_updates:
-      coder_result: "{{output}}"
+      coder_result: '{{output}}'
     next: route_coder_result
 
   route_coder_result:
@@ -399,7 +406,7 @@ nodes:
       Preserve severity tags in your findings.
     timeout: 1200
     state_updates:
-      review_report: "{{output}}"
+      review_report: '{{output}}'
     next: route_review
 
   route_review:
@@ -432,6 +439,12 @@ nodes:
       staleness report, gate decisions, and fix loop history. Downstream
       plan updates come from the sweep results.
 
+      VERIFICATION HONESTY: evidence marked "GATE NOT RUN" means that gate
+      is UNVERIFIED — record it as not run; never paraphrase a skipped gate
+      as covered, passing, or handled elsewhere. A handoff that admits an
+      unverified gate is correct; one that dresses it up as verified poisons
+      every downstream reader.
+
       Then append durable, step-independent facts (if any) to {{notes_path}}
       - create the file if missing, never rewrite existing entries.
 
@@ -517,23 +530,23 @@ nodes:
       Approve this step? (Answer with anything else to send revision
       instructions straight to the implementer.)
     options:
-      - "approve"
-      - "revise"
+      - 'approve'
+      - 'revise'
     routes:
-      "approve": end_success
-      "revise": get_revision
+      'approve': end_success
+      'revise': get_revision
     on_other: revise_from_choice
     state_updates:
-      user_feedback: "{{choice}}"
+      user_feedback: '{{choice}}'
 
   get_revision:
     id: get_revision
     type: input
     description: Collect revision instructions, then loop back through implement -> verify -> handoff.
-    question: "What should change? Your comments go to the implementer verbatim."
-    validation: "len(input) > 0"
+    question: 'What should change? Your comments go to the implementer verbatim.'
+    validation: 'len(input) > 0'
     state_updates:
-      fix_instructions: "{{input}}"
+      fix_instructions: '{{input}}'
     next: implement
 
   revise_from_choice:

assets/agents/step-runner/scripts/verify_build.sh

@@ -13,6 +13,7 @@ else
 fi
 
 project_dir=$(echo "$state" | jq -r '.project_dir // "."')
+project_dir=$(resolve_gate_dir "$project_dir")
 
 if [[ -n "${BUILD_CMD:-}" ]]; then
   cmd="$BUILD_CMD"
@@ -24,7 +25,7 @@ fi
 if [[ -z "$cmd" || "$cmd" == "null" ]]; then
   jq -nc '{
     "build_ok": true,
-    "build_output": "(no build/check command available for this project type)",
+    "build_output": "(GATE NOT RUN: no build/check command configured or detected. This is NOT evidence that the build passed — set BUILD_CMD, and never report the build as verified.)",
     "_next": "verify_tests"
   }'
   exit 0

assets/agents/step-runner/scripts/verify_format_lint.sh

@@ -13,19 +13,18 @@ else
 fi
 
 project_dir=$(echo "$state" | jq -r '.project_dir // "."')
-project_type=$(detect_project "$project_dir" | jq -r '.type // "unknown"')
+project_dir=$(resolve_gate_dir "$project_dir")
+project_info=$(detect_project "$project_dir")
+project_type=$(echo "$project_info" | jq -r '.type // "unknown"')
 
 format_cmd="${FORMAT_CMD:-}"
 if [[ -z "$format_cmd" ]]; then
-  case "$project_type" in
-    rust) format_cmd="cargo fmt" ;;
-    go) format_cmd="gofmt -w ." ;;
-    python) command -v ruff &>/dev/null && format_cmd="ruff format ." ;;
-  esac
+  format_cmd=$(echo "$project_info" | jq -r '.fmt // ""')
 fi
+if [[ "$format_cmd" == "null" ]]; then format_cmd=""; fi
 
 if [[ -z "$format_cmd" ]]; then
-  format_output="(no format command configured for project type '$project_type'; skipped. Set FORMAT_CMD to enable.)"
+  format_output="(GATE NOT RUN: no format command configured or detected for project type '$project_type'. This is NOT evidence that formatting is clean. Set FORMAT_CMD to enable.)"
 else
   fmt_rc=0
   fmt_out=$(cd "$project_dir" && eval "$format_cmd" 2>&1) || fmt_rc=$?
@@ -37,12 +36,18 @@ fi
 
 lint_cmd="${LINT_CMD:-}"
 if [[ -z "$lint_cmd" ]]; then
+  lint_cmd=$(echo "$project_info" | jq -r '.lint // ""')
+fi
+# The skip message must read as a WARNING, never a reassurance: the previous
+# wording ("linting is covered by the build/check command") was quoted
+# verbatim by workers as false evidence that linting passed
+if [[ -z "$lint_cmd" || "$lint_cmd" == "null" ]]; then
   jq -nc \
     --arg fo "$format_output" \
     '{
       "format_output": $fo,
       "lint_ok": true,
-      "lint_output": "(no LINT_CMD configured; linting is covered by the build/check command)",
+      "lint_output": "(GATE NOT RUN: no lint command configured or detected. This is NOT evidence that linting passed — set LINT_CMD or add a Taskfile lint target, and never report linting as covered.)",
       "_next": "verify_build"
     }'
   exit 0

assets/agents/step-runner/scripts/verify_tests.sh

@@ -13,6 +13,7 @@ else
 fi
 
 project_dir=$(echo "$state" | jq -r '.project_dir // "."')
+project_dir=$(resolve_gate_dir "$project_dir")
 
 if [[ -n "${TEST_CMD:-}" ]]; then
   cmd="$TEST_CMD"
@@ -24,7 +25,7 @@ fi
 if [[ -z "$cmd" || "$cmd" == "null" ]]; then
   jq -nc '{
     "tests_ok": true,
-    "tests_output": "(no test command available for this project type)",
+    "tests_output": "(GATE NOT RUN: no test command configured or detected. This is NOT evidence that tests passed — set TEST_CMD, and never report the suite as green.)",
     "_next": "edge_case_sweep"
   }'
   exit 0

assets/config-template.yaml

@@ -0,0 +1,279 @@
+# Coyote configuration. Generated by the first-run wizard.
+# Every setting is listed with its effective value and a short description.
+# For richer examples of each section, see
+# https://github.com/Dark-Alex-17/coyote/blob/main/config.example.yaml
+
+# ---- LLM ----
+__MODEL_BLOCK__
+temperature: null                # Set default temperature parameter (0, 1)
+top_p: null                      # Set default top-p parameter, with a range of (0, 1) or (0, 2) depending on the model
+
+# ---- Behavior ----
+dry_run: false                   # Display the messages that would be sent to the LLM without actually sending them
+stream: true                     # Controls whether to use the stream-style APIs when querying for completions from LLM clients
+save: true                       # Indicates whether to persist the conversation to messages.md for posterity
+keybindings: emacs               # Choose keybinding style (emacs, vi)
+editor: null                     # Specifies the editor used to edit the input buffer or session. (e.g. vim, emacs, nano, hx). Defaults to $EDITOR
+wrap: auto                       # Controls text wrapping (no, auto, <max-width>)
+wrap_code: false                 # Enables or disables the wrapping of code blocks
+
+# ---- Vault ----
+# See the [Vault documentation](https://github.com/Dark-Alex-17/coyote/wiki/Vault) for more information on the Coyote vault.
+#
+# The secrets_provider tells Coyote where to read and write secrets referenced via {{SECRET_NAME}} syntax.
+#
+# Shorthand: set vault_password_file to enable the local provider with that password
+# file (it cannot be a secret template).
+#
+# Explicit: set secrets_provider to one of the supported types below. When secrets_provider is set,
+# vault_password_file is ignored. Note: secrets_provider itself cannot use secret template syntax.
+# The vault must be initialized before any secrets can be resolved.
+#
+# Local (same as the shorthand above):
+# secrets_provider:
+#   type: local
+#   password_file: ~/.coyote_password
+#
+# AWS Secrets Manager (requires an authenticated AWS CLI; see `aws sso login` or `aws configure`):
+# secrets_provider:
+#   type: aws_secrets_manager
+#   aws_profile: default
+#   aws_region: us-east-1
+#
+# GCP Secret Manager (requires `gcloud auth application-default login`):
+# secrets_provider:
+#   type: gcp_secret_manager
+#   gcp_project_id: my-project-id
+#
+# Azure Key Vault (requires `az login`):
+# secrets_provider:
+#   type: azure_key_vault
+#   vault_name: my-vault-name
+#
+# gopass (requires the `gopass` CLI to be installed and initialized):
+# secrets_provider:
+#   type: gopass
+#   store: my-store              # Optional; omit to use the default store
+#
+# 1Password (requires the `op` CLI to be installed and signed in via `op signin`):
+# secrets_provider:
+#   type: one_password
+#   vault: Production            # Optional; omit to use the default vault
+#   account: my.1password.com    # Optional; omit to use the default account
+__SECRETS_BLOCK__
+
+# ---- Function Calling ----
+# See the [Tools documentation](https://github.com/Dark-Alex-17/coyote/wiki/Tools) for more details
+function_calling_support: true   # Enables or disables function calling (globally)
+mapping_tools: {}                # Alias for a tool or toolset
+                                 # Example:
+                                 #   mapping_tools:
+                                 #     fs: 'fs_cat,fs_ls,fs_mkdir,fs_rm,fs_write,fs_read,fs_glob,fs_grep'
+enabled_tools: null              # Which tools to enable by default.
+                                 # Accepts either a YAML list or a comma-separated string. Use 'all' to enable everything.
+                                 # Example (list form):
+                                 #   enabled_tools:
+                                 #     - fs
+                                 #     - web_search_coyote
+                                 # Example (comma-separated form):
+                                 #   enabled_tools: fs,web_search_coyote
+visible_tools: null              # Which tools are visible to be compiled (and are thus able to be defined in 'enabled_tools').
+                                 # Null/missing = all tools in the global tools dir are visible; [] = none;
+                                 # an explicit list makes only those tools visible.
+                                 # Example:
+                                 #   visible_tools:
+                                 #     - execute_command.sh
+                                 #     - fs_cat.sh
+                                 #     - fs_ls.sh
+
+# ---- Skills ----
+# Skills are modular knowledge or capability packs the LLM can load and unload mid-conversation.
+# See the [Skills documentation](https://github.com/Dark-Alex-17/coyote/wiki/Skills) for more details.
+skills_enabled: true             # Master switch. Set to false to hide all skill management tools from the model.
+                                 # Skills also require `function_calling_support: true` above to work at all.
+enabled_skills: null             # Which skills are available by default (no role/agent/session active). null = all visible.
+                                 # Accepts either a YAML list or a comma-separated string.
+                                 # Example (list form):
+                                 #   enabled_skills:
+                                 #     - git-master
+                                 #     - ai-slop-remover
+                                 # Example (comma-separated form):
+                                 #   enabled_skills: git-master,ai-slop-remover
+visible_skills: null             # The universe of skills allowed to be enabled in any context. null = all installed.
+                                 # Example:
+                                 #   visible_skills:
+                                 #     - ai-slop-remover
+                                 #     - code-review
+                                 #     - git-master
+
+# ---- Macros ----
+# Macros are Coyote's custom commands: named sequences of REPL commands and prompts, invoked directly by name
+# (a macro file named `review.yaml` runs as `.review [args]`; built-in commands always win a name collision).
+# Workspace-local macros in `.coyote/macros/` shadow same-named global macros (skip them with --no-workspace-macros).
+# See the [Macros documentation](https://github.com/Dark-Alex-17/coyote/wiki/Macros) for more details.
+enabled_macros: null             # Which macros are invocable by default (no role/agent/session active). null = all visible.
+                                 # An empty list means NO macros are invocable. Accepts either a YAML list or a
+                                 # comma-separated string. Roles, agents, and sessions may define their own
+                                 # `enabled_macros`; the most specific active one wins (session > agent > role > global).
+                                 # Example (list form):
+                                 #   enabled_macros:
+                                 #     - generate-commit-message
+                                 # Example (comma-separated form):
+                                 #   enabled_macros: generate-commit-message,review
+
+# ---- MCP Servers ----
+# See the [MCP Servers documentation](https://github.com/Dark-Alex-17/coyote/wiki/MCP-Servers) for more details
+mcp_server_support: true         # Enables or disables MCP servers (globally)
+mapping_mcp_servers: {}          # Alias for an MCP server or set of servers
+                                 # Example:
+                                 #   mapping_mcp_servers:
+                                 #     git: github,gitmcp
+enabled_mcp_servers: null        # Which MCP servers to enable by default.
+                                 # Accepts either a YAML list or a comma-separated string. Use 'all' to enable everything.
+                                 # Example (list form):
+                                 #   enabled_mcp_servers:
+                                 #     - github
+                                 #     - slack
+                                 # Example (comma-separated form):
+                                 #   enabled_mcp_servers: github,slack,ddg-search
+mcp_tools: null                  # Per-server MCP tool allowlists (glob patterns: * and ? supported).
+                                 # Tools that match no pattern are hidden from the model as if they
+                                 # don't exist. Stacks with the other allowlist layers (mcp.json
+                                 # `allowedTools`, role, agent, session, skill, graph node). Every
+                                 # configured layer must allow a tool, so layers only ever narrow.
+                                 # An empty list blocks all of a server's tools.
+                                 # Example:
+                                 #   mcp_tools:
+                                 #     github:
+                                 #       - get_*
+                                 #       - list_*
+                                 #     slack: []
+
+# ---- Auto-Continue (Todo System) ----
+# The auto-continue system provides built-in task tracking for improved reliability.
+# When enabled, the model can create todo lists and the system will automatically
+# prompt it to continue when incomplete tasks remain.
+# See the [Todo System documentation](https://github.com/Dark-Alex-17/coyote/wiki/TODO-System) for more information
+auto_continue: false             # Enable automatic continuation when incomplete todos remain (default: false)
+max_auto_continues: 10           # Maximum number of automatic continuations before stopping (default: 10)
+inject_todo_instructions: true   # Inject default todo usage instructions into the system prompt (default: true)
+continuation_prompt: null        # Custom prompt used when auto-continuing. If null, uses built-in default
+inject_skill_instructions: true  # Inject a short hint pointing the model at `skill__list` when skills are enabled
+                                 # in this context. Only injected if `function_calling_support`, `skills_enabled`, and the
+                                 # effective enabled skill set is non-empty (default: true)
+skill_instructions: null         # Custom text used for the skill hint when injected. If null, uses built-in default
+
+# ---- Prelude ----
+repl_prelude: null               # Set a default session or role for REPL mode to use (e.g. role:<name>, session:<name>, <session>:<role>)
+cmd_prelude: null                # Set a default session or role for CMD mode to use (e.g. role:<name>, session:<name>, <session>:<role>)
+agent_session: null              # Set a session to use when starting an agent (e.g. temp, default)
+
+# ---- Session ----
+# See the [Session documentation](https://github.com/Dark-Alex-17/coyote/wiki/Sessions) for more information
+save_session: null               # Controls the persistence of the session. If true, auto save; if false, don't auto-save; if null, ask the user what to do
+compression_threshold: 4000      # Compress the session when the token count reaches or exceeds this threshold
+compression_keep_last: 0         # Number of most-recent messages to keep visible after compression (0 = compress all messages)
+summarization_prompt: null       # The text prompt used for creating a concise summary of session messages. If null, uses built-in default
+summary_context_prompt: null     # The text prompt used for including the summary of the entire session as context to the model. If null, uses built-in default
+max_tool_result_chars: null      # Cap on tool result characters forwarded to the model per call (null = no cap)
+max_concurrent_jobs: null        # Max background jobs (`job__*` tools) running at once per context (null = 5; 0 disables background jobs entirely)
+
+# ---- Memory ----
+# See the [Memory documentation](https://github.com/Dark-Alex-17/coyote/wiki/Memory) for more information.
+# Memory is opt-in by workspace presence (`.coyote/memory/MEMORY.md`) and global
+# presence (`<config_dir>/memory/MEMORY.md`). Set `memory: false` to disable
+# even when memory files exist. The cascade is: agent > session > role > app.
+# Bootstrap with `coyote --init-memory [global|workspace]` to create the marker file
+# the LLM needs before it will write any memory.
+memory: null                     # null = enabled when memory exists on disk; true = force on; false = force off
+memory_cap_with_tools: null      # Char cap for injected memory when function calling is available (null = 6000).
+                                 # Only MEMORY.md indexes are injected; the LLM uses memory__read to fetch drill files.
+memory_cap_without_tools: null   # Char cap when function calling is unavailable (null = 12000).
+                                 # Indexes plus drill file bodies are injected up to this cap.
+
+# ---- Workspace Instructions ----
+# Human-curated project instructions injected read-only into the system prompt, in full.
+# Coyote walks up from the current directory and injects the first match from the file
+# chain below (per directory, in order). Scaffold with `coyote --init-instructions`.
+# Disable per-invocation with --no-workspace-instructions, or override the chain with
+# repeatable --workspace-instructions-file flags.
+workspace_instructions: null     # null/true = inject when an instructions file exists; false = never inject
+workspace_instructions_files: null # File name chain to search, in priority order.
+                                   # Default: [COYOTE.md, AGENTS.md, CLAUDE.md, GEMINI.md]
+                                   # Set to a custom list to reorder or drop fallbacks, e.g.:
+                                   #   workspace_instructions_files: [COYOTE.md]
+
+# ---- RAG ----
+# See the [RAG Docs](https://github.com/Dark-Alex-17/coyote/wiki/RAG) for more details.
+rag_embedding_model: null        # Specifies the embedding model used for context retrieval
+rag_reranker_model: null         # Specifies the reranker model used for sorting retrieved documents; Coyote uses Reciprocal Rank Fusion by default
+rag_top_k: 5                     # Specifies the number of documents to retrieve for answering queries
+rag_chunk_size: null             # Defines the size of chunks for document processing in characters
+rag_chunk_overlap: null          # Defines the overlap between chunks
+rag_template: null               # Defines the query structure using variables like __CONTEXT__, __SOURCES__, and __INPUT__
+                                 # to tailor searches to specific needs. If null, uses built-in default
+rag_extractor_model: null        # LLM model for graph-based entity/relationship extraction; when set, enables a graph RAG signal alongside vector and BM25
+rag_extractor_prompt: null       # Custom extraction prompt template; must contain __CHUNK__ placeholder; defaults to built-in prompt when null
+rag_graph_hops: 1                # Number of hops to expand from matched entities at query time (0 = seed nodes only; 1 = direct neighbors; increase for denser graphs)
+
+# Define document loaders to control how RAG and `.file`/`--file` load files of specific formats.
+document_loaders: {}
+                                 # You can add custom loaders using the following syntax:
+                                 #   <file-extension>: <command-to-load-the-file>
+                                 # Note: Use `$1` for input file and `$2` for output file. If `$2` is omitted, use stdout as output.
+                                 # Examples:
+                                 #   document_loaders:
+                                 #     pdf: 'pdftotext $1 -' # https://poppler.freedesktop.org
+                                 #     docx: 'pandoc --to plain $1' # https://pandoc.org
+                                 #     jina: 'curl -fsSL https://r.jina.ai/$1 -H "Authorization: Bearer {{JINA_API_KEY}}"' # Requires a Jina API key in the Coyote vault
+
+# ---- Appearance ----
+highlight: true                  # Controls syntax highlighting
+raw_markdown: false              # When true, render markdown as raw text with syntax highlighting only. When false (default), transforms markdown syntax (headings, bold, lists, etc.) into styled terminal output
+theme: null                      # null = the built-in dark theme; set to `light` for the built-in light theme.
+                                 # Custom themes: place a `dark.tmTheme` or `light.tmTheme` file in the Coyote config
+                                 # directory and it is used in place of the corresponding built-in.
+
+# ---- REPL Prompt ----
+# Custom REPL left/right prompts; see the [REPL Prompt Documentation](https://github.com/Dark-Alex-17/coyote/wiki/REPL-Prompt) for more information
+left_prompt: null                # If null, uses the built-in default:
+                                 #   '{color.red}{model}){color.green}{?session {?agent {agent}>}{session}{?role /}}{!session {?agent {agent}>}}{role}{?rag @{rag}}{color.cyan}{?session )}{!session >}{color.reset} '
+right_prompt: null               # If null, uses the built-in default:
+                                 #   '{color.cyan}{?reasoning_effort [{reasoning_effort}] }{color.purple}{?session {?consume_tokens {consume_tokens}({consume_percent}%)}{!consume_tokens {consume_tokens}}}{color.reset}'
+
+# ---- Miscellaneous ----
+user_agent: null                 # Set User-Agent HTTP header, use `auto` for coyote/<current-version>
+save_shell_history: true         # Whether to save shell execution command to the history file
+sync_models_url: null            # URL to sync model changes from. If null, uses the built-in default:
+                                 #   https://raw.githubusercontent.com/Dark-Alex-17/coyote/refs/heads/main/models.yaml
+
+# ---- Clients ----
+# See the [Clients documentation](https://github.com/Dark-Alex-17/coyote/wiki/Clients) for more details
+#
+# All clients have the following configuration:
+# - type: xxxx
+#   name: xxxx                                      # Only use it to distinguish clients with the same client type. Optional
+#   models:
+#     - name: xxxx                                  # Chat model
+#       max_input_tokens: 100000
+#       supports_vision: true
+#       supports_function_calling: true
+#     - name: xxxx                                  # Embedding model
+#       type: embedding
+#       default_chunk_size: 1500
+#       max_batch_size: 100
+#     - name: xxxx                                  # Reranker model
+#       type: reranker
+#   patch:                                          # Patch API calls
+#     chat_completions:                             # API type; Possible values: chat_completions, embeddings, and rerank
+#       <regex>:                                    # The regex to match model names, e.g. '.*' 'gpt-4o' 'gpt-4o|gpt-4-.*'
+#         url: ''                                   # Patch request URL
+#         body:                                     # Patch request body
+#           <json>
+#         headers:                                  # Patch request headers
+#           <key>: <value>
+#   extra:
+#     proxy: socks5://127.0.0.1:1080                # Set proxy
+#     connect_timeout: 10                           # Set timeout in seconds for connect to api
+#     read_timeout: 300                             # Set timeout in seconds for a read stall (no bytes received); 0 disables (default: 300)
+__CLIENTS_BLOCK__

assets/functions/mcp.json

@@ -21,8 +21,7 @@
     },
     "iwe": {
       "type": "stdio",
-      "command": "iwec",
-      "args": ["--project", "."]
+      "command": "iwec"
     }
   }
 }

assets/functions/sbx-mixin.yaml

@@ -1,4 +1,4 @@
-schemaVersion: "1"
+schemaVersion: '2'
 kind: mixin
 name: built-in-tools
 description: >
@@ -6,39 +6,39 @@ description: >
   global tools and the default MCP server set. Auto-applied by Coyote's sbx
   mixin discovery when running `coyote --sandbox`.
 
