DuDuClaw Complete Feature Inventory

v1.24.0 core + 2026-07/08 additions | Last updated: 2026-08-16 (v1.61.0)

Note: the sections below describe the v1.24.0 baseline. The additions blocks immediately after capture features shipped since (see CHANGELOG.md for the authoritative list). The ja-JP/ and zh-TW/ mirrors are synced with the additions blocks.

---

2026-08 additions (v1.54 – v1.61)

Feature	Description
Calibrated forward model + held-out learning gate (v1.54)	Pre-action confidence predictions scored with proper scores (Brier/RPS, never log score) + Murphy decomposition against external tool evidence, not self-report; evidence-less inductive lessons start as shadow candidates and only promote via out-of-sample Wilson lower bound (Bonferroni-corrected) over a frozen baseline; three honest verdicts only (SUPPORTED / CANDIDATE / INDISTINGUISHABLE_FROM_LUCK). Default ON with per-layer dashboard toggles (39-calibrated-forward-model.md)
Notification governance (v1.55)	Every proactive push carries a mandatory L1/L2/L3 level; quiet hours defer + merge L1/L2 while L3 always delivers; opt-in daily digest that stays silent on empty days; per-category action-rate measurement (notify.stats, <50% precision flagged broken); decision cards collapse in place after a decision; dashboard deep links on channel pushes (40-notification-governance.md)
Unified pending-decisions pipeline (v1.55)	Five decision sources (goal needs_human, kickoff approval, general approvals, install sign-off, autopilot trips) converge on one action-id encoding, one authorization model (closing previously unauthenticated goal buttons), and one inbox; a fourth “take over” action; one person’s decision collapses every recipient’s card
Human takeover (v1.55)	A verified admin simply speaking in a channel conversation pauses the AI there (default 60 min; /takeover query/extend/end); every AI message path into that conversation is frozen, deferred, or dropped while L3 approvals still deliver. Made opt-in (default off) in v1.56 because the always-on default silenced personal-edition self-chat (42-human-takeover.md)
Resident sensing (v1.55)	External data streams (http_poll / command / file_tail / websocket, default off) join the autopilot bus as tick events with auto-derived prev_/delta_/pct_ fields, optional local-model screening before waking an agent, in-memory TickHub ring buffer, SSRF/DNS-rebinding defenses; hardened by live-fire rounds against real market feeds (41-resident-sensing.md)
Cross-invocation recent-actions injection (v1.55)	Every wake-up opens with a compressed audit-log digest of the agent’s own last-24h tool calls (failures and blocked calls included) so agents answer “did you do X?” from durable records instead of live tool state alone
Quoted-reply context on five channels (v1.55)	Replying to (quoting) a message carries the quoted content into agent input on Telegram / Discord / Slack / Teams / WhatsApp; replying to the bot counts as a mention in mention-only groups; Telegram forwards are labeled with their origin
Humanized learned rules (v1.55)	Playbook rules rendered as plain-language sentences (zero-LLM templates) with “why this rule exists” evidence, a /rules channel command, and numbered rule injection so the agent can cite which rule drove an answer
Telegram Mini App approval card (v1.55)	Opt-in “view details” web-app button on high-risk approval cards — full description, simulated consequences, live expiry countdown, approve/deny — with signed initData verification and the same authorization as button presses (43-telegram-miniapp.md)
Learning-pipeline observability (v1.56)	Rules recording source_facts get flagged source-stale when a source fact is superseded (deprioritized + labeled at injection); past-threshold consolidation failures logged with reasons (consolidation_failures.jsonl); dialogue-path rule settlement routed through the held-out gate; inductive shadow candidates finally accumulate out-of-sample samples on the conversation side too
Edition & config hardening (v1.56)	Personal-edition concurrency cap on simultaneous goal tasks (default 2, queue-not-reject, fail-open; RFC-27) — never an agent-count cap; team-edition-only surfaces now blocked server-side at the gateway dispatch entry; agent.toml [model] account_pool actually narrows rotator candidates; dashboard agent creation requires an explicit model choice
Real ACP server (v1.57)	duduclaw acp implements Agent Client Protocol v1 (stdio JSON-RPC) so Zed / JetBrains / nvim agent panels talk to your agents through the same gateway reply pipeline, streaming tool_call / plan / message chunks; the A2A acp-server command is unchanged
Remote MCP + OAuth 2.1 (v1.57)	Spec-native POST /mcp endpoint (version negotiation, stateless mode, Origin-anchored allowlist) plus a minimal-but-complete OAuth 2.1 surface (RFC 9728/8414/7591, PKCE S256, operator consent, refresh rotation) so claude.ai custom connectors / Claude mobile / MCP Inspector connect directly to a self-hosted DuDuClaw
Text verdicts on five channels (v1.57)	Replying to a decision card with a whole-message verdict word (approve/deny/retry/complete/abort/pause, zh+en) equals pressing the button on Telegram / Discord / Slack / LINE / Teams — same authorization, dedup, and action-rate accounting; closes the smartwatch one-tap gap
Local model marketplace (v1.57)	Pick a use case → hardware-fit lights computed from this machine’s memory → one-click install with auto-chosen quantization from five vetted HF publishers; MoE dual-track verdict flags “expert-offload viable” for 30B-A3B-class models on 16GB machines (45-local-model-marketplace.md)
Working State — cross-wake authoritative state (v1.57)	Per-agent key-value posture + handoff note auto-injected into every wake-up (cron / heartbeat / goal loop / channels) as the single source of truth; explicit-tool-only updates with required reason + supersession history, expected_value CAS against concurrent wakes, ttl_hours for day-scoped rules, 32-key cap; [memory] working_state_enabled, default on (44-working-state.md)
Scheduled runs gain memory + visibility (v1.57)	Successful cron/dispatch executions now feed the same distillation/knowledge pipeline (hourly per-agent throttle) and land in the run-history page — previously a purely schedule-driven agent accumulated nothing and showed zero runs
Ecosystem & distribution surfaces (v1.57)	Six free industry starter packs (safety boundaries intact), pack registry install/publish with client-side sha256 + minisign verification, CONTRIBUTING.md + build-your-own-pack tutorial, public-website chat widget (guest mode, default off) + WordPress plugin, Chrome / VS Code extensions, wearable transcript ingestion (POST /ingest/transcript), duduclaw tunnel, LINE friend-QR/NFC kit; external MCP tool surface becomes scope-driven; Homebrew channel retired
Goal task console /goals (v1.58)	Dashboard page assigning goals directly to agents (same semantics as /goal), full per-round execution timeline (tasks.timeline), in-place human intervention — all dashboard needs_human decisions unified onto the same fail-closed tasks.goal_decide path as channel buttons
Foresight page (v1.58)	The LLM→LWM loop made visible: predict → act → observe → compare, per-round prediction-vs-actual (forward.chain), per-agent skill verdict cards (Brier + Murphy decomposition, three honest labels), world-model state buckets readable for the first time; per-aspect MAV verdicts, run links, retry/no-progress signals, and prediction sub-errors now persisted per round
Channel OTP fallback + settings integration (v1.58)	Login-OTP delivery tries the global bot token then every per-agent bot token (dedup, ordered) — fixing silent failure when the bot moved to a single agent; agent channel settings and channel management now share one editor/dialog; sidebar “new feature” (newIn) badge convention introduced
