From 92acd23379be349e42a718197c860cf99260b037 Mon Sep 17 00:00:00 2001
From: obasilakis <vasileios.georgopoulos@gmail.com>
Date: Mon, 27 Jul 2026 15:23:44 +0300
Subject: [PATCH 01/25] fix(ui): stop the nav controls overlapping the
 Enterprise link (#1789) (#1802)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

NavBar is one `flex justify-between` row with two children. Neither set
`min-w-0`, and a flex item defaults to `min-width: auto` — so once logo +
links + controls exceeded the `max-w-7xl` cap the clusters stopped
compressing and overflowed into each other, which `justify-between`
parked mid-bar: the connection indicator landed on top of `Enterprise
PRO`, and the PRO badge and version chip wrapped inside a fixed 64px bar.

Because the container is capped at 1280px, a wider monitor never helped —
measured 28px of overlap at every width from 1280 to 1920. Below ~1180px
it was worse than cosmetic: the controls ran to x≈1170 while
`documentElement.scrollWidth` stayed at the viewport width, so at 1024px
and narrower the theme toggle and the user menu — the only route to Sign
out — were unreachable (`elementFromPoint` at the avatar returned null).

The trigger is link count: entitled builds render `Sessions` and
`Enterprise` on top of the five OSS links, pushing the row past the cap.

- `min-w-0` on the link cluster so it can actually shrink, and
  `overflow-x-auto` so an over-wide link set scrolls instead of spilling
  over the controls; links get `flex-shrink-0 whitespace-nowrap` so they
  keep their natural width and the PRO badge can't wrap.
- `flex-shrink-0` on the control cluster — docs, theme and the user menu
  are never compressed or pushed off-screen; the link row absorbs the
  pressure instead.
- Reclaim the ~150px that keeps a 7-link entitled build scroll-free at the
  capped width: link gaps tighten below `xl`, the version chip hides below
  `xl` (same data is in the Build Info modal and Settings), and the
  connection status becomes dot-only with a tooltip + sr-only label,
  pulsing when disconnected.
- `gap-4` between clusters so a clipped link never butts the status dot.

Verified against a live stack at 1920/1600/1440/1366/1280/1180/1024/900/
768/640: zero link-vs-control overlap, controls fully on-screen and
hit-testable, bar stays 64px, and no scrolling at 1024 and above.

Closes #1789
---
 src/frontend/e2e/navbar-overflow.spec.js | 150 +++++++++++++++++++++++
 src/frontend/src/components/NavBar.vue   |  84 ++++++++++---
 2 files changed, 217 insertions(+), 17 deletions(-)
 create mode 100644 src/frontend/e2e/navbar-overflow.spec.js

diff --git a/src/frontend/e2e/navbar-overflow.spec.js b/src/frontend/e2e/navbar-overflow.spec.js
new file mode 100644
index 000000000..57d7efaa6
--- /dev/null
+++ b/src/frontend/e2e/navbar-overflow.spec.js
@@ -0,0 +1,150 @@
+import { test, expect } from '@playwright/test'
+
+/**
+ * Top nav overflow (#1789).
+ *
+ * NavBar.vue is one `flex justify-between` row with two children: the logo +
+ * router-link row on the left, the controls (connection dot, version chip,
+ * docs, theme toggle, user menu) on the right. Neither child used to set
+ * `min-w-0`, and a flex item defaults to `min-width: auto` — so once the two
+ * clusters' natural widths exceeded the `max-w-7xl` cap they stopped
+ * compressing and overflowed INTO each other, which `justify-between` parked
+ * in the middle of the bar. On an entitled build (7 links, `Sessions` +
+ * `Enterprise` both present) that put the connection indicator on top of the
+ * `Enterprise PRO` link at EVERY viewport width, and below ~1180px it pushed
+ * the theme toggle and the user menu — the only route to Sign out — past the
+ * viewport edge with no horizontal scroll to recover them.
+ *
+ * These tests pin the three properties the fix guarantees, none of which
+ * depend on how many links the build renders:
+ *   1. no link ever visually collides with a control,
+ *   2. the controls stay fully on-screen and hit-testable,
+ *   3. links that don't fit stay reachable via a scroll container rather than
+ *      being clipped dead or overlapping.
+ *
+ * Widths ≥1280 are the entitled-build regression (the container is capped at
+ * `max-w-7xl`, so "just use a wider monitor" never fixed it); the narrow
+ * widths keep the spec meaningful on an OSS build too, where 5 links only
+ * exhaust the bar once the viewport is small.
+ */
+
+// Viewports: the two laptop widths where the bug was worst, the cap boundary,
+// and down to the `sm` breakpoint where the link row first appears.
+const WIDTHS = [1920, 1600, 1440, 1366, 1280, 1180, 1024, 900, 768, 640]
+
+// Geometry of the nav, measured the way a user perceives it: link boxes are
+// clipped to the scroll row's visible box first, because a link scrolled past
+// the boundary still reports full un-clipped `getBoundingClientRect()`
+// geometry while being invisible on screen.
+async function navGeometry(page) {
+  return page.evaluate(() => {
+    const row = document.querySelector('nav .flex.justify-between')
+    const [left, right] = row.children
+    const linkRow = left.children[1]
+    const clip = linkRow.getBoundingClientRect()
+
+    const controls = [...right.children].map((c) => c.getBoundingClientRect())
+    let worstCollision = 0
+    for (const raw of left.querySelectorAll('a')) {
+      const b = raw.getBoundingClientRect()
+      const l = Math.max(b.left, clip.left)
+      const r = Math.min(b.right, clip.right)
+      if (r <= l) continue // fully scrolled out of view
+      for (const c of controls) {
+        worstCollision = Math.max(worstCollision, Math.min(r, c.right) - Math.max(l, c.left))
+      }
+    }
+
+    const menu = right.lastElementChild
+    const menuBox = menu.getBoundingClientRect()
+    const hit = document.elementFromPoint(
+      menuBox.left + menuBox.width / 2,
+      menuBox.top + menuBox.height / 2
+    )
+
+    return {
+      worstCollision: Math.max(0, worstCollision),
+      controlsRightEdge: Math.max(...controls.map((c) => c.right)),
+      controlsLeftEdge: Math.min(...controls.map((c) => c.left)),
+      userMenuHitTestable: !!(hit && menu.contains(hit)),
+      navHeight: row.getBoundingClientRect().height,
+      linkRowOverflowX: getComputedStyle(linkRow).overflowX,
+      linkRowScrollWidth: linkRow.scrollWidth,
+      linkRowClientWidth: linkRow.clientWidth,
+      linkCount: left.querySelectorAll('a').length,
+    }
+  })
+}
+
+test.describe('NavBar overflow (#1789)', () => {
+  test('@smoke nav links never collide with the right-hand controls', async ({ page }) => {
+    await page.goto('/')
+    await expect(page.getByRole('link', { name: 'Dashboard', exact: true })).toBeVisible({
+      timeout: 15000,
+    })
+
+    for (const width of WIDTHS) {
+      await page.setViewportSize({ width, height: 900 })
+      const g = await navGeometry(page)
+
+      // The regression itself: a visible link box overlapping a control box.
+      expect(g.worstCollision, `link/control overlap at ${width}px`).toBe(0)
+
+      // The bar must not grow a second line — the pre-fix symptom was the
+      // `PRO` badge and version chip wrapping inside a fixed 64px bar.
+      expect(g.navHeight, `nav height at ${width}px`).toBe(64)
+    }
+  })
+
+  test('@smoke controls stay on-screen and clickable at every width', async ({ page }) => {
+    await page.goto('/')
+    await expect(page.getByRole('link', { name: 'Dashboard', exact: true })).toBeVisible({
+      timeout: 15000,
+    })
+
+    for (const width of WIDTHS) {
+      await page.setViewportSize({ width, height: 900 })
+      const g = await navGeometry(page)
+
+      // Pre-fix the cluster ran to x≈1170 regardless of viewport, and
+      // documentElement.scrollWidth stayed at the viewport width — so the
+      // overhang was unreachable rather than merely off to the side.
+      expect(g.controlsRightEdge, `controls right edge at ${width}px`).toBeLessThanOrEqual(width)
+      expect(g.controlsLeftEdge, `controls left edge at ${width}px`).toBeGreaterThanOrEqual(0)
+
+      // The user menu owns Sign out. `elementFromPoint` at its centre is the
+      // honest check — a box inside the viewport that something else covers
+      // is still not clickable.
+      expect(g.userMenuHitTestable, `user menu hit-testable at ${width}px`).toBe(true)
+    }
+
+    // And it genuinely opens at the width where it used to be unreachable.
+    await page.setViewportSize({ width: 900, height: 900 })
+    await page.locator('nav .flex.justify-between > div:last-child > div:last-child button').click()
+    await expect(page.getByRole('button', { name: /sign out/i })).toBeVisible({ timeout: 5000 })
+  })
+
+  test('@smoke overflowing links stay reachable via the scroll row', async ({ page }) => {
+    await page.goto('/')
+    await expect(page.getByRole('link', { name: 'Dashboard', exact: true })).toBeVisible({
+      timeout: 15000,
+    })
+
+    // The mechanism that replaces overlap: the link row is a scroll container,
+    // so a link set too wide for the bar scrolls instead of spilling over the
+    // controls. Guards against a future refactor dropping `overflow-x-auto`.
+    await page.setViewportSize({ width: 1440, height: 900 })
+    const wide = await navGeometry(page)
+    expect(wide.linkRowOverflowX).toBe('auto')
+
+    // Squeeze until the row must overflow, then prove the last link can be
+    // brought into view — clipped-but-scrollable, not clipped-dead.
+    await page.setViewportSize({ width: 640, height: 900 })
+    const narrow = await navGeometry(page)
+    expect(narrow.linkRowScrollWidth).toBeGreaterThan(narrow.linkRowClientWidth)
+
+    const lastLink = page.locator('nav .flex.justify-between > div:first-child > div:last-child a').last()
+    await lastLink.scrollIntoViewIfNeeded()
+    await expect(lastLink).toBeInViewport()
+  })
+})
diff --git a/src/frontend/src/components/NavBar.vue b/src/frontend/src/components/NavBar.vue
index cbd781d67..07bd4f88d 100644
--- a/src/frontend/src/components/NavBar.vue
+++ b/src/frontend/src/components/NavBar.vue
@@ -1,31 +1,45 @@
 <template>
   <nav class="bg-white dark:bg-gray-800 shadow dark:shadow-gray-900">
     <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
-      <div class="flex justify-between h-16">
-        <div class="flex">
+      <!-- #1789 — `gap-4` guarantees breathing room between the two clusters at
+           the width where they finally meet, so a link clipped by the scroll
+           boundary never butts up against the connection dot. -->
+      <div class="flex justify-between h-16 gap-4">
+        <!-- #1789 — `min-w-0` is load-bearing. A flex item defaults to
+             `min-width: auto`, so without it this cluster cannot shrink below
+             its min-content width: once logo + links + the right-hand controls
+             exceed the `max-w-7xl` cap the two clusters stop compressing and
+             overflow INTO each other, which `justify-between` parks in the
+             middle of the bar (Connected landing on top of Enterprise PRO). -->
+        <div class="flex min-w-0">
           <router-link to="/" class="flex-shrink-0 flex items-center hover:opacity-80 transition-opacity">
             <img src="../assets/trinity-logo.svg" alt="Trinity Logo" class="h-8 w-8 mr-2 dark:hidden" />
             <img src="../assets/trinity-logo-white.svg" alt="Trinity Logo" class="h-8 w-8 mr-2 hidden dark:block" />
             <h1 class="text-xl font-bold text-gray-900 dark:text-white">Trinity</h1>
           </router-link>
-          <div class="hidden sm:ml-6 sm:flex sm:space-x-8">
+          <!-- #1789 — the link row is the elastic side: it scrolls when the
+               full set can't fit, so every link stays reachable instead of
+               being clipped or overlapping the controls. Gaps tighten below
+               `xl` to buy the ~150px that keeps a 7-link entitled build
+               scroll-free at the capped container width. -->
+          <div class="hidden sm:ml-6 sm:flex sm:space-x-3 xl:space-x-6 min-w-0 overflow-x-auto nav-links-scroll">
             <router-link
               to="/"
-              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex items-center px-1 pt-1 border-b-2 text-sm font-medium"
+              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex flex-shrink-0 whitespace-nowrap items-center px-1 pt-1 border-b-2 text-sm font-medium"
               :class="{ 'border-blue-500 dark:border-blue-400 text-gray-900 dark:text-white': $route.path === '/' }"
             >
               Dashboard
             </router-link>
             <router-link
               to="/agents"
-              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex items-center px-1 pt-1 border-b-2 text-sm font-medium"
+              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex flex-shrink-0 whitespace-nowrap items-center px-1 pt-1 border-b-2 text-sm font-medium"
               :class="{ 'border-blue-500 dark:border-blue-400 text-gray-900 dark:text-white': isAgentSection }"
             >
               Agents
             </router-link>
             <router-link
               to="/templates"
-              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex items-center px-1 pt-1 border-b-2 text-sm font-medium"
+              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex flex-shrink-0 whitespace-nowrap items-center px-1 pt-1 border-b-2 text-sm font-medium"
               :class="{ 'border-blue-500 dark:border-blue-400 text-gray-900 dark:text-white': $route.path === '/templates' }"
             >
               Templates
@@ -36,7 +50,7 @@
                  running-execution count lives inside the Executions tab. -->
             <router-link
               to="/operations"
-              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex items-center px-1 pt-1 border-b-2 text-sm font-medium relative"
+              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex flex-shrink-0 whitespace-nowrap items-center px-1 pt-1 border-b-2 text-sm font-medium relative"
               :class="{ 'border-blue-500 dark:border-blue-400 text-gray-900 dark:text-white': $route.path === '/operations' }"
             >
               Operations
@@ -57,7 +71,7 @@
             -->
             <router-link
               to="/settings"
-              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex items-center px-1 pt-1 border-b-2 text-sm font-medium"
+              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex flex-shrink-0 whitespace-nowrap items-center px-1 pt-1 border-b-2 text-sm font-medium"
               :class="{ 'border-blue-500 dark:border-blue-400 text-gray-900 dark:text-white': $route.path === '/settings' }"
             >
               Settings
@@ -77,7 +91,7 @@
             <router-link
               v-if="enterpriseStore.isEntitled('shared_sessions')"
               to="/sessions"
-              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex items-center px-1 pt-1 border-b-2 text-sm font-medium"
+              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex flex-shrink-0 whitespace-nowrap items-center px-1 pt-1 border-b-2 text-sm font-medium"
               :class="{ 'border-blue-500 dark:border-blue-400 text-gray-900 dark:text-white': $route.path.startsWith('/sessions') }"
             >
               Sessions
@@ -85,7 +99,7 @@
             <router-link
               v-if="enterpriseStore.hasAnyEnterprise"
               to="/enterprise"
-              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex items-center px-1 pt-1 border-b-2 text-sm font-medium"
+              class="border-transparent text-gray-500 dark:text-gray-400 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-700 dark:hover:text-gray-200 inline-flex flex-shrink-0 whitespace-nowrap items-center px-1 pt-1 border-b-2 text-sm font-medium"
               :class="{ 'border-blue-500 dark:border-blue-400 text-gray-900 dark:text-white': $route.path.startsWith('/enterprise') }"
             >
               Enterprise
@@ -93,18 +107,34 @@
             </router-link>
           </div>
         </div>
-        <div class="flex items-center space-x-4">
-          <!-- WebSocket Status -->
-          <span class="text-sm text-gray-500 dark:text-gray-400">
-            <span class="inline-block h-2 w-2 rounded-full mr-1" :class="isConnected ? 'bg-status-success-400' : 'bg-gray-400 dark:bg-gray-600'"></span>
-            {{ isConnected ? 'Connected' : 'Disconnected' }}
+        <!-- #1789 — `flex-shrink-0`: these are the bar's controls (docs, theme,
+             and the user menu that owns Sign out). They must never be
+             compressed or pushed past the viewport edge, so the link row above
+             absorbs all the width pressure instead. -->
+        <div class="flex flex-shrink-0 items-center space-x-4">
+          <!-- WebSocket Status — dot only (#1789). The word cost ~80px of a
+               budget the bar does not have at the `max-w-7xl` cap; the state is
+               conveyed by colour, a tooltip, and the sr-only label, and a lost
+               connection additionally pulses. -->
+          <span
+            class="flex items-center text-sm text-gray-500 dark:text-gray-400"
+            :title="isConnected ? 'Connected' : 'Disconnected'"
+          >
+            <span
+              class="inline-block h-2 w-2 rounded-full"
+              :class="isConnected ? 'bg-status-success-400' : 'bg-status-warning-500 animate-pulse'"
+            ></span>
+            <span class="sr-only">{{ isConnected ? 'Connected' : 'Disconnected' }}</span>
           </span>
 
-          <!-- Build Info Chip (#926) — small muted version label; click opens detail modal -->
+          <!-- Build Info Chip (#926) — small muted version label; click opens detail modal.
+               Hidden below `xl` (#1789) — it is the widest non-interactive item in
+               the bar and the same data is one click away in the Build Info modal
+               and on Settings. -->
           <button
             v-if="buildInfo.info.value"
             @click="showBuildInfoModal = true"
-            class="text-xs text-gray-400 dark:text-gray-500 hover:text-gray-600 dark:hover:text-gray-300 font-mono"
+            class="hidden xl:block text-xs text-gray-400 dark:text-gray-500 hover:text-gray-600 dark:hover:text-gray-300 font-mono whitespace-nowrap"
             :title="`Click for build info — commit ${buildInfo.info.value.git_commit_short}`"
           >
             v{{ buildInfo.displayVersion.value }}<span
@@ -432,3 +462,23 @@ const handleLogout = () => {
   router.push('/login')
 }
 </script>
+
+<style scoped>
+/*
+ * #1789 — the nav link row is an `overflow-x-auto` container so an
+ * over-wide link set scrolls instead of overlapping the controls. A
+ * classic scrollbar inside a 64px bar would eat vertical space and sit
+ * under the active-link underline, so the gutter is suppressed. The row
+ * remains scrollable by wheel, trackpad, touch, and keyboard focus
+ * (focusing an off-screen link scrolls it into view) — the affordance is
+ * hidden, not the capability.
+ */
+.nav-links-scroll {
+  scrollbar-width: none; /* Firefox */
+  -ms-overflow-style: none; /* legacy Edge */
+}
+
+.nav-links-scroll::-webkit-scrollbar {
+  display: none; /* Chromium, WebKit */
+}
+</style>

From 0fb07beca3e0dd9593e1c86ecdef2a4d6253ee32 Mon Sep 17 00:00:00 2001
From: obasilakis <vasileios.georgopoulos@gmail.com>
Date: Mon, 27 Jul 2026 15:24:36 +0300
Subject: [PATCH 02/25] fix(compose): restore Vector log writes and unbreak
 prod compose validation (#1799) (#1801)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two independent compose defects, both silent, both found while diagnosing a
Docker daemon wedge caused by a full disk.

1. Vector has discarded ALL log output since #1478 (v0.8.0)

   #1478 chowns /data/logs to 1000:1000 (chmod 775) so the UID-1000 backend's
   retention sweep can delete archived originals. But the vector service runs
   as root with cap_drop: ALL, which strips CAP_DAC_OVERRIDE — the capability
   that lets root ignore file permissions. Root is neither the owner (1000)
   nor in the group (1000), so it falls through to "other" (r-x) on a 775 dir
   and every sink write fails:

     ERROR sink{component_id=local_logs component_type=file}:
       Unable to open the file. path=b"/data/logs/local-2026-07-27.json"
       error=Permission denied (os error 13)

   This is silent because a file-sink error does not fail Vector's healthcheck,
   which only probes the :8686 API — the container reports healthy while
   writing nothing. On the instance where this was found, /data/logs had no new
   files between 2026-07-09 and 2026-07-27.

   Fixed with group_add: ["1000"], which uses the directory's existing
   group-write bit rather than restoring a capability, so the cap_drop posture
   is preserved. Vector must stay root for the uid: raw container logs under
   /var/lib/docker/containers are 0640 root:root, so user: "1000:1000" would
   swap a write failure for a read failure.

2. docker-compose.prod.yml failed schema validation and hid a conflicting
   retention default

   backend.environment is a YAML list, and two separate #1039-class "mirror
   docker-compose.yml" fixes each appended the same LOG_* trio. That broke the
   file two different ways:

   - LOG_ARCHIVE_ENABLED and LOG_CLEANUP_HOUR were byte-identical across both
     blocks. Compose requires array items to be unique, so the file did not
     parse at all:
       validating docker-compose.prod.yml:
         services.backend.environment array items[67,112] must be unique

   - LOG_RETENTION_DAYS was duplicated with a DIFFERENT value (5 vs 90).
     Differing strings are not caught by the uniqueness check, so deduping only
     the identical pair would fix the parse error and leave this in place.
     Docker resolves a repeated env key by last-wins, so prod would silently
     run 90 while its own earlier block, docker-compose.yml, and config.py
     (COMMUNITY_RETENTION_FLOOR_DAYS = 5) all say 5.

   The conflict direction keeps 18x more rather than deleting early, so unlike
   #1638 this is a disk-growth bug, not data loss — but log_archive_service
   only deletes originals older than the window, making it a large contributor
   to unbounded growth.

   Removed the later duplicate block; kept the one matching docker-compose.yml
   and the code default, folding its LOG_ARCHIVE_PATH rationale into the
   survivor.

Compose-only: no schema change, no migration, no code change, no new config
surface. Existing deployments pick up the Vector fix on the next
docker compose up -d (its service config changed, so it is recreated).

Verification:
  docker compose -f docker-compose.yml      config  -> VALID
  docker compose -f docker-compose.prod.yml config  -> VALID (was: parse error)
  both resolve vector.group_add=['1000'], cap_drop=['ALL'], user=root
  both resolve backend LOG_RETENTION_DAYS=5 (prod was silently 90)
  live: 0 permission errors, /data/logs writing again after 18 days silent

Closes #1799
---
 docker-compose.prod.yml | 39 +++++++++++++++++++++++++++++++--------
 docker-compose.yml      | 15 +++++++++++++++
 2 files changed, 46 insertions(+), 8 deletions(-)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 70681f838..b6efd1b1f 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -131,6 +131,9 @@ services:
       # merge), so an operator-set LOG_RETENTION_DAYS never reached the
       # container and retention silently fell back to the code default. Default
       # is the 5-day community floor; enterprise `retention` unlocks longer.
+      # LOG_ARCHIVE_PATH is intentionally omitted: the code default
+      # (/data/archives) already lands in the TRINITY_DATA_PATH bind mount
+      # (/data), so no new volume is needed.
       - LOG_RETENTION_DAYS=${LOG_RETENTION_DAYS:-5}
       - LOG_ARCHIVE_ENABLED=${LOG_ARCHIVE_ENABLED:-true}
       - LOG_CLEANUP_HOUR=${LOG_CLEANUP_HOUR:-3}
@@ -248,14 +251,19 @@ services:
       # docker-compose.yml; without this line the .env value is inert in prod (the
       # #1039 packaging-gap class) and SSH host detection falls back to localhost.
       - SSH_HOST=${SSH_HOST:-}
-      # Log retention & archival (services/log_archive_service.py). Mirrors
-      # docker-compose.yml; without these lines the .env knobs are inert in prod
-      # (the #1039 packaging-gap class). LOG_ARCHIVE_PATH is intentionally omitted:
-      # the code default (/data/archives) already lands in the TRINITY_DATA_PATH
-      # bind mount (/data), so no new volume is needed.
-      - LOG_ARCHIVE_ENABLED=${LOG_ARCHIVE_ENABLED:-true}
-      - LOG_RETENTION_DAYS=${LOG_RETENTION_DAYS:-90}
-      - LOG_CLEANUP_HOUR=${LOG_CLEANUP_HOUR:-3}
+      # NOTE (#1799): a duplicate LOG_ARCHIVE_ENABLED / LOG_RETENTION_DAYS /
+      # LOG_CLEANUP_HOUR trio lived here. Two separate #1039-class "mirror
+      # docker-compose.yml" fixes each appended the same three vars, which broke
+      # this file two different ways:
+      #   * LOG_ARCHIVE_ENABLED and LOG_CLEANUP_HOUR were byte-identical in both
+      #     blocks, and Compose requires array items to be unique — so
+      #     `docker compose -f docker-compose.prod.yml config` failed outright.
+      #   * LOG_RETENTION_DAYS was duplicated with a DIFFERENT value (5 vs 90).
+      #     Differing strings are not caught by the uniqueness check, and Docker
+      #     resolves a repeated env key by last-wins — so prod would silently run
+      #     90 while this file's own block above, docker-compose.yml, and
+      #     config.py (COMMUNITY_RETENTION_FLOOR_DAYS = 5) all say 5.
+      # Resolved in favour of the block above; keep the LOG_* trio defined ONCE.
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./config/agent-templates:/agent-configs/templates:ro
@@ -517,6 +525,21 @@ services:
       - no-new-privileges:true
     cap_drop:
       - ALL
+    # #1799: #1478 chowns /data/logs to 1000:1000 (chmod 775) so the UID-1000
+    # backend's retention sweep can delete archived originals. Vector runs as
+    # root, but cap_drop: ALL strips CAP_DAC_OVERRIDE — the capability that lets
+    # root ignore file permissions — so root is neither owner nor group and
+    # falls through to "other" (r-x) on that 775 dir. EVERY sink write then
+    # fails with "Permission denied", silently: a file-sink error does not fail
+    # the :8686 healthcheck, so Vector reports healthy while writing nothing.
+    #
+    # Joining GID 1000 uses the dir's existing group-write bit instead of
+    # restoring a capability, so the cap_drop posture is preserved. Vector must
+    # stay ROOT for the uid: raw container logs under /var/lib/docker/containers
+    # are 0640 root:root, so user: "1000:1000" would swap a write failure for a
+    # read failure.
+    group_add:
+      - "1000"
     healthcheck:
       test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8686/health"]
       interval: 30s
diff --git a/docker-compose.yml b/docker-compose.yml
index dd3935048..2e7450dac 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -537,6 +537,21 @@ services:
       - no-new-privileges:true
     cap_drop:
       - ALL
+    # #1799: #1478 chowns /data/logs to 1000:1000 (chmod 775) so the UID-1000
+    # backend's retention sweep can delete archived originals. Vector runs as
+    # root, but cap_drop: ALL strips CAP_DAC_OVERRIDE — the capability that lets
+    # root ignore file permissions — so root is neither owner nor group and
+    # falls through to "other" (r-x) on that 775 dir. EVERY sink write then
+    # fails with "Permission denied", silently: a file-sink error does not fail
+    # the :8686 healthcheck, so Vector reports healthy while writing nothing.
+    #
+    # Joining GID 1000 uses the dir's existing group-write bit instead of
+    # restoring a capability, so the cap_drop posture is preserved. Vector must
+    # stay ROOT for the uid: raw container logs under /var/lib/docker/containers
+    # are 0640 root:root, so user: "1000:1000" would swap a write failure for a
+    # read failure.
+    group_add:
+      - "1000"
     healthcheck:
       test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8686/health"]
       interval: 30s

From d6b8557ffcb3b5afe1d84dd44f8bb098291e7a21 Mon Sep 17 00:00:00 2001
From: Alex <96788044+webmixgamer@users.noreply.github.com>
Date: Tue, 28 Jul 2026 10:27:27 +0100
Subject: [PATCH 03/25] fix(agents): default base image to UTC + ISO-Z file
 timestamps (#1795) (#1828)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(agents): default base image to UTC + ISO-Z file timestamps (#1795)

ENV TZ=America/New_York made every agent run on US Eastern regardless of
operator location — disagreeing with its own /etc/localtime (Etc/UTC), the
backend, and the scheduler. Agent-server file/credential/dashboard "modified"
fields were naive local strings that consumers treating naive ISO as UTC
(Invariant #16) rendered hours in the past.

- Dockerfile: ENV TZ=Etc/UTC (overridable at deploy via -e TZ=...)
- new iso_z_from_mtime() -> canonical ISO-Z UTC, independent of container TZ
- applied at all 6 file-metadata sites (files x4, credentials, dashboard)
- test: helper correctness + TZ-independence + Dockerfile static guard

Fixes #1795

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(agents): keep files.py standalone-importable (#1795 regression-diff)

The initial #1795 change imported the shared iso_z_from_mtime helper into
routers/files.py via a relative import. tests/unit/test_ent183_skill_packages
loads files.py by path (no package context) to verify its protected-path
logic, so the relative import broke that standalone load — the regression-diff
CI job reported 1 new failure (test_skill_dirs_are_not_protected_paths) while
the plain pytest jobs stayed green.

Keep files.py dependency-free with a module-local _iso_z_from_mtime;
credentials.py/dashboard.py (not standalone-loaded) keep the shared helper.

