fix(server): wire WS event bridge to the bus channels actually publish to (#673)

* fix(server): wire WS event bridge to the bus channels actually publish to

include_all_routes() built the /v1/agents/events WebSocket router from
get_event_bus() — a global singleton nothing in `jarvis serve` publishes
to. The real bus lives at app.state.bus (set in server/app.py and handed
to every channel/agent). Events published on it silently never reached
any connected browser client, since the WS router was subscribed to a
different, disconnected EventBus instance entirely.

* fix(server): keep managed agent events on app bus

---------

Co-authored-by: Ari <ari.silva@paipe.co>
Co-authored-by: Elliot Slusky <elliot@slusky.com>

.github/clone-stats/badge.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "label": "Git Clones",
-  "message": "189,482",
+  "message": "190,252",
   "color": "green",
   "namedLogo": "git"
 }

.github/clone-stats/clone-data.json

@@ -1,6 +1,6 @@
 {
-  "total_clones": 189482,
-  "last_updated": "2026-08-13T07:22:13Z",
+  "total_clones": 190252,
+  "last_updated": "2026-08-14T07:19:51Z",
   "daily": {
     "2026-03-27": 2189,
     "2026-03-28": 1874,
@@ -140,6 +140,7 @@
     "2026-08-09": 1076,
     "2026-08-10": 1060,
     "2026-08-11": 2182,
-    "2026-08-12": 641
+    "2026-08-12": 641,
+    "2026-08-13": 770
   }
 }

docs/user-guide/data-boundary-scan.md

@@ -0,0 +1,174 @@
+# Data-boundary scan
+
+`jarvis scan --data-boundaries` reports application-level data boundaries in the
+current OpenJarvis configuration. It complements the existing host/environment
+scan, which checks OS posture such as disk encryption, cloud-sync agents, remote
+access tools, and exposed engine ports.
+
+The data-boundary scan is a configuration diagnostic. It is not a vulnerability
+scanner, a legal privacy assessment, a network monitor, or an OAuth-scope audit.
+
+## Run the scan
+
+```bash
+jarvis scan --data-boundaries
+jarvis scan --data-boundaries --json
+jarvis scan --data-boundaries --json --show-paths
+jarvis scan --data-boundaries --strict
+```
+
+`--strict` exits with status code `1` when the report contains either a `fail`
+or a `warn` finding. Use it when CI or pre-demo checks need to enforce a
+conservative local-only posture.
+
+Without `--strict`, the command always exits `0` even when fail or warn findings
+are present. This is useful for exploratory review.
+
+On a fresh `jarvis init` configuration, common warn findings include
+`server.host = "0.0.0.0"` and `telemetry.enabled = true`. Running
+`jarvis scan --data-boundaries --strict` after init therefore exits `1` until
+those defaults are tightened.
+
+Absolute paths and connector file basenames are redacted by default so JSON
+reports can be pasted into issues without revealing local usernames, mount
+points, or account labels. Use `--show-paths` only for local debugging.
+
+## What it checks
+
+The scan inspects configuration values, environment-variable presence, and the
+existence of known local runtime files. It does not read private content from
+memory databases, trace databases, connector credentials, prompt files, logs, or
+OAuth token files.
+
+The current checks cover:
+
+- cloud-capable model provider, engine, and default model settings
+- local memory context injection combined with cloud-capable inference
+- traces, telemetry, learning, training, and spec-search settings
+- automatic memory service (`tools.storage.enabled` / `[memory].enabled`)
+- deep research engine and model settings
+- security bypass flags when cloud inference is configured
+- unset `security.profile` (informational)
+- web search, browser, local file, shell, code, knowledge chunk scanning, and MCP tool surfaces
+- local knowledge.db composition with cloud-capable Deep Research targets
+- server binding and unauthenticated A2A exposure
+- channel enablement, channel credential fields, and channel credential env vars
+- skills, skill auto-sync, digest sources, and cloud speech/TTS backends such as Cartesia
+- local stores such as `knowledge.db`, `credentials.toml`, `memory.db`, `traces.db`,
+  `telemetry.db`, `scheduler.db`, embeddings, skill index, `.vault_key`, and memory files
+- connector credential files under `connectors/*.json`, without reading them
+- API-key and other runtime credential environment variables (presence only)
+- a scope note for frontend credential storage when cloud/API-key surfaces exist
+
+Configured database paths (for example `traces.db_path` or `memory.db_path`)
+are resolved from config when set, not only the default locations under the
+OpenJarvis home directory.
+
+Static Deep Research targeting uses configuration only (no request overrides):
+`deep_research.engine` or `engine.default`, and `deep_research.model` or
+`server.model` or `intelligence.default_model`.
+
+Model identifiers that contain vendor names (for example `deepseek-r1` or
+`openai/gpt-oss`) are not treated as cloud-bound when their effective engine is
+explicitly local, such as Ollama.
+
+## Status levels
+
+| Status | Meaning |
+| --- | --- |
+| `fail` | A configuration composition is likely incompatible with strict local-only use. |
+| `warn` | A configured surface may send data outside the local runtime or persist sensitive data. |
+| `info` | A relevant setting or local store exists, with no immediate fail or warn condition. |
+
+The command reports potential data paths. It does not prove that a path has been
+used during a specific run.
+
+JSON output includes `"schema_version": 1` for stable downstream parsing.
+
+## Strict local-only checklist
+
+For a conservative local-only setup, review these settings:
+
+```toml
+[analytics]
+enabled = false
+
+[traces]
+enabled = false
+
+[telemetry]
+enabled = false
+
+[agent]
+context_from_memory = false
+
+[intelligence]
+provider = ""
+preferred_engine = ""
+default_model = ""  # local model name only
+
+[engine]
+default = "ollama"  # or another local engine
+
+[tools]
+enabled = ""
+
+[tools.storage]
+enabled = false
+
+[tools.mcp]
+enabled = false
+servers = ""
+
+[channel]
+enabled = false
+
+[learning]
+enabled = false
+auto_update = false
+training_enabled = false
+
+[learning.spec_search]
+enabled = false
+
+[server]
+host = "127.0.0.1"
+
+[security]
+profile = "personal"
+
+[a2a]
+enabled = false
+```
+
+Also unset cloud and channel credentials from the process environment when they
+are not needed.
+
+## Scope and non-goals
+
+The scan intentionally avoids reading private data. In particular, it does not:
+
+- read connector JSON contents or OAuth scopes
+- inspect browser `localStorage` or Tauri secure storage
+- inspect frontend credential storage directly
+- inspect installed skill source code
+- intercept runtime network traffic
+- classify provider retention or training policies
+- prove that a configured path was used at runtime
+
+Frontend credential storage is tracked separately from this CLI diagnostic. If a
+cloud/API-key surface is present, the scan emits an informational scope note so
+users know that browser/Tauri credential storage must be reviewed separately.
+
+## Configuration resolution
+
+The scan follows the same explicit configuration override used by the runtime:
+if `OPENJARVIS_CONFIG` is set, that file is audited. Otherwise the scan uses
+the default OpenJarvis config path under the resolved OpenJarvis home. If the
+home directory cannot be resolved, the command reports a `config-root-error`
+finding instead of crashing.
+
+## See also
+
+- [Security](security.md) — three-layer security model (host scan, config scan, BoundaryGuard)
+- [Configuration](../getting-started/configuration.md) — full config reference

docs/user-guide/evaluations.md

@@ -31,6 +31,16 @@ uv sync --extra dev --extra eval-wandb     # Weights & Biases run tracking
 uv sync --extra dev --extra eval-sheets    # Google Sheets results export
 ```
 
+TauBench additionally requires Python 3.12 or newer and the upstream `tau2`
+package. Install the pinned revision explicitly before running that benchmark:
+
+```bash
+uv pip install "tau2 @ git+https://github.com/sierra-research/tau2-bench.git@fc0055dc4e0a316c3f83133267fbd6faaa770992"
+```
+
+OpenJarvis does not install third-party packages automatically when an
+evaluation is imported or run.
+
 !!! note "Python version requirement"
     Python 3.10 requires the `tomli` package for TOML config parsing. `openjarvis` declares it as a conditional dependency, so it is installed automatically.
 

docs/user-guide/security.md

@@ -2,6 +2,20 @@
 
 OpenJarvis includes a security layer that scans prompts and model outputs for secrets, personally identifiable information (PII), and sensitive file paths. The system is designed to be composable: scanners run as a pipeline, and the `GuardrailsEngine` wrapper drops in front of any inference backend without changing how the rest of your code works.
 
+## Three layers of security review
+
+OpenJarvis separates host posture, application data boundaries, and runtime prompt guardrails:
+
+| Layer | Command / component | What it checks |
+| --- | --- | --- |
+| Host scan | `jarvis scan` | Disk encryption, cloud-sync agents, exposed engine ports, remote-access tools |
+| Data-boundary scan | `jarvis scan --data-boundaries` | Configured inference, memory, traces, channels, tools, and local stores |
+| Runtime guardrails | `GuardrailsEngine` / BoundaryGuard | Secrets, PII, and file-policy violations in live prompts and outputs |
+
+Use the host scan before storing sensitive data on the machine. Use the data-boundary scan to verify whether your `config.toml` is local-only, cloud-capable, or mixed. Use BoundaryGuard during inference when you need live redaction or blocking.
+
+See [Data Boundary Scan](data-boundary-scan.md) for the application config diagnostic and [BoundaryGuard](#guardrailsengine) below for runtime scanning.
+
 ---
 
 ## Overview
@@ -446,8 +460,15 @@ guarded = GuardrailsEngine(
 
 ---
 
+## Data boundary scan
+
+See [Data Boundary Scan](data-boundary-scan.md) for the application config diagnostic (`jarvis scan --data-boundaries`).
+
+---
+
 ## See Also
 
+- [Data Boundary Scan](data-boundary-scan.md) — application config and local-store diagnostic (`jarvis scan --data-boundaries`)
 - [Architecture: Security](../architecture/security.md) — pipeline design, event flow, and file policy integration
 - [API Reference: Security](../api-reference/openjarvis/security/index.md) — full class and function signatures
 - [Tools](tools.md) — how `FileReadTool` uses file policy

frontend/src-tauri/Info.plist

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>NSAppTransportSecurity</key>
+  <dict>
+    <!-- The desktop API URL is user-configurable, so it cannot be represented
+         by Tauri's single, build-time exceptionDomain setting. Keep this
+         exception scoped to WKWebView; native URLSession traffic retains ATS. -->
+    <key>NSAllowsArbitraryLoadsInWebContent</key>
+    <true/>
+  </dict>
+</dict>
+</plist>

frontend/src-tauri/tauri.conf.json

@@ -24,7 +24,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*; img-src 'self' data: blob:"
+      "csp": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' http: https: ws: wss:; img-src 'self' data: blob:"
     }
   },
   "bundle": {
@@ -45,7 +45,6 @@
     "macOS": {
       "entitlements": "Entitlements.plist",
       "minimumSystemVersion": "10.15",
-      "exceptionDomain": "",
       "frameworks": [],
       "providerShortName": null,
       "signingIdentity": "-"

frontend/src/components/Chat/MessageBubble.tsx

@@ -103,6 +103,24 @@ function CopyMessageButton({ content }: { content: string }) {
 export function MessageBubble({ message, isLive = false }: Props) {
   const isUser = message.role === 'user';
 
+  const cleanContent = useMemo(() => stripThinkTags(message.content), [message.content]);
+
+  // Build a ref→source lookup once per render. Memoized so the rehype plugin
+  // identity stays stable until the source list actually changes.
+  const sourcesMap = useMemo(() => {
+    const m = new Map<number, NonNullable<ChatMessage['researchSources']>[number]>();
+    for (const s of message.researchSources ?? []) {
+      if (typeof s.ref === 'number') m.set(s.ref, s);
+    }
+    return m;
+  }, [message.researchSources]);
+
+  const rehypePlugins = useMemo(() => {
+    const base: any[] = [[rehypeHighlight, { detect: true }], rehypeKatex];
+    if (sourcesMap.size > 0) base.push([rehypeCitations, { sources: sourcesMap }]);
+    return base;
+  }, [sourcesMap]);
+
   if (isUser) {
     return (
       <div className="flex justify-end mb-4">
@@ -122,24 +140,6 @@ export function MessageBubble({ message, isLive = false }: Props) {
     );
   }
 
-  const cleanContent = useMemo(() => stripThinkTags(message.content), [message.content]);
-
-  // Build a ref→source lookup once per render. Memoized so the rehype plugin
-  // identity stays stable until the source list actually changes.
-  const sourcesMap = useMemo(() => {
-    const m = new Map<number, NonNullable<ChatMessage['researchSources']>[number]>();
-    for (const s of message.researchSources ?? []) {
-      if (typeof s.ref === 'number') m.set(s.ref, s);
-    }
-    return m;
-  }, [message.researchSources]);
-
-  const rehypePlugins = useMemo(() => {
-    const base: any[] = [[rehypeHighlight, { detect: true }], rehypeKatex];
-    if (sourcesMap.size > 0) base.push([rehypeCitations, { sources: sourcesMap }]);
-    return base;
-  }, [sourcesMap]);
-
   return (
     <div className="group mb-6">
       {/* Deep Research timeline (steps + status) */}

frontend/src/lib/useAgentEvents.test.ts

@@ -0,0 +1,66 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { buildWsUrl } from './useAgentEvents';
+
+const SETTINGS_KEY = 'openjarvis-settings';
+
+class MemoryStorage {
+  private store = new Map<string, string>();
+
+  getItem(key: string): string | null {
+    return this.store.get(key) ?? null;
+  }
+
+  setItem(key: string, value: string): void {
+    this.store.set(key, String(value));
+  }
+}
+
+beforeEach(() => {
+  (globalThis as unknown as { localStorage: MemoryStorage }).localStorage =
+    new MemoryStorage();
+});
+
+afterEach(() => {
+  (globalThis as unknown as { localStorage?: MemoryStorage }).localStorage =
+    undefined;
+});
+
+describe('buildWsUrl', () => {
+  it('authenticates agent events with the configured API key', () => {
+    localStorage.setItem(
+      SETTINGS_KEY,
+      JSON.stringify({
+        apiUrl: 'https://jarvis.example.com:8443',
+        apiKey: 'secret+/=',
+      }),
+    );
+
+    const url = new URL(buildWsUrl('agent/one'));
+
+    expect(url.origin).toBe('wss://jarvis.example.com:8443');
+    expect(url.pathname).toBe('/v1/agents/events');
+    expect(url.searchParams.get('agent_id')).toBe('agent/one');
+    expect(url.searchParams.get('token')).toBe('secret+/=');
+  });
+
+  it('normalizes a versioned API base without duplicating /v1', () => {
+    localStorage.setItem(
+      SETTINGS_KEY,
+      JSON.stringify({ apiUrl: 'http://192.0.2.10:8000/v1/' }),
+    );
+
+    expect(buildWsUrl()).toBe('ws://192.0.2.10:8000/v1/agents/events');
+  });
+
+  it('omits the token for a keyless server', () => {
+    localStorage.setItem(
+      SETTINGS_KEY,
+      JSON.stringify({ apiUrl: 'http://localhost:8000' }),
+    );
+
+    const url = new URL(buildWsUrl('agent-one'));
+
+    expect(url.searchParams.has('token')).toBe(false);
+  });
+});

frontend/src/lib/useAgentEvents.ts

@@ -1,5 +1,5 @@
 import { useEffect, useRef } from 'react';
-import { getBase } from './api';
+import { getApiKey, getBase } from './api';
 
 export interface AgentEvent {
   type: string;
@@ -7,19 +7,16 @@ export interface AgentEvent {
   data: Record<string, unknown>;
 }
 
-function buildWsUrl(agentId?: string): string {
+export function buildWsUrl(agentId?: string): string {
   const base = getBase();
-  let origin: string;
-  if (base) {
-    origin = base.replace(/^http/, 'ws');
-  } else {
-    const loc = window.location;
-    origin = `${loc.protocol === 'https:' ? 'wss:' : 'ws:'}//${loc.host}`;
-  }
-  const path = '/v1/agents/events';
-  return agentId
-    ? `${origin}${path}?agent_id=${encodeURIComponent(agentId)}`
-    : `${origin}${path}`;
+  const url = new URL('/v1/agents/events', base || window.location.origin);
+  url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+
+  if (agentId) url.searchParams.set('agent_id', agentId);
+  const apiKey = getApiKey();
+  if (apiKey) url.searchParams.set('token', apiKey);
+
+  return url.toString();
 }
 
 /**

mkdocs.yml

@@ -198,6 +198,7 @@ nav:
       - Benchmarks: user-guide/benchmarks.md
       - System Access: user-guide/system-access.md
       - Security: user-guide/security.md
+      - Data Boundary Scan: user-guide/data-boundary-scan.md
       - LLM-guided spec search: user-guide/llm-guided-spec-search.md
   - Leaderboard: leaderboard.md
   - Roadmap: development/roadmap.md

rust/crates/openjarvis-python/src/storage.rs

@@ -33,6 +33,33 @@ impl PySQLiteMemory {
             .map_err(|e| PyErr::new::<pyo3::exceptions::PyRuntimeError, _>(e.to_string()))
     }
 
+    fn replace_source(
+        &self,
+        source: &str,
+        documents: Vec<(String, Option<String>)>,
+    ) -> PyResult<Vec<String>> {
+        let parsed_documents = documents
+            .into_iter()
+            .map(|(content, metadata)| {
+                let metadata = metadata
+                    .map(|value| serde_json::from_str(&value))
+                    .transpose()
+                    .map_err(|e| {
+                        PyErr::new::<pyo3::exceptions::PyValueError, _>(e.to_string())
+                    })?;
+                Ok((content, metadata))
+            })
+            .collect::<PyResult<Vec<_>>>()?;
+        let document_refs = parsed_documents
+            .iter()
+            .map(|(content, metadata)| (content.as_str(), metadata.as_ref()))
+            .collect::<Vec<_>>();
+
+        self.inner
+            .replace_source(source, &document_refs)
+            .map_err(|e| PyErr::new::<pyo3::exceptions::PyRuntimeError, _>(e.to_string()))
+    }
+
     #[pyo3(signature = (query, top_k=5))]
     fn retrieve(&self, query: &str, top_k: usize) -> PyResult<String> {
         let results = self

rust/crates/openjarvis-tools/src/storage/sqlite.rs

@@ -94,6 +94,57 @@ impl SQLiteMemory {
     pub fn in_memory() -> Result<Self, OpenJarvisError> {
         Self::new(Path::new(":memory:"))
     }
+
+    /// Atomically replace every document for *source* with *documents*.
+    pub fn replace_source(
+        &self,
+        source: &str,
+        documents: &[(&str, Option<&Value>)],
+    ) -> Result<Vec<String>, OpenJarvisError> {
+        let mut conn = self.conn.lock();
+        let tx = conn.transaction().map_err(|e| {
+            OpenJarvisError::Io(std::io::Error::other(e.to_string()))
+        })?;
+
+        tx.execute(
+            "DELETE FROM documents_fts
+             WHERE rowid IN (SELECT rowid FROM documents WHERE source = ?1)",
+            rusqlite::params![source],
+        )
+        .map_err(|e| OpenJarvisError::Io(std::io::Error::other(e.to_string())))?;
+        tx.execute(
+            "DELETE FROM documents WHERE source = ?1",
+            rusqlite::params![source],
+        )
+        .map_err(|e| OpenJarvisError::Io(std::io::Error::other(e.to_string())))?;
+
+        let mut doc_ids = Vec::with_capacity(documents.len());
+        for (content, metadata) in documents {
+            let doc_id = Uuid::new_v4().to_string();
+            let meta_str = metadata
+                .map(|m| serde_json::to_string(m).unwrap_or_default())
+                .unwrap_or_else(|| "{}".to_string());
+
+            tx.execute(
+                "INSERT INTO documents (id, content, source, metadata)
+                 VALUES (?1, ?2, ?3, ?4)",
+                rusqlite::params![doc_id, content, source, meta_str],
+            )
+            .map_err(|e| OpenJarvisError::Io(std::io::Error::other(e.to_string())))?;
+
+            let rowid = tx.last_insert_rowid();
+            tx.execute(
+                "INSERT INTO documents_fts (rowid, content, source) VALUES (?1, ?2, ?3)",
+                rusqlite::params![rowid, content, source],
+            )
+            .map_err(|e| OpenJarvisError::Io(std::io::Error::other(e.to_string())))?;
+            doc_ids.push(doc_id);
+        }
+
+        tx.commit()
+            .map_err(|e| OpenJarvisError::Io(std::io::Error::other(e.to_string())))?;
+        Ok(doc_ids)
+    }
 }
 
 impl MemoryBackend for SQLiteMemory {
@@ -306,6 +357,40 @@ mod tests {
         assert_eq!(mem.count().unwrap(), 0);
     }
 
+    #[test]
+    fn test_sqlite_replace_source_is_idempotent() {
+        let mem = SQLiteMemory::in_memory().unwrap();
+
+        mem.replace_source("notes.txt", &[("old project notes", None)])
+            .unwrap();
+        assert_eq!(mem.count().unwrap(), 1);
+
+        mem.replace_source("notes.txt", &[("updated project notes", None)])
+            .unwrap();
+        assert_eq!(mem.count().unwrap(), 1);
+
+        assert!(mem.retrieve("old", 5).unwrap().is_empty());
+        let updated = mem.retrieve("updated", 5).unwrap();
+        assert_eq!(updated.len(), 1);
+        assert_eq!(updated[0].source, "notes.txt");
+    }
+
+    #[test]
+    fn test_sqlite_replace_source_preserves_other_sources() {
+        let mem = SQLiteMemory::in_memory().unwrap();
+        mem.store("keep this manual", "manual.txt", None).unwrap();
+        mem.replace_source("notes.txt", &[("old project notes", None)])
+            .unwrap();
+
+        mem.replace_source("notes.txt", &[("updated project notes", None)])
+            .unwrap();
+
+        assert_eq!(mem.count().unwrap(), 2);
+        let manual = mem.retrieve("manual", 5).unwrap();
+        assert_eq!(manual.len(), 1);
+        assert_eq!(manual[0].source, "manual.txt");
+    }
+
     #[test]
     fn test_sqlite_case_insensitive_search() {
         let mem = SQLiteMemory::in_memory().unwrap();

src/openjarvis/__init__.py

@@ -4,8 +4,10 @@ from __future__ import annotations
 
 from importlib.metadata import PackageNotFoundError
 from importlib.metadata import version as _pkg_version
+from typing import TYPE_CHECKING, Any
 
-from openjarvis.sdk import Jarvis, JarvisSystem, MemoryHandle, SystemBuilder
+if TYPE_CHECKING:
+    from openjarvis.sdk import Jarvis, JarvisSystem, MemoryHandle, SystemBuilder
 
 try:
     __version__ = _pkg_version("openjarvis")
@@ -13,3 +15,21 @@ except PackageNotFoundError:  # pragma: no cover — uninstalled source tree
     __version__ = "0.0.0+unknown"
 
 __all__ = ["Jarvis", "JarvisSystem", "MemoryHandle", "SystemBuilder", "__version__"]
+
+_SDK_EXPORTS = {"Jarvis", "JarvisSystem", "MemoryHandle", "SystemBuilder"}
+
+
+def __getattr__(name: str) -> Any:
+    """Load SDK exports lazily so lightweight CLI diagnostics can start safely."""
