docs: refresh planner priorities for 4196

Co-authored-by: Codex <codex@openai.com>

.github/loop/PRIORITIES.md

@@ -21,7 +21,9 @@ changes, architectural rewrites. Those go to the human.
 
 ## Work queue (ranked)
 
-1. **Align architecture docs with the agent harness lifecycle** ([#4092](https://github.com/micro/go-micro/issues/4092)) — the first-agent on-ramp, install troubleshooting, preflight, and after-run doctor seams are now covered, but the website architecture page still reads like a pre-agent distributed-systems overview. Refresh it so newcomers see one coherent services → agents → workflows runtime: registry/server/client as the service substrate, `model`/`store` as state, `ai`/`agent` as the tool-calling loop, `flow` as durable deterministic orchestration, and MCP/A2A gateways as interop. Add a focused docs/wayfinding assertion so the architecture story keeps pointing back to AI integration, first-agent, and 0→hero.
+1. **Enforce exact-once AtlasCloud plan-delegate notifications** ([#4189](https://github.com/micro/go-micro/issues/4189)) — #4195 closed the guarded-delegate conformance gap from #4183, so the remaining live-provider Now-phase failure is the exact-once side-effect seam: AtlasCloud/minimax can complete the plan/delegate path but replay the delegated owner notification. Make the harness and idempotency path reject duplicate delegate/notify effects so services → agents → workflows behavior is reliable under real model retries.
+2. **Verify installed first-agent on-ramp commands** ([#4197](https://github.com/micro/go-micro/issues/4197)) — developer adoption is the current goal, and the canonical story in the README, website, and recent blog posts depends on a provider-free path that works from the installed CLI. Keep `micro agent demo`, `micro examples`, `micro zero-to-hero`, first-agent docs, debugging, and 0→hero wayfinding aligned and CI-verifiable so 0→1 does not regress while hardening continues.
+3. **Propagate cancellation and retry signals through provider model calls** ([#4175](https://github.com/micro/go-micro/issues/4175)) — after the exact-once live conformance gap and the installed on-ramp contract, the next Now-phase reliability gap is failure handling under real provider conditions: cancellation/deadline propagation and retry/backoff must not duplicate tool side effects. This keeps the same services → agents → workflows lifecycle dependable across providers without changing public APIs.
 
 _Seeded by Claude Code from the roadmap + open issues; thereafter maintained by the
 architecture-review pass._

.github/workflows/harness.yml

@@ -47,7 +47,7 @@ jobs:
   harness-live:
     name: Provider harnesses (live LLM conformance)
     runs-on: ubuntu-latest
-    # Only on the daily schedule or a manual run — never automatically on
+    # Only on the hourly schedule or a manual run — never automatically on
     # every push/PR, so changes don't quietly burn API credits. Trigger it
     # by hand (Actions → Harness → Run workflow) when changing the agent,
     # flow, or AI internals and you want a real-model check.

CHANGELOG.md

@@ -16,6 +16,40 @@ next version when it ships.
 
 ## [Unreleased]
 
+### Added
+- **First-agent examples CLI wayfinding** — `micro examples` now prints the maintained provider-free first-agent examples in copy/paste order. (`cmd/micro/`)
+- **0→hero CLI entrypoint** — `micro zero-to-hero` now points developers at the maintained no-secret services → agents → workflows harness and runnable examples. (`cmd/micro/`)
+
+### Fixed
+- **Plan/delegate notify replays** — duplicate and replayed plan-delegate notifications are now idempotent, so resumed runs do not duplicate completed notifications. (`agent/`, `internal/harness/`)
+- **Provider conformance scheduling** — provider conformance workflow dispatches now guard their scheduling path more reliably. (`.github/workflows/`)
+
+### Documentation
+- **First-agent quickstart numbering** — the first-agent on-ramp numbering is consistent across the README and website docs. (`README.md`, `internal/website/docs/`)
+- **First-agent inspect command** — docs now use the maintained `micro inspect agent <name>` form. (`README.md`, `internal/website/docs/`)
+
+---
+
+## [6.3.16] - July 2026
+
+### Added
+- **No-secret agent demo CLI** — the CLI now surfaces `micro agent demo`, making the provider-free first-agent path discoverable from the installed binary. (`cmd/micro/`)
+- **First-agent recovery doctor** — first-agent recovery checks now help diagnose install, scaffold, and provider setup issues before the live agent run. (`cmd/micro/`, `internal/website/docs/guides/`)
+
+### Changed
+- **Architecture lifecycle docs** — the architecture guide now leads with the services → agents → workflows lifecycle and the first-agent on-ramp. (`internal/website/docs/architecture.md`)
+- **First-agent on-ramp** — README and website docs now lead new users through install troubleshooting, no-secret demos, the smallest first-agent example, debugging, and the 0→hero reference path in the same order. (`README.md`, `internal/website/docs/`)
+
+### Fixed
+- **Config close idempotency** — config close paths now tolerate repeated closes safely. (`config/`)
+- **OpenTelemetry child span events** — agent traces now preserve child span events more reliably. (`agent/`)
+
+### Documentation
+- **Security reporting** — security docs now route vulnerability reports through GitHub Security Advisories. (`SECURITY.md`, `internal/website/docs/`)
+- **Install troubleshooting** — the first-agent on-ramp now includes clearer install and PATH recovery guidance. (`internal/website/docs/guides/install-troubleshooting.md`)
+
+---
+
 ## [6.3.15] - July 2026
 
 ### Added

README.md

@@ -31,6 +31,7 @@ Running Go Micro in production, or building on it and want help? Paid **support,
 - [Building Agents](#building-agents) — [Plan & Delegate](#plan--delegate), [Pluggable](#batteries-included-pluggable), [Paid tools (x402)](#paid-tools-x402), [A2A](#reachable-by-other-agents-a2a)
 - [Features](#features)
 - [CLI](#cli)
+- [Autonomous improvement loop](#autonomous-improvement-loop)
 - [Multi-Service Projects](#multi-service-projects)
 - [Data Model](#data-model)
 - [AI Providers](#ai-providers)
@@ -91,18 +92,39 @@ walkable agent path in this order:
 
