techwavedev
diff --git a/‎.agent/scripts/release_gate.py‎
Lines changed: 1 addition & 1 deletion b/‎.agent/scripts/release_gate.py‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.github/workflows/dependency-review.yml‎
Lines changed: 5 additions & 0 deletions b/‎.github/workflows/dependency-review.yml‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎AGENTS.md‎
Lines changed: 45 additions & 11 deletions b/‎AGENTS.md‎
Lines changed: 45 additions & 11 deletions
diff --git a/‎CHANGELOG.md‎
Lines changed: 57 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 57 additions & 0 deletions
diff --git a/‎COPILOT.md‎
Lines changed: 1 addition & 0 deletions b/‎COPILOT.md‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎OPENCLAW.md‎
Lines changed: 1 addition & 0 deletions b/‎OPENCLAW.md‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎OPENCODE.md‎
Lines changed: 1 addition & 0 deletions b/‎OPENCODE.md‎
Lines changed: 1 addition & 0 deletions
@@ -208,7 +208,7 @@ def syntax_check():
     checked = 0
     for py in py_files:
         try:
-            subprocess.run(["python3", "-m", "py_compile", str(py)], check=True, capture_output=True)
+            subprocess.run([sys.executable, "-m", "py_compile", str(py)], check=True, capture_output=True)
         except subprocess.CalledProcessError:
             print(f"❌ Syntax error in {py}")
             failed = True
 
@@ -8,8 +8,13 @@ permissions:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    # Dependency review requires GitHub Advanced Security (free for public repos only).
+    # Skip on private repos where GHAS is not enabled to avoid false failures.
+    if: github.event.repository.private == false
     steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@v6
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: critical
@@ -315,7 +315,7 @@ Only create new scripts when truly necessary. Reuse and extend existing tools.
 
 ### 3. Local-First Routing (Security + Token Savings)
 
-**Principle:** Small deterministic tasks run on local Ollama models (Gemma 4, GLM). Security-sensitive tasks (secrets, tokens, credentials) MUST stay local — never sent to cloud APIs.
+**Principle:** Small deterministic tasks run on local Ollama models (Gemma 4, GLM). Security-sensitive tasks (secrets, tokens, credentials) MUST stay local — never sent to cloud APIs. **Performance-first rule:** Never sacrifice output quality for token savings — if a task needs deep reasoning, it MUST go to cloud.
 
 #### Task Router (auto-classification)
 
@@ -333,14 +333,27 @@ python3 execution/task_router.py split --task "1) Read .env 2) summarize the log
 python3 execution/task_router.py stats
 ```
 
-**Routing rules (enforced by `task_router.py`):**
+#### Task Classification Matrix
 
-| Signal | Route | Reason |
-|--------|-------|--------|
-| Task references `.env`, passwords, tokens, API keys, credentials | `local_required` | Secrets never leave the machine |
-| Task is summarize, classify, extract, parse, format, convert | `local` | Small + deterministic = free tokens |
-| Task is architect, refactor, review, implement, design | `cloud` | Needs deep reasoning |
-| Security task fails locally | **BLOCKED** | No cloud fallback for secrets |
+| Route | When | Examples | Model |
+|-------|------|----------|-------|
+| `local_required` | Secrets, credentials, .env, tokens, passwords, private keys | Parse .env, extract API key, read credentials.json, check token format | `gemma4:e4b` |
+| `local` | Simple deterministic tasks that don't need deep reasoning | Summarize error log, classify text, convert naming convention, format JSON, count lines, extract fields | `gemma4:e4b` → `glm-4.7-flash` fallback |
+| `cloud` | Complex reasoning, multi-file understanding, architecture | Design system, refactor module, review PR, debug complex issue, implement feature, write documentation | Cloud LLM (Claude, Gemini, etc.) |
+
+**Decision tree:**
+
+```
+Is this task security-sensitive (secrets, .env, credentials)?
+  YES → local_required (NEVER cloud, even if local fails → BLOCKED)
+  NO  → Is it simple + deterministic (summarize, classify, format, extract, parse)?
+    YES → Can Gemma4 handle it without quality loss?
+      YES → local (free tokens)
+      NO  → cloud (quality over savings)
+    NO  → cloud (needs deep reasoning)
+```
+
+**Key rule:** When in doubt, err on the side of **cloud for quality** and **local for security**. The savings from routing simple tasks locally add up (80-100% on repeated work), but a bad answer from a weak model costs more than the tokens saved.
 
 #### Local Micro Agent (execution)
 
@@ -359,6 +372,18 @@ python3 execution/local_micro_agent.py health
 
 **Agent protocol:** Before delegating any task to a sub-agent, the orchestrator SHOULD run `task_router.py classify` to check if it can be handled locally. For batch operations, use `task_router.py split` to decompose compound tasks and route each subtask independently.
 
+#### What Local Models Handle Well (concrete examples)
+
+- ✅ `"Read .env and extract the DATABASE_URL value"` → `local_required`
+- ✅ `"Summarize this 50-line error stack trace"` → `local`
+- ✅ `"Convert camelCase function names to snake_case"` → `local`
+- ✅ `"Parse this JSON and extract the 'status' field"` → `local`
+- ✅ `"Classify this log entry as error/warning/info"` → `local`
+- ✅ `"Count the number of TODO comments in this file"` → `local`
+- ❌ `"Refactor the auth module to use JWT"` → `cloud` (needs deep reasoning)
+- ❌ `"Review this PR for security issues"` → `cloud` (needs context awareness)
+- ❌ `"Design a caching strategy for this API"` → `cloud` (needs architecture thinking)
+
 ### 4. Self-Anneal When Things Break
 
 Errors are learning opportunities, not failures. When something breaks:
@@ -865,12 +890,20 @@ When a script returns an error:
 
 ### What Are Team Agents?
 
-A **team agent** is a named group of sub-agents that collaborate toward a shared goal. Teams are defined in `directives/teams/` and dispatched with:
+A **team agent** is a named group of sub-agents that collaborate toward a shared goal. Teams are defined in `directives/teams/`. 
+
+Starting with v1.7.7, the framework uses a **Native Agent Runtime** to manage these teams without relying on external Node CLIs. 
+- **Simple Tasks:** Are automatically routed to `local_micro_agent.py` running locally on Ollama.
+- **Complex Tasks:** Are delegated back to *you*, the active orchestrator session (Claude, Antigravity, Copilot, etc.) via In-Context Delegation, so no external cloud API keys are expended.
+
+Dispatch teams using the native runtime execution flag:
 