+    if name not in _SDK_EXPORTS:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+
+    from openjarvis import sdk
+
+    value = getattr(sdk, name)
+    globals()[name] = value
+    return value
+
+
+def __dir__() -> list[str]:
+    return sorted(set(globals()) | _SDK_EXPORTS)

src/openjarvis/agents/_stubs.py

@@ -155,6 +155,9 @@ class BaseAgent(ABC):
         conversation messages, and finally the user input.
         """
         messages: list[Message] = []
+        context_messages = (
+            list(context.conversation.messages) if context is not None else []
+        )
         # Check if the context already supplies a system message
         _context_has_system = (
             context
@@ -176,9 +179,28 @@ class BaseAgent(ABC):
             except Exception:
                 effective_system_prompt = None
         if effective_system_prompt:
+            context_system_text = "\n\n".join(
+                message.text
+                for message in context_messages
+                if message.role == Role.SYSTEM
+                and message.metadata.get("memory_context")
+                and message.text
+            )
+            if context_system_text:
+                effective_system_prompt = (
+                    f"{effective_system_prompt}\n\n{context_system_text}"
+                )
+                context_messages = [
+                    message
+                    for message in context_messages
+                    if not (
+                        message.role == Role.SYSTEM
+                        and message.metadata.get("memory_context")
+                    )
+                ]
             messages.append(Message(role=Role.SYSTEM, content=effective_system_prompt))
-        if context and context.conversation.messages:
-            messages.extend(context.conversation.messages)
+        if context_messages:
+            messages.extend(context_messages)
         messages.append(Message(role=Role.USER, content=input))
         return messages
 

src/openjarvis/agents/monitor_operative.py

@@ -127,6 +127,7 @@ class MonitorOperativeAgent(ToolUsingAgent):
         memory_backend: Optional[Any] = None,
         interactive: bool = False,
         confirm_callback=None,
+        prompt_builder: Optional[Any] = None,
         **kwargs: Any,
     ) -> None:
         super().__init__(
@@ -139,7 +140,7 @@ class MonitorOperativeAgent(ToolUsingAgent):
             max_tokens=max_tokens,
             interactive=interactive,
             confirm_callback=confirm_callback,
-            prompt_builder=kwargs.get("prompt_builder"),
+            prompt_builder=prompt_builder,
         )
         # Validate strategies
         if memory_extraction not in VALID_MEMORY_EXTRACTION:

src/openjarvis/agents/operative.py

@@ -58,6 +58,7 @@ class OperativeAgent(ToolUsingAgent):
         memory_backend: Optional[Any] = None,
         interactive: bool = False,
         confirm_callback=None,
+        prompt_builder: Optional[Any] = None,
         **kwargs: Any,
     ) -> None:
         super().__init__(
@@ -70,7 +71,7 @@ class OperativeAgent(ToolUsingAgent):
             max_tokens=max_tokens,
             interactive=interactive,
             confirm_callback=confirm_callback,
-            prompt_builder=kwargs.get("prompt_builder"),
+            prompt_builder=prompt_builder,
         )
         self._system_prompt = system_prompt or ""
         self._operator_id = operator_id

src/openjarvis/agents/orchestrator.py

@@ -13,6 +13,7 @@ Supports two modes:
 from __future__ import annotations
 
 import concurrent.futures
+import json
 import re
 from typing import Any, List, Optional
 
@@ -142,12 +143,21 @@ class OrchestratorAgent(ToolUsingAgent):
                 tool_call = ToolCall(
                     id=f"orch_{turns}",
                     name=parsed["tool"],
-                    arguments=parsed["input"] or "{}",
+                    arguments=self._normalize_structured_tool_input(
+                        parsed["tool"],
+                        parsed["input"],
+                    ),
                 )
                 tool_result = self._executor.execute(tool_call)
                 all_tool_results.append(tool_result)
 
-                observation = f"Observation: {tool_result.content}"
+                if tool_result.success:
+                    observation = f"Observation: {tool_result.content}"
+                else:
+                    observation = (
+                        f"Observation: Tool '{tool_result.tool_name}' failed: "
+                        f"{tool_result.content}"
+                    )
                 messages.append(Message(role=Role.USER, content=observation))
                 continue
 
@@ -162,6 +172,75 @@ class OrchestratorAgent(ToolUsingAgent):
         # Max turns exceeded
         return self._max_turns_result(all_tool_results, turns)
 
+    def _normalize_structured_tool_input(
+        self,
+        tool_name: str,
+        raw_input: str,
+    ) -> str:
+        """Map unambiguous structured text input to a string parameter."""
+        if not raw_input:
+            return "{}"
+
+        try:
+            parsed_input = json.loads(raw_input)
+        except json.JSONDecodeError:
+            invalid_json = True
+            string_value = raw_input
+        else:
+            invalid_json = False
+            if isinstance(parsed_input, dict):
+                return raw_input
+            # INPUT is a text protocol. A non-object JSON value such as 42,
+            # true, null, or [1, 2] may still be the intended text for a tool's
+            # string parameter. Quoted JSON strings are decoded to remove only
+            # their surrounding quotes; other values retain their source text.
+            string_value = parsed_input if isinstance(parsed_input, str) else raw_input
+
+        tool_spec = None
+        for candidate in reversed(self._tools):
+            candidate_spec = candidate.spec
+            if candidate_spec.name == tool_name:
+                tool_spec = candidate_spec
+                break
+        if tool_spec is None:
+            return raw_input
+
+        parameters = tool_spec.parameters
+        parameter_container_type = parameters.get("type")
+        if parameter_container_type not in (None, "object"):
+            return raw_input
+
+        properties = parameters.get("properties", {})
+        required = parameters.get("required", [])
+        if not isinstance(properties, dict) or not isinstance(required, list):
+            return raw_input
+
+        if len(required) == 1 and required[0] in properties:
+            parameter_name = required[0]
+        elif not required and len(properties) == 1:
+            parameter_name = next(iter(properties))
+        else:
+            return raw_input
+
+        parameter_schema = properties[parameter_name]
+        if not isinstance(parameter_schema, dict):
+            return raw_input
+        parameter_type = parameter_schema.get("type")
+        accepts_string = parameter_type == "string" or (
+            isinstance(parameter_type, list) and "string" in parameter_type
+        )
+        if not accepts_string:
+            return raw_input
+
+        allow_object_text = (
+            tool_spec.metadata.get("structured_allow_object_text") is True
+        )
+        starts_like_object = raw_input.lstrip("\ufeff \t\r\n").startswith("{")
+        if invalid_json and starts_like_object and not allow_object_text:
+            return raw_input
+
+        return json.dumps({parameter_name: string_value})
+
     @staticmethod
     def _parse_structured_response(text: str) -> dict:
         """Parse THOUGHT/TOOL/INPUT/FINAL_ANSWER from model output."""

src/openjarvis/cli/__init__.py

@@ -2,45 +2,36 @@
 
 from __future__ import annotations
 
+import sys
+
 import click
 
 import openjarvis
-from openjarvis.cli._bootstrap import bootstrap_cmd
-from openjarvis.cli.add_cmd import add
-from openjarvis.cli.agent_cmd import agent
-from openjarvis.cli.ask import ask
-from openjarvis.cli.bench_cmd import bench
-from openjarvis.cli.channel_cmd import channel
-from openjarvis.cli.channels_cmd import channels
-from openjarvis.cli.chat_cmd import chat
-from openjarvis.cli.compose_cmd import compose
-from openjarvis.cli.config_cmd import config
-from openjarvis.cli.connect_cmd import connect
-from openjarvis.cli.daemon_cmd import restart, start, status, stop
-from openjarvis.cli.digest_cmd import digest
-from openjarvis.cli.doctor_cmd import doctor
-from openjarvis.cli.eval_cmd import eval_group
-from openjarvis.cli.feedback_cmd import feedback_group
-from openjarvis.cli.gateway_cmd import gateway
-from openjarvis.cli.host_cmd import host
-from openjarvis.cli.init_cmd import init
-from openjarvis.cli.memory_cmd import memory
-from openjarvis.cli.mine_cmd import mine
-from openjarvis.cli.model import model
-from openjarvis.cli.operators_cmd import operators
-from openjarvis.cli.optimize_cmd import optimize_group
-from openjarvis.cli.pearl_cmd import pearl
-from openjarvis.cli.quickstart_cmd import quickstart
-from openjarvis.cli.registry_cmd import registry
 from openjarvis.cli.scan_cmd import scan
-from openjarvis.cli.scheduler_cmd import scheduler
-from openjarvis.cli.self_update_cmd import self_update
-from openjarvis.cli.serve import serve
-from openjarvis.cli.skill_cmd import skill
-from openjarvis.cli.telemetry_cmd import telemetry
-from openjarvis.cli.tool_cmd import tool
-from openjarvis.cli.vault_cmd import vault
-from openjarvis.cli.workflow_cmd import workflow
+
+
+def _invoked_command(argv: list[str]) -> str:
+    """Return the first positional CLI token after global flags."""
+    for arg in argv:
+        if arg.startswith("-"):
+            continue
+        return arg
+    return ""
+
+
+# A data-boundary scan must be able to diagnose an invalid OPENJARVIS_HOME.
+# Importing the rest of the CLI eagerly would import core.config and resolve that
+# path before the scan can turn the failure into a finding.
+_DATA_BOUNDARY_BOOTSTRAP = (
+    _invoked_command(sys.argv[1:]) == "scan" and "--data-boundaries" in sys.argv[1:]
+)
+
+
+def _should_skip_update_check(ctx: click.Context, argv: list[str]) -> bool:
+    """Return true for commands whose diagnostics should remain local-only."""
+    if "--research" in argv:
+        return True
+    return ctx.invoked_subcommand == "scan" and "--data-boundaries" in argv
 
 
 @click.group(
@@ -63,11 +54,13 @@ def cli(ctx: click.Context, verbose: bool, quiet: bool) -> None:
     # Check for updates on interactive commands. The banner is noise in
     # demo recordings of ``jarvis ask --research``, so skip it whenever
     # the research flag is in argv (cheap argv sniff — Click hasn't
-    # parsed the subcommand's args yet at this point).
+    # parsed the subcommand's args yet at this point). Also skip
+    # ``jarvis scan --data-boundaries`` because it is intended to be a
+    # local application-data diagnostic with no outbound calls.
     import sys
 
-    research_mode_active = "--research" in sys.argv
-    if not quiet and ctx.invoked_subcommand and not research_mode_active:
+    skip_update_check = _should_skip_update_check(ctx, sys.argv[1:])
+    if not quiet and ctx.invoked_subcommand and not skip_update_check:
         import threading
 
         from openjarvis.cli._version_check import check_for_updates
@@ -91,74 +84,111 @@ def cli(ctx: click.Context, verbose: bool, quiet: bool) -> None:
         check_and_route(ctx)
 
 
-cli.add_command(init, "init")
-cli.add_command(ask, "ask")
-cli.add_command(chat, "chat")
-cli.add_command(serve, "serve")
-cli.add_command(model, "model")
-cli.add_command(memory, "memory")
-cli.add_command(mine, "mine")
-cli.add_command(pearl, "pearl")
-cli.add_command(telemetry, "telemetry")
-cli.add_command(bench, "bench")
-cli.add_command(channel, "channel")
-cli.add_command(channels, "channels")
-cli.add_command(scheduler, "scheduler")
-cli.add_command(doctor, "doctor")
-cli.add_command(agent, "agents")
-cli.add_command(workflow, "workflow")
-cli.add_command(skill, "skill")
-cli.add_command(start, "start")
-cli.add_command(stop, "stop")
-cli.add_command(restart, "restart")
-cli.add_command(status, "status")
-cli.add_command(vault, "vault")
-cli.add_command(add, "add")
-cli.add_command(operators, "operators")
-cli.add_command(eval_group, "eval")
-cli.add_command(host, "host")
-cli.add_command(quickstart, "quickstart")
-cli.add_command(optimize_group, "optimize")
-cli.add_command(feedback_group, "feedback")
-cli.add_command(compose, "compose")
-cli.add_command(gateway, "gateway")
-cli.add_command(tool, "tool")
-cli.add_command(registry, "registry")
-cli.add_command(config, "config")
 cli.add_command(scan, "scan")
-cli.add_command(connect, "connect")
-cli.add_command(digest, "digest")
-# deep-research setup pulls the ingestion pipeline (embeddings/numpy). Guard it
-# so a broken or slow numpy on Windows — which can raise at IMPORT time, not
-# just ImportError (#404) — can never take down the whole CLI, including
-# `jarvis serve`. Invoking `jarvis deep-research-setup` without the deps still
-# errors clearly on demand.
-try:
-    from openjarvis.cli.deep_research_setup_cmd import deep_research_setup
+if not _DATA_BOUNDARY_BOOTSTRAP:
+    from openjarvis.cli._bootstrap import bootstrap_cmd
+    from openjarvis.cli.add_cmd import add
+    from openjarvis.cli.agent_cmd import agent
+    from openjarvis.cli.ask import ask
+    from openjarvis.cli.bench_cmd import bench
+    from openjarvis.cli.channel_cmd import channel
+    from openjarvis.cli.channels_cmd import channels
+    from openjarvis.cli.chat_cmd import chat
+    from openjarvis.cli.compose_cmd import compose
+    from openjarvis.cli.config_cmd import config
+    from openjarvis.cli.connect_cmd import connect
+    from openjarvis.cli.daemon_cmd import restart, start, status, stop
+    from openjarvis.cli.digest_cmd import digest
+    from openjarvis.cli.doctor_cmd import doctor
+    from openjarvis.cli.eval_cmd import eval_group
+    from openjarvis.cli.feedback_cmd import feedback_group
+    from openjarvis.cli.gateway_cmd import gateway
+    from openjarvis.cli.host_cmd import host
+    from openjarvis.cli.init_cmd import init
+    from openjarvis.cli.memory_cmd import memory
+    from openjarvis.cli.mine_cmd import mine
+    from openjarvis.cli.model import model
+    from openjarvis.cli.operators_cmd import operators
+    from openjarvis.cli.optimize_cmd import optimize_group
+    from openjarvis.cli.pearl_cmd import pearl
+    from openjarvis.cli.quickstart_cmd import quickstart
+    from openjarvis.cli.registry_cmd import registry
+    from openjarvis.cli.scheduler_cmd import scheduler
+    from openjarvis.cli.self_update_cmd import self_update
+    from openjarvis.cli.serve import serve
+    from openjarvis.cli.skill_cmd import skill
+    from openjarvis.cli.telemetry_cmd import telemetry
+    from openjarvis.cli.tool_cmd import tool
+    from openjarvis.cli.vault_cmd import vault
+    from openjarvis.cli.workflow_cmd import workflow
 
-    cli.add_command(deep_research_setup, "deep-research-setup")
-    cli.add_command(deep_research_setup, "research")
-except Exception as _dr_exc:
-    import logging as _logging
+    cli.add_command(init, "init")
+    cli.add_command(ask, "ask")
+    cli.add_command(chat, "chat")
+    cli.add_command(serve, "serve")
+    cli.add_command(model, "model")
+    cli.add_command(memory, "memory")
+    cli.add_command(mine, "mine")
+    cli.add_command(pearl, "pearl")
+    cli.add_command(telemetry, "telemetry")
+    cli.add_command(bench, "bench")
+    cli.add_command(channel, "channel")
+    cli.add_command(channels, "channels")
+    cli.add_command(scheduler, "scheduler")
+    cli.add_command(doctor, "doctor")
+    cli.add_command(agent, "agents")
+    cli.add_command(workflow, "workflow")
+    cli.add_command(skill, "skill")
+    cli.add_command(start, "start")
+    cli.add_command(stop, "stop")
+    cli.add_command(restart, "restart")
+    cli.add_command(status, "status")
+    cli.add_command(vault, "vault")
+    cli.add_command(add, "add")
+    cli.add_command(operators, "operators")
+    cli.add_command(eval_group, "eval")
+    cli.add_command(host, "host")
+    cli.add_command(quickstart, "quickstart")
+    cli.add_command(optimize_group, "optimize")
+    cli.add_command(feedback_group, "feedback")
+    cli.add_command(compose, "compose")
+    cli.add_command(gateway, "gateway")
+    cli.add_command(tool, "tool")
+    cli.add_command(registry, "registry")
+    cli.add_command(config, "config")
+    cli.add_command(connect, "connect")
+    cli.add_command(digest, "digest")
 
-    _logging.getLogger(__name__).debug("deep-research command unavailable: %s", _dr_exc)
-cli.add_command(self_update, "self-update")
-cli.add_command(bootstrap_cmd, "_bootstrap")
+    # Deep Research setup pulls the ingestion pipeline (embeddings/numpy). Guard
+    # it so an import-time dependency failure cannot take down the whole CLI.
+    try:
+        from openjarvis.cli.deep_research_setup_cmd import deep_research_setup
 
-# Gateway CLI commands (lazy import to avoid pulling starlette)
-try:
-    from openjarvis.cli.auth_cmd import auth
+        cli.add_command(deep_research_setup, "deep-research-setup")
+        cli.add_command(deep_research_setup, "research")
+    except Exception as _dr_exc:
+        import logging as _logging
 
-    cli.add_command(auth, "auth")
-except ImportError:
-    pass
+        _logging.getLogger(__name__).debug(
+            "deep-research command unavailable: %s", _dr_exc
+        )
+    cli.add_command(self_update, "self-update")
+    cli.add_command(bootstrap_cmd, "_bootstrap")
 
-try:
-    from openjarvis.cli.tunnel_cmd import tunnel
+    # Gateway CLI commands (lazy import to avoid pulling starlette)
+    try:
+        from openjarvis.cli.auth_cmd import auth
 
-    cli.add_command(tunnel, "tunnel")
-except ImportError:
-    pass
+        cli.add_command(auth, "auth")
+    except ImportError:
+        pass
+
+    try:
+        from openjarvis.cli.tunnel_cmd import tunnel
+
+        cli.add_command(tunnel, "tunnel")
+    except ImportError:
+        pass
 
 
 def main() -> None:

src/openjarvis/cli/ask.py

@@ -248,6 +248,17 @@ def _get_memory_backend(config):
         return None
 
 
+def _get_memory_facts(config):
+    """Load facts captured by the automatic memory service."""
+    try:
+        from openjarvis.memory import load_configured_facts
+
+        return load_configured_facts(config)
+    except Exception as exc:
+        logger.debug("Automatic memory facts unavailable (optional): %s", exc)
+        return []
+
+
 _MEMORY_TOOLS = frozenset(
     {"retrieval", "memory_store", "memory_search", "memory_index", "memory_retrieve"}
 )
@@ -387,9 +398,8 @@ def _run_agent(
 
     # Wire the SystemPromptBuilder so SOUL.md / MEMORY.md / USER.md persona
     # files actually reach the model. Only passed to agents whose __init__
-    # accepts a `prompt_builder` kwarg (BaseAgent does; agents that override
-    # __init__ without forwarding it, e.g. OrchestratorAgent, opt out
-    # automatically and keep their existing system-prompt machinery).
+    # explicitly accepts a `prompt_builder` kwarg. Agents with specialized
+    # prompt machinery opt in by naming and forwarding the parameter.
     import inspect as _inspect
 
     if "prompt_builder" in _inspect.signature(agent_cls.__init__).parameters:
@@ -416,7 +426,8 @@ def _run_agent(
             from openjarvis.tools.storage.context import ContextConfig, inject_context
 
             backend = _get_memory_backend(config)
-            if backend is not None:
+            facts = _get_memory_facts(config)
+            if backend is not None or facts:
                 ctx_cfg = ContextConfig(
                     top_k=config.memory.context_top_k,
                     min_score=config.memory.context_min_score,
@@ -427,6 +438,7 @@ def _run_agent(
                     [],
                     backend,
                     config=ctx_cfg,
+                    facts=facts,
                 )
                 for msg in context_messages:
                     ctx.conversation.add(msg)
@@ -963,7 +975,8 @@ def ask(
             )
 
             backend = _get_memory_backend(config)
-            if backend is not None:
+            facts = _get_memory_facts(config)
+            if backend is not None or facts:
                 ctx_cfg = ContextConfig(
                     top_k=config.memory.context_top_k,
                     min_score=config.memory.context_min_score,
@@ -974,6 +987,7 @@ def ask(
                     messages,
                     backend,
                     config=ctx_cfg,
+                    facts=facts,
                 )
         except Exception as exc:
             logger.debug("Failed to inject memory context: %s", exc)

src/openjarvis/cli/chat_cmd.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 import sys
 from typing import List, Optional
 
@@ -15,6 +16,8 @@ from openjarvis.core.events import EventBus
 from openjarvis.core.types import Message, Role
 from openjarvis.memory import publish_completed_exchange
 
+logger = logging.getLogger(__name__)
+
 
 def _read_input(prompt: str = "You> ") -> Optional[str]:
     """Read user input with graceful EOF handling."""
@@ -194,6 +197,15 @@ def chat(
         console.print(f"[yellow]Memory service unavailable: {exc}[/yellow]")
         memory_service = None
 
+    # The document backend and automatic fact store are separate persistence
+    # mechanisms. Context injection combines both at read time so facts from
+    # previous sessions are immediately available without a manual index step.