-network:
-  allowedDomains:
-    # fetch_url_via_jina + jina reader fallback
-    - "r.jina.ai:443"
-    # get_current_weather (.sh, .py, .ts)
-    - "wttr.in:443"
-    # search_arxiv (the .sh tool still uses http://, so :80 is required until fixed)
-    - "export.arxiv.org:443"
-    - "export.arxiv.org:80"
-    # search_arxiv + search_wikipedia may follow DOI redirects
-    - "doi.org:443"
-    # search_wikipedia
-    - "en.wikipedia.org:443"
-    # search_wolframalpha
-    - "api.wolframalpha.com:443"
-    # web_search_perplexity
-    - "api.perplexity.ai:443"
-    # web_search_tavily
-    - "api.tavily.com:443"
-    # send_twilio
-    - "api.twilio.com:443"
-    # MCP: github (built-in mcp.json: api.githubcopilot.com)
-    - "api.githubcopilot.com:443"
-    # MCP: atlassian (built-in mcp.json: mcp-remote -> mcp.atlassian.com)
-    - "mcp.atlassian.com:443"
-    # MCP: ddg-search (built-in mcp.json: uvx duckduckgo-mcp-server)
-    - "duckduckgo.com:443"
-    - "html.duckduckgo.com:443"
-    - "lite.duckduckgo.com:443"
-    # MCP: npx-based servers (mcp-remote) pull from npm
-    - "registry.npmjs.org:443"
-    # MCP: docker server may pull images from common registries
-    - "ghcr.io:443"
-    - "registry-1.docker.io:443"
-    - "auth.docker.io:443"
-    - "production.cloudflare.docker.com:443"
+permissions:
+  network:
+    allow:
+      # fetch_url_via_jina + jina reader fallback
+      - 'r.jina.ai'
+      # get_current_weather (.sh, .py, .ts)
+      - 'wttr.in'
+      # search_arxiv (the .sh tool still uses http://, so :80 is required until fixed)
+      - 'export.arxiv.org'
+      - 'export.arxiv.org:80'
+      # search_arxiv + search_wikipedia may follow DOI redirects
+      - 'doi.org'
+      # search_wikipedia
+      - 'en.wikipedia.org'
+      # search_wolframalpha
+      - 'api.wolframalpha.com'
+      # web_search_perplexity
+      - 'api.perplexity.ai'
+      # web_search_tavily
+      - 'api.tavily.com'
+      # send_twilio
+      - 'api.twilio.com'
+      # MCP: github (built-in mcp.json: api.githubcopilot.com)
+      - 'api.githubcopilot.com'
+      # MCP: atlassian (built-in mcp.json: mcp-remote -> mcp.atlassian.com)
+      - 'mcp.atlassian.com'
+      # MCP: ddg-search (built-in mcp.json: uvx duckduckgo-mcp-server)
+      - 'duckduckgo.com'
+      - 'html.duckduckgo.com'
+      - 'lite.duckduckgo.com'
+      # MCP: npx-based servers (mcp-remote) pull from npm
+      - 'registry.npmjs.org'
+      # MCP: docker server may pull images from common registries
+      - 'ghcr.io'
+      - 'registry-1.docker.io'
+      - 'auth.docker.io'

assets/functions/scripts/run-agent.py

@@ -27,14 +27,30 @@ def _ensure_cwd_venv():
 _ensure_cwd_venv()
 
 
+def resolve_dir(env_name, default_path):
+    """Resolve a directory at run time.
+
+    Prefer the override env var when set, otherwise fall back to the default
+    path derived from this script's own location, so the shim keeps working
+    when the config dir moves or is shared across environments with different
+    home directories.
+    """
+    value = os.environ.get(env_name)
+    if value:
+        return value
+    return os.path.normpath(default_path)
+
+
 def main():
     (agent_func, raw_data) = parse_argv()
     agent_data = parse_raw_data(raw_data)
 
-    root_dir = "{config_dir}"
-    setup_env(root_dir, agent_func, raw_data)
+    self_dir = os.path.dirname(os.path.abspath(__file__))
+    agent_dir = os.path.normpath(os.path.join(self_dir, ".."))
+    root_dir = resolve_dir("{root_dir_env}", os.path.join(self_dir, "{root_dir_rel}"))
+    setup_env(root_dir, agent_dir, agent_func, raw_data)
 
-    agent_tools_path = os.path.join(root_dir, "agents/{agent_name}/tools.py")
+    agent_tools_path = os.path.join(agent_dir, "tools.py")
     run(agent_tools_path, agent_func, agent_data)
 
 
@@ -65,12 +81,12 @@ def parse_argv():
     return agent_func, agent_data
 
 
-def setup_env(root_dir, agent_func, raw_data):
+def setup_env(root_dir, agent_dir, agent_func, raw_data):
     load_env(os.path.join(root_dir, ".env"))
     os.environ["LLM_ROOT_DIR"] = root_dir
     os.environ["LLM_AGENT_NAME"] = "{agent_name}"
     os.environ["LLM_AGENT_FUNC"] = agent_func
-    os.environ["LLM_AGENT_ROOT_DIR"] = os.path.join(root_dir, "agents", "{agent_name}")
+    os.environ["LLM_AGENT_ROOT_DIR"] = agent_dir
     os.environ["LLM_AGENT_CACHE_DIR"] = os.path.join(root_dir, "cache", "{agent_name}")
     os.environ["LLM_AGENT_RAW_JSON"] = raw_data
 

assets/functions/scripts/run-agent.sh

@@ -5,13 +5,30 @@
 set -e
 
 main() {
-    root_dir="{config_dir}"
+    self_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    agent_dir="$(cd "$self_dir/.." && pwd)"
+    root_dir="$(resolve_dir "{root_dir_env}" "$self_dir/{root_dir_rel}")"
+    functions_dir="$(resolve_dir "{functions_dir_env}" "$self_dir/{functions_dir_rel}")"
     parse_argv "$@"
     setup_env
-    tools_path="$root_dir/agents/{agent_name}/tools.sh"
+    tools_path="$agent_dir/tools.sh"
     run
 }
 
+# Resolve a directory at run time: prefer the override env var ($1) when set,
+# otherwise fall back to the default path ($2) derived from this script's own
+# location, so the shim keeps working when the config dir moves or is shared
+# across environments with different home directories.
+resolve_dir() {
+    local override
+    override="$(printenv "$1" 2>/dev/null || true)"
+    if [[ -n "$override" ]]; then
+        echo "$override"
+    else
+        (cd "$2" 2>/dev/null && pwd) || echo "$2"
+    fi
+}
+
 parse_argv() {
 		agent_func="$1"
     if [[ -n "$LLM_TOOL_DATA_FILE" ]] && [[ -f "$LLM_TOOL_DATA_FILE" ]]; then
@@ -29,9 +46,9 @@ setup_env() {
     export LLM_ROOT_DIR="$root_dir"
     export LLM_AGENT_NAME="{agent_name}"
     export LLM_AGENT_FUNC="$agent_func"
-    export LLM_AGENT_ROOT_DIR="$LLM_ROOT_DIR/agents/{agent_name}"
+    export LLM_AGENT_ROOT_DIR="$agent_dir"
     export LLM_AGENT_CACHE_DIR="$LLM_ROOT_DIR/cache/{agent_name}"
-    export LLM_PROMPT_UTILS_FILE="{prompt_utils_file}"
+    export LLM_PROMPT_UTILS_FILE="$functions_dir/utils/prompt-utils.sh"
     export LLM_AGENT_RAW_JSON="$agent_data"
 }
 
@@ -59,6 +76,10 @@ run() {
         die "error: no JSON data"
     fi
 
+    if [[ ! -f "$tools_path" ]]; then
+        die "error: agent tools script not found: $tools_path"
+    fi
+
     if [[ "$OS" == "Windows_NT" ]]; then
         set -o igncr
         tools_path="$(cygpath -w "$tools_path")"
@@ -122,4 +143,3 @@ die() {
 }
 
 main "$@"
-

assets/functions/scripts/run-agent.ts

@@ -3,17 +3,38 @@
 // Usage: ./{agent_name}.ts <agent-func> <agent-data>
 
 import { readFileSync, writeFileSync, existsSync } from "fs";
-import { join } from "path";
-import { pathToFileURL } from "url";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+
+function selfDir(): string {
+  if (typeof __dirname !== "undefined") {
+    return __dirname;
+  }
+  return dirname(fileURLToPath(import.meta.url));
+}
+
+// Resolve a directory at run time: prefer the override env var when set,
+// otherwise fall back to the default path derived from this script's own
+// location, so the shim keeps working when the config dir moves or is shared
+// across environments with different home directories.
+function resolveDir(envName: string, defaultPath: string): string {
+  const value = process.env[envName];
+  if (value) {
+    return value;
+  }
+  return resolve(defaultPath);
+}
 
 async function main(): Promise<void> {
   const { agentFunc, rawData } = parseArgv();
   const agentData = parseRawData(rawData);
 
-  const configDir = "{config_dir}";
-  setupEnv(configDir, agentFunc, rawData);
+  const binDir = selfDir();
+  const agentDir = resolve(binDir, "..");
+  const configDir = resolveDir("{root_dir_env}", join(binDir, "{root_dir_rel}"));
+  setupEnv(configDir, agentDir, agentFunc, rawData);
 
-  const agentToolsPath = join(configDir, "agents", "{agent_name}", "tools.ts");
+  const agentToolsPath = join(agentDir, "tools.ts");
   await run(agentToolsPath, agentFunc, agentData);
 }
 
@@ -48,12 +69,17 @@ function parseArgv(): { agentFunc: string; rawData: string } {
   return { agentFunc, rawData: agentData };
 }
 
-function setupEnv(configDir: string, agentFunc: string, rawData: string): void {
+function setupEnv(
+  configDir: string,
+  agentDir: string,
+  agentFunc: string,
+  rawData: string,
+): void {
   loadEnv(join(configDir, ".env"));
   process.env["LLM_ROOT_DIR"] = configDir;
   process.env["LLM_AGENT_NAME"] = "{agent_name}";
   process.env["LLM_AGENT_FUNC"] = agentFunc;
-  process.env["LLM_AGENT_ROOT_DIR"] = join(configDir, "agents", "{agent_name}");
+  process.env["LLM_AGENT_ROOT_DIR"] = agentDir;
   process.env["LLM_AGENT_CACHE_DIR"] = join(configDir, "cache", "{agent_name}");
   process.env["LLM_AGENT_RAW_JSON"] = rawData;
 }

assets/functions/scripts/run-tool.py

@@ -27,14 +27,30 @@ def _ensure_cwd_venv():
 _ensure_cwd_venv()
 
 
+def resolve_dir(env_name, default_path):
+    """Resolve a directory at run time.
+
+    Prefer the override env var when set, otherwise fall back to the default
+    path derived from this script's own location, so the shim keeps working
+    when the config dir moves or is shared across environments with different
+    home directories.
+    """
+    value = os.environ.get(env_name)
+    if value:
+        return value
+    return os.path.normpath(default_path)
+
+
 def main():
     raw_data = parse_argv()
     tool_data = parse_raw_data(raw_data)
 
-    root_dir = "{root_dir}"
+    self_dir = os.path.dirname(os.path.abspath(__file__))
+    root_dir = resolve_dir("{root_dir_env}", os.path.join(self_dir, "{root_dir_rel}"))
+    functions_dir = resolve_dir("{functions_dir_env}", os.path.join(self_dir, "{functions_dir_rel}"))
     setup_env(root_dir, raw_data)
 
-    tool_path = "{tool_path}.py"
+    tool_path = os.path.join(functions_dir, "tools", "{function_name}.py")
     run(tool_path, "run", tool_data)
 
 

assets/functions/scripts/run-tool.sh

@@ -5,13 +5,29 @@
 set -e
 
 main() {
-    root_dir="{root_dir}"
+    self_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    root_dir="$(resolve_dir "{root_dir_env}" "$self_dir/{root_dir_rel}")"
+    functions_dir="$(resolve_dir "{functions_dir_env}" "$self_dir/{functions_dir_rel}")"
     parse_argv "$@"
     setup_env
-    tool_path="{tool_path}.sh"
+    tool_path="$functions_dir/tools/{function_name}.sh"
     run
 }
 
+# Resolve a directory at run time: prefer the override env var ($1) when set,
+# otherwise fall back to the default path ($2) derived from this script's own
+# location, so the shim keeps working when the config dir moves or is shared
+# across environments with different home directories.
+resolve_dir() {
+    local override
+    override="$(printenv "$1" 2>/dev/null || true)"
+    if [[ -n "$override" ]]; then
+        echo "$override"
+    else
+        (cd "$2" 2>/dev/null && pwd) || echo "$2"
+    fi
+}
+
 parse_argv() {
     if [[ -n "$LLM_TOOL_DATA_FILE" ]] && [[ -f "$LLM_TOOL_DATA_FILE" ]]; then
         tool_data="$(cat "$LLM_TOOL_DATA_FILE")"
@@ -28,7 +44,7 @@ setup_env() {
     export LLM_ROOT_DIR="$root_dir"
     export LLM_TOOL_NAME="{function_name}"
     export LLM_TOOL_CACHE_DIR="$LLM_ROOT_DIR/cache/{function_name}"
-    export LLM_PROMPT_UTILS_FILE="{prompt_utils_file}"
+    export LLM_PROMPT_UTILS_FILE="$functions_dir/utils/prompt-utils.sh"
     export LLM_TOOL_RAW_JSON="$tool_data"
 }
 
@@ -56,6 +72,10 @@ run() {
         die "error: no JSON data"
     fi
 
+    if [[ ! -f "$tool_path" ]]; then
+        die "error: tool script not found: $tool_path"
+    fi
+
     if [[ "$OS" == "Windows_NT" ]]; then
         set -o igncr
         tool_path="$(cygpath -w "$tool_path")"

assets/functions/scripts/run-tool.ts

@@ -3,17 +3,41 @@
 // Usage: ./{function_name}.ts <tool-data>
 
 import { readFileSync, writeFileSync, existsSync } from "fs";
-import { join } from "path";
-import { pathToFileURL } from "url";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+
+function selfDir(): string {
+  if (typeof __dirname !== "undefined") {
+    return __dirname;
+  }
+  return dirname(fileURLToPath(import.meta.url));
+}
+
+// Resolve a directory at run time: prefer the override env var when set,
+// otherwise fall back to the default path derived from this script's own
+// location, so the shim keeps working when the config dir moves or is shared
+// across environments with different home directories.
+function resolveDir(envName: string, defaultPath: string): string {
+  const value = process.env[envName];
+  if (value) {
+    return value;
+  }
+  return resolve(defaultPath);
+}
 
 async function main(): Promise<void> {
   const rawData = parseArgv();
   const toolData = parseRawData(rawData);
 
-  const rootDir = "{root_dir}";
+  const binDir = selfDir();
+  const rootDir = resolveDir("{root_dir_env}", join(binDir, "{root_dir_rel}"));
+  const functionsDir = resolveDir(
+    "{functions_dir_env}",
+    join(binDir, "{functions_dir_rel}"),
+  );
   setupEnv(rootDir, rawData);
 
-  const toolPath = "{tool_path}.ts";
+  const toolPath = join(functionsDir, "tools", "{function_name}.ts");
   await run(toolPath, "run", toolData);
 }
 

assets/functions/tools/execute_command.sh

@@ -20,5 +20,12 @@ main() {
     trap "rm -f '$script'" EXIT
     # shellcheck disable=SC2154
     printf '%s\n' "$argc_command" > "$script"
-    bash -e -o pipefail "$script" >> "$LLM_OUTPUT"
+    # No -e: the command gets standard interactive-shell semantics — the last
+    # statement decides the exit code, so trailing guards like `; exit 0` work
+    # and an intermediate non-zero status (grep with no matches, a failing
+    # test run being inspected) cannot abort the script mid-way. pipefail is
+    # kept so a failing pipeline stage still surfaces in the exit code. 2>&1:
+    # the harness only returns $LLM_OUTPUT on success, so without it stderr
+    # (git push, cargo progress, curl -v) vanishes from successful calls.
+    bash -o pipefail "$script" >> "$LLM_OUTPUT" 2>&1
 }

assets/functions/tools/fs_cat.sh

@@ -10,5 +10,13 @@ set -e
 
 main() {
     # shellcheck disable=SC2154
-		cat "$argc_path" >> "$LLM_OUTPUT" 2>&1 || echo "No such file or path: $argc_path" >> "$LLM_OUTPUT"
-}
+    local path="$argc_path"
+
+    # An empty result is shown to the model as the opaque literal "DONE"; emit a note instead.
+    if [[ -f "$path" && ! -s "$path" ]]; then
+        echo "(empty file: $path)" >> "$LLM_OUTPUT"
+        return 0
+    fi
+
+    cat "$path" >> "$LLM_OUTPUT" 2>&1 || echo "No such file or path: $path" >> "$LLM_OUTPUT"
+}

assets/functions/tools/fs_glob.sh

@@ -17,8 +17,8 @@ main() {
     local search_path="${argc_path:-.}"
 
     if [[ ! -d "$search_path" ]]; then
-        echo "Error: directory not found: $search_path" >> "$LLM_OUTPUT"
-        return 1
+        echo "Error: directory not found: $search_path" >&2
+        exit 1
     fi
 
     local results
@@ -33,7 +33,18 @@ main() {
             --exclude '.build' \
             2>/dev/null | head -n "$MAX_RESULTS") || true
     else
-        results=$(find "$search_path" -type f -name "$glob_pattern" \
+        local name_pattern dir_prefix effective_search
+        name_pattern="${glob_pattern##*/}"
+        [[ -z "$name_pattern" || "$name_pattern" == "**" ]] && name_pattern="*"
+        if [[ "$glob_pattern" == */* ]]; then
+            dir_prefix="${glob_pattern%%\**}"
+            dir_prefix="${dir_prefix%/}"
+            effective_search="${search_path}${dir_prefix:+/$dir_prefix}"
+        else
+            effective_search="$search_path"
+        fi
+        [[ -d "$effective_search" ]] || effective_search="$search_path"
+        results=$(find "$effective_search" -type f -name "$name_pattern" \
             -not -path '*/.git/*' \
             -not -path '*/node_modules/*' \
             -not -path '*/target/*' \

assets/functions/tools/fs_grep.sh

@@ -21,11 +21,15 @@ main() {
     local include_filter="${argc_include:-}"
 
     if [[ ! -e "$search_path" ]]; then
-        echo "Error: path not found: $search_path" >> "$LLM_OUTPUT"
-        return 1
+        echo "Error: path not found: $search_path" >&2
+        exit 1
     fi
 
-    local grep_args=(-nH --color=never)
+    # --binary-files=text: GNU grep's binary heuristic false-positives on valid
+    # UTF-8 source files >=128KiB when a multibyte character straddles an
+    # internal read-buffer boundary, silently returning zero matches. This tool
+    # only searches text, so always force text mode.
+    local grep_args=(-nH --color=never --binary-files=text)
 
     if [[ -d "$search_path" ]]; then
         # Use -r (not -R) so symlinks to directories are NOT followed - this avoids

assets/functions/tools/fs_ls.sh

@@ -9,5 +9,18 @@ set -e
 
 main() {
     # shellcheck disable=SC2154
-    ls -1 "$argc_path" >> "$LLM_OUTPUT" 2>&1 || echo "No such path: $argc_path" >> "$LLM_OUTPUT"
-}
+    local path="$argc_path"
+    local output
+
+    if ! output=$(ls -1 "$path" 2>&1); then
+        echo "$output" >> "$LLM_OUTPUT"
+        return 0
+    fi
+
+    # An empty result is shown to the model as the opaque literal "DONE"; emit a note instead.
+    if [[ -z "$output" ]]; then
+        echo "(empty directory: $path)" >> "$LLM_OUTPUT"
+    else
+        echo "$output" >> "$LLM_OUTPUT"
+    fi
+}

assets/functions/tools/fs_patch.sh

@@ -14,6 +14,11 @@ set -e
 #   is the most common cause of "unable to apply patch" failures, especially in files with sed/jq/regex pipelines or
 #   embedded Python with quoted strings.
 # - Hunks are applied in order; the first hunk that fails aborts the whole patch — later hunks are NOT attempted.
+# - Hunks anchor at the FIRST exact match of their context in the file, so include enough context to make each hunk
+#   unique. Hunks must appear in file order.
+# - Every hunk needs at least one context or removed line to anchor it; a hunk containing only additions is an error.
+# - Unrecognized lines inside a hunk are hard errors: every hunk line must start with ' ' (context), '-' (removal),
+#   or '+' (addition).
 # - If you've edited this file in earlier tool calls, fs_cat it again before composing the patch. A stale view of the file
 #   produces context lines that no longer match.
 # - On failure the error message names the failing hunk and shows the expected-vs-actual line. Fix that specific line and
@@ -24,7 +29,7 @@ set -e
 # your changes).
 
 # @option --path! The path of the file to apply the patch to
-# @option --contents! The patch to apply to the file
+# @option --content! The patch to apply to the file
 
 # @env LLM_OUTPUT=/dev/stdout The output path
 
@@ -33,7 +38,11 @@ source "$LLM_PROMPT_UTILS_FILE"
 
 # shellcheck disable=SC2154
 main() {
-    argc_contents="$(jq -r '.contents' <<< "$LLM_TOOL_RAW_JSON")"
+		# Command substitution strips *all* trailing newlines and `jq -r` appends one
+		# of its own, so read with `-j` and pin the real end of the content with a
+		# sentinel that is removed afterwards.
+		argc_contents="$(jq -j '.content' <<< "$LLM_TOOL_RAW_JSON"; printf x)"
+		argc_contents="${argc_contents%x}"
     argc_path="$(jq -r '.path' <<< "$LLM_TOOL_RAW_JSON")"
 
     if [[ ! -f "$argc_path" ]]; then
@@ -41,7 +50,19 @@ main() {
         exit 1
     fi
 
-    new_contents="$(patch_file "$argc_path" <(printf "%s" "$argc_contents"))"
+		# Same sentinel guard on the patched result, otherwise the trailing newline
+		# is stripped again on the way back out. `rc` preserves patch_file's exit
+		# status so a failure still aborts under `set -e`.
+		new_contents="$(patch_file "$argc_path" <(printf "%s" "$argc_contents"); rc=$?; printf x; exit "$rc")"
+		new_contents="${new_contents%x}"
+
+		# awk newline-terminates every printed line, so patching a file that lacks
+		# a final newline would silently add one. Preserve the original file's
+		# final-newline state instead.
+		if [[ -n "$(tail -c 1 "$argc_path")" ]]; then
+			new_contents="${new_contents%$'\n'}"
+		fi
+
     printf "%s" "$new_contents" | git diff --no-index "$argc_path" - || true
 
     guard_operation "Apply changes?"

assets/functions/tools/fs_read.sh

@@ -8,8 +8,8 @@ set -e
 # Use the grep tool to find specific content before reading, then read with offset to target the relevant section.
 