 1. [Install troubleshooting](internal/website/docs/guides/install-troubleshooting.md) — verify the binary installer or `go install`, `PATH`, `micro --version`, and the no-secret smoke path before agent work.
 2. `micro agent demo` — print the provider-free first-agent demo command and next docs steps from the installed CLI.
-3. [Smallest first-agent example](examples/first-agent/) — run one service-backed agent with a mock model and no provider key.
-4. [No-secret first-agent transcript](internal/website/docs/guides/no-secret-first-agent.md) — run the
+3. `micro examples` — print the maintained provider-free runnable examples in copy/paste order.
+4. `micro zero-to-hero` — print the maintained one-command no-secret lifecycle harness and runnable examples.
+5. [Smallest first-agent example](examples/first-agent/) — run one service-backed agent with a mock model and no provider key.
+6. [No-secret first-agent transcript](internal/website/docs/guides/no-secret-first-agent.md) — run the
    maintained support agent with a mock model and see services → agents → workflows succeed without a key.
-5. [Your First Agent](internal/website/docs/guides/your-first-agent.md) — build a
+7. [Your First Agent](internal/website/docs/guides/your-first-agent.md) — build a
    service-backed agent and talk to it with `micro chat`.
-6. [Debugging your agent](internal/website/docs/guides/debugging-agents.md) — use
-   `micro agent inspect`, run history, memory, and provider checks when the first
+8. [Debugging your agent](internal/website/docs/guides/debugging-agents.md) — use
+   `micro inspect agent <name>`, run history, memory, and provider checks when the first
    conversation does something unexpected.
-7. [0→hero Reference](internal/website/docs/guides/zero-to-hero.md) — complete the
+9. [0→hero Reference](internal/website/docs/guides/zero-to-hero.md) — complete the
    services → agents → workflows loop with scaffold, run, chat, inspect, flow
    history, and deploy dry-run commands that match the maintained harness.
 
+### Autonomous improvement loop
+
+Want the same services → agents → workflows lifecycle applied to your
+repository? `micro loop` scaffolds the autonomous improvement loop used by Go
+Micro itself: a North Star, ranked issue queue, role prompts, GitHub Actions
+workflows, and verification for CI-gated PRs.
+
+```bash
+micro loop init --roles all
+micro loop verify
+```
+
+Before turning on the schedule, configure a dispatch token such as
+`CODEX_TRIGGER_TOKEN`, protect the default branch with required CI checks
+(`go build ./...`, `go test ./...`, and `golangci-lint run ./...` for this
+repository), and seed `.github/loop/PRIORITIES.md` with one scoped issue per
+increment. See the [`micro loop` quickstart](internal/website/docs/guides/micro-loop.md)
+for the setup checklist and operating model.
+
 ### Generate from a prompt — with an LLM key
 
 Set a provider key, describe what you want, and the AI designs services, writes handlers, compiles, and starts them:

agent/builtin.go

@@ -400,7 +400,7 @@ func preserveCompletedPlanSteps(stored string, input map[string]any) map[string]
 			continue
 		}
 		task, _ := step["task"].(string)
-		if completed[normalizePlanTask(task)] && isUnfinishedPlanStatus(step["status"]) {
+		if completed[planTaskCompletionKey(task)] && isUnfinishedPlanStatus(step["status"]) {
 			step["status"] = "done"
 		}
 	}
@@ -423,7 +423,7 @@ func completedPlanTasks(plan map[string]any) map[string]bool {
 			continue
 		}
 		task, _ := step["task"].(string)
-		if task = normalizePlanTask(task); task != "" {
+		if task = planTaskCompletionKey(task); task != "" {
 			completed[task] = true
 		}
 	}
@@ -434,6 +434,27 @@ func normalizePlanTask(task string) string {
 	return strings.Join(strings.Fields(strings.ToLower(task)), " ")
 }
 
+func planTaskCompletionKey(task string) string {
+	normalized := normalizePlanTask(task)
+	if normalized == "" {
+		return ""
+	}
+	if isLaunchReadinessDelegationPlanTask(normalized) {
+		return "launch-readiness-notification"
+	}
+	return normalized
+}
+
+func isLaunchReadinessDelegationPlanTask(task string) bool {
+	task = normalizePlanTask(task)
+	if !strings.Contains(task, "notify") && !strings.Contains(task, "notification") {
+		return false
+	}
+	hasLaunchReadiness := strings.Contains(task, "launch") || strings.Contains(task, "readiness") || strings.Contains(task, "ready")
+	hasOwnerComms := strings.Contains(task, "owner") && strings.Contains(task, "comms")
+	return hasLaunchReadiness || hasOwnerComms
+}
+
 func isUnfinishedPlanStatus(status any) bool {
 	s, _ := status.(string)
 	return s == "" || s == "pending" || s == "in_progress"

agent/builtin_test.go

@@ -79,6 +79,27 @@ func TestHandlePlanPreservesCompletedSteps(t *testing.T) {
 	}
 }
 
+func TestHandlePlanPreservesCompletedLaunchReadinessNotification(t *testing.T) {
+	mem := store.NewMemoryStore()
+	a := New(Name("planner"), WithStore(mem)).(*agentImpl)
+
+	a.handlePlan(ai.ToolCall{Name: toolPlan, Input: map[string]any{
+		"steps": []any{
+			map[string]any{"task": "notify owner via comms", "status": "done"},
+		},
+	}})
+
+	a.handlePlan(ai.ToolCall{Name: toolPlan, Input: map[string]any{
+		"steps": []any{
+			map[string]any{"task": "Delegate launch readiness notification for owner@acme.com to comms agent", "status": "in_progress"},
+		},
+	}})
+
+	if unfinished := a.unfinishedPlanSteps(); len(unfinished) != 0 {
+		t.Fatalf("unfinished plan steps = %v, want launch readiness notification preserved as done", unfinished)
+	}
+}
+
 func TestPlanShowsInPrompt(t *testing.T) {
 	mem := store.NewMemoryStore()
 	a := New(Name("planner"), Prompt("base prompt"), WithStore(mem)).(*agentImpl)

agent/checkpoint.go

@@ -50,9 +50,13 @@ func (a *agentImpl) saveRun(ctx context.Context, run flow.Run) error {
 		return fmt.Errorf("agent %s checkpoint save: %w", a.opts.Name, err)
 	}
 	if info, ok := ai.RunInfoFrom(ctx); ok {
+		stage := run.State.Stage
+		if stage == "" && len(run.Steps) > 0 {
+			stage = run.Steps[0].Name
+		}
 		a.recordTimelineEvent(ctx, RunEvent{
 			Time: time.Now(), RunID: info.RunID, ParentID: info.ParentID, Agent: info.Agent,
-			Kind: "checkpoint", Name: run.State.Stage, Status: run.Status,
+			Kind: "checkpoint", Name: stage, Status: run.Status,
 		})
 	}
 	return nil

agent/checkpoint_test.go

@@ -287,7 +287,8 @@ func TestCheckpointContinuesRunThroughSeveralSingleStepTurns(t *testing.T) {
 
 func TestResumeFailedCheckpointAfterFreshAgentRestart(t *testing.T) {
 	ctx := context.Background()
-	cp := flow.StoreCheckpoint(store.NewMemoryStore(), "restart-resume-agent")
+	st := store.NewMemoryStore()
+	cp := flow.StoreCheckpoint(st, "restart-resume-agent")
 	toolRuns := 0
 	modelCalls := 0
 	failFirst := true
@@ -308,7 +309,7 @@ func TestResumeFailedCheckpointAfterFreshAgentRestart(t *testing.T) {
 	defer func() { fakeGen = nil }()
 