+    memory_backend = None
+    if config.agent.context_from_memory:
+        from openjarvis.cli.ask import _get_memory_backend
+
+        memory_backend = _get_memory_backend(config)
+
     # Conversation state
     if not system_prompt:
         from openjarvis.prompt.builder import SystemPromptBuilder
@@ -262,15 +274,57 @@ def chat(
         # Add user message
         history.append(Message(role=Role.USER, content=user_input))
 
-        # Generate response
+        generation_history = history
+        agent_context_message = None
+        if config.agent.context_from_memory:
+            try:
+                from openjarvis.memory import load_configured_facts
+                from openjarvis.tools.storage.context import (
+                    ContextConfig,
+                    inject_context,
+                )
+
+                if memory_service is not None and hasattr(memory_service, "list_facts"):
+                    facts = memory_service.list_facts()
+                else:
+                    facts = load_configured_facts(config)
+                ctx_cfg = ContextConfig(
+                    top_k=config.memory.context_top_k,
+                    min_score=config.memory.context_min_score,
+                    max_context_tokens=config.memory.context_max_tokens,
+                )
+                context_messages = inject_context(
+                    user_input,
+                    [] if agent is not None else history,
+                    memory_backend,
+                    config=ctx_cfg,
+                    facts=facts,
+                )
+                if agent is not None:
+                    if context_messages:
+                        agent_context_message = context_messages[0]
+                else:
+                    generation_history = context_messages
+            except Exception:
+                logger.debug("Failed to inject memory context", exc_info=True)
+
+        # Generate response even when optional memory context is unavailable.
         try:
             if agent is not None:
-                response = agent.run(user_input)
+                from openjarvis.agents._stubs import AgentContext
+
+                agent_context = AgentContext()
+                if agent_context_message is not None:
+                    agent_context.conversation.add(agent_context_message)
+                for msg in history[:-1]:
+                    if msg.role != Role.SYSTEM:
+                        agent_context.conversation.add(msg)
+                response = agent.run(user_input, context=agent_context)
                 content = (
                     response.content if hasattr(response, "content") else str(response)
                 )
             else:
-                result = engine.generate(history, model=model)
+                result = engine.generate(generation_history, model=model)
                 content = (
                     result.get("content", "")
                     if isinstance(result, dict)

src/openjarvis/cli/memory_cmd.py

@@ -89,15 +89,39 @@ def index(
 
     mem = _get_backend(backend)
     try:
-        for chunk in track(chunks, description="Storing chunks...", console=console):
-            mem.store(
-                chunk.content,
-                source=chunk.source,
-                metadata={
-                    "offset": chunk.offset,
-                    "index": chunk.index,
-                },
-            )
+        replace_source = getattr(mem, "replace_source", None)
+        if callable(replace_source):
+            documents_by_source = {}
+            for chunk in chunks:
+                documents_by_source.setdefault(chunk.source, []).append(
+                    (
+                        chunk.content,
+                        {
+                            "offset": chunk.offset,
+                            "index": chunk.index,
+                        },
+                    )
+                )
+            for source, documents in track(
+                documents_by_source.items(),
+                description="Replacing sources...",
+                console=console,
+            ):
+                replace_source(source, documents)
+        else:
+            for chunk in track(
+                chunks,
+                description="Storing chunks...",
+                console=console,
+            ):
+                mem.store(
+                    chunk.content,
+                    source=chunk.source,
+                    metadata={
+                        "offset": chunk.offset,
+                        "index": chunk.index,
+                    },
+                )
     finally:
         if hasattr(mem, "close"):
             mem.close()

src/openjarvis/cli/scan_cmd.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 import sys
 from dataclasses import dataclass
@@ -11,7 +12,11 @@ from typing import Callable, List
 
 import click
 
-from openjarvis.core.paths import get_config_dir
+from openjarvis.core.paths import get_config_dir, get_config_path
+from openjarvis.security.data_boundary_audit import (
+    DataBoundaryReport,
+    build_data_boundary_report,
+)
 
 # Engine ports that should only be listening on localhost.
 _ENGINE_PORTS = {11434, 8080, 8000, 30000, 1234, 52415, 18181}
@@ -441,10 +446,45 @@ _RICH_ICONS = {
     "ok": "[green]\u2713[/green]",
     "warn": "[yellow]![/yellow]",
     "fail": "[red]\u2717[/red]",
+    "info": "[blue]i[/blue]",
     "skip": "[dim]-[/dim]",
 }
 
 
+def _resolve_data_boundary_config_path() -> Path:
+    env_config = os.environ.get("OPENJARVIS_CONFIG")
+    if env_config:
+        return Path(env_config).expanduser().resolve()
+    return get_config_path()
+
+
+def _load_data_boundary_config():
+    """Load config without treating missing config as active."""
+    root = None
+    root_error = ""
+    try:
+        root = get_config_dir()
+        config_path = _resolve_data_boundary_config_path()
+    except Exception as exc:
+        config_path = None
+        root_error = f"{type(exc).__name__}: {exc}"
+
+    if root_error:
+        return None, root, False, "", root_error
+
+    try:
+        from openjarvis.core.config import JarvisConfig, load_config
+    except Exception as exc:
+        return None, root, False, f"{type(exc).__name__}: {exc}", ""
+
+    if config_path is None or not config_path.exists():
+        return JarvisConfig(), root, False, "", root_error
+    try:
+        return load_config(config_path), root, True, "", root_error
+    except Exception as exc:
+        return JarvisConfig(), root, False, f"{type(exc).__name__}: {exc}", root_error
+
+
 def _render_results(results: List[ScanResult]) -> None:
     """Render scan results as a Rich table."""
     from rich.console import Console
@@ -494,17 +534,123 @@ def _render_results(results: List[ScanResult]) -> None:
         console.print()
 
 
+def _render_data_boundary_report(
+    report: DataBoundaryReport,
+    *,
+    show_paths: bool,
+) -> None:
+    """Render application data-boundary findings as a Rich table."""
+    from rich.console import Console
+    from rich.table import Table
+
+    console = Console()
+    console.print()
+    console.print("[bold]OpenJarvis Data-Boundary Scan[/bold]")
+    console.print(f"Verdict: [bold]{report.verdict}[/bold]")
+    console.print()
+
+    table = Table(show_header=True, header_style="bold", show_lines=True)
+    table.add_column("", width=3, justify="center")
+    table.add_column("Finding")
+    table.add_column("Recommendation")
+
+    for finding in report.findings:
+        icon = _RICH_ICONS.get(finding.status, "?")
+        style = {"fail": "red", "warn": "yellow", "info": "blue"}.get(
+            finding.status,
+            "white",
+        )
+        details = [f"[{style}]{finding.title}[/{style}]"]
+        details.append(f"[dim]{finding.potential_data_path}[/dim]")
+        if finding.location:
+            location = finding.absolute_location if show_paths else finding.location
+            details.append(f"[dim]Location: {location}[/dim]")
+        table.add_row(icon, "\n".join(details), finding.recommendation)
+
+    console.print(table)
+    summary = report.summary()
+    console.print()
+    console.print(
+        f"  [red]{summary['fail']} fail[/red], "
+        f"[yellow]{summary['warn']} warning(s)[/yellow], "
+        f"[blue]{summary['info']} info[/blue]"
+    )
+    if not show_paths:
+        console.print(
+            "  [dim]Absolute paths and connector basenames are redacted by default. "
+            "Use --show-paths for local debugging.[/dim]"
+        )
+    console.print()
+
+
+def _emit_data_boundary_json(
+    report: DataBoundaryReport,
+    *,
+    show_paths: bool,
+) -> None:
+    click.echo(json.dumps(report.to_dict(show_paths=show_paths), indent=2))
+
+
 @click.command()
 @click.option("--quick", is_flag=True, default=False, help="Run only critical checks.")
 @click.option("--json", "as_json", is_flag=True, default=False, help="Output as JSON.")
-def scan(quick: bool, as_json: bool) -> None:
+@click.option(
+    "--data-boundaries",
+    is_flag=True,
+    default=False,
+    help="Run application data-boundary checks instead of host checks.",
+)
+@click.option(
+    "--strict",
+    is_flag=True,
+    default=False,
+    help="Exit non-zero if data-boundary fail or warn findings are present.",
+)
+@click.option(
+    "--show-paths",
+    is_flag=True,
+    default=False,
+    help="Show absolute paths in data-boundary output.",
+)
+def scan(
+    quick: bool,
+    as_json: bool,
+    data_boundaries: bool,
+    strict: bool,
+    show_paths: bool,
+) -> None:
     """Audit your environment for privacy and security risks."""
+    if data_boundaries:
+        if quick:
+            raise click.UsageError("--quick cannot be combined with --data-boundaries.")
+        config, root, config_loaded, config_error, root_error = (
+            _load_data_boundary_config()
+        )
+        report = build_data_boundary_report(
+            config,
+            root,
+            config_loaded=config_loaded,
+            config_error=config_error,
+            root_error=root_error,
+        )
+        if as_json:
+            _emit_data_boundary_json(report, show_paths=show_paths)
+        else:
+            _render_data_boundary_report(report, show_paths=show_paths)
+        summary = report.summary()
+        if strict and (summary["fail"] or summary["warn"]):
+            raise click.exceptions.Exit(1)
+        return
+
+    if strict or show_paths:
+        raise click.UsageError(
+            "--strict and --show-paths are only supported with --data-boundaries."
+        )
+
     scanner = PrivacyScanner()
     results: List[ScanResult] = scanner.run_quick() if quick else scanner.run_all()
 
     if as_json:
-        import json as json_mod
-
         output = [
             {
                 "name": r.name,
@@ -514,7 +660,7 @@ def scan(quick: bool, as_json: bool) -> None:
             }
             for r in results
         ]
-        click.echo(json_mod.dumps(output, indent=2))
+        click.echo(json.dumps(output, indent=2))
         return
 
     if not results:

src/openjarvis/cli/serve.py

@@ -25,6 +25,30 @@ from openjarvis.intelligence import (
 
 logger = logging.getLogger(__name__)
 
+_DEFAULT_TOOLS = frozenset({"think", "calculator", "web_search"})
+
+
+def _resolve_allowed_tools(config: object) -> tuple[set[str], bool]:
+    """Return configured tool names and whether the selection was explicit.
+
+    ``tools.enabled`` is the canonical setting used by ``SystemBuilder`` and
+    the interactive CLI.  ``agent.tools`` remains as a backward-compatible
+    fallback, followed by the server's default tool set when neither is set.
+    """
+    configured = config.tools.enabled or config.agent.tools
+    if not configured:
+        return set(_DEFAULT_TOOLS), False
+
+    if isinstance(configured, list):
+        allowed = {
+            tool.strip()
+            for tool in configured
+            if isinstance(tool, str) and tool.strip()
+        }
+    else:
+        allowed = {tool.strip() for tool in configured.split(",") if tool.strip()}
+    return allowed, True
+
 
 def _unique_model_ids(model_ids: list[str]) -> list[str]:
     """Return model ids in first-seen order without duplicates."""
@@ -96,7 +120,7 @@ def _resolve_server_model(
     "--agent",
     "agent_name",
     default=None,
-    help="Agent for non-streaming requests (simple, orchestrator, react, openhands).",
+    help="Agent for chat requests (simple, orchestrator, react, openhands).",
 )
 @click.pass_context
 def serve(
@@ -305,21 +329,7 @@ def serve(
                     from openjarvis.core.registry import ToolRegistry
                     from openjarvis.tools._stubs import BaseTool
 
-                    _DEFAULT_TOOLS = {"think", "calculator", "web_search"}
-                    configured = config.agent.tools
-                    if configured:
-                        if isinstance(configured, list):
-                            allowed = {
-                                t.strip()
-                                for t in configured
-                                if isinstance(t, str) and t.strip()
-                            }
-                        else:
-                            allowed = {
-                                t.strip() for t in configured.split(",") if t.strip()
-                            }
-                    else:
-                        allowed = _DEFAULT_TOOLS
+                    allowed, tools_configured = _resolve_allowed_tools(config)
 
                     tools = []
                     for name in ToolRegistry.keys():
@@ -336,7 +346,7 @@ def serve(
                     # MCP server tools from config.tools.mcp.servers
                     # (#461 — these were silently dropped).
                     mcp_tools = managed_mcp_tools
-                    if configured:
+                    if tools_configured:
                         mcp_tools = [
                             tool
                             for tool in managed_mcp_tools
@@ -357,6 +367,27 @@ def serve(
                 if getattr(agent_cls, "accepts_tools", False):
                     agent_kwargs["max_turns"] = config.agent.max_turns
 
+                # Wire the SystemPromptBuilder so SOUL.md / MEMORY.md / USER.md
+                # reach the model on the SERVE path too. ``ask.py`` has done
+                # this since the persona system landed; ``serve.py`` never did,
+                # so an agent served over HTTP silently answered as a generic
+                # assistant while the same agent via the CLI kept its persona.
+                # Guarded so agents with specialized prompt machinery must opt
+                # in by explicitly naming and forwarding the kwarg.
+                import inspect as _inspect
+
+                if (
+                    "prompt_builder"
+                    in _inspect.signature(agent_cls.__init__).parameters
+                ):
+                    from openjarvis.prompt.builder import SystemPromptBuilder
+
+                    agent_kwargs["prompt_builder"] = SystemPromptBuilder(
+                        agent_template=config.agent.default_system_prompt or "",
+                        memory_files_config=config.memory_files,
+                        system_prompt_config=config.system_prompt,
+                    )
+
                 agent = agent_cls(engine, model_name, **agent_kwargs)
                 # Pin MCP transports to the agent's lifetime so HTTP
                 # connections don't close mid-request (#461).
@@ -406,23 +437,7 @@ def serve(
                         from openjarvis.core.registry import ToolRegistry
                         from openjarvis.tools._stubs import BaseTool
 
-                        _DEFAULT_TOOLS = {"think", "calculator", "web_search"}
-                        configured = config.agent.tools
-                        if configured:
-                            if isinstance(configured, list):
-                                _allowed = {
-                                    t.strip()
-                                    for t in configured
-                                    if isinstance(t, str) and t.strip()
-                                }
-                            else:
-                                _allowed = {
-                                    t.strip()
-                                    for t in configured.split(",")
-                                    if t.strip()
-                                }
-                        else:
-                            _allowed = _DEFAULT_TOOLS
+                        _allowed, _tools_configured = _resolve_allowed_tools(config)
 
                         for _tname in ToolRegistry.keys():
                             if _tname not in _allowed:
@@ -436,7 +451,7 @@ def serve(
                         # Reuse the process-owned MCP pool so channels do not
                         # open a second transport to every configured server.
                         _ch_mcp_tools = managed_mcp_tools
-                        if configured:
+                        if _tools_configured:
                             _ch_mcp_tools = [
                                 tool
                                 for tool in managed_mcp_tools

src/openjarvis/evals/datasets/taubench.py

@@ -8,13 +8,12 @@ Reference: https://github.com/sierra-research/tau2-bench
 
 from __future__ import annotations
 
+import json
 import logging
 import os
-import subprocess
-import sys
+from importlib import metadata
 from typing import Iterable, List, Optional
 
-from openjarvis.core.paths import get_cache_dir
 from openjarvis.evals.core.dataset import DatasetProvider
 from openjarvis.evals.core.splits import apply_split
 from openjarvis.evals.core.types import EvalRecord
@@ -22,48 +21,50 @@ from openjarvis.evals.core.types import EvalRecord
 LOGGER = logging.getLogger(__name__)
 
 TAU2_REPO = "https://github.com/sierra-research/tau2-bench.git"
-CACHE_DIR = get_cache_dir() / "tau2-bench"
+# v1.0.1. Keep the full commit SHA here (rather than a movable tag) so every
+# TauBench setup uses the same third-party code.
+TAU2_REVISION = "fc0055dc4e0a316c3f83133267fbd6faaa770992"
+TAU2_INSTALL_SPEC = f"tau2 @ git+{TAU2_REPO}@{TAU2_REVISION}"
 
 DOMAINS = ("airline", "retail", "telecom")
 
 
 def _ensure_tau2() -> None:
-    """Ensure tau2 package is importable; install from cache if needed."""
+    """Ensure the explicitly installed, pinned tau2 package is importable."""
+    try:
+        distribution = metadata.distribution("tau2")
+    except metadata.PackageNotFoundError as exc:
+        raise ImportError(
+            "TauBench requires tau2, which OpenJarvis does not install at "
+            "runtime. Install the pinned dependency explicitly (Python >=3.12): "
+            f'uv pip install "{TAU2_INSTALL_SPEC}"'
+        ) from exc
+
+    try:
+        direct_url_text = distribution.read_text("direct_url.json")
+        direct_url = json.loads(direct_url_text or "")
+        vcs_info = direct_url.get("vcs_info", {})
+        installed_repo = direct_url.get("url")
+        installed_revision = vcs_info.get("commit_id")
+    except (json.JSONDecodeError, AttributeError):
+        installed_repo = None
+        installed_revision = None
+
+    if installed_repo != TAU2_REPO or installed_revision != TAU2_REVISION:
+        raise ImportError(
+            "The installed tau2 package does not match OpenJarvis's pinned "
+            "source revision. Reinstall it explicitly (Python >=3.12): "
+            f'uv pip install --force-reinstall "{TAU2_INSTALL_SPEC}"'
+        )
+
     try:
         import tau2  # noqa: F401
-    except ImportError:
-        # Clone and install from source
-        if not CACHE_DIR.exists():
-            LOGGER.info("Cloning tau2-bench from %s ...", TAU2_REPO)
-            CACHE_DIR.parent.mkdir(parents=True, exist_ok=True)
-            subprocess.run(
-                ["git", "clone", "--depth", "1", TAU2_REPO, str(CACHE_DIR)],
-                check=True,
-                capture_output=True,
-            )
-        LOGGER.info("Installing tau2-bench ...")
-        # Try `python -m pip` first; fall back to `uv pip` for uv-managed venvs
-        # which don't ship pip by default.
-        try:
-            subprocess.run(
-                [sys.executable, "-m", "pip", "install", "-e", str(CACHE_DIR)],
-                check=True,
-                capture_output=True,
-            )
-        except (subprocess.CalledProcessError, FileNotFoundError):
-            subprocess.run(
-                [
-                    "uv",
-                    "pip",
-                    "install",
-                    "--python",
-                    sys.executable,
-                    "-e",
-                    str(CACHE_DIR),
-                ],
-                check=True,
-                capture_output=True,
-            )
+    except ImportError as exc:
+        raise ImportError(
+            "The pinned tau2 package is installed but cannot be imported. "
+            "Reinstall it explicitly (Python >=3.12): "
+            f'uv pip install --force-reinstall "{TAU2_INSTALL_SPEC}"'
+        ) from exc
 
 
 class TauBenchDataset(DatasetProvider):

src/openjarvis/memory/__init__.py

@@ -19,6 +19,7 @@ from openjarvis.memory.store import (
     FactStore,
     LocalFactStore,
     create_fact_store,
+    load_configured_facts,
 )
 
 __all__ = [
@@ -29,5 +30,6 @@ __all__ = [
     "MemoryService",
     "build_memory_service",
     "create_fact_store",
+    "load_configured_facts",
     "publish_completed_exchange",
 ]

src/openjarvis/memory/store.py

@@ -16,7 +16,7 @@ import time
 from abc import ABC, abstractmethod
 from dataclasses import asdict, dataclass
 from pathlib import Path
-from typing import Iterable, List
+from typing import Any, Iterable, List
 
 from openjarvis.core.paths import get_config_dir
 from openjarvis.core.registry import FactStoreRegistry
@@ -205,4 +205,30 @@ def create_fact_store(
     return FactStoreRegistry.create(key, path, max_facts=max_facts)
 
 
-__all__ = ["Fact", "FactStore", "LocalFactStore", "create_fact_store"]
+def load_configured_facts(config: Any) -> List[Fact]:
+    """Load automatic-memory facts from *config* when the service is enabled.
+
+    Context injection is also used by short-lived commands such as
+    ``jarvis ask``, where no :class:`MemoryService` instance exists.  This
+    helper gives those callers the same configured fact-store view without
+    coupling them to the service lifecycle.
+    """
+    memory = getattr(config, "memory", None)
+    if memory is None or not getattr(memory, "enabled", False):
+        return []
+
+    store = create_fact_store(
+        getattr(memory, "backend", "local"),
+        path=getattr(memory, "facts_path", None),
+        max_facts=getattr(memory, "max_facts", 1000),
+    )
+    return store.list()
+
+
+__all__ = [
+    "Fact",
+    "FactStore",
+    "LocalFactStore",
+    "create_fact_store",
+    "load_configured_facts",
+]

src/openjarvis/sdk.py

@@ -516,20 +516,35 @@ class Jarvis:
             existing = agent_kwargs.get("tools", [])
             agent_kwargs["tools"] = digest_tools + list(existing)
 
+        # Wire the SystemPromptBuilder so SOUL.md / MEMORY.md / USER.md reach
+        # the model — mirrors ``cli/ask.py`` and ``cli/serve.py``. Guarded so
+        # agents whose ``__init__`` doesn't accept the kwarg opt out.
+        import inspect as _inspect
+
+        if "prompt_builder" in _inspect.signature(agent_cls.__init__).parameters:
+            from openjarvis.prompt.builder import SystemPromptBuilder
+
+            agent_kwargs["prompt_builder"] = SystemPromptBuilder(
+                agent_template=self._config.agent.default_system_prompt or "",
+                memory_files_config=self._config.memory_files,
+                system_prompt_config=self._config.system_prompt,
+            )
+
         agent_obj = agent_cls(self._engine, model_name, **agent_kwargs)
         ctx = AgentContext()
 
         # Context injection
         if context and self._config.agent.context_from_memory:
             try:
-                from openjarvis.cli.ask import _get_memory_backend
+                from openjarvis.cli.ask import _get_memory_backend, _get_memory_facts
                 from openjarvis.tools.storage.context import (
                     ContextConfig,
                     inject_context,
                 )
 
                 backend = _get_memory_backend(self._config)
-                if backend is not None:
+                facts = _get_memory_facts(self._config)
+                if backend is not None or facts:
                     ctx_cfg = ContextConfig(
                         top_k=self._config.memory.context_top_k,
                         min_score=self._config.memory.context_min_score,
@@ -540,6 +555,7 @@ class Jarvis:
                         [],
                         backend,
                         config=ctx_cfg,
+                        facts=facts,
                     )
                     for msg in context_messages:
                         ctx.conversation.add(msg)
@@ -570,17 +586,24 @@ class Jarvis:
     ) -> List[Message]:
         """Inject memory context into messages."""
         try:
-            from openjarvis.cli.ask import _get_memory_backend
+            from openjarvis.cli.ask import _get_memory_backend, _get_memory_facts
             from openjarvis.tools.storage.context import ContextConfig, inject_context
 
             backend = _get_memory_backend(self._config)
-            if backend is not None:
+            facts = _get_memory_facts(self._config)
+            if backend is not None or facts:
                 ctx_cfg = ContextConfig(
                     top_k=self._config.memory.context_top_k,
                     min_score=self._config.memory.context_min_score,
                     max_context_tokens=self._config.memory.context_max_tokens,
                 )
-                return inject_context(query, messages, backend, config=ctx_cfg)
+                return inject_context(
+                    query,
+                    messages,
+                    backend,
+                    config=ctx_cfg,
+                    facts=facts,
+                )
         except Exception as exc:
             logger.warning("Failed to inject memory context: %s", exc)
         return messages

src/openjarvis/security/__init__.py

@@ -4,27 +4,10 @@ from __future__ import annotations
 
 import logging
 from dataclasses import dataclass
+from importlib import import_module
 from typing import Any, Optional
 
 from openjarvis.core.events import EventBus
-from openjarvis.security._stubs import BaseScanner
-from openjarvis.security.audit import AuditLogger
-from openjarvis.security.file_policy import (
-    DEFAULT_SENSITIVE_PATTERNS,
-    filter_sensitive_paths,
-    is_sensitive_file,
-)
-from openjarvis.security.guardrails import GuardrailsEngine, SecurityBlockError
-from openjarvis.security.scanner import PIIScanner, SecretScanner
-from openjarvis.security.ssrf import check_ssrf, is_private_ip
-from openjarvis.security.types import (
-    RedactionMode,
-    ScanFinding,
-    ScanResult,
-    SecurityEvent,
-    SecurityEventType,
-    ThreatLevel,
-)
 
 logger = logging.getLogger(__name__)
 
@@ -50,6 +33,12 @@ def setup_security(
     if not config.security.enabled:
         return SecurityContext(engine=engine)
 
+    from openjarvis.security._stubs import BaseScanner
+    from openjarvis.security.audit import AuditLogger
+    from openjarvis.security.guardrails import GuardrailsEngine
+    from openjarvis.security.scanner import PIIScanner, SecretScanner
+    from openjarvis.security.types import RedactionMode
+
     # Scanners + engine wrapping
     try:
         scanners: list[BaseScanner] = []
@@ -121,3 +110,46 @@ __all__ = [
     "is_sensitive_file",
     "setup_security",
 ]
+
+_LAZY_EXPORTS = {
+    "AuditLogger": ("openjarvis.security.audit", "AuditLogger"),
+    "BaseScanner": ("openjarvis.security._stubs", "BaseScanner"),
+    "DEFAULT_SENSITIVE_PATTERNS": (
+        "openjarvis.security.file_policy",
+        "DEFAULT_SENSITIVE_PATTERNS",
+    ),
+    "GuardrailsEngine": ("openjarvis.security.guardrails", "GuardrailsEngine"),
+    "PIIScanner": ("openjarvis.security.scanner", "PIIScanner"),
+    "RedactionMode": ("openjarvis.security.types", "RedactionMode"),
+    "ScanFinding": ("openjarvis.security.types", "ScanFinding"),
+    "ScanResult": ("openjarvis.security.types", "ScanResult"),
+    "SecretScanner": ("openjarvis.security.scanner", "SecretScanner"),
+    "SecurityBlockError": (
+        "openjarvis.security.guardrails",
+        "SecurityBlockError",
+    ),
+    "SecurityEvent": ("openjarvis.security.types", "SecurityEvent"),
+    "SecurityEventType": ("openjarvis.security.types", "SecurityEventType"),
+    "ThreatLevel": ("openjarvis.security.types", "ThreatLevel"),
+    "check_ssrf": ("openjarvis.security.ssrf", "check_ssrf"),
+    "filter_sensitive_paths": (
+        "openjarvis.security.file_policy",
+        "filter_sensitive_paths",
+    ),
+    "is_private_ip": ("openjarvis.security.ssrf", "is_private_ip"),
+    "is_sensitive_file": ("openjarvis.security.file_policy", "is_sensitive_file"),
+}
+
+
+def __getattr__(name: str) -> Any:
+    target = _LAZY_EXPORTS.get(name)
+    if target is None:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+    module_name, attribute = target
+    value = getattr(import_module(module_name), attribute)
+    globals()[name] = value
+    return value
+
+
+def __dir__() -> list[str]:
+    return sorted(set(globals()) | set(_LAZY_EXPORTS))

src/openjarvis/server/agent_manager_routes.py

@@ -34,6 +34,15 @@ _MEMORY_BACKEND_LOCK_SETUP = threading.Lock()
 _MCP_LOCK_SETUP = threading.Lock()
 
 
+def _get_runtime_event_bus(runtime: Any = None) -> Any:
+    """Return the server-owned event bus, falling back outside app runtimes."""