Belief Loop (v1.59)	Structured beliefs about the external world via belief_submit / belief_settle / belief_stats MCP tools; deterministic three-way Brier settlement against a submit-time baseline with TickHub cross-check (agents can’t self-report reality); programmatic calibration-stats and belief-vs-live injection hooks; /foresight beliefs tab (46-belief-loop.md)
Per-goal contract fields + self-study (v1.59)	duration_hours (deadline → needs_human) and risk_boundary (empty ⇒ five-line baseline) on goal creation, injected every round and checked by the MAV safety aspect; /goal gains 時限:/邊界: segments; optional structured-prediction requirement; agents with same-day belief misses get an automatic evening self-study goal
Dispatch engine default ON + scheduler liveness (v1.59)	[dispatch] enabled default flipped to true (assigned goals now execute out of the box) with a hot-reload dashboard toggle; /healthz returns 503 when cron/heartbeat loops stall >5 min — closing the incident where a scheduler-dead container stayed “healthy” for days
Two-stage judging + judge hardening (v1.60)	Cheap first-stage evaluator (continue/candidate_complete/blocked) in front of the MAV panel (default on; any failure degrades to full MAV, never auto-pass); four judge discipline clauses (anti-ratchet, audit-don’t-fabricate, anti-scope-creep, self-claims-aren’t-evidence); truncated-panel and first-token PASS false-positive holes closed; gap-fingerprint stall detection; bail-pattern detection; resume_on_restart default pause
Pluggable judge seam (v1.60)	[dispatch] judge = mav / evaluator_only / external / human_only — external-judge failures always degrade back to MAV (stricter, audited) with its feedback treated as untrusted DATA; unknown values fall back to mav; dashboard selector under Settings → Automation
Goal contract freeze (v1.60)	Acceptance criteria frozen at creation into an immutable acceptance_criteria_baseline read by judges and evaluator alike; agent-identity tasks_update edits of goal acceptance criteria refused with audit; /goal without criteria gets four-element guidance + suggested outcome-style criteria
Goal-loop human signals + admission queue (v1.60)	Closed six-way pause_reason classification on needs_human (statically stamped, never parsed from LLM text); overdue-progress reporting (progress_report_minutes); zero-LLM tool-streak advisories (3/5/8 escalation); bounded FIFO admission queue for ephemeral spawns (default queue); best-round handoff on budget exhaustion (deterministic pick + gap list instead of empty-handed escalation)
Agent Mail (v1.60)	Per-agent mailbox (/mail page): Gmail API / drop-folder inbound, outbound always drafts pending ApprovalBroker confirmation (a background worker is the only sender), DATA-fenced content, dedicated non-grantable scopes, cross-agent reads via delegation policy (47-agent-mail.md)
Agent config presets P1 (v1.60)	duduclaw preset command family + agent create --preset — named reusable config bundles; binding authority in preset_bindings.toml, resolution materialized outside the agent dir (self-modification-proof), org fields rejected, sensitive sections stripped; 9 built-in department presets
Unified assign panel + plan-first mode + gallery (v1.60)	One assign panel from every entry point (personal edition finally has a primary action) with ask / assign / plan-first (“think first”) modes — plan-first parks the task at needs_human with a generated 3-8 step plan, injected once as <execution_plan> after approval; finished goals accept follow-up “continue” instructions; Inspiration Gallery /gallery fans 22 industry-team examples into one-click remake cards; task detail page gains four tabs (artifacts / files / changes / process)
Artifact provenance + delivery safety (v1.60)	artifacts.jsonl five-origin provenance ledger (declared / swept / uploaded / produced / unknown; exact-vs-inferred attribution, never guessed from time windows); goal artifacts archived into attachments/ on accept (canonicalize containment, 20MB/100MB caps); zero-LLM delivery gate before 📎DELIVER (zero-byte / magic-mismatch / corrupt-zip hard-fail); [limits] DocumentLimits guarding the three downstream office/zip parsers; expert-pack zip “header lie” bypass fixed
Credentials P1 + secret-reference unification (v1.60)	secret://keychain and secret://file local backends, tick-source secret:// headers, credential inventory card + doctor --fix-residue; SecretRef/Secret types converge seven hand-rolled decrypt dialects that could send secret:// reference literals to vendor APIs as real credentials; WhatsApp webhook signature now fail-closed; ActionGuard judge fed a closed 21-token finding enum (attacker-controlled text structurally can’t reach the judge prompt); MCP key rotation live-reloads and denied_tools/allowed_tools enforced at the MCP dispatch gate
Ten-channel notification unification (v1.60)	autopilot notify, MCP send_message, and reminders all route through the shared create_sender factory covering ten channels (WebChat honestly refuses) — fixing autopilot Slack notifications that had never been delivered and Google Chat / Teams silent-skip defects
Evolution measurement hardening (v1.60)	AEE commit gate splits visible vs held-out eval dimensions (fence-only: they veto but never promote); champion bootstrap made same-form; duduclaw evolution clear-holdout-rotation operator exit; per-round snapshots of 14 harness knobs into aee_round events; Code Mode Phase 0 measurement gate (duduclaw cost tool-loop, four-criteria PROCEED/REJECT/INSUFFICIENT_DATA verdict)
Cron day-of-week convention fix (v1.61, BREAKING)	Numeric day-of-week normalized at parse time from Unix crontab convention (0/7=Sunday, 1-5=Mon–Fri) to the cron crate’s Quartz ordinals, with scheduler / heartbeat / MCP validation / dashboard sharing one normaliser — previously * * 1-5 fired Sunday–Thursday (Sunday ghost runs + silent Friday skips); schedules deliberately written Quartz-style shift by one day after upgrade
duduclaw migrate-from claude-code (v1.61)	One-way import of Claude Code memory shards (→ semantic + SPO temporal memory), CLAUDE.md (→ agent wiki context layer, zero injection budget), and session transcripts (noise-filtered to human prompts + assistant final replies — measured ~1.5% of transcript bytes are signal); everything lands as origin=import (trust ≤ 0.7), treated as DATA, redacted by default, injection-scanned, skills security-scanned fail-closed; nothing writes without --apply
Channel capability table (v1.61)	channel_capabilities.rs single authority for 11 channels × 7 capabilities (file/photo upload, interactive buttons, edit-in-place, typing, native markdown, quoted replies) + progress throttle seconds; unsupported capabilities now leave a structured log instead of a silent no-op
minimal_context spawn slimming (v1.61)	Every official-CLI spawn carries a curated --tools list + --setting-sources project,local (keeps the agent-file-guard hook): measured 35,892 → 10,974 fixed tokens per spawn (~69%); estimate_tokens CJK-recalibrated (~22% underestimate fixed); MCP tools/list now filtered by caller capability (discoverable ⊆ callable)
Credentials P2/P3 (v1.61)	Zero-restart rotation — account-pool writes invalidate the rotator cache, Telegram re-resolves its token every poll, six webhook channels verify inbound signatures per-request, Odoo reconnects on next call (Discord/Slack resident WS still need restart); spawn env scrubbed to an allowlist (all *_API_KEY/*_TOKEN/*_SECRET/*_PASSWORD filtered, vendor keys injected explicitly by callers); opt-in per-agent [capabilities] git_credentials (default off) restores SSH/GPG for git-push agents, audited; second secret:// convergence round (account_rotator + mcp.rs)
Console & task polish (v1.61)	⌘K cross-source content search (conversations / artifacts / memory / wiki), /files search + task filters + date range, /goals task pin/archive/rename + pagination (20-row hard cap lifted), read-only /presets dashboard, mail rejection notes, /goals detail unified into the four-tab /tasks/:id page