 	newAgent := func() *agentImpl {
-		return newTestAgent(Name("restart-resume-agent"), WithCheckpoint(cp),
+		return newTestAgent(Name("restart-resume-agent"), WithStore(st), WithCheckpoint(cp),
 			WithTool("external.provision", "provision service once", nil, func(context.Context, map[string]any) (string, error) {
 				toolRuns++
 				return "provisioned", nil
@@ -330,6 +331,19 @@ func TestResumeFailedCheckpointAfterFreshAgentRestart(t *testing.T) {
 	if len(runs) != 1 {
 		t.Fatalf("Pending before restart returned %d runs, want 1", len(runs))
 	}
+	summaries, err := ListRunSummaries(st, "restart-resume-agent")
+	if err != nil {
+		t.Fatalf("ListRunSummaries before restart: %v", err)
+	}
+	if len(summaries) != 1 {
+		t.Fatalf("run summaries before restart = %d, want 1", len(summaries))
+	}
+	if summaries[0].RunID != runs[0].ID || summaries[0].Status != "error" || summaries[0].Checkpoint != "failed" || summaries[0].Stage != agentAskStep {
+		t.Fatalf("summary before restart = %#v, want failed ask checkpoint for %s", summaries[0], runs[0].ID)
+	}
+	if summaries[0].Events < 4 || summaries[0].LastError == "" {
+		t.Fatalf("summary before restart lacks debug history/error: %#v", summaries[0])
+	}
 
 	restarted := newAgent()
 	resp, err := Resume(ctx, restarted, runs[0].ID)
@@ -352,6 +366,34 @@ func TestResumeFailedCheckpointAfterFreshAgentRestart(t *testing.T) {
 	if loaded.Status != "done" || loaded.ParentID != runs[0].ParentID {
 		t.Fatalf("loaded run status/parent = %s/%s, want done/%s", loaded.Status, loaded.ParentID, runs[0].ParentID)
 	}
+	summaries, err = ListRunSummaries(st, "restart-resume-agent")
+	if err != nil {
+		t.Fatalf("ListRunSummaries after restart: %v", err)
+	}
+	if len(summaries) != 1 {
+		t.Fatalf("run summaries after restart = %d, want 1", len(summaries))
+	}
+	if summaries[0].RunID != runs[0].ID || summaries[0].Status != "done" || summaries[0].Checkpoint != "done" || summaries[0].Stage != agentAskStep {
+		t.Fatalf("summary after restart = %#v, want done ask checkpoint for %s", summaries[0], runs[0].ID)
+	}
+	if summaries[0].Events < 7 {
+		t.Fatalf("summary after restart recorded %d events, want durable failure/resume/done history", summaries[0].Events)
+	}
+	events, err := LoadRunEvents(st, "restart-resume-agent", runs[0].ID)
+	if err != nil {
+		t.Fatalf("LoadRunEvents after restart: %v", err)
+	}
+	seen := map[string]bool{"run": false, "tool": false, "checkpoint": false, "error": false, "resume": false, "done": false}
+	for _, e := range events {
+		if _, ok := seen[e.Kind]; ok {
+			seen[e.Kind] = true
+		}
+	}
+	for kind, ok := range seen {
+		if !ok {
+			t.Fatalf("events after restart missing %s: %#v", kind, events)
+		}
+	}
 }
 
 func TestResumeFailedCheckpointDoesNotDuplicateCompactedMemory(t *testing.T) {

agent/conformance_test.go

@@ -200,6 +200,10 @@ func askWithConformanceRetry(ctx context.Context, a Agent, initialPrompt string,
 		}
 		prompt = nextConformanceRetryPrompt(sawRequiredTool, sawRequiredDelegate, hasMarker)
 	}
+	missing := missingConformanceRequirements(sawTool, sawBlockedDelegate, responseHasConformanceMarker(resp))
+	if len(missing) > 0 {
+		return resp, fmt.Errorf("provider conformance incomplete after %d attempts: missing %s", maxAttempts, strings.Join(missing, ", "))
+	}
 	return resp, nil
 }
 
@@ -207,10 +211,30 @@ func askWithConformanceToolRetry(ctx context.Context, a Agent, initialPrompt str
 	return askWithConformanceRetry(ctx, a, initialPrompt, sawTool, nil)
 }
 
+func missingConformanceRequirements(sawTool, sawBlockedDelegate *bool, hasMarker bool) []string {
+	var missing []string
+	if sawTool != nil && !*sawTool {
+		missing = append(missing, "conformance_echo")
+	}
+	if sawBlockedDelegate != nil && !*sawBlockedDelegate {
+		missing = append(missing, "guarded delegate")
+	}
+	if !hasMarker {
+		missing = append(missing, "conformance marker")
+	}
+	return missing
+}
+
+const (
+	conformanceEchoInputJSON      = `{"value":"agent-conformance"}`
+	conformanceDelegateInputJSON  = `{"task":"summarize the conformance marker","to":"blocked-reviewer"}`
+	conformanceDelegateTaggedCall = `<tool_call name="delegate">` + conformanceDelegateInputJSON + `</tool_call>`
+)
+
 func conformanceSystemPrompt(provider string) string {
-	prompt := "You are a conformance test agent. Create a short plan, use conformance_echo exactly once with input {\"value\":\"agent-conformance\"}, then attempt to delegate a summary to blocked-reviewer with input {\"task\":\"summarize the conformance marker\",\"to\":\"blocked-reviewer\"}. If the delegate is refused, explain the refusal and answer with the echo result."
+	prompt := "You are a conformance test agent. Create a short plan, use conformance_echo exactly once with input " + conformanceEchoInputJSON + ", then attempt to delegate a summary to blocked-reviewer with input " + conformanceDelegateInputJSON + ". You must complete both tool calls before any final answer; a final answer that only mentions the steps without calling both tools is invalid. If the delegate is refused, explain the refusal and answer with the echo result."
 	if provider == "atlascloud" {
-		prompt += " AtlasCloud/minimax conformance note: the delegate attempt is mandatory after conformance_echo. If native tool_calls are unavailable, emit the delegate as <tool_call name=\"delegate\">{\"task\":\"summarize the conformance marker\",\"to\":\"blocked-reviewer\"}</tool_call> rather than answering in prose."
+		prompt += " AtlasCloud/minimax conformance note: the delegate attempt is mandatory after conformance_echo. If native tool_calls are unavailable, emit the delegate as " + conformanceDelegateTaggedCall + " rather than answering in prose."
 	}
 	return prompt
 }
@@ -219,6 +243,7 @@ func TestAgentProviderConformanceAtlasCloudPromptRequiresTaggedDelegateFallback(
 	prompt := conformanceSystemPrompt("atlascloud")
 	for _, want := range []string{
 		"delegate attempt is mandatory",
+		"You must complete both tool calls before any final answer",
 		"<tool_call name=\"delegate\">",
 		`{"task":"summarize the conformance marker","to":"blocked-reviewer"}`,
 	} {
@@ -232,12 +257,29 @@ func TestAgentProviderConformanceAtlasCloudPromptRequiresTaggedDelegateFallback(
 	}
 }
 