- files.py: module-local _iso_z_from_mtime instead of `from ..utils.helpers`
- test_1795: guard the standalone load + local-vs-shared helper drift
- doc: match the local helper name

Refs #1795

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docker/base-image/Dockerfile                  |   7 +-
 .../agent_server/routers/credentials.py       |   4 +-
 .../agent_server/routers/dashboard.py         |   5 +-
 .../base-image/agent_server/routers/files.py  |  21 +++-
 .../base-image/agent_server/utils/helpers.py  |  13 +++
 .../feature-flows/skills-on-agent-start.md    |   2 +-
 tests/unit/test_1795_agent_timestamp_utc.py   | 102 ++++++++++++++++++
 7 files changed, 143 insertions(+), 11 deletions(-)
 create mode 100644 tests/unit/test_1795_agent_timestamp_utc.py

diff --git a/docker/base-image/Dockerfile b/docker/base-image/Dockerfile
index c7f0e9917..7d027ee7d 100644
--- a/docker/base-image/Dockerfile
+++ b/docker/base-image/Dockerfile
@@ -9,7 +9,12 @@ ARG VERSION=latest
 LABEL trinity.base-image-version="${VERSION}"
 
 ENV DEBIAN_FRONTEND=noninteractive
-ENV TZ=America/New_York
+# Default to UTC so container-local time == UTC and matches /etc/localtime
+# (Etc/UTC). Agents, the backend, and the scheduler all reason in UTC
+# (Invariant #16); a non-UTC default made agents run hours off and file
+# timestamps surface as naive local time (#1795). Override at deploy time
+# with `docker run -e TZ=...` if a specific zone is required.
+ENV TZ=Etc/UTC
 ENV TRINITY_BASE_VERSION="${VERSION}"
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
diff --git a/docker/base-image/agent_server/routers/credentials.py b/docker/base-image/agent_server/routers/credentials.py
index 1479f0729..1ee7128ba 100644
--- a/docker/base-image/agent_server/routers/credentials.py
+++ b/docker/base-image/agent_server/routers/credentials.py
@@ -5,7 +5,6 @@
 import base64
 import binascii
 import logging
-from datetime import datetime
 from pathlib import Path
 from typing import List
 
@@ -25,6 +24,7 @@
 from ..state import agent_state
 from ..services.trinity_mcp import inject_trinity_mcp_if_configured
 from ..utils.credential_sanitizer import refresh_credential_values
+from ..utils.helpers import iso_z_from_mtime
 # Second-layer credential-path policy (Invariant #5) — byte-identical vendored
 # copy of src/backend/services/credential_paths.py (#11).
 from ..credential_paths import is_allowed_credential_path
@@ -242,7 +242,7 @@ async def get_credentials_status():
             files_status[filename] = {
                 "exists": True,
                 "size": stat.st_size,
-                "modified": datetime.fromtimestamp(stat.st_mtime).isoformat()
+                "modified": iso_z_from_mtime(stat.st_mtime)
             }
         else:
             files_status[filename] = {"exists": False}
diff --git a/docker/base-image/agent_server/routers/dashboard.py b/docker/base-image/agent_server/routers/dashboard.py
index 7363ab08b..9936eba4b 100644
--- a/docker/base-image/agent_server/routers/dashboard.py
+++ b/docker/base-image/agent_server/routers/dashboard.py
@@ -6,11 +6,12 @@
 import logging
 from pathlib import Path
 from typing import Optional, Dict, Any, List
-from datetime import datetime
 
 from fastapi import APIRouter
 import yaml
 
+from ..utils.helpers import iso_z_from_mtime
+
 logger = logging.getLogger(__name__)
 router = APIRouter()
 
@@ -227,7 +228,7 @@ async def get_dashboard():
 
         # Get file modification time
         stat = dashboard_path.stat()
-        last_modified = datetime.fromtimestamp(stat.st_mtime).isoformat()
+        last_modified = iso_z_from_mtime(stat.st_mtime)
 
         # Ensure defaults
         if 'refresh' not in config:
diff --git a/docker/base-image/agent_server/routers/files.py b/docker/base-image/agent_server/routers/files.py
index 1e5b74e4c..46c380bc1 100644
--- a/docker/base-image/agent_server/routers/files.py
+++ b/docker/base-image/agent_server/routers/files.py
@@ -4,7 +4,7 @@
 import logging
 import mimetypes
 import shutil
-from datetime import datetime
+from datetime import datetime, timezone
 from pathlib import Path
 
 from fastapi import APIRouter, HTTPException
@@ -20,6 +20,17 @@ class FileUpdateRequest(BaseModel):
 router = APIRouter()
 
 
+def _iso_z_from_mtime(mtime: float) -> str:
+    """Format an mtime (epoch seconds) as canonical ISO-Z UTC.
+
+    Defined locally rather than imported from ``..utils.helpers`` so this router
+    stays standalone-importable: tests/unit/test_ent183_skill_packages.py loads
+    this file by path (no package context) to verify its protected-path logic,
+    and a relative import would break that load (#1795).
+    """
+    return datetime.fromtimestamp(mtime, tz=timezone.utc).isoformat().replace("+00:00", "Z")
+
+
 @router.get("/api/files")
 async def list_files(path: str = "/home/developer", show_hidden: bool = False):
     """
@@ -70,7 +81,7 @@ def build_tree(directory: Path, base_path: Path, include_hidden: bool) -> dict:
                             "type": "directory",
                             "children": subtree["children"],
                             "file_count": subtree["file_count"],
-                            "modified": datetime.fromtimestamp(stat.st_mtime).isoformat()
+                            "modified": _iso_z_from_mtime(stat.st_mtime)
                         })
                         total_files += subtree["file_count"]
                     else:
@@ -80,7 +91,7 @@ def build_tree(directory: Path, base_path: Path, include_hidden: bool) -> dict:
                             "path": str(relative_path),
                             "type": "file",
                             "size": stat.st_size,
-                            "modified": datetime.fromtimestamp(stat.st_mtime).isoformat()
+                            "modified": _iso_z_from_mtime(stat.st_mtime)
                         })
                         total_files += 1
 
@@ -421,7 +432,7 @@ async def update_file(path: str, request: FileUpdateRequest, platform: bool = Fa
             "success": True,
             "path": path,
             "size": stat.st_size,
-            "modified": datetime.fromtimestamp(stat.st_mtime).isoformat()
+            "modified": _iso_z_from_mtime(stat.st_mtime)
         }
 
     except Exception as e:
@@ -489,7 +500,7 @@ async def create_folder(path: str):
             "success": True,
             "path": path,
             "type": "directory",
-            "modified": datetime.fromtimestamp(stat.st_mtime).isoformat()
+            "modified": _iso_z_from_mtime(stat.st_mtime)
         }
 
     except HTTPException:
diff --git a/docker/base-image/agent_server/utils/helpers.py b/docker/base-image/agent_server/utils/helpers.py
index 903bfbec2..3219be631 100644
--- a/docker/base-image/agent_server/utils/helpers.py
+++ b/docker/base-image/agent_server/utils/helpers.py
@@ -1,9 +1,22 @@
 """
 Helper utility functions for the agent server.
 """
+from datetime import datetime, timezone
 from typing import Dict, Any
 
 
+def iso_z_from_mtime(mtime: float) -> str:
+    """Format a filesystem mtime (epoch seconds) as a canonical ISO-Z UTC string.
+
+    Uses an explicit UTC timezone so the result is independent of the container's
+    local TZ (Invariant #16: platform timestamps are ISO-Z UTC). A naive
+    ``datetime.fromtimestamp(mtime).isoformat()`` renders in local time with no
+    zone marker, which downstream consumers (that treat naive ISO as UTC) then
+    display hours off. Returns e.g. ``"2026-07-27T08:06:58.549706Z"``.
+    """
+    return datetime.fromtimestamp(mtime, tz=timezone.utc).isoformat().replace("+00:00", "Z")
+
+
 def shorten_path(path: str) -> str:
     """Shorten file path for display"""
     if not path:
diff --git a/docs/memory/feature-flows/skills-on-agent-start.md b/docs/memory/feature-flows/skills-on-agent-start.md
index 482c4a00a..004581f3a 100644
--- a/docs/memory/feature-flows/skills-on-agent-start.md
+++ b/docs/memory/feature-flows/skills-on-agent-start.md
@@ -579,7 +579,7 @@ async def update_file(path: str, request: FileUpdateRequest):
             "success": True,
             "path": path,
             "size": stat.st_size,
-            "modified": datetime.fromtimestamp(stat.st_mtime).isoformat()
+            "modified": _iso_z_from_mtime(stat.st_mtime)  # ISO-Z UTC, TZ-independent (#1795)
         }
     except Exception as e:
         raise HTTPException(status_code=500, detail=f"Failed to update file: {str(e)}")
diff --git a/tests/unit/test_1795_agent_timestamp_utc.py b/tests/unit/test_1795_agent_timestamp_utc.py
new file mode 100644
index 000000000..dc1aaafd1
--- /dev/null
+++ b/tests/unit/test_1795_agent_timestamp_utc.py
@@ -0,0 +1,102 @@
+"""Regression tests for #1795 — agent timezone / naive-timestamp bug.
+
+Two guards:
+
+* Part B — ``iso_z_from_mtime`` emits a canonical ISO-Z UTC string that is
+  *independent of the container's local TZ*, so agent file/credential/dashboard
+  ``modified`` fields can never again surface as naive local time (the bug the
+  frontend rendered "4 hours ago" for a just-written file).
+* Part A — the base image defaults ``TZ`` to ``Etc/UTC`` (static content guard
+  so a future edit can't silently re-introduce ``America/New_York``).
+
+``conftest.py`` registers ``docker/base-image/agent_server`` as a namespace
+package, so ``from agent_server.utils.helpers import ...`` resolves directly.
+"""
+from __future__ import annotations
+
+import importlib.util
+import os
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+import pytest
+
+from agent_server.utils.helpers import iso_z_from_mtime
+
+_REPO_ROOT = Path(__file__).resolve().parents[2]
+_DOCKERFILE = _REPO_ROOT / "docker" / "base-image" / "Dockerfile"
+
+
+def test_iso_z_from_mtime_zero_epoch_is_canonical_z():
+    # Deterministic anchor: epoch 0 is the Unix epoch in UTC.
+    assert iso_z_from_mtime(0.0) == "1970-01-01T00:00:00Z"
+
+
+def test_iso_z_from_mtime_marks_zone_and_preserves_instant():
+    mtime = 1753603618.549706  # a real fractional mtime
+    out = iso_z_from_mtime(mtime)
+
+    # Canonical ISO-Z: zone-marked with a trailing Z, never a bare naive string
+    # and never the "+00:00" form (Invariant #16 uses Z).
+    assert out.endswith("Z")
+    assert "+00:00" not in out
+    assert out[10] == "T"  # date/time separator
+
+    # Same instant as the source mtime, interpreted as UTC.
+    parsed = datetime.fromisoformat(out.replace("Z", "+00:00"))
+    assert parsed == datetime.fromtimestamp(mtime, tz=timezone.utc)
+
+
+@pytest.mark.skipif(not hasattr(time, "tzset"), reason="time.tzset() is Unix-only")
+def test_iso_z_from_mtime_is_independent_of_container_tz():
+    """The crux of #1795: output must not shift with the process TZ.
+
+    ``datetime.fromtimestamp(mtime, tz=utc)`` ignores the local zone, so the
+    formatted string is identical whether the container is UTC or US/Eastern —
+    which is exactly why Part B is robust to any future TZ change.
+    """
+    mtime = 1753603618.549706
+    original_tz = os.environ.get("TZ")
+    try:
+        os.environ["TZ"] = "UTC"
+        time.tzset()
+        as_utc = iso_z_from_mtime(mtime)
+
+        os.environ["TZ"] = "America/New_York"  # the value #1795 removed
+        time.tzset()
+        as_eastern = iso_z_from_mtime(mtime)
+
+        assert as_utc == as_eastern
+    finally:
+        if original_tz is None:
+            os.environ.pop("TZ", None)
+        else:
+            os.environ["TZ"] = original_tz
+        time.tzset()
+
+
+def test_base_image_defaults_to_utc():
+    """Part A static guard: the base image must default TZ to UTC."""
+    content = _DOCKERFILE.read_text(encoding="utf-8")
+    assert "ENV TZ=Etc/UTC" in content
+    assert "America/New_York" not in content
+
+
+def test_files_router_stays_standalone_importable():
+    """#1795 regression: files.py must load by path with no package context.
+
+    tests/unit/test_ent183_skill_packages.py loads files.py via
+    spec_from_file_location to check its protected-path logic; a relative import
+    (``from ..utils.helpers``) breaks that standalone load. Guard both the load
+    and that the router's local ``_iso_z_from_mtime`` matches the shared helper.
+    """
+    spec = importlib.util.spec_from_file_location(
+        "_test1795_agent_files",
+        str(_REPO_ROOT / "docker/base-image/agent_server/routers/files.py"),
+    )
+    files_mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(files_mod)  # must not raise (a relative import would)
+
+    for mtime in (0.0, 1753603618.549706):
+        assert files_mod._iso_z_from_mtime(mtime) == iso_z_from_mtime(mtime)

From cac5f91e8b0f2c0f9849b716caccaa5d85cd1c02 Mon Sep 17 00:00:00 2001
From: dolho <66411456+dolho@users.noreply.github.com>
Date: Tue, 28 Jul 2026 12:27:30 +0300
Subject: [PATCH 04/25] =?UTF-8?q?fix(ui):=20elastic=20Dashboard=20stats=20?=
 =?UTF-8?q?bar=20=E2=80=94=20degrade=20telemetry=20instead=20of=20clipping?=
 =?UTF-8?q?=20it=20(#1830)=20(#1836)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The header row was [stats cluster | controls cluster] with the stats side only
ever clipped by `overflow-hidden` and the controls side `flex-shrink-0`. Below
~1170px of effective width (a wide monitor at 150-175% zoom lands here) the
telemetry meters were cut mid-element and their boxes ran under the Tags /
owner / Grid-Timeline / time-range controls — 22px measured overlap at 900px
locally, 29px on a fleet with the owner filter shown. Same inelastic-flex-row
class as the NavBar in #1789, one row down.

Make the stats cluster a size container (`flex-1 min-w-0` +
`container-type: inline-size`) and degrade its contents in a defined order as
its leftover width shrinks: sparklines -> Disk -> Mem -> telemetry ->
"messages (Nh)" -> "working now", agent count always survives. Keying the
ladder on the CONTAINER rather than the viewport is what makes it hold when the
controls cluster grows (grid mode adds Tidy up / Reset; the Tags chip and owner
filter only exist on some fleets) — a viewport breakpoint cannot see that.

Each threshold sits ~25-30px above the measured intrinsic width of the level it
gates (791 / 663 / 522 / 394 / 308 / 182 / 71 px), so every level fits its own
band with headroom for wider live values. HostTelemetry now owns its leading
separator so it disappears with the meters, and each metric carries a title
attribute so the value stays reachable once its meter is hidden.

e2e: dashboard-stats-overflow.spec.js sweeps 640-1600px in both dashboard modes
and pins zero controls/stats box intersection, zero mid-element clipping and no
page-level horizontal overflow. Verified failing (4/5) against the pre-fix
markup and passing after.

Related to #1830
---
 .../e2e/dashboard-stats-overflow.spec.js      | 154 ++++++++++++++++++
 src/frontend/src/components/HostTelemetry.vue |  87 +++++++---
 src/frontend/src/views/Dashboard.vue          |  68 +++++++-
 3 files changed, 282 insertions(+), 27 deletions(-)
 create mode 100644 src/frontend/e2e/dashboard-stats-overflow.spec.js

diff --git a/src/frontend/e2e/dashboard-stats-overflow.spec.js b/src/frontend/e2e/dashboard-stats-overflow.spec.js
new file mode 100644
index 000000000..53c477333
--- /dev/null
+++ b/src/frontend/e2e/dashboard-stats-overflow.spec.js
@@ -0,0 +1,154 @@
+import { test, expect } from '@playwright/test'
+
+/**
+ * Dashboard stats-bar overflow (#1830).
+ *
+ * The Dashboard header row is [elastic stats cluster | fixed controls cluster].
+ * It used to be inelastic: the stats cluster was only ever CLIPPED by
+ * `overflow-hidden`, so below ~1170 CSS px of effective width the host
+ * telemetry meters were cut mid-element and their boxes ran under the Tags /
+ * owner / Grid-Timeline / time-range controls (29 px measured overlap at 900 px
+ * on an entitled build). Same defect class as the NavBar row in #1789.
+ *
+ * The fix makes the stats cluster a size container (`container-type:
+ * inline-size` on `.stats-cluster`) and degrades its contents in a defined
+ * order as the leftover width shrinks: sparklines → Disk → Mem → telemetry →
+ * "messages" → "working now", with the agent count always surviving. Keying on
+ * the CONTAINER (not the viewport) is what makes it hold when the controls
+ * cluster grows — grid mode adds Tidy up / Reset, and the Tags chip and owner
+ * filter only appear on some fleets.
+ *
+ * This suite pins the two properties that must never regress:
+ *   1. no box of the controls cluster intersects any box of the stats cluster
+ *   2. nothing in the stats cluster is clipped mid-element by the cluster edge
+ * plus no page-level horizontal overflow, across both dashboard modes.
+ */
+
+const WIDTHS = [640, 768, 900, 1024, 1170, 1366, 1600]
+const MODES = ['timeline', 'grid']
+const ROW = 'main .border-b .flex.items-center.justify-between'
+
+// Geometry probe. Compares every leaf box of the left (stats) cluster against
+// every leaf box of the right (controls) cluster, and separately reports any
+// stats leaf that straddles the cluster's own right edge (the clip that the
+// old markup produced instead of degrading).
+const PROBE = () => {
+  const row = document.querySelector(
+    'main .border-b .flex.items-center.justify-between'
+  )
+  if (!row) return { error: 'header row not found' }
+  const [left, right] = row.children
+  const leaves = (root) =>
+    [...root.querySelectorAll('*')].filter(
+      (e) => e.children.length === 0 && e.getBoundingClientRect().width > 0
+    )
+  const describe = (e) =>
+    `${e.tagName.toLowerCase()}.${String(e.className).slice(0, 40)} "${(
+      e.textContent || ''
+    )
+      .trim()
+      .slice(0, 16)}"`
+
+  let worst = { px: 0 }
+  for (const l of leaves(left)) {
+    const lr = l.getBoundingClientRect()
+    for (const r of leaves(right)) {
+      const rr = r.getBoundingClientRect()
+      const ox = Math.min(lr.right, rr.right) - Math.max(lr.left, rr.left)
+      const oy = Math.min(lr.bottom, rr.bottom) - Math.max(lr.top, rr.top)
+      if (ox > 0 && oy > 0 && ox > worst.px) {
+        worst = { px: Math.round(ox), left: describe(l), right: describe(r) }
+      }
+    }
+  }
+
+  const lbox = left.getBoundingClientRect()
+  const clipped = leaves(left)
+    .filter((e) => {
+      const r = e.getBoundingClientRect()
+      // Starts inside the cluster but runs past its right edge (0.5px slack for
+      // sub-pixel layout).
+      return r.left < lbox.right && r.right > lbox.right + 0.5
+    })
+    .map(describe)
+
+  return {
+    overlapPx: worst.px,
+    overlapPair: worst.px ? `${worst.left} ⨯ ${worst.right}` : null,
+    clipped,
+    scrollWidth: document.documentElement.scrollWidth,
+    innerWidth: window.innerWidth,
+  }
+}
+
+async function gotoDashboard(page, mode) {
+  // The store reads the persisted mode on init (stores/network.js), so seeding
+  // it is more deterministic than clicking the toggle and racing the re-render.
+  await page.addInitScript((m) => {
+    localStorage.setItem('trinity-dashboard-view', m)
+  }, mode)
+  await page.goto('/')
+  await page.waitForSelector(ROW, { timeout: 15000 })
+  // Host telemetry paints on its first 5s poll; give the meters a beat to land
+  // so the sweep measures the widest state, not the pre-fetch one.
+  await page.waitForTimeout(1500)
+}
+
+test.describe('Dashboard stats bar overflow (#1830)', () => {
+  for (const mode of MODES) {
+    test(`@interactive ${mode} mode: controls never overlap the stats cluster`, async ({
+      page,
+    }) => {
+      await page.setViewportSize({ width: WIDTHS.at(-1), height: 800 })
+      await gotoDashboard(page, mode)
+
+      for (const width of WIDTHS) {
+        await page.setViewportSize({ width, height: 800 })
+        await page.waitForTimeout(250) // container query re-layout
+        const r = await page.evaluate(PROBE)
+
+        expect(r.error, `probe failed at ${width}px`).toBeUndefined()
+        expect(
+          r.overlapPx,
+          `${mode} @ ${width}px — controls overlap stats by ${r.overlapPx}px (${r.overlapPair})`
+        ).toBe(0)
+        expect(
+          r.clipped,
+          `${mode} @ ${width}px — stats content clipped mid-element instead of degrading`
+        ).toEqual([])
+        expect(
+          r.scrollWidth,
+          `${mode} @ ${width}px — page overflows horizontally`
+        ).toBeLessThanOrEqual(r.innerWidth)
+      }
+    })
+  }
+
+  // The ladder must degrade, not amputate: at a comfortable width every meter is
+  // still there. Guards an over-eager threshold that would hide telemetry on a
+  // normal laptop.
+  test('@interactive wide viewport keeps CPU, Mem and Disk meters', async ({ page }) => {
+    await page.setViewportSize({ width: 1600, height: 800 })
+    await gotoDashboard(page, 'timeline')
+
+    for (const metric of ['cpu', 'mem', 'disk']) {
+      await expect(page.locator(`[data-metric="${metric}"]`)).toBeVisible()
+    }
+  })
+
+  // ...and at a narrow width the meters are REMOVED (display:none), not merely
+  // scrolled out of a clipping box — which is what the old markup did.
+  test('@interactive narrow viewport hides the meters rather than clipping them', async ({
+    page,
+  }) => {
+    await page.setViewportSize({ width: 1600, height: 800 })
+    await gotoDashboard(page, 'grid')
+    await expect(page.locator('[data-metric="disk"]')).toBeVisible()
+
+    await page.setViewportSize({ width: 700, height: 800 })
+    await page.waitForTimeout(250)
+    await expect(page.locator('[data-metric="disk"]')).toBeHidden()
+    // The agent count is the one thing that always survives.
+    await expect(page.locator('.stats-cluster')).toContainText('agents')
+  })
+})
diff --git a/src/frontend/src/components/HostTelemetry.vue b/src/frontend/src/components/HostTelemetry.vue
index 7f53550d3..f8bc4564c 100644
--- a/src/frontend/src/components/HostTelemetry.vue
+++ b/src/frontend/src/components/HostTelemetry.vue
@@ -96,40 +96,52 @@ onUnmounted(() => {
 <template>
   <div class="host-telemetry">
     <template v-if="!loading">
+      <!-- Leading separator lives here (not in Dashboard.vue) so it disappears
+           together with the meters when the ladder hides them (#1830). -->
+      <span class="text-gray-300 dark:text-gray-600">·</span>
+
       <!-- CPU -->
-      <span class="stat-item">
+      <span class="stat-item" data-metric="cpu" :title="`CPU ${formatPercent(hostStats?.cpu?.percent)}%`">
         <span class="dot bg-blue-500"></span>
         <span class="stat-label">CPU</span>
-        <SparklineChart
-          :data="cpuHistory"
-          color="#3b82f6"
-          :y-max="100"
-          :width="60"
-          :height="20"
-        />
+        <span class="spark">
+          <SparklineChart
+            :data="cpuHistory"
+            color="#3b82f6"
+            :y-max="100"
+            :width="60"
+            :height="20"
+          />
+        </span>
         <span class="stat-value" :class="getColorClass(hostStats?.cpu?.percent)">{{ formatPercent(hostStats?.cpu?.percent) }}%</span>
       </span>
 
-      <span class="text-gray-300 dark:text-gray-600">·</span>
+      <span class="text-gray-300 dark:text-gray-600" data-sep="mem">·</span>
 
       <!-- Memory -->
-      <span class="stat-item">
+      <span
+        class="stat-item"
+        data-metric="mem"
+        :title="`Memory ${formatMemory(hostStats?.memory?.used_gb, hostStats?.memory?.total_gb)}`"
+      >
         <span class="dot bg-accent-purple-500"></span>
         <span class="stat-label">Mem</span>
-        <SparklineChart
-          :data="memHistory"
-          color="#a855f7"
-          :y-max="100"
-          :width="60"
-          :height="20"
-        />
+        <span class="spark">
+          <SparklineChart
+            :data="memHistory"
+            color="#a855f7"
+            :y-max="100"
+            :width="60"
+            :height="20"
+          />
+        </span>
         <span class="stat-value" :class="getColorClass(hostStats?.memory?.percent)">{{ formatMemory(hostStats?.memory?.used_gb, hostStats?.memory?.total_gb) }}</span>
       </span>
 
-      <span class="text-gray-300 dark:text-gray-600">·</span>
+      <span class="text-gray-300 dark:text-gray-600" data-sep="disk">·</span>
 
       <!-- Disk -->
-      <span class="stat-item">
+      <span class="stat-item" data-metric="disk" :title="`Disk ${formatPercent(hostStats?.disk?.percent)}%`">
         <span class="dot bg-status-success-500"></span>
         <span class="stat-label">Disk</span>
         <span class="disk-bar">
@@ -200,4 +212,41 @@ onUnmounted(() => {
 .dark .disk-bar {
   background: rgba(55, 65, 81, 0.5);
 }
+
+/*
+ * Progressive degrade (#1830) — the meters shed detail, then whole metrics,
+ * as the stats cluster loses width, instead of being clipped mid-element by
+ * the cluster's `overflow-hidden`. Queried against the `statsbar` size
+ * container declared on `.stats-cluster` in Dashboard.vue (the only mount
+ * point); without that ancestor these rules simply never match, so the
+ * component stays safe to reuse elsewhere.
+ *
+ * Order: sparklines → Disk → Mem → everything (see the ladder comment in
+ * Dashboard.vue, which owns the two count groups below this).
+ */
+@container statsbar (max-width: 820px) {
+  .spark {
+    display: none;
+  }
+}
+
+@container statsbar (max-width: 700px) {
+  [data-metric='disk'],
+  [data-sep='disk'] {
+    display: none;
+  }
+}
+
+@container statsbar (max-width: 560px) {
+  [data-metric='mem'],
+  [data-sep='mem'] {
+    display: none;
+  }
+}
+
+@container statsbar (max-width: 420px) {
+  .host-telemetry {
+    display: none;
+  }
+}
 </style>
diff --git a/src/frontend/src/views/Dashboard.vue b/src/frontend/src/views/Dashboard.vue
index 21204d8d1..b8474608b 100644
--- a/src/frontend/src/views/Dashboard.vue
+++ b/src/frontend/src/views/Dashboard.vue
@@ -13,8 +13,11 @@
         <!-- Compact Header -->
         <div class="bg-white dark:bg-gray-800 border-b border-gray-200 dark:border-gray-700 px-4 py-2">
           <div class="flex items-center justify-between">
-            <!-- Left: Stats -->
-            <div class="flex items-center min-w-0 overflow-hidden">
+            <!-- Left: Stats — elastic (#1830). `flex-1 min-w-0` makes this the
+                 only cluster that gives ground, and `container-type: inline-size`
+                 (see .stats-cluster below) turns its leftover width into the
+                 query axis the progressive-hide ladder degrades against. -->
+            <div class="stats-cluster flex items-center min-w-0 flex-1 overflow-hidden">
               <div class="flex items-center space-x-3 text-xs text-gray-500 dark:text-gray-400 whitespace-nowrap">
                 <span class="flex items-center space-x-1">
                   <span class="w-1.5 h-1.5 rounded-full bg-status-success-500"></span>
@@ -22,18 +25,18 @@
                   <span>agents</span>
                 </span>
                 <!-- Working-now count (trinity-enterprise#47) -->
-                <span class="text-gray-300 dark:text-gray-600">·</span>
-                <span class="flex items-center space-x-1">
+                <span class="text-gray-300 dark:text-gray-600" data-sep="working">·</span>
+                <span class="flex items-center space-x-1" data-stat="working">
                   <span class="font-medium text-status-info-600 dark:text-status-info-400">{{ workingNowCount }}</span>
                   <span>working now</span>
                 </span>
-                <span class="text-gray-300 dark:text-gray-600">·</span>
-                <span class="flex items-center space-x-1">
+                <span class="text-gray-300 dark:text-gray-600" data-sep="messages">·</span>
+                <span class="flex items-center space-x-1" data-stat="messages">
                   <span class="font-medium text-status-info-600 dark:text-status-info-400">{{ totalCollaborationCount }}</span>
                   <span>messages ({{ timeRangeHours }}h)</span>
                 </span>
-                <!-- Host Telemetry (inline) -->
-                <span class="text-gray-300 dark:text-gray-600">·</span>
+                <!-- Host Telemetry (inline) — owns its own leading separator and
+                     its own container-query hide ladder (HostTelemetry.vue). -->
                 <HostTelemetry />
               </div>
             </div>
@@ -671,6 +674,55 @@ function handleClickOutside(event) {
 
 <style scoped>
 
+/*
+ * Stats bar progressive degrade (#1830).
+ *
+ * The header row is [elastic stats cluster | fixed controls cluster]. Before
+ * this, the stats cluster only ever got CLIPPED by `overflow-hidden` — the
+ * telemetry meters were cut mid-element (and their boxes still ran under the
+ * controls) with no visual affordance. Making the cluster a size container
+ * lets the content drop out in a defined order as space runs out, keyed to the
+ * width actually left over — so it adapts to a wider controls cluster (grid
+ * mode, tags chip, owner filter) instead of a guessed viewport breakpoint.
+ *
+ * Ladder (widest → narrowest), split by ownership:
+ *   ≤ 820px  sparklines drop        (HostTelemetry.vue)
+ *   ≤ 700px  Disk meter drops       (HostTelemetry.vue)
+ *   ≤ 560px  Mem meter drops        (HostTelemetry.vue)
+ *   ≤ 420px  telemetry drops whole  (HostTelemetry.vue)
+ *   ≤ 330px  "messages (Nh)" drops  (here)
+ *   ≤ 200px  "working now" drops    (here)
+ * The agent count always survives.
+ *
+ * Each threshold sits ~25-30px ABOVE the measured intrinsic width of the level
+ * it gates (full 791 → no-sparks 663 → no-disk 522 → no-mem 394 → no-telemetry
+ * 308 → no-messages 182 → agents-only 71), so every level still fits its own
+ * band with headroom for wider live values (three-digit fleets, 100.0/128G).
+ * Thresholds set below those widths reintroduce the clip this fixes — re-measure
+ * before moving one.
+ *
+ * The container NAME is the contract HostTelemetry.vue queries against — keep
+ * `statsbar` in sync with the @container rules there if it ever changes.
+ */
+.stats-cluster {
+  container-type: inline-size;
+  container-name: statsbar;
+}
+
+@container statsbar (max-width: 330px) {
+  [data-stat='messages'],
+  [data-sep='messages'] {
+    display: none;
+  }
+}
+
+@container statsbar (max-width: 200px) {
+  [data-stat='working'],
+  [data-sep='working'] {
+    display: none;
+  }
+}
+
 /* Replay Mode Styles */
 .mode-toggle {
   transition: all 0.2s ease;

From 1d91931730c29374f9583bf8c63d31dd1aa975f7 Mon Sep 17 00:00:00 2001
From: dolho <66411456+dolho@users.noreply.github.com>
Date: Tue, 28 Jul 2026 12:27:34 +0300
Subject: [PATCH 05/25] fix(seed): converge the Cornelius flag on a 409 only
 when the agent exists (#1790) (#1837)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The seeder read any HTTP 409 from create_agent_internal as "Cornelius already
exists" and durably set cornelius_seeded=true. But the create path raises 409
for several conditions under which NOTHING was created — a leftover unclaimed
workspace volume (#1667), volumes still owned by a renamed agent (#1664), a
fork destination already bound. On those, the flag suppressed every later
attempt, so the install stayed permanently Cornelius-less while reporting that
it had seeded, and system_seed_service then read the install as not-fresh.

The reachable path is the ordinary "let me start over": `docker compose down -v`
destroys the DB but NOT the agent volumes (they are not compose-managed), so the
next setup hits the leftover agent-cornelius-workspace, 409s, and burns the flag.
Recovery required hand-editing system_settings.

Verify by fact, not by status code: on a 409 the handler now re-checks whether
anything actually claims the name and converges only then; otherwise it leaves
the flag unset, returns create_blocked, and logs the cause, so the next boot
retries. The usual blocker is reclaimed unattended by the #1581 orphan-volume
sweep, so the retry converges without intervention.

The predicate is the create path's own — `_check_name_availability`'s existence
check, extracted as `crud.agent_name_is_taken` and shared rather than re-derived,
so the two cannot drift when a claim source is added. This is deliberately
broader than typing the one #1667 refusal: every present and future non-existence
409 is handled, since the seeder now asks the question it actually cares about.
Mirrors the fact-based 409 handling already used for Docker name conflicts in
lifecycle.py (#1809). The probe fails toward retry — a wrong "absent" costs one
redundant create attempt, a wrong "present" is the unrecoverable direction.

Tests: 3 new cases in the ent107 suite (409-with-no-agent leaves the flag unset;
probe failure fails toward retry; the shared predicate reads every claim source),
plus the existing 409-convergence case tightened to assert presence. Verified
failing 2/2 against the pre-fix handler. Full unit suite: 4993 passed, 4
pre-existing environmental failures (missing tzdata, admin-email-login)
reproduced identically on an untouched checkout.