2026-08 additions (v1.53)

Feature	Description
Evolution v3: AEE + playbook	Default evolution target moved from SOUL.md rewrites to gene-shaped playbook rules — Gate/Measure split, champion + matches-or-improves commit gate, entry-level observation windows; SOUL.md is read-only for agents (38-aee-playbook-evolution.md)
E1 entry assertions + anti-reward-hacking audit	Every new playbook rule carries machine-checkable assertions replayed zero-LLM against recorded transcripts (G-Assertions); deterministic screening of candidate rules for eval-prompt leakage / tautology / failure-suppression before commit
Task-level forward model	Predict-act-verify world model on the goal loop: 4-tier statistical prediction (zero LLM on cold start), fidelity-graded observation (native tool events / audit-only / none), <state> block + (state, action) visit-graph oscillation detection, deterministic task-rule induction; [task_forward_model], default off
Grounded dispatch precheck	Zero-LLM evidence check before the acceptance judge — the final answer must overlap a real non-error tool result; self-echo deny-list + input-overlap subtraction defeat self-certification; [dispatch] grounding_precheck_enabled, default on
Memory novelty gate	Near-duplicate semantic-layer memory writes rejected with telemetry (0.92 char n-gram cosine) — anti fake-surprise; temporal supersession/reaffirmation exempt; [memory] novelty_gate, default on
Verified-only reflexion	MistakeNotebook entries carry programmatic TrajectoryEvidence; evidence-less self-reported mistakes no longer consolidate into learned rules
Simulate-before-act approvals	needs_human / approval requests attach a simulated three-step trajectory (15s cap, degrades to no-simulation rather than blocking); read-only wiki namespaces only; dashboard renders the preview
Eval recording isolation + bootstrap CLI	--record runs against a temporary .mcp.json (eval home + placeholder key — zero production side effects, no key leakage); max-turns runaways parse as error_max_turns (assessable failure baseline); duduclaw eval-scaffold drafts cases from SOUL rules; duduclaw playbook migrate-soul migrates legacy SOUL rules into playbook drafts
Audit log as evidence source	tool_calls.jsonl records masked result_text/input_text (3-pass secret masking, 16MB rotation, 0600); system-sender dispatches (goal-loop/cron/heartbeat/autopilot) attribute to the executing agent

2026-07 mid/late additions (v1.33 – v1.46)

Feature	Description
Unified LLM provider layer (duduclaw-llm)	One normalized request/stream shape over four native protocols (Anthropic / OpenAI Responses / Gemini / OpenAI-compat, 8 presets); ModelRegistry pricing + FallbackRouter cooldowns; stdio MCP client + provider-agnostic tool loop so API-mode agents get the full tool surface
Agent behavioral evals (duduclaw eval)	Golden-task regression per agent: deterministic tool-call/regex/grounded assertions + optional LLM judge; live and replay modes, CI-gating exit code
HITL ApprovalBroker	One interrupt/approval primitive across MCP tools / autopilot / bus tasks; SQLite-backed, TTL expiry = DENY (fail-closed)
OpenTelemetry GenAI tracing	Opt-in gen_ai.* spans, OTLP-exportable to Langfuse/Grafana/Jaeger/Datadog; zero overhead when off
Channel UX layer	Per-platform markdown rendering, typing indicators, live todo-board progress edited in place across 8 external channels
Autonomous Goal Loop	/goal → loop-to-completion with a three-aspect MAV acceptance judge; stuck escalates to a human with channel buttons (34-goal-loop.md)
Iterative kanban rounds	Task board revising state machine with per-round detail history
Trusted memory & judge hardening (v1.41)	Write-time origin binding with Sybil-resistant reaffirmation, GovMem promotion gate, Janus rule probation, PORTICO task-scoped capability grants, trace-grounded eval assertions
OS-native perception & proactive care	File watch + frontmost sensing → footprint temporal memory (restart-durable snapshots), built-in proactive care checks, LLM-scored proactive gate, one-click OS automation templates (33-os-native-perception.md)
Office document suite	Real docx/xlsx/pptx/pdf output, 📎DELIVER protocol + undeclared-output sweep, gateway archive, files page with LibreOffice preview (31-office-document-suite.md)
Expert packs ecosystem	Installable AI teams: security-scanned install pipeline, built-in industry catalog with category/department grouping, LLM-guided pack authoring, department × rank org placement with --attach-under (32-expert-packs.md)
Recording → skill	Browser (Playwright trace+HAR, secrets redacted in place) and desktop recorders distilled into approval-gated SKILL.md drafts (36-recording-to-skill.md)
Photo → desktop pet	Local photo → background removal → pixel quantization → Codex-Pets 8×9 spritesheet; autonomous wander engine moving a real always-on-top window (35-photo-desktop-pet.md)
Capability feature toggles	16 plain-language feature groups over the raw allow/deny tool lists, backed by a completeness-guarded tool catalog
Google Workspace / Notion / GitHub native tools	First-party MCP tools for Gmail/Calendar/Drive/Sheets, Notion, GitHub (v1.45; hidden by default until configured)
Desktop shell (Tauri 2)	Native window wrapping gateway + dashboard, tray, gateway picker, transparent desktop-pet overlay window
Interaction pacing guard	Conversation-history framing + always-on pacing rule so greetings never re-trigger prior tool-heavy tasks

2026-07 additions (post-v1.24.0)