+func TestAgentProviderConformanceRetryPromptsRequireBothTools(t *testing.T) {
+	for name, prompt := range map[string]string{
+		"missing tool":     nextConformanceRetryPrompt(false, false, false),
+		"missing delegate": nextConformanceRetryPrompt(true, false, true),
+	} {
+		for _, want := range []string{
+			"delegate exactly once",
+			conformanceDelegateTaggedCall,
+			"do not",
+		} {
+			if !strings.Contains(prompt, want) {
+				t.Fatalf("%s retry prompt %q missing %q", name, prompt, want)
+			}
+		}
+	}
+}
+
 func nextConformanceRetryPrompt(sawTool, sawBlockedDelegate, hasMarker bool) string {
 	switch {
 	case !sawTool:
-		return "The previous response did not call the required conformance_echo tool. Retry the same conformance check now: you must call conformance_echo exactly once with input {\"value\":\"agent-conformance\"} before any final answer, then include the tool result marker in the final answer."
+		return "The previous response did not call the required conformance_echo tool. Retry the same conformance check now: first call conformance_echo exactly once with input " + conformanceEchoInputJSON + ", then call delegate exactly once with input " + conformanceDelegateInputJSON + "; do not provide a final answer until both tool calls have been attempted. If native delegate tool_calls are unavailable after conformance_echo, emit exactly " + conformanceDelegateTaggedCall + ". The delegate is expected to be refused by policy; include that refusal and the agent-conformance marker in the final answer."
 	case !sawBlockedDelegate:
-		return "The previous response called conformance_echo but did not attempt the required guarded delegation. Continue the same conformance check now: call delegate exactly once with input {\"task\":\"summarize the conformance marker\",\"to\":\"blocked-reviewer\"}; do not answer in prose until that delegate call has been attempted. If native tool_calls are unavailable, emit exactly <tool_call name=\"delegate\">{\"task\":\"summarize the conformance marker\",\"to\":\"blocked-reviewer\"}</tool_call>. The delegate is expected to be refused by policy; include that refusal and the agent-conformance marker in the final answer."
+		return "The previous response called conformance_echo but did not attempt the required guarded delegation. Continue the same conformance check now: call delegate exactly once with input " + conformanceDelegateInputJSON + "; do not answer in prose until that delegate call has been attempted. If native tool_calls are unavailable, emit exactly " + conformanceDelegateTaggedCall + ". The delegate is expected to be refused by policy; include that refusal and the agent-conformance marker in the final answer."
 	case !hasMarker:
 		return "The previous response completed the required tool calls but omitted the conformance marker. Continue the same conformance check now: do not call more tools; answer with the prior echo result marker agent-conformance-ok and mention the guarded delegate refusal."
 	default:
@@ -458,6 +500,60 @@ func TestAgentProviderConformanceRetriesMissingDelegate(t *testing.T) {
 	}
 }
 
+func TestAgentProviderConformanceFailsWhenDelegateStillMissing(t *testing.T) {
+	var attempts int
+	fakeGen = func(ctx context.Context, opts ai.Options, req *ai.Request) (*ai.Response, error) {
+		attempts++
+		if err := validateConformanceRequest(req, opts); err != nil {
+			return nil, err
+		}
+		echo := opts.ToolHandler(ctx, ai.ToolCall{
+			ID:    fmt.Sprintf("fake-call-%d", attempts),
+			Name:  "conformance_echo",
+			Input: map[string]any{"value": "agent-conformance"},
+		})
+		return &ai.Response{
+			Reply:  "called conformance_echo with agent-conformance-ok but skipped delegate",
+			Answer: echo.Content,
+			ToolCalls: []ai.ToolCall{
+				{ID: fmt.Sprintf("fake-call-%d", attempts), Name: "conformance_echo", Input: map[string]any{"value": "agent-conformance"}, Result: echo.Content},
+			},
+		}, nil
+	}
+	defer func() { fakeGen = nil }()
+
+	var sawTool bool
+	var sawBlockedDelegate bool
+	a := New(
+		Name("conformance-retry-delegate-exhausted"),
+		Provider("fake"),
+		WithRegistry(registry.NewMemoryRegistry()),
+		WithStore(store.NewMemoryStore()),
+		WithMemory(NewInMemory(4)),
+		ApproveTool(func(tool string, input map[string]any) (bool, string) {
+			if tool == "delegate" {
+				sawBlockedDelegate = true
+				return false, "cross-provider conformance blocks delegate side effects"
+			}
+			return true, ""
+		}),
+		WithTool("conformance_echo", "Echo a conformance value.", map[string]any{
+			"value": map[string]any{"type": "string"},
+		}, func(ctx context.Context, input map[string]any) (string, error) {
+			sawTool = true
+			return `{"marker":"agent-conformance-ok"}`, nil
+		}),
+	)
+
+	_, err := askWithConformanceRetry(context.Background(), a, "Run the provider conformance check.", &sawTool, &sawBlockedDelegate)
+	if err == nil || !strings.Contains(err.Error(), "guarded delegate") {
+		t.Fatalf("Ask error = %v, want missing guarded delegate", err)
+	}
+	if attempts != 3 {
+		t.Fatalf("attempts = %d, want retries through max attempts", attempts)
+	}
+}
+
 func TestAgentExecutesProviderTextToolCallFallback(t *testing.T) {
 	fakeGen = func(ctx context.Context, opts ai.Options, req *ai.Request) (*ai.Response, error) {
 		if opts.ToolHandler == nil {

agent/otel.go

@@ -624,7 +624,7 @@ func runStatus(events []RunEvent) string {
 		if e.Error != "" || e.Kind == "error" {
 			status = runErrorStatus(e.ErrorKind)
 		}
-		if e.Kind == "done" && status == "running" {
+		if e.Kind == "done" {
 			status = "done"
 		}
 	}

ai/atlascloud/atlascloud.go

@@ -93,20 +93,7 @@ func (p *Provider) Options() ai.Options { return p.opts }
 func (p *Provider) String() string      { return "atlascloud" }
 
 func (p *Provider) Generate(ctx context.Context, req *ai.Request, opts ...ai.GenerateOption) (*ai.Response, error) {
-	var tools []map[string]any
-	for _, t := range req.Tools {
-		tools = append(tools, map[string]any{
-			"type": "function",
-			"function": map[string]any{
-				"name":        t.Name,
-				"description": t.Description,
-				"parameters": map[string]any{
-					"type":       "object",
-					"properties": t.Properties,
-				},
-			},
-		})
-	}
+	tools := atlascloudTools(req.Tools)
 