+
+    from openjarvis.core.events import get_event_bus
+
+    bus = getattr(runtime, "bus", None)
+    return bus if bus is not None else get_event_bus()
+
+
 def _start_managed_worker(app_state: Any, target: Any, *, name: str) -> Any:
     """Start and track a managed-agent worker for orderly app shutdown."""
 
@@ -301,14 +310,13 @@ def _make_lightweight_system(
         # Wrap with InstrumentedEngine so agent ticks are recorded
         # in telemetry (FLOPs, energy, cost savings).
         try:
-            from openjarvis.core.events import get_event_bus
             from openjarvis.telemetry.instrumented_engine import (
                 InstrumentedEngine,
             )
 
             plain_engine = InstrumentedEngine(
                 plain_engine,
-                get_event_bus(),
+                _get_runtime_event_bus(runtime),
             )
         except Exception:
             pass  # telemetry is optional
@@ -1644,26 +1652,27 @@ def create_agent_manager_router(
 
         # Re-use the server's engine + model so we don't pick a
         # random model from Ollama's list.
-        server_engine = getattr(request.app.state, "engine", None)
-        server_model = getattr(request.app.state, "model", "")
-        server_config = getattr(request.app.state, "config", None)
+        app_state = request.app.state
+        server_engine = getattr(app_state, "engine", None)
+        server_model = getattr(app_state, "model", "")
+        server_config = getattr(app_state, "config", None)
+        server_bus = _get_runtime_event_bus(app_state)
 
         def _run_tick():
             try:
                 from openjarvis.agents.executor import AgentExecutor
-                from openjarvis.core.events import get_event_bus
 
-                _ts = getattr(request.app.state, "trace_store", None)
+                _ts = getattr(app_state, "trace_store", None)
                 executor = AgentExecutor(
                     manager=manager,
-                    event_bus=get_event_bus(),
+                    event_bus=server_bus,
                     trace_store=_ts,
                 )
                 system = _make_lightweight_system(
                     server_engine,
                     server_model,
                     server_config,
-                    request.app.state,
+                    app_state,
                 )
                 executor.set_system(system)
                 # The route handler above already called start_tick() to
@@ -1690,7 +1699,7 @@ def create_agent_manager_router(
 
         try:
             _start_managed_worker(
-                request.app.state,
+                app_state,
                 _run_tick,
                 name=f"managed-agent-run-{agent_id}",
             )
@@ -1997,11 +2006,12 @@ def create_agent_manager_router(
             import time as _time
 
             from openjarvis.agents.executor import AgentExecutor
-            from openjarvis.core.events import get_event_bus
 
-            _srv_engine = getattr(request.app.state, "engine", None)
-            _srv_model = getattr(request.app.state, "model", "")
-            _srv_config = getattr(request.app.state, "config", None)
+            _app_state = request.app.state
+            _srv_engine = getattr(_app_state, "engine", None)
+            _srv_model = getattr(_app_state, "model", "")
+            _srv_config = getattr(_app_state, "config", None)
+            _srv_bus = _get_runtime_event_bus(_app_state)
 
             def _immediate_tick():
                 _start = _time.time()
@@ -2011,17 +2021,17 @@ def create_agent_manager_router(
                     _srv_model,
                 )
                 try:
-                    _ts2 = getattr(request.app.state, "trace_store", None)
+                    _ts2 = getattr(_app_state, "trace_store", None)
                     executor = AgentExecutor(
                         manager=manager,
-                        event_bus=get_event_bus(),
+                        event_bus=_srv_bus,
                         trace_store=_ts2,
                     )
                     system = _make_lightweight_system(
                         _srv_engine,
                         _srv_model,
                         _srv_config,
-                        request.app.state,
+                        _app_state,
                     )
                     executor.set_system(system)
                     logger.info(
@@ -2055,7 +2065,7 @@ def create_agent_manager_router(
 
             try:
                 _start_managed_worker(
-                    request.app.state,
+                    _app_state,
                     _immediate_tick,
                     name=f"managed-agent-immediate-{agent_id}",
                 )
@@ -2106,12 +2116,12 @@ def create_agent_manager_router(
         return {"learning_log": manager.list_learning_log(agent_id)}
 
     @agents_router.post("/{agent_id}/learning/run")
-    def trigger_learning(agent_id: str):
+    def trigger_learning(agent_id: str, request: Request):
         if not manager.get_agent(agent_id):
             raise HTTPException(status_code=404, detail="Agent not found")
-        from openjarvis.core.events import EventType, get_event_bus
+        from openjarvis.core.events import EventType
 
-        bus = get_event_bus()
+        bus = _get_runtime_event_bus(request.app.state)
         bus.publish(EventType.AGENT_LEARNING_STARTED, {"agent_id": agent_id})
         return {"status": "triggered"}
 

src/openjarvis/server/api_routes.py

@@ -1087,12 +1087,16 @@ def include_all_routes(app) -> None:
     except ImportError:
         pass
 
-    # WebSocket bridge for real-time agent events
+    # WebSocket bridge for real-time agent events. Must subscribe on the
+    # same EventBus instance channels/agents actually publish to
+    # (app.state.bus, set in server/app.py) — the get_event_bus() global
+    # singleton is a *different* bus that nothing in `jarvis serve` ever
+    # publishes to, so events silently never reached this endpoint.
     try:
         from openjarvis.core.events import get_event_bus
         from openjarvis.server.ws_bridge import create_ws_router
 
-        ws_router = create_ws_router(get_event_bus())
+        ws_router = create_ws_router(getattr(app.state, "bus", None) or get_event_bus())
         app.include_router(ws_router)
     except Exception:
         logger.debug("WebSocket bridge not available", exc_info=True)

src/openjarvis/server/cloud_router.py

@@ -84,6 +84,17 @@ def is_cloud_model(model: str) -> bool:
     return get_provider(model) is not None
 
 
+def _openrouter_model_id(model: str) -> str:
+    """Return the provider-facing ID for an OpenRouter model."""
+    prefix = "openrouter/"
+    candidate = model.removeprefix(prefix)
+    # OpenRouter owns IDs such as "openrouter/auto" itself. Only remove the
+    # LiteLLM routing prefix when the remainder is still a provider/model ID.
+    if model.startswith(prefix) and "/" in candidate:
+        return candidate
+    return model
+
+
 # ---------------------------------------------------------------------------
 # Message conversion
 # ---------------------------------------------------------------------------
@@ -371,7 +382,7 @@ async def stream_cloud(
                 "OPENROUTER_API_KEY not set — add it in the Cloud Models tab"
             )
         async for token in _stream_openai(
-            model,
+            _openrouter_model_id(model),
             messages,
             temperature,
             max_tokens,

src/openjarvis/server/routes.py

@@ -11,7 +11,7 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import StreamingResponse
 
 from openjarvis.core.paths import get_config_dir
-from openjarvis.core.types import Message, Role
+from openjarvis.core.types import Message, Role, ToolCall
 from openjarvis.server.model_capabilities import is_embed_only_model
 from openjarvis.server.models import (
     ChatCompletionChunk,
@@ -40,6 +40,15 @@ def _to_messages(chat_messages) -> list[Message]:
                 role=role,
                 content=m.content or "",
                 name=m.name,
+                tool_calls=[
+                    ToolCall(
+                        id=tool_call.get("id", ""),
+                        name=tool_call.get("function", {}).get("name", ""),
+                        arguments=tool_call.get("function", {}).get("arguments", "{}"),
+                    )
+                    for tool_call in (m.tool_calls or [])
+                ]
+                or None,
                 tool_call_id=m.tool_call_id,
             )
         )
@@ -114,13 +123,15 @@ async def chat_completions(request_body: ChatCompletionRequest, request: Request
     memory_backend = getattr(request.app.state, "memory_backend", None)
     if (
         config is not None
-        and memory_backend is not None
         and config.agent.context_from_memory
         and request_body.messages
     ):
         try:
             from openjarvis.tools.storage.context import ContextConfig, inject_context
 
+            memory_service = getattr(request.app.state, "memory_service", None)
+            facts = memory_service.list_facts() if memory_service is not None else []
+
             # Extract query from the last user message
             query_text = ""
             for m in reversed(request_body.messages):
@@ -130,6 +141,7 @@ async def chat_completions(request_body: ChatCompletionRequest, request: Request
 
             if query_text:
                 messages = _to_messages(request_body.messages)
+                messages = _ensure_identity_prompt(messages, config)
                 ctx_cfg = ContextConfig(
                     top_k=config.memory.context_top_k,
                     min_score=config.memory.context_min_score,
@@ -140,22 +152,35 @@ async def chat_completions(request_body: ChatCompletionRequest, request: Request
                     messages,
                     memory_backend,
                     config=ctx_cfg,
+                    facts=facts,
                 )
-                # Rebuild request messages from enriched Message objects
-                if len(enriched) > len(messages):
-                    from openjarvis.server.models import ChatMessage
+                # Rebuild after identity/context merging so downstream engine
+                # adapters always receive exactly one system message.
+                from openjarvis.server.models import ChatMessage
 
-                    new_msgs = []
-                    for msg in enriched:
-                        new_msgs.append(
-                            ChatMessage(
-                                role=msg.role.value,
-                                content=msg.content,
-                                name=msg.name,
-                                tool_call_id=getattr(msg, "tool_call_id", None),
-                            )
+                new_msgs = []
+                for msg in enriched:
+                    new_msgs.append(
+                        ChatMessage(
+                            role=msg.role.value,
+                            content=msg.content,
+                            name=msg.name,
+                            tool_calls=[
+                                {
+                                    "id": tool_call.id,
+                                    "type": "function",
+                                    "function": {
+                                        "name": tool_call.name,
+                                        "arguments": tool_call.arguments,
+                                    },
+                                }
+                                for tool_call in (msg.tool_calls or [])
+                            ]
+                            or None,
+                            tool_call_id=getattr(msg, "tool_call_id", None),
                         )
-                    request_body.messages = new_msgs
+                    )
+                request_body.messages = new_msgs
         except Exception:
             logging.getLogger("openjarvis.server").debug(
                 "Memory context injection failed",
@@ -200,12 +225,14 @@ async def chat_completions(request_body: ChatCompletionRequest, request: Request
         # When the client passes `tools`, stream the model's raw
         # OpenAI-compat function-calling decision directly from the engine
         # (bypassing the agent) — the streaming mirror of the non-streaming
-        # #454 fix.  Routing tools through the agent stream bridge ignored
-        # `request_body.tools`, ran the agent's own tool loop, and
-        # word-split generic filler content into fake token deltas, so the
-        # caller's tool_calls were dropped entirely (the streaming analog of
-        # #414).  For plain chat (no tools), stream token-by-token directly
-        # from the engine for true real-time output.
+        # #454 fix. Routing client-supplied tools through a server-side agent
+        # would execute the agent's different tool set and drop the raw tool
+        # call the caller expects (#414).
+        #
+        # Without client-supplied tools, keep streaming requests on the
+        # configured server agent so its server-side tool loop is available
+        # to the desktop UI and other stream:true clients (#735). Fall back to
+        # direct token streaming when no tool-bearing agent is configured.
         if request_body.tools:
             return await _handle_stream_tools(
                 engine,
@@ -216,6 +243,16 @@ async def chat_completions(request_body: ChatCompletionRequest, request: Request
                 bus=getattr(request.app.state, "bus", None),
                 memory_service=getattr(request.app.state, "memory_service", None),
             )
+        if agent is not None and getattr(agent, "_tools", None):
+            return await _handle_agent_stream(
+                agent,
+                model,
+                request_body,
+                complexity_info,
+                trace_store=getattr(request.app.state, "trace_store", None),
+                bus=getattr(request.app.state, "bus", None),
+                memory_service=getattr(request.app.state, "memory_service", None),
+            )
         return await _handle_stream(
             engine,
             model,
@@ -547,6 +584,114 @@ def _handle_agent(
     )
 
 
+async def _handle_agent_stream(
+    agent,
+    model: str,
+    req: ChatCompletionRequest,
+    complexity_info=None,
+    *,
+    trace_store=None,
+    bus=None,
+    memory_service=None,
+):
+    """Run the configured agent and return its result as an SSE response.
+
+    Agents own the tool-execution loop, which is synchronous today.  Run that
+    loop in a worker thread and stream its final answer once complete.  This
+    keeps ``stream:true`` clients (including the desktop UI) on the same agent
+    and configured toolkit as non-streaming requests instead of bypassing the
+    agent and silently dropping server-side tools.
+
+    Requests that explicitly supply OpenAI ``tools`` continue to use
+    ``_handle_stream_tools`` so their raw tool-call deltas are preserved.
+    """
+    chunk_id = f"chatcmpl-{uuid.uuid4().hex[:12]}"
+    query_text = ""
+    for message in reversed(req.messages):
+        if message.role == "user" and message.content:
+            query_text = message.content
+            break
+
+    async def generate():
+        first_chunk = ChatCompletionChunk(
+            id=chunk_id,
+            model=model,
+            choices=[StreamChoice(delta=DeltaMessage(role="assistant"))],
+        )
+        yield f"data: {first_chunk.model_dump_json()}\n\n"
+
+        try:
+            response = await asyncio.to_thread(
+                _handle_agent,
+                agent,
+                model,
+                req,
+                complexity_info,
+                trace_store=trace_store,
+                bus=bus,
+            )
+        except Exception as exc:
+            logging.getLogger("openjarvis.server").error(
+                "Agent stream error: %s",
+                exc,
+                exc_info=True,
+            )
+            error_chunk = ChatCompletionChunk(
+                id=chunk_id,
+                model=model,
+                choices=[
+                    StreamChoice(
+                        delta=DeltaMessage(
+                            content=f"Sorry, an error occurred: {exc}",
+                        ),
+                        finish_reason="stop",
+                    )
+                ],
+            )
+            yield f"data: {error_chunk.model_dump_json()}\n\n"
+            yield "data: [DONE]\n\n"
+            return
+
+        content = _response_content(response)
+        if content:
+            content_chunk = ChatCompletionChunk(
+                id=chunk_id,
+                model=model,
+                choices=[StreamChoice(delta=DeltaMessage(content=content))],
+            )
+            yield f"data: {content_chunk.model_dump_json()}\n\n"
+
+        import json as _json
+
+        finish_chunk = ChatCompletionChunk(
+            id=chunk_id,
+            model=model,
+            choices=[
+                StreamChoice(delta=DeltaMessage(), finish_reason="stop"),
+            ],
+        )
+        finish_data = _json.loads(finish_chunk.model_dump_json())
+        finish_data["usage"] = response.usage.model_dump()
+        if complexity_info is not None:
+            finish_data["complexity"] = complexity_info.model_dump()
+        yield f"data: {_json.dumps(finish_data)}\n\n"
+
+        _record_completed_exchange(
+            memory_service,
+            query_text,
+            content,
+            bus=bus,
+            source="server.chat.stream",
+        )
+        yield "data: [DONE]\n\n"
+
+    return StreamingResponse(
+        generate(),
+        media_type="text/event-stream",
+        headers={"Cache-Control": "no-cache", "Connection": "keep-alive"},
+    )
+
+
 async def _handle_stream_tools(
     engine,
     model: str,
@@ -690,11 +835,10 @@ async def _handle_stream(
 ):
     """Stream response using SSE format.
 
-    This path streams straight from the engine, bypassing the agent /
+    This no-agent fallback streams straight from the engine, bypassing the
     ``TraceCollector``. When *trace_store* is set we accumulate the streamed
     tokens and record a minimal ``Trace`` once the stream completes
-    successfully — otherwise streamed chats (the desktop GUI's main path)
-    would never populate ``traces.db``.
+    successfully.
     """
     import time
 

src/openjarvis/server/stream_bridge.py

@@ -246,62 +246,15 @@ class AgentStreamBridge:
                     {"results": tool_results_data},
                 )
 
-            # Stream content using real LLM token streaming via
-            # engine.stream_full() when the engine is available.
+            # ``agent.run()`` already produced the authoritative, grounded
+            # response.  Do not call the engine again here: a second inference
+            # would not have the agent's system prompt, tool transcript, or
+            # other internal context and could therefore contradict the
+            # result reported by the agent events.  Replay the final content
+            # in chunks so the OpenAI-compatible streaming response stays
+            # consistent with the completed agent run.
             content = agent_result.content or ""
-            engine = getattr(self._agent, "_engine", None)
-            used_real_streaming = False
-
-            if engine is not None and hasattr(engine, "stream_full") and content:
-                # Re-stream using the engine for real token delivery.
-                # Build the same messages the agent used for its final turn.
-                try:
-                    from openjarvis.core.types import Message as MsgType
-                    from openjarvis.core.types import Role as RoleType
-
-                    replay_messages = []
-                    for m in self._request.messages:
-                        role = (
-                            RoleType(m.role)
-                            if m.role in {r.value for r in RoleType}
-                            else RoleType.USER
-                        )
-                        replay_messages.append(
-                            MsgType(
-                                role=role,
-                                content=m.content or "",
-                                name=m.name,
-                                tool_call_id=m.tool_call_id,
-                            )
-                        )
-
-                    async for sc in engine.stream_full(
-                        replay_messages,
-                        model=self._model,
-                    ):
-                        if sc.content:
-                            chunk = ChatCompletionChunk(
-                                id=self._chunk_id,
-                                model=self._model,
-                                choices=[
-                                    StreamChoice(
-                                        delta=DeltaMessage(content=sc.content),
-                                    )
-                                ],
-                            )
-                            yield f"data: {chunk.model_dump_json()}\n\n"
-                    used_real_streaming = True
-                except Exception as stream_exc:
-                    import logging as _logging
-
-                    _logger = _logging.getLogger("openjarvis.server")
-                    _logger.warning(
-                        "Real streaming failed, falling back to word replay: %s",
-                        stream_exc,
-                    )
-
-            # Fallback: word-by-word replay if real streaming was not used
-            if not used_real_streaming and content:
+            if content:
                 words = content.split(" ")
                 for i, word in enumerate(words):
                     token = word if i == 0 else " " + word

src/openjarvis/system/orchestrator.py

@@ -40,8 +40,9 @@ class QueryOrchestrator:
 
         messages = [Message(role=Role.USER, content=query)]
 
-        if context and s.memory_backend and s.config.agent.context_from_memory:
+        if context and s.config.agent.context_from_memory:
             try:
+                from openjarvis.memory import load_configured_facts
                 from openjarvis.tools.storage.context import (
                     ContextConfig,
                     inject_context,
@@ -52,11 +53,13 @@ class QueryOrchestrator:
                     min_score=s.config.memory.context_min_score,
                     max_context_tokens=s.config.memory.context_max_tokens,
                 )
+                facts = load_configured_facts(s.config)
                 messages = inject_context(
                     query,
                     messages,
                     s.memory_backend,
                     config=ctx_cfg,
+                    facts=facts,
                 )
             except Exception as exc:
                 logger.warning("Failed to inject memory context: %s", exc)

src/openjarvis/tools/_stubs.py

@@ -136,6 +136,15 @@ class ToolExecutor:
                 content=f"Invalid arguments JSON: {exc}",
                 success=False,
             )
+        if not isinstance(params, dict):
+            return ToolResult(
+                tool_name=tool_call.name,
+                content=(
+                    "Invalid arguments: expected a JSON object, "
+                    f"got {type(params).__name__}."
+                ),
+                success=False,
+            )
 
         # Boundary guard: scan external tool arguments
         if self._boundary_guard is not None and not getattr(tool, "is_local", True):
@@ -143,6 +152,15 @@ class ToolExecutor:
                 tool_call = self._boundary_guard.check_outbound(tool_call)
                 # Re-parse arguments after potential redaction
                 params = json.loads(tool_call.arguments) if tool_call.arguments else {}
+                if not isinstance(params, dict):
+                    return ToolResult(
+                        tool_name=tool_call.name,
+                        content=(
+                            "Invalid arguments: expected a JSON object, "
+                            f"got {type(params).__name__}."