Feature	Description
Aider-style code map (code_map MCP tool)	tree-sitter symbol graph over the HippoRAG-lite Personalized-PageRank engine; ranks repo files by relevance to a query
Semantic vector memory (w_vec)	third re-rank signal beside FTS/graph; zero-dep CJK-safe NgramHashEmbedder, opt-in DUDUCLAW_SEMANTIC_VECTORS=1
Cross-session user profile	per-user preference traits (temporal supersession) → session-stable ## About This User reply injection; user_profile_record / user_profile_get MCP tools
GDPR export/erase	duduclaw gdpr export|erase <contact> over memory (triples + mentions + key_facts, 4-table cascade, SHA-256 tombstone) and the session store (<channel>:<chat_id> prefix)
Memory PPR bench	duduclaw memory bench — P50/P95 latency + partition recommendation (LightRAG measurement gate)
Custom Dashboard Widgets	AI-guided or raw-HTML dashboard cards in a sandboxed runtime; Widget Studio share/import/export (30-custom-widgets.md)
Budget circuit breaker	hard per-agent rolling-window spend caps ([budget] daily_cap_cents) that block LLM calls at the choke-point; budget_events.jsonl
Burn-rate cost anomaly	rolling mean+stddev outlier detection over per-day spend (cost_anomaly.rs)
Audit export + SIEM sink	duduclaw audit — normalize + stream the JSONL audit trails to NDJSON / a webhook
Output guardrail hook	opt-in [guardrails] — secret-leak / injection-echo / deny-phrase / PII scan before send
CI red-team scan	duduclaw redteam — jailbreak variants from CONTRACT.toml must_not, run through the input-guard
Security posture report	duduclaw security — weighted checklist of active protections
Backup / restore	duduclaw backup / restore — timestamped home archive + SHA-256 sidecar (verified on restore)
Session replay	duduclaw session replay <id> — print a session’s turns (+ --tools)
MCP Bridge	[[mcp.external]] — mount external MCP servers with a deny-by-default tool filter + env:// / secret:// credentials; per-SaaS recipes in guides/mcp-bridge.md
Secret manager backends	1Password Connect + Infisical adapters; secret://<backend>/<name> resolution wired into the MCP Bridge
MCP/skill trust tiering	official / active / orphan classification from repo push-age + owner type
Email channel (partial)	async SMTP send (lettre, loopback-verified) + RFC822 inbound parse; IMAP poll + channel lifecycle are PENDING-LIVE
Communication Channels	now nine (adds Google Chat + Microsoft Teams over the 7 below)

---

Core Architecture

Feature	Description
Multi-Runtime AI Agent Platform	Unified AgentRuntime trait — Claude / Codex / Gemini / Antigravity (agy) / Grok (grok) / OpenAI-compat six backends with auto-detection
MCP Server (JSON-RPC 2.0)	Exposes 80+ tools to AI Runtime via stdin/stdout; registered at <agent>/.mcp.json (v1.8.5 — Claude CLI -p only reads project-level), gateway auto-creates/repairs on startup
ACP/A2A Server	Two commands: duduclaw acp — Agent Client Protocol v1 for IDE agent panels (Zed / JetBrains / nvim; initialize / session/new / session/prompt streaming, AUTH_REQUIRED when unconfigured); duduclaw acp-server — A2A protocol (agent/discover / message/send / tasks/*, .well-known/agent.json AgentCard)
Agent Directory Structure	.claude/, .mcp.json, SOUL.md, CLAUDE.md, CONTRACT.toml, agent.toml, wiki/, SKILLS/, memory/, tasks/, state/
Sub-agent Orchestration	create_agent / spawn_agent / list_agents with reports_to hierarchy + D3.js OrgChart + “## Your Team” auto-injection
DelegationEnvelope	Structured handoff protocol — context / constraints / task_chain / expected_output
TaskSpec Workflow	Multi-step task planning — dependency-aware scheduling, auto-retry (3x), replan (2x), persistence
Long-Response Splitting	Sub-agent replies > channel byte budget split via channel_format::split_text with paginated labels 📨 **agent** 的回報 (1/N)
Orphan Response Recovery	reconcile_orphan_responses replays bus_queue.jsonl agent_response callbacks left by crash / Ctrl+C / hotswap
File-based IPC	bus_queue.jsonl for inter-agent delegation, max 5 hop tracking
Per-Agent Channel Token	get_agent_channel_token reads per-agent bot_token_enc first (fixes Discord thread cross-bot 401s)

Multi-Runtime

Feature	Description
Claude Runtime	Claude Code SDK (claude CLI) with JSONL streaming + --resume multi-turn
Codex Runtime	OpenAI Codex CLI with --json streaming events, AGENTS.md file for system prompt
Gemini Runtime	Google Gemini CLI with --output-format stream-json, GEMINI_SYSTEM_MD env var for system prompt, --approval-mode yolo. Retained for paid GEMINI_API_KEY users after Google retired the personal-tier Gemini CLI on 2026-06-18
Antigravity Runtime (v1.24.0)	Google Antigravity CLI (agy, the 2026-06-18 Gemini-CLI successor), driven via oneshot agy -p --dangerously-skip-permissions --print-timeout 300s. Binary auto-resolve (PATH → ~/.local/bin/agy); no --system flag so the system prompt + history are embedded in the prompt (CJK-safe); auth ANTIGRAVITY_API_KEY; auto-pre-seeds the agent dir into agy’s trustedWorkspaces (cross-process lock) to avoid a headless trust-prompt hang; token usage estimated (print mode exposes no stats)
Grok Runtime (R4)	xAI Grok CLI (“Grok Build”), driven via oneshot grok -p (verified against docs.x.ai 2026-07-13). Binary grok (curl-installed; third-party grok-cli as fallback probe); --model selection; --tools/--disallowed-tools confinement (+ native_sandbox hard gate); system prompt + history embedded in the prompt (CJK-safe); duduclaw MCP server written as [mcp_servers.duduclaw] TOML into per-agent <agent_dir>/.grok/config.toml (+ agent identity forwarded via spawn env); XAI_API_KEY env auth; token usage estimated (plain stdout). Residuals (need a live CLI): --tools list delimiter, project-local config.toml discovery for mcp_servers, --output-format json schema for real usage, and the full --model roster (grok models) — only grok-4.5 / grok-build-0.1 are doc-confirmed
OpenAI-compat Runtime	HTTP endpoint (MiniMax / DeepSeek / etc.) via REST API
RuntimeRegistry	Auto-detection of installed CLIs, per-agent [runtime] config
Cross-Provider Failover	FailoverManager health tracking, cooldown, non-retryable error detection

Session Memory Stack (v1.8.1 + v1.8.6)

Feature	Description
Native Multi-Turn	Claude CLI --resume + SHA-256 deterministic session ID + history-in-prompt fallback (stale session, account rotation, unknown stream-json error)
Turn Trimming	>800 chars → head 300 + tail 200 + [trimmed N chars], CJK-safe char-level slicing
Prompt Cache Strategy	Direct API “system_and_3” breakpoint placement, ~75% multi-turn hit rate
Compression Summary Injection	Post-compression summaries (role=system) injected into system prompt, not conversation turns
Instruction Pinning	First user message → async Haiku extraction → sessions.pinned_instructions → injected at system prompt tail
Snowball Recap	Each turn prepends <task_recap> to user message — zero LLM cost, U-shaped attention tail
Clarification Accumulation	Agent-question + user-answer appended to pinned instructions (≤1000 chars)
P2 Key-Fact Accumulator	2-4 facts per substantive turn → key_facts FTS5 table → top-3 injected (~100-150 tokens vs MemGPT 6,500, −87%)
CLI Lightweight Path	call_claude_cli_lightweight() — --effort medium --max-turns 1 --no-session-persistence --tools "", 25-40% cost reduction
Stabilization Flags	--strict-mcp-config + --exclude-dynamic-system-prompt-sections (10-15% token reduction); --bare removed v1.8.11 (broke OAuth keychain)
CJK-Safe String Slicing	duduclaw_core::truncate_bytes / truncate_chars replaced 31 unsafe byte-index sites

Communication Channels (7)