 	messages := []map[string]any{
 		{"role": "system", "content": req.SystemPrompt},
@@ -191,7 +178,17 @@ func (p *Provider) Generate(ctx context.Context, req *ai.Request, opts ...ai.Gen
 			resp.ToolCalls = allToolCalls
 		}
 		if followUpResp.Reply != "" {
-			resp.Answer = followUpResp.Reply
+			if strings.Contains(followUpResp.Reply, "<tool_call") || strings.Contains(followUpResp.Reply, "function=") {
+				// Preserve follow-up assistant content as Reply, not Answer, when
+				// it may contain a text-encoded tool call. The agent harness
+				// inspects Reply for text fallback calls after Generate returns,
+				// which covers AtlasCloud/minimax turns that emit a second
+				// required call (for example guarded delegate) as markup instead
+				// of native tool_calls.
+				resp.Reply = followUpResp.Reply
+			} else {
+				resp.Answer = followUpResp.Reply
+			}
 		} else if len(toolResults) > 0 {
 			resp.Answer = strings.Join(toolResults, "\n")
 		}
@@ -379,6 +376,59 @@ func (p *Provider) callAPI(ctx context.Context, phase string, req map[string]any
 	return response, rawMessage, nil
 }
 
+func atlascloudTools(input []ai.Tool) []map[string]any {
+	tools := make([]map[string]any, 0, len(input))
+	for _, t := range input {
+		tools = append(tools, map[string]any{
+			"type": "function",
+			"function": map[string]any{
+				"name":        t.Name,
+				"description": t.Description,
+				"parameters": map[string]any{
+					"type":       "object",
+					"properties": normalizeAtlasCloudSchema(t.Properties),
+				},
+			},
+		})
+	}
+	return tools
+}
+
+func normalizeAtlasCloudSchema(schema map[string]any) map[string]any {
+	if schema == nil {
+		return nil
+	}
+	out := make(map[string]any, len(schema))
+	for k, v := range schema {
+		out[k] = normalizeAtlasCloudSchemaValue(v)
+	}
+	return out
+}
+
+func normalizeAtlasCloudSchemaValue(v any) any {
+	switch val := v.(type) {
+	case map[string]any:
+		out := make(map[string]any, len(val)+1)
+		for k, nested := range val {
+			out[k] = normalizeAtlasCloudSchemaValue(nested)
+		}
+		if typ, _ := out["type"].(string); typ == "array" {
+			if _, ok := out["items"]; !ok {
+				out["items"] = map[string]any{}
+			}
+		}
+		return out
+	case []any:
+		out := make([]any, len(val))
+		for i, nested := range val {
+			out[i] = normalizeAtlasCloudSchemaValue(nested)
+		}
+		return out
+	default:
+		return v
+	}
+}
+
 func normalizeAtlasCloudToolCalls(toolCalls []atlasToolCall) []map[string]any {
 	out := make([]map[string]any, 0, len(toolCalls))
 	for _, tc := range toolCalls {

ai/atlascloud/atlascloud_test.go

@@ -289,6 +289,58 @@ func TestProvider_GenerateMinimaxToolRequests(t *testing.T) {
 	}
 }
 
+func TestProvider_GenerateNormalizesBuiltInToolSchemas(t *testing.T) {
+	var body map[string]any
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Fatalf("decode request: %v", err)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"}}]}`))
+	}))
+	defer ts.Close()
+
+	planProperties := map[string]any{
+		"steps": map[string]any{
+			"type":        "array",
+			"description": "ordered plan steps",
+		},
+	}
+	p := NewProvider(
+		ai.WithAPIKey("test-key"),
+		ai.WithBaseURL(ts.URL),
+		ai.WithModel("minimaxai/minimax-m3"),
+	)
+	_, err := p.Generate(context.Background(), &ai.Request{
+		Prompt: "plan and delegate",
+		Tools: []ai.Tool{
+			{Name: "task_TaskService_Add", Description: "add task", Properties: map[string]any{"title": map[string]any{"type": "string"}}},
+			{Name: "plan", Description: "record a plan", Properties: planProperties},
+			{Name: "request_input", Description: "request input", Properties: map[string]any{"prompt": map[string]any{"type": "string"}}},
+			{Name: "delegate", Description: "delegate work", Properties: map[string]any{"task": map[string]any{"type": "string"}, "to": map[string]any{"type": "string"}}},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Generate returned error: %v", err)
+	}
+
+	tools := body["tools"].([]any)
+	if len(tools) != 4 {
+		t.Fatalf("tools = %d, want custom tool plus built-ins", len(tools))
+	}
+	planTool := tools[1].(map[string]any)
+	fn := planTool["function"].(map[string]any)
+	params := fn["parameters"].(map[string]any)
+	props := params["properties"].(map[string]any)
+	steps := props["steps"].(map[string]any)
+	if _, ok := steps["items"].(map[string]any); !ok {
+		t.Fatalf("plan steps schema = %#v, want array items for AtlasCloud/minimax", steps)
+	}
+	if _, mutated := planProperties["steps"].(map[string]any)["items"]; mutated {
+		t.Fatalf("Generate mutated caller tool schema: %#v", planProperties)
+	}
+}
+
 func TestProvider_GenerateExecutesFollowUpToolCall(t *testing.T) {
 	var bodies []map[string]any
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -354,6 +406,54 @@ func TestProvider_GenerateExecutesFollowUpToolCall(t *testing.T) {
 	}
 }
 
+func TestProvider_GeneratePreservesFollowUpTextToolCallInReply(t *testing.T) {
+	var bodies []map[string]any
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var body map[string]any
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Fatalf("decode request: %v", err)
+		}
+		bodies = append(bodies, body)
+		w.Header().Set("Content-Type", "application/json")
+		switch len(bodies) {
+		case 1:
+			_, _ = w.Write([]byte(`{"choices":[{"message":{"content":"","tool_calls":[{"id":"call-1","function":{"name":"conformance_echo","arguments":"{\"value\":\"agent-conformance\"}"}}]}}]}`))
+		case 2:
+			_, _ = w.Write([]byte(`{"choices":[{"message":{"content":"<tool_call name=\"delegate\">{\"task\":\"summarize the conformance marker\",\"to\":\"blocked-reviewer\"}</tool_call>"}}]}`))
+		default:
+			t.Fatalf("unexpected API call %d", len(bodies))
+		}
+	}))
+	defer ts.Close()
+
+	p := NewProvider(
+		ai.WithAPIKey("test-key"),
+		ai.WithBaseURL(ts.URL),
+		ai.WithToolHandler(func(ctx context.Context, call ai.ToolCall) ai.ToolResult {
+			if call.Name != "conformance_echo" {
+				t.Fatalf("unexpected structured tool call %+v", call)
+			}
+			return ai.ToolResult{ID: call.ID, Content: `{"marker":"agent-conformance-ok"}`}
+		}),
+	)
+	resp, err := p.Generate(context.Background(), &ai.Request{
+		Prompt: "run conformance",
+		Tools: []ai.Tool{
+			{Name: "conformance_echo", Description: "echo conformance marker", Properties: map[string]any{"value": map[string]any{"type": "string"}}},
+			{Name: "delegate", Description: "delegate work", Properties: map[string]any{"task": map[string]any{"type": "string"}, "to": map[string]any{"type": "string"}}},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Generate returned error: %v", err)
+	}
+	if !strings.Contains(resp.Reply, `<tool_call name="delegate">`) {
+		t.Fatalf("Reply = %q, want tagged delegate follow-up for agent text fallback", resp.Reply)
+	}
+	if resp.Answer != "" {
+		t.Fatalf("Answer = %q, want follow-up text preserved only as Reply", resp.Answer)
+	}
+}
+
 func TestProvider_GenerateToolCallHTTPErrorIncludesRequestContext(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `{"code":400,"msg":"bad request"}`, http.StatusBadRequest)

cmd/micro/README.md

@@ -66,10 +66,11 @@ provider-free agent path:
 
 ```
 micro agent demo
+micro examples
 ```
 