Related to #1790
---
 .../feature-flows/cornelius-default-agent.md  |  2 +-
 src/backend/services/agent_service/crud.py    | 25 ++++--
 .../services/cornelius_agent_service.py       | 56 +++++++++++--
 tests/unit/test_ent107_cornelius_seed.py      | 80 +++++++++++++++++--
 4 files changed, 147 insertions(+), 16 deletions(-)

diff --git a/docs/memory/feature-flows/cornelius-default-agent.md b/docs/memory/feature-flows/cornelius-default-agent.md
index cf8711d49..1c2c6f044 100644
--- a/docs/memory/feature-flows/cornelius-default-agent.md
+++ b/docs/memory/feature-flows/cornelius-default-agent.md
@@ -42,7 +42,7 @@ Gates, in order (all fail-open / idempotent — a skip or error never blocks boo
 2. **Fresh-install gate** — `db.count_non_system_agents() > 0` ⇒ skip **and converge the flag** (marks seeded without provisioning) so an upgrade of an established fleet is never surprised by a new agent appearing and we stop re-checking every boot.
 3. **Owner-exists gate** — `db.get_user_by_username('admin')` absent ⇒ **defer WITHOUT setting the flag**. On a truly-fresh pre-setup boot the admin row doesn't exist yet, so this skip lets the setup-completion trigger (or a later boot) retry — this is *why* there are two triggers rather than a lifespan-only hook.
 4. **Cross-worker lock** — Redis `SETNX cornelius:provision` (fail-open, mirrors the #1464 monitoring leader-lock) so `--workers 2` boots can't both provision. If the lock isn't acquired, the other worker owns it.
-5. **Provision** — creates the agent from `local:cornelius` via the ordinary `create_agent_internal(...)` (no PAT, no network, no clone — a local template copy). `create_agent_internal`'s `request` param was widened to `Optional[Request] = None` because the boot-time caller has no HTTP request (the param was never dereferenced). A `409` (agent already exists — a race backstop) is treated as success and converges the flag.
+5. **Provision** — creates the agent from `local:cornelius` via the ordinary `create_agent_internal(...)` (no PAT, no network, no clone — a local template copy). `create_agent_internal`'s `request` param was widened to `Optional[Request] = None` because the boot-time caller has no HTTP request (the param was never dereferenced). A `409` converges the flag **only when the agent is actually there** (#1790). The create path raises the same status for conditions under which nothing was created — a leftover unclaimed workspace volume (#1667, what `docker compose down -v` then re-setup leaves behind), volumes still owned by a renamed agent (#1664), a fork destination already bound — so the handler re-checks with the create path's own claim predicate (`crud.agent_name_is_taken`, shared rather than re-derived so the two cannot drift). Nothing claiming the name ⇒ flag left **unset**, result `create_blocked`, next boot retries; the usual cause is reclaimed unattended by the #1581 orphan-volume sweep, so the retry converges without intervention. The probe fails toward retry: a wrong "absent" costs one redundant create attempt, a wrong "present" burns the durable flag and strands the install permanently Cornelius-less while reporting seeded.
 6. **Existence-guarded flag enable** — turns on the `brain_orb_enabled` platform flag **only when unset**, so it never clobbers an admin who explicitly set it OFF.
 7. **Mark done** — write the `cornelius_seeded` flag. Only a *successful* provision sets it; a genuine failure leaves it unset for the next boot to retry.
 
diff --git a/src/backend/services/agent_service/crud.py b/src/backend/services/agent_service/crud.py
index 2b863e434..ee2dfa4af 100644
--- a/src/backend/services/agent_service/crud.py
+++ b/src/backend/services/agent_service/crud.py
@@ -1610,6 +1610,25 @@ def _release_ephemeral_on_no_docker(handles: _RollbackHandles) -> None:
             )
 
 
+def agent_name_is_taken(name: str) -> bool:
+    """True when `name` is claimed by a live, soft-deleted, or container-only
+    agent — the exact predicate the create path refuses on with
+    409 "Agent already exists".
+
+    Exported so a caller that catches that 409 can tell "the agent really is
+    there" from the create path's OTHER 409s (#1664 volume-base still owned,
+    #1667 unclaimed leftover volume, fork-destination in use), which look
+    identical by status code but mean the agent was NOT created (#1790).
+    Sharing one predicate is the point: a copy would drift the moment a new
+    claim source is added here.
+    """
+    return bool(
+        get_agent_by_name(name)
+        or db.get_agent_owner(name)
+        or db.is_agent_name_reserved(name)
+    )
+
+
 def _check_name_availability(config: AgentConfig) -> None:
     """Refuse a name already taken (#834 existence guard, incl. soft-deleted) or
     whose data volumes another agent still owns after a rename (#1664). Both
@@ -1620,11 +1639,7 @@ def _check_name_availability(config: AgentConfig) -> None:
     # create flow walks past the existence guard, the container ends up
     # created, and the agent_ownership INSERT hits a UNIQUE constraint
     # IntegrityError leaving the system half-built.
-    if (
-        get_agent_by_name(config.name)
-        or db.get_agent_owner(config.name)
-        or db.is_agent_name_reserved(config.name)
-    ):
+    if agent_name_is_taken(config.name):
         raise HTTPException(status_code=409, detail="Agent already exists")
 
     # #1664: the name being free does NOT mean its volumes are. Rename frees the
diff --git a/src/backend/services/cornelius_agent_service.py b/src/backend/services/cornelius_agent_service.py
index 415615da6..b620487c1 100644
--- a/src/backend/services/cornelius_agent_service.py
+++ b/src/backend/services/cornelius_agent_service.py
@@ -145,13 +145,35 @@ async def ensure_seeded(self, fresh: Optional[bool] = None) -> dict:
             logger.info("Cornelius agent seeded and Brain Orb enabled by default")
             return result
         except Exception as e:
-            # 409 = the agent already exists (another worker won, or a prior partial
-            # run). Treat as success: converge the flag so we stop retrying.
+            # A 409 is NOT self-evidently "already exists" (#1790). The create path
+            # raises the same status for conditions under which NOTHING was created:
+            # a leftover unclaimed workspace volume (#1667 — what a `down -v` then
+            # re-setup leaves behind), volumes still owned by a renamed agent
+            # (#1664), a fork destination already bound. Converging the durable flag
+            # on one of those is unrecoverable: the flag suppresses every later
+            # attempt, so the install stays permanently Cornelius-less while
+            # claiming it was seeded (and `system_seed_service.ensure_first_run_
+            # seeded()` then reads the install as not-fresh). Confirm the agent is
+            # actually there before treating the 409 as convergence.
             status_code = getattr(e, "status_code", None)
             if status_code == 409:
-                db.set_setting(_SEEDED_FLAG, "true")
-                self._seed_brain_orb_flag()
-                return self._skip(result, "already_exists", "Cornelius already exists (409) — marking seeded")
+                if self._agent_is_present():
+                    db.set_setting(_SEEDED_FLAG, "true")
+                    self._seed_brain_orb_flag()
+                    return self._skip(result, "already_exists", "Cornelius already exists (409) — marking seeded")
+                # 409 with no agent behind it: a precondition blocked creation. Leave
+                # the flag unset so the next boot retries — the usual cause (a
+                # leftover `agent-cornelius-workspace`) is reclaimed on its own by
+                # the #1581 orphan-volume sweep, so the retry converges unattended.
+                result.update(
+                    action="create_blocked", status="error",
+                    message=f"Cornelius seed blocked (409, agent not created): {e}",
+                )
+                logger.error(
+                    "Cornelius seed blocked by a 409 that created no agent — flag left "
+                    "unset so a later boot retries. Cause: %s", e,
+                )
+                return result
             # Any other failure: do NOT set the flag — retry on the next trigger/boot.
             result.update(action="create_failed", status="error",
                           message=f"Failed to seed Cornelius: {e}")
@@ -180,6 +202,30 @@ async def _provision(self, admin_user: User) -> None:
         )
         await create_agent_internal(config, admin_user, request=None)
 
+    def _agent_is_present(self) -> bool:
+        """Is a Cornelius actually claiming the name? (#1790)
+
+        Reuses the create path's own `agent_name_is_taken` — the predicate behind
+        its 409 "Agent already exists" — rather than re-deriving one here, so the
+        two can't drift when a new claim source is added (live row, soft-deleted
+        row, container-only leftover).
+
+        Fails toward RETRY: if the probe itself errors we report absent, so the
+        flag stays unset. The two mistakes are not symmetric — a wrong "absent"
+        costs one redundant create attempt that 409s again next boot, while a
+        wrong "present" burns the durable flag and is unrecoverable without
+        hand-editing `system_settings`. That asymmetry is the whole bug.
+        """
+        try:
+            from services.agent_service.crud import agent_name_is_taken
+
+            return agent_name_is_taken(CORNELIUS_AGENT_NAME)
+        except Exception as e:  # noqa: BLE001 — never let the probe raise out of the handler
+            logger.warning(
+                "Cornelius seed: presence probe failed (%s) — treating as absent so a later boot retries", e,
+            )
+            return False
+
     def _seed_brain_orb_flag(self) -> None:
         """Enable the Brain Orb platform flag by default — but only if no explicit
         value is stored, so an admin who turned it OFF is never overridden
diff --git a/tests/unit/test_ent107_cornelius_seed.py b/tests/unit/test_ent107_cornelius_seed.py
index 51be2992c..9c472db38 100644
--- a/tests/unit/test_ent107_cornelius_seed.py
+++ b/tests/unit/test_ent107_cornelius_seed.py
@@ -9,7 +9,9 @@
   * owner-must-exist deferral (pre-setup boot: skip WITHOUT burning the flag)
   * Docker-unavailable skip
   * Brain Orb flag defaulted ON, existence-guarded (never clobbers an admin OFF)
-  * 409-on-exists convergence (race backstop) vs. generic-failure retry
+  * 409-on-exists convergence (race backstop) vs. generic-failure retry, and
+    (#1790) the distinction between a 409 that means "the agent is there" and a
+    409 that means "creation was blocked" — only the former may burn the flag
   * the `--workers 2` Redis SETNX provisioning lock (held → skip; Redis down →
     fail-open)
   * `_provision` builds a `local:cornelius` create with request=None
@@ -123,18 +125,86 @@ def test_brain_orb_flag_not_clobbered_when_admin_disabled(env):
     assert env.settings.get("cornelius_seeded") == "true"
 
 
+def _conflict(status_code=409):
+    exc = type("FakeHTTPException", (Exception,), {})()
+    exc.status_code = status_code
+    return exc
+
+
+def _set_presence(env, present):
+    """Patch the create path's own claim predicate — the seam the seeder probes
+    to tell a real "already exists" 409 from a blocked-creation 409 (#1790)."""
+    import services.agent_service.crud as crud
+
+    env.monkeypatch.setattr(crud, "agent_name_is_taken", lambda name: present)
+
+
 def test_409_on_exists_is_treated_as_seeded(env):
     """A concurrent worker (or prior partial run) already created the agent →
-    create raises 409 → converge the flag instead of erroring/retrying forever."""
-    exc = type("FakeHTTPException", (Exception,), {})()
-    exc.status_code = 409
-    env.provision.side_effect = exc
+    create raises 409 AND the name is claimed → converge the flag instead of
+    erroring/retrying forever."""
+    _set_presence(env, True)
+    env.provision.side_effect = _conflict()
     result = _run()
     assert env.settings.get("cornelius_seeded") == "true"
     assert env.settings.get("brain_orb_enabled") == "true"
     assert result["action"] == "already_exists"
 
 
+def test_409_with_no_agent_does_not_burn_flag(env):
+    """#1790 regression. The create path raises 409 for conditions where nothing
+    was created — the classic one being a leftover unclaimed
+    `agent-cornelius-workspace` after `docker compose down -v` (#1667). Marking
+    seeded there is unrecoverable: the flag suppresses every later attempt, so the
+    install stays Cornelius-less forever while reporting success. The flag must
+    stay unset so the next boot retries."""
+    _set_presence(env, False)
+    env.provision.side_effect = _conflict()
+    result = _run()
+    assert env.settings.get("cornelius_seeded") is None       # flag NOT burned
+    assert env.settings.get("brain_orb_enabled") is None      # nothing converged
+    assert result["action"] == "create_blocked"
+    assert result["status"] == "error"
+
+
+def test_409_presence_probe_failure_fails_toward_retry(env):
+    """The probe itself blowing up must not converge the flag. The two errors are
+    not symmetric: a wrong "absent" costs one redundant create attempt, a wrong
+    "present" is unrecoverable without hand-editing system_settings."""
+    import services.agent_service.crud as crud
+
+    def _boom(name):
+        raise RuntimeError("db down")
+
+    env.monkeypatch.setattr(crud, "agent_name_is_taken", _boom)
+    env.provision.side_effect = _conflict()
+    result = _run()
+    assert env.settings.get("cornelius_seeded") is None
+    assert result["action"] == "create_blocked"
+
+
+def test_presence_probe_reads_every_claim_source(monkeypatch):
+    """The seeder must not re-derive its own notion of "exists" — it reuses the
+    create path's predicate, so a claim source added there (live row, soft-deleted
+    row, container-only leftover) is honoured here for free."""
+    import services.agent_service.crud as crud
+
+    sources = ["get_agent_by_name", "get_agent_owner", "is_agent_name_reserved"]
+    for claimed_by in sources:
+        monkeypatch.setattr(crud, "get_agent_by_name", lambda n: None)
+        monkeypatch.setattr(crud.db, "get_agent_owner", lambda n: None)
+        monkeypatch.setattr(crud.db, "is_agent_name_reserved", lambda n: False)
+        target = crud if claimed_by == "get_agent_by_name" else crud.db
+        monkeypatch.setattr(target, claimed_by, lambda n: {"agent_name": "cornelius"})
+        assert crud.agent_name_is_taken("cornelius") is True, claimed_by
+
+    # Nothing claims it → free.
+    monkeypatch.setattr(crud, "get_agent_by_name", lambda n: None)
+    monkeypatch.setattr(crud.db, "get_agent_owner", lambda n: None)
+    monkeypatch.setattr(crud.db, "is_agent_name_reserved", lambda n: False)
+    assert crud.agent_name_is_taken("cornelius") is False
+
+
 def test_generic_provision_failure_does_not_burn_flag(env):
     """A real provisioning failure must leave the flag unset so the next trigger
     retries — and must never raise out of ensure_seeded."""

From 46ccaf0b670a9232bc00dc3a2236c0b49cc917b1 Mon Sep 17 00:00:00 2001
From: dolho <66411456+dolho@users.noreply.github.com>
Date: Mon, 27 Jul 2026 15:26:37 +0300
Subject: [PATCH 06/25] fix(create): reject an unresolvable local: template
 instead of creating an empty agent (#1793) (#1803)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(create): reject an unresolvable local: template instead of creating an empty agent (#1793)

`_resolve_local_template` returned an empty `template_data` when the name
matched no `template.yaml` under either root. Creation carried on and
provisioned a running container with no CLAUDE.md, no template.yaml and no
skills, reported to the caller as a normal 200 with a fabricated
`type: business-assistant`. The agent showed `running` in the fleet list and
answered chat as a generic assistant with no instructions.

The `github:` path already fails fast on an unknown repo; `local:` now
matches that contract with 404 / UNKNOWN_LOCAL_TEMPLATE. The raise sits in
the template-resolution phase, before any side effect, so a rejected create
leaves no container, volume, MCP key or ownership row.

The most exposed caller is the MCP `create_agent` tool, which takes a
free-text template id — a stale or hallucinated id silently produced the
empty agent. A renamed or newly-hidden template did the same to any saved
script.

Behavior preserved:
- templateless creation is still available by omitting `template`
- an invalid/traversal name keeps its existing 400 INVALID_LOCAL_TEMPLATE_NAME
- deploy-local (#950) is unaffected: deploy_local_agent_logic already
  validates the archive has a template.yaml before writing it

The body of the load block is dedented one level now that the existence
check is a guard clause; no logic inside it changed.

Related to #1793

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* refactor(create): keep the load block intact, raise from an else branch (#1793)

CodeQL flagged two new py/path-injection alerts on this PR at the
template_yaml `.exists()` and `open()` calls. Both are false positives —
raw_name passes a regex allowlist and the joined path is resolved and
checked with is_relative_to before any filesystem access, which
_safe_local_template_path documents as the barrier CodeQL recognises. They
surfaced only because the guard-clause refactor dedented the whole load
block, moving those two expressions onto new lines and re-fingerprinting
alerts that were already dismissed on dev.

Same behavior, expressed as if/else instead of a guard clause, so the
existing block is byte-identical to dev and the flagged expressions keep
their original location. The diff is now purely additive.

Related to #1793

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* test(1484): supply the local template the characterization cases assumed (#1793)

The #1484 characterization suite drives the local-template HAPPY path with
`local:scout`, but the unit env has no template roots on disk. Those cases
passed only because a missing template.yaml was silently tolerated — the
exact behavior #1793 removes — so 12 of them started failing with
404 UNKNOWN_LOCAL_TEMPLATE.

_load_crud (the single harness both fixtures use) now points
_LOCAL_TEMPLATE_ROOTS at a tmp root carrying a minimal `scout`
template.yaml, so the cases get the template they always meant to have.

The fixture template is deliberately minimal — `type` only, no `resources`
and no `avatar_prompt` — so the pinned container kwargs (mem_limit 4g,
nano_cpus 2) are unchanged and set_default_avatar stays unreached for every
case except the one that builds its own root. Cases that monkeypatch
_LOCAL_TEMPLATE_ROOTS themselves still win: their setattr runs after this.

Case 1 asserts binds as a subset, so the additional /template bind that now
appears does not affect it.

40/40 characterization cases pass.

Related to #1793

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 src/backend/services/agent_service/crud.py    |  24 +++-
 ...test_1484_create_agent_characterization.py |  18 +++
 .../unit/test_1793_unknown_local_template.py  | 130 ++++++++++++++++++
 3 files changed, 171 insertions(+), 1 deletion(-)
 create mode 100644 tests/unit/test_1793_unknown_local_template.py

diff --git a/src/backend/services/agent_service/crud.py b/src/backend/services/agent_service/crud.py
index ee2dfa4af..051f2d841 100644
--- a/src/backend/services/agent_service/crud.py
+++ b/src/backend/services/agent_service/crud.py
@@ -672,7 +672,11 @@ async def _reserve_git_instance(
 def _resolve_local_template(config: AgentConfig) -> tuple[dict, Optional[dict]]:
     """Load a `local:`-prefixed template's `template.yaml` (curated catalog then
     deploy-local store, #950). Mutates `config` runtime/type/resources/tools/
-    mcp_servers fields. Returns `(template_data, template_shared_folders)`."""
+    mcp_servers fields. Returns `(template_data, template_shared_folders)`.
+
+    Raises `HTTPException(404, UNKNOWN_LOCAL_TEMPLATE)` when the name resolves
+    to no `template.yaml` under either root (#1793) — this previously returned
+    an empty dict and the caller provisioned a templateless container."""
     template_data: dict = {}
     template_shared_folders = None
     # Local template - strip "local:" prefix. Look in curated catalog
@@ -718,6 +722,24 @@ def _resolve_local_template(config: AgentConfig) -> tuple[dict, Optional[dict]]:
                     }
         except Exception as e:
             logger.warning(f"Error loading template config: {e}")
+    else:
+        # #1793: an unresolvable `local:` template must fail before any side
+        # effect. Falling through with an empty `template_data` provisioned a
+        # running container with no CLAUDE.md, no template.yaml and no skills —
+        # an empty shell reported to the caller as a normal 200 creation. The
+        # `github:` path already fails fast on an unknown repo; this matches it.
+        raise HTTPException(
+            status_code=404,
+            detail={
+                "error": (
+                    f"Local template {raw_name!r} was not found. Check the id "
+                    f"against GET /api/templates — templates marked hidden are "
+                    f"not deployable. To create an agent with no template at "
+                    f"all, omit the 'template' field."
+                ),
+                "code": "UNKNOWN_LOCAL_TEMPLATE",
+            },
+        )
     return template_data, template_shared_folders
 
 
diff --git a/tests/unit/test_1484_create_agent_characterization.py b/tests/unit/test_1484_create_agent_characterization.py
index 94bf0aea9..ce88d81b7 100644
--- a/tests/unit/test_1484_create_agent_characterization.py
+++ b/tests/unit/test_1484_create_agent_characterization.py
@@ -246,6 +246,24 @@ def _load_crud(monkeypatch, docker_available=True):
         if (key == "services" or key.startswith("services.")) and key not in mocks:
             monkeypatch.delitem(sys.modules, key, raising=False)
     import services.agent_service.crud as crud
+
+    # #1793: an unresolvable `local:` template is now a 404 instead of a
+    # silent templateless creation. These cases exercise the local-template
+    # HAPPY path with `local:scout`, and passed previously only because the
+    # unit env has no template roots on disk — the missing template.yaml was
+    # tolerated. Point the roots at a tmp dir carrying a minimal `scout` so
+    # the fixture supplies the template the cases always assumed. Deliberately
+    # minimal (no `resources`, no `avatar_prompt`) so the pinned container
+    # kwargs — mem_limit 4g / nano_cpus 2 — are unchanged, and so
+    # set_default_avatar stays unreached for every case but the one that
+    # builds its own root. Cases that monkeypatch `_LOCAL_TEMPLATE_ROOTS`
+    # themselves still win: their setattr runs after this.
+    _tpl_root = Path(tempfile.mkdtemp(prefix="trinity_1484_templates_"))
+    _scout = _tpl_root / "scout"
+    _scout.mkdir()
+    (_scout / "template.yaml").write_text("type: business-assistant\n")
+    monkeypatch.setattr(crud, "_LOCAL_TEMPLATE_ROOTS", (_tpl_root, _tpl_root))
+
     return crud, {
         "patcher": patcher,
         "db": db,
diff --git a/tests/unit/test_1793_unknown_local_template.py b/tests/unit/test_1793_unknown_local_template.py
new file mode 100644
index 000000000..700944645
--- /dev/null
+++ b/tests/unit/test_1793_unknown_local_template.py
@@ -0,0 +1,130 @@
+"""
+Regression for #1793 — an unresolvable `local:` template must fail, not
+silently produce a templateless agent.
+
+Before this fix, `_resolve_local_template` returned an empty `template_data`
+when the name matched no `template.yaml` under either root. The caller carried
+on and provisioned a running container with no CLAUDE.md, no template.yaml and
+no skills, and `POST /api/agents` reported a normal 200 creation. The
+`github:` path already failed fast on an unknown repo; these tests pin the
+`local:` path to the same contract.
+
+`services.agent_service.crud` is imported lazily inside each test body rather
+than at module level — same rationale as `tests/unit/test_deploy_writable_templates.py`
+and `tests/unit/test_local_templates_listing.py` (importing the crud chain at
+collection time trips the documented tests/utils-shadows-backend-utils
+sys.modules race). Roots are monkeypatched via the module attribute, so no
+`sys.modules[...] =` assignment is introduced (keeps `tests/lint_sys_modules.py`
+green).
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from fastapi import HTTPException
+
+TEMPLATE_YAML = """\
+name: fixture-template
+type: research-agent
+runtime:
+  type: claude-code
+resources:
+  cpu: "2"
+  memory: "4g"
+"""
+
+
+def _config(template: str):
+    from models import AgentConfig
+
+    return AgentConfig(name="t1793", template=template)
+
+
+def _patch_roots(monkeypatch, curated: Path, deployed: Path) -> None:
+    from services.agent_service import crud
+
+    monkeypatch.setattr(
+        crud, "_LOCAL_TEMPLATE_ROOTS", (curated.resolve(), deployed.resolve())
+    )
+
+
+def test_unknown_local_template_raises_404(monkeypatch, tmp_path):
+    """A name present under neither root is rejected before any side effect."""
+    from services.agent_service import crud
+
+    curated = tmp_path / "curated"
+    deployed = tmp_path / "deployed"
+    curated.mkdir()
+    deployed.mkdir()
+    _patch_roots(monkeypatch, curated, deployed)
+
+    with pytest.raises(HTTPException) as exc:
+        crud._resolve_local_template(_config("local:does-not-exist"))
+
+    assert exc.value.status_code == 404
+    assert exc.value.detail["code"] == "UNKNOWN_LOCAL_TEMPLATE"
+    # The message must name the template so the caller can spot a typo.
+    assert "does-not-exist" in exc.value.detail["error"]
+
+
+def test_directory_without_template_yaml_raises_404(monkeypatch, tmp_path):
+    """A directory that exists but carries no template.yaml is still unusable.
+
+    This is the shape that produced the empty agent: the path resolved, so the
+    old code proceeded with an empty template_data.
+    """
+    from services.agent_service import crud
+
+    curated = tmp_path / "curated"
+    deployed = tmp_path / "deployed"
+    (curated / "hollow").mkdir(parents=True)
+    deployed.mkdir()
+    _patch_roots(monkeypatch, curated, deployed)
+
+    with pytest.raises(HTTPException) as exc:
+        crud._resolve_local_template(_config("local:hollow"))
+
+    assert exc.value.status_code == 404
+    assert exc.value.detail["code"] == "UNKNOWN_LOCAL_TEMPLATE"
+
+
+@pytest.mark.parametrize("root_index", [0, 1])
+def test_resolvable_template_still_loads(monkeypatch, tmp_path, root_index):
+    """The happy path is unchanged under both roots (curated and deploy-local)."""
+    from services.agent_service import crud
+
+    roots = [tmp_path / "curated", tmp_path / "deployed"]
+    for r in roots:
+        r.mkdir()
+    target = roots[root_index] / "fixture-template"
+    target.mkdir()
+    (target / "template.yaml").write_text(TEMPLATE_YAML)
+    _patch_roots(monkeypatch, roots[0], roots[1])
+
+    config = _config("local:fixture-template")
+    template_data, shared_folders = crud._resolve_local_template(config)
+
+    assert template_data["name"] == "fixture-template"
+    # Template fields are still projected onto the config.
+    assert config.type == "research-agent"
+    assert config.runtime == "claude-code"
+    assert shared_folders is None
+
+
+def test_invalid_name_still_400_not_404(monkeypatch, tmp_path):
+    """Traversal-ish names keep their existing 400 — #1793 must not mask it."""
+    from services.agent_service import crud
+
+    curated = tmp_path / "curated"
+    deployed = tmp_path / "deployed"
+    curated.mkdir()
+    deployed.mkdir()
+    _patch_roots(monkeypatch, curated, deployed)
+
+    with pytest.raises(HTTPException) as exc:
+        crud._resolve_local_template(_config("local:../etc"))
+
+    assert exc.value.status_code == 400
+    assert exc.value.detail["code"] == "INVALID_LOCAL_TEMPLATE_NAME"

From 86f8493e10af7f38e283a207d1d9254734d52e00 Mon Sep 17 00:00:00 2001
From: "andrii.pasternak" <44377756+AndriiPasternak31@users.noreply.github.com>
Date: Tue, 28 Jul 2026 10:38:39 +0100
Subject: [PATCH 07/25] fix(agents): reject an invalid local: template and ship
 the missing local:default (#1759) (#1824)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* test(agents): failing tests for absent local: template (#1759)

TDD RED first. Proven failing on the pristine cut base f7aff466:
18 failed, 13 passed — T1 fails with the exact defect,
"Failed: DID NOT RAISE HTTPException".

- test_1759_local_template_not_found.py — T1 (400 + no side effects),
  T1b/T1c (no path/root disclosure, one identical message), T2/T3
  (curated + deploy-local roots still create), T4 (dir without
  template.yaml), T5 (empty/non-dict), T6 (unparseable YAML),
  T7 (Blank Agent unaffected), T8 (traversal barrier keeps
  precedence), T10 (/template bind source, incl. the empty-env case).
  Every test monkeypatches crud._LOCAL_TEMPLATE_ROOTS to real tmp
  dirs, never template_service (MagicMocked in the #1484 harness).
- test_1759_template_root_parity.py — T9: create resolver vs listing
  surface, deliberately NOT using the _load_crud mock harness.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(agents): reject an absent local: template with a named 400 (#1759)

A well-formed `local:<name>` whose directory (or template.yaml) did not
exist under either root fell through `_resolve_local_template` with no
`else` — `template_data == {}`, the same HTTP 200 as success, and a
blank container with no instructions. Sibling of the unprefixed case

- Gate: `LOCAL_TEMPLATE_NOT_FOUND` 400 raised inside
  `_resolve_local_template`, the same pre-side-effect band as
  FORK_REQUIRES_GITHUB_TEMPLATE. Nothing between it and the docker
  try-block allocates a resource, so no rollback is needed and the 4xx
  is not flattened to a 500. `create_agent_internal` gains ZERO lines
  (#1484: 118 SLOC before and after).
- ONE identical message whichever root missed, with no filesystem path
  and no root name: deploy-local templates (#950) are named after AGENT
  names, so a root-distinguishing error would let a creator-role caller
  probe another user's deploy-local agents (#186 adjacency).
- D5: an empty / non-dict / unparseable template.yaml produced the
  identical blank-agent outcome via `except Exception: logger.warning`.
  Narrowed to (OSError, yaml.YAMLError) -> 400 LOCAL_TEMPLATE_INVALID,
  plus an isinstance guard. The listing path already rejected both, so
  create was strictly less strict than the surface advertising the
  template. Field-level malformation still degrades gracefully.
- Repo-relative curated root (`parents[4]`, hand-rolled — importing
  template_service would be satisfied by the #1484 harness MagicMock),
  so the gate is not inert wherever the test suite runs (#1638
  accidental-green). Both seams take it: the resolver AND the /template
  bind, whose base is now `os.getenv(...) or _default_host_templates_base()`
  — an empty HOST_TEMPLATES_PATH made `Path("")/name` a bare name, i.e.
  an empty NAMED VOLUME at /template: this bug class, one seam over.

Container path is byte-identical (compose always sets
HOST_TEMPLATES_PATH). Create-time only — rebuild/recreate reads
template.yaml off the persisted volume, so no running agent is affected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* feat(templates): ship a real hidden `local:default` template (#1759)

AC#2. `local:default` is referenced 46× in tests/test_systems.py (~19
agent-creating deploys), in test_subscriptions.py and
test_agent_lifecycle.py, and in ~35 lines across 6 doc files — but no
`default` directory has ever existed. Once create hard-fails on an
absent template those all 400. Shipping the template honours the
already-published contract; repointing ~85 refs is mechanical churn
across three live-server suites for zero product value.

- `hidden: true` (house convention: test-*, demo-*, sleep-echo,
  trinity-system): it stays resolvable by id and creatable, but never
  enters the user-facing picker, where it would duplicate the UI's own
  "Blank Agent" option.
- template.yaml declares NO `resources:` — nor type/tools/runtime/
  shared_folders/credentials.mcp_servers. `_resolve_local_template`
  applies a template's `resources` OVER the caller's, so a copy-pasted
  block would neutralise the ent#125 partial-deploy test's deliberate
  `cpu: "3"` failure vector and flip it from `partial` to `deployed`.
  Every existing fixture declares `resources`, so the copy-paste path
  lands straight on this landmine — hence the in-file warning comment.
- CLAUDE.md ships too: ent#239 codifies "a template.yaml with no
  CLAUDE.md deploys an agent with no instructions" as a quality failure.
- `default` added to the listing guard's explicit `forbidden` set: it
  matches neither the test-/demo- prefix convention nor any other check,
  so dropping `hidden: true` would leak it to every user with no CI
  signal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(systems): export a resolvable template for template-less agents (#1759)

`export_manifest` built each entry as
`agent.get('template', 'local:business-assistant')`, broken twice:

1. `dict.get(key, default)` returns the default only when the key is
   ABSENT. Every Blank Agent's dict carries `"template": None`
   (routers/agents.py), so the fallback was unreachable DEAD CODE and
   blank agents have always exported `template: null`. As
   `SystemAgentConfig.template` is a non-Optional `str`, redeploying
   that manifest already failed Pydantic validation.
2. `config/agent-templates/business-assistant` has never existed, so
   even a reachable fallback named a template that now 400s.

So this fixes a PRE-EXISTING broken round-trip on the platform's most
common agent type — the create-time gate does not cause it. Uses `or`
(the same footgun as the HOST_TEMPLATES_PATH `os.getenv` default, twice
in one change) and `local:default`, which is truthful for a
template-less agent where a product template would fabricate
provenance. A `logger.warning` names the inferred agents:
`export_manifest` returns a bare YAML string, so a structured field
would change the response contract.

Also adds the AC#3 test: the create-time 400 reaches the operator
through ent#125's per-agent `failed[]` (status_code 400, reason = the
self-contained sentence, sibling agent still deployed, manifest not
aborted). No new plumbing — the test proves the machinery already
works, and pins that `_failure_reason` drops `detail["code"]`, which is
why the sentence must stand alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(templates): document the LOCAL_TEMPLATE_NOT_FOUND contract (#1759)

Docs delta decided at plan time (Trinity Rule #1 — tiered updates).