Channel	Protocol
Telegram	Long polling, file/photo/sticker/voice, forums/topics, mention-only, voice transcription
LINE	Webhook, HMAC-SHA256 signature, sticker support, per-chat settings
Discord	Gateway WebSocket, slash commands (/ask /status /config /session /agent), voice channels (Songbird), auto-thread (session id stable across entire thread lifetime post-v1.8.14), embed replies
Slack	Socket Mode, mention-only, thread replies
WhatsApp	Cloud API
Feishu	Open Platform v2
WebChat	Embedded /ws/chat WebSocket + React frontend (Zustand store)
Channel Hot-Start/Stop	Dashboard-driven dynamic launch/termination
Generic Webhook	POST /webhook/{agent_id} + HMAC-SHA256 signature verification
Media Pipeline	Auto-resize (max 1568px) + MIME detection + Vision integration
Sticker System	LINE sticker catalog + emotion detection + Discord emoji equivalents
Channel Failure Tracking	channel_failures.jsonl with FailureReason enum (RateLimited/Billing/Timeout/BinaryMissing/SpawnError/EmptyResponse/NoAccounts/Unknown)
Discord Gateway Hardening (v1.9.2)	Real op 6 RESUME — persists session_id + resume_gateway_url + sequence across reconnects; select! stall watchdog breaks after 2× heartbeat silence (fixes 18-min zombie); heartbeat channel capacity 1→16 with try_send; op 9 reads d.bool for RESUME vs IDENTIFY with 1-5s jitter; close codes 4007/4009/4003 clear session; backoff cap 300s→60s; handles RESUMED dispatch

Evolution System

Evolution v3 (2026-08-06): the default evolution target moved from rewriting SOUL.md to the playbook (small, independently-retirable gene-shaped rules; SOUL.md is read-only for agents by default). The GVU² rows below (Dual-Loop / 4+2 Layer Verification / SOUL.md Versioning) now describe the non-default legacy path (agent.toml [evolution] legacy_soul_evolution = true). See 38-aee-playbook-evolution.md and evolution-engine.md ch.12 for the current default (AEE, Gate/Measure split, champion + matches-or-improves, entry-level observation windows).

Feature	Description
Prediction-Driven Engine	Active Inference + Dual Process Theory, ~90% zero LLM cost
Dual Process Router	System 1 (rules) / System 2 (LLM reflection)
AEE (v3 default)	Agentic Evolution Engine — Generator inner loop (≤3 rounds) → Gate (deterministic, veto) / Measure (scored, no veto) split → champion + matches-or-improves commit gate → entry-level accept/rollback against linked eval cases
Playbook (v3 default)	Gene-shaped behavior rules (category/signals_match/eval_cases/success_streak), extends the existing rule_lifecycle store, 0.92-cosine dedup, capacity + stale/archive lifecycle
GVU² Dual-Loop (legacy)	Outer loop (Behavioral GVU — SOUL.md rewrite) + Inner loop (Task GVU — instant retry); opt-in via legacy_soul_evolution = true
4+2 Layer Verification (legacy)	L1-Format / L2-Metrics / L2.5-MistakeRegression / L3-LLMJudge / L3.5-SandboxCanary / L4-Safety
MistakeNotebook	Cross-loop error memory — records failure patterns, prevents regression; entries now carry deterministic TrajectoryEvidence (which tool/assertion failed) so unverified self-reported diagnosis no longer feeds reflection consolidation (v3)
SOUL.md Versioning (legacy)	24h observation period, atomic rollback, SHA-256 fingerprint — applies to the legacy GVU path; SOUL.md cap-deadlock now breaks via a guarded consolidate rewrite instead of freezing the agent (v3 Phase 0)
MetaCognition	Self-calibrating error thresholds every 100 predictions, now with a symmetric raise-back rule so thresholds don’t drift one-directionally (v3 Phase 0)
Adaptive Depth	MetaCognition-driven GVU iteration count (3-7 rounds based on history)
Deferred GVU (legacy)	Gradient accumulation + delayed retry (max 3 deferrals, 72h span, 9-21 effective rounds)
Stagnation Detector (v3)	Scans evolution.db every 30 min for consecutive-rejected / D-days-zero-apply / repeated-rejection-reason signals, posts to Activity Feed + dashboard
ConversationOutcome	Zero-LLM conversation result detection (TaskType / Satisfaction / Completion), zh-TW + en
Agent-as-Evaluator	Independent Evaluator Agent (Haiku cost control) for adversarial verification, structured JSON verdict
Orchestrator Template	5-step planning (Analyze → Decompose → Delegate → Evaluate → Synthesize) + complexity routing

Wiki Knowledge Layer (v1.8.9)

Feature	Description
4-Layer Architecture	L0 Identity / L1 Core / L2 Context / L3 Deep — Vault-for-LLM inspired
Trust Weighting	trust (0.0-1.0) frontmatter; search ranked by trust-weighted score
Auto-Injection	build_system_prompt() injects L0+L1 into WIKI_CONTEXT across CLI / channel / dispatcher paths
FTS5 Full-Text Index	SQLite unicode61 tokenizer with CJK support, auto-syncs on write/delete, manual rebuild wiki_rebuild_fts
Knowledge Graph	wiki_graph MCP tool exports BFS-limited Mermaid diagrams; node shapes by layer
Dedup Detection	wiki_dedup — title match + tag Jaccard similarity (≥0.8)
Reverse Backlink Index	Scans related frontmatter + body markdown links for bidirectional mapping
Search Filters	min_trust / layer / expand (1-hop related/backlink expansion)
Shared Wiki	~/.duduclaw/shared/wiki/ cross-agent SOPs + policies + specs; wiki_visible_to capability control; MCP tools shared_wiki_ls/read/write/search/delete/stats, wiki_share; SoT policy via .scope.toml (see Identity & Access)
CLAUDE_WIKI Template	Included in agent CLAUDE.md on creation, provides wiki MCP tool usage guide

Skill Ecosystem

Feature	Description
7-Stage Lifecycle	Activation → Compression → Extraction → Reconstruction → Distillation → Diagnostician → Gap Analysis
GitHub Live Indexing	Search API with 24h local cache, weighted search
Skill Marketplace	Web dashboard browsing, installation, security scanning
Skill Auto-Synthesis	Gap accumulator → synthesize from episodic memory (Voyager-inspired) → sandbox trial with TTL → cross-agent graduation
Skill Synthesis Scheduler (W19-P1, v1.22.0)	Runs the “conversation → skill” extraction autonomously on an interval — config.toml [skill_synthesis] auto_run / dry_run / interval_hours / lookback_days + dashboard skill_synthesis.get/update RPC; skill_synthesis_threshold is a u32 count (fixed the registry scan rejecting 0.7)
Skill Security Scanner (Rust-native)	skill_lifecycle::security_scanner scans candidate skills, no Python dependency

Local Inference Engine

Feature	Description
llama.cpp	Metal/CUDA/Vulkan/CPU via llama-cpp-2 crate
mistral.rs	Rust-native, ISQ on-the-fly quantization, PagedAttention, Speculative Decoding
OpenAI-compatible HTTP	Exo/llamafile/vLLM/SGLang
Confidence Router	LocalFast / LocalStrong / CloudAPI three-tier routing, CJK-aware token estimation
InferenceManager	Multi-mode auto-switching: Exo P2P → llamafile → Direct → OpenAI-compat → Cloud API
llamafile Manager	Subprocess lifecycle, zero-install portable inference across 6 OS
Exo P2P Cluster	Distributed inference, 235B+ models across machines, cluster discovery, endpoint failover
MLX Bridge	Apple Silicon local reflections via mlx_lm + LoRA adapter support
Model Management	model_search (HuggingFace), model_download (resume + mirror), model_recommend (hardware-aware)