+                        ),
+                        success=False,
+                    )
             except Exception as exc:
                 return ToolResult(
                     tool_name=tool_call.name,

src/openjarvis/tools/code_interpreter.py

@@ -56,6 +56,7 @@ class CodeInterpreterTool(BaseTool):
                 "required": ["code"],
             },
             category="code",
+            metadata={"structured_allow_object_text": True},
         )
 
     def execute(self, **params: Any) -> ToolResult:

src/openjarvis/tools/code_interpreter_docker.py

@@ -55,6 +55,7 @@ class DockerCodeInterpreterTool(BaseTool):
             },
             category="code",
             timeout_seconds=60.0,
+            metadata={"structured_allow_object_text": True},
         )
 
     def execute(self, **params: Any) -> ToolResult:

src/openjarvis/tools/repl.py

@@ -191,6 +191,7 @@ class ReplTool(BaseTool):
                 "required": ["code"],
             },
             category="code",
+            metadata={"structured_allow_object_text": True},
         )
 
     def execute(self, **params: Any) -> ToolResult:

src/openjarvis/tools/storage/context.py

@@ -2,13 +2,16 @@
 
 from __future__ import annotations
 
-from dataclasses import dataclass
-from typing import List, Optional
+from dataclasses import dataclass, replace
+from typing import TYPE_CHECKING, List, Optional, Sequence
 
 from openjarvis.core.events import EventType, get_event_bus
 from openjarvis.core.types import Message, Role
 from openjarvis.tools.storage._stubs import MemoryBackend, RetrievalResult
 
+if TYPE_CHECKING:
+    from openjarvis.memory.store import Fact
+
 
 @dataclass(slots=True)
 class ContextConfig:
@@ -46,28 +49,75 @@ def format_context(results: List[RetrievalResult]) -> str:
 
 def build_context_message(
     results: List[RetrievalResult],
+    facts: Sequence[Fact] = (),
 ) -> Message:
     """Create a system message with formatted context."""
-    context_text = format_context(results)
-    content = (
-        "The following context was retrieved from the knowledge"
-        " base. Use it to inform your response, citing sources"
-        " where applicable:\n\n" + context_text
+    sections = []
+    if facts:
+        fact_text = "\n".join(f"- {fact.text}" for fact in facts)
+        sections.append(
+            "The following durable facts were remembered from prior "
+            "conversations. Use them when relevant to the user's request:\n\n"
+            + fact_text
+        )
+    if results:
+        sections.append(
+            "The following context was retrieved from the knowledge"
+            " base. Use it to inform your response, citing sources"
+            " where applicable:\n\n" + format_context(results)
+        )
+    content = "\n\n".join(sections)
+    return Message(
+        role=Role.SYSTEM,
+        content=content,
+        metadata={"memory_context": True},
     )
-    return Message(role=Role.SYSTEM, content=content)
+
+
+def _merge_context_message(
+    messages: List[Message],
+    context_message: Message,
+) -> List[Message]:
+    """Return a copy with context folded into the existing system prompt."""
+    system_messages = [message for message in messages if message.role == Role.SYSTEM]
+    if not system_messages:
+        return [context_message, *messages]
+
+    content = "\n\n".join(
+        part
+        for part in (
+            *(message.text for message in system_messages),
+            context_message.text,
+        )
+        if part
+    )
+    combined = replace(system_messages[0], content=content)
+    merged: List[Message] = []
+    inserted = False
+    for message in messages:
+        if message.role == Role.SYSTEM:
+            if not inserted:
+                merged.append(combined)
+                inserted = True
+            continue
+        merged.append(message)
+    return merged
 
 
 def inject_context(
     query: str,
     messages: List[Message],
-    backend: MemoryBackend,
+    backend: Optional[MemoryBackend],
     *,
     config: Optional[ContextConfig] = None,
+    facts: Sequence[Fact] = (),
 ) -> List[Message]:
     """Retrieve relevant context and prepend it to *messages*.
 
     Returns a **new** list — the original list is not mutated.
-    If no results pass the score threshold, returns the original
+    Automatic-memory facts are included independently of the retrieval
+    backend, so persisted facts remain recallable even when the document
+    store is empty. If no facts or results are available, returns the original
     messages unchanged.
 
     Parameters
@@ -77,33 +127,55 @@ def inject_context(
     messages:
         The existing message list.
     backend:
-        The memory backend to search.
+        The memory backend to search, or ``None`` when only facts are available.
     config:
         Context injection settings (uses defaults if ``None``).
+    facts:
+        Durable facts captured by the automatic memory service.
     """
     cfg = config or ContextConfig()
     if not cfg.enabled:
         return messages
 
-    results = backend.retrieve(query, top_k=cfg.top_k)
+    results = backend.retrieve(query, top_k=cfg.top_k) if backend is not None else []
 
     # Filter by minimum score
     results = [r for r in results if r.score >= cfg.min_score]
 
-    if not results:
-        return messages
-
-    # Truncate to max_context_tokens
-    truncated: List[RetrievalResult] = []
+    # When both sources have data, cap facts at half the total budget so they
+    # cannot starve query-specific document retrieval. Unused fact budget is
+    # still available to documents. Newest facts win within the fact budget.
+    fact_budget = cfg.max_context_tokens
+    if results:
+        fact_budget //= 2
+    selected_facts: List[Fact] = []
     total_tokens = 0
+    for fact in reversed(facts):
+        tokens = _count_tokens(fact.text)
+        if total_tokens + tokens > fact_budget:
+            continue
+        selected_facts.append(fact)
+        total_tokens += tokens
+
+    # Fill the remaining context budget with retrieved documents.
+    truncated: List[RetrievalResult] = []
     for r in results:
         tokens = _count_tokens(r.content)
+        if total_tokens + tokens > cfg.max_context_tokens:
+            # A large top result should not disappear solely because facts
+            # consumed their reserved share. Prefer that result when it fits
+            # the total budget on its own.
+            if not truncated and selected_facts and tokens <= cfg.max_context_tokens:
+                selected_facts = []
+                total_tokens = 0
+            else:
+                break
         if total_tokens + tokens > cfg.max_context_tokens:
             break
         truncated.append(r)
         total_tokens += tokens
 
-    if not truncated:
+    if not selected_facts and not truncated:
         return messages
 
     # Publish event
@@ -114,13 +186,14 @@ def inject_context(
             "context_injection": True,
             "query": query,
             "num_results": len(truncated),
+            "num_facts": len(selected_facts),
             "total_tokens": total_tokens,
         },
     )
 
     # Build context message and prepend
-    ctx_msg = build_context_message(truncated)
-    return [ctx_msg] + list(messages)
+    ctx_msg = build_context_message(truncated, selected_facts)
+    return _merge_context_message(messages, ctx_msg)
 
 
 __all__ = [

src/openjarvis/tools/storage/sqlite.py

@@ -95,6 +95,29 @@ class SQLiteMemory(MemoryBackend):
         )
         return doc_id
 
+    def replace_source(
+        self,
+        source: str,
+        documents: List[tuple[str, Optional[Dict[str, Any]]]],
+    ) -> List[str]:
+        """Atomically replace all documents associated with *source*."""
+        payload = [
+            (content, json.dumps(metadata) if metadata else None)
+            for content, metadata in documents
+        ]
+        doc_ids = self._rust_impl.replace_source(source, payload)
+        bus = get_event_bus()
+        for doc_id in doc_ids:
+            bus.publish(
+                EventType.MEMORY_STORE,
+                {
+                    "backend": self.backend_id,
+                    "doc_id": doc_id,
+                    "source": source,
+                },
+            )
+        return doc_ids
+
     def retrieve(
         self,
         query: str,

tests/agents/test_base_agent.py

@@ -205,6 +205,40 @@ class TestBuildMessages:
         assert messages[1].content == "prev"
         assert messages[2].content == "new"
 
+    def test_prompt_builder_merges_context_system_message(self):
+        engine = MagicMock()
+        prompt_builder = MagicMock()
+        prompt_builder.build.return_value = "You are OpenJarvis."
+        agent = _ConcreteAgent(engine, "m", prompt_builder=prompt_builder)
+        conv = Conversation()
+        conv.add(
+            Message(
+                role=Role.SYSTEM,
+                content="Remember: user likes jazz.",
+                metadata={"memory_context": True},
+            )
+        )
+        ctx = AgentContext(conversation=conv)
+
+        messages = agent._build_messages("new", ctx)
+
+        system_messages = [m for m in messages if m.role == Role.SYSTEM]
+        assert len(system_messages) == 1
+        assert "You are OpenJarvis." in system_messages[0].content
+        assert "user likes jazz" in system_messages[0].content
+
+    def test_prompt_builder_preserves_caller_system_context(self):
+        engine = MagicMock()
+        prompt_builder = MagicMock()
+        prompt_builder.build.return_value = "Agent instructions."
+        agent = _ConcreteAgent(engine, "m", prompt_builder=prompt_builder)
+        conv = Conversation()
+        conv.add(Message(role=Role.SYSTEM, content="You are helpful."))
+
+        messages = agent._build_messages("new", AgentContext(conversation=conv))
+
+        assert any(message.content == "You are helpful." for message in messages)
+
 
 class TestGenerate:
     def test_delegates_to_engine(self):

tests/cli/test_ask_agent.py

@@ -396,11 +396,10 @@ class TestPersonaFilesReachModel:
         assert "MEMORY_SENTINEL" in joined
         assert "USER_SENTINEL" in joined
 
-    def test_orchestrator_keeps_its_own_system_prompt(
+    def test_orchestrator_accepts_persona_prompt_builder(
         self, runner, monkeypatch, tmp_path
     ):
-        """OrchestratorAgent's __init__ doesn't accept ``prompt_builder``;
-        the wiring must skip it silently rather than crash."""
+        """Orchestrator explicitly accepts and applies persona wiring."""
         from openjarvis.core.config import JarvisConfig
 
         soul = tmp_path / "SOUL.md"
@@ -425,5 +424,6 @@ class TestPersonaFilesReachModel:
         ):
             result = runner.invoke(cli, ["ask", "--agent", "orchestrator", "Hello"])
 
-        # Pass condition: doesn't crash with TypeError on prompt_builder kwarg.
         assert result.exit_code == 0, result.output
+        messages = engine.generate.call_args.args[0]
+        assert "ORCH_PERSONA_SENTINEL" in messages[0].content

tests/cli/test_chat_cmd.py

@@ -17,7 +17,8 @@ from openjarvis.cli.chat_cmd import _read_input, chat
 from openjarvis.core.config import JarvisConfig
 from openjarvis.core.events import Event, EventBus, EventType
 from openjarvis.core.registry import AgentRegistry, ToolRegistry
-from openjarvis.core.types import ToolCall, ToolResult
+from openjarvis.core.types import Role, ToolCall, ToolResult
+from openjarvis.memory.store import LocalFactStore
 from openjarvis.tools._stubs import BaseTool, ToolSpec
 
 
@@ -97,6 +98,79 @@ class TestReadInput:
 
 
 class TestChatAgents:
+    def test_direct_chat_injects_auto_memory_facts(self, tmp_path) -> None:
+        facts_path = tmp_path / "facts.jsonl"
+        LocalFactStore(facts_path).add(
+            "The user's favorite color is blue",
+            source="auto",
+        )
+
+        engine = MagicMock()
+        engine.engine_id = "mock"
+        engine.generate.return_value = {"content": "Blue."}
+        config = JarvisConfig()
+        config.intelligence.default_model = "test-model"
+        config.memory.enabled = True
+        config.memory.facts_path = str(facts_path)
+        config.agent.context_from_memory = True
+
+        with (
+            patch("openjarvis.cli.chat_cmd.load_config", return_value=config),
+            patch("openjarvis.engine.get_engine", return_value=("mock", engine)),
+            patch("openjarvis.intelligence.register_builtin_models"),
+            patch("openjarvis.memory.build_memory_service", return_value=None),
+            patch("openjarvis.cli.ask._get_memory_backend", return_value=None),
+        ):
+            result = CliRunner().invoke(
+                chat,
+                ["--model", "test-model"],
+                input="What is my favorite color?\n/quit\n",
+            )
+
+        assert result.exit_code == 0
+        messages = engine.generate.call_args.args[0]
+        assert messages[0].role.value == "system"
+        assert "favorite color is blue" in messages[0].content
+
+    def test_chat_generation_survives_fact_store_failure(self) -> None:
+        class _FailingMemoryService:
+            def start(self) -> None:
+                pass
+
+            def stop(self, timeout: float = 2.0) -> None:
+                pass
+
+            def list_facts(self):
+                raise OSError("fact store unavailable")
+
+        engine = MagicMock()
+        engine.engine_id = "mock"
+        engine.generate.return_value = {"content": "Still working."}
+        config = JarvisConfig()
+        config.intelligence.default_model = "test-model"
+        config.memory.enabled = True
+        config.agent.context_from_memory = True
+
+        with (
+            patch("openjarvis.cli.chat_cmd.load_config", return_value=config),
+            patch("openjarvis.engine.get_engine", return_value=("mock", engine)),
+            patch("openjarvis.intelligence.register_builtin_models"),
+            patch(
+                "openjarvis.memory.build_memory_service",
+                return_value=_FailingMemoryService(),
+            ),
+            patch("openjarvis.cli.ask._get_memory_backend", return_value=None),
+        ):
+            result = CliRunner().invoke(
+                chat,
+                ["--model", "test-model"],
+                input="hello\n/quit\n",
+            )
+
+        assert result.exit_code == 0
+        assert "Still working." in result.output
+        engine.generate.assert_called_once()
+
     def test_simple_agent_does_not_receive_tool_only_kwargs(self) -> None:
         engine = MagicMock()
         engine.engine_id = "mock"
@@ -121,6 +195,106 @@ class TestChatAgents:
         assert "simple ok" in result.output
         assert "failed" not in result.output.lower()
 
+    def test_agent_receives_prior_turn_history(self) -> None:
+        """Multi-turn chat must pass prior turns to agent.run() via AgentContext."""
+
+        captured_contexts: list[AgentContext | None] = []
+
+        class _CapturingAgent(BaseAgent):
+            agent_id = "capturing_chat_agent"
+
+            def run(self, input, context: AgentContext | None = None, **kwargs):
+                captured_contexts.append(context)
+                return AgentResult(content=f"reply-{len(captured_contexts)}", turns=1)
+
+        engine = MagicMock()
+        engine.engine_id = "mock"
+        config = JarvisConfig()
+        config.intelligence.default_model = "test-model"
+
+        AgentRegistry.register_value("capturing_chat_agent", _CapturingAgent)
+
+        with (
+            patch("openjarvis.cli.chat_cmd.load_config", return_value=config),
+            patch("openjarvis.engine.get_engine", return_value=("mock", engine)),
+            patch("openjarvis.intelligence.register_builtin_models"),
+        ):
+            result = CliRunner().invoke(
+                chat,
+                ["--agent", "capturing_chat_agent", "--model", "test-model"],
+                input="first turn\nsecond turn\n/quit\n",
+            )
+
+        assert result.exit_code == 0
+        assert len(captured_contexts) == 2
+
+        first_turn_context, second_turn_context = captured_contexts
+        assert first_turn_context is not None
+        assert first_turn_context.conversation.messages == []
+
+        assert second_turn_context is not None
+        prior_texts = [m.content for m in second_turn_context.conversation.messages]
+        assert "first turn" in prior_texts
+        assert "reply-1" in prior_texts
+
+    def test_agent_memory_context_precedes_prior_turn_history(self, tmp_path) -> None:
+        """Memory system context must remain ahead of prior conversation turns."""
+
+        captured_contexts: list[AgentContext | None] = []
+
+        class _CapturingAgent(BaseAgent):
+            agent_id = "capturing_memory_chat_agent"
+
+            def run(self, input, context: AgentContext | None = None, **kwargs):
+                captured_contexts.append(context)
+                return AgentResult(content=f"reply-{len(captured_contexts)}", turns=1)
+
+        facts_path = tmp_path / "facts.jsonl"
+        LocalFactStore(facts_path).add("The user likes jazz", source="auto")
+
+        engine = MagicMock()
+        engine.engine_id = "mock"
+        config = JarvisConfig()
+        config.intelligence.default_model = "test-model"
+        config.memory.enabled = True
+        config.memory.facts_path = str(facts_path)
+        config.agent.context_from_memory = True
+
+        AgentRegistry.register_value(
+            "capturing_memory_chat_agent",
+            _CapturingAgent,
+        )
+
+        with (
+            patch("openjarvis.cli.chat_cmd.load_config", return_value=config),
+            patch("openjarvis.engine.get_engine", return_value=("mock", engine)),
+            patch("openjarvis.intelligence.register_builtin_models"),
+            patch("openjarvis.memory.build_memory_service", return_value=None),
+            patch("openjarvis.cli.ask._get_memory_backend", return_value=None),
+        ):
+            result = CliRunner().invoke(
+                chat,
+                ["--agent", "capturing_memory_chat_agent", "--model", "test-model"],
+                input="first turn\nsecond turn\n/quit\n",
+            )
+
+        assert result.exit_code == 0
+        assert len(captured_contexts) == 2
+
+        second_turn_context = captured_contexts[1]
+        assert second_turn_context is not None
+        messages = second_turn_context.conversation.messages
+        assert [message.role for message in messages] == [
+            Role.SYSTEM,
+            Role.USER,
+            Role.ASSISTANT,
+        ]
+        assert "user likes jazz" in messages[0].content
+        assert [message.content for message in messages[1:]] == [
+            "first turn",
+            "reply-1",
+        ]
+
     def test_memory_service_started_fed_and_stopped(self) -> None:
         """The REPL starts memory, publishes each turn, and stops it."""
 

tests/cli/test_memory_cmd.py

@@ -40,6 +40,35 @@ def test_memory_index_file(tmp_path: Path, monkeypatch):
     assert "Indexed" in result.output or "chunk" in result.output
 
 
+def test_memory_index_replaces_existing_source(tmp_path: Path, monkeypatch):
+    """Re-indexing a file replaces its previous chunks."""
+    _register_sqlite()
+    db_path = str(tmp_path / "mem.db")
+    doc = tmp_path / "doc.txt"
+    doc.write_text(" ".join(["legacy"] * 100), encoding="utf-8")
+
+    mod = importlib.import_module("openjarvis.cli.memory_cmd")
+    monkeypatch.setattr(
+        mod,
+        "_get_backend",
+        lambda b=None: SQLiteMemory(db_path=db_path),
+    )
+
+    first = CliRunner().invoke(cli, ["memory", "index", str(doc)])
+    assert first.exit_code == 0
+
+    doc.write_text(" ".join(["updated"] * 100), encoding="utf-8")
+    second = CliRunner().invoke(cli, ["memory", "index", str(doc)])
+    assert second.exit_code == 0
+
+    backend = SQLiteMemory(db_path=db_path)
+    assert backend.count() == 1
+    assert backend.retrieve("legacy") == []
+    updated = backend.retrieve("updated")
+    assert len(updated) == 1
+    assert updated[0].source == str(doc)
+
+
 def test_memory_index_nonexistent(tmp_path: Path):
     """Indexing a nonexistent path should fail."""
     _register_sqlite()

tests/cli/test_scan_data_boundaries.py

@@ -0,0 +1,396 @@
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+from click.testing import CliRunner
+
+from openjarvis.cli.scan_cmd import PrivacyScanner, ScanResult, scan
+from openjarvis.core.config import JarvisConfig
+
+
+def _low_noise_config():
+    """Baseline config with no warn/fail findings under an empty scan root.
+
+    JarvisConfig defaults include absolute store paths under the real
+    OPENJARVIS_HOME; clear those so tests only see artifacts under tmp_path.
+    """
+    config = JarvisConfig()
+    config.analytics.enabled = False
+    config.traces.enabled = False
+    config.telemetry.enabled = False
+    config.agent.context_from_memory = False
+    config.agent.tools = ""
+    config.skills.enabled = False
+    config.digest.enabled = False
+    config.channel.enabled = False
+    config.learning.enabled = False
+    config.learning.training_enabled = False
+    config.learning.auto_update = False
+    config.learning.spec_search.enabled = False
+    config.tools.enabled = ""
+    config.tools.mcp.enabled = False
+    config.tools.storage.enabled = False
+    config.optimize.optimizer_provider = ""
+    config.optimize.judge_model = ""
+    config.server.host = "127.0.0.1"
+    config.security.profile = "personal"
+    # Avoid scanning the developer's real ~/.openjarvis store files.