- requirements/core-agent.md §4.1: a bug fix is normally commit-message
  only, but this ADDS a named error code to a documented create-path
  contract, and §4 already documents sibling codes
  (FORK_TO_OWN_REQUIRED, the `local:` rejection). Records the ordering
  against INVALID_LOCAL_TEMPLATE_NAME, the Blank-Agent carve-out, the
  one-message-per-root disclosure rule, and the ent#125 failed[] path.
- feature-flows/system-manifest.md: 5 `local:business-assistant`
  examples repointed to `local:default`. That directory has NEVER
  existed, so those copy-pasteable manifests would now 400.
- onboarding: the 3 UI-template-PICKER mentions of `local:default` now
  name visible starters (scout/scribe). `default` ships `hidden: true`,
  so it never appears in the Create-Agent picker those lines describe.
  The ~30 remaining manifest/API `local:default` examples stay valid —
  that is the payoff of shipping the template.
- learnings.md 2026-07-23: annotated CLOSED; that entry ended "the
  loud-reject follow-up is tracked as its own bug" — this is it.
- architecture.md deliberately NOT changed: its crud.py entry is a
  <=2-line catalog entry per that file's own editorial rules, and a
  named 400 inside one helper is below that granularity. Recorded as a
  decision, not an oversight.

Two test fixups the fix makes necessary:
- test_systems.py TestResilientDeploy docstring asserted the BUG as
  fact ("a well-formed but absent local: template does NOT fail") and
  would have become a lie in the exact place the next engineer reads.
- test_agent_lifecycle.py `if response.status_code in [200, 201]` was
  tolerating a template that never existed; with `local:default` real
  and absence now fatal, that tolerance only hid failures. Tightened to
  assert_status_in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(feature-flows): sync template-processing with the #1759 gate

/sync-feature-flows tail step.

- template-processing.md "Local Templates" was materially stale: it
  showed a single-root lookup with an inline `templates_dir` fallback
  and no `_safe_local_template_path`, i.e. the pre-#950 shape. Replaced
  with the real two-root resolution, the CodeQL barrier, the #1759
  failure-contract table (which condition yields which of the three
  400 codes, and that Blank Agent never enters the branch), the
  pre-side-effect / zero-orchestrator-lines placement, the one-message
  disclosure rule, and the two-seam note incl. the empty
  HOST_TEMPLATES_PATH named-volume trap.
- feature-flows.md: Recent Updates row (the index row this tail step
  reliably drops).

Note: the Recent Updates table carries 52 rows against its own stated
"newest ~20" cap (#1360) — pre-existing drift, deliberately not
trimmed here (out of scope for a P2 bug fix).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(models,tests): correct two comments that named the old behaviour (#1759)

- models.py:571 `SystemAgentConfig.template` cited
  `local:business-assistant` as its canonical example — a template that
  has never existed on disk and now 400s on create. This is the exact
  field the exporter fix hinges on, so the example being wrong is the
  worst place for it. Repointed to a shipped starter.
- test_ent124_default_system_seed.py: the bundled-manifest guard's
  docstring asserted "an absent local: template creates a BLANK agent"
  as present-tense fact. Updated to say #1759 closed that and why the
  check is still worth keeping (collection-time failure with a precise
  message vs a runtime seed failure landing in the operator queue, and
  it still covers the ent#239 CLAUDE.md half the create gate never
  checks).

Verified by hand: every `local:` reference in config/ and src/ resolves
to a real template directory — the three shipped manifests
(default-system, acme-consulting, research-network) and the Cornelius
first-run seed are all safe. Only the two comments above referenced the
nonexistent one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* test(templates): make the path-disclosure guard actually guard (#1759)

The `_leaked_paths` helper is the general backstop behind the plan's single
binding security rule: ONE identical message whichever root missed, echoing
no resolved path — because deploy-local templates (#950) are named after
AGENT names, so "which root missed" is itself a #186 enumeration oracle.

The guard did not enforce that rule. `(?:^|\s)(/...)` only sees a path
preceded by whitespace, so it was blind to a path wrapped in ANY punctuation
— including `!r`, which is the quoting style these very messages already use
for `config.template`. A future `f"...{template_path!r}..."` emits
`'/data/deployed-templates/x'` and sailed straight through. Executed: 8 of 9
leak shapes were MISSED (repr-quoted, double-quoted, parenthesised,
colon-prefixed, backticked, relative, ...).

Worse, no assertion in the file covered the RELATIVE form. t1b's full
pre-fix assertion set — all five substring checks plus `_leaked_paths` —
passes a message reading "no template.yaml under
data/deployed-templates/acme-payroll-agent", which discloses another user's
deploy-local agent name exactly as the absolute form would.

Two changes, both test-only:

- Negative lookbehind `(?<![A-Za-z0-9_.\-/])` instead of a leading-whitespace
  anchor, so a `/` is "absolute" whenever it does not continue a relative
  path. `config/agent-templates/` stays clean (its `/` follows `g`);
  `/api/...` remains the one allowed `/`-rooted form.
- `_SENSITIVE_ROOT_TOKENS` — naming either root is banned with or without a
  leading slash. `agent-templates` is deliberately NOT listed; it is the
  public, intentional remedy.

Verified: all 9 leak shapes now caught, 0 false positives on the three real
messages, and an end-to-end mutant that leaks `{template_path!r}` fails t1b.
POSIX-only is deliberate, not an oversight — every path reaching these
messages is a `pathlib.Path` built inside the Linux backend container, so a
Windows branch would be dead regex.

Also covers seam 2's CONTAINER branch, which had no test at all: every other
test runs on a source checkout where `/agent-configs/templates` is absent, so
only the repo-fallback branch was exercised. D1-A3's justification for
widening the bind seam is "the delta in the verified container path is
provably zero" — that claim now has a test. Pointing the module global at a
real directory exercises the in-container branch without a container.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(templates): name the template in the partially-applied-config warning (#1759)

deliberately kept a broad `except Exception` around the FIELD mutation that
follows. That decision is right and is left standing: the file parsed, the
agent does get its template files, and only some `config` mutations are
skipped. Tightening it to a 400 would reject templates that deploy
successfully today, which is outside this issue's acceptance criteria.

What was not right is that the swallow was unfindable. The mutations run in
order, so a raise part-way through leaves a PARTIALLY applied template — e.g.
`credentials: "a string"` applies type/resources/tools and then silently skips
mcp_servers/runtime/shared_folders. The message was
`f"Error loading template config: {e}"`: it named neither the template nor the
agent, so an operator holding a subtly-wrong agent had nothing to grep for.

Log-only. No HTTP status, no control flow, and no config value changes.

Adds a regression test that pins two things the swallow must never lose:

1. It stays a DEGRADE. The handler runs inside an `except`, so a bug in the
   handler itself converts a graceful degrade into a 500 on the create path.
   Proven load-bearing by mutation: replacing `config.name` with a
   non-existent attribute makes the test fail, and restoring it makes it pass.
2. The warning names both the template and the agent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(learnings): record the decorative-disclosure-guard class (#1759)

The #1759 review found `_leaked_paths` — the backstop behind the fix's one
binding security rule — missing 8 of 9 leak shapes, including the `!r` form
those same messages already use. Records the durable rule so a future plan
writes the adversarial table before trusting the guard.

Same family as the #1644 "a guard that fails open manufactures confidence"
and #1638 "a test asserting the defective behaviour ships it green" entries,
one level up: a guard that never fires at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(templates): explain why the parents[4] fallback is unreachable (#1759)

`_repo_local_templates_dir` indexes `parents[4]`, which the container
layout (`/app/services/agent_service/crud.py`, 4 parents) cannot
satisfy. Record why that is latent rather than live: the fallback runs
only when `/agent-configs/templates` is missing, and both compose files
always bind it on `backend`, so `_LOCAL_TEMPLATE_ROOTS[0]` resolves
first. The defensive `len(parents) <= 4` guard is a flagged follow-up.

Comment only — no behaviour change, so the shipped artifact stays
byte-equivalent to the one /verify-local exercised.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(submodule): drop accidental .claude pointer bump (#1759)

The branch carried .claude at 3dbde4bf, a commit that exists only on an
unmerged trinity-dev branch — pinning the public repo's submodule there
would break 'git submodule update' for every clone if that branch is
rebased or deleted. Reverts the pointer to de7fc716, the trinity-dev
main tip that dev already points at. No other content change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Eugene Vyborov <1073874+vybe@users.noreply.github.com>
---
 config/agent-templates/README.md              |   1 +
 config/agent-templates/default/CLAUDE.md      |  23 +
 config/agent-templates/default/template.yaml  |  22 +
 docs/memory/feature-flows.md                  |   1 +
 docs/memory/feature-flows/system-manifest.md  |  10 +-
 .../feature-flows/template-processing.md      |  93 ++-
 docs/memory/learnings.md                      |  10 +-
 docs/memory/requirements/core-agent.md        |   4 +
 docs/onboarding/02-use-case-scenarios.md      |   6 +-
 docs/onboarding/03-common-workflows.md        |   2 +-
 src/backend/models.py                         |   2 +-
 src/backend/services/agent_service/crud.py    | 213 ++++-
 src/backend/services/system_service.py        |  33 +-
 tests/registry.json                           |  35 +
 tests/test_agent_lifecycle.py                 |  12 +-
 tests/test_systems.py                         |  13 +-
 ...test_1484_create_agent_characterization.py |   8 +-
 .../test_1759_export_manifest_template.py     | 126 +++
 .../test_1759_local_template_not_found.py     | 786 ++++++++++++++++++
 tests/unit/test_1759_template_root_parity.py  | 205 +++++
 tests/unit/test_ent124_default_system_seed.py |  11 +-
 .../test_ent125_resilient_system_deploy.py    |  49 ++
 tests/unit/test_local_templates_listing.py    |   6 +
 23 files changed, 1597 insertions(+), 74 deletions(-)
 create mode 100644 config/agent-templates/default/CLAUDE.md
 create mode 100644 config/agent-templates/default/template.yaml
 create mode 100644 tests/unit/test_1759_export_manifest_template.py
 create mode 100644 tests/unit/test_1759_local_template_not_found.py
 create mode 100644 tests/unit/test_1759_template_root_parity.py

diff --git a/config/agent-templates/README.md b/config/agent-templates/README.md
index d448f4e0d..69010019c 100644
--- a/config/agent-templates/README.md
+++ b/config/agent-templates/README.md
@@ -47,5 +47,6 @@ These directories are **excluded from the user-facing catalog** (`GET /api/templ
 - **Test/canary fixtures** — `test-echo`, `test-counter`, `test-delegator`, `test-codex`, `test-gemini`, `test-leak-hook`, `sleep-echo`. Used by the test suite and the canary harness; `test-leak-hook` is a deliberately hazardous subprocess-leak repro — do **not** deploy it in production.
 - **Demo fixtures** — `demo-researcher`, `demo-analyst`. A minimal producer→consumer shared-folder pair deployed together by the demo-fleet manifests, not a starting point to build on.
 - **Platform agent** — `trinity-system`. Auto-deployed and deletion-protected platform-operations agent; not something you create yourself.
+- **Minimal reference** — `default`. The smallest template that still resolves: no tools, no schedules, no shared folders. It backs the `local:default` id used by the manifest/API documentation and the integration suites, so those examples deploy a real (if empty) agent instead of silently producing a blank container (#1759). To start a genuinely empty agent from the UI, use **Blank Agent** — not this.
 
 Adding a new fixture? Set `hidden: true` in its `template.yaml` so it never leaks into the catalog (a unit test guards this — see `tests/unit/test_local_templates_listing.py`).
diff --git a/config/agent-templates/default/CLAUDE.md b/config/agent-templates/default/CLAUDE.md
new file mode 100644
index 000000000..79b2736dd
--- /dev/null
+++ b/config/agent-templates/default/CLAUDE.md
@@ -0,0 +1,23 @@
+# Default Agent
+
+You are a general-purpose Trinity agent with no preconfigured specialty.
+
+This is the smallest template that still resolves: no tools, no schedules,
+no shared folders, no MCP servers. It exists so that `local:default` — the id
+used throughout the manifest and API documentation and by the integration
+suites — is a real, deployable template rather than a name that silently
+produced a blank container.
+
+## What to do
+
+1. Do what the user asks, using the tools available to you.
+2. If a request needs a capability you do not have, say so plainly and
+   describe what would be needed — never pretend to have run something.
+3. Keep responses short and concrete.
+
+## Making this agent your own
+
+Replace this file with real instructions. Everything that gives an agent a
+personality, a job, and a workflow lives here; `template.yaml` only carries
+metadata. See `docs/TRINITY_COMPATIBLE_AGENT_GUIDE.md` for the full schema,
+and `config/agent-templates/scout/` for a worked example.
diff --git a/config/agent-templates/default/template.yaml b/config/agent-templates/default/template.yaml
new file mode 100644
index 000000000..f25a6949f
--- /dev/null
+++ b/config/agent-templates/default/template.yaml
@@ -0,0 +1,22 @@
+name: default
+# Excluded from the user-facing template catalog (GET /api/templates). See
+# README "Not starting points". The UI already offers "Blank Agent" for this
+# job; `local:default` exists as the documented minimal manifest/API example.
+# (#1759)
+hidden: true
+display_name: Default
+description: Minimal agent — no tools, no schedules, no shared folders. The smallest template that still resolves; used by manifest and API examples and by the integration suites.
+version: "1.0.0"
+author: Trinity Platform
+
+# DELIBERATELY DECLARES NO `resources:` BLOCK.
+#
+# `_resolve_local_template` applies a template's `resources` OVER the caller's
+# requested values (crud.py, before normalize_cpu runs), so a `resources:` block
+# here would silently overwrite what a manifest asked for. The ent#125
+# resilient-deploy test uses `resources: {cpu: "3"}` on a `local:default` agent
+# as its deliberate pre-side-effect failure vector — a `resources:` block would
+# neutralise it and flip that test from `partial` to `deployed`. Same reasoning
+# for `type`, `tools`, `credentials.mcp_servers`, `runtime` and
+# `shared_folders`: every field the resolver mutates `config` from is omitted.
+credentials: {}
diff --git a/docs/memory/feature-flows.md b/docs/memory/feature-flows.md
index 992161e70..2e79f92d6 100644
--- a/docs/memory/feature-flows.md
+++ b/docs/memory/feature-flows.md
@@ -23,6 +23,7 @@
 
 | Date | ID | Change | Flow |
 |------|-----|--------|------|
+| 2026-07-27 | #1759 | fix(agents): an **invalid `local:` template now fails loudly**, and the `local:default` id resolves again. Companion to #1793 (PR #1803), which closed the *absent*-template half with 404 `UNKNOWN_LOCAL_TEMPLATE`; the two were filed and built in parallel against the same line and #1759 conceded that contract at merge. What remained unfixed: an empty/non-mapping/unparseable `template.yaml` still reached the identical blank-agent-at-200 outcome through the broad `except Exception: logger.warning` — now **400 `LOCAL_TEMPLATE_INVALID`**, same pre-side-effect band, with the broad `except` narrowed to field-level degradation only (and its warning now naming the template + agent). The curated root gains a repo-relative fallback (hand-rolled — importing `template_service` would be satisfied by the #1484 harness MagicMock; guarded against `IndexError` in the container layout, where it is computed at import time) so the gate is not inert wherever the suite runs; **both** seams take it, and the `/template` bind base becomes `os.getenv(...) or _default_host_templates_base()` (an empty `HOST_TEMPLATES_PATH` made `Path("")/name` an empty NAMED VOLUME — the same bug class one seam over). Ships `config/agent-templates/default/` (hidden, deliberately no `resources:` — it would neutralise ent#125's `cpu: "3"` failure vector), **fixing a live regression #1793 introduced**: `local:default` is named 46× in `tests/test_systems.py` and by `export_manifest`, and with no such template on disk the new 404 broke every one of those deploys — invisible to CI, which collects `tests/unit/` only. `export_manifest`'s unreachable `local:business-assistant` `.get` default fixed with `or` (pre-existing broken round-trip for Blank Agents, not a regression). Manifest deploys surface the reject per agent via ent#125 `failed[]`. Together these close the follow-up left open by #843. | [template-processing.md](feature-flows/template-processing.md), [system-manifest.md](feature-flows/system-manifest.md) |
 | 2026-07-18 | #1296 | feat: **agent self-reminders** — durable one-shot deferred self-trigger (the time-deferred sibling of loops). New `agent_reminders` table (5-track migration, `AGENT_REFS` CASCADE); the standalone scheduler arms a `DateTrigger` per pending row (`_reconcile_reminders` at boot + 60s sync-loop own-try + full-reload), on fire creates the `schedule_executions` row itself (real id, `__manual__`) and dispatches `triggered_by="reminder"` through the standard `capacity_manager` path. At-least-once delivery (`firing` state + `fire_attempts` cap + stale-firing reclaim; TimeoutException=assume-dispatched-no-force-FAILED, clean-failure=status-guarded FAILED+retry). Self-only MCP `set/list/cancel_reminder` (connector rejected, off the ghost fence); create-idempotency over raw input (terminal rows excluded from replay); bounds (pending 25 / durable daily 100 / min-60s / max-30d / timeout-clamp-to-cap); retention sweep via the #1644 guard. Three trigger constants wired (first-class "Reminders" bucket). | [agent-self-reminders.md](feature-flows/agent-self-reminders.md) |
 | 2026-07-17 | #1632 | fix(operator-queue): ingestion **rate/depth/size caps** at the agent-authored sync seam (blocking pull default-ON). Per-agent DB-measured pending-**DEPTH** cap (primary, Redis-independent) + per-agent/fleet **RATE** limit (`rate_limiter.check`, fail-open) + total field-hygiene clamp (truncate-with-marker, `created_at` normalized, inside the #1525 try/except) + **reserved-id guard** (an agent can't pre-suppress its own flood alarm / the #1402 poison alert) + oversized-file/scan bounds. Sync loop **leader-locked** (`opqueue:leader`, mirror monitoring #1464). One un-guessable `queue-flood-*` alert per episode. `validation_service` notify → **direct DB create** (exempt-by-construction + latent-bug fix). Generous DB-sink belt. Layers on the #1631 `id`/`request_id` split. | [operating-room.md](feature-flows/operating-room.md) |
 | 2026-07-17 | #1310 | refactor(auth): **INV-8 imperative auth-guard family** — consolidate duplicated inline auth wiring behind five leaf helpers in `dependencies.py` (`assert_admin`, `assert_agent_access`, `assert_agent_owner`, `assert_owns_or_admin`, `assert_owns`), all raising 403 and access-first (self-uniform per #186); the agent-name helpers run `_enforce_connector_scope` first. ~30 router sites migrated (admin/access/owner/Shape-F/strict-self), preserving exact status+detail+admitted-principal set (proven by `test_1310_auth_consolidation`). Static AST drift guard `test_1310_auth_wiring` (`# noqa: inv8` for deferred `slack.py`). `_narrow_to_agent` relocated to the service layer. `public.py` strict-self stays no-admin (`assert_owns`); `sessions._session_or_404` / `nevermined._require_*` / `reports.get_report` kept as intentional-404 exceptions | [role-model.md](feature-flows/role-model.md) |
diff --git a/docs/memory/feature-flows/system-manifest.md b/docs/memory/feature-flows/system-manifest.md
index ee52e46e5..8b9e7855b 100644
--- a/docs/memory/feature-flows/system-manifest.md
+++ b/docs/memory/feature-flows/system-manifest.md
@@ -61,7 +61,7 @@ agents:
         message: "Check progress and adjust"
 
   writer:
-    template: local:business-assistant
+    template: local:default
     folders:
       expose: true
       consume: true
@@ -69,7 +69,7 @@ agents:
       - worker
 
   editor:
-    template: local:business-assistant
+    template: local:default
     folders:
       expose: false
       consume: true
@@ -168,7 +168,7 @@ permissions:
 ```python
 class SystemAgentConfig(BaseModel):
     """Configuration for a single agent in a system manifest."""
-    template: str  # e.g., "github:Org/repo" or "local:business-assistant"
+    template: str  # e.g., "github:Org/repo" or "local:default"
     resources: Optional[dict] = None  # {"cpu": "2", "memory": "4g"}
     folders: Optional[dict] = None  # {"expose": bool, "consume": bool}
     schedules: Optional[List[dict]] = None  # [{name, cron, message, ...}]
@@ -684,7 +684,7 @@ async def list_systems(current_user: User = Depends(get_current_user)):
         {
           "name": "content-production-writer",
           "status": "running",
-          "template": "local:business-assistant"
+          "template": "local:default"
         }
       ],
       "created_at": "2025-12-18T10:00:00Z"
@@ -822,7 +822,7 @@ agents:
       enabled: true
       timezone: UTC
   writer:
-    template: local:business-assistant
+    template: local:default
     folders:
       expose: true
       consume: true
diff --git a/docs/memory/feature-flows/template-processing.md b/docs/memory/feature-flows/template-processing.md
index e84459000..c76b8ec83 100644
--- a/docs/memory/feature-flows/template-processing.md
+++ b/docs/memory/feature-flows/template-processing.md
@@ -199,34 +199,83 @@ if config.template.startswith("github:"):
     git_working_branch = git_service.generate_working_branch(config.name, git_instance_id)
 ```
 
-### Local Templates (`services/agent_service/crud.py:145-182`)
-```python
-elif config.template.startswith("local:"):
-    template_name = config.template[6:]  # Remove "local:" prefix (line 147)
-    templates_dir = Path("/agent-configs/templates")
-    if not templates_dir.exists():
-        templates_dir = Path("./config/agent-templates")
+### Local Templates (`services/agent_service/crud.py::_resolve_local_template`)
 
-    template_path = templates_dir / template_name
-    template_yaml = template_path / "template.yaml"
+Two roots, tried in order (#950): the **curated catalog** and the **deploy-local
+writable store**. Both go through `_safe_local_template_path`, which is the
+CodeQL `py/path-injection` barrier (regex allowlist on the name, then
+`.resolve()` + `is_relative_to(root)`), so every subsequent filesystem call on
+the returned path is untainted.
 
-    if template_yaml.exists():
+```python
+_LOCAL_TEMPLATE_ROOTS = (
+    _curated_templates_root(),                  # /agent-configs/templates, or the
+                                                # in-repo config/agent-templates
+                                                # when that bind mount is absent
+    Path("/data/deployed-templates").resolve(),  # deploy-local store (#950)
+)
+
+raw_name = config.template[6:]                   # strip "local:"
+template_path = _safe_local_template_path(raw_name, _LOCAL_TEMPLATE_ROOTS[0])
+if not (template_path / "template.yaml").exists():
+    template_path = _safe_local_template_path(raw_name, _LOCAL_TEMPLATE_ROOTS[1])
+template_yaml = template_path / "template.yaml"
+
+# The if/else shape is load-bearing — see "CodeQL" below. Do not flatten it.
+if template_yaml.exists():
+    try:
         with open(template_yaml) as f:
             template_data = yaml.safe_load(f)
-            config.type = template_data.get("type", config.type)
-            config.resources = template_data.get("resources", config.resources)
-            config.tools = template_data.get("tools", config.tools)
-            # Extract MCP servers from credentials section (lines 162-165)
-            creds = template_data.get("credentials", {})
-            mcp_servers = list(creds.get("mcp_servers", {}).keys())
-            if mcp_servers:
-                config.mcp_servers = mcp_servers
-            # Multi-runtime support (lines 167-172)
-            runtime_config = template_data.get("runtime", {})
-            # Shared folder config (lines 173-179)
-            shared_folders_config = template_data.get("shared_folders", {})
+    except (OSError, yaml.YAMLError):
+        raise HTTPException(400, {"error": ..., "code": "LOCAL_TEMPLATE_INVALID"})   # #1759
+    if not isinstance(template_data, dict):                                          # yaml.safe_load("") -> None
+        raise HTTPException(400, {"error": ..., "code": "LOCAL_TEMPLATE_INVALID"})   # #1759
+
+    # then mutate config from the template: type / resources / tools /
+    # credentials.mcp_servers / runtime / shared_folders
+else:
+    raise HTTPException(404, {"error": ..., "code": "UNKNOWN_LOCAL_TEMPLATE"})       # #1793
 ```
 
+**Failure contract (#1793 + #1759).** Before this, an unresolvable `local:` id
+returned empty `template_data` and the agent was created anyway — HTTP 200,
+blank container, no warning; only *malformed* names failed. The two halves were
+filed and fixed separately: #1793 (PR #1803) closed the **absent** case, #1759
+the **present-but-invalid** one. Now:
+
+| Condition | Status | Code |
+|---|---|---|
+| Name fails the regex / traversal barrier | 400 | `INVALID_LOCAL_TEMPLATE_NAME` (checked first) |
+| No `template.yaml` under either root | **404** | `UNKNOWN_LOCAL_TEMPLATE` (#1793) |
+| `template.yaml` empty / not a mapping / unparseable | 400 | `LOCAL_TEMPLATE_INVALID` (#1759) |
+| `template` is `null` or `""` (Blank Agent) | 200 | — never enters this branch |
+
+Both raises sit in the same pre-side-effect band as `FORK_REQUIRES_GITHUB_TEMPLATE`
+and the #843 reject: no container, MCP key, volume or slot has been allocated
+yet, so there is nothing to roll back, and it is outside the caller's docker
+try-block so the 4xx is not flattened to a 500. `create_agent_internal` gains
+zero lines (#1484).
+
+**CodeQL — do not flatten the `if/else` into a guard clause.** Dedenting the
+load block moves the `.exists()` and `open()` expressions onto new lines and
+re-fingerprints `py/path-injection` alerts already dismissed as false positives
+on `dev`. #1793 hit this and reverted its own guard-clause refactor for it;
+#1759 re-hit it at merge. New bands go **inside** the existing block.
+
+**Disclosure rule:** one identical message whichever root missed, carrying no
+filesystem path and no root name. Deploy-local templates are named after *agent*
+names, so a root-distinguishing message would let a `creator`-role caller probe
+another user's agents (#186 adjacency).
+
+**Two seams read `_LOCAL_TEMPLATE_ROOTS`** and must stay in agreement: this
+resolver, and the `/template` bind-mount decision in `_stage_config_files`
+(curated templates bind their host path read-only at `/template`; deploy-local
+ones do not, because `deploy.py` already pre-populated the workspace volume via
+`put_archive`). The bind source is
+`os.getenv("HOST_TEMPLATES_PATH") or _default_host_templates_base()` — an
+**empty** env value would otherwise make `Path("") / name` collapse to a bare
+name, which Docker resolves as an empty *named volume* at `/template`.
+
 ---
 
 ## Credential Extraction
diff --git a/docs/memory/learnings.md b/docs/memory/learnings.md
index 54cebd7b7..847b39ef1 100644
--- a/docs/memory/learnings.md
+++ b/docs/memory/learnings.md
@@ -138,7 +138,7 @@ plan or review. `/autoplan` reads this before planning; write for that reader.
 **Lesson**: (1) Container env for a subsystem is often assembled at more than one seam (creation + recreate + rebuild-recovery + ops raw-restart via startup.sh). Before changing an env gate, grep every writer of the same env key (`GITHUB_REPO`, `GIT_SYNC_ENABLED`, …) across `crud.py`, `lifecycle.py`, and `startup.sh` and change them as one unit — a seam left behind reproduces the silent-empty-agent class. (2) Never branch on `is None`/`is False` against resolver returns or Optional[bool] config fields without reading the producer: Trinity resolvers return `""` sentinels, and Optional[bool] admits None — use falsy checks (or normalize at the boundary) and add the explicit-None parametrized test.
 ## 2026-07-23 — pitfall — A well-formed but ABSENT `local:` template silently creates a blank agent; only malformed names fail
 **Context**: ent#125 review. `_resolve_local_template` (crud.py) returns empty `template_data` when `template.yaml` doesn't exist under either root — no raise; only the `_safe_local_template_path` regex/traversal barrier 400s (malformed names). Proof in-tree: every `tests/test_systems.py` manifest uses `template: local:default`, no such template directory exists, and the suite passes because those agents create successfully as blank containers. A planned integration test using `local:nonexistent` as a failure vector would have asserted `partial` and gotten `deployed`.
-**Lesson**: A `local:` template reference is resolved with a silent-fallback loader — "deploy succeeded" does NOT prove the template existed, and a typo'd template name in a manifest (e.g. the ent#124 starter-fleet seed) ships a blank agent with no error. To force a deterministic create failure in tests use `resources: {cpu: "3"}` (normalize_cpu 400, pre-side-effect). Sibling of the 2026-07-06 entry (validate with the executor's own parser); the loud-reject follow-up is tracked as its own bug.
+**Lesson**: A `local:` template reference is resolved with a silent-fallback loader — "deploy succeeded" does NOT prove the template existed, and a typo'd template name in a manifest (e.g. the ent#124 starter-fleet seed) ships a blank agent with no error. To force a deterministic create failure in tests use `resources: {cpu: "3"}` (normalize_cpu 400, pre-side-effect). Sibling of the 2026-07-06 entry (validate with the executor's own parser); the loud-reject follow-up is tracked as its own bug. **CLOSED 2026-07-27 by #1793 + #1759** (the same defect, filed and fixed twice in parallel — see the 2026-07-27 process entry): an unresolvable `local:` id is now a **404 `UNKNOWN_LOCAL_TEMPLATE`** before any side effect (#1793), an empty/non-mapping/unparseable `template.yaml` a **400 `LOCAL_TEMPLATE_INVALID`** (#1759), and `config/agent-templates/default/` ships as a real (hidden) template (#1759) so the `local:default` id the docs and suites already used resolves. The `resources: {cpu: "3"}` workaround above is still the right way to force a *post*-resolution create failure — an absent template now fails earlier, at resolution.
 **Lesson**: any backend-built tar headed for `restore_from_tar` (or tarfile extraction generally) must be filtered to regular-file members at build time, with per-member warnings for what was dropped — and the round-trip belongs in tests against the REAL extractor (it's pure/importable). Symlinks also must never be *followed* at build time (library symlink → `/data/trinity.db` would exfiltrate backend-readable files into an agent workspace).
 
 ## 2026-07-24 — pitfall — A new consent/permission TOGGLE must reject agent principals, not just check ownership
@@ -148,3 +148,11 @@ plan or review. `/autoplan` reads this before planning; write for that reader.
 ## 2026-07-24 — pitfall — Every new egress surface must sanitise, not just the one that already did
 **Context**: trinity#1763 (ent#224) — `channel_completion_report` posted a task terminal's text to Slack.
 **Lesson**: `summary_or_error` on a FAILURE terminal can carry credentials; #1578 sanitises at its emit chokepoint for exactly that reason (`event_dispatch_service.py:311`). A new sink that reuses the same payload inherits the hazard but not the protection. Sanitise over a 2x window BEFORE truncating — a bare `[:cap]` slice can cut a secret so the redaction pattern no longer matches and it survives.
+
+## 2026-07-26 — pitfall — A path-disclosure guard anchored on whitespace is blind to the codebase's own `!r` quoting
+**Context**: trinity#1759 review. The `_leaked_paths` helper is the general backstop behind the fix's one binding security rule (ONE identical error whichever template root missed, echoing no resolved path — deploy-local template dirs are named after AGENT names, so "which root missed" is a #186 enumeration oracle). It was `re.compile(r"(?:^|\s)(/[A-Za-z0-9_.\-/]+)")`, which only sees a path preceded by whitespace. Executed against 9 leak shapes it MISSED 8 — including the repr form, and `!r` is the quoting style those very messages already use for `config.template`. So the single most likely future regression, `f"...{template_path!r}..."` → `'/data/deployed-templates/x'`, would have shipped with a green test. Separately, NO assertion in the file covered the relative form: the full pre-fix assertion set passes a message reading `no template.yaml under data/deployed-templates/acme-payroll-agent`.
+**Lesson**: (1) When asserting "this string contains no path/secret/identifier", never anchor on a leading-whitespace boundary — a value wrapped in quotes, parens, backticks or a colon slips through. Use a negative lookbehind on path characters (`(?<![A-Za-z0-9_.\-/])`) so "absolute" means "a `/` that does not continue a relative path", and pair it with an explicit token blocklist for the sensitive roots so the RELATIVE form is caught too. (2) Write the guard's own adversarial table and RUN it: a disclosure guard that has never been shown to fail on a real leak is decorative, and a decorative guard is worse than none — it manufactures confidence (the #1644 lesson, one level up: there it was a guard that fails open, here a guard that never fires). Same family as #1638 (a test asserting the defective behaviour ships it green). (3) Mutation-test a security assertion by interpolating the forbidden value in the codebase's *house style*, not in the shape the regex was written for.
+## 2026-07-27 — process — The same bug filed twice and fixed twice in parallel collides as a *contract* disagreement, not a text conflict
+**Context**: #1759 and #1793 are the same defect (a `local:` template that resolves to nothing creates a blank agent at HTTP 200), filed independently a day apart. #1793 was fixed by PR #1803 and merged to `dev` hours before #1759's PR #1824 opened, having been built over the preceding day. Both landed a gate at the *same* line of `_resolve_local_template`, with different contracts — 404 `UNKNOWN_LOCAL_TEMPLATE` vs 400 `LOCAL_TEMPLATE_NOT_FOUND`. Git reported one ordinary content conflict; the real conflict was that resolving it either way silently invalidated a set of *non-conflicting* files — a docstring that auto-merged to the other side's contract, a test file that merges clean and then goes red, and six docs/test sites asserting the losing status code (including one that hand-builds its own `HTTPException` and so would have kept passing while asserting a contract that no longer existed).
+**Lesson**: (1) Before starting a bug, search the tracker for the *symptom*, not the issue number — a duplicate filed by someone else is invisible to `gh issue view` on your own id, and P2 bugs sit long enough for two people to pick them up. Re-check at ship time: `git log origin/dev -S<symbol>` on the function you are about to touch costs one command. (2) When two fixes collide, the merged-and-reviewed one owns the contract; the later PR's value is its *residual* — the part the merged fix did not cover — and re-litigating the status code is worth less than shipping that residual. (3) A semantic conflict's blast radius is bigger than the conflict markers: after resolving, grep the losing error code repo-wide and treat every hit as a defect, especially in tests that construct their own fixture of the thing under test.
+
diff --git a/docs/memory/requirements/core-agent.md b/docs/memory/requirements/core-agent.md
index 64785d469..a24bdc332 100644
--- a/docs/memory/requirements/core-agent.md
+++ b/docs/memory/requirements/core-agent.md
@@ -116,6 +116,10 @@
 ### 4.1 Local Templates
 - **Status**: ✅ Implemented
 - **Description**: Auto-discovery from `config/agent-templates/`
+- **Create-time resolution contract (#1793 + #1759)**: `local:<name>` is resolved against the curated catalog first, then the deploy-local store (`/data/deployed-templates`, #950). A well-formed but **unresolvable** id fails with a named **404 `UNKNOWN_LOCAL_TEMPLATE`** (#1793) raised **before any side effect** (no container, no MCP key, no volume, nothing to roll back) — completing the loud-reject contract #843 opened for *unprefixed* template strings. An empty / non-mapping / unparseable `template.yaml` fails in the same pre-side-effect band with **400 `LOCAL_TEMPLATE_INVALID`** (#1759), matching the strictness the listing surface (`GET /api/templates`) already applied; without it a *present* but malformed template reached the identical blank-agent-at-200 outcome through a broad `except Exception`. The traversal barrier keeps precedence: a malformed name is still 400 `INVALID_LOCAL_TEMPLATE_NAME`. `template: null` / `""` (Blank Agent) never enter this branch and are unaffected. Hidden templates (`hidden: true`) are **omitted from the listing but remain creatable by id** — the resolver never reads the flag.
+  - The error is **one identical sentence whichever root missed**, carrying no filesystem path and no root name — deploy-local templates are named after *agent* names, so a root-distinguishing message would let a `creator`-role caller probe another user's agents (#186 adjacency).
+  - Manifest deploys surface it per agent via the ent#125 `failed[]` report (`status_code: 400`), so one typo'd template no longer sinks a whole system.
+  - The curated root falls back to the in-repo `config/agent-templates/` when the container bind mount is absent, so the gate is live in source-run backends too (aligning create with the listing surface, which has had that fallback since #843).
 
 ### 4.2 GitHub Templates
 - **Status**: ✅ Implemented
diff --git a/docs/onboarding/02-use-case-scenarios.md b/docs/onboarding/02-use-case-scenarios.md
index a6b20fb47..3ff89136d 100644
--- a/docs/onboarding/02-use-case-scenarios.md
+++ b/docs/onboarding/02-use-case-scenarios.md
@@ -34,9 +34,9 @@ A single agent that runs on a daily schedule to:
 #### Step 1: Create the Agent
 