Compression Engine

Feature	Description
Meta-Token (LTSC)	Rust-native lossless BPE-like, 27-47% compression on structured input
LLMLingua-2	Microsoft token-importance pruning, 2-5x lossy compression
StreamingLLM	Attention sink + sliding window KV-cache for infinite conversations
Strategy Selector	compress_text accepts strategy param — meta_token / llmlingua / streaming_llm / auto

Voice Pipeline

Feature	Description
ASR (Speech-to-Text)	Whisper.cpp (local) / SenseVoice ONNX (local) / OpenAI Whisper API / Deepgram (streaming)
TTS (Text-to-Speech)	Piper ONNX (local) / MiniMax T2A (auto-detect CJK/Latin) / Edge TTS / OpenAI TTS
VAD	Silero ONNX voice activity detection
Audio Decode	symphonia: OGG Opus, MP3, AAC, WAV, FLAC → PCM
Discord Voice	Songbird integration, voice channel participation
LiveKit Voice	WebRTC multi-agent voice rooms
ONNX Embedding	BERT WordPiece tokenizer + ONNX Runtime vector embedding

Security

Feature	Description
3-Phase Defense	Deterministic blacklist (<50ms) / obfuscation detection (YELLOW+) / AI judgment (RED only)
Threat Level State Machine	GREEN → YELLOW → RED auto-escalation, 24h no-event auto-demotion
Ed25519 Auth	Challenge-response WebSocket authentication
AES-256-GCM	API key encryption at rest, per-agent key isolation
Prompt Injection Scanner	6 rule categories + XML delimiter protection
SOUL.md Drift Detection	SHA-256 fingerprint comparison
CONTRACT.toml	Behavioral boundaries + duduclaw test red-team CLI (9 built-in scenarios); auto-injected into system prompt for all runtimes
RBAC	Role-based access control matrix
Unified Audit Log	audit.unified_log merges security_audit.jsonl / tool_calls.jsonl / channel_failures.jsonl / feedback.jsonl — Logs page source filter + severity dropdown
JSONL Audit Log	Full tool call recording, async write
Unicode Normalization	NFKC normalization to detect homograph attacks
Action Claim Verifier	Signature validation for tool execution claims
Container Sandbox	Docker (Bollard) / Apple Container / WSL2 — --network=none, tmpfs, read-only rootfs, 512MB limit
Secret Leak Scanner	20+ patterns (Anthropic/OpenAI/AWS/GitHub/Slack/Stripe/DB URLs)
Sensitive Data Redaction (RFC-23, v1.14.0)	duduclaw-redaction crate — internal data (Odoo / shared wiki / file tools) is replaced with <REDACT:CATEGORY:hash8> tokens before reaching the LLM and auto-restored at trusted egress (user channel reply, whitelisted tools); AES-256-GCM SQLite vault (per-agent 32-byte key, 0o600), TTL 7d two-phase GC, 5 built-in profiles, five-layer enable/disable resolver, JSONL audit with 10MB rotation

Memory System

Feature	Description
Episodic / Semantic Separation	Generative Agents 3D-weighted retrieval (Recency + Importance + Relevance)
Full-Text Search (FTS5)	SQLite built-in
Vector Index	Embedding-based semantic search (ONNX BERT / Qwen3-Embedding)
Memory Decay Scheduler	Daily background task — low-importance + 30d old → archived, archived + 90d → permanent delete
Cognitive Memory MCP Tools	memory_search_by_layer, memory_successful_conversations, memory_episodic_pressure, memory_consolidation_status
Federated Memory	Cross-agent knowledge sharing (Private / Team / Public levels)
Key-Fact Accumulator	key_facts table with FTS5 — cross-session lightweight memory (see Session Memory Stack)
Temporal Memory (F1, v1.19.0)	memories gains temporal/knowledge-graph columns (valid_from/valid_until/superseded_by/supersedes/subject/predicate/object/confidence/metadata) via idempotent migration; store_temporal() auto conflict-resolves same (agent, subject, predicate) and links supersession chain; search() default-filters to currently-valid rows; get_history() / get_at() expose chain + point-in-time
Reflexion Loop (F2, v1.19.0)	Bridges existing MistakeNotebook — F2a injects recent unresolved mistakes into answering prompt (## Past Mistakes to Avoid, CJK-safe match + recency fallback); F2b consolidates ≥3 same-MistakeCategory mistakes into one semantic memory rule (reflexion.rs) then marks sources resolved. Trigger = ErrorCategory Significant/Critical (MetaCognition-adaptive)
memory_fetch_batch (F3, v1.19.0)	MCP tool + get_by_ids fetch ≤100 entries by ID in one call (namespace/ownership enforced, partial hits → missing_ids)
Bi-temporal + build-time provenance (D1)	memories gains ingested_at (transaction-time axis, distinct from world-time valid_from) + invalidated_by_event/invalidated_at (which source_event closed a row out, when) via idempotent migration. store_temporal() supersession is decided by world-time valid_from (out-of-order resilient — an earlier fact inserts as a bounded historical segment without disturbing the current one; no-valid_from writes keep legacy ingestion-order behavior); identical re-observation reaffirms (metadata reaffirmed_by, ≤20, + access_count bump) instead of adding a row
memory_get_history / memory_get_at (D1)	MCP exposure of the temporal read APIs — full supersession chain (with provenance columns) and point-in-time lookup for a (subject, predicate) triple (scope memory:read)
memory_invalidate_by_origin (D1)	Source rollback primitive — expires (never deletes) every currently-valid fact from an exact origin (optionally since a cutoff), cascades origin_trust ≤ 0.1 to derived_from descendants; history preserved (invalidated_by_event = "origin_purge"). Scope admin
Graph retrieval evolution (D3)	HippoRAG-lite graph gains four fail-safe refinements (byte-identical when unused): (1) persistent per-agent graph cache (RwLock) invalidated by a per-agent generation counter that every triple-mutating write bumps, engaged only above GRAPH_CACHE_MIN_TRIPLES = 500; (2) entity alias merging via entity_alias(agent_id, canonical, alias) — folds surface forms onto one node before build+seeding, normalized + chain-flattened; (3) predicate edge labels attached to edges (PPR unchanged) feeding engine.export_graph(agent, limit) → serializable {nodes, edges} snapshot (quarantined facts flagged) for the D6 curation UI; (4) opt-in embedding seeding (graph_embed_seed) — PPR seeds = whole-word FTS ∪ query-embedding nearest entity vectors (same-model cosine, top-k, lazy entity_embedding cache), off by default
memory_alias_add / memory_alias_list (D3)	MCP tools to manage entity aliases — add folds an alias onto a canonical entity (scope memory:write), list returns (canonical, alias) pairs (scope memory:read); namespace-isolated
Decision Continuity (RFC-24, v1.23.0)	When an agent offers an enumerated choice (Option A/B/C), each option is persisted into the Temporal Memory semantic layer (independent of conversation compression) and open decisions are re-injected each turn; a later “use Option C” (new turn / session / process) resolves from durable state instead of being guessed. Deterministic, zero-LLM detection; decision_resolve / decision_list MCP tools + Dashboard panel + Prometheus counters; per-agent opt-in [memory] decision_continuity = true (TTL decision_ttl_days, default 7)