 # @option --path! The absolute path to the file or directory to read
-# @option --offset The line number to start reading from (1-indexed, default: 1)
-# @option --limit The maximum number of lines to read (default: 2000)
+# @option --offset <INT> The line number to start reading from (1-indexed, default: 1)
+# @option --limit <INT> The maximum number of lines to read (default: 2000)
 
 # @env LLM_OUTPUT=/dev/stdout The output path
 
@@ -23,8 +23,8 @@ main() {
     local limit="${argc_limit:-2000}"
 
     if [[ ! -e "$target" ]]; then
-        echo "Error: path not found: $target" >> "$LLM_OUTPUT"
-        return 1
+        echo "Error: path not found: $target" >&2
+        exit 1
     fi
 
     if [[ -d "$target" ]]; then
@@ -33,9 +33,20 @@ main() {
     fi
 
     local total_lines file_bytes
-    total_lines=$(wc -l < "$target" 2>/dev/null || echo 0)
+    # awk counts a final line that lacks a trailing newline; wc -l would undercount it by one.
+    total_lines=$(awk 'END { print NR }' "$target" 2>/dev/null || echo 0)
     file_bytes=$(wc -c < "$target" 2>/dev/null || echo 0)
 
+    if [[ "$total_lines" -eq 0 ]]; then
+        echo "(file is empty: $target)" >> "$LLM_OUTPUT"
+        return 0
+    fi
+
+    if [[ "$offset" -gt "$total_lines" ]]; then
+        echo "(offset $offset is past the end of the file, which has $total_lines lines)" >> "$LLM_OUTPUT"
+        return 0
+    fi
+
     if [[ "$file_bytes" -gt "$MAX_BYTES" ]] && [[ "$offset" -eq 1 ]] && [[ "$limit" -ge 2000 ]]; then
         {
             echo "Warning: Large file (${file_bytes} bytes, ${total_lines} lines). Showing first ${limit} lines."
@@ -48,7 +59,8 @@ main() {
 
     sed -n "${offset},${end_line}p" "$target" 2>/dev/null | {
         local line_num=$offset
-        while IFS= read -r line; do
+        # `|| [[ -n "$line" ]]` keeps the final line when the file has no trailing newline.
+        while IFS= read -r line || [[ -n "$line" ]]; do
             if [[ ${#line} -gt $MAX_LINE_LENGTH ]]; then
                 line="${line:0:$MAX_LINE_LENGTH}... (truncated)"
             fi

assets/functions/tools/fs_write.sh

@@ -6,7 +6,7 @@ set -e
 # sending less data, and is less prone to accidental data loss.
 
 # @option --path! The path of the file to write to
-# @option --contents! The full contents to write to the file
+# @option --content! The full contents to write to the file
 
 # @env LLM_OUTPUT=/dev/stdout The output path
 
@@ -15,7 +15,12 @@ source "$LLM_PROMPT_UTILS_FILE"
 
 # shellcheck disable=SC2154
 main() {
-    argc_contents="$(jq -r '.contents' <<< "$LLM_TOOL_RAW_JSON")"
+		# Command substitution strips *all* trailing newlines and `jq -r` appends one
+		# of its own, so read with `-j` and pin the real end of the content with a
+		# sentinel that is removed afterwards. Without this every written file loses
+		# its final newline, which breaks formatters such as `cargo fmt --check`.
+		argc_contents="$(jq -j '.content' <<< "$LLM_TOOL_RAW_JSON"; printf x)"
+		argc_contents="${argc_contents%x}"
     argc_path="$(jq -r '.path' <<< "$LLM_TOOL_RAW_JSON")"
 
     if [[ -f "$argc_path" ]]; then

assets/functions/tools/git_command.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -e
+
+# @describe Execute a git command. Strictly limited to a single git invocation: the command must start with 'git' and shell metacharacters (; & | < > ( ) $ `) are rejected outside single quotes — no pipes, chaining, redirection, or command substitution. Use git's own flags instead of pipes (e.g. 'git log -n 20' instead of piping to head). Output is never paginated and git will never prompt for input.
+# @option --command! The git command to execute (e.g. "git status --short").
+
+# @env LLM_OUTPUT=/dev/stdout The output path
+
+# shellcheck disable=SC1090
+source "$LLM_PROMPT_UTILS_FILE"
+
+main() {
+    # shellcheck disable=SC2154
+    argc_command="$(jq -r '.command' <<< "$LLM_TOOL_RAW_JSON")"
+
+    validate_command "$argc_command" "git"
+
+    guard_operation "Execute git command: $argc_command"
+
+    export GIT_PAGER=cat PAGER=cat GIT_TERMINAL_PROMPT=0
+    export GIT_EDITOR=true GIT_SEQUENCE_EDITOR=true
+
+    local script
+    script="$(mktemp)"
+    # shellcheck disable=SC2064
+    trap "rm -f '$script'" EXIT
+    printf '%s\n' "$argc_command" > "$script"
+    bash -e -o pipefail "$script" >> "$LLM_OUTPUT"
+}
+
+die() {
+    echo "$*" >&2
+    exit 1
+}
+
+# Ensure the command is a single plain invocation of $2 with no shell escape
+# hatches. Metacharacters are allowed inside single quotes (where bash treats
+# them as literals) but rejected everywhere else, including $ and ` inside
+# double quotes (expansion/substitution).
+validate_command() {
+    local cmd="$1" prog="$2"
+
+    local first
+    first="$(awk '{print $1}' <<< "$cmd")"
+    if [[ "$first" != "$prog" ]]; then
+        die "error: this tool only executes $prog commands; the command must start with '$prog' (got: '${first:-<empty>}')"
+    fi
+
+    local i c in_single=0 in_double=0 len=${#cmd}
+    for (( i = 0; i < len; i++ )); do
+        c="${cmd:i:1}"
+        if (( in_single )); then
+            [[ "$c" == "'" ]] && in_single=0
+            continue
+        fi
+        if (( in_double )); then
+            case "$c" in
+                '\') i=$((i + 1)) ;;
+                '"') in_double=0 ;;
+                '$' | '`') die "error: '$c' is not allowed inside double quotes (expansion/substitution is blocked); use single quotes for literal text" ;;
+            esac
+            continue
+        fi
+        case "$c" in
+            '\') i=$((i + 1)) ;;
+            "'") in_single=1 ;;
+            '"') in_double=1 ;;
+            ';' | '&' | '|' | '<' | '>' | '(' | ')' | '$' | '`')
+                die "error: shell metacharacter '$c' is not allowed; run a single $prog command with no pipes, chaining, redirection, or substitution (use $prog's own flags instead, and single quotes for literal text)"
+                ;;
+            $'\n')
+                die "error: newlines are not allowed; run a single $prog command"
+                ;;
+        esac
+    done
+    if (( in_single || in_double )); then
+        die "error: unbalanced quotes in command"
+    fi
+}

assets/functions/tools/web_search_coyote.sh

@@ -15,6 +15,11 @@ set -e
 #   - vertexai:gemini-*
 #   - perplexity:*
 #   - ernie:*
+#   - claude:*                       (Anthropic native web_search server tool)
+#   - openai:gpt-4o-search-preview   (and -mini-; requires an api-key openai
+#                                     client — the codex OAuth path uses the
+#                                     Responses API where this parameter
+#                                     does not exist)
 # @env LLM_OUTPUT=/dev/stdout The output path
 
 # shellcheck disable=SC2154
@@ -30,6 +35,13 @@ main() {
 }'
     elif [[ "$client" == "ernie" ]]; then
         export COYOTE_PATCH_ERNIE_CHAT_COMPLETIONS='{".*":{"body":{"web_search":{"enable":true}}}}'
+    elif [[ "$client" == "claude" ]]; then
+        export COYOTE_PATCH_CLAUDE_CHAT_COMPLETIONS='{".*":{"body":{"tools":[{"type":"web_search_20250305","name":"web_search","max_uses":5}]}}}'
+    elif [[ "$client" == "openai" ]]; then
+        # Chat Completions native search exists only on the search-preview
+        # models; the regex scopes the patch so other OpenAI models run
+        # unpatched instead of erroring on an unsupported parameter.
+        export COYOTE_PATCH_OPENAI_CHAT_COMPLETIONS='{"gpt-4o.*search-preview.*":{"body":{"web_search_options":{}}}}'
     fi
 
     coyote -m "$WEB_SEARCH_MODEL" "$argc_query" >> "$LLM_OUTPUT"

assets/functions/utils/prompt-utils.sh

@@ -186,7 +186,9 @@ input() {
 }
 
 confirm() {
-  trap "stty echo; exit" EXIT
+  # stty targets stdin, which is /dev/null when the host spawns tool scripts;
+  # point it at the real terminal and stay quiet when there isn't one.
+  trap "stty echo </dev/tty 2>/dev/null; exit" EXIT
   _prompt_text "$1 (y/N)"
   echo -en "\033[36m\c " >&2
 
@@ -229,7 +231,7 @@ list() {
   declare first_row
   first_row=$((last_row - opts_count + 1))
 
-  trap "_cursor_blink_on; stty echo; exit" 2
+  trap "_cursor_blink_on; stty echo </dev/tty 2>/dev/null; exit" 2
 
   _cursor_blink_off
 
@@ -275,7 +277,7 @@ checkbox() {
   declare first_row
   first_row=$((last_row - opts_count + 1))
 
-  trap "_cursor_blink_on; stty echo; exit" 2
+  trap "_cursor_blink_on; stty echo </dev/tty 2>/dev/null; exit" 2
 
   _cursor_blink_off
 
@@ -403,7 +405,7 @@ range() {
   declare current_row
   current_row=$((first_row - 1))
 
-  trap "_cursor_blink_on; stty echo; exit" 2
+  trap "_cursor_blink_on; stty echo </dev/tty 2>/dev/null; exit" 2
 
   _cursor_blink_off
 
@@ -528,7 +530,11 @@ guard_operation() {
 # +    print(f"Hello {name}")
 patch_file() {
   awk '
-    FNR == NR {
+    function isHeaderPair(i) {
+      return (patchLines[i] ~ /^--- / && patchLines[i+1] ~ /^\+\+\+ / && patchLines[i+2] ~ /^@@/)
+    }
+
+    FILENAME == ARGV[1] {
       lines[FNR] = $0
       next;
     }
@@ -547,12 +553,7 @@ patch_file() {
       while (patchLineIndex <= totalPatchLines) {
         line = patchLines[patchLineIndex]
 
-        if (line ~ /^--- / || line ~ /^\+\+\+ /) {
-          patchLineIndex++
-          continue
-        }
-
-        if (line ~ /^@@ /) {
+        if (line ~ /^@@/) {
           mode = "hunk"
           hunkIndex++
           patchLineIndex++
@@ -560,7 +561,22 @@ patch_file() {
         }
 
         if (mode == "hunk") {
-          while (patchLineIndex <= totalPatchLines && line ~ /^[-+ ]|^\s*$/ && line !~ /^--- /) {
+          while (patchLineIndex <= totalPatchLines) {
+            line = patchLines[patchLineIndex]
+
+            if (line ~ /^\\ No newline/) {
+              patchLineIndex++
+              continue
+            }
+
+            if (isHeaderPair(patchLineIndex)) {
+              break
+            }
+
+            if (line !~ /^[-+ ]/ && line !~ /^[ \t]*$/) {
+              break
+            }
+
             sanitizedLine = substr(line, 2)
 
             if (line !~ /^\+/) {
@@ -574,21 +590,79 @@ patch_file() {
             }
 
             patchLineIndex++
-            line = patchLines[patchLineIndex]
           }
 
           mode = "none"
-        } else {
-          patchLineIndex++
+          continue
         }
+
+        if (isHeaderPair(patchLineIndex)) {
+          patchLineIndex += 2
+          continue
+        }
+
+        if (line ~ /^\\ No newline/) {
+          patchLineIndex++
+          continue
+        }
+
+        if (hunkIndex == 0) {
+          # Preamble before the first hunk: tolerate prose, code fences, and lone headers.
+          patchLineIndex++
+          continue
+        }
+
+        if (line ~ /^[ \t]*$/ || line ~ /^```/) {
+          patchLineIndex++
+          continue
+        }
+
+        print "error: unrecognized line in patch (line " patchLineIndex "): " line > "/dev/stderr"
+        print "" > "/dev/stderr"
+        print "Every line inside a hunk must start with \" \" (context), \"-\" (removal), or \"+\" (addition)." > "/dev/stderr"
+        exit 1
       }
 
       if (hunkIndex == 0) {
         print "error: no patch" > "/dev/stderr"
+        print "" > "/dev/stderr"
+        print "No hunk header was found. Each hunk must start with a line beginning \"@@\"" > "/dev/stderr"
+        print "(for example \"@@ ... @@\" or \"@@ -1,4 +1,4 @@\"). Inside a hunk, context lines" > "/dev/stderr"
+        print "start with a single space, removed lines with \"-\", and added lines with \"+\"." > "/dev/stderr"
         exit 1
       }
 
       totalHunks = hunkIndex
+
+      if (totalLines == 0) {
+        for (h = 1; h <= totalHunks; h++) {
+          if (hunkTotalOriginalLines[h] > 0) {
+            print "error: unable to apply patch" > "/dev/stderr"
+            print "" > "/dev/stderr"
+            print "Hunk " h " expects existing content but the file is empty." > "/dev/stderr"
+            exit 1
+          }
+        }
+
+        for (h = 1; h <= totalHunks; h++) {
+          for (i = 1; i <= hunkTotalUpdatedLines[h]; i++) {
+            print hunkUpdatedLines[h,i]
+          }
+        }
+
+        exit 0
+      }
+
+      for (h = 1; h <= totalHunks; h++) {
+        if (hunkTotalOriginalLines[h] == 0) {
+          print "error: unable to apply patch" > "/dev/stderr"
+          print "" > "/dev/stderr"
+          print "Hunk " h " contains no context or removed lines; include at least one" > "/dev/stderr"
+          print "context line so the hunk can be anchored." > "/dev/stderr"
+          exit 1
+        }
+      }
+
       hunkIndex = 1
 
       for (lineIndex = 1; lineIndex <= totalLines; lineIndex++) {
@@ -599,7 +673,7 @@ patch_file() {
           nextLineIndex = lineIndex + 1
 
           for (i = 2; i <= hunkTotalOriginalLines[hunkIndex]; i++) {
-            if (lines[nextLineIndex] != hunkOriginalLines[hunkIndex,i]) {
+            if (nextLineIndex > totalLines || lines[nextLineIndex] != hunkOriginalLines[hunkIndex,i]) {
               if (i - 1 > bestPartialLen[hunkIndex]) {
                 bestPartialLen[hunkIndex] = i - 1
                 bestPartialAnchorLine[hunkIndex] = lineIndex
@@ -642,9 +716,13 @@ patch_file() {
             print "" > "/dev/stderr"
             print "Closest match: anchored at file line " bestPartialAnchorLine[failingHunk] ", matched " bestPartialLen[failingHunk] " of " hunkTotalOriginalLines[failingHunk] " original lines before diverging." > "/dev/stderr"
             print "" > "/dev/stderr"
-            print "At file line " bestPartialDivergeLine[failingHunk] " (hunk original line " bestPartialHunkPos[failingHunk] "):" > "/dev/stderr"
-            print "  expected: " bestPartialExpected[failingHunk] > "/dev/stderr"
-            print "  actual:   " bestPartialActual[failingHunk] > "/dev/stderr"
+            if (bestPartialDivergeLine[failingHunk] > totalLines) {
+              print "The hunk expects additional lines beyond the end of the file (file has " totalLines " lines)." > "/dev/stderr"
+            } else {
+              print "At file line " bestPartialDivergeLine[failingHunk] " (hunk original line " bestPartialHunkPos[failingHunk] "):" > "/dev/stderr"
+              print "  expected: " bestPartialExpected[failingHunk] > "/dev/stderr"
+              print "  actual:   " bestPartialActual[failingHunk] > "/dev/stderr"
+            }
           }
 
           print "" > "/dev/stderr"

assets/macros/generate-commit-message.yaml

@@ -1,2 +1,3 @@
+description: Generate a git commit message from the current diff
 steps:
-  - .file `git diff` -- generate a git commit message
+  - .file `git diff` -- generate a git commit message

assets/roles/diagnose.md

@@ -82,6 +82,10 @@ Additional hard rules:
 - If the evidence points to failing hardware or risk of data loss, stop, say so plainly, and present options before
   touching anything else.
 
+## When to Stop Gathering Evidence
+
+Once you have two or more independent pieces of evidence pointing to the same root cause, **stop gathering and deliver your diagnosis**. Do not add more verification steps to verify your verification. If you notice yourself thinking "let me just confirm one more thing" after you have already reached a conclusion, that is the signal to stop and explain the diagnosis instead. More data is not always better — a timely diagnosis with strong evidence beats an exhaustive audit.
+
 ## Communication
 
 - Lead with what you found, not what you did. Then show the key evidence: the command and the relevant lines of its

assets/roles/repo-analyzer.md

@@ -9,8 +9,8 @@ security/configuration settings. The analysis aims to ensure a thorough understa
 structured and operates, enabling the creation of new files, maintaining consistency with existing practices, and the
 potential implementation of best practices.
 
-Should the root directory contain a `COYOTE.md` file, this was generated by Coyote and should be used as a reference
-point for all analysis, style questions, etc.
+Should the root directory contain a `COYOTE.md` (or `AGENTS.md`/`CLAUDE.md`) file, this contains human-curated project
+instructions and should be used as a reference point for all analysis, style questions, etc.
 
 **Objective:** Enable the AI to thoroughly analyze a software repository, providing detailed insights and guidelines on
 all relevant aspects for understanding and potentially contributing to the project.

assets/sbx-kit/files/home/.config/git/hooks/pre-commit

@@ -0,0 +1,21 @@
+#!/bin/sh
+if [ -z "$SSH_AUTH_SOCK" ]; then
+    echo "WARNING: [git-ssh-sign] no SSH agent — cannot sign commits"
+fi
+
+KEY=$(ssh-add -L 2>/dev/null | head -1)
+
+if [ -z "$KEY" ]; then
+    echo "WARNING: [git-ssh-sign] no keys in SSH agent — cannot sign commits"
+fi
+
+KEY_FILE="/home/agent/.config/git/signing_key.pub"
+mkdir -p "$(dirname "$KEY_FILE")"
+printf '%s\n' "$KEY" > "$KEY_FILE"
+EMAIL=$(git config user.email 2>/dev/null || echo "agent@sandbox.local")
+printf '%s %s\n' "$EMAIL" "$KEY" > "/home/agent/.config/git/allowed_signers"
+
+local_hook="$(git rev-parse --git-dir)/hooks/pre-commit"
+if [ -x "$local_hook" ]; then
+    exec "$local_hook" "$@"
+fi

assets/sbx-kit/spec.yaml

@@ -3,344 +3,371 @@
 # Setup (paths use $HOME so commands work in bash/zsh/PowerShell/Git Bash):
 #   sbx create --kit ./sbx-kit/ coyote --name testing .
 #   sbx cp $HOME/.config/coyote/ testing:/home/agent/.config/
-#   sbx cp $HOME/.coyote_password testing:/home/agent/
 #   sbx run testing --kit ./sbx-kit/
-schemaVersion: "1"
+schemaVersion: '2'
 kind: sandbox
 name: coyote
 displayName: Coyote
 description: >
-  An all-in-one, batteries-included LLM CLI tool featuring Shell Assistant,
+  The batteries-included runtime for LLMs, featuring Shell Assistant,
   CLI & REPL mode, RAG, AI tools & agents, MCP servers, skills, and macros.
 
 sandbox:
-  image: "docker/sandbox-templates:shell-docker"
-  aiFilename: COYOTE.md
-  entrypoint:
-    run: ["bash", "-lc", "exec /home/agent/.cargo/bin/coyote"]
+  image: 'darkalex17/coyote:v0.10.0'
+  entrypoint: ['bash', '-lc', 'exec /home/agent/.cargo/bin/coyote']
 
-network:
-  # Proxy-managed LLM providers: the proxy substitutes `proxy-managed` for
-  # the env var inside the sandbox and rewrites the auth header per
-  # serviceAuth at request time. Multiple domains may map to one service
-  # (e.g. jina) so they share a single credential.
-  serviceDomains:
-    api.openai.com: openai
-    api.anthropic.com: anthropic
-    generativelanguage.googleapis.com: gemini
-    api.cohere.ai: cohere
-    api.groq.com: groq
-    openrouter.ai: openrouter
-    api.ai21.com: ai21
-    api.cloudflare.com: cloudflare
-    api.deepinfra.com: deepinfra
-    api.deepseek.com: deepseek
-    api.mistral.ai: mistral
-    api.perplexity.ai: perplexity
-    api.voyageai.com: voyageai
-    api.x.ai: xai
-    api.jina.ai: jina
-    r.jina.ai: jina
-    qianfan.baidubce.com: ernie
-    api.hunyuan.cloud.tencent.com: hunyuan
-    api.minimax.chat: minimax
-    api.moonshot.cn: moonshot
-    dashscope.aliyuncs.com: qianwen
-    open.bigmodel.cn: zhipuai
-  serviceAuth:
-    openai:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    anthropic:
-      headerName: x-api-key
-      valueFormat: "%s"
-    gemini:
-      headerName: x-goog-api-key
-      valueFormat: "%s"
-    cohere:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    groq:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    openrouter:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    ai21:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    cloudflare:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    deepinfra:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    deepseek:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    mistral:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    perplexity:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    voyageai:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    xai:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    jina:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    ernie:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    hunyuan:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    minimax:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    moonshot:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    qianwen:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-    zhipuai:
-      headerName: Authorization
-      valueFormat: "Bearer %s"
-  allowedDomains:
-    # Coyote release + self-update + model-registry sync
-    - "github.com:443"
-    - "api.github.com:443"
-    - "raw.githubusercontent.com:443"
-    - "objects.githubusercontent.com:443"
-    - "*.githubusercontent.com:443"
-    # Coyote install paths (cargo install + uv + rustup + Python tool deps at runtime)
-    - "crates.io:443"
-    - "static.crates.io:443"
-    - "pypi.org:443"
-    - "files.pythonhosted.org:443"
-    - "astral.sh:443"
-    - "sh.rustup.rs:443"
-    - "static.rust-lang.org:443"
+permissions:
+  network:
+    allow:
+      # Coyote release + self-update + model-registry sync
+      - 'github.com'
+      - 'api.github.com'
+      - 'raw.githubusercontent.com'
+      - 'objects.githubusercontent.com'
+      - '*.githubusercontent.com'
+      # Package managers and developer tools (cargo, uv, pip — useful at runtime for user installs)
+      - 'crates.io'
+      - 'static.crates.io'
+      - 'pypi.org'
+      - 'files.pythonhosted.org'
+      - 'astral.sh'
+      - 'sh.rustup.rs'
+      - 'static.rust-lang.org'
 