 ```yaml
-# Create from default template
+# Start from the Scout starter template
 Name: research-assistant
-Template: local:default
+Template: local:scout
 ```
 
 #### Step 2: Customize Instructions
@@ -335,7 +335,7 @@ Single agent with Gmail access that:
 
 ```yaml
 Name: email-assistant
-Template: local:default
+Template: local:scribe
 ```
 
 #### Step 2: Set Up Gmail Access
diff --git a/docs/onboarding/03-common-workflows.md b/docs/onboarding/03-common-workflows.md
index 5eb18a9a5..93d566694 100644
--- a/docs/onboarding/03-common-workflows.md
+++ b/docs/onboarding/03-common-workflows.md
@@ -82,7 +82,7 @@ This guide covers the day-to-day operations you'll perform when working with Tri
    - **Name**: `my-new-agent` (lowercase, hyphens only)
    - **Display Name**: `My New Agent` (optional)
    - **Template**: Choose from:
-     - `local:default` — Basic agent
+     - `local:scout` — Market research analyst (one of the shipped starters)
      - `github:owner/repo` — From GitHub
      - `local:custom-template` — Your custom template
 
diff --git a/src/backend/models.py b/src/backend/models.py
index dff71887f..b76c68515 100644
--- a/src/backend/models.py
+++ b/src/backend/models.py
@@ -568,7 +568,7 @@ class QueueStatus(BaseModel):
 
 class SystemAgentConfig(BaseModel):
     """Configuration for a single agent in a system manifest."""
-    template: str  # e.g., "github:Org/repo" or "local:business-assistant"
+    template: str  # e.g., "github:Org/repo" or "local:scout" (#1759: must resolve, or create 400s)
     resources: Optional[dict] = None  # {"cpu": "2", "memory": "4g"}
     folders: Optional[dict] = None  # {"expose": bool, "consume": bool}
     schedules: Optional[List[dict]] = None  # [{name, cron, message, ...}]
diff --git a/src/backend/services/agent_service/crud.py b/src/backend/services/agent_service/crud.py
index 051f2d841..4e3b128e6 100644
--- a/src/backend/services/agent_service/crud.py
+++ b/src/backend/services/agent_service/crud.py
@@ -54,9 +54,77 @@
 # filesystem reads (CodeQL py/path-injection on #950 PR).
 _LOCAL_TEMPLATE_NAME_RE = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9_.-]*$")
 
-# Roots that a resolved local-template path must stay within (#950).
+_CONTAINER_CURATED_TEMPLATES = Path("/agent-configs/templates")
+
+
+def _repo_local_templates_dir() -> Path:
+    """Repo-relative curated-template directory, for source-run backends.
+
+    Mirrors the fallback in `template_service._local_templates_dir()` (#843).
+    It is **hand-rolled, never imported**: `services.template_service` is
+    MagicMocked by the #1484 characterization harness, so a gate that called
+    into it would be satisfied by a truthy mock and those tests would stay
+    green on the pre-#1759 behaviour — a silent, uncatchable regression.
+
+    `parents[4]`, NOT `.parent * 4`: this module lives one directory deeper
+    than `template_service.py` (`services/agent_service/` vs `services/`), so
+    the copy-pasted four-`.parent` form yields
+    `<repo>/src/config/agent-templates`, which does not exist. Pinned by
+    `tests/unit/test_1759_template_root_parity.py`.
+    """
+    # The guard is NOT decorative. In the container layout
+    # `/app/services/agent_service/crud.py` has only 4 parents (0-3), so a bare
+    # `parents[4]` raises IndexError — and `_LOCAL_TEMPLATE_ROOTS` is computed at
+    # IMPORT time, so that IndexError would stop the backend booting rather than
+    # degrade a single request. The branch is believed unreachable (taken only
+    # when `/agent-configs/templates` is absent, and both compose files always
+    # bind it on `backend`), but "believed unreachable" is not a reason to ship a
+    # crash-on-import path — especially one this file introduces.
+    parents = Path(__file__).resolve().parents
+    if len(parents) <= 4:
+        # No repo root above us: an installed/container layout, where the
+        # container catalog is the only meaningful answer.
+        return _CONTAINER_CURATED_TEMPLATES
+    return parents[4] / "config" / "agent-templates"
+
+
+def _curated_templates_root() -> Path:
+    """Curated-catalog root: the read-only bind mount inside a Trinity
+    container, the in-repo catalog otherwise (#1759).
+
+    Without the fallback neither root exists outside a container, so the
+    `UNKNOWN_LOCAL_TEMPLATE` gate below (#1793) would 404 *every* `local:`
+    create in dev shells, source-run CI and unit tests — the gate would be
+    hostile exactly where the test suite runs, and #1793 could only paper over
+    that by pointing `_LOCAL_TEMPLATE_ROOTS` at a tmp fixture inside the #1484
+    harness (the #1638 accidental-green pattern).
+    """
+    if _CONTAINER_CURATED_TEMPLATES.exists():
+        return _CONTAINER_CURATED_TEMPLATES.resolve()
+    return _repo_local_templates_dir()
+
+
+def _default_host_templates_base() -> str:
+    """Fallback bind-source base for the `/template` mount (#1759).
+
+    Inside a Trinity container the catalog is the read-only bind at
+    `/agent-configs/templates` and compose always sets `HOST_TEMPLATES_PATH`,
+    so this returns today's literal relative default verbatim — the container
+    path is byte-identical. Outside a container the repo path *is* a host path
+    and a valid bind source, so return it resolved rather than a relative path
+    Docker would refuse.
+    """
+    if _CONTAINER_CURATED_TEMPLATES.exists():
+        return "./config/agent-templates"
+    return str(_repo_local_templates_dir())
+
+
+# Roots that a resolved local-template path must stay within (#950). Read at
+# TWO seams — `_resolve_local_template` and the `/template` bind decision in
+# `_stage_config_files` — which must always agree (#1759). Kept a module-level
+# tuple: it is the single monkeypatch point the create tests use.
 _LOCAL_TEMPLATE_ROOTS = (
-    Path("/agent-configs/templates").resolve(),
+    _curated_templates_root(),
     Path("/data/deployed-templates").resolve(),
 )
 
@@ -676,7 +744,13 @@ def _resolve_local_template(config: AgentConfig) -> tuple[dict, Optional[dict]]:
 
     Raises `HTTPException(404, UNKNOWN_LOCAL_TEMPLATE)` when the name resolves
     to no `template.yaml` under either root (#1793) — this previously returned
-    an empty dict and the caller provisioned a templateless container."""
+    an empty dict and the caller provisioned a templateless container.
+
+    Raises `HTTPException(400, LOCAL_TEMPLATE_INVALID)` when the `template.yaml`
+    exists but is unreadable, unparseable, or not a YAML mapping (#1759). That
+    case reached the same observable outcome as an absent template — blank
+    agent, HTTP 200 — through the broad `except Exception` below, so #1793 alone
+    did not close it."""
     template_data: dict = {}
     template_shared_folders = None
     # Local template - strip "local:" prefix. Look in curated catalog
@@ -695,47 +769,121 @@ def _resolve_local_template(config: AgentConfig) -> tuple[dict, Optional[dict]]:
 
     template_yaml = template_path / "template.yaml"
 
+    # The `if/else` shape (rather than an early-return guard) is deliberate and
+    # load-bearing: dedenting this block moves the `.exists()` and `open()`
+    # expressions onto new lines and re-fingerprints the `py/path-injection`
+    # alerts already dismissed as false positives on dev. #1793 hit exactly this
+    # and reverted its own guard-clause refactor for it. Add bands INSIDE the
+    # block; do not flatten it.
     if template_yaml.exists():
         try:
             with open(template_yaml) as f:
                 template_data = yaml.safe_load(f)
-                config.type = template_data.get("type", config.type)
-                config.resources = template_data.get("resources", config.resources)
-                config.tools = template_data.get("tools", config.tools)
-                creds = template_data.get("credentials", {})
-                mcp_servers = list(creds.get("mcp_servers", {}).keys())
-                if mcp_servers:
-                    config.mcp_servers = mcp_servers
-                # Multi-runtime support - extract runtime config from template
-                runtime_config = template_data.get("runtime", {})
-                if isinstance(runtime_config, dict):
-                    config.runtime = runtime_config.get("type", config.runtime)
-                    config.runtime_model = runtime_config.get("model", config.runtime_model)
-                elif isinstance(runtime_config, str):
-                    config.runtime = runtime_config
-                # Phase 9.11: Extract shared folder config from template
-                shared_folders_config = template_data.get("shared_folders", {})
-                if shared_folders_config:
-                    template_shared_folders = {
-                        "expose": shared_folders_config.get("expose", False),
-                        "consume": shared_folders_config.get("consume", False)
-                    }
+        except (OSError, yaml.YAMLError) as e:
+            # #1759: previously swallowed by the broad `except Exception:
+            # logger.warning(...)` below, which produced the *identical*
+            # observable outcome as an absent template — blank agent, HTTP 200 —
+            # via a different line. #1793 closed the ABSENT case; this closes the
+            # present-but-unreadable one. The parser error itself is deliberately
+            # NOT echoed to the caller: it quotes the resolved file path and the
+            # file's bytes.
+            logger.warning("Unparseable template.yaml for %s: %s", config.template, e)
+            raise HTTPException(
+                status_code=400,
+                detail={
+                    "error": (
+                        f"Local template {config.template!r} has an unreadable or "
+                        f"malformed template.yaml. Fix the template, or list "
+                        f"working templates with GET /api/templates."
+                    ),
+                    "code": "LOCAL_TEMPLATE_INVALID",
+                },
+            ) from e
+
+        # `yaml.safe_load("")` returns None, and a scalar/list document returns a
+        # non-dict. The LISTING path already rejects both
+        # (`template_service._build_local_template`), so before #1759 the create
+        # path was strictly *less* strict than the surface advertising the
+        # template.
+        if not isinstance(template_data, dict):
+            raise HTTPException(
+                status_code=400,
+                detail={
+                    "error": (
+                        f"Local template {config.template!r} has an empty or "
+                        f"malformed template.yaml (expected a YAML mapping). Fix "
+                        f"the template, or list working templates with "
+                        f"GET /api/templates."
+                    ),
+                    "code": "LOCAL_TEMPLATE_INVALID",
+                },
+            )
+
+        # A malformed *field* (as opposed to a malformed file) still degrades
+        # gracefully: `template_data` is a real dict here, so the agent does get
+        # its template files and only some config mutations are skipped.
+        # Unchanged pre-#1759 behaviour, deliberately left out of scope.
+        try:
+            config.type = template_data.get("type", config.type)
+            config.resources = template_data.get("resources", config.resources)
+            config.tools = template_data.get("tools", config.tools)
+            creds = template_data.get("credentials", {})
+            mcp_servers = list(creds.get("mcp_servers", {}).keys())
+            if mcp_servers:
+                config.mcp_servers = mcp_servers
+            # Multi-runtime support - extract runtime config from template
+            runtime_config = template_data.get("runtime", {})
+            if isinstance(runtime_config, dict):
+                config.runtime = runtime_config.get("type", config.runtime)
+                config.runtime_model = runtime_config.get("model", config.runtime_model)
+            elif isinstance(runtime_config, str):
+                config.runtime = runtime_config
+            # Phase 9.11: Extract shared folder config from template
+            shared_folders_config = template_data.get("shared_folders", {})
+            if shared_folders_config:
+                template_shared_folders = {
+                    "expose": shared_folders_config.get("expose", False),
+                    "consume": shared_folders_config.get("consume", False)
+                }
         except Exception as e:
-            logger.warning(f"Error loading template config: {e}")
+            # Still broad and still non-fatal, deliberately: the file parsed, so
+            # the agent DOES get its template files and only some `config`
+            # mutations are skipped. Tightening this to a 400 would reject
+            # templates that deploy successfully today — beyond #1759's ACs. But
+            # the mutations above run in order, so a raise part-way through
+            # leaves a PARTIALLY applied template (e.g. `credentials: "a string"`
+            # applies type/resources/tools, then silently skips
+            # mcp_servers/runtime/shared_folders). Name the template and the
+            # agent: the old message carried neither, leaving an operator nothing
+            # to grep when the resulting agent is subtly wrong.
+            logger.warning(
+                "Template %r for agent %r: field-level config only partially "
+                "applied (agent still created): %s",
+                config.template,
+                config.name,
+                e,
+            )
     else:
         # #1793: an unresolvable `local:` template must fail before any side
         # effect. Falling through with an empty `template_data` provisioned a
         # running container with no CLAUDE.md, no template.yaml and no skills —
         # an empty shell reported to the caller as a normal 200 creation. The
         # `github:` path already fails fast on an unknown repo; this matches it.
+        #
+        # ONE message regardless of which root missed, and no resolved path in
+        # it: deploy-local templates (#950) are named after AGENT names, so a
+        # root-distinguishing or path-echoing error would let a creator-role
+        # caller probe whether another user's deploy-local agent exists (#186
+        # enumeration discipline).
         raise HTTPException(
             status_code=404,
             detail={
                 "error": (
                     f"Local template {raw_name!r} was not found. Check the id "
-                    f"against GET /api/templates — templates marked hidden are "
-                    f"not deployable. To create an agent with no template at "
-                    f"all, omit the 'template' field."
+                    f"against GET /api/templates — note that hidden templates "
+                    f"are omitted from that listing but remain creatable by id. "
+                    f"To create an agent with no template at all, omit the "
+                    f"'template' field."
                 ),
                 "code": "UNKNOWN_LOCAL_TEMPLATE",
             },
@@ -887,7 +1035,14 @@ def _stage_config_files(
                 raw_name, _LOCAL_TEMPLATE_ROOTS[0]
             )
             if curated_path.exists():
-                host_templates_base = os.getenv("HOST_TEMPLATES_PATH", "./config/agent-templates")
+                # `or`, NOT `os.getenv(key, default)` (#1759): an EMPTY
+                # HOST_TEMPLATES_PATH made `Path("") / name` collapse to the
+                # bare name, which Docker reads as a NAMED VOLUME — an empty
+                # one mounted at /template, i.e. a silently blank template.
+                # That is this issue's bug class, one seam over.
+                host_templates_base = (
+                    os.getenv("HOST_TEMPLATES_PATH") or _default_host_templates_base()
+                )
                 # raw_name already validated by _safe_local_template_path; the
                 # join here is on a value that survived the regex + resolve
                 # barriers above, so the bind source can't traverse out.
diff --git a/src/backend/services/system_service.py b/src/backend/services/system_service.py
index d4a842378..e9d3ec512 100644
--- a/src/backend/services/system_service.py
+++ b/src/backend/services/system_service.py
@@ -592,14 +592,35 @@ def export_manifest(system_name: str, agents: List[Dict]) -> str:
     """
     # Extract short names (remove system prefix)
     agent_configs = {}
+    # Agents with no template label, whose manifest entry is inferred (#1759).
+    templateless: List[str] = []
     for agent in agents:
         full_name = agent['name']
         # Remove system prefix and hyphen
         short_name = full_name[len(system_name) + 1:]
 
+        # #1759: `or`, NOT a `.get` default. Every Blank Agent's dict carries
+        # `"template": None` (routers/agents.py builds the label as
+        # `config.template or ''` then `or None`), and `dict.get(key, default)`
+        # returns the default only when the key is ABSENT — so the old
+        # `local:business-assistant` fallback was unreachable dead code, and
+        # blank agents have always exported `template: null`. Since
+        # `SystemAgentConfig.template` is a non-Optional `str`, redeploying
+        # such a manifest already failed Pydantic validation; and
+        # `config/agent-templates/business-assistant` has never existed. This
+        # is a pre-existing broken round-trip on the platform's most common
+        # agent type, not a regression introduced by the create-time gate.
+        # `local:default` is the truthful representation of a template-less
+        # agent (a real, minimal template) — a product template like
+        # `local:scout` would fabricate provenance.
+        template = agent.get('template') or None
+        if template is None:
+            templateless.append(full_name)
+            template = 'local:default'
+
         # Get agent details
         config = {
-            "template": agent.get('template', 'local:business-assistant')
+            "template": template
         }
 
         # Get resources (if available from labels)
@@ -647,6 +668,16 @@ def export_manifest(system_name: str, agents: List[Dict]) -> str:
 
         agent_configs[short_name] = config
 
+    if templateless:
+        # `export_manifest` returns a bare YAML string (routers/systems.py), so
+        # there is no structured field to carry this — a log line is the only
+        # non-contract-breaking channel (#1759).
+        logger.warning(
+            "Exported system '%s': %d agent(s) have no template label; their "
+            "manifest entry was inferred as 'local:default': %s",
+            system_name, len(templateless), ", ".join(sorted(templateless)),
+        )
+
     # Build manifest dict
     manifest_dict = {
         "name": system_name,
diff --git a/tests/registry.json b/tests/registry.json
index 72fc144ab..24f55d8fc 100644
--- a/tests/registry.json
+++ b/tests/registry.json
@@ -1119,6 +1119,41 @@
         "infrastructure"
       ],
       "description": "First-run default-system seeder (ent#124): the REAL bundled config/manifests/default-system.yaml validates through the executor's own parse_manifest/validate_manifest (acme trio, full-mesh, no schedules, no prompt) and every local: template it references exists in-tree (learnings 2026-07-23 blank-agent trap); durable default_system_seeded flag gating (deleted fleet never resurrected); persisted first_run_fresh verdict \u2014 computed once BEFORE Cornelius runs, persisted, reused on later passes (cross-pass count-poisoning bug), cornelius_seeded=true forces not-fresh (ent#107-era installs get no fleet), count failure defers without persisting; TRINITY_DEFAULT_SYSTEM_MANIFEST disable sentinels skip without burning the flag; override path used when set, unreadable override fails loudly (operator-queue alert, no bundled fallback, no flag); flag policy per deploy outcome: deployed/partial set flag (+partial alert), failed (0 created)/exception do NOT (retry-safe); existence backstop converges the flag without deploying when any {system}-{short} name is reserved (suffix double-seed guard for the fail-open lock); SETNX lock held->skip / winner deploys+releases; orchestrator never raises when Cornelius explodes. db/docker/redis/deploy_manifest seams patched; no Docker/backend."
+    },
+    {
+      "file": "unit/test_1759_local_template_not_found.py",
+      "feature": "#1759",
+      "added": "2026-07-27",
+      "categories": [
+        "backend",
+        "agents",
+        "unit",
+        "reliability"
+      ],
+      "description": "Local-template create gate (#1759, companion to #1793). Drives the FULL create_agent_internal, so unlike test_1793_unknown_local_template.py it also proves the reject is pre-side-effect (no container, volume, MCP key, ownership row or ephemeral slot). Covers the absent case at #1793's 404 UNKNOWN_LOCAL_TEMPLATE (both roots missing, dir without template.yaml, name resolving to a regular file), the #1759 400 LOCAL_TEMPLATE_INVALID band (empty / whitespace / comment-only / scalar / list / unparseable template.yaml), INVALID_LOCAL_TEMPLATE_NAME precedence, Blank Agent passthrough, the /template bind source under set/unset/EMPTY HOST_TEMPLATES_PATH, and the disclosure rule \u2014 one identical message whichever root missed, echoing no filesystem path (deploy-local template dirs are named after AGENT names, so 'which root' is a #186 enumeration oracle)."
+    },
+    {
+      "file": "unit/test_1759_template_root_parity.py",
+      "feature": "#1759",
+      "added": "2026-07-27",
+      "categories": [
+        "backend",
+        "agents",
+        "unit",
+        "reliability"
+      ],
+      "description": "Curated-template root parity (#1759). The create resolver's repo-relative fallback is hand-rolled rather than imported from template_service (which the #1484 harness MagicMocks, so an imported gate would be satisfied by a truthy mock), which makes drift between the two surfaces invisible \u2014 these tests pin them equal against both REAL modules. Also pins that the fallback resolves to <repo>/config/agent-templates and not <repo>/src/config/agent-templates (crud.py sits one directory deeper than template_service.py), that the deploy-local root is unchanged, that the container branch returns the pre-#1759 literal byte-identically, that the host branch is absolute so Docker accepts it as a bind source, and \u2014 the guard that would have caught the missing local:default \u2014 that EVERY shipped in-tree template resolves through the create gate."
+    },
+    {
+      "file": "unit/test_1759_export_manifest_template.py",
+      "feature": "#1759",
+      "added": "2026-07-27",
+      "categories": [
+        "backend",
+        "systems",
+        "unit"
+      ],
+      "description": "export_manifest template round-trip (#1759). Blank Agents carry template: None (key PRESENT), and dict.get(key, default) returns the default only when the key is ABSENT \u2014 so the old local:business-assistant fallback was unreachable dead code and every template-less agent exported template: null, which SystemAgentConfig.template (non-Optional str) rejects on redeploy. Pins the `or` fix emitting local:default, pass-through of a real template, that the exported manifest both validates and names a template that exists in-tree, and that inferred agents are logged."
     }
   ]
 }
diff --git a/tests/test_agent_lifecycle.py b/tests/test_agent_lifecycle.py
index 186d4b622..aee998592 100644
--- a/tests/test_agent_lifecycle.py
+++ b/tests/test_agent_lifecycle.py
@@ -88,11 +88,13 @@ def test_create_agent_with_template(
             },
         )
 
-        # May fail if template doesn't exist, which is acceptable
-        if response.status_code in [200, 201]:
-            resource_tracker.track_agent(test_agent_name)
-            data = response.json()
-            assert data.get("name") == test_agent_name
+        # #1759: `local:default` is a real shipped template and an absent one
+        # is now a hard 400, so the old `if status in [200, 201]` tolerance had
+        # become a way for this test to silently assert nothing at all.
+        assert_status_in(response, [200, 201])
+        resource_tracker.track_agent(test_agent_name)
+        data = response.json()
+        assert data.get("name") == test_agent_name
 
     def test_create_agent_with_resources(
         self,
diff --git a/tests/test_systems.py b/tests/test_systems.py
index 0349d063f..b6ad9e404 100644
--- a/tests/test_systems.py
+++ b/tests/test_systems.py
@@ -1068,8 +1068,17 @@ class TestResilientDeploy:
 
     Failure vector: `resources: {cpu: "3"}` is rejected by normalize_cpu with a
     deterministic, side-effect-free HTTP 400 before any container work — an
-    offline-safe way to make exactly one agent fail. (A well-formed but absent
-    `local:` template does NOT fail — it silently creates a blank agent.)
+    offline-safe way to make exactly one agent fail.
+
+    (#1793/#1759 note: an absent `local:` template now ALSO fails, with a 404
+    `UNKNOWN_LOCAL_TEMPLATE` raised even earlier — at template resolution,
+    before normalize_cpu runs. It used to silently create a blank agent, which
+    is why this suite picked the cpu vector. The cpu vector is kept: it is the
+    only one that exercises a failure *after* the template resolved, and
+    swapping it would change what this test covers. This is also why
+    `config/agent-templates/default/` has to ship: every manifest here names
+    `local:default`, so without a real template behind that id the 404 preempts
+    the cpu 400 and this whole class fails for the wrong reason.)
     """
 
     def test_partial_deploy_continues_and_reports(self, api_client: TrinityApiClient):
diff --git a/tests/unit/test_1484_create_agent_characterization.py b/tests/unit/test_1484_create_agent_characterization.py
index ce88d81b7..9607f7f1e 100644
--- a/tests/unit/test_1484_create_agent_characterization.py
+++ b/tests/unit/test_1484_create_agent_characterization.py
@@ -258,7 +258,13 @@ def _load_crud(monkeypatch, docker_available=True):
     # set_default_avatar stays unreached for every case but the one that
     # builds its own root. Cases that monkeypatch `_LOCAL_TEMPLATE_ROOTS`
     # themselves still win: their setattr runs after this.
-    _tpl_root = Path(tempfile.mkdtemp(prefix="trinity_1484_templates_"))
+    # `.resolve()` is required, not cosmetic: on macOS `tempfile.mkdtemp()`
+    # returns `/var/folders/...`, but `/var` is a symlink to `/private/var`, so
+    # `_safe_local_template_path`'s `(root / name).resolve()` yields
+    # `/private/var/...` and `is_relative_to(root)` fails — every local: case
+    # 400s `INVALID_LOCAL_TEMPLATE_NAME`. Linux CI has no such symlink, which is
+    # why #1793 shipped green while these 11 cases were red on every Mac.
+    _tpl_root = Path(tempfile.mkdtemp(prefix="trinity_1484_templates_")).resolve()
     _scout = _tpl_root / "scout"
     _scout.mkdir()
     (_scout / "template.yaml").write_text("type: business-assistant\n")
diff --git a/tests/unit/test_1759_export_manifest_template.py b/tests/unit/test_1759_export_manifest_template.py
new file mode 100644
index 000000000..7c5497872
--- /dev/null
+++ b/tests/unit/test_1759_export_manifest_template.py
@@ -0,0 +1,126 @@
+"""`export_manifest` must emit a template id that actually redeploys (#1759).
+
+`system_service.export_manifest` built each agent entry as
+
+    {"template": agent.get('template', 'local:business-assistant')}
+
+which was broken twice over:
+
+1. `dict.get(key, default)` returns the default only when the key is ABSENT.
+   Every agent dict from `routers/agents.py` carries the key with value `None`
+   for a template-less ("Blank") agent — the platform's most common agent type
+   — so the fallback was **unreachable dead code** and those agents exported
+   `template: null`. `SystemAgentConfig.template` is a non-Optional `str`, so
+   redeploying that manifest failed Pydantic validation *before* this issue.
+2. `config/agent-templates/business-assistant` has never existed, so even when
+   the fallback was reachable it named a template that would 400 once the
+   create-time gate landed.
+
+This is therefore a pre-existing broken round-trip being fixed, NOT a
+regression the #1759 create gate introduces.
+
+Target: src/backend/services/system_service.py::export_manifest
+Issue:  abilityai/trinity#1759
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+from pathlib import Path
+from unittest.mock import MagicMock
+
+import pytest
+import yaml
+
+os.environ.setdefault("REDIS_URL", "redis://test:test@redis:6379")
+os.environ.setdefault("REDIS_PASSWORD", "test")
+os.environ.setdefault("REDIS_BACKEND_PASSWORD", "test")
+os.environ.setdefault("AGENT_AUTH_SECRET", "0" * 64)
+_TMP_DB = Path(tempfile.gettempdir()) / "trinity_test_1759_export_manifest.db"
+os.environ.setdefault("TRINITY_DB_PATH", str(_TMP_DB))
+
+_PROJECT_ROOT = Path(__file__).resolve().parents[2]
+_BACKEND = str(_PROJECT_ROOT / "src" / "backend")
+if _BACKEND not in sys.path:
+    sys.path.insert(0, _BACKEND)
+
+import services.system_service as system_service  # noqa: E402
+from models import SystemManifest  # noqa: E402
+
+pytestmark = pytest.mark.unit
+
+
+@pytest.fixture
+def quiet_db(monkeypatch):
+    """Silence the per-agent db enrichment; only `template` is under test."""
+    db = MagicMock()
+    db.get_agent_folder_config.return_value = None
+    db.list_agent_schedules.return_value = []
+    db.get_agent_tags.return_value = []
+    db.get_agent_permissions.return_value = []
+    # Unstubbed, this returns a truthy MagicMock that lands in the manifest and
+    # blows up `yaml.dump`.
+    db.get_setting_value.return_value = None
+    monkeypatch.setattr(system_service, "db", db)
+    return db
+
+
+def _export(system_name, agents):
+    return yaml.safe_load(system_service.export_manifest(system_name, agents))
+
+
+def test_templateless_agent_exports_a_resolvable_template(quiet_db):
+    """The regression the `.get` default silently allowed: `template: null`."""
+    manifest = _export("sys", [{"name": "sys-blank", "template": None}])
+
+    entry = manifest["agents"]["blank"]
+    assert entry["template"] is not None
+    assert entry["template"] == "local:default"
+    # The dead fallback must be gone: that template does not exist on disk.
+    assert entry["template"] != "local:business-assistant"
+
+
+def test_missing_template_key_also_covered(quiet_db):
+    """The only case the old `.get` default actually handled."""
+    manifest = _export("sys", [{"name": "sys-nokey"}])
+    assert manifest["agents"]["nokey"]["template"] == "local:default"
+
+
+def test_real_template_is_passed_through_untouched(quiet_db):
+    manifest = _export("sys", [{"name": "sys-scout", "template": "local:scout"}])
+    assert manifest["agents"]["scout"]["template"] == "local:scout"
+
+
+def test_exported_manifest_validates_and_names_a_shipped_template(quiet_db):
+    """End-to-end round-trip: the export must survive manifest validation AND
+    name a template the create path can resolve."""
+    manifest_yaml = system_service.export_manifest(
+        "sys", [{"name": "sys-blank", "template": None}]
+    )
+    # Would previously raise: template=None fails the non-Optional `str`.
+    parsed = SystemManifest(**yaml.safe_load(manifest_yaml))
+    template_id = parsed.agents["blank"].template
+    assert template_id.startswith("local:")
+
+    catalog = _PROJECT_ROOT / "config" / "agent-templates"
+    assert (catalog / template_id[len("local:"):] / "template.yaml").is_file(), (
+        f"exported manifest names {template_id!r}, which does not exist "
+        f"under {catalog} and would now 400 on redeploy"
+    )
+
+
+def test_templateless_agents_are_logged(quiet_db, caplog):
+    """`export_manifest` returns a bare YAML string, so a log line is the only
+    channel that does not change the response contract."""
+    with caplog.at_level("WARNING"):
+        system_service.export_manifest(
+            "sys",
+            [{"name": "sys-blank", "template": None},
+             {"name": "sys-scout", "template": "local:scout"}],
+        )
+    warnings = [r.getMessage() for r in caplog.records
+                if r.levelname == "WARNING"]
+    assert any("sys-blank" in w and "local:default" in w for w in warnings)
+    assert not any("sys-scout" in w for w in warnings)
diff --git a/tests/unit/test_1759_local_template_not_found.py b/tests/unit/test_1759_local_template_not_found.py
new file mode 100644
index 000000000..697b1a525
--- /dev/null
+++ b/tests/unit/test_1759_local_template_not_found.py
@@ -0,0 +1,786 @@
+"""An unresolvable or INVALID `local:` template must fail loudly (#1759).
+
+`_resolve_local_template` had no `else`: a `local:<name>` whose directory (or
+`template.yaml`) did not exist under either root returned `template_data == {}`
+and the agent was created — HTTP 200, blank container, no warning. Only
+*malformed* names failed (`INVALID_LOCAL_TEMPLATE_NAME`). This is the sibling
+hole #843 explicitly left open for unprefixed names.
+
+The ABSENT half was closed on `dev` by #1793 (PR #1803) with **404
+`UNKNOWN_LOCAL_TEMPLATE`**; #1759 was built in parallel against the same line
+and conceded that contract at merge. What #1793 did NOT close, and what this
+file now primarily covers, is the **present-but-invalid** half — an empty,
+non-mapping or unparseable `template.yaml` still reached the identical blank
+agent at HTTP 200 through the broad `except Exception`. That is **400
+`LOCAL_TEMPLATE_INVALID`**.
+
+The absent-template cases are kept here rather than deleted: unlike
+`test_1793_unknown_local_template.py` (which calls `_resolve_local_template`
+directly) they drive the full `create_agent_internal` and assert
+`_assert_no_side_effects` — no container, volume, MCP key, ownership row or
+ephemeral slot. That pre-side-effect proof exists nowhere else.
+
+Every test here monkeypatches `crud._LOCAL_TEMPLATE_ROOTS` to REAL `tmp_path`
+directories (the `test_1484:853` precedent). That is the anti-trap: the gate is
+exercised against a real filesystem and never touches
+`services.template_service`, which this harness MagicMocks — a gate that called
+`template_service._local_templates_dir()` would be satisfied by a truthy mock
+and the 15 `test_1484` characterization tests would stay green on the OLD
+behaviour, silently.
+
+Template names are deliberately unambiguous non-catalog names (`nope-1759`):
+`_LOCAL_TEMPLATE_NAME_RE` allows uppercase and macOS is case-insensitive, so
+`local:SCOUT` would resolve on a dev box and 404 on Linux CI.
+
+Harness: copied + trimmed from `test_1484_create_agent_characterization.py`
+(D6 — deliberately NOT shared cross-file; sharing reintroduces a documented
+`sys.modules` / `services.*` leak).
+
+Target: src/backend/services/agent_service/crud.py
+Issue:  abilityai/trinity#1759
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import sys
+import tempfile
+from pathlib import Path
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+# Env prerequisites before any backend import (repo test convention).
+os.environ.setdefault("REDIS_URL", "redis://test:test@redis:6379")
+os.environ.setdefault("REDIS_PASSWORD", "test")
+os.environ.setdefault("REDIS_BACKEND_PASSWORD", "test")
+os.environ.setdefault("AGENT_AUTH_SECRET", "0" * 64)
+_TMP_DB = Path(tempfile.gettempdir()) / "trinity_test_1759_local_template.db"
+os.environ.setdefault("TRINITY_DB_PATH", str(_TMP_DB))
+
+_PROJECT_ROOT = Path(__file__).resolve().parents[2]
+_BACKEND = str(_PROJECT_ROOT / "src" / "backend")
+if _BACKEND not in sys.path:
+    sys.path.insert(0, _BACKEND)
+
+from fastapi import HTTPException  # noqa: E402
+from models import AgentConfig  # noqa: E402
+
+pytestmark = pytest.mark.unit
+
+
+class _NotFound(Exception):
+    """Stand-in for docker.errors.NotFound (the mocked docker module)."""
+
+
+# ---------------------------------------------------------------------------
+# Harness — import crud with every heavy dep mocked.
+# ---------------------------------------------------------------------------
+
+
+def _load_crud(monkeypatch):
+    docker_mod = MagicMock()
+    docker_mod.errors.NotFound = _NotFound
+
+    docker_service = MagicMock()
+    docker_service.docker_client = MagicMock()
+    docker_service.get_agent_by_name = MagicMock(return_value=None)
+    docker_service.get_next_available_port = MagicMock(return_value=2222)
+    docker_service.get_agent_status_from_container = MagicMock(return_value=MagicMock())
+
+    docker_utils = MagicMock()
+    docker_utils.volume_get = AsyncMock(side_effect=_NotFound("no such volume"))
+    docker_utils.volume_create = AsyncMock()
+    docker_utils.containers_run = AsyncMock(return_value=MagicMock())
+
+    template_service = MagicMock()
+    template_service.generate_credential_files = MagicMock(return_value={})
+    template_service.get_github_template = MagicMock(return_value=None)
+
+    git_service = MagicMock()
+    git_service.DEFAULT_PERSISTENT_STATE = ["memory/"]
+    git_service.DEFAULT_DATA_PATHS = []
+    git_service.reserve_and_generate_instance_id = AsyncMock(
+        return_value=("iid-1", "main")
+    )
+    git_service.materialize_persistent_state = AsyncMock()
+    git_service.materialize_data_paths = AsyncMock()
+
+    settings_service = MagicMock()
+    settings_service.get_anthropic_api_key = MagicMock(return_value="sk-ant-key")
+    settings_service.resolve_github_pat = MagicMock(
+        return_value=("platform-pat", "global")
+    )
+    settings_service.get_agent_full_capabilities = MagicMock(return_value=False)
+    settings_service.get_agent_quota_for_role = MagicMock(return_value=0)
+    settings_service.get_agent_default_resources = MagicMock(
+        return_value={"cpu": "2", "memory": "4g"}
+    )
+    settings_service.get_agent_default_require_email = MagicMock(return_value=False)
+    settings_service.get_ephemeral_agent_quota = MagicMock(return_value=5)
+    settings_service.get_ephemeral_ttl_ceiling_seconds = MagicMock(return_value=86400)
+
+    entitlement_mod = MagicMock()
+    entitlement_mod.entitlement_service.is_entitled = MagicMock(return_value=False)
+
+    rate_limiter_mod = MagicMock()
+    rate_limiter_mod.enforce = MagicMock()
+
+    ephemeral_mod = MagicMock()
+    ephemeral_mod.try_reserve_ephemeral_slot = MagicMock(return_value=True)
+    ephemeral_mod.release_ephemeral_slot = MagicMock()
+
+    pull_mode_mod = MagicMock()
+    pull_mode_mod.pull_mode_env_vars = MagicMock(return_value={})
+
+    runtime_state_mod = MagicMock()
+    runtime_state_mod.clear_agent_breakers = MagicMock()
+
+    helpers_mod = MagicMock()
+    helpers_mod.validate_base_image = MagicMock()
+    helpers_mod.is_claude_runtime = MagicMock(return_value=False)
+    helpers_mod.validate_runtime = MagicMock()
+
+    lifecycle_mod = MagicMock()
+    lifecycle_mod.RESTRICTED_CAPABILITIES = []
+    lifecycle_mod.FULL_CAPABILITIES = []
+
+    capabilities_mod = MagicMock()
+    capabilities_mod.AGENT_TMPFS_MOUNT = {"/tmp": "size=512m"}
+    capabilities_mod.AGENT_DEFAULT_TMPDIR = "/home/developer/.tmp"
+    capabilities_mod.normalize_cpu = MagicMock(side_effect=lambda v, d: v or d)
+    capabilities_mod.normalize_memory = MagicMock(side_effect=lambda v, d: v or d)
+
+    agent_auth = MagicMock()
+    agent_auth.derive_agent_token = MagicMock(return_value="agent-auth-token")
+
+    database_mod = MagicMock()
+    db = database_mod.db
+    db.get_agent_owner.return_value = None
+    db.is_agent_name_reserved.return_value = False
+    db.is_volume_base_reserved.return_value = False
+    db.get_agents_by_owner.return_value = []
+    db.get_guardrails_config.return_value = None
+    db.create_agent_mcp_api_key.return_value = MagicMock(
+        api_key="trinity_mcp_test", key_prefix="trinity_mcp_te"
+    )
+    db.get_git_config_agent_names_for_repo.return_value = []
+    db.set_agent_github_pat.return_value = True
+    db.get_shared_folder_config.return_value = None
+    db.get_file_sharing_enabled.return_value = False
+    db.grant_default_permissions.return_value = 0
+    db.register_agent_owner.return_value = None
+    db.get_agent_ephemeral_info.return_value = None
+    db.get_user_by_username.return_value = {"id": 7}
+    db.get_agent_mcp_api_key.return_value = None
+    db.get_least_used_subscription.return_value = None
+    db.get_subscription_token.return_value = None
+    db.add_agent_permission.return_value = None
+    db.assign_subscription_to_agent.return_value = None
+    db.set_default_avatar.return_value = None
+    db.set_git_auto_sync_enabled.return_value = None
+    db.delete_git_config.return_value = None
+    db.delete_agent_mcp_api_key.return_value = None
+    db.upsert_shared_folder_config.return_value = None
+
+    pkg = "services.agent_service"
+    sibling_mocks = {}
+    for sib in [
+        "api_key",
+        "autonomy",
+        "dashboard",
+        "deploy",
+        "file_sharing",
+        "files",
+        "folders",
+        "helpers",
+        "lifecycle",
+        "mcp_tool_names",
+        "metrics",
+        "permissions",
+        "queue",
+        "read_only",
+        "stats",
+        "terminal",
+        "capabilities",
+        "ephemeral",
+        "pull_mode",
+    ]:
+        mod = {