+    config.traces.db_path = ""
+    config.telemetry.db_path = ""
+    config.security.audit_log_path = ""
+    config.security.vault_key_path = ""
+    config.tools.storage.db_path = ""
+    config.tools.storage.facts_path = ""
+    config.sessions.db_path = ""
+    config.agent_manager.db_path = ""
+    config.optimize.db_path = ""
+    config.scheduler.db_path = ""
+    config.skills.index_dir = ""
+    config.memory_files.soul_path = ""
+    config.memory_files.memory_path = ""
+    config.memory_files.user_path = ""
+    return config
+
+
+def _patch_config(monkeypatch, tmp_path, config, config_loaded=True, error=""):
+    monkeypatch.setattr(
+        "openjarvis.cli.scan_cmd._load_data_boundary_config",
+        lambda: (config, tmp_path, config_loaded, error, ""),
+    )
+    monkeypatch.setattr("openjarvis.cli.scan_cmd.get_config_dir", lambda: tmp_path)
+
+
+def test_scan_data_boundaries_json_redacts_paths(monkeypatch, tmp_path):
+    config = _low_noise_config()
+    (tmp_path / "traces.db").write_text("", encoding="utf-8")
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(scan, ["--data-boundaries", "--json"])
+
+    assert result.exit_code == 0
+    payload = json.loads(result.output)
+    assert payload["schema_version"] == 1
+    assert payload["root"] != str(tmp_path.resolve())
+    assert str(tmp_path.resolve()) not in result.output
+    assert "findings" in payload
+
+
+def test_scan_data_boundaries_show_paths_json(monkeypatch, tmp_path):
+    config = _low_noise_config()
+    trace_db = tmp_path / "traces.db"
+    trace_db.write_text("", encoding="utf-8")
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(
+        scan,
+        ["--data-boundaries", "--json", "--show-paths"],
+    )
+
+    assert result.exit_code == 0
+    payload = json.loads(result.output)
+    assert payload["root"] == str(tmp_path.resolve())
+    assert "traces.db" in result.output
+
+
+def test_scan_data_boundaries_handles_config_load_error(monkeypatch, tmp_path):
+    config = _low_noise_config()
+    _patch_config(
+        monkeypatch,
+        tmp_path,
+        config,
+        config_loaded=False,
+        error="TOMLDecodeError: invalid config",
+    )
+
+    result = CliRunner().invoke(scan, ["--data-boundaries", "--json"])
+
+    assert result.exit_code == 0
+    payload = json.loads(result.output)
+    assert payload["summary"]["fail"] == 1
+    assert payload["findings"][0]["id"] == "config-load-error"
+
+
+def test_scan_data_boundaries_strict_exits_nonzero_on_fail(
+    monkeypatch,
+    tmp_path,
+):
+    config = _low_noise_config()
+    config.intelligence.provider = "openai"
+    config.agent.context_from_memory = True
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(scan, ["--data-boundaries", "--strict"])
+
+    assert result.exit_code == 1
+    assert "local memory may be sent to cloud inference" in result.output
+
+
+def test_scan_data_boundaries_fail_exits_zero_without_strict(
+    monkeypatch,
+    tmp_path,
+):
+    config = _low_noise_config()
+    config.intelligence.provider = "openai"
+    config.agent.context_from_memory = True
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(scan, ["--data-boundaries"])
+
+    assert result.exit_code == 0
+    assert "local memory may be sent to cloud inference" in result.output
+
+
+def test_scan_data_boundaries_strict_exits_on_warning(
+    monkeypatch,
+    tmp_path,
+):
+    config = _low_noise_config()
+    config.tools.enabled = "web_search"
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(scan, ["--data-boundaries", "--strict"])
+
+    assert result.exit_code == 1
+    assert "Web search tool is configured" in result.output
+
+
+def test_scan_data_boundaries_strict_passes_with_info_only(
+    monkeypatch,
+    tmp_path,
+):
+    config = _low_noise_config()
+    config.agent.context_from_memory = True
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(scan, ["--data-boundaries", "--strict"])
+
+    assert result.exit_code == 0
+    assert "OpenJarvis Data-Boundary Scan" in result.output
+
+
+def test_scan_data_boundaries_init_defaults_strict_exits_on_warn(
+    monkeypatch,
+    tmp_path,
+):
+    config = _low_noise_config()
+    config.server.host = "0.0.0.0"
+    config.telemetry.enabled = True
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(scan, ["--data-boundaries", "--strict"])
+
+    assert result.exit_code == 1
+    assert "bind all" in result.output
+
+
+def test_scan_data_boundaries_rejects_quick(monkeypatch, tmp_path):
+    config = _low_noise_config()
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(scan, ["--quick", "--data-boundaries"])
+
+    assert result.exit_code != 0
+    assert "cannot be combined" in result.output
+
+
+def test_scan_rejects_strict_without_data_boundaries():
+    result = CliRunner().invoke(scan, ["--strict"])
+
+    assert result.exit_code != 0
+    assert "only supported with --data-boundaries" in result.output
+
+
+def test_existing_scan_json_still_works(monkeypatch):
+    monkeypatch.setattr(
+        PrivacyScanner,
+        "run_all",
+        lambda self: [
+            ScanResult(
+                name="Network Exposure",
+                status="ok",
+                message="No exposed ports.",
+                platform="all",
+            )
+        ],
+    )
+
+    result = CliRunner().invoke(scan, ["--json"])
+
+    assert result.exit_code == 0
+    payload = json.loads(result.output)
+    assert payload[0]["name"] == "Network Exposure"
+    assert payload[0]["status"] == "ok"
+
+
+def test_existing_scan_quick_json_still_works(monkeypatch):
+    monkeypatch.setattr(
+        PrivacyScanner,
+        "run_quick",
+        lambda self: [
+            ScanResult(
+                name="Cloud Sync Agents",
+                status="ok",
+                message="No cloud-sync agents detected.",
+                platform="all",
+            )
+        ],
+    )
+
+    result = CliRunner().invoke(scan, ["--quick", "--json"])
+
+    assert result.exit_code == 0
+    payload = json.loads(result.output)
+    assert payload[0]["name"] == "Cloud Sync Agents"
+
+
+def test_top_level_cli_registers_data_boundary_scan(monkeypatch, tmp_path):
+    from openjarvis.cli import cli
+
+    config = _low_noise_config()
+    _patch_config(monkeypatch, tmp_path, config)
+
+    result = CliRunner().invoke(cli, ["scan", "--data-boundaries", "--json"])
+
+    assert result.exit_code == 0
+    payload = json.loads(result.output)
+    assert payload["schema_version"] == 1
+    assert "summary" in payload
+
+
+def test_top_level_scan_data_boundaries_does_not_check_for_updates(
+    monkeypatch,
+    tmp_path,
+):
+    import sys
+
+    from openjarvis.cli import cli
+    from openjarvis.core.config import JarvisConfig
+
+    called = {"value": False}
+
+    def fake_check_for_updates(_subcommand):
+        called["value"] = True
+
+    monkeypatch.setattr(
+        "openjarvis.cli._version_check.check_for_updates",
+        fake_check_for_updates,
+    )
+    monkeypatch.setattr(
+        "openjarvis.cli.scan_cmd._load_data_boundary_config",
+        lambda: (JarvisConfig(), tmp_path, False, "", ""),
+    )
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["jarvis", "scan", "--data-boundaries", "--json"],
+    )
+
+    result = CliRunner().invoke(cli, ["scan", "--data-boundaries", "--json"])
+
+    assert result.exit_code == 0
+    assert called["value"] is False
+
+
+def test_update_check_skip_helper_is_precise():
+    from click import Command, Context
+
+    from openjarvis.cli import _should_skip_update_check
+
+    ctx = Context(Command("jarvis"))
+    ctx.invoked_subcommand = "scan"
+    assert _should_skip_update_check(ctx, ["scan", "--data-boundaries"])
+
+    ctx.invoked_subcommand = "ask"
+    assert not _should_skip_update_check(ctx, ["ask", "scan", "--data-boundaries"])
+
+
+def test_existing_scan_quick_text_still_works(monkeypatch):
+    monkeypatch.setattr(
+        PrivacyScanner,
+        "run_quick",
+        lambda self: [
+            ScanResult(
+                name="Cloud Sync Agents",
+                status="ok",
+                message="No cloud-sync agents detected.",
+                platform="all",
+            )
+        ],
+    )
+
+    result = CliRunner().invoke(scan, ["--quick"])
+
+    assert result.exit_code == 0
+    assert "OpenJarvis Security Scan" in result.output
+
+
+def test_data_boundary_loader_honors_openjarvis_config(
+    monkeypatch,
+    tmp_path,
+):
+    from openjarvis.cli import scan_cmd
+    from openjarvis.core.config import load_config
+
+    config_path = tmp_path / "custom.toml"
+    config_path.write_text(
+        "[telemetry]\nenabled = false\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("OPENJARVIS_CONFIG", str(config_path))
+    monkeypatch.setenv("OPENJARVIS_HOME", str(tmp_path / "home"))
+    load_config.cache_clear()
+
+    _config, _root, loaded, error, root_error = scan_cmd._load_data_boundary_config()
+
+    assert loaded is True
+    assert error == ""
+    assert root_error == ""
+
+
+def test_data_boundary_loader_reports_root_error(monkeypatch):
+    from openjarvis.cli import scan_cmd
+
+    monkeypatch.setattr(
+        "openjarvis.cli.scan_cmd.get_config_dir",
+        lambda: (_ for _ in ()).throw(RuntimeError("bad home")),
+    )
+
+    _config, root, loaded, error, root_error = scan_cmd._load_data_boundary_config()
+
+    assert root is None
+    assert loaded is False
+    assert error == ""
+    assert "bad home" in root_error
+
+
+def test_data_boundary_cli_reports_real_root_error_without_import_crash():
+    repo_root = Path(__file__).resolve().parents[2]
+    invalid_home = repo_root / ".invalid-openjarvis-home"
+    env = os.environ.copy()
+    env["OPENJARVIS_HOME"] = str(invalid_home)
+    env["PYTHONPATH"] = str(repo_root / "src")
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            "-c",
+            "from openjarvis.cli import main; main()",
+            "scan",
+            "--data-boundaries",
+            "--json",
+        ],
+        capture_output=True,
+        text=True,
+        env=env,
+        check=False,
+    )
+
+    assert result.returncode == 0, result.stderr
+    payload = json.loads(result.stdout)
+    assert payload["findings"][0]["id"] == "config-root-error"
+    assert str(invalid_home) not in result.stdout
+    assert str(repo_root) not in result.stdout

tests/cli/test_serve_persona.py

@@ -0,0 +1,129 @@
+"""Regression: ``jarvis serve`` must wire the ``SystemPromptBuilder`` into the
+agent it constructs, so SOUL.md / MEMORY.md / USER.md reach the model over HTTP.
+
+``cli/ask.py`` (and ``cli/chat_cmd.py`` and the managed-agent executor) have
+wired the builder since the persona system landed. The serve path never did, so
+an agent served over HTTP silently answered as a generic assistant — explicitly
+denying the persona — while the same agent via the CLI kept it. Found deploying
+a personal assistant: SOUL.md was correct on disk the whole time; no error, no
+warning.
+
+This test boots ``serve`` just far enough to capture the agent handed to
+``create_app`` and asserts the builder (and thus the persona content) is
+present. It fails on the unpatched serve path: ``agent._prompt_builder`` is
+``None``, so the persona files never reach the model.
+"""
+
+from __future__ import annotations
+
+import importlib
+from unittest.mock import MagicMock, patch
+
+import pytest
+from click.testing import CliRunner
+
+from openjarvis.cli import cli
+
+pytest.importorskip("fastapi")
+pytest.importorskip("uvicorn")
+
+# ``openjarvis.cli.serve`` as a package attribute resolves to the click
+# *command* (re-exported); grab the real module to monkeypatch its globals.
+serve_mod = importlib.import_module("openjarvis.cli.serve")
+
+
+def _fake_engine() -> MagicMock:
+    engine = MagicMock()
+    engine.list_models.return_value = ["test-model"]
+    engine.health.return_value = True
+    engine.name = "mock"
+    engine.engine_id = "mock"
+    return engine
+
+
+@pytest.mark.parametrize(
+    "agent_name",
+    ["simple", "orchestrator", "monitor_operative", "operative"],
+)
+def test_serve_wires_persona_builder_into_served_agent(
+    tmp_path, monkeypatch, agent_name
+):
+    """The agent built on the serve path must carry a SystemPromptBuilder whose
+    assembled prompt includes SOUL.md content (regression for the HTTP persona
+    loss)."""
+    from openjarvis.agents.monitor_operative import MonitorOperativeAgent
+    from openjarvis.agents.operative import OperativeAgent
+    from openjarvis.agents.orchestrator import OrchestratorAgent
+    from openjarvis.agents.simple import SimpleAgent
+    from openjarvis.core.config import JarvisConfig
+    from openjarvis.core.registry import AgentRegistry
+
+    # Persona file with a unique sentinel we can grep for in the built prompt.
+    soul = tmp_path / "SOUL.md"
+    soul.write_text("SERVE_PERSONA_SENTINEL", encoding="utf-8")
+
+    # conftest clears registries per-test; re-register the agent we exercise.
+    agent_classes = {
+        "simple": SimpleAgent,
+        "orchestrator": OrchestratorAgent,
+        "monitor_operative": MonitorOperativeAgent,
+        "operative": OperativeAgent,
+    }
+    if not AgentRegistry.contains(agent_name):
+        AgentRegistry.register_value(agent_name, agent_classes[agent_name])
+
+    config = JarvisConfig()
+    config.server.host = "127.0.0.1"
+    config.server.port = 8123
+    config.intelligence.default_model = "test-model"
+    config.memory_files.soul_path = str(soul)
+    # Keep the heavy optional subsystems off so we reach create_app cleanly.
+    config.telemetry.enabled = False
+    config.agent_manager.enabled = False
+    config.sessions.enabled = False
+    config.channel.enabled = False
+    config.skills.enabled = False
+    config.agent.context_from_memory = False
+
+    engine = _fake_engine()
+    monkeypatch.setattr(serve_mod, "load_config", lambda *a, **k: config)
+    monkeypatch.setattr(serve_mod, "get_engine", lambda *a, **k: ("mock", engine))
+    monkeypatch.setattr(serve_mod, "discover_engines", lambda *a, **k: {})
+    monkeypatch.setattr(serve_mod, "discover_models", lambda *a, **k: {})
+
+    # setup_security returns its own context; pass the engine straight through.
+    sec = MagicMock()
+    sec.engine = engine
+    sec.capability_policy = None
+    sec.audit_logger = None
+    monkeypatch.setattr("openjarvis.security.setup_security", lambda *a, **k: sec)
+
+    captured: dict = {}
+
+    def _capture_create_app(*args, **kwargs):
+        captured["agent"] = kwargs.get("agent")
+        return MagicMock(name="app")
+
+    with (
+        patch("openjarvis.server.app.create_app", side_effect=_capture_create_app),
+        patch("uvicorn.run", lambda *a, **k: None),
+    ):
+        result = CliRunner().invoke(
+            cli, ["serve", "--agent", agent_name], catch_exceptions=False
+        )
+
+    assert result.exit_code == 0, result.output
+    agent = captured.get("agent")
+    assert agent is not None, (
+        "serve did not construct an agent or never reached create_app; "
+        f"output:\n{result.output}"
+    )
+    # The regression: without the fix ``agent._prompt_builder`` is None and the
+    # persona files never reach the model over HTTP.
+    assert agent._prompt_builder is not None, (
+        f"serve constructed {agent_name} without a prompt_builder — SOUL.md / "
+        "MEMORY.md / USER.md would be silently dropped on the HTTP path."
+    )
+    assert "SERVE_PERSONA_SENTINEL" in agent._prompt_builder.build(), (
+        "prompt_builder is wired on serve, but its built prompt omits SOUL.md"
+    )

tests/cli/test_serve_tools.py

@@ -0,0 +1,53 @@
+"""Regression tests for tool selection during ``jarvis serve`` startup."""
+
+from __future__ import annotations
+
+import pytest
+
+from openjarvis.cli.serve import _resolve_allowed_tools
+from openjarvis.core.config import JarvisConfig
+
+
+@pytest.mark.parametrize(
+    "configured",
+    [
+        "code_interpreter,file_read",
+        ["code_interpreter", "file_read"],
+    ],
+)
+def test_tools_enabled_is_used_by_serve(configured):
+    config = JarvisConfig()
+    config.tools.enabled = configured
+
+    allowed, explicit = _resolve_allowed_tools(config)
+
+    assert allowed == {"code_interpreter", "file_read"}
+    assert explicit is True
+
+
+def test_tools_enabled_takes_precedence_over_legacy_agent_tools():
+    config = JarvisConfig()
+    config.tools.enabled = "file_read"
+    config.agent.tools = "calculator"
+
+    allowed, explicit = _resolve_allowed_tools(config)
+
+    assert allowed == {"file_read"}
+    assert explicit is True
+
+
+def test_agent_tools_remains_a_backward_compatible_fallback():
+    config = JarvisConfig()
+    config.agent.tools = "file_read"
+
+    allowed, explicit = _resolve_allowed_tools(config)
+
+    assert allowed == {"file_read"}
+    assert explicit is True
+
+
+def test_serve_defaults_tools_when_no_selection_is_configured():
+    allowed, explicit = _resolve_allowed_tools(JarvisConfig())
+
+    assert allowed == {"think", "calculator", "web_search"}
+    assert explicit is False

tests/deployment/test_desktop_network_policy.py

@@ -0,0 +1,34 @@
+"""Regression guards for the desktop app's outbound network policy."""
+
+from __future__ import annotations
+
+import json
+import plistlib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent.parent
+TAURI_CONFIG = ROOT / "frontend" / "src-tauri" / "tauri.conf.json"
+MACOS_INFO_PLIST = ROOT / "frontend" / "src-tauri" / "Info.plist"
+
+
+def _csp_sources(directive: str) -> set[str]:
+    config = json.loads(TAURI_CONFIG.read_text(encoding="utf-8"))
+    csp = config["app"]["security"]["csp"]
+    directives = {
+        parts[0]: set(parts[1:]) for item in csp.split(";") if (parts := item.split())
+    }
+    return directives[directive]
+
+
+def test_desktop_csp_allows_remote_api_servers() -> None:
+    """The user-configured API URL may point beyond localhost (#649)."""
+    connect_sources = _csp_sources("connect-src")
+
+    assert {"http:", "https:", "ws:", "wss:"} <= connect_sources
+
+
+def test_macos_webview_allows_user_configured_http_servers() -> None:
+    """CSP alone cannot override App Transport Security for public hosts."""
+    info = plistlib.loads(MACOS_INFO_PLIST.read_bytes())
+
+    assert info["NSAppTransportSecurity"]["NSAllowsArbitraryLoadsInWebContent"] is True

tests/evals/datasets/test_taubench.py

@@ -0,0 +1,98 @@
+"""Tests for the TauBench optional dependency boundary."""
+
+from __future__ import annotations
+
+import builtins
+import sys
+from types import ModuleType
+from unittest.mock import Mock
+
+import pytest
+
+from openjarvis.evals.datasets import taubench
+
+
+def _mock_direct_url(monkeypatch, direct_url):
+    distribution = Mock()
+    distribution.read_text.return_value = direct_url
+    monkeypatch.setattr(
+        taubench.metadata, "distribution", Mock(return_value=distribution)
+    )
+
+
+def test_ensure_tau2_accepts_the_pinned_source_revision(monkeypatch):
+    monkeypatch.setitem(sys.modules, "tau2", ModuleType("tau2"))
+    _mock_direct_url(
+        monkeypatch,
+        (
+            '{"url": "https://github.com/sierra-research/tau2-bench.git", '
+            '"vcs_info": {"vcs": "git", '
+            f'"commit_id": "{taubench.TAU2_REVISION}"}}}}'
+        ),
+    )
+
+    taubench._ensure_tau2()
+
+
+def test_ensure_tau2_requires_explicit_pinned_install(monkeypatch):
+    monkeypatch.setitem(sys.modules, "tau2", None)
+    monkeypatch.setattr(
+        taubench.metadata,
+        "distribution",
+        Mock(side_effect=taubench.metadata.PackageNotFoundError),
+    )
+
+    with pytest.raises(ImportError) as exc_info:
+        taubench._ensure_tau2()
+
+    message = str(exc_info.value)
+    assert "does not install at runtime" in message
+    assert taubench.TAU2_REVISION in message
+    assert "uv pip install" in message
+
+
+@pytest.mark.parametrize(
+    "direct_url",
+    [
+        # Editable install left behind by the previous runtime installer.
+        '{"url": "file:///home/user/.openjarvis/cache/tau2-bench", '
+        '"dir_info": {"editable": true}}',
+        # A git install from an arbitrary upstream revision.
+        '{"url": "https://github.com/sierra-research/tau2-bench.git", '
+        '"vcs_info": {"vcs": "git", "commit_id": "deadbeef"}}',
+        # Registry installs do not carry PEP 610 direct-origin metadata.
+        None,
+    ],
+)
+def test_ensure_tau2_rejects_unpinned_install(monkeypatch, direct_url):
+    _mock_direct_url(monkeypatch, direct_url)
+    original_import = builtins.__import__
+
+    def guarded_import(name, *args, **kwargs):
+        if name == "tau2":
+            raise AssertionError("unverified tau2 package was imported")
+        return original_import(name, *args, **kwargs)
+
+    monkeypatch.setattr(builtins, "__import__", guarded_import)
+
+    with pytest.raises(ImportError) as exc_info:
+        taubench._ensure_tau2()
+
+    message = str(exc_info.value)
+    assert "does not match" in message
+    assert taubench.TAU2_REVISION in message
+    assert "--force-reinstall" in message
+
+
+def test_verify_requirements_reports_install_instruction(monkeypatch):
+    monkeypatch.setitem(sys.modules, "tau2", None)
+    monkeypatch.setattr(
+        taubench.metadata,
+        "distribution",
+        Mock(side_effect=taubench.metadata.PackageNotFoundError),
+    )
+
+    issues = taubench.TauBenchDataset().verify_requirements()
+
+    assert len(issues) == 1
+    assert taubench.TAU2_REVISION in issues[0]

tests/memory/test_context.py

@@ -7,6 +7,7 @@ from typing import Any, Dict, List, Optional
 
 from openjarvis.core.events import EventBus, EventType
 from openjarvis.core.types import Message, Role
+from openjarvis.memory.store import Fact
 from openjarvis.tools.storage._stubs import MemoryBackend, RetrievalResult
 from openjarvis.tools.storage.context import (
     ContextConfig,
@@ -167,6 +168,113 @@ def test_inject_context_no_results_returns_original():
     assert augmented is messages
 
 
+def test_inject_context_adds_auto_memory_facts_without_backend():
+    messages = [Message(role=Role.USER, content="What is my favorite color?")]
+    facts = [Fact(text="The user's favorite color is blue", source="auto")]
+
+    augmented = inject_context("favorite color", messages, None, facts=facts)
+
+    assert len(augmented) == 2
+    assert augmented[0].role == Role.SYSTEM
+    assert "remembered from prior conversations" in augmented[0].content
+    assert "favorite color is blue" in augmented[0].content
+
+
+def test_inject_context_prioritizes_newest_facts_within_token_budget():
+    messages = [Message(role=Role.USER, content="What do you remember?")]
+    facts = [
+        Fact(text="old fact uses four tokens"),
+        Fact(text="new fact uses four tokens"),
+    ]
+
+    augmented = inject_context(
+        "remember",
+        messages,
+        None,
+        config=ContextConfig(max_context_tokens=5),
+        facts=facts,
+    )
+
+    assert "new fact uses four tokens" in augmented[0].content
+    assert "old fact uses four tokens" not in augmented[0].content
+
+
+def test_inject_context_merges_with_existing_system_message():
+    messages = [
+        Message(role=Role.SYSTEM, content="You are OpenJarvis."),
+        Message(role=Role.USER, content="What is my favorite color?"),
+    ]
+    facts = [Fact(text="The user's favorite color is blue")]
+
+    augmented = inject_context("favorite color", messages, None, facts=facts)
+
+    system_messages = [m for m in augmented if m.role == Role.SYSTEM]
+    assert len(system_messages) == 1
+    assert "You are OpenJarvis." in system_messages[0].content
+    assert "favorite color is blue" in system_messages[0].content
+    assert messages[0].content == "You are OpenJarvis."