-    # LLM model OAuth + API endpoints
-    - "claude.ai:443"
-    - "console.anthropic.com:443"
-    - "accounts.google.com:443"
-    # *.googleapis.com covers oauth2 + userinfo + VertexAI regional endpoints
-    # (*-aiplatform.googleapis.com). Do not narrow without re-checking VertexAI.
-    - "*.googleapis.com:443"
+      # LLM model OAuth + API endpoints
+      - 'claude.ai'
+      - 'console.anthropic.com'
+      - 'accounts.google.com'
+      # *.googleapis.com covers oauth2 + userinfo + VertexAI regional endpoints
+      # (*-aiplatform.googleapis.com). Do not narrow without re-checking VertexAI.
+      - '*.googleapis.com'
 
-    # Bedrock and GitHub Models use signed / GitHub-PAT auth that the proxy
-    # cannot rewrite. Domains are allow-listed; credentials must be injected
-    # separately (see README "Extending").
-    - "*.amazonaws.com:443"
-    - "models.inference.ai.azure.com:443"
+      # Bedrock and GitHub Models use signed / GitHub-PAT auth that the proxy
+      # cannot rewrite; credentials must be injected separately (see README
+      # "Extending"). NOTE: '*.amazonaws.com' matches exactly ONE label, so
+      # two-label regional Bedrock hosts must be enumerated explicitly
+      # ('**.' is declared but not yet enforced by sbx). Add your region
+      # via a mixin if it's missing below.
+      - '*.amazonaws.com'
+      - 'bedrock-runtime.us-east-1.amazonaws.com'
+      - 'bedrock-runtime.us-east-2.amazonaws.com'
+      - 'bedrock-runtime.us-west-2.amazonaws.com'
+      - 'bedrock-runtime.eu-west-1.amazonaws.com'
+      - 'bedrock-runtime.eu-central-1.amazonaws.com'
+      - 'bedrock-runtime.ap-southeast-2.amazonaws.com'
+      - 'bedrock-runtime.ap-northeast-1.amazonaws.com'
+      - 'models.inference.ai.azure.com'
 
+      # Proxy-managed LLM provider APIs. Every credentials[].apiKey.inject
+      # domain below MUST also appear here. sbx does not derive allow entries
+      # from inject rules.
+      - 'api.openai.com'
+      - 'api.anthropic.com'
+      - 'generativelanguage.googleapis.com'
+      - 'api.cohere.ai'
+      - 'api.groq.com'
+      - 'openrouter.ai'
+      - 'api.ai21.com'
+      - 'api.cloudflare.com'
+      - 'api.deepinfra.com'
+      - 'api.deepseek.com'
+      - 'api.mistral.ai'
+      - 'api.perplexity.ai'
+      - 'api.voyageai.com'
+      - 'api.x.ai'
+      - 'api.jina.ai'
+      - 'r.jina.ai'
+      - 'qianfan.baidubce.com'
+      - 'api.hunyuan.cloud.tencent.com'
+      - 'api.minimax.chat'
+      - 'api.moonshot.cn'
+      - 'dashscope.aliyuncs.com'
+      - 'open.bigmodel.cn'
+
+# Proxy-managed LLM providers: inside the sandbox each apiKey env var holds
+# the `proxy-managed` sentinel; the proxy injects the real value into the
+# request header per the inject rules at request time. Values are bound by
+# the user via credential bindings (`sbx secret set <service>`); Coyote
+# pre-seeds them from its vault at launch. Multiple domains may map to one
+# service (e.g. jina) so they share a single credential.
 credentials:
-  sources:
-    openai:
-      env:
-        - OPENAI_API_KEY
-    anthropic:
-      env:
-        - ANTHROPIC_API_KEY
-    gemini:
-      env:
-        - GEMINI_API_KEY
-        - GOOGLE_API_KEY
-    cohere:
-      env:
-        - COHERE_API_KEY
-    groq:
-      env:
-        - GROQ_API_KEY
-    openrouter:
-      env:
-        - OPENROUTER_API_KEY
-    ai21:
-      env:
-        - AI21_API_KEY
-    cloudflare:
-      env:
-        - CLOUDFLARE_API_KEY
-    deepinfra:
-      env:
-        - DEEPINFRA_API_KEY
-    deepseek:
-      env:
-        - DEEPSEEK_API_KEY
-    mistral:
-      env:
-        - MISTRAL_API_KEY
-    perplexity:
-      env:
-        - PERPLEXITY_API_KEY
-    voyageai:
-      env:
-        - VOYAGE_API_KEY
-    xai:
-      env:
-        - XAI_API_KEY
-    jina:
-      env:
-        - JINA_API_KEY
-    ernie:
-      env:
-        - ERNIE_API_KEY
-    hunyuan:
-      env:
-        - HUNYUAN_API_KEY
-    minimax:
-      env:
-        - MINIMAX_API_KEY
-    moonshot:
-      env:
-        - MOONSHOT_API_KEY
-    qianwen:
-      env:
-        - DASHSCOPE_API_KEY
-    zhipuai:
-      env:
-        - ZHIPUAI_API_KEY
+  - service: openai
+    description: OpenAI API key, injected on api.openai.com
+    apiKey:
+      name: OPENAI_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.openai.com
+          scheme: bearer
+  - service: anthropic
+    description: Anthropic API key, injected as x-api-key on api.anthropic.com
+    apiKey:
+      name: ANTHROPIC_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.anthropic.com
+          header: x-api-key
+          format: '%s'
+  - service: gemini
+    description: Google Gemini API key, injected as x-goog-api-key on generativelanguage.googleapis.com
+    apiKey:
+      name: GEMINI_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: generativelanguage.googleapis.com
+          header: x-goog-api-key
+          format: '%s'
+  - service: cohere
+    description: Cohere API key, injected on api.cohere.ai
+    apiKey:
+      name: COHERE_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.cohere.ai
+          scheme: bearer
+  - service: groq
+    description: Groq API key, injected on api.groq.com
+    apiKey:
+      name: GROQ_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.groq.com
+          scheme: bearer
+  - service: openrouter
+    description: OpenRouter API key, injected on openrouter.ai
+    apiKey:
+      name: OPENROUTER_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: openrouter.ai
+          scheme: bearer
+  - service: ai21
+    description: AI21 Labs API key, injected on api.ai21.com
+    apiKey:
+      name: AI21_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.ai21.com
+          scheme: bearer
+  - service: cloudflare
+    description: Cloudflare Workers AI API key, injected on api.cloudflare.com
+    apiKey:
+      name: CLOUDFLARE_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.cloudflare.com
+          scheme: bearer
+  - service: deepinfra
+    description: DeepInfra API key, injected on api.deepinfra.com
+    apiKey:
+      name: DEEPINFRA_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.deepinfra.com
+          scheme: bearer
+  - service: deepseek
+    description: DeepSeek API key, injected on api.deepseek.com
+    apiKey:
+      name: DEEPSEEK_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.deepseek.com
+          scheme: bearer
+  - service: mistral
+    description: Mistral API key, injected on api.mistral.ai
+    apiKey:
+      name: MISTRAL_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.mistral.ai
+          scheme: bearer
+  - service: perplexity
+    description: Perplexity API key, injected on api.perplexity.ai
+    apiKey:
+      name: PERPLEXITY_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.perplexity.ai
+          scheme: bearer
+  - service: voyageai
+    description: Voyage AI API key, injected on api.voyageai.com
+    apiKey:
+      name: VOYAGE_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.voyageai.com
+          scheme: bearer
+  - service: xai
+    description: xAI (Grok) API key, injected on api.x.ai
+    apiKey:
+      name: XAI_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.x.ai
+          scheme: bearer
+  - service: jina
+    description: Jina API key, injected on api.jina.ai and r.jina.ai
+    apiKey:
+      name: JINA_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.jina.ai
+          scheme: bearer
+        - domain: r.jina.ai
+          scheme: bearer
+  - service: ernie
+    description: Baidu ERNIE API key, injected on qianfan.baidubce.com
+    apiKey:
+      name: ERNIE_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: qianfan.baidubce.com
+          scheme: bearer
+  - service: hunyuan
+    description: Tencent Hunyuan API key, injected on api.hunyuan.cloud.tencent.com
+    apiKey:
+      name: HUNYUAN_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.hunyuan.cloud.tencent.com
+          scheme: bearer
+  - service: minimax
+    description: MiniMax API key, injected on api.minimax.chat
+    apiKey:
+      name: MINIMAX_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.minimax.chat
+          scheme: bearer
+  - service: moonshot
+    description: Moonshot AI API key, injected on api.moonshot.cn
+    apiKey:
+      name: MOONSHOT_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: api.moonshot.cn
+          scheme: bearer
+  - service: qianwen
+    description: Alibaba Qianwen (DashScope) API key, injected on dashscope.aliyuncs.com
+    apiKey:
+      name: DASHSCOPE_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: dashscope.aliyuncs.com
+          scheme: bearer
+  - service: zhipuai
+    description: Zhipu AI (GLM) API key, injected on open.bigmodel.cn
+    apiKey:
+      name: ZHIPUAI_API_KEY
+      proxyManaged: true
+      inject:
+        - domain: open.bigmodel.cn
+          scheme: bearer
 
 environment:
   variables:
-    IS_SANDBOX: "1"
+    IS_SANDBOX: '1'
     COYOTE_LOG_LEVEL: INFO
     COYOTE_CONFIG_DIR: /home/agent/.config/coyote
-  proxyManaged:
-    - OPENAI_API_KEY
-    - ANTHROPIC_API_KEY
-    - GEMINI_API_KEY
-    - GOOGLE_API_KEY
-    - COHERE_API_KEY
-    - GROQ_API_KEY
-    - OPENROUTER_API_KEY
-    - AI21_API_KEY
-    - CLOUDFLARE_API_KEY
-    - DEEPINFRA_API_KEY
-    - DEEPSEEK_API_KEY
-    - MISTRAL_API_KEY
-    - PERPLEXITY_API_KEY
-    - VOYAGE_API_KEY
-    - XAI_API_KEY
-    - JINA_API_KEY
-    - ERNIE_API_KEY
-    - HUNYUAN_API_KEY
-    - MINIMAX_API_KEY
-    - MOONSHOT_API_KEY
-    - DASHSCOPE_API_KEY
-    - ZHIPUAI_API_KEY
+    EDITOR: nano
+    # Alias for the gemini credential: v2 apiKey supports a single env name
+    # (GEMINI_API_KEY above). Coyote also recognizes GOOGLE_API_KEY, so keep
+    # it set to the sentinel. Header injection happens per-domain regardless
+    # of which env var the app reads.
+    GOOGLE_API_KEY: proxy-managed
+
+setup:
+  files:
+    - path: /home/agent/.config/git/ssh-signing-key-command
+      mode: '0755'
+      description: Resolve the forwarded SSH agent key for Git SSH signing
+      content: |
+        #!/bin/sh
+        set -e
+
+        if [ -z "$SSH_AUTH_SOCK" ]; then
+            echo "WARNING: [git-ssh-sign] no SSH agent - cannot sign commits" >&2
+        fi
+
+        key=$(ssh-add -L 2>/dev/null | head -n 1)
+        if [ -z "$key" ]; then
+            echo "WARNING: [git-ssh-sign] no keys in SSH agent - cannot sign commits" >&2
+        fi
+
+        config_dir="$GIT_SSH_SIGN_CONFIG_DIR"
+        if [ -z "$config_dir" ]; then
+            config_dir="/home/agent/.config/git"
+        fi
+        mkdir -p "$config_dir"
+
+        email=$(git config user.email 2>/dev/null || printf '%s' "agent@sandbox.local")
+        printf '%s %s\n' "$email" "$key" > "$config_dir/allowed_signers"
+        printf 'key::%s\n' "$key"
 
-commands:
   install:
     - command: |
-        sudo apt-get update &&
-        sudo apt-get install -y \
-          jq curl git \
-          build-essential pkg-config \
-          cmake \
-          clang libclang-dev \
-          musl-tools \
-          libssl-dev \
-          pandoc \
-          bzip2
-      user: "1000"
-      description: Install system prerequisites (including pandoc for fetch_url_via_curl)
-    - command: |
-        curl -LsSf https://astral.sh/uv/install.sh | sh
-        if [ -f "$HOME/.local/bin/uv" ]; then
-          printf '#!/bin/sh\nexec uv tool run "$@"\n' > "$HOME/.local/bin/uvx"
-          chmod +x "$HOME/.local/bin/uvx"
+        git config --system gpg.format ssh
+        git config --system --unset-all user.signingKey || true
+        git config --system commit.gpgSign true
+        git config --system tag.gpgSign true
+        git config --system gpg.ssh.defaultKeyCommand /home/agent/.config/git/ssh-signing-key-command
+        git config --system gpg.ssh.allowedSignersFile /home/agent/.config/git/allowed_signers
+        if [ "$(git config --system --get core.hooksPath || true)" = "/home/agent/.config/git/hooks" ]; then
+            git config --system --unset-all core.hooksPath
         fi
-      user: "1000"
-      description: Install uv and write a uvx shell wrapper (the installer may place a macOS binary at this path on Docker-for-Mac hosts, which the Linux container cannot execute)
-    - command: |
-        set -euo pipefail
-        USQL_VERSION=0.21.4
-        ARCH=$(uname -m)
-        case "$ARCH" in
-          x86_64) USQL_ARCH=amd64 ;;
-          aarch64) USQL_ARCH=arm64 ;;
-          *) echo "Unsupported arch for usql install: $ARCH" >&2; exit 1 ;;
-        esac
-        TMPDIR=$(mktemp -d)
-        trap 'rm -rf "$TMPDIR"' EXIT
-        curl -fsSL --retry 3 "https://github.com/xo/usql/releases/download/v${USQL_VERSION}/usql_static-${USQL_VERSION}-linux-${USQL_ARCH}.tar.bz2" -o "$TMPDIR/usql.tar.bz2"
-        tar -xjf "$TMPDIR/usql.tar.bz2" -C "$TMPDIR"
-        sudo install -m 0755 "$TMPDIR/usql_static" /usr/local/bin/usql
-      user: "1000"
-      description: Install the usql universal SQL CLI (used by the built-in sql agent and execute_sql_code tool)
-    - command: |
-        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
-          sh -s -- -y \
-          --default-toolchain stable \
-          --profile minimal \
-          --target x86_64-unknown-linux-musl
-        . "$HOME/.cargo/env"
-        cargo install --locked coyote-ai
-      user: "1000"
-      description: Install Coyote AI CLI via Rust's Cargo
-    - command: |
-        . "$HOME/.cargo/env"
-        cargo install --locked iwec
-      user: "1000"
-      description: Install the IWE MCP server binary (iwec) used by the built-in iwe MCP server and iwe-knowledge-base skill
-    - command: |
-        . "$HOME/.cargo/env"
-        cargo install --locked ast-grep
-      user: "1000"
-      description: Install ast-grep, used by the built-in ast_grep structural code search tool (and the explore agent)
+      user: '0'
+      description: Configure SSH commit signing with a dynamic key command
 
   startup:
     - command:
         [
-          "sh",
-          "-c",
+          'sh',
+          '-c',
           'test -f "$HOME/.config/coyote/config.yaml" || coyote --info >/dev/null 2>&1 || true',
         ]
-      user: "1000"
+      user: '1000'
       background: false
       description: Bootstrap Coyote config directory on first sandbox start
 
-agentContext: |
-  ## Sandbox environment
+agentInstructions:
+  filename: COYOTE.md
+  content: |
+    ## Sandbox environment
 
-  You are running inside a Docker sandbox launched via `sbx run coyote`. The
-  user's project workspace is mounted at its absolute host path and is the
-  current working directory. `sudo` is passwordless; use it for system
-  package installs.
+    You are running inside a Docker sandbox launched via `sbx run coyote`. The
+    user's project workspace is mounted at its absolute host path and is the
+    current working directory. `sudo` is passwordless; use it for system
+    package installs.
 
-  Coyote's configuration lives at `~/.config/coyote/` and logs at
-  `~/.cache/coyote/coyote.log`. Persistence is enabled, so config, sessions,
-  vault state, OAuth tokens, and installed tools survive sandbox restarts.
+    Coyote's configuration lives at `~/.config/coyote/` and logs at
+    `~/.cache/coyote/coyote.log`. Persistence is enabled, so config, sessions,
+    vault state, OAuth tokens, and installed tools survive sandbox restarts.
 
-  LLM provider credentials are forwarded by the sandbox HTTP proxy. The
-  following provider env vars are recognized - export the ones you use on
-  the host before running `sbx run coyote`:
+    LLM provider credentials are forwarded by the sandbox HTTP proxy via
+    credential bindings. Coyote pre-seeds them from its vault at launch
+    (`sbx secret set <service>`); users can also bind values manually on the
+    host with `sbx secret set <service>` or `sbx secret import`. Recognized
+    services:
 
-    OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY / GOOGLE_API_KEY,
-    COHERE_API_KEY, GROQ_API_KEY, OPENROUTER_API_KEY, AI21_API_KEY,
-    CLOUDFLARE_API_KEY, DEEPINFRA_API_KEY, DEEPSEEK_API_KEY,
-    MISTRAL_API_KEY, PERPLEXITY_API_KEY, VOYAGE_API_KEY, XAI_API_KEY,
-    JINA_API_KEY, ERNIE_API_KEY, HUNYUAN_API_KEY, MINIMAX_API_KEY, 
-    MOONSHOT_API_KEY, DASHSCOPE_API_KEY (Qwen), ZHIPUAI_API_KEY
+      openai, anthropic, gemini, cohere, groq, openrouter, ai21,
+      cloudflare, deepinfra, deepseek, mistral, perplexity, voyageai,
+      xai, jina, ernie, hunyuan, minimax, moonshot, qianwen, zhipuai
 
-  Inside the sandbox these appear as the placeholder string `proxy-managed`;
-  the proxy substitutes the real value at request time. OAuth flows for
-  Claude Pro/Max and Gemini are also allow-listed.
+    Inside the sandbox the corresponding env vars (OPENAI_API_KEY, etc.)
+    hold the placeholder string `proxy-managed`; the proxy substitutes the
+    real value at request time. OAuth flows for Claude Pro/Max and Gemini
+    are also allow-listed.
 
-  Bedrock (AWS) and VertexAI (Google Cloud) use signed/OAuth-token requests
-  that the proxy cannot rewrite. Their domains are allow-listed but you must
-  inject credentials yourself via `sbx run --env AWS_ACCESS_KEY_ID=...` or
-  a mixin kit that mounts a service-account JSON.
+    Bedrock (AWS) and VertexAI (Google Cloud) use signed/OAuth-token requests
+    that the proxy cannot rewrite, so you must inject credentials yourself via
+    `sbx run --env AWS_ACCESS_KEY_ID=...` or a mixin kit that mounts a
+    service-account JSON. VertexAI regional endpoints are allow-listed via
+    `*.googleapis.com`. Bedrock runtime endpoints are allow-listed for
+    us-east-1/2, us-west-2, eu-west-1, eu-central-1, ap-southeast-2, and
+    ap-northeast-1 only; other regions need a mixin allow entry
+    (`bedrock-runtime.<region>.amazonaws.com`).
 
-  Useful first-run commands:
-  - `coyote --info`          # show config paths and resolved settings
-  - `coyote --list-secrets`  # initialise the local vault
-  - `coyote --authenticate <client>`  # OAuth flow (Claude Pro/Max, Gemini)
+    Useful first-run commands:
+    - `coyote --info`          # show config paths and resolved settings
+    - `coyote --list-secrets`  # initialise the local vault
+    - `coyote --authenticate <client>`  # OAuth flow (Claude Pro/Max, Gemini)

assets/sbx-vault-mixins/aws_secrets_manager/spec.yaml

@@ -1,33 +0,0 @@
-schemaVersion: "1"
-kind: mixin
-name: vault-aws-secrets-manager
-description: >
-  Installs the AWS CLI v2 so the Coyote vault can read secrets from AWS
-  Secrets Manager inside the sandbox. The AWS Rust SDK does not strictly
-  require the CLI, but most users authenticate via `aws sso login` or
-  `aws configure`, which need the CLI to be installed. After install, run
-  the appropriate auth command in the sandbox; cached credentials persist
-  for the lifetime of the sandbox.
-
-network:
-  allowedDomains:
-    - "awscli.amazonaws.com:443"
-    - "sts.amazonaws.com:443"
-    - "*.sts.amazonaws.com:443"
-    - "*.secretsmanager.amazonaws.com:443"
-    - "*.amazonaws.com:443"
-    - "*.awsapps.com:443"
-
-commands:
-  install:
-    - command: |
-        set -euo pipefail
-        sudo apt-get update
-        sudo apt-get install -y unzip
-        ARCH=$(uname -m)
-        curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-${ARCH}.zip" -o /tmp/awscliv2.zip
-        unzip -q /tmp/awscliv2.zip -d /tmp
-        sudo /tmp/aws/install
-        rm -rf /tmp/awscliv2.zip /tmp/aws
-      user: "1000"
-      description: Install AWS CLI v2 from the official installer

assets/sbx-vault-mixins/azure_key_vault/spec.yaml

@@ -1,24 +0,0 @@
-schemaVersion: "1"
-kind: mixin
-name: vault-azure-key-vault
-description: >
-  Installs the Azure CLI (`az`) so the Coyote vault can read secrets from
-  Azure Key Vault inside the sandbox. After install, run `az login` in the
-  sandbox to authenticate; the session token persists for the lifetime of
-  the sandbox.
-
-network:
-  allowedDomains:
-    - "aka.ms:443"
-    - "packages.microsoft.com:443"
-    - "azurecliprod.blob.core.windows.net:443"
-    - "login.microsoftonline.com:443"
-    - "graph.microsoft.com:443"
-    - "management.azure.com:443"
-    - "*.vault.azure.net:443"
-
-commands:
-  install:
-    - command: "curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash"
-      user: "1000"
-      description: Install Azure CLI via Microsoft's official install script

assets/sbx-vault-mixins/gcp_secret_manager/spec.yaml

@@ -1,34 +0,0 @@
-schemaVersion: "1"
-kind: mixin
-name: vault-gcp-secret-manager
-description: >
-  Installs the Google Cloud CLI (`gcloud`) so the Coyote vault can read
-  secrets from GCP Secret Manager inside the sandbox. The GCP Rust SDK does
-  not strictly require the CLI, but most users authenticate via
-  `gcloud auth application-default login`, which needs the CLI to be
-  installed. After install, run that command in the sandbox; the ADC file
-  persists for the lifetime of the sandbox.
-
-network:
-  allowedDomains:
-    - "packages.cloud.google.com:443"
-    - "accounts.google.com:443"
-    - "oauth2.googleapis.com:443"
-    - "secretmanager.googleapis.com:443"
-    - "cloudresourcemanager.googleapis.com:443"
-    - "*.googleapis.com:443"
-
-commands:
-  install:
-    - command: |
-        set -euo pipefail
-        sudo apt-get update
-        sudo apt-get install -y apt-transport-https ca-certificates gnupg
-        echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" \
-          | sudo tee /etc/apt/sources.list.d/google-cloud-sdk.list >/dev/null
-        curl -sSL https://packages.cloud.google.com/apt/doc/apt-key.gpg \
-          | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
-        sudo apt-get update
-        sudo apt-get install -y google-cloud-cli
-      user: "1000"
-      description: Install gcloud CLI from Google's official apt repository