Git Worktree Isolation (v1.6.0)

Feature	Description
L0 Isolation Layer	Per-task git worktree — cheaper than container sandbox, prevents concurrent agent file collisions
Atomic Merge	Dry-run pre-check → abort → real merge if clean; protected by global Mutex
Snap Workflow	create → execute → inspect → merge/cleanup; pure-function decision logic
Friendly Branch Names	wt/{agent_id}/{adjective}-{noun} from 50×50 word lists
copy_env_files	Path traversal jail, symlink rejection, 1MB size limit
AgentExitCode	Structured exit codes — Success / Error / Retry / KeepAlive
Resource Limits	Max 5 worktrees per agent, 20 total

Account & Cost Management

Feature	Description
Multi-Account Rotation	OAuth + API Key, 4 strategies (Priority/LeastCost/RoundRobin/Failover)
Dual Dispatch Path	Both sub-agent dispatcher (claude_runner::call_with_rotation) and channel reply (channel_reply::call_claude_cli_rotated) go through rotator
CostTelemetry	SQLite token tracking + cache efficiency analytics + 200K price cliff warning
Budget Manager	Per-account monthly limits + cooldown + adaptive routing (cache_eff <30% → local)
Direct API	Bypass CLI, cache_control: ephemeral, 95%+ cache hit rate
Channel Failure Tracking	channel_failures.jsonl with category-specific zh-TW messages
Binary Discovery	which_claude() / which_claude_in_home() probe Homebrew (Intel + Apple Silicon) / Bun / Volta / npm-global / .claude/bin / .local/bin / asdf / NVM

Browser Automation

Feature	Description
5-Layer Router	API Fetch / Static Scrape / Headless Playwright / Sandbox Container / Computer Use
Capability Gating	agent.toml [capabilities] deny-by-default
Browserbase	Cloud browser alternative for L5
bash-gate.sh	Layer 1.5 allowlist for Playwright/Puppeteer (requires DUDUCLAW_BROWSER_VIA_BASH=1)

Container Sandbox

Feature	Description
Docker	Bollard API, all platforms
Apple Container	Native macOS 15+
WSL2	Windows Linux subsystem

Scheduling

Feature	Description
CronScheduler	cron_tasks.jsonl + cron_tasks.db persistent (v1.8.12), schedule_task MCP tool with corrected schema including agent_id + name
ReminderScheduler	One-shot reminders (relative 5m/2h/1d or ISO 8601), direct or agent_callback mode
HeartbeatScheduler	Per-agent unified scheduling — bus polling + GVU silence breaker + cron
Scheduler-Level Task-Board Pull (v1.9.3)	poll_assigned_tasks moved into HeartbeatScheduler::run tick — scans entire agent registry every 30s (no longer skips enabled=false agents); 1-hour LIKE-marker cooldown prevents stampedes
duduclaw evolution finalize CLI (v1.9.1)	One-shot recovery for SOUL.md observation windows that should already have closed; --dry-run / --agent filters; backstop for the 30-min ObservationFinalizer background task

Task Board & Activity Feed

Feature	Description
Task Board	SQLite-backed task management — status / priority / assignment tracking
Dashboard RPC	tasks.list/create/update/remove/assign, activity.list for web UI
Agent MCP Tools	tasks_list, tasks_create, tasks_update, tasks_claim, tasks_complete, tasks_block, activity_list, activity_post — agents see their own queue, claim work, post progress
Real-time Activity Feed	WebSocket-streamed activity events
System-Prompt Injection	Pending tasks (up to 5) auto-injected into agent system prompt

Autopilot Rule Engine

Feature	Description
Event Bus	tokio::broadcast (capacity 8192) — TaskCreated / TaskStatusChanged / ChannelMessage / AgentIdle / CronTick
Rule Conditions	all / any + eq/neq/in/gt/lt/contains operators
Action Types	delegate (enqueue bus task), notify (channel), run_skill (skill name + target validated via alphanumeric allowlist + canonicalize() path containment)
Rule CRUD	Dashboard RPC autopilot.list/create/update/remove/history + agent MCP autopilot_list; structure validated at write time
3-State Circuit Breaker	Per-rule Closed / Open / HalfOpen — 10 fires in 60s trips Open (60s cooldown), then HalfOpen probe; prevents self-reinforcing loops; transitions logged to history + Activity Feed
events.db Bridge	SQLite (WAL + monotonic auto-increment id + 7-day prune) replaces legacy events.jsonl — no rotation race, no partial-line hazard

Reliability & Governance

Feature	Description
Durability Framework (duduclaw-durability, v1.9.4)	Five pillars — idempotency (key-based dedup), retry (exponential backoff + jitter), circuit_breaker (three-state with probe_inflight accounting), checkpoint (resumable task progress), dlq (Dead Letter Queue). Used by gateway LLM fallback + durable cron
Governance Layer (duduclaw-governance, v1.9.4)	PolicyRegistry with YAML loading + hot reload + agent-priority merge + fail-safe (illegal policies skipped, malformed YAML doesn’t panic). Four PolicyTypes — Rate / Permission / Quota / Lifecycle
Quota Manager	Per-agent / per-policy soft + hard quota enforcement; error_codes.rs standardizes governance errors (QUOTA_EXCEEDED / POLICY_DENIED / …). Default set in policies/global.yaml (e.g. default-rate-mcp 200/min)
LLM Fallback Chain (gateway/llm_fallback.rs, v1.9.4)	Primary timeout/503/429/overloaded auto-switches to fallback model; pure is_llm_fallback_error / should_attempt_model_fallback unit-tested; hard-deadline arm returns Err("hard timeout") so fallback triggers reliably
Evolution Events System (v1.9.4)	30+ event schema (schema.rs), async batch+retry emitter (emitter.rs), query interface (query.rs), reliability guarantees (reliability.rs); HTTP endpoints surfaced in Web ReliabilityPage

Identity & Access

Feature	Description
Identity Resolution (duduclaw-identity, RFC-21 §1, v1.11.0)	IdentityProvider async trait — WikiCacheIdentityProvider (shared/wiki/identity/people/*.md), NotionIdentityProvider (Notion databases/query + field_map), ChainedProvider (cache → upstream, graceful degrade)
identity_resolve MCP Tool	Gated by Scope::IdentityRead, returns canonical ResolvedPerson records
Sender Auto-Injection	Channel reply injects XML-delimited <sender> block into system prompt (resolved once per turn) so SOUL.md “reject non-member” rules are data-driven
Shared Wiki SoT Policy (RFC-21 §3, v1.11.0)	~/.duduclaw/shared/wiki/.scope.toml declares namespace ownership — agent_writable (default), read_only { synced_from }, operator_only; honoured by shared_wiki_write / shared_wiki_delete; wiki_namespace_status exposes active policy; absent/malformed ⇒ fail-safe no policy