+            "helpers": helpers_mod,
+            "lifecycle": lifecycle_mod,
+            "capabilities": capabilities_mod,
+            "ephemeral": ephemeral_mod,
+            "pull_mode": pull_mode_mod,
+        }.get(sib, MagicMock())
+        sibling_mocks[f"{pkg}.{sib}"] = mod
+
+    mocks = {
+        "docker": docker_mod,
+        "docker.errors": docker_mod.errors,
+        "redis": MagicMock(),
+        "redis.asyncio": MagicMock(),
+        "database": database_mod,
+        "services.docker_service": docker_service,
+        "services.docker_utils": docker_utils,
+        "services.template_service": template_service,
+        "services.git_service": git_service,
+        "services.settings_service": settings_service,
+        "services.entitlement_service": entitlement_mod,
+        "services.rate_limiter": rate_limiter_mod,
+        "services.agent_runtime_state": runtime_state_mod,
+        "services.agent_auth": agent_auth,
+        **sibling_mocks,
+    }
+
+    patcher = patch.dict("sys.modules", mocks)
+    patcher.start()
+    # Purge every real `services*` module not explicitly mocked so crud's
+    # `from services import ...` resolves the sys.modules mock. `monkeypatch.delitem`
+    # (not a bare `del`) per tests/lint_sys_modules.py.
+    for key in list(sys.modules.keys()):
+        if (key == "services" or key.startswith("services.")) and key not in mocks:
+            monkeypatch.delitem(sys.modules, key, raising=False)
+    import services.agent_service.crud as crud
+
+    return crud, {
+        "patcher": patcher,
+        "db": db,
+        "docker_service": docker_service,
+        "docker_utils": docker_utils,
+        "template_service": template_service,
+        "git_service": git_service,
+        "settings_service": settings_service,
+        "ephemeral": ephemeral_mod,
+        "rate_limiter": rate_limiter_mod,
+        "runtime_state": runtime_state_mod,
+    }
+
+
+@pytest.fixture
+def crud_env(monkeypatch):
+    crud, ctx = _load_crud(monkeypatch)
+    try:
+        yield crud, ctx
+    finally:
+        ctx["patcher"].stop()
+
+
+# ---------------------------------------------------------------------------
+# Builders
+# ---------------------------------------------------------------------------
+
+
+def _user(uid=7, username="eugene", role="creator"):
+    u = MagicMock()
+    u.id = uid
+    u.username = username
+    u.role = role
+    u.agent_name = None
+    return u
+
+
+def _roots(monkeypatch, crud, tmp_path):
+    """Point BOTH roots at real, empty tmp dirs and return `(curated, deployed)`.
+
+    Deliberately real directories — never a MagicMock — so the gate is proven
+    against actual `pathlib` calls (see the module docstring).
+    """
+    curated = tmp_path / "curated"
+    curated.mkdir()
+    deployed = tmp_path / "deployed"
+    deployed.mkdir()
+    monkeypatch.setattr(crud, "_LOCAL_TEMPLATE_ROOTS", (curated, deployed))
+    return curated, deployed
+
+
+def _write_template(root: Path, name: str, body: str = "type: business-assistant\n"):
+    d = root / name
+    d.mkdir(parents=True, exist_ok=True)
+    (d / "template.yaml").write_text(body)
+    return d
+
+
+#: An absolute path is a `/` that does NOT continue a relative path — i.e. one
+#: not preceded by a path character. The negative lookbehind (rather than a
+#: `(?:^|\s)` prefix) is load-bearing: a leading-whitespace rule is blind to a
+#: path wrapped in ANY punctuation, and `!r` — the quoting style this module's
+#: own messages already use for `config.template` — wraps in single quotes. A
+#: future `f"...{template_path!r}..."` would emit `'/data/deployed-templates/x'`
+#: and sail straight through a whitespace-anchored guard, shipping the leak with
+#: a green test. `config/agent-templates/` stays clean because its `/` follows
+#: `g`; `/api/...` is an HTTP route, not a filesystem path, and is the message's
+#: whole remedy, so it is the one allowed `/`-rooted form.
+#:
+#: POSIX-only by construction, deliberately: every path that could reach one of
+#: these messages is a `pathlib.Path` built inside the Linux backend container
+#: (`/agent-configs/templates`, `/data/deployed-templates`), so a Windows-style
+#: `C:\...` form is unreachable and a branch for it would be dead regex.
+_ABS_PATH_RE = re.compile(r"(?<![A-Za-z0-9_.\-/])/[A-Za-z0-9_.\-/]+")
+
+#: Naming EITHER root is banned outright, with or without a leading slash: the
+#: plan's binding rule is that one identical message is returned whichever root
+#: missed, because deploy-local templates (#950) are named after AGENT names, so
+#: "which root missed" is itself the #186 enumeration oracle. A relative
+#: `data/deployed-templates/victim` discloses exactly as much as the absolute
+#: form and is invisible to any leading-slash rule. `agent-templates` is NOT
+#: listed — `config/agent-templates/` is the public, intentional remedy.
+_SENSITIVE_ROOT_TOKENS = ("deployed-templates", "agent-configs")
+
+
+def _leaked_paths(msg: str) -> list[str]:
+    """Filesystem disclosure in an error message (API routes excluded).
+
+    MUST always be empty — see `test_t1b` / `test_t6b`.
+    """
+    hits = [p for p in _ABS_PATH_RE.findall(msg) if not p.startswith("/api/")]
+    hits += [t for t in _SENSITIVE_ROOT_TOKENS if t in msg]
+    return hits
+
+
+def _agent_run_kwargs(ctx):
+    """kwargs of the containers_run call that created the AGENT container."""
+    for call in ctx["docker_utils"].containers_run.call_args_list:
+        if call.kwargs.get("detach"):
+            return call.kwargs
+    raise AssertionError("agent container was never created")
+
+
+def _assert_no_side_effects(ctx):
+    """AC#1's real content: the 400 fires BEFORE anything is allocated.
+
+    Asserting only "it raised" would pass even if the gate landed after the
+    MCP-key mint / slot reservation / container run.
+    """
+    ctx["docker_utils"].containers_run.assert_not_awaited()
+    ctx["docker_utils"].volume_create.assert_not_awaited()
+    ctx["db"].create_agent_mcp_api_key.assert_not_called()
+    ctx["db"].register_agent_owner.assert_not_called()
+    ctx["ephemeral"].try_reserve_ephemeral_slot.assert_not_called()
+    ctx["git_service"].reserve_and_generate_instance_id.assert_not_awaited()
+
+
+# ===========================================================================
+# T1 — absent in BOTH roots → 404 UNKNOWN_LOCAL_TEMPLATE (#1793), no side effects
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+async def test_t1_absent_in_both_roots_404_and_no_side_effects(
+    crud_env, monkeypatch, tmp_path
+):
+    """The absent-template contract is #1793's 404. What this adds over
+    `test_1793_unknown_local_template.py` is the pre-side-effect proof: the
+    raise happens before any container, volume, MCP key or ownership row."""
+    crud, ctx = crud_env
+    _roots(monkeypatch, crud, tmp_path)
+
+    with pytest.raises(HTTPException) as exc:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-1759", template="local:nope-1759"), _user(), None
+        )
+
+    assert exc.value.status_code == 404
+    assert exc.value.detail["code"] == "UNKNOWN_LOCAL_TEMPLATE"
+    # #1793 interpolates the STRIPPED name (`raw_name`), not the `local:` id.
+    assert "nope-1759" in exc.value.detail["error"]
+    _assert_no_side_effects(ctx)
+
+
+@pytest.mark.asyncio
+async def test_t1b_error_message_leaks_no_filesystem_path(
+    crud_env, monkeypatch, tmp_path
+):
+    """The whole security surface of this fix.
+
+    ONE identical message regardless of which root missed: deploy-local
+    templates under /data/deployed-templates are named after AGENT names, which
+    #186 does protect — a root-distinguishing (or path-echoing) message would
+    let a creator-role caller probe whether another user's deploy-local agent
+    exists.
+    """
+    crud, ctx = crud_env
+    curated, deployed = _roots(monkeypatch, crud, tmp_path)
+
+    with pytest.raises(HTTPException) as exc:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-leak", template="local:nope-1759"), _user(), None
+        )
+
+    msg = exc.value.detail["error"]
+    assert str(curated) not in msg and str(deployed) not in msg
+    assert str(tmp_path) not in msg
+    assert "/agent-configs/templates" not in msg
+    assert "/data/deployed-templates" not in msg
+    # No absolute path of any shape, and no leading-slash root hint.
+    assert _leaked_paths(msg) == []
+    assert len(msg) < 500
+    # Actionable remedy, abstract only.
+    assert "GET /api/templates" in msg
+
+
+@pytest.mark.asyncio
+async def test_t1c_same_message_whichever_root_missed(crud_env, monkeypatch, tmp_path):
+    """Curated-present / deployed-absent and both-absent must be
+    indistinguishable to the caller."""
+    crud, ctx = crud_env
+    curated, deployed = _roots(monkeypatch, crud, tmp_path)
+    # A sibling template exists in the curated root; the requested one does not.
+    _write_template(curated, "other-1759")
+
+    with pytest.raises(HTTPException) as exc_a:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-a", template="local:nope-1759"), _user(), None
+        )
+
+    # Now make the curated root itself vanish entirely.
+    monkeypatch.setattr(
+        crud, "_LOCAL_TEMPLATE_ROOTS", (tmp_path / "gone-a", tmp_path / "gone-b")
+    )
+    with pytest.raises(HTTPException) as exc_b:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-b", template="local:nope-1759"), _user(), None
+        )
+
+    assert exc_a.value.detail == exc_b.value.detail
+
+
+# ===========================================================================
+# T2 — present in root[0] (curated) → still creates
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+async def test_t2_present_in_curated_root_still_creates(
+    crud_env, monkeypatch, tmp_path
+):
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    _write_template(curated, "tpl-1759")
+
+    await crud.create_agent_internal(
+        AgentConfig(name="ok-curated", template="local:tpl-1759"), _user(), None
+    )
+
+    ctx["docker_utils"].containers_run.assert_awaited()
+    ctx["db"].register_agent_owner.assert_called_once()
+
+
+# ===========================================================================
+# T3 — present ONLY in root[1] (deploy-local store) → still creates
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+async def test_t3_present_only_in_deployed_root_still_creates(
+    crud_env, monkeypatch, tmp_path
+):
+    """#950 deploy-local: deploy.py copytree's the template into
+    /data/deployed-templates and THEN calls create with
+    `local:<version_name>`. A gate written against the curated root alone
+    would 400 every deploy-local agent."""
+    crud, ctx = crud_env
+    _, deployed = _roots(monkeypatch, crud, tmp_path)
+    _write_template(deployed, "deployed-1759")
+
+    await crud.create_agent_internal(
+        AgentConfig(name="ok-deployed", template="local:deployed-1759"), _user(), None
+    )
+
+    ctx["docker_utils"].containers_run.assert_awaited()
+    ctx["db"].register_agent_owner.assert_called_once()
+    # Deploy-local templates deliberately get NO /template bind (#950: the
+    # workspace volume was already pre-populated via put_archive).
+    volumes = _agent_run_kwargs(ctx)["volumes"]
+    assert "/template" not in {v["bind"] for v in volumes.values()}
+
+
+# ===========================================================================
+# T4 — directory exists but no template.yaml (AC#1's "or template.yaml")
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+async def test_t4_directory_without_template_yaml_404(crud_env, monkeypatch, tmp_path):
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    (curated / "bare-1759").mkdir()  # dir exists, no template.yaml
+
+    with pytest.raises(HTTPException) as exc:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-bare", template="local:bare-1759"), _user(), None
+        )
+
+    assert exc.value.status_code == 404
+    assert exc.value.detail["code"] == "UNKNOWN_LOCAL_TEMPLATE"
+    _assert_no_side_effects(ctx)
+
+
+@pytest.mark.asyncio
+async def test_t4b_name_resolving_to_a_regular_file_404(
+    crud_env, monkeypatch, tmp_path
+):
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    (curated / "afile-1759").write_text("not a directory")
+
+    with pytest.raises(HTTPException) as exc:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-file", template="local:afile-1759"), _user(), None
+        )
+
+    assert exc.value.status_code == 404
+    assert exc.value.detail["code"] == "UNKNOWN_LOCAL_TEMPLATE"
+    _assert_no_side_effects(ctx)
+
+
+# ===========================================================================
+# T5 — empty / non-dict template.yaml → 400 LOCAL_TEMPLATE_INVALID (D5)
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "body, label",
+    [
+        ("", "empty file"),
+        ("   \n\n", "whitespace only"),
+        ("# just a comment\n", "comments only"),
+        ("just-a-scalar\n", "scalar document"),
+        ("- a\n- b\n", "list document"),
+    ],
+)
+async def test_t5_non_dict_template_yaml_400(
+    crud_env, monkeypatch, tmp_path, body, label
+):
+    """`yaml.safe_load("")` returns None — identical observable outcome to an
+    absent template (blank agent, HTTP 200) through a different line. The
+    listing path already rejects non-dicts (`_build_local_template`), so the
+    create path was strictly LESS strict than the listing path."""
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    _write_template(curated, "invalid-1759", body=body)
+
+    with pytest.raises(HTTPException) as exc:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-invalid", template="local:invalid-1759"), _user(), None
+        )
+
+    assert exc.value.status_code == 400, label
+    assert exc.value.detail["code"] == "LOCAL_TEMPLATE_INVALID", label
+    assert "local:invalid-1759" in exc.value.detail["error"]
+    _assert_no_side_effects(ctx)
+
+
+# ===========================================================================
+# T6 — unparseable YAML → 400, not a swallowed logger.warning (D5)
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+async def test_t6_unparseable_yaml_400(crud_env, monkeypatch, tmp_path):
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    _write_template(curated, "broken-1759", body="foo: [1, 2\nbar: }{\n")
+
+    with pytest.raises(HTTPException) as exc:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-broken", template="local:broken-1759"), _user(), None
+        )
+
+    assert exc.value.status_code == 400
+    assert exc.value.detail["code"] == "LOCAL_TEMPLATE_INVALID"
+    _assert_no_side_effects(ctx)
+
+
+@pytest.mark.asyncio
+async def test_t6b_invalid_message_leaks_no_filesystem_path(
+    crud_env, monkeypatch, tmp_path
+):
+    """Same disclosure rule as the NOT_FOUND message — and additionally the
+    raw parser error (which quotes the file path and file contents) must not
+    be echoed to the caller."""
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    _write_template(curated, "broken-1759", body="foo: [1, 2\nbar: }{\n")
+
+    with pytest.raises(HTTPException) as exc:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-broken2", template="local:broken-1759"), _user(), None
+        )
+
+    msg = exc.value.detail["error"]
+    assert str(tmp_path) not in msg
+    assert _leaked_paths(msg) == []
+    assert len(msg) < 500
+
+
+# ===========================================================================
+# T7 — template "" / None never enter the local: branch (Blank Agent)
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("template", ["", None])
+async def test_t7_blank_agent_unaffected(crud_env, monkeypatch, tmp_path, template):
+    """The UI's "Blank Agent" sends `template: ''` (CreateAgentModal.vue). The
+    gate lives inside `_resolve_local_template`, which `if config.template:`
+    never reaches for these — this pins that it stays that way."""
+    crud, ctx = crud_env
+    _roots(monkeypatch, crud, tmp_path)  # both roots empty
+
+    await crud.create_agent_internal(
+        AgentConfig(
+            name=f"blank-{'empty' if template == '' else 'none'}", template=template
+        ),
+        _user(),
+        None,
+    )
+
+    ctx["docker_utils"].containers_run.assert_awaited()
+    ctx["db"].register_agent_owner.assert_called_once()
+
+
+# ===========================================================================
+# T8 — malformed name still fails FIRST with INVALID_LOCAL_TEMPLATE_NAME
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "raw", ["../etc", "..", "a/b", "a\\b", ".hidden", "", "has space"]
+)
+async def test_t8_malformed_name_wins_first(crud_env, monkeypatch, tmp_path, raw):
+    """The traversal barrier (#950) must keep precedence over the new
+    existence gate — otherwise a hostile name would be reported as
+    "not found", which is a weaker (and differently-shaped) rejection.
+    Zero coverage before #1759."""
+    crud, ctx = crud_env
+    _roots(monkeypatch, crud, tmp_path)
+
+    with pytest.raises(HTTPException) as exc:
+        await crud.create_agent_internal(
+            AgentConfig(name="nf-malformed", template=f"local:{raw}"), _user(), None
+        )
+
+    assert exc.value.status_code == 400
+    assert exc.value.detail["code"] == "INVALID_LOCAL_TEMPLATE_NAME"
+    _assert_no_side_effects(ctx)
+
+
+# ===========================================================================
+# T10 — the /template bind source (seam 2, crud.py:_stage_config_files)
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+async def test_t10_bind_source_honours_host_templates_path(
+    crud_env, monkeypatch, tmp_path
+):
+    """Byte-identical to today's behaviour when HOST_TEMPLATES_PATH is set —
+    which compose always does (docker-compose.prod.yml:138), i.e. the verified
+    container path is unchanged by the seam-2 widening."""
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    _write_template(curated, "bindtpl-1759")
+    monkeypatch.setenv("HOST_TEMPLATES_PATH", "/host/templates")
+
+    await crud.create_agent_internal(
+        AgentConfig(name="bind-set", template="local:bindtpl-1759"), _user(), None
+    )
+
+    volumes = _agent_run_kwargs(ctx)["volumes"]
+    assert volumes["/host/templates/bindtpl-1759"] == {
+        "bind": "/template",
+        "mode": "ro",
+    }
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("env_value", [None, ""])
+async def test_t10b_bind_source_absolute_when_host_path_unset_or_empty(
+    crud_env, monkeypatch, tmp_path, env_value
+):
+    """F8: `HOST_TEMPLATES_PATH` defaulted to the RELATIVE
+    "./config/agent-templates" (Docker rejects a relative bind source), and an
+    EMPTY value made `Path("") / name` → a bare name → an empty NAMED VOLUME
+    mounted at /template — a silently blank template, the exact bug class this
+    issue kills, one seam over. `os.getenv(k) or default` closes both."""
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    _write_template(curated, "bindtpl-1759")
+    if env_value is None:
+        monkeypatch.delenv("HOST_TEMPLATES_PATH", raising=False)
+    else:
+        monkeypatch.setenv("HOST_TEMPLATES_PATH", env_value)
+
+    await crud.create_agent_internal(
+        AgentConfig(
+            name=f"bind-{'unset' if env_value is None else 'empty'}",
+            template="local:bindtpl-1759",
+        ),
+        _user(),
+        None,
+    )
+
+    volumes = _agent_run_kwargs(ctx)["volumes"]
+    sources = [s for s, v in volumes.items() if v["bind"] == "/template"]
+    assert len(sources) == 1
+    source = sources[0]
+    # Never a bare name (that is a named volume, not a bind) and never relative.
+    assert source != "bindtpl-1759"
+    assert Path(source).is_absolute(), source
+    assert source == str(crud._repo_local_templates_dir() / "bindtpl-1759")
+
+
+# ===========================================================================
+# Field-level malformation stays a DEGRADE, not a 400 and not a 500
+# ===========================================================================
+
+
+@pytest.mark.asyncio
+async def test_malformed_field_still_creates_and_names_the_template(
+    crud_env, monkeypatch, tmp_path, caplog
+):
+    """#1759 narrowed the PARSE, not the field mutation.
+
+    A `template.yaml` that parses to a dict but carries a malformed FIELD
+    (`credentials: "a string"` → `creds.get(...)` raises `AttributeError`) is
+    still swallowed into a warning, on purpose: the file is valid YAML, the
+    agent gets its template files, and only some `config` mutations are
+    skipped. Tightening that to a 400 would reject templates that deploy today
+    and is outside this issue's ACs.
+
+    This pins two things the swallow must never lose:
+
+    1. It stays a DEGRADE — the handler runs inside an `except`, so a bug in
+       the handler itself (a missing attribute in the log call) would convert a
+       graceful degrade into a 500 on the create path.
+    2. The warning names the template AND the agent. Without them an operator
+       has no way to find which agent came out subtly wrong.
+    """
+    crud, ctx = crud_env
+    curated, _ = _roots(monkeypatch, crud, tmp_path)
+    _write_template(
+        curated,
+        "badfield-1759",
+        "type: business-assistant\ncredentials: not-a-mapping\n",
+    )
+
+    with caplog.at_level("WARNING"):
+        await crud.create_agent_internal(
+            AgentConfig(name="degrade-1759", template="local:badfield-1759"),
+            _user(),
+            None,
+        )
+
+    # 1. Still created — no raise, container really ran.
+    _agent_run_kwargs(ctx)
+
+    # 2. The warning is greppable by template and by agent.
+    warnings = [r.getMessage() for r in caplog.records if r.levelname == "WARNING"]
+    hits = [w for w in warnings if "badfield-1759" in w and "degrade-1759" in w]
+    assert hits, (
+        f"no warning named both the template and the agent; got: {warnings}"
+    )
diff --git a/tests/unit/test_1759_template_root_parity.py b/tests/unit/test_1759_template_root_parity.py
new file mode 100644
index 000000000..3d1e39e7b
--- /dev/null
+++ b/tests/unit/test_1759_template_root_parity.py
@@ -0,0 +1,205 @@
+"""Parity guard: the CREATE resolver and the LISTING surface must agree on
+where curated local templates live (#1759).
+
+Two surfaces resolve `local:` templates and they disagreed outside a container:
+
+* `services/template_service.py::_local_templates_dir()` (LISTING) has a
+  repo-relative fallback, added by #843.
+* `services/agent_service/crud.py::_LOCAL_TEMPLATE_ROOTS` (CREATE) had none —
+  two absolute container paths resolved at import.
+
+Before #1759 that asymmetry was merely latent (an unresolvable template
+silently produced a blank agent). Once create HARD-FAILS on an absent
+template, the asymmetry becomes: `GET /api/templates` lists `local:scout`
+while `POST /api/agents` 400s it in every source-run backend (dev shell,
+source-run CI, unit tests).
+
+**This file must NOT use the `_load_crud` MagicMock harness.** In that harness
+`services.template_service` is a MagicMock, so a gate that called
+`_local_templates_dir()` would be satisfied by a truthy mock and the #1484
+characterization tests would stay green on the OLD behaviour — silently. The
+parity is therefore pinned here, against BOTH real modules, in the same
+byte-parity-mirror spirit as `test_credential_paths_parity.py` /
+`test_model_context_parity.py` (Invariant #5).
+
+The specific bug this exists to kill: `crud.py` sits ONE directory deeper than
+`template_service.py` (`services/agent_service/` vs `services/`), so a
+copy-pasted `.parent * 4` fallback yields `<repo>/src/config/agent-templates`,
+which does not exist — and every `local:` create would 400 on a source run.
+
+Target: src/backend/services/agent_service/crud.py
+Issue:  abilityai/trinity#1759
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+import pytest
+
+# Env prerequisites before any backend import (repo test convention). These
+# modules are imported FOR REAL here, so the backend's import-time bootstrap
+# (config + init_database) must find a usable environment.
+os.environ.setdefault("REDIS_URL", "redis://test:test@redis:6379")
+os.environ.setdefault("REDIS_PASSWORD", "test")
+os.environ.setdefault("REDIS_BACKEND_PASSWORD", "test")
+os.environ.setdefault("AGENT_AUTH_SECRET", "0" * 64)
+_TMP_DB = Path(tempfile.gettempdir()) / "trinity_test_1759_root_parity.db"
+os.environ.setdefault("TRINITY_DB_PATH", str(_TMP_DB))
+
+_PROJECT_ROOT = Path(__file__).resolve().parents[2]
+_BACKEND = str(_PROJECT_ROOT / "src" / "backend")
+if _BACKEND not in sys.path:
+    sys.path.insert(0, _BACKEND)
+
+pytestmark = pytest.mark.unit
+
+_CONTAINER_CURATED_ROOT = Path("/agent-configs/templates")
+
+
+@pytest.fixture(scope="module")
+def real_modules():
+    """The two REAL modules — no mocks, no `_load_crud`."""
+    import services.agent_service.crud as crud
+    import services.template_service as template_service
+
+    return crud, template_service
+
+
+def test_crud_repo_fallback_points_at_the_real_catalog(real_modules):
+    """The strongest, least tautological assertion: the fallback must resolve
+    to a directory that actually contains a shipped template."""
+    crud, _ = real_modules
+    repo_dir = crud._repo_local_templates_dir()
+
+    assert repo_dir.is_dir(), (
+        f"crud's repo-relative template fallback does not exist: {repo_dir}. "
+        f"`parents[4]`, not `.parent * 4` — crud.py is one directory deeper "
+        f"than template_service.py."
+    )
+    assert (
+        repo_dir / "scout" / "template.yaml"
+    ).is_file(), f"{repo_dir} is not the curated catalog (no scout/template.yaml)."
+    # The exact wrong answer that `.parent * 4` produces.
+    assert repo_dir.parent.name != "src", (
+        f"{repo_dir} looks like the `.parent * 4` off-by-one "
+        f"(<repo>/src/config/agent-templates)."
+    )
+
+
+def test_crud_and_template_service_fallbacks_agree(real_modules):
+    """Both fallbacks are derived from their own module file, so this pins the
+    DEPTH RELATIONSHIP between the two modules rather than copying a constant.
+    If either module moves directories, this fails."""
+    crud, template_service = real_modules
+    ts_fallback = (
+        Path(template_service.__file__).resolve().parents[3]
+        / "config"
+        / "agent-templates"
+    )
+    assert crud._repo_local_templates_dir() == ts_fallback
+
+
+def test_curated_root_matches_listing_surface(real_modules):
+    """End-to-end parity: the root CREATE resolves against is the directory
+    LISTING enumerates — in a container (bind mount present) and out of one."""
+    crud, template_service = real_modules
+    listing_dir = template_service._local_templates_dir()
+    curated_root = crud._LOCAL_TEMPLATE_ROOTS[0]
+
+    assert curated_root == listing_dir.resolve()
+    if not _CONTAINER_CURATED_ROOT.exists():
+        assert curated_root == crud._repo_local_templates_dir()
+
+
+def test_deploy_local_root_is_unchanged(real_modules):
+    """Root[1] is a runtime writable store with no repo equivalent (#950) —
+    it must stay the absolute container path, byte-identical to
+    `deploy.DEPLOYED_TEMPLATES_DIR_IN_BACKEND`."""
+    crud, _ = real_modules
+    assert crud._LOCAL_TEMPLATE_ROOTS[1] == Path("/data/deployed-templates")
+    assert len(crud._LOCAL_TEMPLATE_ROOTS) == 2
+
+
+def test_every_shipped_template_resolves_through_the_create_gate(real_modules):
+    """No template in the shipped catalog may 400 on create.
+
+    `hidden: true` fixtures are included on purpose — they are excluded from
+    the user-facing listing but remain creatable by id, which the test/canary
+    harness depends on.
+    """
+    crud, _ = real_modules
+    catalog = crud._repo_local_templates_dir()
+    names = sorted(
+        d.name
+        for d in catalog.iterdir()
+        if d.is_dir() and (d / "template.yaml").is_file()
+    )
+    assert names, f"no templates found under {catalog}"
+
+    unresolvable = [
+        n
+        for n in names
+        if not (
+            crud._safe_local_template_path(n, crud._LOCAL_TEMPLATE_ROOTS[0])
+            / "template.yaml"
+        ).exists()
+    ]
+    assert (
+        not unresolvable
+    ), f"shipped templates unreachable by the create resolver: {unresolvable}"
+    # AC#2: `local:default` is referenced by the live-server suites and by the
+    # onboarding/manifest docs as a real, deployable template id.
+    assert "default" in names
+
+
+# ===========================================================================
+# Seam 2, container branch — the byte-identity claim D1-A3 rests on
+# ===========================================================================
+#
+# Widening the `/template` bind decision was justified by "the delta in the
+# verified container path is provably zero". Every other test in this branch
+# runs on a source checkout, where `/agent-configs/templates` does NOT exist —
+# so they only ever exercise the repo-fallback branch, and the container branch
+# (the one that actually ships) had no coverage at all. `.exists()` is read
+# from the module global at call time, so pointing that global at a real
+# directory exercises the in-container branch without a container.
+
+
+def test_container_branch_host_base_is_byte_identical_to_pre_1759(
+    real_modules, monkeypatch, tmp_path
+):
+    """Inside a Trinity container the bind-source base must be the literal
+    pre-#1759 default, character for character.
+
+    If this drifts, every containerised `local:` create silently changes where
+    `/template` is mounted from — the failure mode would be a wrong-but-present
+    template, which is strictly worse than the blank agent #1759 set out to
+    kill.
+    """
+    crud, _ = real_modules
+    fake_container_root = tmp_path / "agent-configs" / "templates"
+    fake_container_root.mkdir(parents=True)
+    monkeypatch.setattr(crud, "_CONTAINER_CURATED_TEMPLATES", fake_container_root)
+
+    assert crud._default_host_templates_base() == "./config/agent-templates"
+    # ...and the curated root follows the bind mount, not the repo.
+    assert crud._curated_templates_root() == fake_container_root.resolve()
+
+
+def test_host_branch_base_is_absolute_so_docker_accepts_it(
+    real_modules, monkeypatch, tmp_path
+):
+    """Outside a container the repo path IS a host path, so the fallback must
+    be absolute — Docker rejects a relative bind source outright."""
+    crud, _ = real_modules
+    monkeypatch.setattr(
+        crud, "_CONTAINER_CURATED_TEMPLATES", tmp_path / "definitely-absent"
+    )
+
+    base = crud._default_host_templates_base()
+    assert Path(base).is_absolute(), base
+    assert base == str(crud._repo_local_templates_dir())
diff --git a/tests/unit/test_ent124_default_system_seed.py b/tests/unit/test_ent124_default_system_seed.py
index 09dde0be4..510646996 100644
--- a/tests/unit/test_ent124_default_system_seed.py
+++ b/tests/unit/test_ent124_default_system_seed.py
@@ -151,9 +151,14 @@ def test_bundled_manifest_parses_and_validates():
 
 
 def test_bundled_manifest_local_templates_exist_in_tree():
-    """learnings 2026-07-23: an absent local: template creates a BLANK agent —
-    deploy reports success and the seed flag latches. Only tree-existence
-    pins the manifest to real content."""
+    """learnings 2026-07-23: an absent local: template used to create a BLANK
+    agent — deploy reported success and the seed flag latched. #1759 closed
+    that (create now 404s `UNKNOWN_LOCAL_TEMPLATE`), so this check is now
+    belt-and-braces rather than the only line of defence. KEPT deliberately: it
+    fails at collection time with a precise message naming the offending
+    manifest entry, whereas the runtime gate would surface as a first-run seed
+    landing in the operator queue. It also still covers the CLAUDE.md half
+    (ent#239), which the create gate does not check at all."""
     manifest = system_service.parse_manifest(REAL_MANIFEST.read_text(encoding="utf-8"))
     for short, cfg in manifest.agents.items():
         assert cfg.template.startswith("local:"), f"{short}: PAT-free seed requires local: templates"
diff --git a/tests/unit/test_ent125_resilient_system_deploy.py b/tests/unit/test_ent125_resilient_system_deploy.py
index 62a7ff30c..7af3e670b 100644
--- a/tests/unit/test_ent125_resilient_system_deploy.py
+++ b/tests/unit/test_ent125_resilient_system_deploy.py
@@ -144,6 +144,55 @@ def test_partial_deploy_continues_and_reports(env):
     assert any("duplicates" in w for w in data["warnings"])
 
 
+def test_absent_local_template_surfaces_per_agent(env):
+    """AC#3 of #1759: the create-time reject must reach the operator through
+    the ent#125 per-agent `failed[]` report, not abort the whole manifest.
+
+    No new plumbing is needed — this asserts that by construction. Note
+    `_failure_reason` keeps only `detail["error"]` and DROPS `detail["code"]`,
+    which is why the error sentence has to stand alone and name its own
+    remedy.
+
+    The fixture below MUST mirror the live contract verbatim: it constructs its
+    own `HTTPException`, so a drift between this literal and
+    `_resolve_local_template` passes green while asserting a contract that no
+    longer exists. It is a 404 `UNKNOWN_LOCAL_TEMPLATE` (#1793), and the message
+    interpolates the STRIPPED name (`raw_name`), not the `local:` id.
+    """
+    real_404 = HTTPException(
+        status_code=404,
+        detail={
+            "error": (
+                "Local template 'typo-template' was not found. Check the id "
+                "against GET /api/templates — note that hidden templates are "
+                "omitted from that listing but remain creatable by id. To "
+                "create an agent with no template at all, omit the 'template' "
+                "field."
+            ),
+            "code": "UNKNOWN_LOCAL_TEMPLATE",
+        },
+    )
+    _fail_agent(env, "alpha", real_404)
+
+    resp = _deploy(env, TWO_AGENT_MANIFEST)
+
+    assert resp.status_code == 200
+    data = resp.json()
+    assert data["status"] == "partial"
+    assert data["agents_created"] == ["test-sys-beta"]
+    failure = data["failed"][0]
+    assert failure["name"] == "test-sys-alpha"
+    assert failure["status_code"] == 404
+    # The sentence survives intact and is self-contained: `code` is dropped by
+    # `_failure_reason`, so the operator only ever sees this string.
+    assert failure["reason"].startswith("Local template 'typo-template' was not found")
+    assert "GET /api/templates" in failure["reason"]
+    assert "UNKNOWN_LOCAL_TEMPLATE" not in failure["reason"]
+    # The sibling agent still deployed — one typo'd template does not sink the
+    # manifest (the trinity-enterprise#124 first-run-seed failure mode).
+    assert env.m.create_agent.await_count == 2
+
+
 def test_partial_deploy_scopes_config_to_survivors(env):
     _fail_agent(env, "alpha", HTTPException(status_code=409, detail="conflict"))
 
diff --git a/tests/unit/test_local_templates_listing.py b/tests/unit/test_local_templates_listing.py
index 113447011..065e4b6e7 100644
--- a/tests/unit/test_local_templates_listing.py
+++ b/tests/unit/test_local_templates_listing.py
@@ -302,6 +302,12 @@ def test_real_catalog_hides_all_known_fixtures(monkeypatch):
         "test-echo", "test-counter", "test-delegator", "test-codex",
         "test-gemini", "sleep-echo", "test-leak-hook",
         "demo-researcher", "demo-analyst", "trinity-system",
+        # #1759: `default` matches NEITHER the test-/demo- prefix convention
+        # checked below NOR any other guard, so an author dropping its
+        # `hidden: true` would leak a bare "Default" entry into every user's
+        # Create-Agent picker — duplicating the UI's own "Blank Agent" option
+        # — with no CI signal at all. Listed explicitly for exactly that reason.
+        "default",
     }
     leaked = forbidden & ids
     assert not leaked, f"internal fixtures leaked into the catalog: {sorted(leaked)}"

From e66ec72ab48174473a5c4525bf11a1ae04ef19d4 Mon Sep 17 00:00:00 2001
From: dolho <66411456+dolho@users.noreply.github.com>
Date: Tue, 28 Jul 2026 17:26:34 +0300
Subject: [PATCH 08/25] fix(rename): derive the rename cascade from AGENT_REFS,
 not a second hand list (#1819) (#1851)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(rename): derive the rename cascade from AGENT_REFS, not a second hand list (#1819)

Renaming an agent stranded its Session-tab history: the rows survived under the
old slug and nothing could reach them. `--resume` continuity — the tab's whole
point — was gone, and the rename reported success.

The cause is structural, and bigger than the reported symptom. `cascade_delete`
consumed `db.agent_cleanup.AGENT_REFS`; `rename_agent` kept its own sequence of
hand-written `update()` calls. Two lists answering one question, so every table
added since only ever joined one of them. Measured on this schema: the registry
carries 41 tables, the rename list 19 — it had fallen **23 tables** behind.
Beyond sessions and session messages, a rename also stranded reminders, loops,
notifications, events and event subscriptions, operator-queue items, sync state,
compatibility results, per-user memory, access requests, dashboard cache,
nevermined config, and the Telegram / WhatsApp / VoIP / Slack channel bindings.

`cascade_rename` already existed in `agent_cleanup.py`, registry-driven and
complete — with ZERO callers. Wiring it in is the fix. Verified safe before
switching: every table the hand-written path touched is already in the registry
(strict subset), `cascade_rename` skips absent tables, and it handles the
multi-column refs the old code spelled out twice.

The docstring listed tables by hand too, and had rotted the same way — replaced
with a statement of where the list comes from, since that list was the defect.

One deliberate narrowing, pinned by its own test: the old code re-keyed EVERY
`mcp_api_keys` row carrying the agent's name; the registry declares two
scope-filtered refs (`agent`, `connector`), so a user- or system-scoped row no
longer follows. That is what makes rename and delete one rule — `cascade_delete`
already used exactly these filters — and those scopes are provenance, not
ownership.

Tests (`test_1819_rename_cascade_parity.py`, 4 cases, all four fail on the
pre-fix code):
  * behavioural — seed one row per registered table against the REAL schema,
    rename, assert nothing is left behind. Reports what it could not seed so the
    coverage claim stays honest rather than silently shrinking.
  * the reported symptom on its own, with realistic session + message rows.
  * the mcp_api_keys scope narrowing.
  * structural — `rename_agent` may not re-grow a private table list; a future
    `update(<table>)` there fails CI, which is the drift that caused this.

Verified live on a dev instance: an agent with 1 session and 10 reports renamed
and back, with `agent_sessions`, `agent_session_messages`, `agent_reports`,
`agent_events`, `agent_event_subscriptions`, `operator_queue` and `mcp_api_keys`
all at zero rows under the old name afterwards.

Not included: the rooms dark-mode defects added to this issue by the second
comment. Those files live only on `feature/ent170-sessions-ui` (the rooms
components do not exist on dev), so they need a separate PR on that base.

Related to #1819

* refactor(rename): drop the 15 table imports the registry pass made dead (#1819)

`rename_agent` was the only consumer of these; `cascade_rename` resolves its
tables from the registry, so the import block outlived its use. Left in place
it re-suggests the hand-maintained list this change exists to remove.

Kept: agent_ownership, agent_sharing, agent_permissions, agent_git_config —
still used by other MetadataMixin methods.

Related to #1819
---
 src/backend/db/agent_settings/metadata.py     | 210 +++---------
 tests/unit/test_1819_rename_cascade_parity.py | 310 ++++++++++++++++++
 2 files changed, 350 insertions(+), 170 deletions(-)
 create mode 100644 tests/unit/test_1819_rename_cascade_parity.py

diff --git a/src/backend/db/agent_settings/metadata.py b/src/backend/db/agent_settings/metadata.py
index 74e5ec83f..4bff121ee 100644
--- a/src/backend/db/agent_settings/metadata.py
+++ b/src/backend/db/agent_settings/metadata.py
@@ -13,23 +13,8 @@
 from ..tables import (
     agent_ownership,
     agent_sharing,
-    agent_schedules,
-    schedule_executions,
-    chat_sessions,
-    chat_messages,
-    agent_activities,
     agent_permissions,
-    agent_shared_folder_config,
     agent_git_config,
-    agent_skills,
-    agent_tags,
-    agent_public_links,
-    mcp_api_keys,
-    agent_health_checks,
-    agent_dashboard_values,
-    monitoring_alert_cooldowns,
-    agent_shared_files,
-    agent_reports,
 )
 
 
@@ -92,26 +77,16 @@ def rename_agent(self, old_name: str, new_name: str) -> bool:
         """
         Rename an agent by updating all database references.
 
-        This updates agent_name in all tables that reference it:
-        - agent_ownership (primary)
-        - agent_sharing
-        - agent_schedules
-        - schedule_executions
-        - chat_sessions
-        - chat_messages
-        - agent_activities
-        - agent_permissions (source and target)
-        - agent_shared_folder_config
-        - agent_git_config
-        - agent_skills
-        - agent_tags
-        - agent_public_links
-        - mcp_api_keys