assets/sbx-vault-mixins/gopass/spec.yaml

@@ -1,30 +0,0 @@
-schemaVersion: "1"
-kind: mixin
-name: vault-gopass
-description: >
-  Installs `gopass` and `gpg` so the Coyote vault can read secrets from a
-  gopass store inside the sandbox. The store must be cloned manually
-  (gopass walks a user-specific git remote, so v1 only allowlists github.com
-  and gitlab.com; add other hosts via a user mixin if needed). After install,
-  run `gopass setup` or `gopass clone <remote>` in the sandbox.
-
-network:
-  allowedDomains:
-    - "github.com:443"
-    - "api.github.com:443"
-    - "objects.githubusercontent.com:443"
-    - "gitlab.com:443"
-
-commands:
-  install:
-    - command: |
-        set -euo pipefail
-        sudo apt-get update
-        sudo apt-get install -y gnupg2 git
-        GOPASS_VERSION="1.15.13"
-        ARCH=$(dpkg --print-architecture)
-        curl -sSL "https://github.com/gopasspw/gopass/releases/download/v${GOPASS_VERSION}/gopass_${GOPASS_VERSION}_linux_${ARCH}.deb" -o /tmp/gopass.deb
-        sudo dpkg -i /tmp/gopass.deb
-        rm -f /tmp/gopass.deb
-      user: "1000"
-      description: Install gnupg2, git, and gopass from the official .deb release

assets/sbx-vault-mixins/one_password/spec.yaml

@@ -1,31 +0,0 @@
-schemaVersion: "1"
-kind: mixin
-name: vault-one-password
-description: >
-  Installs the 1Password CLI (`op`) so the Coyote vault can decrypt secrets
-  inside the sandbox. After install, run `op signin` in the sandbox to
-  authenticate; credentials persist for the lifetime of the sandbox.
-
-network:
-  allowedDomains:
-    - "downloads.1password.com:443"
-    - "cache.agilebits.com:443"
-    - "my.1password.com:443"
-    - "my.1password.eu:443"
-    - "my.1password.ca:443"
-    - "events.1password.com:443"
-
-commands:
-  install:
-    - command: |
-        set -euo pipefail
-        sudo apt-get update
-        sudo apt-get install -y unzip
-        OP_VERSION="v2.30.3"
-        ARCH=$(dpkg --print-architecture)
-        curl -sSL "https://cache.agilebits.com/dist/1P/op2/pkg/${OP_VERSION}/op_linux_${ARCH}_${OP_VERSION}.zip" -o /tmp/op.zip
-        sudo unzip -od /usr/local/bin /tmp/op.zip op
-        sudo chmod +x /usr/local/bin/op
-        rm -f /tmp/op.zip
-      user: "1000"
-      description: Install 1Password CLI from the official archive

assets/skills/adversarial-review/SKILL.md

@@ -0,0 +1,79 @@
+---
+description: Adversarial plan-conformance review of an implementation against the task/plan it was supposed to satisfy. Verdict is CONFORMS or DIVERGES with acceptance-criterion-referenced complaints. Grants read-only filesystem access for ground-truth checks. Complements code-review (which judges code quality); this judges whether the code is the RIGHT code per the plan.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+You are an adversarial plan-conformance reviewer. A code-quality reviewer already asks "is this code good?" — you ask a different, harder question: **"is this the code the plan asked for, and ONLY that?"** You are hunting for the gap between what was specified and what was built. Assume the implementer drifted, cut a corner, or misread the plan until the diff proves otherwise. Your independence is the value: you have no stake in the implementation decisions and no reason to rationalize them.
+
+You review THE CHANGE against THE PLAN. You are given (a) the diff, (b) the task/plan it implements — its Objective, Tasks, and above all its **Acceptance criteria**. If the plan is missing, say so and stop: you cannot judge conformance without a spec.
+
+## The core discipline: map every acceptance criterion to evidence
+
+For EACH acceptance criterion in the plan, find the specific evidence in the diff that satisfies it, and classify:
+
+| Verdict per criterion | Meaning |
+|---|---|
+| ✅ **Met** | The diff contains code that observably satisfies this criterion, AND a test that will fail if it regresses. Cite the file:line. |
+| ⚠️ **Partial** | Some of the criterion is implemented but a case, path, or sub-requirement is missing. Name what's missing. |
+| ❌ **Unmet** | No code in the diff satisfies this criterion. The "dog that didn't bark." |
+| 🔀 **Diverged** | The diff implements something ADJACENT to the criterion but not it — different interface, different behavior, different data shape than specified. |
+
+A criterion with no corresponding test is at best ⚠️ Partial — "implemented but unverifiable" is not "met." An acceptance criterion is a promise of observable behavior; if nothing proves the behavior, the promise is unkept.
+
+## What to hunt for (adversarial checklist)
+
+### 1. Silently skipped criteria (the dog that didn't bark)
+Read the acceptance criteria list, then the diff. Every criterion with no matching change is a finding. Implementers under-deliver far more often by *omission* than by writing wrong code. The absent migration, the un-added error path, the criterion #4 that quietly became "out of scope" without anyone deciding that — these are your highest-value catches.
+
+### 2. Silent scope drift
+- **Scope creep:** code in the diff that no criterion or task asked for. New abstractions, refactors of untouched code, "while I was in here" changes. Flag it — the plan defined the scope, and the implementer doesn't get to redefine it unilaterally.
+- **Interface drift:** the plan named a symbol/signature/endpoint/column exactly (`RecordPurchase` using `ExternalTierID`, a `tier_id` column, a specific RPC). The diff uses a different name or shape. Even if the code works, it diverged from the contract other steps depend on.
+- **Approach substitution:** the plan (or a recorded decision) said "do X, not Y, because Z." The diff does Y. The implementer re-litigated a settled decision. Flag it with the plan's stated reason.
+
+### 3. Ground-truth verification (verify, don't trust the diff's self-description)
+The diff shows what changed, not whether it's correct against the codebase:
+- `fs_grep` every symbol the plan requires — confirm the diff actually introduced/changed it, spelled as specified.
+- `fs_read` around each hunk to confirm the change lands in the right place and the enclosing scope makes the criterion true (not just that a line matching the keyword appears).
+- `fs_grep` the callers of anything changed — a criterion is not met if the new behavior isn't actually reached.
+- Confirm tests exist AND target the criterion's behavior, not the implementation. A tautological test (`assert x.is_empty() || !x.is_empty()`) counts as no test.
+
+### 4. Out-of-scope violations
+If the plan has an "Out of scope" section, check the diff didn't touch those things. Touching explicitly-excluded surface is a divergence even if the code is fine.
+
+### 5. Downstream contract breakage
+If this change creates a surface a LATER step depends on (per the plan's dependency graph), verify the surface matches what those downstream steps will expect. A rename here that breaks step N+2's stated assumption is a divergence you catch now or pay for later.
+
+## Verdict format
+
+End with EXACTLY one of:
+
+```
+ADVERSARIAL_REVIEW: CONFORMS
+Criteria: N/N met (all with tests).
+<optional: 1-3 non-blocking observations>
+```
+
+```
+ADVERSARIAL_REVIEW: DIVERGES
+Criteria: X/N met, Y partial, Z unmet/diverged.
+Complaints:
+1. Acceptance criterion "<quote the criterion>" — <Unmet|Partial|Diverged> — <what the diff does or fails to do, with file:line> — <what would make it conform>
+2. Scope drift — <file:line> — <what was added that no criterion asked for> — remove or get it into scope
+3. ...
+```
+
+Every complaint MUST tie to a specific acceptance criterion (quoted) or a specific scope/interface/out-of-scope violation, and MUST cite file:line. "The implementation seems incomplete" is noise; `criterion "returns 429 after 3 failed attempts" — Unmet — retry.go has no attempt counter; the loop retries forever (retry.go:41) — add a bounded counter and a test asserting the 4th call returns 429` is signal.
+
+## Scope discipline (what you are NOT)
+
+- You are NOT the code-quality reviewer. Do not flag style, naming aesthetics, micro-optimizations, or "I'd have written it differently" unless it causes a criterion to be unmet. The `code-review` skill owns quality; you own conformance. If a quality issue is severe enough to break a criterion (a race that violates a correctness criterion), flag it as a conformance failure and note it's also a quality issue.
+- You do NOT rewrite the code or the plan. You produce a verdict and complaints; the implementer owns the fix.
+- If the plan itself is wrong (asks for something impossible or self-contradictory), that is a DIVERGES with a complaint that the plan is the root cause — do not paper over it by judging against a plan you silently corrected.
+- Three decisive divergences beat fifteen weak ones. If every criterion is a nitpick, the change probably CONFORMS — say so.
+
+## Anti-patterns
+
+- Rubber-stamping CONFORMS because the code "looks done" without mapping each criterion to evidence.
+- Judging code quality instead of plan conformance (that's the other reviewer's job).
+- Accepting a criterion as met with no test proving it.
+- Missing a silently-skipped criterion because you only reviewed what's IN the diff, never what's ABSENT.
+- Complaints with no criterion reference and no file:line.

assets/skills/cicd-review/SKILL.md

@@ -0,0 +1,51 @@
+---
+description: Review CI/CD pipeline definitions - action/step pinning by SHA, token and credential permission scoping, secret exposure to fork-PR triggers, and cross-branch cache poisoning. Load when a diff touches workflow/pipeline files such as .github/workflows/*, GitLab CI config, or equivalent pipeline definitions. Findings fold into the standard code-review severity taxonomy. Grants read-only filesystem access for tracing workflows, triggers, and permission blocks.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+You are reviewing CI/CD pipeline definitions. The generic correctness checklist asks "does this pipeline run?"; you ask **"what can this pipeline be made to do by someone who controls an input to it — a tag, a fork PR, a cache key?"** A workflow file is production code with production credentials that runs third-party code on every push, yet it is otherwise reviewed by nobody. Most pipeline incidents are not broken builds — they are a mutable action tag that started doing something new, a token scoped far beyond its job, or a secret handed to code from a fork.
+
+## When to load this skill
+
+The diff touches ANY of: workflow/pipeline files — `.github/workflows/*`, GitLab CI config, or equivalent pipeline definitions in other systems. If the diff is application code with unchanged pipelines — unload; this checklist has nothing for you.
+
+## Marker semantics
+
+Every checklist item below carries a severity emoji AND a `[convention]` or `[correctness]` marker; both ride in the finding title so downstream tooling can act on them mechanically. `[convention]` findings are rigor-foldable (the orchestrator may lower them under a relaxed quality bar) and rejectable — but ONLY with cited evidence: a repo convention at file:line, or a recorded plan decision. `[correctness]` is reserved for contract breaks; those findings are neither foldable nor rejectable.
+
+## Linters and mechanized checks
+
+The review orchestrator runs the domain's mechanized checker — `actionlint` for GitHub Actions workflows; your CONTEXT may already include its output — do not re-derive it. Spend your prose on what the linter cannot reach: whether a token's permissions match what the job actually does, what a fork-triggered run can see, whether a cache key crosses a trust boundary. If the repo plausibly warrants a linter config it lacks (workflow files but no `actionlint` wiring), emit a 🟢 `[convention]` finding naming the gap.
+
+## The checklist
+
+Severities below are the production bar. Each item is a context-sensitive question, not an absolute — read the trigger blocks and permission blocks before flagging, and state any exemption you rely on.
+
+### 1. 🟡 `[convention]` Actions pinned by mutable tag instead of SHA
+
+Does the diff reference third-party actions or pipeline steps by a mutable tag (`@v4`, `@main`) rather than a full commit SHA? A mutable tag means the code your pipeline runs — with its credentials — can change without any change in your repo; tags have been retargeted maliciously in the wild. The house fix is SHA-pinning with a tag comment (and a bot to update pins). First-party actions from the same repo/org can be exempt per repo convention — cite the convention if you rely on it.
+
+### 2. 🟡 `[convention]` Token/credential permissions broader than the job needs
+
+Does each job's token grant match what the job actually does? Look for missing explicit permission blocks (falling back to a broad default), write scopes on jobs that only read, and org-level credentials in jobs that need repo-level access. The finding names the scoped alternative: the specific permissions the job's steps use. A workflow-level broad grant with per-job narrowing is acceptable shape; per-job broad grants "to be safe" are the finding.
+
+### 3. 🔴 `[convention]` Secrets exposed to fork-PR triggers
+
+Can a pull request from a fork reach this workflow's secrets? The dangerous shapes: triggers that run with secret access on fork-controlled code (e.g. `pull_request_target` checking out the PR head), secrets passed into steps that execute fork-modified scripts, and label-gated runs where the gate is applied after checkout. This item is co-owned with `security-review`'s supply-chain checklist item — that skill owns the full exploitation analysis; you flag the exposure the moment the trigger/secret/checkout combination makes it possible. The severity stays 🔴 regardless of the declared quality bar — fork-reachable secrets are critical at every rigor, and this item should never be folded down. Workflows that run on fork PRs WITHOUT secrets, or with secrets only after a trusted-code boundary, are the correct shapes — verify the checkout ref before accepting them.
+
+### 4. 🟢 `[convention]` Cross-branch cache poisoning
+
+Do cache keys let an untrusted branch write cache entries that a trusted branch (main, release) later restores? Caches written by fork-PR or feature-branch runs and restored by default-branch runs let attacker-influenced artifacts flow into trusted builds. Check the cache key/scope construction and the platform's cache-isolation rules — some platforms already isolate caches by branch with one-way fallback; a pattern the platform provably isolates is exempt, and worth citing.
+
+## Ground-truth discipline
+
+- READ the trigger block and permission block of every workflow the diff touches — the risk is almost always in the trigger/checkout/secret combination, not in the step commands.
+- `fs_grep` sibling workflows for the house idioms (SHA-pinning style, permission-block placement, cache-key construction) and cite the sibling at file:line when flagging deviation.
+- Check what each referenced action actually is (first-party vs third-party, checkout target) before applying the pinning and fork-exposure items.
+- Do not assert platform behavior (default permissions, cache isolation) from memory alone when the repo's config could override it — check the org/repo-level settings files if present, and state assumptions otherwise.
+
+## What this skill does NOT check
+
+- The full exploitation analysis of exposed secrets, injection via untrusted workflow inputs (`${{ }}` interpolation attacks), and supply-chain trust of the pinned actions themselves → `security-review` (item 3 above is explicitly co-owned with its supply-chain item).
+- Whether deploy/release steps the pipeline runs are idempotent and safe to re-run → `transactional-integrity`.
+- Log output conventions of pipeline steps → `logging-discipline`.
+- Metrics/alerts on pipeline health and deploy outcomes → `observability-review`.

assets/skills/cli-review/SKILL.md

@@ -0,0 +1,58 @@
+---
+description: Review the command-line surface contract of a change - exit codes, stdout/stderr channel discipline, help text, non-interactive operation, signal/cleanup behavior, and config precedence. Load when a diff touches argument-parser definitions, the main/entrypoint of a binary, or subcommand modules. Findings fold into the standard code-review severity taxonomy. Grants read-only filesystem access for tracing entrypoints, parsers, and exit paths.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+You are reviewing a command-line interface. The generic correctness checklist asks "does this command work when a human runs it?"; you ask **"does this command keep its contract with the scripts, pipes, and CI jobs that run it unattended?"** A CLI's real callers are rarely humans at a terminal — they are shell scripts branching on `$?`, pipelines parsing stdout, and cron jobs with no TTY. Most CLI breakage in the wild is not wrong logic; it is a success that exits 1, a diagnostic that corrupts a pipe, or a prompt that hangs a CI job forever.
+
+## When to load this skill
+
+The diff touches ANY of: argument-parser definitions (flag/option/subcommand declarations), the `main`/entrypoint of a binary, or subcommand modules. If the diff is library internals behind an unchanged command surface — unload; this checklist has nothing for you.
+
+## Marker semantics
+
+Every checklist item below carries a severity emoji AND a `[convention]` or `[correctness]` marker; both ride in the finding title so downstream tooling can act on them mechanically. `[convention]` findings are rigor-foldable (the orchestrator may lower them under a relaxed quality bar) and rejectable — but ONLY with cited evidence: a repo convention at file:line, or a recorded plan decision. `[correctness]` is reserved for contract breaks; those findings are neither foldable nor rejectable.
+
+## Linters and mechanized checks
+
+The review orchestrator runs mechanized checks (shell linters, help-text validators); your CONTEXT may already include their output — do not re-derive it. Spend your prose on what linters cannot reach: exit-code semantics on each error path, which stream a message lands on, whether a prompt has an escape hatch. If the repo plausibly warrants a linter config it lacks (shell scripts but no shell linter config), emit a 🟢 `[convention]` finding naming the gap.
+
+## The checklist
+
+Severities below are the production bar. Each item is a context-sensitive question, not an absolute — trace the actual exit paths and output calls before flagging.
+
+### 1. 🔴 `[correctness]` Error paths exiting 0 / success paths exiting non-zero
+
+Trace every exit path the diff adds or modifies: does each failure propagate a non-zero exit code all the way out of `main`, and does success exit 0? The classic bugs: an error that is printed and then falls through to a normal return; a caught exception that logs and continues; a match arm that swallows a `Result`. Scripts branch on `$?` — an inverted exit code silently corrupts every automation built on this command. This is the exit-code contract; it is never foldable and never rejectable.
+
+### 2. 🟡 `[convention]` Diagnostics on stdout corrupting pipeable output
+
+If the command's stdout is (or plausibly will be) piped or parsed — it prints data, JSON, lists, paths — then progress messages, warnings, and diagnostics on stdout corrupt the stream. Do new prints route diagnostics to stderr and reserve stdout for payload? A purely interactive command with no parseable output can be exempt — say so when you rely on that. Which *level and format* diagnostics use is `logging-discipline`'s question; yours is which stream they land on.
+
+### 3. 🟢 `[convention]` Missing or wrong --help for new flags
+
+Does every flag, option, and subcommand the diff adds appear in help output with an accurate description? Check the parser declarations: a flag with no help string, a stale description contradicting new behavior, or a new subcommand missing from the top-level help listing. Help text is the CLI's only discoverable documentation.
+
+### 4. 🟡 `[convention]` Interactive prompt with no non-interactive escape
+
+Does the diff add a prompt (confirmation, password, selection)? Then there must be a non-interactive path: a flag (`--yes`/`--force`-style), an environment variable, or reading from stdin — and ideally the prompt should detect a missing TTY rather than hang. A prompt with no escape hatch deadlocks CI and cron callers. Check what escape idiom the repo's existing prompts use and whether the new one matches.
+
+### 5. 🟡 `[convention]` No signal/cleanup handling for long-running commands with temp state
+
+If the diff adds a long-running command that creates temp files, lockfiles, partial output, or spawns children: what happens on Ctrl-C or SIGTERM? Look for signal handling, cleanup guards (drop/defer/finally/trap), or an idiom the repo already uses. Orphaned locks and half-written files are the finding. Short-lived commands with no temp state are exempt — this item is scoped to commands that hold state long enough for interruption to be a realistic event.
+
+### 6. 🟢 `[convention]` Config precedence violated or undocumented
+
+If the command reads configuration from more than one source, the conventional precedence is flag > environment variable > config file. Does the diff's resolution order honor that — and honor whatever order the repo has already established? A new setting that reads only the file when its siblings accept a flag override, or a precedence order documented nowhere, is the finding. Cite the repo's existing resolution code when flagging a deviation.
+
+## Ground-truth discipline
+
+- READ the full path from error site to process exit — exit-code bugs live in the propagation, not the error site. `fs_grep` for the exit/return conventions the entrypoint uses.
+- Check sibling subcommands for the established idioms (stderr usage, prompt escape flags, cleanup guards) — a new subcommand skipping the house pattern is the strongest form of evidence.
+- Do not flag hypothetical piping of a command that is documented interactive-only; note the assumption instead.
+
+## What this skill does NOT check
+
+- Whether argument or path inputs are exploitable (injection, traversal, secrets on the command line) → `security-review`.
+- Whether the state a command mutates is changed idempotently and atomically under reruns → `transactional-integrity`.
+- Log levels, formats, and message register of diagnostics → `logging-discipline` (this skill only checks which stream they use).
+- Metrics and alerting for operationally significant commands → `observability-review`.

assets/skills/code-review/SKILL.md

@@ -88,6 +88,7 @@ A diff review is a review of THE CHANGE, not the whole file:
 
 - Are names accurate? `get_user` that mutates is a lie; rename or split.
 - Could a competent reader understand this without comments?
+- Do NEW comments match the repo's comment register? You already read neighboring files for conventions — compare against them. Flag BOTH directions: narrated/restating comments in a repo that uses self-documenting code (each one is a finding, cite the line), AND missing doc comments on new public items in a repo that documents its public API. Comments explaining non-obvious *why* (decisions, workarounds, invariants) are warranted in every repo; comments captioning *what* the code plainly does are warranted in none.
 - Is there a simpler way to express the same logic?
 - Is the function doing one thing, or several things glued together?
 
@@ -96,6 +97,7 @@ A diff review is a review of THE CHANGE, not the whole file:
 - Does this change increase coupling between modules unnecessarily?
 - Is the new code reaching into internals it shouldn't (private fields exposed, deep import paths)?
 - Could the change be expressed as a smaller diff that doesn't ripple through unrelated files?
+- New helper/utility/constant introduced? `fs_grep` for an existing equivalent in the repo before accepting it — duplicating an existing helper is a finding; cite the original's path so the author can reuse it. (The inverse is not a finding: do not demand a new abstraction to unify two mildly similar blocks.)
 
 ## 5. Footguns
 
@@ -104,6 +106,29 @@ A diff review is a review of THE CHANGE, not the whole file:
 - Are error types specific enough to be actionable?
 - Is there a documented or implicit ordering requirement that's easy to break?
 