+
+
+def test_inject_context_collapses_multiple_system_messages():
+    messages = [
+        Message(role=Role.SYSTEM, content="Identity."),
+        Message(role=Role.SYSTEM, content="Persona."),
+        Message(role=Role.USER, content="What do you remember?"),
+    ]
+
+    augmented = inject_context(
+        "remember",
+        messages,
+        None,
+        facts=[Fact(text="User likes jazz")],
+    )
+
+    system_messages = [m for m in augmented if m.role == Role.SYSTEM]
+    assert len(system_messages) == 1
+    assert "Identity." in system_messages[0].content
+    assert "Persona." in system_messages[0].content
+    assert "User likes jazz" in system_messages[0].content
+
+
+def test_inject_context_reserves_budget_for_retrieved_documents():
+    backend = _FakeMemory(
+        [RetrievalResult(content="d1 d2 d3 d4 d5", score=1.0, source="doc")]
+    )
+    facts = [
+        Fact(text="old1 old2 old3 old4 old5"),
+        Fact(text="new1 new2 new3 new4 new5"),
+    ]
+
+    augmented = inject_context(
+        "query",
+        [Message(role=Role.USER, content="query")],
+        backend,
+        config=ContextConfig(max_context_tokens=10),
+        facts=facts,
+    )
+
+    assert "new1 new2 new3 new4 new5" in augmented[0].content
+    assert "d1 d2 d3 d4 d5" in augmented[0].content
+    assert "old1 old2 old3 old4 old5" not in augmented[0].content
+
+
+def test_inject_context_prefers_large_document_that_fits_total_budget():
+    backend = _FakeMemory(
+        [RetrievalResult(content="d1 d2 d3 d4 d5 d6 d7 d8", score=1.0)]
+    )
+
+    augmented = inject_context(
+        "query",
+        [Message(role=Role.USER, content="query")],
+        backend,
+        config=ContextConfig(max_context_tokens=10),
+        facts=[Fact(text="f1 f2 f3 f4 f5")],
+    )
+
+    assert "d1 d2 d3 d4 d5 d6 d7 d8" in augmented[0].content
+    assert "f1 f2 f3 f4 f5" not in augmented[0].content
+
+
 def test_inject_context_publishes_event():
     bus = EventBus(record_history=True)
     results = [

tests/memory/test_fact_store.py

@@ -7,7 +7,11 @@ import json
 import pytest
 
 from openjarvis.core.registry import FactStoreRegistry
-from openjarvis.memory.store import LocalFactStore, create_fact_store
+from openjarvis.memory.store import (
+    LocalFactStore,
+    create_fact_store,
+    load_configured_facts,
+)
 
 
 def test_add_and_list(tmp_path):
@@ -145,3 +149,28 @@ def test_create_fact_store_default_path_uses_openjarvis_home(tmp_path, monkeypat
 def test_create_fact_store_unknown_backend(tmp_path):
     with pytest.raises(ValueError):
         create_fact_store("cloud", path=tmp_path / "f.jsonl")
+
+
+def test_load_configured_facts_reads_enabled_store(tmp_path):
+    from types import SimpleNamespace
+
+    path = tmp_path / "facts.jsonl"
+    LocalFactStore(path).add("User likes jazz", source="auto")
+    config = SimpleNamespace(
+        memory=SimpleNamespace(
+            enabled=True,
+            backend="local",
+            facts_path=str(path),
+            max_facts=1000,
+        )
+    )
+
+    assert [fact.text for fact in load_configured_facts(config)] == ["User likes jazz"]
+
+
+def test_load_configured_facts_skips_disabled_memory():
+    from types import SimpleNamespace
+
+    config = SimpleNamespace(memory=SimpleNamespace(enabled=False))
+
+    assert load_configured_facts(config) == []

tests/sdk/test_sdk.py

@@ -95,6 +95,30 @@ class TestJarvisAsk:
             assert result == "Agent response"
             j.close()
 
+    def test_ask_with_agent_wires_persona(self, tmp_path):
+        from openjarvis.agents.simple import SimpleAgent
+        from openjarvis.core.registry import AgentRegistry
+
+        soul = tmp_path / "SOUL.md"
+        soul.write_text("SDK_PERSONA_SENTINEL", encoding="utf-8")
+
+        cfg = JarvisConfig()
+        cfg.memory_files.soul_path = str(soul)
+        cfg.memory_files.memory_path = ""
+        cfg.memory_files.user_path = ""
+        cfg.agent.context_from_memory = False
+
+        if not AgentRegistry.contains("simple"):
+            AgentRegistry.register_value("simple", SimpleAgent)
+
+        engine = _make_engine()
+        with patch("openjarvis.sdk.get_engine", return_value=("mock", engine)):
+            j = Jarvis(config=cfg, model="test-model")
+            j.ask("Hello", agent="simple")
+            messages = engine.generate.call_args.args[0]
+            assert "SDK_PERSONA_SENTINEL" in messages[0].content
+            j.close()
+
     def test_ask_no_engine_raises(self):
         with patch("openjarvis.sdk.get_engine", return_value=None):
             j = Jarvis(config=JarvisConfig())

tests/server/test_agent_manager_routes.py

@@ -605,6 +605,39 @@ class TestLightweightSystemEngineResolution:
         )
         assert captured["key"] == "llamacpp"
 
+    def test_instrumented_engine_uses_runtime_event_bus(self, monkeypatch):
+        pytest.importorskip("fastapi")
+        from openjarvis.core.events import EventBus
+        from openjarvis.server import agent_manager_routes as amr
+        from openjarvis.telemetry import instrumented_engine
+
+        resolved_engine = MagicMock()
+        wrapped_engine = MagicMock()
+        runtime_bus = EventBus()
+        runtime = SimpleNamespace(
+            bus=runtime_bus,
+            memory_backend=object(),
+            channel_backend=None,
+            channel_bridge=None,
+            knowledge_db_path=None,
+        )
+        monkeypatch.setattr(
+            "openjarvis.engine._discovery.get_engine",
+            MagicMock(return_value=("resolved", resolved_engine)),
+        )
+        instrumented = MagicMock(return_value=wrapped_engine)
+        monkeypatch.setattr(instrumented_engine, "InstrumentedEngine", instrumented)
+
+        system = amr._make_lightweight_system(
+            engine=MagicMock(),
+            model="m",
+            config=self._cfg("vllm", "ollama"),
+            runtime=runtime,
+        )
+
+        instrumented.assert_called_once_with(resolved_engine, runtime_bus)
+        assert system.engine is wrapped_engine
+
     def test_caches_tool_memory_backend_when_prompt_context_is_disabled(
         self,
         monkeypatch,

tests/server/test_cloud_router.py

@@ -0,0 +1,49 @@
+"""Regression tests for OpenRouter model ID normalization."""
+
+from __future__ import annotations
+
+import pytest
+
+from openjarvis.core.types import Message
+from openjarvis.server import cloud_router
+
+
+def test_get_provider_detects_bare_openrouter_id():
+    assert cloud_router.get_provider("anthropic/claude-haiku-4.5") == "openrouter"
+
+
+def test_get_provider_detects_litellm_prefixed_openrouter_id():
+    model = "openrouter/anthropic/claude-haiku-4.5"
+    assert cloud_router.get_provider(model) == "openrouter"
+
+
+@pytest.mark.parametrize(
+    "requested_model,expected_forwarded_model",
+    [
+        ("anthropic/claude-haiku-4.5", "anthropic/claude-haiku-4.5"),
+        ("openrouter/anthropic/claude-haiku-4.5", "anthropic/claude-haiku-4.5"),
+        ("openrouter/auto", "openrouter/auto"),
+    ],
+)
+@pytest.mark.asyncio
+async def test_stream_cloud_normalizes_openrouter_model_before_forwarding(
+    monkeypatch, requested_model, expected_forwarded_model
+):
+    monkeypatch.setenv("OPENROUTER_API_KEY", "test-key")
+    captured: dict[str, str] = {}
+
+    async def fake_stream_openai(model, messages, temperature, max_tokens, **kwargs):
+        captured["model"] = model
+        yield "ok"
+
+    monkeypatch.setattr(cloud_router, "_stream_openai", fake_stream_openai)
+
+    tokens = [
+        token
+        async for token in cloud_router.stream_cloud(
+            requested_model, [Message(role="user", content="hi")]
+        )
+    ]
+
+    assert tokens == ["ok"]
+    assert captured["model"] == expected_forwarded_model

tests/server/test_model_management.py

@@ -213,6 +213,7 @@ class TestStreamingResilience:
         engine = _make_engine()
         agent = MagicMock()
         agent.agent_id = "simple"
+        agent._tools = []
         agent.run.return_value = AgentResult(
             content="agent response",
             turns=1,

tests/server/test_routes.py

@@ -11,6 +11,7 @@ fastapi = pytest.importorskip("fastapi")
 from fastapi.testclient import TestClient  # noqa: E402
 
 from openjarvis.core.events import EventBus, EventType  # noqa: E402
+from openjarvis.core.types import Role  # noqa: E402
 from openjarvis.server.app import create_app  # noqa: E402
 
 # ---------------------------------------------------------------------------
@@ -534,6 +535,94 @@ class TestChatCompletions:
                     content += delta_content
         assert content == "Hello world"
 
+    def test_streaming_without_client_tools_uses_configured_agent(self):
+        """Server-side tools remain available to streaming web clients (#735)."""
+        from openjarvis.agents.orchestrator import OrchestratorAgent
+        from openjarvis.core.types import ToolResult
+        from openjarvis.tools._stubs import BaseTool, ToolSpec
+
+        executions: list[str] = []
+
+        class _FileReadTool(BaseTool):
+            @property
+            def spec(self):
+                return ToolSpec(
+                    name="file_read",
+                    description="Read a file",
+                    parameters={
+                        "type": "object",
+                        "properties": {"path": {"type": "string"}},
+                    },
+                )
+
+            def execute(self, **params):
+                executions.append(params["path"])
+                return ToolResult(
+                    tool_name="file_read",
+                    content="README fixture contents",
+                    success=True,
+                )
+
+        engine = _make_engine(content="ENGINE BYPASS")
+        engine.generate.side_effect = [
+            {
+                "content": "",
+                "tool_calls": [
+                    {
+                        "id": "call_1",
+                        "name": "file_read",
+                        "arguments": '{"path": "README.md"}',
+                    }
+                ],
+                "usage": {},
+            },
+            {
+                "content": "README fixture contents",
+                "finish_reason": "stop",
+                "usage": {},
+            },
+        ]
+        agent = OrchestratorAgent(
+            engine,
+            "test-model",
+            tools=[_FileReadTool()],
+            bus=EventBus(),
+            max_turns=3,
+            temperature=0.7,
+            max_tokens=128,
+            system_prompt="Use the configured tools.",
+        )
+        app = create_app(
+            engine,
+            "test-model",
+            agent=agent,
+            bus=EventBus(),
+            config=_test_config(),
+        )
+        client = TestClient(app)
+
+        resp = client.post(
+            "/v1/chat/completions",
+            json={
+                "model": "test-model",
+                "messages": [{"role": "user", "content": "Read README.md"}],
+                "stream": True,
+            },
+        )
+
+        assert resp.status_code == 200
+        content = ""
+        for line in resp.text.strip().split("\n"):
+            if not line.startswith("data:") or "[DONE]" in line:
+                continue
+            data = json.loads(line[5:].strip())
+            delta = data.get("choices", [{}])[0].get("delta", {})
+            content += delta.get("content") or ""
+
+        assert content == "README fixture contents"
+        assert executions == ["README.md"]
+        assert engine.generate.call_count == 2
+
     def test_streaming_with_tools_emits_tool_calls_and_bypasses_agent(self):
         """Regression for the streaming analog of #414.
 
@@ -758,6 +847,47 @@ class TestIdentityPromptInjection:
         assert len(system_msgs) == 1
         assert system_msgs[0].content == "Be terse."
 
+    def test_stream_uses_grounded_agent_result_without_replay(self):
+        """Regression for #734: web streaming emits the agent's final answer."""
+        from openjarvis.core.events import EventBus
+
+        captured: list = []
+        engine = _make_capturing_engine(captured)
+        agent = _make_agent(content="My name is Jarvis Prime.")
+        agent._tools = [object()]
+        agent._engine = engine
+        client = TestClient(
+            create_app(
+                engine,
+                "test-model",
+                agent=agent,
+                bus=EventBus(),
+                config=_identity_config(),
+            )
+        )
+
+        resp = client.post(
+            "/v1/chat/completions",
+            json={
+                "model": "test-model",
+                "messages": [{"role": "user", "content": "who are you?"}],
+                "stream": True,
+            },
+        )
+
+        assert resp.status_code == 200
+        streamed_content = ""
+        for line in resp.text.splitlines():
+            if not line.startswith("data: {"):
+                continue
+            payload = json.loads(line.removeprefix("data: "))
+            choices = payload.get("choices", [])
+            if choices and choices[0]["delta"].get("content"):
+                streamed_content += choices[0]["delta"]["content"]
+        assert streamed_content == "My name is Jarvis Prime."
+        assert captured == []
+        agent.run.assert_called_once()
+
     def test_direct_injects_identity_when_absent(self):
         captured: list = []
         engine = _make_capturing_engine(captured)
@@ -798,6 +928,101 @@ class TestIdentityPromptInjection:
         assert len(system_msgs) == 1
         assert system_msgs[0].content == "Be terse."
 
+    def test_direct_merges_identity_and_auto_memory_into_one_system_message(self):
+        from openjarvis.memory.store import Fact
+
+        class _MemoryService:
+            def list_facts(self):
+                return [Fact(text="The user's favorite color is blue")]
+
+        captured: list = []
+        engine = _make_capturing_engine(captured)
+        cfg = _identity_config()
+        cfg.agent.context_from_memory = True
+        client = TestClient(
+            create_app(
+                engine,
+                "test-model",
+                config=cfg,
+                memory_service=_MemoryService(),
+            )
+        )
+
+        resp = client.post(
+            "/v1/chat/completions",
+            json={
+                "model": "test-model",
+                "messages": [{"role": "user", "content": "What is my favorite color?"}],
+            },
+        )
+
+        assert resp.status_code == 200
+        messages = engine.generate.call_args.args[0]
+        system_messages = [m for m in messages if m.role == Role.SYSTEM]
+        assert len(system_messages) == 1
+        assert "OpenJarvis" in system_messages[0].content
+        assert "favorite color is blue" in system_messages[0].content
+
+    def test_memory_context_preserves_assistant_tool_calls(self):
+        from openjarvis.memory.store import Fact
+
+        class _MemoryService:
+            def list_facts(self):
+                return [Fact(text="User likes jazz")]
+
+        captured: list = []
+        engine = _make_capturing_engine(captured)
+        cfg = _identity_config()
+        cfg.agent.context_from_memory = True
+        client = TestClient(
+            create_app(
+                engine,
+                "test-model",
+                config=cfg,
+                memory_service=_MemoryService(),
+            )
+        )
+
+        resp = client.post(
+            "/v1/chat/completions",
+            json={
+                "model": "test-model",
+                "messages": [
+                    {"role": "user", "content": "Run the lookup"},
+                    {
+                        "role": "assistant",
+                        "content": "",
+                        "tool_calls": [
+                            {
+                                "id": "call_1",
+                                "type": "function",
+                                "function": {
+                                    "name": "lookup",
+                                    "arguments": '{"query":"jazz"}',
+                                },
+                            }
+                        ],
+                    },
+                    {
+                        "role": "tool",
+                        "content": "result",
+                        "tool_call_id": "call_1",
+                    },
+                    {"role": "user", "content": "What did it find?"},
+                ],
+            },
+        )
+
+        assert resp.status_code == 200
+        messages = engine.generate.call_args.args[0]
+        assistant = next(
+            message for message in messages if message.role == Role.ASSISTANT
+        )
+        assert assistant.tool_calls is not None
+        assert assistant.tool_calls[0].id == "call_1"
+        assert assistant.tool_calls[0].name == "lookup"
+        assert assistant.tool_calls[0].arguments == '{"query":"jazz"}'
+
     def test_direct_injects_soul_persona_when_present(self, tmp_path):
         """Regression: /v1/chat/completions previously injected only the bare
         ``default_system_prompt`` blurb via a hand-rolled lookup, bypassing

tests/server/test_stream_bridge.py

@@ -1,6 +1,68 @@
-import json
+"""Regression tests for streaming completed agent responses."""
 
-from openjarvis.server.stream_bridge import AgentStreamBridge
+from __future__ import annotations
+
+import asyncio
+import json
+from unittest.mock import MagicMock
+
+import pytest
+
+pytest.importorskip("fastapi")
+
+from openjarvis.agents._stubs import AgentResult  # noqa: E402
+from openjarvis.core.events import EventBus  # noqa: E402
+from openjarvis.core.types import ToolResult  # noqa: E402
+from openjarvis.server.models import ChatCompletionRequest  # noqa: E402
+from openjarvis.server.stream_bridge import AgentStreamBridge  # noqa: E402
+
+
+def _streamed_content(events: list[str]) -> str:
+    """Join assistant content from OpenAI-compatible data chunks."""
+    content = []
+    for event in events:
+        if not event.startswith("data: {"):
+            continue
+        payload = json.loads(event.removeprefix("data: ").strip())
+        choices = payload.get("choices")
+        if choices and choices[0]["delta"].get("content"):
+            content.append(choices[0]["delta"]["content"])
+    return "".join(content)
+
+
+def test_stream_replays_grounded_agent_result_without_second_inference():
+    grounded_content = "My name is Jarvis. The tool reports 72 degrees."
+    agent = MagicMock()
+    agent._model = "configured-model"
+    agent.run.return_value = AgentResult(
+        content=grounded_content,
+        tool_results=[
+            ToolResult(tool_name="weather", content="72 degrees", success=True)
+        ],
+        metadata={"prompt_tokens": 10, "completion_tokens": 12, "total_tokens": 22},
+    )
+
+    async def ungrounded_replay(*args, **kwargs):
+        raise AssertionError("stream_full must not run after agent.run")
+        yield  # pragma: no cover
+
+    agent._engine.stream_full = ungrounded_replay
+    request = ChatCompletionRequest(
+        model="requested-model",
+        messages=[{"role": "user", "content": "Who are you, and what's outside?"}],
+        stream=True,
+    )
+    bridge = AgentStreamBridge(agent, EventBus(), request.model, request)
+
+    async def collect_events() -> list[str]:
+        return [event async for event in bridge.stream()]
+
+    events = asyncio.run(collect_events())
+
+    assert _streamed_content(events) == grounded_content
+    assert any(event.startswith("event: tool_results\n") for event in events)
+    agent.run.assert_called_once()
+    assert agent._model == "configured-model"
 
 
 def test_tool_call_start_serializes_arguments_for_sse_without_mutating_event():

tests/server/test_ws_bridge.py

@@ -3,8 +3,10 @@
 from __future__ import annotations
 
 import asyncio
+import threading
 import time
 from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
 
 import pytest
 
@@ -161,3 +163,91 @@ class TestWSBridge:
             ]
 
         asyncio.run(exercise())
+
+
+class TestIncludeAllRoutesBusWiring:
+    """Regression: the WS endpoint must subscribe on the same EventBus that
+    channels/agents actually publish to (app.state.bus), not the unrelated
+    get_event_bus() global singleton — publishing on the latter used to
+    silently never reach any connected browser client."""
+
+    def test_uses_app_state_bus_not_global_singleton(self):
+        from openjarvis.core.events import reset_event_bus
+        from openjarvis.server.api_routes import include_all_routes
+
+        reset_event_bus()  # isolate from other tests' global singleton state
+        app = FastAPI()
+        real_bus = EventBus()
+        app.state.bus = real_bus
+        include_all_routes(app)
+
+        client = TestClient(app)
+        with client.websocket_connect("/v1/agents/events") as ws:
+            real_bus.publish(EventType.AGENT_TICK_START, {"agent_id": "test-123"})
+            time.sleep(0.05)
+            data = ws.receive_json()
+            assert data["data"]["agent_id"] == "test-123"
+
+    @pytest.mark.parametrize(
+        ("path", "payload"),
+        [
+            ("/v1/managed-agents/test-123/run", None),
+            (
+                "/v1/managed-agents/test-123/messages",
+                {"content": "run now", "mode": "immediate", "stream": False},
+            ),
+        ],
+    )
+    def test_managed_agent_run_paths_publish_to_app_bus(self, path, payload):
+        from openjarvis.agents.executor import AgentExecutor
+        from openjarvis.core.events import reset_event_bus
+        from openjarvis.server.api_routes import include_all_routes
+
+        reset_event_bus()
+        app_bus = EventBus()
+        manager = MagicMock()
+        manager.get_agent.return_value = {
+            "id": "test-123",
+            "name": "test",
+            "status": "idle",
+            "config": {},
+        }
+        manager.send_message.return_value = {
+            "id": "message-123",
+            "agent_id": "test-123",
+            "content": "run now",
+            "mode": "immediate",
+        }
+
+        app = FastAPI()
+        app.state.bus = app_bus
+        app.state.agent_manager = manager
+        include_all_routes(app)
+
+        executed = threading.Event()
+        observed_buses = []
+
+        def publish_tick(executor, agent_id, **_kwargs):
+            observed_buses.append(executor._bus)
+            executor._bus.publish(EventType.AGENT_TICK_START, {"agent_id": agent_id})
+            executed.set()
+
+        client = TestClient(app)
+        with (
+            patch.object(AgentExecutor, "execute_tick", publish_tick),
+            patch(
+                "openjarvis.server.agent_manager_routes._make_lightweight_system",
+                return_value=MagicMock(),
+            ) as make_system,
+            client.websocket_connect("/v1/agents/events?agent_id=test-123") as ws,
+        ):
+            request_kwargs = {"json": payload} if payload is not None else {}
+            response = client.post(path, **request_kwargs)
+            assert response.status_code == 200
+            assert executed.wait(timeout=1)
+            assert observed_buses == [app_bus]
+            data = ws.receive_json()
+
+        assert data["type"] == "agent_tick_start"
+        assert data["data"]["agent_id"] == "test-123"
+        make_system.assert_called_once()

tests/test_orchestrator_learning/test_orchestrator_structured.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import pytest
+
 from openjarvis.agents.orchestrator import OrchestratorAgent
 from openjarvis.core.types import ToolResult
 from openjarvis.engine._stubs import InferenceEngine
@@ -18,8 +20,10 @@ class _MockEngine(InferenceEngine):
     def __init__(self, responses: list[str]) -> None:
         self._responses = list(responses)
         self._call_idx = 0
+        self.calls = []
 
     def generate(self, messages, **kwargs) -> dict:
+        self.calls.append(list(messages))
         if self._call_idx < len(self._responses):
             content = self._responses[self._call_idx]
             self._call_idx += 1
@@ -58,6 +62,109 @@ class _MockTool(BaseTool):
         return ToolResult(tool_name="calculator", content=str(expr), success=True)
 
 
+class _FileReadLikeTool(BaseTool):
+    """Small test double with one required and one optional parameter."""
+
+    tool_id = "file_read"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(
+            name="file_read",
+            description="Read a file",
+            parameters={
+                "type": "object",
+                "properties": {
+                    "path": {"type": "string"},
+                    "max_lines": {"type": "integer"},
+                },
+                "required": ["path"],
+            },
+        )
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(
+            tool_name="file_read",
+            content=params.get("path", ""),
+            success=True,
+        )
+
+
+class _AmbiguousTool(BaseTool):
+    """Test double whose bare input cannot map to one parameter safely."""
+
+    tool_id = "copy"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(
+            name="copy",
+            description="Copy a value",
+            parameters={
+                "type": "object",
+                "properties": {
+                    "source": {"type": "string"},
+                    "destination": {"type": "string"},
+                },
+                "required": ["source", "destination"],
+            },
+        )
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(tool_name="copy", content="copied", success=True)
+
+
+class _CodeLikeTool(BaseTool):
+    """Test double that explicitly accepts object-prefixed source text."""