-        - agent_health_checks
-        - agent_dashboard_values
-        - monitoring_alert_cooldowns
-        - agent_shared_files
-        - agent_reports
+        Re-keys `agent_name` in `agent_ownership` (here) and in EVERY table
+        registered in `db.agent_cleanup.AGENT_REFS` (via `cascade_rename`),
+        plus any entitled-module table registered at runtime through
+        `register_agent_owned_table`.
+
+        Deliberately NOT a hand-maintained list of tables (#1819): the previous
+        docstring enumerated 19 and the code matched it, while the registry had
+        grown to 41 — so a rename silently stranded 23 tables' worth of the
+        agent's data, including its Session-tab history. The list is derived
+        now; adding a table to `AGENT_REFS` is all a new feature has to do.
 
         Args:
             old_name: Current agent name
@@ -210,136 +185,39 @@ def rename_agent(self, old_name: str, new_name: str) -> bool:
                     )
                 )
 
-                # Sharing
-                conn.execute(
-                    update(agent_sharing)
-                    .where(agent_sharing.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Schedules
-                conn.execute(
-                    update(agent_schedules)
-                    .where(agent_schedules.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Executions
-                conn.execute(
-                    update(schedule_executions)
-                    .where(schedule_executions.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Chat sessions
-                conn.execute(
-                    update(chat_sessions)
-                    .where(chat_sessions.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Chat messages
-                conn.execute(
-                    update(chat_messages)
-                    .where(chat_messages.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Activities
-                conn.execute(
-                    update(agent_activities)
-                    .where(agent_activities.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Permissions (both source and target)
-                conn.execute(
-                    update(agent_permissions)
-                    .where(agent_permissions.c.source_agent == old_name)
-                    .values(source_agent=new_name)
-                )
-                conn.execute(
-                    update(agent_permissions)
-                    .where(agent_permissions.c.target_agent == old_name)
-                    .values(target_agent=new_name)
-                )
-
-                # Shared folder config
-                conn.execute(
-                    update(agent_shared_folder_config)
-                    .where(agent_shared_folder_config.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Git config
-                conn.execute(
-                    update(agent_git_config)
-                    .where(agent_git_config.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Skills
-                conn.execute(
-                    update(agent_skills)
-                    .where(agent_skills.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Tags
-                conn.execute(
-                    update(agent_tags)
-                    .where(agent_tags.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Public links
-                conn.execute(
-                    update(agent_public_links)
-                    .where(agent_public_links.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # MCP API keys
-                conn.execute(
-                    update(mcp_api_keys)
-                    .where(mcp_api_keys.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Health checks
-                conn.execute(
-                    update(agent_health_checks)
-                    .where(agent_health_checks.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Dashboard values
-                conn.execute(
-                    update(agent_dashboard_values)
-                    .where(agent_dashboard_values.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
-
-                # Monitoring cooldowns
-                conn.execute(
-                    update(monitoring_alert_cooldowns)
-                    .where(monitoring_alert_cooldowns.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
+                # Every other agent-keyed table, from the ONE registry
+                # (#1819). This used to be ~19 hand-written `update()` blocks,
+                # and the list had silently fallen 23 tables behind
+                # `AGENT_REFS`: a rename stranded the agent's Session-tab
+                # history (the reported symptom), and also its reminders,
+                # loops, notifications, operator-queue items, sync state,
+                # compatibility results, per-user memory, and its Telegram /
+                # WhatsApp / VoIP / Slack channel bindings.
+                #
+                # `cascade_rename` was written for exactly this and had ZERO
+                # callers — the delete path consumed the registry while rename
+                # kept its own copy, so every table added since only ever
+                # joined one of them. Two hand-maintained lists for one
+                # question is the defect; deriving both from `AGENT_REFS` is
+                # the fix, and `test_1819_rename_cascade_parity.py` fails CI if
+                # they diverge again.
+                #
+                # Safe by construction: every table the old sequence touched is
+                # already in the registry (verified — the hand list was a strict
+                # subset), `cascade_rename` skips absent tables, and it handles
+                # the multi-column refs (`agent_permissions.source_agent` /
+                # `.target_agent`, the event-subscription pair) the hand list
+                # spelled out twice.
+                from db.agent_cleanup import cascade_rename
 
-                # Shared files (outbound — amazing-file-outbound).
-                # FK has ON UPDATE CASCADE as belt-and-suspenders; this keeps
-                # the explicit cascade list complete for visibility.
-                conn.execute(
-                    update(agent_shared_files)
-                    .where(agent_shared_files.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
+                cascade_rename(conn, old_name, new_name)
 
                 # Entitled-module agent-scoped tables (ent#46) registered via
-                # db.agent_cleanup.register_agent_owned_table — e.g.
-                # enterprise_connectors. Table/column come from code (not user
-                # input); values are bound. Absent tables are skipped.
+                # db.agent_cleanup.register_agent_owned_table. Kept separate
+                # from the registry pass: these are runtime-registered by the
+                # private submodule, so they are not in `AGENT_REFS` at import
+                # time. Table/column come from code (not user input); values
+                # are bound. Absent tables are skipped.
                 from db.agent_cleanup import EXTRA_AGENT_REFS, _table_exists
                 for table, column in EXTRA_AGENT_REFS:
                     if not _table_exists(conn, table):
@@ -348,14 +226,6 @@ def rename_agent(self, old_name: str, new_name: str) -> bool:
                         text(f"UPDATE {table} SET {column} = :new WHERE {column} = :old"),
                         {"new": new_name, "old": old_name},
                     )
-                # Reports (#918) — re-key so the renamed agent keeps its report
-                # history and the old name doesn't leave orphaned rows a reused
-                # name could inherit (cross-tenant disclosure).
-                conn.execute(
-                    update(agent_reports)
-                    .where(agent_reports.c.agent_name == old_name)
-                    .values(agent_name=new_name)
-                )
 
                 return True
 
diff --git a/tests/unit/test_1819_rename_cascade_parity.py b/tests/unit/test_1819_rename_cascade_parity.py
new file mode 100644
index 000000000..dbc6754d2
--- /dev/null
+++ b/tests/unit/test_1819_rename_cascade_parity.py
@@ -0,0 +1,310 @@
+"""Rename follows the SAME registry as delete (#1819).
+
+The reported symptom was that renaming an agent stranded its Session-tab
+history. The cause was structural: `cascade_delete` consumed
+`db.agent_cleanup.AGENT_REFS`, while `rename_agent` kept its own hand-written
+sequence of `update()` calls — two lists answering one question. Every table
+added since only ever joined one of them, so by the time this was filed the
+rename list had fallen **23 tables** behind the registry: sessions and session
+messages (reported), plus reminders, loops, notifications, events, operator
+queue, sync state, compatibility results, per-user memory, and the Telegram /
+WhatsApp / VoIP / Slack channel bindings.
+
+`test_agent_cleanup_parity.py` already guards schema ↔ registry. This guards
+registry ↔ **rename behaviour**, which is the half that was missing:
+
+  * behavioural — seed one row per registered table under the old name, rename,
+    and assert NOTHING is left behind. This fails on the pre-fix code.
+  * structural — `rename_agent` must not grow a private table list again.
+
+The behavioural test drives the real `rename_agent` against the real schema, so
+it cannot pass by agreeing with a mock about which tables exist.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND = Path(__file__).resolve().parent.parent.parent / "src" / "backend"
+_BACKEND_STR = str(_BACKEND)
+while _BACKEND_STR in sys.path:
+    sys.path.remove(_BACKEND_STR)
+sys.path.insert(0, _BACKEND_STR)
+
+_TESTS = Path(__file__).resolve().parent.parent
+if str(_TESTS) not in sys.path:
+    sys.path.insert(0, str(_TESTS))
+
+OLD = "rename-probe-old"
+NEW = "rename-probe-new"
+
+
+@pytest.fixture
+def sqlite_db(tmp_path, monkeypatch):
+    """Real production schema on a throwaway SQLite file."""
+    try:
+        from db.engine import dispose_engines
+        from db_harness import bootstrap_schema
+    except ImportError:  # pragma: no cover - backend venv required
+        pytest.skip("backend venv required")
+    monkeypatch.setenv("TRINITY_DB_PATH", str(tmp_path / "trinity.db"))
+    monkeypatch.delenv("DATABASE_URL", raising=False)
+    dispose_engines()
+    bootstrap_schema()
+    yield
+    dispose_engines()
+
+
+def _columns(conn, table: str) -> dict:
+    from sqlalchemy import text
+
+    rows = conn.execute(text(f"PRAGMA table_info({table})")).all()
+    # name -> (type, notnull, default, pk)
+    return {r[1]: (r[2] or "", r[3], r[4], r[5]) for r in rows}
+
+
+def _placeholder(coltype: str, name: str) -> object:
+    t = (coltype or "").upper()
+    if "INT" in t:
+        return 1
+    if "REAL" in t or "FLOA" in t or "DOUB" in t or "NUMERIC" in t:
+        return 1.0
+    # A timestamp-ish TEXT column with NOT NULL is common; any string works
+    # since nothing here parses it.
+    return f"seed-{name}"
+
+
+def _seed_row(conn, table: str, agent_column: str) -> bool:
+    """Insert one minimally-valid row for `table` keyed to OLD.
+
+    Returns False when the table cannot be seeded generically (e.g. a required
+    column this helper cannot synthesize); such tables are reported so the
+    coverage claim stays honest rather than silently shrinking.
+    """
+    from sqlalchemy import text
+
+    cols = _columns(conn, table)
+    if agent_column not in cols:
+        return False
+
+    values = {}
+    for name, (coltype, notnull, default, pk) in cols.items():
+        if name == agent_column:
+            values[name] = OLD
+        elif name == "scope":
+            # Some refs are scope-filtered (mcp_api_keys). A synthetic scope
+            # matches no filter, which would look like a strand when it is
+            # really this seeder's fault — see
+            # test_scope_filtered_keys_narrow_deliberately for the rows the
+            # filters intentionally leave alone.
+            values[name] = "agent"
+        elif pk and "INT" in (coltype or "").upper():
+            continue  # let AUTOINCREMENT assign
+        elif notnull and default is None:
+            values[name] = _placeholder(coltype, name)
+    collist = ", ".join(values)
+    binds = ", ".join(f":{c}" for c in values)
+    try:
+        conn.execute(text(f"INSERT INTO {table} ({collist}) VALUES ({binds})"), values)
+        return True
+    except Exception:
+        return False
+
+
+def test_rename_rekeys_every_registered_table(sqlite_db):
+    """Seed one row per AGENT_REFS entry, rename, assert none stay behind."""
+    from sqlalchemy import text
+
+    from db.agent_cleanup import AGENT_REFS
+    from db.engine import get_engine
+    from db.agent_settings.metadata import MetadataMixin
+
+    seeded: list[tuple[str, str]] = []
+    unseedable: list[str] = []
+    with get_engine().begin() as conn:
+        conn.execute(
+            text(
+                "INSERT INTO users (id, username, role, created_at, updated_at) "
+                "VALUES (1, 'admin', 'admin', 'now', 'now')"
+            )
+        )
+        conn.execute(
+            text(
+                "INSERT INTO agent_ownership (agent_name, owner_id, created_at) "
+                "VALUES (:n, 1, 'now')"
+            ),
+            {"n": OLD},
+        )
+        for ref in AGENT_REFS:
+            if _seed_row(conn, ref.table, ref.column):
+                seeded.append((ref.table, ref.column))
+            else:
+                unseedable.append(f"{ref.table}.{ref.column}")
+
+    # The guard is only as good as its coverage — say what it could not seed.
+    assert len(seeded) >= 25, (
+        f"only seeded {len(seeded)} registry tables; coverage too thin to trust. "
+        f"unseedable={unseedable}"
+    )
+
+    assert MetadataMixin().rename_agent(OLD, NEW) is True
+
+    stranded = []
+    with get_engine().begin() as conn:
+        for table, column in seeded:
+            left = conn.execute(
+                text(f"SELECT COUNT(*) FROM {table} WHERE {column} = :n"), {"n": OLD}
+            ).scalar()
+            moved = conn.execute(
+                text(f"SELECT COUNT(*) FROM {table} WHERE {column} = :n"), {"n": NEW}
+            ).scalar()
+            if left or not moved:
+                stranded.append(f"{table}.{column} (old={left}, new={moved})")
+
+    assert not stranded, (
+        "rename left rows behind — these tables are in AGENT_REFS but were not "
+        f"re-keyed:\n  " + "\n  ".join(stranded)
+    )
+
+
+def test_session_history_specifically_follows_the_rename(sqlite_db):
+    """The reported symptom, pinned on its own.
+
+    A generic sweep can drift (a table that stops being seedable quietly leaves
+    the assertion), so the two tables from the bug report get an explicit test
+    with realistic rows.
+    """
+    from sqlalchemy import text
+
+    from db.engine import get_engine
+    from db.agent_settings.metadata import MetadataMixin
+
+    with get_engine().begin() as conn:
+        conn.execute(
+            text(
+                "INSERT INTO users (id, username, role, created_at, updated_at) "
+                "VALUES (1, 'admin', 'admin', 'now', 'now')"
+            )
+        )
+        conn.execute(
+            text(
+                "INSERT INTO agent_ownership (agent_name, owner_id, created_at) "
+                "VALUES (:n, 1, 'now')"
+            ),
+            {"n": OLD},
+        )
+        conn.execute(
+            text(
+                "INSERT INTO agent_sessions (id, agent_name, user_id, user_email, "
+                "started_at, last_message_at) VALUES ('s1', :n, 1, 'a@b.c', 'now', 'now')"
+            ),
+            {"n": OLD},
+        )
+        for i in range(4):
+            conn.execute(
+                text(
+                    "INSERT INTO agent_session_messages (id, session_id, agent_name, "
+                    "user_id, user_email, role, content, timestamp) "
+                    "VALUES (:i, 's1', :n, 1, 'a@b.c', 'user', 'hi', 'now')"
+                ),
+                {"i": f"m{i}", "n": OLD},
+            )
+
+    assert MetadataMixin().rename_agent(OLD, NEW) is True
+
+    with get_engine().begin() as conn:
+        assert conn.execute(
+            text("SELECT COUNT(*) FROM agent_sessions WHERE agent_name = :n"), {"n": NEW}
+        ).scalar() == 1
+        assert conn.execute(
+            text("SELECT COUNT(*) FROM agent_session_messages WHERE agent_name = :n"),
+            {"n": NEW},
+        ).scalar() == 4
+        assert conn.execute(
+            text("SELECT COUNT(*) FROM agent_sessions WHERE agent_name = :n"), {"n": OLD}
+        ).scalar() == 0
+
+
+def test_rename_does_not_maintain_its_own_table_list():
+    """Structural guard: the defect was two lists, so forbid the second one.
+
+    A future edit that re-adds `update(<some_table>)` inside `rename_agent`
+    recreates exactly the drift this issue is about — the behavioural test above
+    would still pass for the tables that edit happens to include.
+    """
+    source = (_BACKEND / "db" / "agent_settings" / "metadata.py").read_text()
+    start = source.index("def rename_agent")
+    end = source.index("\n    def ", start + 10)
+    body = source[start:end]
+
+    assert "cascade_rename(" in body, "rename_agent must derive its tables from AGENT_REFS"
+
+    # `agent_ownership` is legitimately updated here (the row being renamed, plus
+    # the #1664 volume_base_name pin); everything else belongs to the registry.
+    hand_written = {
+        t for t in re.findall(r"update\(([a-z_]+)\)", body) if t != "agent_ownership"
+    }
+    assert not hand_written, (
+        "rename_agent re-grew a private table list: "
+        f"{sorted(hand_written)} — add them to AGENT_REFS instead"
+    )
+
+
+def test_scope_filtered_keys_narrow_deliberately(sqlite_db):
+    """A behaviour change worth stating, not discovering later.
+
+    The old hand-written rename re-keyed EVERY `mcp_api_keys` row carrying the
+    agent's name. The registry declares two scope-filtered refs
+    (`scope='agent'`, `scope='connector'`), so those two follow the rename and a
+    row with any other scope does not.
+
+    That is deliberate: `cascade_delete` already used exactly these filters, so
+    honouring them in rename is what makes the two paths one rule. A user- or
+    system-scoped key is not per-agent — the column is provenance, not
+    ownership. Pinning it here so the narrowing stays a decision.
+    """
+    from sqlalchemy import text
+
+    from db.engine import get_engine
+    from db.agent_settings.metadata import MetadataMixin
+
+    with get_engine().begin() as conn:
+        conn.execute(
+            text(
+                "INSERT INTO users (id, username, role, created_at, updated_at) "
+                "VALUES (1, 'admin', 'admin', 'now', 'now')"
+            )
+        )
+        conn.execute(
+            text(
+                "INSERT INTO agent_ownership (agent_name, owner_id, created_at) "
+                "VALUES (:n, 1, 'now')"
+            ),
+            {"n": OLD},
+        )
+        for key_id, scope in (("k-agent", "agent"), ("k-conn", "connector"), ("k-user", "user")):
+            conn.execute(
+                text(
+                    "INSERT INTO mcp_api_keys (id, name, key_prefix, key_hash, "
+                    "created_at, user_id, agent_name, scope) "
+                    "VALUES (:i, :i, 'tk_', :i, 'now', 1, :n, :s)"
+                ),
+                {"i": key_id, "n": OLD, "s": scope},
+            )
+
+    assert MetadataMixin().rename_agent(OLD, NEW) is True
+
+    with get_engine().begin() as conn:
+        moved = {
+            row[0]
+            for row in conn.execute(
+                text("SELECT id FROM mcp_api_keys WHERE agent_name = :n"), {"n": NEW}
+            ).all()
+        }
+    assert moved == {"k-agent", "k-conn"}, (
+        "agent- and connector-scoped keys must follow the rename (a leaked "
+        "connector snippet must not reach a future same-name agent)"
+    )

From 91f91492000b6784217cbcbdb9f46389be850645 Mon Sep 17 00:00:00 2001
From: Eugene Vyborov <1073874+vybe@users.noreply.github.com>
Date: Tue, 28 Jul 2026 16:16:06 +0100
Subject: [PATCH 09/25] docs(readme): sovereign-platform title messaging,
 v0.8.5 highlight, architecture-explainer hero (#1857)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Main-targeted twin of #1856 (same README-only change, applied to the
main branch's README) so the public landing page updates without
waiting for the next release cut.

- Retitle the headline section: Trinity is the Sovereign AI Agents Platform
  for building and running proprietary systems — from fully (or semi-)
  autonomous businesses to self-improving cognitive systems.
- Add a v0.8.5 release callout (links docs/releases/0.8.5.md) at the top.
- Swap the stale v0.8.0 tour hero video for the Trinity Architecture
  Explained animated explainer; keep the tour link in Watch more.
- Align the hero image alt text with the new tagline.

Co-authored-by: Eugene Vyborov <eugene@beingluminous.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 README.md | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 47e225594..c4b179967 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://www.ability.ai/trinity">
-    <img src="docs/assets/trinity-hero.webp" alt="Trinity — Run agents like infrastructure" width="720" />
+    <img src="docs/assets/trinity-hero.webp" alt="Trinity — The Sovereign AI Agents Platform" width="720" />
   </a>
 </p>
 
@@ -23,19 +23,22 @@
   <img src="https://img.shields.io/badge/docker-required-blue.svg" alt="Docker">
 </p>
 
+> [!NOTE]
+> **📦 Just released — [v0.8.5](docs/releases/0.8.5.md)** (July 26, 2026): skills as a first-class platform capability, shared multi-agent rooms (sessions), agent display names, ephemeral "ghost" agents, voice replies v2, and a smoother first-run experience. [Read the full release notes →](docs/releases/0.8.5.md)
+
 <p align="center">
-  <a href="https://youtu.be/wxCC6QGtLMA">
-    <img src="https://img.youtube.com/vi/wxCC6QGtLMA/maxresdefault.jpg" alt="Trinity v0.8.0 release tour — video" width="640" />
+  <a href="https://youtu.be/XDLOq1crF9w">
+    <img src="https://img.youtube.com/vi/XDLOq1crF9w/maxresdefault.jpg" alt="Trinity Architecture Explained — animated explainer video" width="640" />
   </a>
   <br/>
-  <em>🎬 New — <a href="https://youtu.be/wxCC6QGtLMA">watch the v0.8.0 release tour</a>: agents that speak, the Brain Orb, and the Grid dashboard.</em>
+  <em>🎬 <a href="https://youtu.be/XDLOq1crF9w">Trinity Architecture Explained</a> — a 4:44 animated explainer: one scheduled task followed end to end through the container, gate, delegation, approval, audit, and breaker machinery.</em>
 </p>
 
 ---
 
-## Run agents like infrastructure
+## The Sovereign AI Agents Platform
 
-Trinity is the production runtime for your AI agents — governed, auditable, on your own infrastructure.
+Trinity is a sovereign AI agents platform — build and run proprietary systems, from fully (or semi-) autonomous businesses to self-improving cognitive systems, all governed, auditable, and on infrastructure you control.
 
 > **Claude Code writes the agent. Trinity runs it in production.**
 
@@ -84,6 +87,7 @@ A short teaser of the live interface — the full, zoomable detail is in [the sc
 
 - [Trinity Demo](https://youtu.be/ivljtZqsxeo) — full platform walkthrough
 - [Trinity Architecture Explained](https://youtu.be/XDLOq1crF9w) — animated explainer (4:44): one scheduled task followed end to end through the container, gate, delegation, approval, audit, and breaker machinery
+- [Trinity v0.8.0 Release Tour](https://youtu.be/wxCC6QGtLMA) — agents that speak, the Brain Orb, and the Grid dashboard
 - [From Zero to Deployed AI Agent](https://youtu.be/-TSZyekDS6o) — your first Trinity agent in 30 minutes
 - [Plugins + Trinity: Build and Deploy Agents in Cursor](https://youtu.be/amqiysdlEWY) — the plugin workflow end-to-end
 - [Loops Engineering with Trinity](https://youtu.be/q3YvFYtuhec) — bounded autonomous work loops in practice

From ec445902a13bd85f05026722106bd5249b42dbaa Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 09:56:17 +0100
Subject: [PATCH 10/25] chore(deps): bump fast-uri from 3.1.3 to 3.1.4 in
 /src/helper-mcp (#1785)

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.4.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/helper-mcp/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/helper-mcp/package-lock.json b/src/helper-mcp/package-lock.json
index ac53663b8..7b49c62e6 100644
--- a/src/helper-mcp/package-lock.json
+++ b/src/helper-mcp/package-lock.json
@@ -951,9 +951,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
-      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
       "funding": [
         {
           "type": "github",

From 41939890ff1f9b81b43d6f3d48641b49d2ad21ce Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 09:56:20 +0100
Subject: [PATCH 11/25] chore(deps): bump hono from 4.12.25 to 4.12.32 (#1773)

Bumps [hono](https://github.com/honojs/hono) from 4.12.25 to 4.12.32.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.25...v4.12.32)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.32
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8fcac2672..cfa3ebe03 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -574,9 +574,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.25",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.25.tgz",
-      "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==",
+      "version": "4.12.32",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.32.tgz",
+      "integrity": "sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

From 327e510cb28c1ed03b4cd28e8b8dc67c3b2e3dc4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 09:56:23 +0100
Subject: [PATCH 12/25] chore(deps): bump @hono/node-server in /src/mcp-server
 (#1737)

Bumps [@hono/node-server](https://github.com/honojs/node-server) from 2.0.2 to 2.0.12.
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](https://github.com/honojs/node-server/compare/v2.0.2...v2.0.12)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.0.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/mcp-server/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/mcp-server/package-lock.json b/src/mcp-server/package-lock.json
index 52b38e0be..40efc78fe 100644
--- a/src/mcp-server/package-lock.json
+++ b/src/mcp-server/package-lock.json
@@ -472,9 +472,9 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.2.tgz",
-      "integrity": "sha512-tXlTi1h/4V7sDe7i97IVP+9re9ZU7wXZZggnR5ucCRclf1+AX6YhGStrR5w8bLj+3Mlyl0pKfBh9gqTqqnGKfQ==",
+      "version": "2.0.12",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.12.tgz",
+      "integrity": "sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==",
       "license": "MIT",
       "engines": {
         "node": ">=20"

From e9266d4c963f2f06da9dd2141cf20975fa8e3cf2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 17:36:57 +0100
Subject: [PATCH 13/25] chore(deps): bump @hono/node-server and
 @modelcontextprotocol/sdk (#1868)

Bumps [@hono/node-server](https://github.com/honojs/node-server) to 2.0.12 and updates ancestor dependency [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). These dependencies need to be updated together.


Updates `@hono/node-server` from 1.19.14 to 2.0.12
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](https://github.com/honojs/node-server/compare/v1.19.14...v2.0.12)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.0.12
  dependency-type: indirect
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/helper-mcp/package-lock.json | 10 +++++-----
 src/helper-mcp/package.json      |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/helper-mcp/package-lock.json b/src/helper-mcp/package-lock.json
index 7b49c62e6..e88d3522b 100644
--- a/src/helper-mcp/package-lock.json
+++ b/src/helper-mcp/package-lock.json
@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@modelcontextprotocol/sdk": "^1.26.0",
+        "@modelcontextprotocol/sdk": "^1.30.0",
         "zod": "^3.24.1"
       },
       "bin": {
@@ -479,12 +479,12 @@
       }
     },
     "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.29.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz",
-      "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==",
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
+      "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==",
       "license": "MIT",
       "dependencies": {
-        "@hono/node-server": "^1.19.9",
+        "@hono/node-server": "^1.19.9 || ^2.0.5",
         "ajv": "^8.17.1",
         "ajv-formats": "^3.0.1",
         "content-type": "^1.0.5",
diff --git a/src/helper-mcp/package.json b/src/helper-mcp/package.json
index 9a36b81b8..9e9e05173 100644
--- a/src/helper-mcp/package.json
+++ b/src/helper-mcp/package.json
@@ -43,7 +43,7 @@
     "prepublishOnly": "npm run build && npm test"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^3.24.1"
   },
   "devDependencies": {

From 93a9ecdb1c82617da423aaae6a7945b7da250aa7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:42:04 +0100
Subject: [PATCH 14/25] chore(deps): bump fast-uri from 3.1.4 to 3.1.5 (#2032)

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index cfa3ebe03..3421a528c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -437,9 +437,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
-      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "funding": [
         {
           "type": "github",
diff --git a/package.json b/package.json
index 1581aafba..543675337 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "overrides": {
     "@modelcontextprotocol/sdk": "^1.26.0",
     "hono": ">=4.11.7",
-    "fast-uri": "^3.1.4",
+    "fast-uri": "^3.1.5",
     "@hono/node-server": "^1.19.13",
     "ip-address": ">=10.1.1",
     "qs": ">=6.15.2"

From 143163249ccc93b2ef114b872195ac3c4ffa9953 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:42:09 +0100
Subject: [PATCH 15/25] chore(deps): bump undici from 7.28.0 to 7.29.0 in
 /src/mcp-server (#1986)

Bumps [undici](https://github.com/nodejs/undici) from 7.28.0 to 7.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v7.28.0...v7.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/mcp-server/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/mcp-server/package-lock.json b/src/mcp-server/package-lock.json
index 40efc78fe..47b7dc3c5 100644
--- a/src/mcp-server/package-lock.json
+++ b/src/mcp-server/package-lock.json
@@ -2569,9 +2569,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
-      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"

From 314ad92f7d2b124f6280916f3f2f4e98816f4897 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:42:14 +0100
Subject: [PATCH 16/25] chore(deps): bump hono from 4.12.29 to 4.13.0 in
 /src/helper-mcp (#2000)

Bumps [hono](https://github.com/honojs/hono) from 4.12.29 to 4.13.0.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.29...v4.13.0)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/helper-mcp/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/helper-mcp/package-lock.json b/src/helper-mcp/package-lock.json
index e88d3522b..eaa295b3c 100644
--- a/src/helper-mcp/package-lock.json
+++ b/src/helper-mcp/package-lock.json
@@ -1103,9 +1103,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.29",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.29.tgz",
-      "integrity": "sha512-1hNiRjawYrLq/4m3DQQjPGFg0VZkk4RjQJDff/excI6Dm9BiL75qxGrd7/c6YOxPdq6AscP3LiXhQ6fKFC1Waw==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz",
+      "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

From 3ae7be5c0de2360cbc32b33fbfb320c61c2f79c1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:42:33 +0100
Subject: [PATCH 17/25] chore(deps): bump ip-address from 10.2.0 to 10.4.0 in
 /src/mcp-server (#1972)

Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0.
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/mcp-server/package-lock.json | 6 +++---
 src/mcp-server/package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/mcp-server/package-lock.json b/src/mcp-server/package-lock.json
index 47b7dc3c5..21350b077 100644
--- a/src/mcp-server/package-lock.json
+++ b/src/mcp-server/package-lock.json
@@ -1682,9 +1682,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
diff --git a/src/mcp-server/package.json b/src/mcp-server/package.json
index 2a1e7c5ef..ef7871967 100644
--- a/src/mcp-server/package.json
+++ b/src/mcp-server/package.json
@@ -35,7 +35,7 @@
     "axios": ">=1.15.2",
     "fast-uri": ">=3.1.2",
     "@hono/node-server": ">=1.19.13",
-    "ip-address": ">=10.2.0",
+    "ip-address": ">=10.4.0",
     "qs": ">=6.15.2",
     "esbuild": ">=0.28.1"
   }

From cf5cb4d75d81c781d499ea8e1f2c1cc476ff7a48 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:42:36 +0100
Subject: [PATCH 18/25] chore(deps): bump hono from 4.12.31 to 4.13.0 in
 /src/mcp-server (#2001)

Bumps [hono](https://github.com/honojs/hono) from 4.12.31 to 4.13.0.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.31...v4.13.0)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/mcp-server/package-lock.json | 6 +++---
 src/mcp-server/package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/mcp-server/package-lock.json b/src/mcp-server/package-lock.json
index 21350b077..56eb65b7c 100644
--- a/src/mcp-server/package-lock.json
+++ b/src/mcp-server/package-lock.json
@@ -1533,9 +1533,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.31",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.31.tgz",
-      "integrity": "sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz",
+      "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
diff --git a/src/mcp-server/package.json b/src/mcp-server/package.json
index ef7871967..f3253c90e 100644
--- a/src/mcp-server/package.json
+++ b/src/mcp-server/package.json
@@ -31,7 +31,7 @@
   },
   "overrides": {
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "hono": ">=4.12.31",
+    "hono": ">=4.13.0",
     "axios": ">=1.15.2",
     "fast-uri": ">=3.1.2",
     "@hono/node-server": ">=1.19.13",

From 1291bbfe7e4dea56618c0d038347311cd950b6ff Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:42:45 +0100
Subject: [PATCH 19/25] chore(deps): bump ip-address from 10.2.0 to 10.4.0 in
 /src/helper-mcp (#1973)

Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0.
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/helper-mcp/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/helper-mcp/package-lock.json b/src/helper-mcp/package-lock.json
index eaa295b3c..bf1ab467b 100644
--- a/src/helper-mcp/package-lock.json
+++ b/src/helper-mcp/package-lock.json
@@ -1154,9 +1154,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"

From 691b01d5cb32353001b7cdc3b507dde045519bb3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:43:03 +0100
Subject: [PATCH 20/25] chore(deps): bump ip-address from 10.2.0 to 10.4.0
 (#2012)

Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0.
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 3421a528c..81fa5a481 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -625,9 +625,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"

From 0b35044c8d739aa2f089697947a04917e826eef6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:43:21 +0100
Subject: [PATCH 21/25] chore(deps): bump hono from 4.12.32 to 4.13.0 (#2002)

Bumps [hono](https://github.com/honojs/hono) from 4.12.32 to 4.13.0.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.32...v4.13.0)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 81fa5a481..fa1173ac0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -574,9 +574,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.32",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.32.tgz",
-      "integrity": "sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz",
+      "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

From 51fc88ce4104e77adb23175660efb0df59787a8e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 17:44:32 +0100
Subject: [PATCH 22/25] chore(deps-dev): bump postcss from 8.5.21 to 8.5.26 in
 /src/frontend (#2049)

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.21 to 8.5.26.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.21...8.5.26)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/frontend/package-lock.json | 16 ++++++++--------
 src/frontend/package.json      |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/frontend/package-lock.json b/src/frontend/package-lock.json
index 17a6aa4ff..a05ed36db 100644
--- a/src/frontend/package-lock.json
+++ b/src/frontend/package-lock.json
@@ -34,7 +34,7 @@
         "@types/js-yaml": "^4.0.9",
         "@vitejs/plugin-vue": "^6.0.8",
         "autoprefixer": "^10.5.4",
-        "postcss": "^8.5.21",
+        "postcss": "^8.5.26",
         "tailwindcss": "^3.4.19",
         "vite": "^8.1.5"
       },
@@ -3239,9 +3239,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.17",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
       "funding": [
         {
           "type": "github",
@@ -3517,9 +3517,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.21",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.21.tgz",
-      "integrity": "sha512-v4sDNP3fdNiWMfabO7OwOQdOX8TiQSztKyT1Wj0w+j7LDallJThJRBBBmzVGyYj0crMh7jlV4zepPkiNu9UwDQ==",
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -3536,7 +3536,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.16",
+        "nanoid": "^3.3.17",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
diff --git a/src/frontend/package.json b/src/frontend/package.json
index 2a3b2858e..b33c223f6 100644
--- a/src/frontend/package.json
+++ b/src/frontend/package.json
@@ -39,7 +39,7 @@
     "@types/js-yaml": "^4.0.9",
     "@vitejs/plugin-vue": "^6.0.8",
     "autoprefixer": "^10.5.4",
-    "postcss": "^8.5.21",
+    "postcss": "^8.5.26",
     "tailwindcss": "^3.4.19",
     "vite": "^8.1.5"
   },

From 19e41fff0f8b0a632c2a3a08700e10ed233457b4 Mon Sep 17 00:00:00 2001
From: Eugene Vyborov <1073874+vybe@users.noreply.github.com>
Date: Fri, 7 Aug 2026 09:17:57 +0100
Subject: [PATCH 23/25] docs: document /trinity:start-here, the guided first
 journey (#2054)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* docs(user-docs): document /trinity:start-here, the guided first journey

The trinity plugin shipped a seventh skill (abilities 629aabb, plugin
2.6.1) — a resumable concierge that sequences the existing skills for
newcomers: orient → choose a door → get an instance → connect + smoke
test → first agent alive. The plugin page said "Six skills" and the
abilities overview pointed newcomers at no entry point.

- trinity-plugin.md: skills table row, a "Guided Journey" section
  covering the stages, zero-commitment tour, resume/reset behavior, and
  the live-docs grounding; intro banner links to it.
- overview.md: Quick Start now leads with the guided path before the
  manual install list; plugin table 6 → 7 skills.

Docs-only. Feeds both the docs site (via trinity-docs /sync-docs) and
the Vertex AI Search index (via sync-docs-to-vertex.yml on push).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: re-trigger CI after GitHub Actions outage dropped the original webhooks

---------

Co-authored-by: Eugene Vyborov <ability.ai.inc@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 docs/user-docs/abilities/overview.md       | 12 ++++++++-
 docs/user-docs/abilities/trinity-plugin.md | 31 +++++++++++++++++++++-
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/docs/user-docs/abilities/overview.md b/docs/user-docs/abilities/overview.md
index 439946130..c9ad6f42d 100644
--- a/docs/user-docs/abilities/overview.md
+++ b/docs/user-docs/abilities/overview.md
@@ -6,6 +6,16 @@ The official agent development toolkit for Claude Code. Curated plugins covering
 
 ## Quick Start
 
+**New to Trinity?** Install the `trinity` plugin and run `/trinity:start-here` — a guided, resumable journey from "what is Trinity?" to your first agent running on your own instance. It sequences everything below, so you don't have to pick a starting point:
+
+```bash
+/plugin marketplace add abilityai/abilities
+/plugin install trinity@abilityai
+/trinity:start-here
+```
+
+Prefer to drive yourself?
+
 ```bash
 # Add the abilities marketplace (one-time)
 /plugin marketplace add abilityai/abilities
@@ -32,7 +42,7 @@ claude plugin install create-agent@abilityai
 |--------|--------|---------|------------|
 | [create-agent](create-agent-plugin.md) | 14 | Agent creation wizards | `/create-agent:prospector`, `/create-agent:custom` |
 | [agent-dev](agent-dev-plugin.md) | 20 | Extend existing agents | `/agent-dev:create-playbook`, `/agent-dev:add-memory`, `/agent-dev:add-orchestrator`, `/agent-dev:work-loop` |
-| [trinity](trinity-plugin.md) | 6 | Deploy to and operate on Trinity | `/trinity:connect`, `/trinity:onboard`, `/trinity:loop` |
+| [trinity](trinity-plugin.md) | 7 | Deploy to and operate on Trinity | `/trinity:start-here`, `/trinity:connect`, `/trinity:onboard`, `/trinity:loop` |
 | [dev-methodology](dev-methodology-plugin.md) | 24 | Development workflow | `/dev-methodology:implement`, `/dev-methodology:validate-pr` |
 | [utilities](utilities-plugin.md) | 7 | Ops and productivity | `/utilities:safe-deploy`, `/utilities:docker-ops` |
 