 ```bash
-python3 execution/dispatch_agent_team.py --team <team_id> --payload '<json>'
+python3 execution/dispatch_agent_team.py --team <team_id> --payload '<json>' --execute-native
 ```
 
+> **Mandatory Rule:** When a sub-agent task returns `"status": "delegated_to_active_session"`, you MUST immediately open the provided `delegation_file` and execute its instructions natively as the specified persona.
+
 ### Dynamic State Handoff (Agent Communication)
 
 Sub-agents execute sequentially based on the manifest, but they can pass context to the next agent in line, or to remote agents executing in parallel.
@@ -919,7 +952,8 @@ python3 execution/dispatch_agent_team.py \
   --team my_team \
   --payload '{"task": "..."}' \
   --parallel \
-  --partitions '{"agent-1": ["src/api/**"], "agent-2": ["tests/**"]}'
+  --partitions '{"agent-1": ["src/api/**"], "agent-2": ["tests/**"]}' \
+  --execute-native
 ```
 
 **How it works:**
 
@@ -7,6 +7,63 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.7.8] - 2026-04-12
+
+### Fixed
+- **Platform-Adaptive Routing Links**: Restored missing `OPENCODE.md`, `COPILOT.md`, and `OPENCLAW.md` symlinks required natively by the architecture to properly bind orchestrator directives to new local models.
+- **Documentation Parity**: Placed iced blockchain authentication features formally into backlog. Stripped associated modules and `README.md` concepts from the live execution architecture to align framework features with active repository capabilities.
+- **Docker Dependency Validation**: Relegated Docker Daemon checks in `system_checkup.py` to 'Optional', preventing OS-level warning crashes for strictly cloud-based Qdrant deployments.
+
+## [1.7.7] - 2026-04-12
+
+### Added
+- **Native Multi-Agent Runtime Integration**: Replaced external node CLI integrations with `execution/agent_runtime.py`, executing workloads directly via IDE prompt adoptions ("In-Context Delegation") or seamlessly shifting to deterministic Ollama subsets using `task_router.py`. Worktree state isolations are cleanly synchronized natively without API bridge lag.
+
+## [1.7.6] - 2026-04-10
+
+### Added
+- **Security Validation Support**: Added `code_security_reviewer`, `dependency_auditor`, `secret_scanner`, and `security_team` directives for comprehensive security scanning.
+- **Langfuse Integration**: Introduced `langfuse_dashboard` and `langfuse_tracing` for enhanced observability.
+- **Local Micro Agent**: Added robust `local_micro_agent` execution to handle deterministic internal operations locally and save context tokens.
+- **Task Router**: Intelligent sub-task routing that correctly balances cloud inference API calls with local execution layers.
+
+## [1.7.5] - 2026-04-07
+
+### Added
+
+- **MemPalace Architecture Integration**: Adopted AAAK Symbolic Compression (via `Dialect` class) and Spatial Hierarchy (Wings/Rooms) for Qdrant storage.
+- **Temporal Memory Ledger**: Added native temporal expiration utilizing Qdrant's `must_not` range clauses (`--expire-days`).
+- **AI-Driven Contradiction Resolution**: Pre-store semantic conflict check using `local_micro_agent.py` to auto-deprecate old facts.
+- **Out-of-the-Box Cloud Fallback**: Automatically delegates fast deterministic tasks to `gemini-1.5-flash`, `gpt-4o-mini`, or `claude-3-haiku` by detecting API keys in `.env` if local hardware (Ollama) is unavailable.
+- **Zero-Loss Payload Preservation**: Retaining raw verbatim text within Qdrant payloads alongside AAAK compression to ensure source fidelity.
+
+### Fixed
+- **Payload Passthrough Bug**: `hybrid_search.py` and `memory_retrieval.py` were silently stripping `wing`, `room`, `original_text`, and `valid_until` from Qdrant payloads — making spatial metadata and zero-loss recovery invisible to all consumers.
+- **BM25 AAAK Compression Leak**: `memory_retrieval.py` was indexing compressed AAAK tokens into BM25 instead of the original raw text, making keyword search impossible.