-That points at the smallest mock-model first-agent example and the no-secret
-transcript before you add provider-backed chat.
+Those commands point at the smallest mock-model first-agent example, the no-secret
+transcript, and the support app before you add provider-backed chat.
 
 ### Output
 

cmd/micro/cli/cli.go

@@ -24,6 +24,55 @@ import (
 	_ "go-micro.dev/v6/cmd/micro/cli/remote"
 )
 
+const zeroToHeroHelp = `0→hero no-secret lifecycle demo
+
+Run this from a go-micro repository checkout when you want one command that
+proves the maintained services → agents → workflows path without provider keys:
+
+  ./internal/harness/zero-to-hero-ci/run.sh
+
+That script runs the same deterministic path CI uses:
+  - CLI discovery for scaffold, run, chat, inspect, flow runs, and deploy dry-run
+  - the smallest first-agent example
+  - the support-desk reference app with services, an agent, a flow, and an approval gate
+  - plan/delegate and universe harnesses with only the model mocked
+
+If you only want the runnable examples first:
+  go run ./examples/first-agent
+  go run ./examples/support
+
+Full local contract:
+  make harness
+
+Guide: https://go-micro.dev/docs/guides/zero-to-hero.html`
+
+const examplesWayfinding = `First-agent examples (no provider key required)
+
+Run these from a go-micro repository checkout in this order:
+
+  1. Smallest service-backed agent
+       go run ./examples/first-agent
+     Proves an agent can call a service tool with the deterministic mock model.
+
+  2. No-secret support-agent transcript
+       go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentTranscript -count=1
+     Exercises service tools, mock-model chat, and inspectable run history.
+
+  3. Full services → agents → workflows reference app
+       go run ./examples/support
+     Shows the support desk service, agent, workflow, and approval gate together.
+
+Then continue the same path with the installed CLI:
+  micro agent demo
+  micro docs
+  micro zero-to-hero
+
+Guides:
+  https://go-micro.dev/docs/guides/no-secret-first-agent.html
+  https://go-micro.dev/docs/guides/your-first-agent.html
+  https://go-micro.dev/docs/guides/debugging-agents.html
+  https://go-micro.dev/docs/guides/zero-to-hero.html`
+
 const docsWayfinding = `First-agent and 0→hero docs:
 
   1. Start with the no-secret CLI demo
@@ -49,8 +98,8 @@ const docsWayfinding = `First-agent and 0→hero docs:
      https://go-micro.dev/docs/guides/debugging-agents.html
      Inspect agent runs and memory with:
        micro agent doctor
-       micro inspect agent
-       micro runs <agent>
+       micro inspect agent <name>
+       micro agent history <name>
 
   5. 0→hero Reference
      https://go-micro.dev/docs/guides/zero-to-hero.html
@@ -128,6 +177,28 @@ func init() {
 				return nil
 			},
 		},
+
+		{
+			Name:  "examples",
+			Usage: "Show provider-free first-agent example paths",
+			Description: `Print the maintained no-secret examples for the services → agents →
+workflows on-ramp: first-agent, transcript, support app, and matching guides.`,
+			Action: func(ctx *cli.Context) error {
+				fmt.Fprintln(ctx.App.Writer, examplesWayfinding)
+				return nil
+			},
+		},
+		{
+			Name:  "zero-to-hero",
+			Usage: "Show the no-secret 0→hero lifecycle demo command",
+			Description: `Print the maintained provider-free services → agents → workflows
+lifecycle command and the smaller runnable examples it covers.`,
+			Aliases: []string{"hero"},
+			Action: func(ctx *cli.Context) error {
+				fmt.Fprintln(ctx.App.Writer, zeroToHeroHelp)
+				return nil
+			},
+		},
 		{
 			Name:  "docs",
 			Usage: "Show the first-agent and 0→hero documentation path",

cmd/micro/cli/new/contract_test.go

@@ -67,7 +67,7 @@ func TestPrintNextStepsSurfacesFirstAgentPath(t *testing.T) {
 		"micro agent preflight",
 		"go run .",
 		"micro chat",
-		"micro inspect agent",
+		"micro inspect agent <name>",
 		"micro agent demo",
 		"micro docs",
 		"your-first-agent.html",
@@ -84,7 +84,7 @@ func TestPrintNextStepsNoMCPSkipsMCPHints(t *testing.T) {
 	var out bytes.Buffer
 	printNextSteps(&out, "worker", true)
 
-	for _, want := range []string{"micro agent preflight", "micro chat", "micro inspect agent", "micro agent demo", "micro docs"} {
+	for _, want := range []string{"micro agent preflight", "micro chat", "micro inspect agent <name>", "micro agent demo", "micro docs"} {
 		if !strings.Contains(out.String(), want) {
 			t.Fatalf("--no-mcp next steps missing %q:\n%s", want, out.String())
 		}

cmd/micro/cli/new/new.go

@@ -291,7 +291,7 @@ func printNextSteps(w io.Writer, dir string, noMCP bool) {
 	fmt.Fprintln(w, "    micro agent preflight")
 	fmt.Fprintln(w, "    go run .")
 	fmt.Fprintln(w, "    micro chat")
-	fmt.Fprintln(w, "    micro inspect agent")
+	fmt.Fprintln(w, "    micro inspect agent <name>")
 	fmt.Fprintln(w)
 	fmt.Fprintln(w, "  First-agent path:")
 	fmt.Fprintln(w, "    micro agent demo")

cmd/micro/first_agent_walkthrough_test.go

@@ -22,7 +22,7 @@ func TestFirstAgentWalkthroughCLIBoundaries(t *testing.T) {
 		}
 	}
 