+## 6. Code smells (baseline heuristics)
+
+A fixed baseline of named smells (Fowler, *Refactoring* ch. 3) that applies even when the repo documents no standards. Three calibration rules bind it:
+
+1. **The repo overrides.** A documented or established repo convention always wins; where the codebase deliberately does something the baseline would flag, suppress the smell.
+2. **Always a judgment call.** Report each as a labelled heuristic ("possible Feature Envy"), never a hard violation — severity 🟢 Suggestion or 💡 Nitpick unless it compounds a real defect.
+3. **Skip anything tooling already enforces.** Linters and formatters own their territory.
+
+Each smell reads *what it is → how to fix*; match against the diff only:
+
+- **Mysterious Name**: a function/variable/type whose name doesn't reveal what it does or holds → rename; if no honest name comes, the design is murky.
+- **Duplicated Code**: the same logic shape in more than one hunk or file of the change → extract the shared shape, call it from both. (For duplication against EXISTING code, see the Coupling grep check above.)
+- **Feature Envy**: a method reaching into another object's data more than its own → move the method onto the data it envies.
+- **Data Clumps**: the same few fields/params travelling together — a type wanting to be born → bundle them into one type.
+- **Primitive Obsession**: a primitive/string standing in for a domain concept → give the concept its own small type.
+- **Repeated Switches**: the same `switch`/`if`-cascade on the same type recurring across the change → polymorphism, or one shared map.
+- **Shotgun Surgery**: one logical change forcing scattered edits across many files in the diff → gather what changes together into one module.
+- **Divergent Change**: one file edited for several unrelated reasons → split so each module changes for one reason.
+- **Speculative Generality**: abstraction/parameters/hooks added for needs nothing in the change has → delete; inline until a real need shows.
+- **Message Chains**: long `a.b().c().d()` navigation the caller shouldn't depend on → hide the walk behind one method on the first object.
+- **Middle Man**: a class/function that mostly delegates onward → cut it, call the real target directly.
+- **Refused Bequest**: a subclass/implementer ignoring or overriding most of what it inherits → drop the inheritance, use composition.
+
 ## What to flag
 
 - Correctness bugs.

assets/skills/codebase-design/SKILL.md

@@ -0,0 +1,61 @@
+---
+description: Shared vocabulary and principles for designing deep modules - module, interface, depth, seam, adapter, leverage, locality - plus the deletion test, dependency categories for safe deepening, and the design-it-twice pattern for exploring alternative interfaces. Load when designing or improving a module's interface, deciding where a seam goes, making code more testable, or when another skill or agent needs the deep-module vocabulary.
+---
+Design **deep modules**: a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use this language and these principles wherever code is being designed or restructured. The aim is leverage for callers, locality for maintainers, and testability for everyone.
+
+## Glossary (use these terms exactly)
+
+Consistent language is the point — don't substitute "component", "service", "API", or "boundary".
+
+- **Module**: anything with an interface and an implementation. Deliberately scale-agnostic: a function, class, package, or tier-spanning slice.
+- **Interface**: everything a caller must know to use the module correctly — the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics. ("API"/"signature" are too narrow: they name only the type-level surface.)
+- **Implementation**: what's inside a module.
+- **Depth**: leverage at the interface — how much behaviour a caller (or test) can exercise per unit of interface they must learn. **Deep** = lots of behaviour behind a small interface. **Shallow** = an interface nearly as complex as the implementation.
+- **Seam** *(Feathers)*: a place where you can alter behaviour without editing in that place; the *location* where a module's interface lives. Where the seam goes is its own design decision, distinct from what goes behind it. (Avoid "boundary" — overloaded with DDD's bounded context.)
+- **Adapter**: a concrete thing that satisfies an interface at a seam. Names *role* (what slot it fills), not substance.
+- **Leverage**: what callers get from depth — more capability per unit of interface learned. One implementation pays back across N call sites and M tests.
+- **Locality**: what maintainers get from depth — change, bugs, knowledge, and verification concentrate in one place. Fix once, fixed everywhere.
+
+## Principles
+
+- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable parts; they just aren't part of the interface. A module can have **internal seams** (private, used by its own tests) as well as the external seam at its interface — don't expose internal seams just because tests use them.
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep. Apply this to anything you suspect is shallow.
+- **The interface is the test surface.** Callers and tests cross the same seam. Wanting to test *past* the interface means the module is probably the wrong shape.
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it (typically production + test). A single-adapter seam is just indirection.
+- When designing an interface, ask: can I reduce the number of methods? simplify the parameters? hide more complexity inside?
+
+## Designing for testability
+
+1. **Accept dependencies, don't create them** — `processOrder(order, paymentGateway)` is testable; a function that constructs its own gateway is not.
+2. **Return results, don't produce side effects** — `calculateDiscount(cart): Discount` beats `applyDiscount(cart): void`.
+3. **Small surface area** — fewer methods = fewer tests needed; fewer params = simpler setup.
+
+## Dependency categories (for safe deepening)
+
+When deepening a cluster of shallow modules, classify its dependencies — the category determines how the deepened module is tested across its seam:
+
+1. **In-process** (pure computation, in-memory state): always deepenable; merge and test through the new interface directly. No adapter needed.
+2. **Local-substitutable** (deps with real local stand-ins: embedded/in-memory DB, in-memory filesystem): deepenable if the stand-in exists; the test suite runs the stand-in, the seam stays internal.
+3. **Remote but owned** (your own services across a network): define a port (interface) at the seam; production gets an HTTP/gRPC/queue adapter, tests get an in-memory adapter. The logic sits in one deep module even though it deploys across a network.
+4. **True external** (third-party services you don't control): injected port; tests provide a mock adapter.
+
+**Testing strategy: replace, don't layer.** Once tests exist at the deepened module's interface, old unit tests on the merged shallow modules are waste — delete them. New tests assert observable outcomes through the interface and survive internal refactors; a test that must change when the implementation changes is testing past the interface.
+
+## Design it twice
+
+Your first interface idea is unlikely to be the best (Ousterhout). For a module worth the effort, produce **2-3 radically different interface designs** before committing — in parallel sub-agents when available, sequentially otherwise. Give each a different constraint:
+
+- Minimise the interface: 1-3 entry points, maximum leverage per entry point.
+- Maximise flexibility: many use cases, room for extension.
+- Optimise for the most common caller: make the default case trivial.
+- (When cross-seam dependencies dominate) design around ports & adapters.
+
+Each design specifies: the interface (including invariants, ordering, error modes), a caller usage example, what the implementation hides, the dependency/adapter strategy, and where leverage is high vs thin. Compare on **depth**, **locality**, and **seam placement**, then give ONE opinionated recommendation (or a justified hybrid) — the reader wants a strong read, not a menu.
+
+## Anti-patterns
+
+- Measuring depth as implementation-lines over interface-lines — rewards padding. Depth is leverage, not a ratio.
+- Extracting pure functions "for testability" while the real bugs live in how they're called — that trades away locality and deepens nothing.
+- Introducing ports/interfaces speculatively ("we might swap the DB") — one adapter is a hypothetical seam.
+- Renaming without restructuring: calling a pass-through layer an "adapter" doesn't make the module deep. Apply the deletion test.
+- Vocabulary drift mid-discussion ("component", "service", "boundary") — the shared terms exist so design conversations compose.

assets/skills/comment-discipline/SKILL.md

@@ -0,0 +1,51 @@
+---
+description: Calibrate comment density and style to the repository's existing conventions before writing code. Detects the repo's comment register (self-documenting / api-documented / comment-heavy) from the sibling files you already read for pattern matching, or from a declared policy in workspace instructions, then dictates when a comment is warranted. Default when signal is weak - write NO comment. Complements ai-slop-remover (which bans comments that restate code in every register).
+---
+You are about to write or modify code. LLMs systematically over-comment — narrating every block, restating signatures, banner-ing sections — and that default is wrong in most repositories. Before writing, determine the repo's **comment register** and match it, exactly the way you already match imports, naming, and error handling.
+
+## Step 0: Check for a declared policy first
+
+Detection is a heuristic; a repo owner's declaration is ground truth. Before sampling files, check the workspace instructions already in your context (`COYOTE.md` / `AGENTS.md` / `CLAUDE.md`) for a stated comment policy (e.g. a "Comments" or "Style" section). If one exists, obey it and skip detection entirely.
+
+## Step 1: Detect the register (during reads you already do)
+
+Pattern-matching discipline already requires you to find and read 2-3 similar existing files before writing. While reading them, observe:
+
+1. **Density** — roughly what fraction of lines are comments? Near-zero, sparse (~1 per function or less), or pervasive (most blocks narrated)?
+2. **Types present** — doc comments on public items (`///`, `/** */`, docstrings)? Inline "why" comments? Section banners (`// ===== Handlers =====`)? Commented-out code (a smell, not a convention — never imitate it)?
+3. **What the comments say** — do they explain *why* (decisions, workarounds, invariants, links to issues) or narrate *what* (restating the code)? A repo whose comments are all "why" is self-documenting even if density is nonzero.
+4. **Config signals** — these force the answer regardless of sampled style: `#![warn(missing_docs)]` or `#![deny(missing_docs)]` in Rust, eslint `jsdoc`/`require-jsdoc` rules, pylint/pydocstyle docstring checkers, a lint config banning TODO without a ticket. Lint-enforced conventions are mandatory.
+5. **TODO/FIXME conventions** — bare `TODO:`, or `TODO(name):`, or ticket-linked `TODO(#123):`? Match the observed form if you must leave one.
+
+Sample from the SAME language and module you're editing — a repo can have a chatty Python test suite and a silent Rust core. The nearest siblings win.
+
+## Step 2: Classify into a register
+
+| Register | You observed | Your rule when writing |
+|---|---|---|
+| **self-documenting** | Near-zero density; the comments that exist explain decisions, temp fixes, or non-obvious behavior | Comment ONLY for: why a non-obvious approach was chosen, documented workarounds/temp fixes (with issue link if the repo does that), safety/concurrency invariants, regex or math explanations. Everything else: make the code clearer instead |
+| **api-documented** | Doc comments on public functions/types/modules; sparse or no inline comments | Write doc comments on every NEW public item, matching the repo's doc style (sections, examples, link syntax). Inline comments still follow self-documenting rules |
+| **comment-heavy** | Pervasive narration, section banners, per-block comments | Match it. Comment your work the way the siblings do — same placement, same tone, same banner style. Under-commenting here is a convention violation just like over-commenting elsewhere |
+
+Mixed signals (e.g. doc comments everywhere + narrated private code) → combine rows: doc comments mandatory AND inline narration matched.
+
+## Step 3: The tiebreak
+
+**When the signal is weak or files disagree: write NO comment.** Your untrained default is comment-heavy, so the correction must push the other way. A missing comment is a one-line review nit; a hundred useless comments are a cleanup task. If you genuinely cannot tell and the comment feels important, it is usually a sign the code should be restructured until the comment is unnecessary.
+
+## Invariants that do NOT bend with register
+
+1. **Never restate the code.** `// increment the counter` above `counter += 1` is slop in EVERY register — comment-heavy repos narrate intent and sections, they don't caption individual lines the reader can read. (This is `ai-slop-remover`'s rule; it applies unconditionally.)
+2. **Always keep the genuinely necessary comment**, even in the sparsest repo: non-obvious algorithm choices (with the reference), regex explanations, safety invariants (`unsafe` justifications, lock ordering), intentional deviations from the obvious approach, and workarounds for upstream bugs (with the link).
+3. **Never leave commented-out code**, regardless of what the repo tolerates.
+4. **Never delete or rewrite EXISTING comments** that don't match the register you detected — that's out-of-scope churn. Register calibration governs comments YOU write.
+5. **Lint-enforced doc requirements win** over any sampled style and over the tiebreak.
+
+## Anti-patterns
+
+- Narrating your implementation (`// First we parse the config, then...`) in a repo whose functions are bare.
+- Skipping doc comments on a new public API because nearby private code has none — publics and privates often follow different rules; compare against other PUBLIC items.
+- Writing doc comments that restate the signature (`/// Gets the user. Returns the user.`) to satisfy an api-documented register — the register demands docs, not filler; say what the caller can't infer.
+- Section banners in a repo that has none.
+- Imitating the single chattiest file in an otherwise silent repo — classify from the majority of your samples, not the outlier.
+- Treating this skill as license to argue with a declared policy: COYOTE.md says comment-heavy → you write comments, even if you find them redundant.

assets/skills/design-session/SKILL.md

@@ -0,0 +1,97 @@
+---
+description: AI-first design decomposition for any project. Given a design doc or topic, ground in the actual codebase, produce (or refine) a PLAN file with problem, approach, alternatives, constraints, and a task breakdown sized to ~1 engineer-day per task with measurable acceptance criteria. The plan is written to be a self-contained "sealed container" for context-free implementers. Grants filesystem access for grounding and for writing the plan.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_ls, fs_cat, fs_write
+---
+You are decomposing a design doc (or topic) into an executable plan. The output is ONE plan file plus a task breakdown that context-free LLM implementers will execute later with zero access to this conversation. Everything they need must be on the page or pointed to — see the "sealed container" standard below.
+
+## Inputs
+
+- A design doc (path or pasted), or a one-line problem statement.
+- The target project directory (ground truth for all claims).
+- The plans directory where the PLAN file lands.
+
+## Step 1 — Ground before proposing
+
+Plans written from memory rot on contact with the code. Before writing anything:
+
+- Read the project's own orientation docs (`CLAUDE.md`, `AGENTS.md`, `CONTRIBUTING.md`, `README.md` at the project root) — conventions constrain the design.
+- Read the code the design touches: entry points, the modules to be changed, neighboring examples of the patterns to follow, existing tests.
+- `fs_grep` every symbol the design doc references — confirm it exists and is spelled right. Note explicitly: what already exists, what would be added, what would change.
+- Verify build/test commands actually exist (`Makefile`, `justfile`, `package.json` scripts, CI config).
+
+## Step 2 — The proposal
+
+Produce a structured proposal (iterate with the user when interactive — load the `grilling` skill and work the open decisions as frontier rounds, each question carrying a recommended answer; in autonomous runs, resolve what the doc + code answer and flag the rest as open questions):
+
+- **Problem** — one paragraph; state assumptions explicitly.
+- **Scope** — In / Out. Call out tempting adjacent work being deferred.
+- **Approach** — concrete: name files, symbols, data flow, migrations. Reference existing patterns by path.
+- **Alternatives considered** — table of alternative → why rejected. Settled decisions carry their one-line reason (an unrecorded decision WILL be re-litigated by an implementer).
+- **Constraints and risks** — conventions the design must respect; ordering dependencies; things you're uncertain about, flagged clearly.
+- **Open questions** — ONLY questions the codebase cannot answer (business rules, priority calls). If none, say "No open questions."
+- **Task breakdown** — see below.
+
+## Quality bar round (closes Step 2)
+
+The last round of Step 2 sets the plan's quality bar. It is grilling-compatible — run it as numbered questions, each carrying a recommended answer, like any other frontier round:
+
+1. **Propose `rigor`** — one of `poc | prototype | production` (default `production`). Infer the recommended value from the design doc's own language: "spike"/"demo" → `poc`; "iterate"/"internal" → `prototype`; otherwise `production`. Rigor calibrates which review-finding severities BLOCK downstream work: 🔴-critical findings block at EVERY rigor; at `poc`, suggestion/nitpick-level (🟢/💡) convention findings may be dropped from reports entirely. Anything a lower rigor defers is tracked as a follow-up — never silently dropped.
+2. **Propose `surfaces`** — zero or more of the closed enum: `rest-api`, `cli`, `library`, `worker`, `iac`, `db-migration`, `frontend`, `ci-cd` (`grpc`/`graphql` are aliases for `rest-api`), plus the escape hatch `other:<label>` for anything outside it. Infer from the approach: an HTTP handler → `rest-api`, a schema change → `db-migration`, and so on.
+3. **Per-surface confirm/drop** — for each accepted surface, present the headline best practices its reviewers will enforce and let the user confirm or drop each one. Every drop demands a one-line reason and lands in the plan's `## Quality bar` section — a dropped practice without a recorded reason WILL be re-litigated by a reviewer.
+
+For an `other:<label>` surface no reviewer checklist exists, so the lane is: a librarian lookup distills an authoritative best-practice checklist for the label; the user confirms or drops each item; accepted items become task acceptance criteria where possible, otherwise they live under `## Quality bar → Long-tail criteria`. (The architect drives the lookup; this skill documents the shape the results take in the plan.)
+
+Autonomous runs (no user to grill): take the inferred values, drop nothing, and note "quality bar inferred, not user-confirmed" in the plan.
+
+## Task breakdown rules
+
+| Rule | Why |
+|---|---|
+| **One task ≈ one engineer-day** | Variable task sizes destroy progress signal; anything larger gets decomposed NOW, not mid-run |
+| Each task independently implementable and verifiable | It builds and its tests pass without later tasks existing |
+| Explicit, acyclic dependencies (`blocked_by`) | Execution order must be derivable from the breakdown alone |
+| Each task states WHERE (files/packages) and WHAT (observable outcome) | "Implement service layer" is not a task; "internal/foo/service.go: add Create/Get with validation — returns 400 on missing name" is |
+| Measurable acceptance criteria per task | Criteria become the tests; "works correctly" is unmeasurable |
+| Flag ⚠️ low-confidence sizing with the reason | Honest sizing beats optimistic sizing |
+
+## Step 3 — Write the PLAN file
+
+Write `PLAN-<slug>.md` (kebab-case slug from the topic; verify no collision) to the plans directory:
+
+```markdown
+---
+slug: <slug>
+status: draft        # draft | active | implemented
+created: YYYY-MM-DD
+rigor: production    # poc | prototype | production; omitted = production
+surfaces: []         # from the closed enum and/or other:<label>; omitted = []
+---
+
+# <Title>
+
+## Problem
+## Scope (In / Out)
+## Approach
+## Alternatives considered
+## Constraints and risks
+## Quality bar
+## Open questions
+## Task breakdown
+
+| # | Task | Size | blocked_by | Notes |
+|---|------|------|-----------|-------|
+```
+
+`## Quality bar` records the quality-bar round in human-readable form: the rigor line with its one-line reason, the surfaces line, the dropped-practices list (each entry with its one-line reason and the date it was decided), and the long-tail criteria block (`none`, or the distilled checklist for each `other:<label>` surface).
+
+The plan is the implementers' entire context. Write for the "sealed container" standard: every question an implementer will hit is either answered inline or delegated via a pointer to the exact file/doc that answers it (where infra code goes, what DB tech, which layout to mirror, exact test commands). Paste short code snippets for load-bearing patterns — a path alone forces re-exploration; a stale claim fails the executor mid-implementation.
+
+## Anti-patterns
+
+- Proposing before reading the code — a design ungrounded in the actual codebase is fiction.
+- "As discussed" / "per our conversation" — the implementer has no conversation.
+- Tasks larger than a day hiding an "and then also…".
+- Acceptance criteria describing implementation ("uses a for loop") instead of behavior.
+- Open questions the code could have answered — grep first, ask last.
+- Unrecorded decisions — every settled fork carries its reason.
+- Declaring `rigor: poc` to dodge review findings the user never agreed to drop.

assets/skills/diagnosing-bugs/SKILL.md

@@ -0,0 +1,82 @@
+---
+description: Feedback-loop-first debugging discipline for hard code bugs and performance regressions. Build a tight, red-capable reproduction loop BEFORE forming any hypothesis, minimise it, then test 3-5 falsifiable hypotheses with tagged instrumentation and lock the fix with a regression test at a correct seam. Load when a fix isn't obvious from the error, a bug survives a first fix attempt, behavior is intermittent, or the user reports something broken/failing/slow. Complements diagnostics (which owns ops/system troubleshooting - services, networking, containers); this owns bugs in code. Grants shell access for running reproduction loops.
+enabled_tools: execute_command
+---
+You are hunting a bug in code. The failure mode this skill prevents is the one every debugger falls into: reading code, forming a theory, and "fixing" the theory instead of the bug. The discipline: **no hypothesis until a feedback loop exists.** Skip phases only when you can say why.
+
+**Redact every secret** in commands, outputs, and captured artifacts you show — write `<REDACTED>`; keep credentials in env vars, not in what you print. Quote only the lines of captured artifacts that carry signal.
+
+## Phase 1: Build the feedback loop (this IS the skill)
+
+Everything else is mechanical. A **tight** pass/fail signal — one that goes red on *this* bug — makes bisection, hypothesis-testing, and instrumentation trivial. Without one, no amount of code-reading will save you. Spend disproportionate effort here.
+
+Ways to construct one, in rough order of preference:
+
+1. **Failing test** at whatever seam reaches the bug: unit, integration, e2e.
+2. **curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing output against a known-good snapshot.
+4. **Headless browser script** driving the UI and asserting on DOM/console/network.
+5. **Replay a captured trace** — save a real request/payload/event log, replay it through the code path in isolation.
+6. **Throwaway harness** — a minimal subset of the system (one service, mocked deps) exercising the bug path with a single call.
+7. **Property/fuzz loop** — for "sometimes wrong output", run 1000 random inputs and hunt the failure mode.
+8. **Bisection harness** — bug appeared between two known states? Automate "boot at X, check" so `git bisect run` can consume it.
+9. **Differential loop** — same input through old vs new version (or two configs), diff the outputs.
+
+Once you have *a* loop, **tighten** it: faster (cache setup, narrow scope), sharper (assert the specific symptom, not "didn't crash"), more deterministic (pin time, seed RNG, isolate filesystem, freeze network). A 2-second deterministic loop is a debugging superpower; a 30-second flaky one is barely better than nothing.
+
+**Non-deterministic bugs**: the goal is a higher reproduction *rate*, not a clean repro. Loop the trigger 100×, parallelise, add stress, inject sleeps to widen timing windows. A 50% flake is debuggable; 1% is not.
+
+**Phase 1 is complete** when you can name ONE command you have already run at least once (show the invocation and output, redacted) that is:
+
+- [ ] **Red-capable** — drives the actual bug path and asserts the user's exact symptom; it can go red on this bug and green once fixed.
+- [ ] **Deterministic** — same verdict every run (or a pinned, high reproduction rate).
+- [ ] **Fast** — seconds, not minutes.
+- [ ] **Agent-runnable** — you can run it unattended.
+
+If you catch yourself reading code to build a theory before this command exists — STOP. That is the exact failure this skill exists to prevent. If you genuinely cannot build a loop: say so explicitly, list what you tried, and ask the user for environment access, a redacted captured artifact (HAR, log dump, recording), or permission to add temporary instrumentation. Do NOT proceed to hypothesise without a loop.
+
+## Phase 2: Reproduce + minimise
+
+Run the loop; watch it go red. Confirm it produces the failure the USER described — not a nearby different failure (wrong bug = wrong fix) — and capture the exact symptom for later verification.
+
+Then **minimise**: shrink to the smallest scenario that still goes red. Cut inputs, callers, config, and steps one at a time, re-running after each cut. Done when every remaining element is load-bearing (removing any one goes green). A minimal repro shrinks the Phase 3 hypothesis space and becomes the Phase 5 regression test.
+
+## Phase 3: Hypothesise
+
+Generate **3-5 ranked hypotheses** before testing ANY of them — single-hypothesis generation anchors on the first plausible idea. Each must be **falsifiable**: "if X is the cause, then changing Y makes the bug disappear / changing Z makes it worse." Can't state the prediction? It's a vibe — discard or sharpen.
+
+Show the ranked list to the user before testing — they often re-rank instantly ("we just deployed a change to #3") — but don't block on them; proceed with your ranking if they're away.
+
+## Phase 4: Instrument
+
+Every probe maps to a specific Phase 3 prediction. **One variable at a time.**
+
+1. Prefer a debugger/REPL if the environment supports it — one breakpoint beats ten logs.
+2. Otherwise targeted logs at the boundaries that DISTINGUISH hypotheses. Never "log everything and grep".
+3. **Tag every debug log with a unique prefix** (e.g. `[DEBUG-a4f2]`) so cleanup is a single grep. Untagged logs survive into production; tagged logs die.
+
+**Performance regressions**: logs are usually the wrong tool. Establish a baseline measurement first (timing harness, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5: Fix + regression test
+
+Write the regression test BEFORE the fix — but only at a **correct seam**: one where the test exercises the real bug pattern as it occurs at the call site. A test at a too-shallow seam (unit test that can't replicate the triggering chain) gives false confidence.
+
+**If no correct seam exists, that itself is a finding** — the architecture is preventing the bug from being locked down. Document it; don't fake the test.
+
+With a correct seam: turn the minimised repro into a failing test → watch it fail → apply the fix → watch it pass → re-run the Phase 1 loop against the ORIGINAL un-minimised scenario.
+
+## Phase 6: Cleanup (required before declaring done)
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop, show the output)
+- [ ] Regression test passes — or the absence of a correct seam is documented
+- [ ] All `[DEBUG-...]` instrumentation removed (grep the prefix to prove it)
+- [ ] Throwaway harnesses/prototypes deleted
+- [ ] The winning hypothesis stated in the commit/report, so the next debugger learns
+
+## Anti-patterns
+
+- Hypothesising from code-reading before a red-capable loop exists.
+- "Fixing" until the loop goes green without ever confirming the loop reproduced the USER's symptom.
+- Shotgun instrumentation — untargeted logs that distinguish nothing.
+- Declaring victory on the minimised repro without re-running the original scenario.
+- Deleting or weakening the failing test to get green.

assets/skills/diagnostics/SKILL.md

@@ -16,6 +16,10 @@ evidence yourself — never ask the user to run commands and paste output back.
 5. **State each hypothesis in one line before testing it.** Pivot openly when disproved.
 6. **Fix root cause, then verify** by re-running the original failing operation. No verification, no fix.
 