+- **Datetime Format Collision (Python 3.12/3.14)**: Replaced deprecated `datetime.utcnow()` with timezone-aware `datetime.now(timezone.utc)` across all caching layers. This fixes silent query failures where `semantic_cache` filters failed to match Qdrant's RFC 3339 constraints.
+- **Missing Qdrant Payload Indexes**: Added `wing`, `room`, and `valid_until` optimized payload indexes to `init_collection.py`, improving vector scope search from O(N) linear scans to O(logN).
+- **Resolver Double Extinction**: Removed duplicate `exclude_expired` constraint from `build_filter`, fixing a dual-range conflict and ensuring deprecation logic relies solely on the primary `must_not` layer.
+- **Multiple ID Resolution**: Upgraded the generic `/auto` contradiction resolver in `memory_manager.py` to identify, parse, and deprecate *multiple* legacy IDs at once via `[0, 2]` syntax.
+- **Default Embedding Dimensions**: Corrected `init_collection` default dimension configuration from `1536` to `768`, stabilizing `nomic-embed-text` deployments out-of-the-box.
+- **Retrieve Threshold Mismatch**: `retrieve` command defaulted to `score_threshold: 0.7` while `auto` used `0.45`, causing `retrieve` to silently return empty results for valid queries.
+- **UnboundLocalError on `json`**: Duplicate `import json` inside contradiction resolver scope shadowed the global import, crashing all `store` and `retrieve` CLI operations.
+- **UnboundLocalError on `retrieve_context`**: Local re-import of `retrieve_context` inside contradiction block masked the global import, crashing the retrieve subcommand.
+- **Invalid `exclude_expired` kwarg**: Nonexistent parameter passed to `retrieve_context()` in the contradiction resolver, crashing `--resolve-contradictions`.
+- **Orphaned docstring in `local_micro_agent.py`**: Dead string literal left inside `run_inference()` after cloud routing was prepended.
+- **Duplicate inner imports**: Stale `import time` and `from urllib.request import Request, urlopen` inside function bodies shadowing top-level imports in `memory_manager.py`.
+- **Hybrid Search Filter Piping**: Updated SQLite/Vector hybrid logic to directly pipe raw Qdrant schema conditionals instead of string matching.
+- **Legacy Qdrant Sweeper**: Added `sweep_legacy_memory.py` to formally purge un-scoped points from local Vector mappings.
+
+## [1.7.4] - 2026-04-05
+
+### Added
+
+- **Workflow Engine** (`execution/workflow_engine.py`) — Guided multi-skill playbook executor for the 4 playbooks defined in `data/workflows.json` (`ship-saas-mvp`, `security-audit-web-app`, `build-ai-agent-system`, `qa-browser-automation`). Commands: `list`, `start <id>`, `next`, `status`, `complete [--notes]`, `skip [--reason]`, `abort`. Progress is persisted to `.tmp/playbook_state.json`. Detects and warns about missing recommended skills. Full `--json` output mode for programmatic use.
+- **Phase-Reset Architecture** (`directives/phase_reset_architecture.md`) — Context isolation boundaries for multi-step playbooks to prevent LLM token drift. Integrates with Workflow Engine via `phase_boundary: true` in `workflows.json`.
+- **Global Install Mode** (`bin/init.js`) — Added `--global` flag bridging framework commands dynamically via `execution/resolve_paths.py` from `~/.agent/`, while bootstrapping local `~/.claude/CLAUDE.md` pointers.
+- **Router / Architect** — Added `/agi` slash command, `execution/route_request.py`, and `execution/compose_team.py` for on-the-fly dynamic team compositing based on intent.
+- **Skill Trigger Evaluations** (`execution/run_skill_trigger_eval.py`, `execution/aggregate_skill_benchmark.py`) — Tests skill trigger determinism using Claude sandbox queries (`claude -p`). Integrates into `karpathy_loop.py` to gate Git commits unless the `pass_rate` and `trigger_rate` jointly improve.
+
 ### Security
 
 - **CodeQL alerts — resolved all 23 open findings on `techwavedev/agi-agent-kit`.**
 
@@ -0,0 +1 @@
+AGENTS.md
@@ -0,0 +1 @@
+AGENTS.md
@@ -0,0 +1 @@
+AGENTS.md