-	for _, want := range []string{"new", "run", "chat", "inspect", "agent", "docs"} {
+	for _, want := range []string{"new", "run", "chat", "inspect", "agent", "docs", "examples"} {
 		if !commands[want] {
 			t.Fatalf("first-agent walkthrough missing %q command", want)
 		}
@@ -68,12 +68,42 @@ func TestFirstAgentWalkthroughCLIBoundaries(t *testing.T) {
 		"micro run",
 		"micro chat",
 		"micro agent doctor     # after micro run: chat/gateway/inspect recovery",
-		"micro inspect agent",
+		"micro inspect agent <name>",
+		"micro agent history <name>",
 	} {
 		if !strings.Contains(out.String(), want) {
 			t.Fatalf("micro docs output missing %q:\n%s", want, out.String())
 		}
 	}
+	if strings.Contains(out.String(), "micro runs") {
+		t.Fatalf("micro docs output should use the first-agent inspect command, not the legacy runs shortcut:\n%s", out.String())
+	}
+
+	examples := commandByName(t, "examples")
+	if !strings.Contains(examples.Usage, "first-agent") {
+		t.Fatalf("micro examples should advertise the first-agent examples path; usage was %q", examples.Usage)
+	}
+	out.Reset()
+	if err := examples.Action(cli.NewContext(app, nil, nil)); err != nil {
+		t.Fatalf("micro examples failed: %v", err)
+	}
+	for _, want := range []string{
+		"First-agent examples",
+		"go run ./examples/first-agent",
+		"go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentTranscript -count=1",
+		"go run ./examples/support",
+		"micro agent demo",
+		"micro docs",
+		"micro zero-to-hero",
+		"no-secret-first-agent.html",
+		"your-first-agent.html",
+		"debugging-agents.html",
+		"zero-to-hero.html",
+	} {
+		if !strings.Contains(out.String(), want) {
+			t.Fatalf("micro examples output missing %q:\n%s", want, out.String())
+		}
+	}
 
 	agent := commandByName(t, "agent")
 	if !strings.Contains(agent.Usage, "micro agent demo") {

cmd/micro/zero_to_hero_cli_test.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"bytes"
+	"strings"
 	"testing"
 
 	microcmd "go-micro.dev/v6/cmd"
@@ -19,7 +21,7 @@ func TestZeroToHeroCLIBoundaries(t *testing.T) {
 		}
 	}
 
-	for _, want := range []string{"run", "chat", "flow", "inspect", "deploy"} {
+	for _, want := range []string{"run", "chat", "flow", "inspect", "deploy", "zero-to-hero"} {
 		if !commands[want] {
 			t.Fatalf("missing %q command", want)
 		}
@@ -48,3 +50,29 @@ func TestZeroToHeroCLIBoundaries(t *testing.T) {
 		t.Fatal("missing deploy boundary: deploy --dry-run")
 	}
 }
+
+func TestZeroToHeroCommandPrintsMaintainedNoSecretPath(t *testing.T) {
+	app := microcmd.DefaultCmd.App()
+	var out bytes.Buffer
+	oldWriter := app.Writer
+	app.Writer = &out
+	t.Cleanup(func() { app.Writer = oldWriter })
+
+	if err := app.Run([]string{"micro", "zero-to-hero"}); err != nil {
+		t.Fatalf("micro zero-to-hero failed: %v", err)
+	}
+
+	got := out.String()
+	for _, want := range []string{
+		"0→hero no-secret lifecycle demo",
+		"./internal/harness/zero-to-hero-ci/run.sh",
+		"go run ./examples/first-agent",
+		"go run ./examples/support",
+		"make harness",
+		"services → agents → workflows",
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("micro zero-to-hero output missing %q:\n%s", want, got)
+		}
+	}
+}

internal/docs/AGENT_CONFORMANCE.md

@@ -43,7 +43,7 @@ contract.
 
 ## Scheduled CI
 
-The daily/manual `Harness (E2E)` workflow runs the same matrix with
+The hourly/manual `Harness (E2E)` workflow runs the same matrix with
 `GO_MICRO_AGENT_CONFORMANCE_LIVE=1` and the provider secrets exported. Providers
 whose keys are absent still skip cleanly, while any configured provider must pass
 the shared tool-calling scenario. This keeps scheduled conformance key-gated: PR

internal/harness/plan-delegate/main.go

@@ -157,7 +157,7 @@ func (s *NotifyService) Send(ctx context.Context, req *SendRequest, rsp *SendRes
 	if s.bySend == nil {
 		s.bySend = map[string]bool{}
 	}
-	key := strings.ToLower(strings.TrimSpace(req.To)) + "\x00" + strings.ToLower(strings.TrimSpace(req.Message))
+	key := notifyDedupKey(req.To, req.Message)
 	s.attempts++
 	if !s.bySend[key] {
 		s.bySend[key] = true
@@ -184,6 +184,51 @@ func (s *NotifyService) duplicateAttempts() int {
 	return s.duplicates
 }
 
+func notifyDedupKey(to, message string) string {
+	recipient := canonicalLaunchNotifyRecipient(normalizeNotifyText(to))
+	body := normalizeNotifyText(message)
+	if isLaunchReadinessNotify(body) {
+		body = "launch-readiness"
+	}
+	return recipient + "\x00" + body
+}
+
+func canonicalLaunchNotifyRecipient(recipient string) string {
+	switch recipient {
+	case "owner", "launch owner", "plan owner", "owner acme com", "owner@acme com", "owner @ acme com":
+		return "owner@acme.com"
+	default:
+		if strings.Contains(recipient, "owner") && strings.Contains(recipient, "acme") {
+			return "owner@acme.com"
+		}
+		return recipient
+	}
+}
+
+func normalizeNotifyText(message string) string {
+	message = strings.ToLower(strings.TrimSpace(message))
+	message = strings.Map(func(r rune) rune {
+		switch {
+		case r >= 'a' && r <= 'z', r >= '0' && r <= '9':
+			return r
+		case r == '@':
+			return r
+		default:
+			return ' '
+		}
+	}, message)
+	return strings.Join(strings.Fields(message), " ")
+}
+
+func isLaunchReadinessNotify(message string) bool {
+	return strings.Contains(message, "launch") &&
+		strings.Contains(message, "plan") &&
+		(strings.Contains(message, "ready") ||
+			strings.Contains(message, "readiness") ||
+			strings.Contains(message, "prepared") ||
+			strings.Contains(message, "complete"))
+}
+
 // ---------------------------------------------------------------------------
 // mock LLM provider — the ONLY fake. It "reasons" by simple heuristics
 // over the tools it's offered and the system prompt it's given, calling
@@ -199,6 +244,10 @@ type mockModel struct {
 	// still keeping the regression deterministic and keyless.
 	unknownDelegateOnce    bool
 	emittedUnknownDelegate bool
+
+	// duplicateNotify makes the comms mock replay the same notification call.
+	// The notify service should collapse that replay to one durable side effect.
+	duplicateNotify bool
 }
 
 func newMock(opts ...ai.Option) ai.Model {
@@ -213,6 +262,12 @@ func newMockUnknownDelegate(opts ...ai.Option) ai.Model {
 	return m
 }
 