+## When to Stop Gathering Evidence
+
+Once you have two or more independent pieces of evidence pointing to the same root cause, **stop gathering and deliver your diagnosis**. Do not add more verification steps to verify your verification. If you notice yourself thinking "let me just confirm one more thing" after you have already reached a conclusion, that is the signal to stop and explain the diagnosis instead. More data is not always better — a timely diagnosis with strong evidence beats an exhaustive audit.
+
 ## Command Discipline
 
 - Non-interactive and bounded, always: `--no-pager`, `-n`/`--since` on logs, `timeout 10` on anything that might

assets/skills/git-master/SKILL.md

@@ -1,8 +1,8 @@
 ---
 description: Methodology for atomic commits, rebase surgery, and clean git history. Grants shell access for running git commands.
-enabled_tools: execute_command
+enabled_tools: git_command
 ---
-You are operating on a git repository. Apply these conventions strictly. Use the `execute_command` tool to run git commands.
+You are operating on a git repository. Apply these conventions strictly. Use the `git_command` tool to run git commands.
 
 ## Atomic commits
 
@@ -29,7 +29,7 @@ Each commit represents one logical change. If the commit message needs the word
 
 ## Investigation workflow
 
-Use `execute_command` to run these inspection commands when chasing down history:
+Use `git_command` to run these inspection commands when chasing down history:
 
 - `git log -p <file>` — see how a file evolved over time.
 - `git log -S '<string>'` (pickaxe) — find when a string was added or removed.

assets/skills/grilling/SKILL.md

@@ -0,0 +1,60 @@
+---
+description: Interview the user relentlessly about a plan, decision, or design until shared understanding is reached. Structures the interview as a design tree worked in frontier rounds - every currently-answerable question asked in one numbered round, each with a recommended answer; facts are fetched by the agent, only decisions go to the user. Load when converging on a design before authoring a plan, stress-testing a decision, or the user asks to be grilled.
+---
+Interview the user relentlessly until you reach a shared understanding. Map the topic as a **design tree**: every decision branches into the decisions that hang off it. Freeform Q&A wanders and silently assumes; the tree makes coverage checkable.
+
+## Frontier rounds
+
+Work the tree in **rounds**. The **frontier** is every decision whose prerequisites are already settled: the questions you can ask *now* without guessing at answers you haven't heard yet. Ask the WHOLE frontier in one round — numbered, each with your recommended answer. Then wait for the user's answers before the next round.
+
+Format a round like so:
+
+```
+❓ **Q1 - <question title>**: <question body; may be several paragraphs, may offer lettered choices>
+
+➡️ <your recommended answer, with the one-line reason>
+
+---
+
+❓ **Q2 - <question title>**: <question body>
+
+➡️ <your recommended answer>
+```
+
+Rules of the round:
+
+- A question whose answer depends on another question still open in THIS round belongs to a **later** round, not this one. No stacked hypotheticals.
+- Recommendations are mandatory. "What do you want?" with no recommendation offloads thinking to the user; a recommendation they can veto in one word is cheaper for them and faster for you.
+- Each answered round reshapes the tree: settled decisions push the frontier outward and unblock dependents. Recompute the frontier and ask the next round.
+- Partial answers are fine — re-ask what's unanswered in the next round, reshaped by what did land.
+
+## Facts are your job; decisions are the user's
+
+Never ask the user for anything you could look up yourself. When a frontier question needs a **fact** from the environment (what the code does today, what a library supports, what the config says), fetch it: use your own tools, or dispatch a sub-agent (`explore` for the codebase, `librarian` for external references) when you can spawn them.
+
+Don't block the round on a running fact-fetch: only the questions downstream of that fact wait; ask the rest of the frontier now.
+
+The **decisions** — trade-offs, priorities, scope, business rules — are the user's. Put each one to them and wait. Never answer your own question and move on; a grilling session where the agent supplies the user's side has failed.
+
+## Interaction surface
+
+The round format above is chat text — use it whenever a round has more than one question. Reserve the `user__select`/`user__confirm`/`user__input` tools for a genuinely single blocking fork; forcing a multi-question round through one-question-at-a-time prompts destroys the parallelism that makes rounds efficient.
+
+## Completion
+
+The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Then:
+
+1. Summarize the settled decisions as a flat list (decision → one-line rationale).
+2. Ask the user to confirm the shared understanding.
+3. Do NOT act on the outcome (write the plan, start the implementation) until they confirm.
+
+Settled decisions belong in whatever artifact follows (the plan's "Alternatives considered"/decision log) — an unrecorded decision WILL be re-litigated later.
+
+## Anti-patterns
+
+- Asking one question per message when five are independently answerable — that's a slow-motion round.
+- Asking questions the codebase answers — grep first, ask never.
+- Questions without recommendations.
+- Stacked hypotheticals ("if we go with A, then for the storage would you...") — that's a later round.
+- Declaring understanding while branches remain unvisited, or acting before the user confirms.
+- Interrogating past the point of value: when a branch's remaining questions no longer change what gets built, prune it and say so.

assets/skills/iac-review/SKILL.md

@@ -0,0 +1,59 @@
+---
+description: Review the infrastructure-as-code surface of a change - Terraform, Helm charts, Kubernetes manifests, Dockerfiles, and compose files. Checks provider/module/base-image pinning, plaintext secret material, IAM/RBAC scoping, resource requests/limits, mutable image tags in deploy paths, and destructive plan operations without lifecycle guards. Load when a diff touches *.tf files, Helm charts, K8s manifests, Dockerfiles, or compose files. Findings fold into the standard code-review severity taxonomy. Grants read-only filesystem access for tracing modules, values files, and manifests.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+You are reviewing infrastructure-as-code. The generic correctness checklist asks "does this config apply cleanly?"; you ask **"what does this change do to the running system on apply day — and on every rebuild after?"** IaC is executable: an unpinned module resolves differently next month, a wildcard grant is a standing invitation, and a resource replacement that looked like an update deletes a database. Most IaC incidents are not syntax errors — they are a drifted dependency, a `latest` tag that moved, or a destroy the plan output showed and nobody read.
+
+## When to load this skill
+
+The diff touches ANY of: `*.tf` files or Terraform modules, Helm charts or values files, Kubernetes manifests, Dockerfiles, or compose files. If the diff is application code with unchanged infrastructure — unload; this checklist has nothing for you.
+
+## Marker semantics
+
+Every checklist item below carries a severity emoji AND a `[convention]` or `[correctness]` marker; both ride in the finding title so downstream tooling can act on them mechanically. `[convention]` findings are rigor-foldable (the orchestrator may lower them under a relaxed quality bar) and rejectable — but ONLY with cited evidence: a repo convention at file:line, or a recorded plan decision. `[correctness]` is reserved for contract breaks; those findings are neither foldable nor rejectable.
+
+## Linters and mechanized checks
+
+The review orchestrator runs the domain's mechanized checkers — `tflint`/`checkov` for Terraform, `hadolint` for Dockerfiles, `kubeconform` for Kubernetes manifests; your CONTEXT may already include their output — do not re-derive it. Spend your prose on what those tools cannot reach: blast radius of a destructive operation, whether a wildcard grant had a scoped alternative, whether a pin was omitted deliberately. If the repo plausibly warrants a linter config it lacks (Terraform but no `tflint`/`checkov` config, Dockerfiles but no `hadolint` config, manifests but no `kubeconform` wiring), emit a 🟢 `[convention]` finding naming the gap.
+
+## The checklist
+
+Severities below are the production bar. Each item is a context-sensitive question, not an absolute — read the module sources, values files, and sibling stacks before flagging, and state any exemption you rely on.
+
+### 1. 🟡 `[convention]` Unpinned providers, modules, or base images
+
+Does the diff add or modify a provider requirement, module source, or base image without pinning it to an exact version (or digest)? Unpinned means unbuildable-reproducibly: the same code produces different infrastructure next month. Check for version constraints on providers, ref/version on module sources, and tags-plus-digests on base images. A floating constraint that the repo's lockfile then pins is a weaker finding — cite the lockfile if it exists. Internal modules versioned by the same repo's release process can be exempt; say so.
+
+### 2. 🔴 `[convention]` Plaintext secret material in code, state, or values
+
+Does the diff introduce secret material — passwords, tokens, keys, connection strings with credentials — in plaintext in config files, values files, environment blocks, or anywhere it lands in state or the image? Report the finding and the location; defer the exploitation analysis to `security-review`, which owns the abuse question. The severity stays 🔴 regardless of the declared quality bar — a committed secret is critical at every rigor, and this item should never be folded down. Values wired from an external secret manager, encrypted-at-rest secret stores, or CI-injected references are the correct shapes — verify the reference is actually a reference, not an inlined value.
+
+### 3. 🟡 `[convention]` Wildcard IAM/RBAC where a scoped grant is available
+
+Does the diff grant `*` actions, `*` resources, cluster-admin, or a similarly broad role where the workload's actual needs are enumerable? The finding must name the scoped alternative: the specific actions the code paths use, the resource ARNs/namespaces in play. A genuinely dynamic resource set can justify a partial wildcard — the finding is a wildcard chosen for convenience when a scoped grant was available. Whether the over-grant is *exploitable* in this environment is `security-review`'s question; yours is the least-privilege contract.
+
+### 4. 🟢 `[convention]` Missing resource requests/limits on workloads
+
+Do new or modified workloads (Deployments, StatefulSets, Jobs, compose services in deploy paths) declare resource requests and limits? A workload with no requests schedules blind and a workload with no limits can starve its node neighbors. Check whether the repo sets these via a shared chart/library or namespace defaults (LimitRange) before flagging — a house mechanism that already applies them is an exemption worth citing.
+
+### 5. 🟡 `[convention]` Mutable image tags in deploy paths
+
+Does anything in a deploy path reference an image by a mutable tag — `latest`, a branch name, an unversioned tag? A mutable tag means the deployed artifact changes without a corresponding code change: rollbacks stop meaning anything and two environments running "the same tag" can run different code. The fix is an immutable version tag or digest. Local-development compose files not used for deployment are exempt — verify which one this file is before flagging, and say so.
+
+### 6. 🟡 `[convention]` Destructive plan operations without lifecycle guards
+
+Will applying this diff destroy or replace stateful resources — a changed identifier forcing replacement, a removed resource holding data, a rename the tool treats as destroy-and-create? For resources where destruction means data loss (databases, buckets, volumes), look for the guardrails: `prevent_destroy` lifecycle blocks, deletion protection flags, `moved`/state-migration blocks for renames. The finding names the resource, why the plan will destroy it, and the guard or migration that is missing. Stateless, freely recreatable resources are exempt.
+
+## Ground-truth discipline
+
+- READ the module source and values files a manifest consumes, not just the diff hunk — pins, secrets, and defaults often live one level up or down from the change.
+- `fs_grep` sibling stacks/charts for the house idioms (version-pinning style, secret-reference mechanism, shared resource-limit templates) and cite the sibling at file:line when flagging deviation.
+- Distinguish deploy-path files from local-dev scaffolding before applying deploy-path severities; the file's consumers, not its syntax, determine which it is.
+- Do not guess what a plan will do from the diff alone when the change is ambiguous — say what evidence would settle it (the plan output) and flag the ambiguity itself.
+
+## What this skill does NOT check
+
+- Whether an exposed secret, over-grant, or open ingress is actually exploitable, and supply-chain trust of images/modules → `security-review` (this skill reports the presence of the hazard; that skill owns the abuse analysis).
+- Whether provisioning/deployment scripts mutate state idempotently and survive reruns → `transactional-integrity`.
+- Log configuration conventions inside deployed workloads → `logging-discipline`.
+- Metrics, alerts, and dashboards for new infrastructure → `observability-review`.

assets/skills/incident-prior-art/SKILL.md

@@ -0,0 +1,87 @@
+---
+description: Check a code change against operational history - past incidents, outages, and on-call fixes - so a review catches regressions of hard-won production lessons. Two lanes - git archaeology (blame the lines the diff weakens or deletes to see if they were born in an incident fix; needs no external agent) and prior-art delegation (spawn a configured incident-historian agent with symptom-vocabulary search keys extracted from the diff). Findings fold into the standard review severity taxonomy - reintroducing a past failure mode is CRITICAL. Grants shell access for git history commands.
+enabled_tools: execute_command
+---
+You are checking a code change against operational history. Code review answers "is this code good?"; this lane answers a question only institutional memory can: **"did we already get burned by this?"** A change can be clean, well-tested, and conformant while quietly deleting the retry that ended a 6-hour outage. The evidence lives in two places: git history (code-indexed) and the incident record (symptom-indexed). Work both.
+
+## When this lane runs
+
+This lane is OPTIONAL and runs only when both hold:
+
+1. **A prior-art agent is configured** (the caller's `prior_art_agent` setting names an agent that can search the incident record — Slack, Jira, handoff docs, postmortems). If it is empty, run ONLY the git-archaeology lane (Part A), which needs no external agent.
+2. **The diff touches operationally-relevant surface**: services with on-call history, code that emits alerts/metrics/log lines operators watch, error handling, retries, timeouts, rate limits, queue/batch processing, or config controlling any of these. A docs change or a pure-UI tweak does not need an incident sweep — skip and say so in one line.
+
+## Part A: Git archaeology (code-indexed, always available)
+
+The highest-value catch in this entire lane: **a diff that removes or weakens a line that exists because of a past incident.** Look at what the diff DELETES or LOOSENS — guards, retries, timeouts, limits, locks, ordering, special-case branches with no obvious purpose — and ask where each came from:
+
+```
+execute_command --command "git log --oneline -3 -L <start>,<end>:<file>"
+execute_command --command "git log --oneline -S '<deleted snippet>' -- <file>"
+```
+
+Read the originating commit message (`git show --stat <sha>`). Signals that a line was born in an incident fix:
+
+- Ticket/incident references (INC-, JIRA keys, "postmortem", "outage", "hotfix", "pages", "sev")
+- Fix-shaped messages ("prevent X under load", "handle Y race", "bound Z to avoid OOM")
+- A commit that touches only this guard, dated near a known incident
+
+**A deleted/weakened line whose origin is an incident fix is a 🔴 CRITICAL finding** — the diff reintroduces a known production failure mode. Cite the line, the originating commit, and its message. If the origin is ordinary feature work, no finding — do not manufacture history.
+
+## Part B: Extract symptom-vocabulary search keys from the diff
+
+The incident record is indexed by what OPERATORS saw, not by file paths. Before delegating, translate the diff into that vocabulary:
+
+1. **Error/log strings** added, changed, or deleted — incidents are found by error strings more than by anything else. A DELETED log line is itself a lead: someone may rely on it for triage.
+2. **Metric, alert, and dashboard names** the code emits or the change affects.
+3. **Config keys** and their old/new values (timeouts, limits, feature flags).
+4. **Service/feature/domain terms** an operator would use ("invoice proration", "webhook retries", "usage export") — not function names.
+5. **External dependencies touched** (queues, third-party APIs, databases) — their names appear in incident titles.
+
+Collect 3-8 strong keys. Weak generic keys ("error", "billing") flood the search; skip them.
+
+## Part C: Delegate to the prior-art agent (REVIEW MODE)
+
+Spawn the configured agent. Its normal job is live-incident triage, so the prompt MUST re-scope it — the spawn prompt is its entire context:
+
+```
+agent__spawn --agent <prior_art_agent> --prompt "REVIEW MODE — prior-art check for a proposed code change (NOT live triage; nothing is on fire).
+
+## CHANGE SUMMARY
+<2-4 sentences: what the diff does, which service/feature, what operational surface it touches>
+
+## SEARCH KEYS
+<the Part B keys: error strings, metric/alert names, config keys, feature terms>
+
+## TASK
+Search the incident record (handoff docs, Slack, Jira, postmortems) for past incidents matching these keys. For each relevant hit report:
+- Reference (ticket/thread/doc section) and date
+- What happened and what the resolution was
+- Relevance: does this change RISK REINTRODUCING that failure mode, or should it ADOPT a safeguard from that resolution?
+
+Only report incidents with a concrete connection to these search keys. 'The billing system has had incidents' is noise. If nothing relevant exists, say so plainly — a clean result is a valid result.
+
+You are read-only. Do not post, comment, or edit anything."
+```
+
+## Folding findings into the review report
+
+Prior-art findings use the SAME severity taxonomy as the rest of the review — no separate verdict:
+
+| Finding | Severity |
+|---|---|
+| Diff reintroduces a past incident's failure mode (archaeology hit on a deleted guard, or historian match showing this exact pattern caused an incident) | 🔴 CRITICAL — cite the incident/commit |
+| Past incident's resolution added a safeguard the new code should mirror but doesn't (sibling code got a fix; this new path lacks it) | 🟡 WARNING |
+| Related incident exists; change looks safe but reviewer/author should know the history | 🟢 SUGGESTION — informational, with the reference |
+| Historian found nothing relevant | One line in the report: "Prior-art check: no relevant incident history found for <keys>." |
+
+Present these under a dedicated **"Operational history"** section in the final report, each finding citing its incident reference or originating commit.
+
+## Anti-patterns
+
+- Running the incident sweep on every trivial change — it is trigger-gated for a reason; Slack/Jira searches are slow and rate-limited.
+- Blocking on vague similarity ("this area had incidents once") — a 🔴 requires a concrete reintroduction path tied to a specific incident or originating commit.
+- Searching by file paths or function names — the incident record doesn't know them; translate to symptom vocabulary first.
+- Skipping Part A because no prior-art agent is configured — archaeology is local git work and always available.
+- Treating a clean historian result as wasted effort — "no prior art" is signal, and it belongs in the report as one line, not zero.
+- Manufacturing findings from ordinary-feature-work commits to have something to say. Most deleted lines were not incident fixes.

assets/skills/iwe-knowledge-base/SKILL.md

@@ -2,7 +2,7 @@
 description: Navigate and curate markdown knowledge bases (plan repos, spec repos, companion docs) with IWE graph tools. Load when the workspace is or contains a markdown knowledge base and the task involves finding, reading, or reorganizing plans, specs, designs, or notes. Activates the iwe MCP server rooted at the current directory.
 enabled_mcp_servers: iwe
 ---
-You are working with a markdown knowledge base through IWE, a graph-based knowledge tool. The `iwe` MCP server is rooted at the current working directory (`--project .`), so the knowledge base is the directory Coyote was launched in. IWE derives structure from links: a link on its own line is an *inclusion link* (parent-child hierarchy); a link inside text is an *inline reference* (cross-reference, produces backlinks). The server watches the filesystem, so external edits are picked up automatically — never ask for a restart.
+You are working with a markdown knowledge base through IWE, a graph-based knowledge tool. The `iwe` MCP server is rooted at the current working directory, so the knowledge base is the directory Coyote was launched in. IWE derives structure from links: a link on its own line is an *inclusion link* (parent-child hierarchy); a link inside text is an *inline reference* (cross-reference, produces backlinks). The server watches the filesystem, so external edits are picked up automatically — never ask for a restart.
 