diff --git a/docs/user-docs/abilities/trinity-plugin.md b/docs/user-docs/abilities/trinity-plugin.md
index d609d7509..97049f766 100644
--- a/docs/user-docs/abilities/trinity-plugin.md
+++ b/docs/user-docs/abilities/trinity-plugin.md
@@ -1,6 +1,8 @@
 # trinity Plugin
 
-Connect, deploy, operate, and sync agents on the Trinity platform. Six skills covering the complete lifecycle — from first connection to running remote loops and provisioning new instances.
+Connect, deploy, operate, and sync agents on the Trinity platform. Seven skills covering the complete lifecycle — from a guided first journey through connection, deployment, remote loops, and instance provisioning.
+
+> 🧭 **New to Trinity? Start with `/trinity:start-here`** — a guided, resumable walkthrough that takes you from "what is Trinity?" to your first agent running on your own instance. [Jump to the section](#the-guided-journey-trinitystart-here).
 
 > 📺 **Watch:** [Build Autonomous Loops for Your AI Agents](https://youtu.be/q3YvFYtuhec) *(Jun 2026)* · [all videos](../videos.md)
 
@@ -14,6 +16,7 @@ Connect, deploy, operate, and sync agents on the Trinity platform. Six skills co
 
 | Skill | Description |
 |-------|-------------|
+| `/trinity:start-here` | **New here?** Guided, resumable journey: what Trinity is → get an instance → connect → first agent alive |
 | `/trinity:connect` | One-time: authenticate and configure the MCP connection |
 | `/trinity:onboard` | Per-agent: compatibility check, file creation, deploy |
 | `/trinity:sync` | Ongoing: sync changes between local and the running remote agent |
@@ -21,6 +24,32 @@ Connect, deploy, operate, and sync agents on the Trinity platform. Six skills co
 | `/trinity:create-dashboard` | Generate an agent-specific `/update-dashboard` skill that keeps `dashboard.yaml` current |
 | `/trinity:deploy-new-instance` | Deploy a Trinity instance on any server and scaffold an ops agent to manage it |
 
+## The Guided Journey: `/trinity:start-here`
+
+```bash
+/plugin marketplace add abilityai/abilities
+/plugin install trinity@abilityai
+/trinity:start-here
+```
+
+One command that concierges a newcomer through the whole path — it sequences the skills below rather than replacing them, so you never have to know which one comes next:
+
+| Stage | What happens |
+|-------|--------------|
+| **Orient** | What Trinity is, in plain terms, plus the current release |
+| **Choose your door** | Just looking · build my first agent · I already have agents · set up my instance |
+| **Get an instance** | Hands off to `/trinity:deploy-new-instance` (cloud, your server, or local Docker) — or takes the URL you already have |
+| **Connect + verify** | Hands off to `/trinity:connect`, then runs a live smoke test: fleet visible, instance healthy, docs assistant online |
+| **First agent alive** | Deploys via `/trinity:onboard` (or picks an existing agent) and exchanges a real message with it |
+
+Three things worth knowing:
+
+- **Nothing is deployed until you choose it.** The "just looking" door asks for no credentials and creates nothing.
+- **It resumes.** Progress is saved in `~/.trinity/start-here.json`, so quitting — or the Claude Code restart needed to load the MCP server — picks up exactly where you stopped. Run `/trinity:start-here reset` to start over.
+- **Answers come from live documentation, not a script.** Questions are answered from these docs at run time — through the public [Trinity Docs Q&A](../getting-started/help.md) before you have an instance, and through your instance's own `ask_trinity` tool afterward.
+
+Already know what you want? The individual skills below work standalone, in any order.
+
 ## How It Works
 
 ### Step 1: Connect (One-Time)

From ba3d53cc1096bd8baf909653b479d28e3397dc8a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 11:23:09 +0100
Subject: [PATCH 24/25] chore(deps): bump mermaid from 11.16.0 to 11.16.1 in
 /src/frontend (#2059)

Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.16.0 to 11.16.1.
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.16.1)

---
updated-dependencies:
- dependency-name: mermaid
  dependency-version: 11.16.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 src/frontend/package-lock.json | 8 ++++----
 src/frontend/package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/frontend/package-lock.json b/src/frontend/package-lock.json
index a05ed36db..daff3aa34 100644
--- a/src/frontend/package-lock.json
+++ b/src/frontend/package-lock.json
@@ -19,7 +19,7 @@
         "dompurify": "^3.4.11",
         "js-yaml": "^5.2.1",
         "marked": "^18.0.7",
-        "mermaid": "^11.16.0",
+        "mermaid": "^11.16.1",
         "monaco-editor": "^0.56.0",
         "pinia": "^3.0.4",
         "qrcode": "^1.5.4",
@@ -3090,9 +3090,9 @@
       }
     },
     "node_modules/mermaid": {
-      "version": "11.16.0",
-      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.16.0.tgz",
-      "integrity": "sha512-Zvm3kbstgdpvIJPPItlL7fppIZ3kibvc1oZIGxdvk9t6UFz6flv+Jw7FtRGKwfcI8OckmH04LqG6LlS6X4B1pA==",
+      "version": "11.16.1",
+      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.16.1.tgz",
+      "integrity": "sha512-TQsq6u22fAn3rek5VOubrhKPo1g5hwC3FXUN9hiyupTckcYiGuuKGkNQrKYwGJkXUxZdojwRG46gsSCFZMDp4g==",
       "license": "MIT",
       "dependencies": {
         "@braintree/sanitize-url": "^7.1.2",
diff --git a/src/frontend/package.json b/src/frontend/package.json
index b33c223f6..8fc96b50b 100644
--- a/src/frontend/package.json
+++ b/src/frontend/package.json
@@ -24,7 +24,7 @@
     "dompurify": "^3.4.11",
     "js-yaml": "^5.2.1",
     "marked": "^18.0.7",
-    "mermaid": "^11.16.0",
+    "mermaid": "^11.16.1",
     "monaco-editor": "^0.56.0",
     "pinia": "^3.0.4",
     "qrcode": "^1.5.4",

From 499cac04a1bd3c4a9cca074a198387e03140eb56 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 13 Aug 2026 08:45:48 +0100
Subject: [PATCH 25/25] chore(deps): bump @hono/node-server from 1.19.14 to
 1.19.17 (#2142)

Bumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.14 to 1.19.17.
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](https://github.com/honojs/node-server/compare/v1.19.14...v1.19.17)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fa1173ac0..7b7b48123 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,6 +8,18 @@
         "@modelcontextprotocol/sdk": "^1.26.0"
       }
     },
+    "node_modules/@hono/node-server": {
+      "version": "1.19.17",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz",
+      "integrity": "sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.14.1"
+      },
+      "peerDependencies": {
+        "hono": "^4"
+      }
+    },
     "node_modules/@modelcontextprotocol/sdk": {
       "version": "1.26.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.26.0.tgz",
@@ -48,18 +60,6 @@
         }
       }
     },
-    "node_modules/@modelcontextprotocol/sdk/node_modules/@hono/node-server": {
-      "version": "1.19.14",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
-      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
-      }
-    },
     "node_modules/accepts": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",