Live Forking (RFC-26)

Feature	Description
Live Run Forking (duduclaw-fork)	pydantic-deepagents-inspired parallel branching of a live run — explore multiple continuations concurrently
AI Judge	Scores parallel branches to select the best continuation
Budget Control	budget.rs caps fork fan-out / cost

CLI Runtime (PTY Pool)

Feature	Description
Cross-Platform PTY Pool (duduclaw-cli-runtime, v1.15.0)	Drives the real interactive claude REPL (ConPTY on Win 10 1809+, openpty on Unix via portable-pty) with sentinel-framed in-band response protocol — a standby for if Anthropic re-activates the programmatic-usage split that would block claude -p for OAuth-subscription accounts (the 2026-06-15 change was paused; -p still works). Default off, per-agent opt-in [runtime] pty_pool_enabled = true. Known limitation: pool sessions have no conversation dimension (cross-conversation context bleed) — the default FreshSpawn -p path is unaffected. See 27-pty-pool-runtime
Worker Supervisor (duduclaw-cli-worker)	Out-of-process worker subprocess gated by [runtime] worker_managed = true; SIGTERM/SIGKILL sequenced into gateway graceful shutdown
pty_runtime.rs Adapter	RuntimeMode::{FreshSpawn, PtyPool} per-agent routing, acquire_and_invoke surface; OAuth → interactive REPL, API-key → oneshot_pty_invoke + claude -p
Unbound from Claude (v1.24.0)	CliKind::Antigravity added; which_codex / which_gemini / which_agy discovery (alongside which_claude); resolve_program + worker spawn_session_default resolve all four CliKinds (no more None/reject); cli_kind_for_provider() derives the PtyPool kind from [runtime] provider, replacing the two hardcoded CliKind::Claude acquire sites. Interactive REPL stays Claude-only by design (non-Claude providers route to the oneshot runtime_dispatch path)
Runtime Status Endpoint	GET /api/runtime/status loopback-only JSON (Phase 8.5)
Observability	pty_pool_* Prometheus counters (acquires / cache-hit / spawn / eviction / invoke outcomes / duration histogram), worker_health_misses_total, worker_restarts_total, pty_pool_managed_worker_active gauge
Graceful Fallback	All PTY paths fall back to legacy tokio::process::Command + claude -p on error — missing worker / unhealthy pool / spawn failure is recoverable

MCP HTTP/SSE Transport (W20)

Feature	Description
HTTP Server	duduclaw http-server --bind 127.0.0.1:8765 — Bearer-authenticated REST + SSE
Endpoints	POST /mcp/v1/call (single JSON-RPC tool call), GET /mcp/v1/stream (long-lived SSE), POST /mcp/v1/stream/call (async + SSE push), GET /healthz (no auth)
Rate Limit	Token bucket OpType::HttpRequest, 60 req/min
SSE Connection Store	mcp_sse_store.rs manages SSE connections with broadcast channels

ERP Integration

Feature	Description
Odoo Bridge	15 MCP tools (CRM/Sales/Inventory/Accounting), JSON-RPC middleware
Edition Gate	CE/EE auto-detection, feature gating
Event Polling	Proactive agent notifications on Odoo state changes
Per-Agent Credential Isolation	OdooConnectorPool keyed by (agent_id, profile); audit log carries profile + ok=bool (v1.11.0 / RFC-21 §2)
Dashboard Test-Before-Save	odoo.test accepts inline params; missing credential falls back to stored secret; inline mode reuses the same SSRF / HTTPS / db-name validators (v1.13.1)

RL & Observability

Feature	Description
RL Trajectory Collector	Writes ~/.duduclaw/rl_trajectories.jsonl during channel interactions
duduclaw rl CLI	export / stats / reward — composite reward (outcome × 0.7 + efficiency × 0.2 + overlong × 0.1)
Prometheus Metrics	GET /metrics — requests, tokens, duration histogram, channel status
Dashboard WebSocket Heartbeat	Server Ping 30s + 60s idle close; client ping RPC 25s
BroadcastLayer	Tracing layer streams real-time logs to WebSocket subscribers

Memory Evaluation & Python Layer

Feature	Description
LOCOMO Memory Evaluation (W21, v1.9.4)	python/duduclaw/memory_eval/ — retrieval_accuracy / retention_rate / locomo_integrity_check; cron_runner daily 03:00 UTC; 5-min smoke_test P0; build_golden_qa.py builds gold-standard QA set; 200-entry data/golden_qa_set.jsonl; duduclaw-memory batch query API
Python Agents Routing (v1.9.4)	python/duduclaw/agents/ — capability-based routing (capabilities/ manifest loader + matcher, routing/ router + resolution + memory_resolver)
Python MCP Scope Enforcement (v1.9.4)	python/duduclaw/mcp/ — API key auth with key masking; memory tools (store/read/search/namespace/quota) with strict scope enforcement (memory:write / memory:read) at execute() entry

Web Dashboard

Feature	Description
23 Pages	Dashboard / Agents / Channels / Accounts / Memory / Security / Settings / OrgChart / SkillMarket / Logs / WebChat / OnboardWizard / Billing / License / Report / PartnerPortal / Marketplace / KnowledgeHub / Odoo / Login / Users / Analytics / Export
Tech Stack	React 19 + TypeScript + Tailwind CSS 4 + Base UI + CVA
DuDuClaw Design System (mds)	Shared web/src/components/mds/ component library (OKLCH tokens, four-layer surfaces, three-tier shadows, Inter / Geist Mono) + nav-model.ts grouped sidebar (personal / work / company / settings) + web/DESIGN.md spec; every page built on the shared primitives with synchronized en/ja/zh i18n
Real-time Log Streaming	BroadcastLayer tracing → WebSocket push
Memory → Key Insights Tab	key_facts cards with access_count badge + timestamp + collapsible source metadata
Memory → Evolution Tab	SOUL.md version history with pre/post metric deltas + status badges
Logs → History Tab Rewrite	Source filter chips + per-source counts + severity dropdown + severity-colored left borders + JSON detail expansion
Toast Notifications	Module-scoped event bus, max-5 queue, warm stone/amber/emerald/rose variants, respects prefers-reduced-motion
OrgChart	D3.js interactive agent hierarchy visualization
Session Replay	Conversation playback with timeline
WikiGraph	Interactive knowledge graph
Internationalization	zh-TW / en / ja-JP (600+ translation keys)
Dark/Light Theme	System preference + manual toggle
Experiment Logger	Trajectory recording for RL/RLHF offline analysis
Marketplace RPC	marketplace.list serves real MCP catalog (Playwright / Browserbase / Filesystem / GitHub / Slack / Postgres / SQLite / Memory / Fetch / Brave Search)
Partner Portal	SQLite PartnerStore + profile/stats/customers CRUD + 7 RPCs

Commercial

Feature	Description
License Tiers	Free / Pro / Enterprise
Hardware Fingerprint	License binding
Industry Templates	Manufacturing / Restaurant / Trading
CLI Tools	12+ subcommands
Partner Portal	Multi-tenant reseller interface