+
+    tool_id = "code"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(
+            name="code",
+            description="Execute source code",
+            parameters={
+                "type": "object",
+                "properties": {"code": {"type": "string"}},
+                "required": ["code"],
+            },
+            metadata={"structured_allow_object_text": True},
+        )
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(
+            tool_name="code",
+            content=params.get("code", ""),
+            success=True,
+        )
+
+
+class _UnionStringTool(BaseTool):
+    """Test double with a JSON Schema union that accepts strings."""
+
+    tool_id = "union_file_read"
+
+    @property
+    def spec(self) -> ToolSpec:
+        return ToolSpec(
+            name="union_file_read",
+            description="Read a nullable path",
+            parameters={
+                "type": "object",
+                "properties": {"path": {"type": ["string", "null"]}},
+                "required": ["path"],
+            },
+        )
+
+    def execute(self, **params) -> ToolResult:
+        return ToolResult(
+            tool_name="union_file_read",
+            content=params.get("path", ""),
+            success=True,
+        )
+
+
 # -- Tests -------------------------------------------------------------------
 
 
@@ -80,6 +187,207 @@ class TestStructuredMode:
         assert result.content == "4"
         assert result.turns == 2
         assert len(result.tool_results) == 1
+        assert result.tool_results[0].success is True
+        assert result.tool_results[0].content == "2+2"
+
+    @pytest.mark.parametrize(
+        ("raw_input", "expected"),
+        [
+            ("notes/today.md", "notes/today.md"),
+            ('"notes/today.md"', "notes/today.md"),
+            ('{"path": "notes/today.md"}', "notes/today.md"),
+            ("42", "42"),
+            ("true", "true"),
+            ("false", "false"),
+            ("null", "null"),
+            ("1e3", "1e3"),
+            ('["notes/today.md"]', '["notes/today.md"]'),
+            ('["notes/today.md",]', '["notes/today.md",]'),
+            ("[draft] notes.md", "[draft] notes.md"),
+            (
+                "[x * 2 for x in range(3)]",
+                "[x * 2 for x in range(3)]",
+            ),
+            ('"notes/today.md', '"notes/today.md'),
+            ('""', ""),
+            ('"{draft} notes.md"', "{draft} notes.md"),
+            (r'"C:\\Users\\me\\notes.txt"', r"C:\Users\me\notes.txt"),
+        ],
+    )
+    def test_single_string_parameter_accepts_text_input(self, raw_input, expected):
+        """Structured text maps to the unambiguous string parameter."""
+        engine = _MockEngine(
+            [
+                f"TOOL: file_read\nINPUT: {raw_input}",
+                "FINAL_ANSWER: done",
+            ]
+        )
+        agent = OrchestratorAgent(
+            engine=engine,
+            model="test",
+            tools=[_FileReadLikeTool()],
+            mode="structured",
+        )
+
+        result = agent.run("Read my notes")
+
+        assert result.tool_results[0].success is True
+        assert result.tool_results[0].content == expected
+
+    @pytest.mark.parametrize(
+        "raw_input",
+        [
+            '{"path": "notes/today.md",}',
+            '{path: "notes/today.md"}',
+            "{'path': 'notes/today.md'}",
+            '{"unknown": 1, "path": "notes/today.md",}',
+            r'{"pa\u0074h": "notes/today.md",}',
+            '\ufeff{"path": "notes/today.md",}',
+        ],
+    )
+    def test_malformed_json_like_input_remains_an_argument_error(self, raw_input):
+        """Malformed JSON-looking text is not reclassified as a tool value."""
+        engine = _MockEngine(
+            [
+                f"TOOL: file_read\nINPUT: {raw_input}",
+                "FINAL_ANSWER: done",
+            ]
+        )
+        agent = OrchestratorAgent(
+            engine=engine,
+            model="test",
+            tools=[_FileReadLikeTool()],
+            mode="structured",
+        )
+
+        result = agent.run("Read my notes")
+
+        assert result.tool_results[0].success is False
+        assert "Invalid arguments JSON" in result.tool_results[0].content
+        assert "Tool 'file_read' failed: Invalid arguments JSON" in (
+            engine.calls[1][-1].content
+        )
+
+    @pytest.mark.parametrize(
+        "raw_input",
+        [
+            "{'code': value}",
+            '{"code": object()}',
+            "{'nested': {'value': 1}}",
+        ],
+    )
+    def test_opted_in_tool_accepts_object_prefixed_text(self, raw_input):
+        """Explicit raw-text metadata disambiguates dict-shaped source code."""
+        engine = _MockEngine(
+            [
+                f"TOOL: code\nINPUT: {raw_input}",
+                "FINAL_ANSWER: done",
+            ]
+        )
+        agent = OrchestratorAgent(
+            engine=engine,
+            model="test",
+            tools=[_CodeLikeTool()],
+            mode="structured",
+        )
+
+        result = agent.run("Execute code")
+
+        assert result.tool_results[0].success is True
+        assert result.tool_results[0].content == raw_input
+
+    def test_valid_object_remains_arguments_for_opted_in_tool(self):
+        """Raw-text metadata does not override valid JSON argument objects."""
+        engine = _MockEngine(
+            [
+                'TOOL: code\nINPUT: {"code": "print(1)"}',
+                "FINAL_ANSWER: done",
+            ]
+        )
+        agent = OrchestratorAgent(
+            engine=engine,
+            model="test",
+            tools=[_CodeLikeTool()],
+            mode="structured",
+        )
+
+        result = agent.run("Execute code")
+
+        assert result.tool_results[0].success is True
+        assert result.tool_results[0].content == "print(1)"
+
+    def test_union_string_schema_accepts_json_scalar_text(self):
+        """String unions normalize text that also parses as a JSON scalar."""
+        engine = _MockEngine(
+            [
+                "TOOL: union_file_read\nINPUT: null",
+                "FINAL_ANSWER: done",
+            ]
+        )
+        agent = OrchestratorAgent(
+            engine=engine,
+            model="test",
+            tools=[_UnionStringTool()],
+            mode="structured",
+        )
+
+        result = agent.run("Read the path named null")
+
+        assert result.tool_results[0].success is True
+        assert result.tool_results[0].content == "null"
+
+    def test_ambiguous_json_scalar_gets_stable_object_error(self):
+        """Ambiguous valid JSON is rejected before tool dispatch."""
+        engine = _MockEngine(
+            [
+                "TOOL: copy\nINPUT: 42",
+                "FINAL_ANSWER: done",
+            ]
+        )
+        agent = OrchestratorAgent(
+            engine=engine,
+            model="test",
+            tools=[_AmbiguousTool()],
+            mode="structured",
+        )
+
+        result = agent.run("Copy my notes")
+
+        assert result.tool_results[0].success is False
+        assert result.tool_results[0].content == (
+            "Invalid arguments: expected a JSON object, got int."
+        )
+        assert "Tool 'copy' failed: Invalid arguments" in (engine.calls[1][-1].content)
+
+    @pytest.mark.parametrize(
+        "raw_input",
+        [
+            "notes/today.md",
+            '{"source": "notes/today.md",}',
+        ],
+    )
+    def test_multiple_required_parameters_do_not_guess_string_mapping(
+        self,
+        raw_input,
+    ):
+        """Ambiguous bare input remains invalid instead of choosing a field."""
+        engine = _MockEngine(
+            [
+                f"TOOL: copy\nINPUT: {raw_input}",
+                "FINAL_ANSWER: done",
+            ]
+        )
+        agent = OrchestratorAgent(
+            engine=engine,
+            model="test",
+            tools=[_AmbiguousTool()],
+            mode="structured",
+        )
+
+        result = agent.run("Copy my notes")
+
+        assert result.tool_results[0].success is False
+        assert "Invalid arguments JSON" in result.tool_results[0].content
 
     def test_direct_final_answer(self):
         """Test that FINAL_ANSWER on first turn works."""

tests/tools/test_code_interpreter.py

@@ -127,6 +127,10 @@ class TestCodeInterpreterTool:
         tool = CodeInterpreterTool()
         assert tool.tool_id == "code_interpreter"
 
+    def test_structured_object_text_opt_in(self):
+        tool = CodeInterpreterTool()
+        assert tool.spec.metadata["structured_allow_object_text"] is True
+
     def test_registry_registration(self):
         ToolRegistry.register_value("code_interpreter", CodeInterpreterTool)
         assert ToolRegistry.contains("code_interpreter")

tests/tools/test_code_interpreter_docker.py

@@ -25,6 +25,7 @@ class TestDockerCodeInterpreterTool:
         assert spec.name == "code_interpreter_docker"
         assert "code" in spec.parameters["properties"]
         assert spec.category == "code"
+        assert spec.metadata["structured_allow_object_text"] is True
 
     def test_empty_code(self):
         from openjarvis.tools.code_interpreter_docker import (

tests/tools/test_repl.py

@@ -17,6 +17,10 @@ class TestReplSpec:
         tool = ReplTool()
         assert tool.spec.category == "code"
 
+    def test_structured_object_text_opt_in(self):
+        tool = ReplTool()
+        assert tool.spec.metadata["structured_allow_object_text"] is True
+
     def test_spec_parameters(self):
         tool = ReplTool()
         params = tool.spec.parameters

tests/tools/test_stubs.py

@@ -2,6 +2,10 @@
 
 from __future__ import annotations
 
+import json
+
+import pytest
+
 from openjarvis.core.events import EventBus, EventType
 from openjarvis.core.types import ToolCall, ToolResult
 from openjarvis.tools._stubs import BaseTool, ToolExecutor, ToolSpec
@@ -50,6 +54,17 @@ class _ErrorTool(BaseTool):
         raise RuntimeError("boom")
 
 
+class _ScalarBoundaryGuard:
+    """Test guard that rewrites outbound arguments to a JSON scalar."""
+
+    def check_outbound(self, tool_call: ToolCall) -> ToolCall:
+        return ToolCall(
+            id=tool_call.id,
+            name=tool_call.name,
+            arguments=json.dumps("redacted"),
+        )
+
+
 # ---------------------------------------------------------------------------
 # ToolSpec tests
 # ---------------------------------------------------------------------------
@@ -134,6 +149,38 @@ class TestToolExecutor:
         assert result.success is False
         assert "Invalid arguments JSON" in result.content
 
+    @pytest.mark.parametrize(
+        ("arguments", "decoded_type"),
+        [
+            ("42", "int"),
+            ("true", "bool"),
+            ("null", "NoneType"),
+            ("[]", "list"),
+            ('"text"', "str"),
+        ],
+    )
+    def test_execute_rejects_non_object_json(self, arguments, decoded_type):
+        executor = ToolExecutor([_EchoTool()])
+        call = ToolCall(id="1", name="echo", arguments=arguments)
+
+        result = executor.execute(call)
+
+        assert result.success is False
+        assert result.content == (
+            f"Invalid arguments: expected a JSON object, got {decoded_type}."
+        )
+
+    def test_execute_revalidates_boundary_guard_arguments(self):
+        tool = _EchoTool()
+        tool.is_local = False
+        executor = ToolExecutor([tool], boundary_guard=_ScalarBoundaryGuard())
+        call = ToolCall(id="1", name="echo", arguments='{"text":"safe"}')
+
+        result = executor.execute(call)
+
+        assert result.success is False
+        assert result.content == ("Invalid arguments: expected a JSON object, got str.")
+
     def test_execute_empty_arguments(self):
         executor = ToolExecutor([_EchoTool()])
         call = ToolCall(id="1", name="echo", arguments="")

tests/tools/test_tool_registration.py

@@ -64,6 +64,8 @@ EXPECTED_TOOLS = {
     "image_generate",
     # audio_tool.py
     "audio_transcribe",
+    # text_to_speech.py
+    "text_to_speech",
     # knowledge_tools.py
     "kg_add_entity",
     "kg_add_relation",

tools/pearl-reference-oracle/README.md

@@ -1,111 +0,0 @@
-# Pearl reference oracle (OpenJarvis Phase 0 deliverable)
-
-Phase 0-B of [Spec B](../../docs/design/2026-05-05-apple-silicon-pearl-mining-design.md)
-called for "build a Python reference oracle for NoisyGEMM, validate against the
-Pearl CUDA reference."
-
-**Phase 0 found the oracle already exists upstream**, in two complementary forms:
-
-| Layer | Upstream location | What it covers |
-|---|---|---|
-| Pure-Rust mining algorithm exposed to Python | `pearl/py-pearl-mining` | The complete `mine()` + `verify_plain_proof()` cycle. CPU-only. Hardware-portable. |
-| PyTorch reference of production NoisyGEMM | `pearl/miner/miner-base/src/miner_base/noisy_gemm.py` | The same NoisyGEMM that vllm-miner accelerates with H100 CUDA. Bit-exact denoising verified by upstream test (`tests/test_noisy_gemm.py:92`). |
-
-So this directory contains:
-
-1. `smoke_test.py` — a runnable script that **actually mines a block on this machine** using the upstream Rust path, demonstrating the v1 architecture works on Apple Silicon (or any platform where `py-pearl-mining` builds).
-2. This README documenting where the reference math lives.
-
-## What this is *not*
-
-This is **not a reimplementation** of NoisyGEMM. The original Spec B planned for that;
-Phase 0 made it unnecessary. If you're tempted to write `noisy_gemm.py` here, stop —
-read `pearl/miner/miner-base/src/miner_base/noisy_gemm.py` instead.
-
-## Setup
-
-You need:
-
-- macOS arm64 (M1/M2/M3/M4) **or** Linux x86_64 / aarch64
-- Python 3.12 (`uv venv --python 3.12 .venv` is the easiest)
-- Rust 1.78+ (any recent toolchain — verified with 1.94 on macOS arm64)
-- The Pearl source tree somewhere on disk
-
-Build the wheel and install it (one-time, ~60 s on a fast Mac, ~5 min on first build):
-
-```bash
-# from the Pearl repo root
-cd py-pearl-mining
-uv pip install maturin
-maturin build --release --interpreter "$(which python)"
-
-# install the resulting wheel
-uv pip install target/wheels/py_pearl_mining-*.whl
-```
-
-Or if Pearl publishes to PyPI in the future:
-
-```bash
-uv pip install py-pearl-mining
-```
-
-## Run the smoke test
-
-```bash
-python smoke_test.py
-```
-
-Actual output on Apple Silicon M2 Max (numbers will vary by hardware and run):
-
-```
-host: macOS-26.4.1-arm64-arm-64bit (arm64)
-python: 3.12.1
-[ok] pearl_mining loaded from <site-packages>/pearl_mining/__init__.py
-[ok] PUBLICDATA_SIZE=164  MERKLE_LEAF_SIZE=1024
-[ok] mine(m=256, n=128, k=1024, rank=32) returned a proof in 0.119 s
-       proof.m=256 proof.n=128 proof.k=1024  noise_rank=32
-       a.row_indices=[177, 185, 241, 249]  bt.row_indices=[80, 81, 88, 89, 112, 113, 120, 121]
-[ok] verify_plain_proof: ok=True ('Mining solution verified successfully', 0.2 ms)
-
-[ok] all checks passed — Pearl mining works on this host
-```
-
-The `a.row_indices` and `bt.row_indices` values above are not constants — they're
-`(offset + ROWS_PATTERN)` and `(offset + COLS_PATTERN)` for whichever offset the
-miner happened to find a jackpot at. The smoke test verifies the *deltas* match
-the configured `PeriodicPattern`, not the absolute values.
-
-If it succeeds, this host can mine Pearl using the OpenJarvis `cpu-pearl` provider
-(see Spec B §13). If it fails, the `[fail]` line tells you which step broke.
-
-## What this proves (and what it doesn't)
-
-**Proves:**
-
-- The Pearl mining algorithm executes correctly on this host's CPU.
-- Generated proofs verify under `verify_plain_proof`. (This is the same check
-  validators run on the inputs to the ZK proof.)
-- The whole stack — `pearl-blake3`, `zk-pow`, `py-pearl-mining` — builds and
-  loads as a native CPython extension.
-
-**Does NOT prove:**
-
-- Network-difficulty hashrate. The smoke test uses
-  `nbits=0x1D2FFFFF` (test difficulty), much easier than mainnet. Real mining
-  expected hashrate on Apple Silicon CPU is several orders of magnitude lower
-  per share — see Spec B §1.5.6.
-- ZK proof generation throughput. The smoke test calls `verify_plain_proof`,
-  not `generate_proof`. Plonky2 STARK proving takes seconds-to-minutes of CPU
-  per block (Spec B Open Q10).
-- That this host can keep up with the network's block production rate.
-
-## When to update this
-
-- When Pearl bumps `py-pearl-mining` API: re-run the smoke test against the
-  new ref pinned in `OpenJarvis/src/openjarvis/mining/_constants.py`.
-- When Pearl publishes a Mac wheel to PyPI: simplify the install instructions
-  above, drop the local `maturin build` step.
-- When Spec B v2 adds the PyTorch-MPS reference path: extend `smoke_test.py`
-  with an MPS path comparison. The `miner-base` reference is already in
-  PyTorch, so the v2 smoke test would be a different test invoking
-  `miner_base.NoisyGemm` and comparing CPU vs MPS outputs for parity.

tools/pearl-reference-oracle/smoke_test.py

@@ -1,139 +0,0 @@
-"""Pearl mining smoke test — runs an end-to-end mine + verify cycle.
-
-Verifies that this host can run Pearl's pure-Rust mining algorithm via the
-`pearl_mining` Python package. Used as Phase 0-B of the OpenJarvis Apple Silicon
-mining spec ([Spec B]).
-
-Exit codes:
-    0   all checks passed
-    1   pearl_mining import failed
-    2   mine() failed
-    3   verify_plain_proof rejected the proof
-    4   timing or sanity check failed
-
-[Spec B]: ../../docs/design/2026-05-05-apple-silicon-pearl-mining-design.md
-"""
-
-from __future__ import annotations
-
-import platform
-import sys
-import time
-
-# Test fixture values — match upstream Pearl's tests/test_python_api.py so we are
-# testing the same code path that Pearl's own CI exercises. Do not change
-# without re-syncing with upstream.
-DEFAULT_NBITS = 0x1D2FFFFF
-DEFAULT_M = 256
-DEFAULT_N = 128
-DEFAULT_K = 1024
-DEFAULT_RANK = 32
-ROWS_PATTERN = [0, 8, 64, 72]
-COLS_PATTERN = [0, 1, 8, 9, 32, 33, 40, 41]
-
-
-def _ok(msg: str) -> None:
-    print(f"[ok] {msg}")
-
-
-def _fail(msg: str, code: int) -> None:
-    print(f"[fail] {msg}")
-    sys.exit(code)
-
-
-def main() -> None:
-    print(f"host: {platform.platform()} ({platform.machine()})")
-    print(f"python: {sys.version.split()[0]}")
-
-    try:
-        import pearl_mining
-    except ImportError as e:
-        _fail(f"could not import pearl_mining — install with `uv pip install py-pearl-mining` or build from source: {e}", 1)
-
-    _ok(f"pearl_mining loaded from {pearl_mining.__file__}")
-    _ok(
-        f"PUBLICDATA_SIZE={pearl_mining.PUBLICDATA_SIZE}  "
-        f"MERKLE_LEAF_SIZE={pearl_mining.MERKLE_LEAF_SIZE}"
-    )
-
-    block_header = pearl_mining.IncompleteBlockHeader(
-        version=0,
-        prev_block=b"\x00" * 32,
-        merkle_root=b"0123456789abcdef" * 2,
-        timestamp=0x66666666,
-        nbits=DEFAULT_NBITS,
-    )
-    mining_config = pearl_mining.MiningConfiguration(
-        common_dim=DEFAULT_K,
-        rank=DEFAULT_RANK,
-        mma_type=pearl_mining.MMAType.Int7xInt7ToInt32,
-        rows_pattern=pearl_mining.PeriodicPattern.from_list(ROWS_PATTERN),
-        cols_pattern=pearl_mining.PeriodicPattern.from_list(COLS_PATTERN),
-        reserved=pearl_mining.MiningConfiguration.RESERVED,
-    )
-
-    t0 = time.perf_counter()
-    try:
-        plain_proof = pearl_mining.mine(
-            DEFAULT_M,
-            DEFAULT_N,
-            DEFAULT_K,
-            block_header,
-            mining_config,
-            signal_range=None,
-            wrong_jackpot_hash=False,
-        )
-    except Exception as e:
-        _fail(f"mine() raised: {e!r}", 2)
-    t_mine = time.perf_counter() - t0
-
-    _ok(
-        f"mine(m={DEFAULT_M}, n={DEFAULT_N}, k={DEFAULT_K}, rank={DEFAULT_RANK}) "
-        f"returned a proof in {t_mine:.3f} s"
-    )
-    print(
-        f"       proof.m={plain_proof.m} proof.n={plain_proof.n} proof.k={plain_proof.k}  "
-        f"noise_rank={plain_proof.noise_rank}"
-    )
-    print(
-        f"       a.row_indices={plain_proof.a.row_indices}  "
-        f"bt.row_indices={plain_proof.bt.row_indices}"
-    )
-
-    t0 = time.perf_counter()
-    ok, msg = pearl_mining.verify_plain_proof(block_header, plain_proof)
-    t_verify_ms = (time.perf_counter() - t0) * 1000
-
-    if not ok:
-        _fail(f"verify_plain_proof rejected our proof: {msg}", 3)
-
-    _ok(f"verify_plain_proof: ok=True ({msg!r}, {t_verify_ms:.1f} ms)")
-
-    if plain_proof.m != DEFAULT_M or plain_proof.n != DEFAULT_N or plain_proof.k != DEFAULT_K:
-        _fail("plain_proof dimensions do not match request", 4)
-    if plain_proof.noise_rank != DEFAULT_RANK:
-        _fail("plain_proof noise_rank does not match request", 4)
-
-    # Row indices are (offset + base_index) for some valid offset within the
-    # matrix dimension — see threads_partition() in zk-pow/src/ffi/mine.rs.
-    # We can't assert an absolute value (different offsets are valid every run),
-    # but we can assert the deltas match the pattern shape.
-    a_idxs = list(plain_proof.a.row_indices)
-    bt_idxs = list(plain_proof.bt.row_indices)
-    a_deltas = [v - a_idxs[0] for v in a_idxs]
-    bt_deltas = [v - bt_idxs[0] for v in bt_idxs]
-    if a_deltas != ROWS_PATTERN:
-        _fail(f"a.row_indices deltas ({a_deltas}) != ROWS_PATTERN ({ROWS_PATTERN})", 4)
-    if bt_deltas != COLS_PATTERN:
-        _fail(f"bt.row_indices deltas ({bt_deltas}) != COLS_PATTERN ({COLS_PATTERN})", 4)
-
-    print()
-    print("[ok] all checks passed — Pearl mining works on this host")
-    print()
-    print("Note: this used test difficulty (nbits=0x1D2FFFFF), not mainnet.")
-    print("Real-network shares per second will be many orders of magnitude lower.")
-    print("See docs/design/2026-05-05-apple-silicon-pearl-mining-design.md §1.5.6")
-
-
-if __name__ == "__main__":
-    main()