 ## When to use this (and when not)
 
@@ -10,7 +10,8 @@ Use IWE tools when the task involves a corpus of markdown documents: plan reposi
 
 Do NOT use IWE tools for:
 
-- **Agent memory** (`.coyote/memory/`, `COYOTE.md`) — use the `memory__*` tools; they own the index conventions there.
+- **Agent memory** (`.coyote/memory/`) — use the `memory__*` tools; they own the index conventions there.
+- **Workspace instructions** (`COYOTE.md`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`) — human-curated and read-only; never edit them with IWE write tools.
 - **Semantic/similarity search over documents** — that is RAG's job. IWE search is fuzzy title/key matching plus structural traversal, not embeddings.
 - **Source code** — IWE only understands markdown.
 

assets/skills/library-review/SKILL.md

@@ -0,0 +1,59 @@
+---
+description: Review the public-API surface contract of a library change - semver discipline against the manifest version, panic reachability from public entry points, doc coverage, error-type information quality, dependency weight/pinning, and internal-type leakage. Load when a diff touches the public API of a lib crate/package - exported symbols, pub items, __init__/index exports - or its manifest version. Findings fold into the standard code-review severity taxonomy. Grants read-only filesystem access for tracing exports, manifests, and public signatures.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+You are reviewing a library's public surface. The generic correctness checklist asks "does this code work?"; you ask **"what did downstream consumers just inherit?"** A library's public API is a versioned contract: every exported symbol, signature, error type, and transitive dependency becomes someone else's problem the moment it ships. Most library pain downstream is not broken logic — it is a silent semver break, a panic escaping an API that promised a `Result`, or a private type welded into a public signature that can now never change.
+
+## When to load this skill
+
+The diff touches ANY of: the public API of a lib crate/package — exported symbols, `pub` items, `__init__`/index exports, re-export lists — or its manifest version (Cargo.toml, package.json, pyproject.toml). If the diff is purely private internals with no public-surface or manifest change — unload; this checklist has nothing for you.
+
+## Marker semantics
+
+Every checklist item below carries a severity emoji AND a `[convention]` or `[correctness]` marker; both ride in the finding title so downstream tooling can act on them mechanically. `[convention]` findings are rigor-foldable (the orchestrator may lower them under a relaxed quality bar) and rejectable — but ONLY with cited evidence: a repo convention at file:line, or a recorded plan decision. `[correctness]` is reserved for contract breaks; those findings are neither foldable nor rejectable.
+
+## Linters and mechanized checks
+
+The review orchestrator runs mechanized checks (API-diff/semver checkers, doc-coverage lints); your CONTEXT may already include their output — do not re-derive it. Spend your prose on what linters cannot reach: whether a behavioral change breaks callers even though signatures held, whether an error type actually tells the caller what to do, whether a new dependency is worth its weight. If the repo plausibly warrants a linter config it lacks (a published library with no API-breakage check or doc lint configured), emit a 🟢 `[convention]` finding naming the gap.
+
+## The checklist
+
+Severities below are the production bar. Each item is a context-sensitive question, not an absolute — establish what is actually public and actually published before flagging.
+
+### 1. 🔴 `[correctness]` Breaking public-API change without a major-version note
+
+Does the diff remove, rename, or change the signature/behavior of anything exported — or tighten what an input accepts, or change what an error variant means? Compare against the manifest version: a breaking change is a 🔴 `[correctness]` finding unless the diff carries a major-version bump or an explicit note that one is planned for the release. Verify "published" first: symbols added earlier on this same unreleased branch are fair game to change freely, and a 0.x line may follow a different compatibility policy — read the repo's versioning statement before firing. Semver is the contract; this is never foldable and never rejectable.
+
+### 2. 🟡 `[convention]` Panic/unwrap reachable from public API on user input
+
+Trace new public entry points: can caller-supplied input reach a panic — `unwrap`/`expect` on values derived from arguments, unchecked indexing/slicing, unchecked arithmetic, assertions on caller data? A library that panics on bad input takes down the host application; the contract is to return the error type instead. Panics on programmer error (violated documented invariants) or in internal-only paths that input cannot reach are exempt — say so when you rely on that distinction.
+
+### 3. 🟢 `[convention]` Public items with no doc comments
+
+Does every new public item — function, type, trait/interface, module, re-export — carry a doc comment saying what it does, what its parameters mean, and what errors/panics it can produce? Match the repo's documentation register: in a library where every existing public item is documented, an undocumented newcomer is a clear finding; cite a documented sibling at file:line.
+
+### 4. 🟡 `[convention]` Error types erasing caller-actionable information
+
+Read the error paths crossing the public boundary: does the error type let a caller distinguish the cases they would handle differently — retry vs give up, bad input vs internal failure, which resource was missing? Stringly-typed errors, a single opaque variant swallowing distinct causes, and lossy conversions that drop the source error are the finding. The caller cannot match on a message string; they need variants, codes, or a source chain.
+
+### 5. 🟢 `[convention]` Heavyweight or unpinned new required dependency
+
+Does the diff add a required dependency? For a library, every required dependency lands in every consumer's tree: is it proportionate to what it is used for (a large framework pulled in for one helper is the finding), is its version constraint sane per the ecosystem's norm (a wildcard or unbounded range is the finding), and could it be optional/feature-gated instead? Dev/test-only dependencies are exempt. Whether the dependency is *trustworthy* (typosquats, abandonment, supply-chain risk) is `security-review`'s question.
+
+### 6. 🟢 `[convention]` Internal types leaking through the public surface
+
+Do new public signatures expose types that were meant to stay internal — a private module's struct now returned publicly, a third-party type welded into a public signature (locking the dependency into the public contract), or an implementation detail that consumers will now depend on? Once shipped, these can only be removed by a major version. Look for the repo's existing pattern (newtype wrappers, re-export boundaries, facade modules) and cite it when flagging.
+
+## Ground-truth discipline
+
+- Establish the actual public surface first: `fs_grep` the export list / re-exports / visibility modifiers — an item can be `pub` yet unreachable from outside, or private yet re-exported.
+- READ the manifest for the current version and any versioning policy notes before calling anything a semver break.
+- Check a documented, well-shaped sibling API for the house style (doc register, error-type shape, newtype boundaries) — deviation from a cited sibling is the strongest form of evidence.
+- Do not flag behavior-preserving refactors of private internals; the contract is the public surface.
+
+## What this skill does NOT check
+
+- Whether inputs are exploitable or a new dependency is malicious/compromised → `security-review` (this skill only weighs dependency size and pinning).
+- Whether stateful helpers the library exposes are idempotent, atomic, or retry-safe → `transactional-integrity`.
+- Log lines a library emits and their conventions → `logging-discipline`.
+- Metrics/alerts for the library's operational behavior → `observability-review`.

assets/skills/logging-discipline/SKILL.md

@@ -0,0 +1,69 @@
+---
+description: Calibrate log output to the repository's existing logging conventions before writing code, and review diffs for under- and over-logging. Detects the repo's logging register from sibling files - logger/framework, message style (capitalization, length, tense), payload vs ID-only context, level semantics, error-path convention - and matches it; falls back to stated best-judgment defaults when no convention exists. Load when writing code that touches boundaries, error paths, jobs, or state transitions, or when reviewing such a diff. Complements security-review (which owns secrets/PII in logs) and incident-prior-art (which treats deleted log lines as operational leads).
+---
+You are writing or reviewing code that logs — or that should. LLMs fail in both directions: narrating every step (noise operators must grep past) and swallowing error paths silently (invisible failures at 3am). "Correct" is repo-relative: detect the register, match it; where no register exists, apply the best-judgment defaults below.
+
+## Step 0: Check for a declared policy first
+
+Check the workspace instructions already in your context (`COYOTE.md`/`AGENTS.md`, a logging section in `CONTRIBUTING.md`) for a stated logging convention. A declaration beats detection — obey it and skip Step 1.
+
+## Step 1: Detect the register (during reads you already do)
+
+Pattern-matching discipline already has you reading 2-3 sibling files before writing. While reading, note how THEY log:
+
+1. **Logger and shape** — which logging library/facade, and is output structured (key-value fields) or printf-style interpolated strings? Never introduce a second logging mechanism alongside an established one.
+2. **Message style** — capitalization (lowercase `"failed to connect"` vs sentence-case `"Failed to connect"`), punctuation (trailing periods or not), length (terse fragments vs full sentences), tense/mood ("connecting" / "connected" / "connect failed"). Match all of it — mixed message styles make logs harder to grep.
+3. **Context convention** — what rides along with the message: full payloads, or IDs only? Which fields are customary (request/correlation ID, entity IDs, durations)? Attached as structured fields or interpolated into the string? If the repo logs IDs-only, do NOT log payloads — that's both a style break and a data-exposure risk.
+4. **Level semantics in practice** — what does this repo actually use `error`/`warn`/`info`/`debug` for? Match observed usage over textbook definitions.
+5. **Error-path convention** — do errors get logged where they occur and then propagated, or propagated silently and logged once at the top? Match it; this determines where YOUR log lines go.
+
+Sample from the same language and layer you're editing — a chatty CLI layer and a quiet library core can coexist in one repo; the nearest siblings win.
+
+## Step 2: When to log (and when not)
+
+Warranted — a reader on-call should be able to see:
+
+- **Boundaries**: calls to external systems (network, DB, queues) — at minimum their failures, with enough context to identify the failing operation.
+- **Error paths**: every error is either logged or propagated to something that logs it — never silently swallowed, and **never both** (see invariants).
+- **Lifecycle**: job/worker/process start, finish, and abnormal exit; consumed/produced messages where the repo's register does so.
+- **State transitions an operator would care about** (order of magnitude: status changes, retries exhausted, fallbacks engaged).
+
+Unwarranted:
+
+- **Narration** — logging what the next line of code plainly does ("entering function", "about to save"). The comment-discipline rule, applied to logs.
+- **Hot paths** — per-item logging inside loops or per-request debug logging in high-volume paths; aggregate or sample instead.
+- **Log-and-rethrow** — logging an error AND re-raising it to a caller that logs again produces duplicate stacks that make incidents harder to read, not easier.
+- **Payloads the register doesn't log** — and never full payloads containing credentials or personal data regardless of register (security-review owns that judgment; don't create the finding).
+
+## Best-judgment defaults (weak or no signal)
+
+A greenfield file, a repo with no discernible convention, or contradictory siblings — use these and note the choice:
+
+- Structured logging if the ecosystem's standard library or dominant framework supports it; otherwise the language's idiomatic default.
+- Terse, lowercase, no trailing period, present-tense messages ("failed to fetch invoice"), stable wording (log messages are grepped and alerted on — treat them as identifiers, not prose).
+- IDs and small scalar fields, never payloads.
+- `error` = someone may need to act, `warn` = degraded but coping, `info` = lifecycle, `debug` = development detail.
+- When genuinely unsure whether a line earns its keep: boundaries and error paths yes, everything else no.
+
+## Review-side checks (for diffs)
+
+- **Underdone**: a new external call, error path, or background job with zero failure visibility — no log, no metric, no propagation to a logging caller. Cite the path and what an operator would be blind to.
+- **Overdone**: narration logs, log-and-rethrow duplication, hot-loop logging, payload logging in an IDs-only repo. Cite the line and the register evidence.
+- **Register mismatch**: new log lines that break the detected message style or use a different logger/mechanism than the siblings.
+- **Deleted or reworded log lines**: operators and alerts grep for exact strings; flag deletions/rewordings of lines that look triage-relevant so the change is conscious, not accidental (incident-prior-art treats these as leads — same instinct at review time).
+- Severity calibration: silent new failure paths are 🟡 findings; style/register mismatches are 🟢/💡.
+
+## Invariants (register-independent)
+
+1. **No error silently swallowed.** An empty catch/ignored error with no log, no metric, and no propagation is a finding in every repo.
+2. **No double-logging of one error** along a single propagation path — one log per failure, at the level the repo's convention chooses.
+3. **No secrets or personal data in logs**, ever, regardless of how payload-happy the register is.
+4. **Never delete existing log lines as drive-by "cleanup"** — that's out-of-scope churn AND an operational hazard; if a line must go, say so explicitly in the change description.
+
+## Anti-patterns
+
+- Importing your favorite logging style into a repo that has one.
+- Logging every function entry/exit because "more visibility is better" — noise is the enemy of visibility.
+- Flagging a quiet pure-computation module for "missing logs" — the trigger surface is boundaries, error paths, jobs, and state transitions; inert code needs none.
+- Rewording existing log messages to be "cleaner" — you just broke someone's saved Loki/CloudWatch query.
+- Treating textbook level definitions as authoritative over the repo's observed usage.

assets/skills/migration-review/SKILL.md

@@ -0,0 +1,55 @@
+---
+description: Review database schema migrations - expand/contract compatibility with currently-running code, reversibility, online/concurrent index creation, backfills mixed into DDL transactions, and down-migrations. Load when a diff touches migration directories/files, schema definitions, or ORM model changes. Findings fold into the standard code-review severity taxonomy. Grants read-only filesystem access for tracing migrations, schema definitions, and the code that reads the affected tables.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+You are reviewing a schema migration. The generic correctness checklist asks "does this migration apply?"; you ask **"what happens in the window when this schema and the currently-running code coexist — and what happens if we have to go back?"** A migration does not run against an idle system: for the minutes (or hours) of a rolling deploy, old code runs against the new schema, and a rollback runs old code against it indefinitely. Most migration incidents are not failed DDL — they are a column dropped while running code still reads it, a lock held on a hot table during business hours, or a bad deploy with no way back.
+
+## When to load this skill
+
+The diff touches ANY of: migration directories or files, schema definition files, or ORM model changes that generate schema changes. If the diff is query/application logic against an unchanged schema — unload; this checklist has nothing for you.
+
+## Marker semantics
+
+Every checklist item below carries a severity emoji AND a `[convention]` or `[correctness]` marker; both ride in the finding title so downstream tooling can act on them mechanically. `[convention]` findings are rigor-foldable (the orchestrator may lower them under a relaxed quality bar) and rejectable — but ONLY with cited evidence: a repo convention at file:line, or a recorded plan decision. `[correctness]` is reserved for contract breaks; those findings are neither foldable nor rejectable.
+
+## Linters and mechanized checks
+
+The review orchestrator runs mechanized checks (migration linters, schema-diff tools, lock-analysis checkers); your CONTEXT may already include their output — do not re-derive it. Spend your prose on what those tools cannot reach: whether the currently-running code still depends on what this migration removes, whether irreversibility was a decision or an accident, whether a table is big enough for lock duration to matter. If the repo plausibly warrants a linter config it lacks (a migration directory but no migration linter or schema-diff check configured), emit a 🟢 `[convention]` finding naming the gap.
+
+## The checklist
+
+Severities below are the production bar. Each item is a context-sensitive question, not an absolute — read the code that touches the affected tables and the repo's deploy story before flagging, and state any exemption you rely on.
+
+### 1. 🔴 `[correctness]` Expand/contract violation against currently-running code
+
+Does this migration remove or rename a column/table, tighten a constraint, or change a type that the CURRENTLY-DEPLOYED code still reads or writes? During a rolling deploy — and after any rollback — that code runs against this schema, and the violation is an outage, not a style issue. The safe sequence is expand/contract: additive schema change first, code migrated in a separate deploy, contraction only after no running code references the old shape. `fs_grep` the codebase for references to everything this migration drops or renames; a rename must land as add-new/backfill/drop-old across deploys, not as a single in-place rename. This is a contract break with the running system: never foldable, never rejectable. The exemption is genuine confirmation that nothing running references the old shape — a column already unreferenced for several releases, or a pre-first-deploy table; cite the evidence when you rely on it.
+
+### 2. 🟡 `[convention]` Irreversible migration without an explicit stated reason
+
+Does the migration destroy information — dropping a column with data, lossy type narrowing, collapsing values — such that no down-migration could restore it? Irreversible is sometimes the right call, but it must be a *stated* decision: a comment in the migration or an equivalent recorded note saying what is lost and why that is acceptable. Silent irreversibility is the finding; the reviewer after an incident should not have to discover it from the diff.
+
+### 3. 🟡 `[convention]` Index creation without concurrent/online mode on large tables
+
+Does the migration create an index on a table that is large or hot in production? Default index builds take locks that block writes for the duration of the build — on a big table that is a self-inflicted outage. Look for the engine's online path (concurrent/online index creation, e.g. `CREATE INDEX CONCURRENTLY` in Postgres, `ALGORITHM=INPLACE` in MySQL) and note that concurrent builds often cannot run inside a transaction — the migration tool may need its transaction wrapper disabled for that step. A genuinely small, cold, or brand-new table is exempt — say which and why.
+
+### 4. 🟡 `[convention]` Data backfill in the same transaction as DDL
+
+Does the migration mix a data backfill (UPDATE/INSERT over existing rows) into the same transaction as schema changes? A backfill over a large table holds the DDL's locks for the whole rewrite, blocks concurrent writes, and can bloat/timeout the transaction. The safe shape is: schema change in the migration, backfill as a separate batched step (separate migration, background job, or chunked script). A backfill over a provably tiny table can be exempt — state the size reasoning. How the backfill itself behaves under interruption and rerun is `transactional-integrity`'s question.
+
+### 5. 🟢 `[convention]` Missing down-migration where the tool supports it
+
+Does the migration tool in this repo support down/rollback scripts, and do sibling migrations provide them? Then a new migration without one is the finding — the first schema rollback should not be authored during the incident that needs it. Where the down-path is genuinely impossible (see item 2), the down script should say so explicitly rather than be omitted. Repos whose tooling or stated convention is forward-only are exempt; cite the convention.
+
+## Ground-truth discipline
+
+- `fs_grep` the application code for every column, table, and constraint this migration touches — the expand/contract question is answered by the code, not by the migration file.
+- READ sibling migrations for the house idioms (down-scripts, concurrent-index flags, backfill separation, naming) and cite a sibling at file:line when flagging deviation.
+- Check the migration tool's config for transaction-wrapping behavior before reasoning about what runs atomically — tools differ, and per-migration overrides matter.
+- Reason about table size honestly: if you cannot tell whether a table is large, say so and frame the finding conditionally rather than asserting an outage.
+
+## What this skill does NOT check
+
+- Whether backfill or migration-adjacent application code is idempotent, atomic, and safe under rerun/crash → `transactional-integrity`.
+- Whether schema changes expose sensitive data or weaken access controls in exploitable ways → `security-review`.
+- Log output of migration runs and its conventions → `logging-discipline`.
+- Metrics/alerts for migration execution and post-migration health → `observability-review`.

assets/skills/observability-review/SKILL.md

@@ -0,0 +1,72 @@
+---
+description: Post-implementation observability analysis - decide what monitoring, metrics, and alerts the just-implemented code needs, account for what already exists, and either produce concrete alert-as-code changes (routed through the normal implementation pipeline) or a structured recommendations block for the final report / PR description. Advisory by design - it always produces its artifact, never a blocking verdict. Load after implementing changes that add operational surface - new external endpoints, error paths, queues/jobs/crons, or notable state machines. Grants read-only filesystem access for stack detection and coverage inventory.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+Code was just implemented; you are deciding how anyone will know when it breaks. Logging (see `logging-discipline`) makes failures *inspectable*; this pass makes them *noticed* — metrics, alerts, dashboards. The output is always an artifact (code changes or a recommendations block), never a verdict: observability judgments (thresholds, paging severity) are ultimately human calls, so this lane informs and proposes rather than blocks.
+
+## When this pass applies
+
+The change adds **operational surface**: a new or changed external endpoint, a new error path or failure mode, a new queue consumer/producer, background job, or cron, a new external dependency, a notable state machine, or new metrics. If none of these — pure refactor, UI polish, docs, tests — skip with a one-line note. An observability pass on inert code is budget spent producing nothing.
+
+## Step 1: Detect the observability stack
+
+Establish what this repo HAS before proposing anything:
+
+1. **Metrics emission** — grep for the instrumentation the codebase already uses (a metrics client, OpenTelemetry, statsd-style calls, framework middleware). Note the naming convention of existing metrics.
+2. **Alert-as-code** — look for alert/monitor definitions living in the repo: rule files (e.g. Prometheus-style `*.rules.y*ml`), monitor/alert resources in infrastructure-as-code, `alerts/`/`monitoring/` directories, dashboard-as-code. THIS determines your output mode (Step 3).
+3. **Existing coverage inventory** — for the paths the change touches, find what already watches them: grep rule files and dashboards for the relevant metric names, service names, and log strings. An alert that already covers the new failure mode means UPDATE or NOTHING, not a duplicate.
+4. **Live-lookup hook (optional)** — if the caller configured an agent that can query the live monitoring stack, spawn it to verify the inventory ("what alerts currently cover <service/path>? current thresholds?") instead of trusting repo greps alone. The spawn prompt is that agent's whole context: name the services, metrics, and symptoms to look up, and state that it is read-only reconnaissance. If no such agent is configured, note that the inventory is repo-derived.
+
+## Step 2: Gap analysis
+
+For each new failure mode / operational surface in the change, walk the chain:
+
+1. **Is there a signal?** Does anything (metric, log line, built-in framework metric) even record this failing? No signal → no alert can exist; the first recommendation is the signal itself.
+2. **Is there detection on the signal?** An existing alert/monitor that would fire? Check semantics, not just existence — an endpoint-level 5xx alert may already cover your new handler; a queue-depth alert may NOT cover your new consumer's silent skip path.
+3. **Is the detection actionable?** Would it fire with enough context to triage (labels, runbook link), at the right urgency?
+
+Classify each gap: **covered** (existing signal + alert suffice), **update** (existing alert needs a label/threshold/scope change), **new** (nothing watches this), or **accepted-blind** (deliberately unwatched — say why, e.g. dev-only tooling).
+
+## Step 3: Produce the artifact (write vs recommend)
+
+The repo's alert-as-code situation decides:
+
+- **Alert-as-code lives in this repo** and the gap warrants coverage → produce the concrete rule/monitor changes (new rules, updated thresholds/labels/scopes) as ordinary code changes, following the existing rule files' conventions exactly. Route them through the caller's NORMAL implementation pipeline — same review gates as any code. An unreviewed alert is a false-page generator.
+- **Alerting lives outside the repo** (a UI-managed system, another team's repo), or the decision is judgment-heavy (paging severity, threshold without baseline data) → produce a structured **recommendations block** for the final report / PR description instead. Never attempt to modify external systems.
+
+Mixed outcomes are normal: write the mechanical rule update, recommend the judgment-heavy new pager.
+
+## Output format
+
+Always end with this block (it is the artifact the caller attaches to the report/PR):
+
+```
+## Observability
+
+Surface analyzed: <the operational surface this change adds, one line>
+Stack: <metrics lib / alert-as-code location or "external-only" / live inventory used: yes|no>
+
+Covered:
+- <failure mode> — covered by <existing alert/metric, path or name>
+
+Changes made (via the implementation pipeline):
+- <rule file:change> — <what and why>   (or "none")
+
+Recommendations (for humans to action):
+- <proposed alert> — signal: <metric/log>, condition: <threshold + rationale or "needs baseline data - start with X and tune">, urgency: <page|ticket>, runbook note: <one line>
+- <proposed metric/dashboard addition> — <why anyone would look at it>
+
+Accepted blind spots:
+- <what is deliberately unwatched and why>   (or "none")
+```
+
+For inapplicable changes the whole block collapses to: `## Observability` / `Not applicable: <one line>`.
+
+## Anti-patterns
+
+- **Alert spam.** Every alert costs attention forever. Page-worthy = a human must act NOW; everything else is a ticket or a dashboard. When in doubt, recommend ticket-urgency and say so.
+- **Invented thresholds.** A threshold with no baseline is a guess; either ground it in observed data (existing dashboards, load expectations stated in the change) or mark it explicitly as "start here, tune after N days".
+- **Duplicating existing coverage** because you only grepped for one spelling of the metric — inventory first, propose second.
+- **Metrics nobody will chart.** Each proposed metric names who would look at it and when. "Might be useful" is not a consumer.
+- **Blocking on this pass.** It is advisory: produce the artifact, attach it, move on. The only failure mode is skipping the pass on a change that added operational surface.
+- **Touching external alerting systems.** Recommendations only; live systems belong to humans and their change control.