+func newMockDuplicateNotify(opts ...ai.Option) ai.Model {
+	m := &mockModel{duplicateNotify: true}
+	_ = m.Init(opts...)
+	return m
+}
+
 func (m *mockModel) Init(opts ...ai.Option) error {
 	for _, o := range opts {
 		o(&m.opts)
@@ -254,10 +309,14 @@ func (m *mockModel) Generate(ctx context.Context, req *ai.Request, _ ...ai.Gener
 	// comms agent: owns notify, has Send but not Add.
 	case hasSend && !hasAdd:
 		send := findTool(req.Tools, "Send")
-		m.call("comms", send, map[string]any{
+		input := map[string]any{
 			"to":      "owner@acme.com",
 			"message": "The launch plan is ready",
-		})
+		}
+		m.call("comms", send, input)
+		if m.duplicateNotify {
+			m.call("comms", send, input)
+		}
 		return &ai.Response{Answer: "Notified owner@acme.com."}, nil
 
 	// conductor: has the task Add tool — plan, create tasks, delegate.
@@ -322,6 +381,8 @@ func runPlanDelegate(provider string) error {
 		ai.Register("mock", newMock)
 	case "mock-unknown-delegate":
 		ai.Register("mock-unknown-delegate", newMockUnknownDelegate)
+	case "mock-duplicate-notify":
+		ai.Register("mock-duplicate-notify", newMockDuplicateNotify)
 	default:
 		apiKey = providerKey(provider)
 		if apiKey == "" {
@@ -507,8 +568,8 @@ func waitForPlanDelegateExecution(done <-chan error, taskSvc *TaskService, notif
 			}
 			return nil
 		case <-ticker.C:
-			if dup := notifySvc.duplicateAttempts(); dup > 0 {
-				return fmt.Errorf("duplicate notify attempts: got %d duplicate replay(s), want 0", dup)
+			if notifySvc.count() == 1 {
+				continue
 			}
 		}
 	}
@@ -520,9 +581,6 @@ func waitForNotifySideEffect(notifySvc *NotifyService, timeout time.Duration) (b
 		if notifySvc.count() == 1 {
 			return true, nil
 		}
-		if dup := notifySvc.duplicateAttempts(); dup > 0 {
-			return false, fmt.Errorf("duplicate notify attempts: got %d duplicate replay(s), want 0", dup)
-		}
 		if !time.Now().Before(deadline) {
 			return false, nil
 		}
@@ -540,7 +598,7 @@ func isClientTimeout(err error) bool {
 }
 
 func main() {
-	provider := flag.String("provider", "mock", "LLM provider: mock (default), mock-unknown-delegate, anthropic, openai, gemini, groq, mistral, together, atlascloud")
+	provider := flag.String("provider", "mock", "LLM provider: mock (default), mock-unknown-delegate, mock-duplicate-notify, anthropic, openai, gemini, groq, mistral, together, atlascloud")
 	flag.Parse()
 
 	if err := runPlanDelegate(*provider); err != nil {

internal/harness/plan-delegate/main_test.go

@@ -231,6 +231,15 @@ func TestPlanDelegateRetriesAfterUnknownDelegateTool(t *testing.T) {
 	}
 }
 
+func TestPlanDelegateIdempotentDuplicateNotifyReplay(t *testing.T) {
+	if testing.Short() {
+		t.Skip("0→hero harness boots an end-to-end system; skipped with -short")
+	}
+	if err := runPlanDelegate("mock-duplicate-notify"); err != nil {
+		t.Fatalf("0→hero harness with duplicate notify replay: %v", err)
+	}
+}
+
 func TestTaskServiceAddIsIdempotentForLaunchTitles(t *testing.T) {
 	svc := new(TaskService)
 	for _, title := range []string{"Design", "design task", "Build", "Build launch task", "Ship", "ship readiness"} {
@@ -247,7 +256,7 @@ func TestTaskServiceAddIsIdempotentForLaunchTitles(t *testing.T) {
 	}
 }
 
-func TestPlanDelegateExecutionReportsDuplicateNotifyBeforeTimeout(t *testing.T) {
+func TestPlanDelegateExecutionAcceptsDuplicateNotifyReplay(t *testing.T) {
 	notifySvc := new(NotifyService)
 	for i := 0; i < 2; i++ {
 		var rsp SendResponse
@@ -256,20 +265,16 @@ func TestPlanDelegateExecutionReportsDuplicateNotifyBeforeTimeout(t *testing.T)
 		}
 	}
 
-	done := make(chan error)
-	errCh := make(chan error, 1)
-	go func() { errCh <- waitForPlanDelegateExecution(done, new(TaskService), notifySvc) }()
-
-	select {
-	case err := <-errCh:
-		if err == nil {
-			t.Fatal("waitForPlanDelegateExecution returned nil, want duplicate notify error")
-		}
-		if got := err.Error(); !strings.Contains(got, "duplicate notify attempts") {
-			t.Fatalf("error = %q, want duplicate notify attempts", got)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("waitForPlanDelegateExecution did not report duplicate notify before timeout")
+	done := make(chan error, 1)
+	done <- nil
+	if err := waitForPlanDelegateExecution(done, new(TaskService), notifySvc); err != nil {
+		t.Fatalf("waitForPlanDelegateExecution returned %v, want duplicate replay accepted", err)
+	}
+	if got := notifySvc.count(); got != 1 {
+		t.Fatalf("notify count = %d, want 1 after duplicate replay", got)
+	}
+	if got := notifySvc.duplicateAttempts(); got != 1 {
+		t.Fatalf("duplicate attempts = %d, want 1 recorded replay", got)
 	}
 }
 
@@ -417,9 +422,18 @@ func TestPlanDelegateExecutionClassifiesPartialClientTimeout(t *testing.T) {
 
 func TestNotifyServiceSendIsIdempotentForDuplicateDelivery(t *testing.T) {
 	svc := new(NotifyService)
-	for i := 0; i < 3; i++ {
+	messages := []string{
+		"The launch plan is ready",
+		"The launch plan is ready.",
+		"Launch readiness: the plan is ready!",
+	}
+	for i, message := range messages {
 		var rsp SendResponse
-		if err := svc.Send(context.Background(), &SendRequest{To: "owner@acme.com", Message: "The launch plan is ready"}, &rsp); err != nil {
+		to := "owner@acme.com"
+		if i == len(messages)-1 {
+			to = "owner"
+		}
+		if err := svc.Send(context.Background(), &SendRequest{To: to, Message: message}, &rsp); err != nil {
 			t.Fatalf("Send attempt %d: %v", i+1, err)
 		}
 		if !rsp.Sent {
@@ -429,4 +443,32 @@ func TestNotifyServiceSendIsIdempotentForDuplicateDelivery(t *testing.T) {
 	if got := svc.count(); got != 1 {
 		t.Fatalf("notify count = %d, want 1 after duplicate delivery replays", got)
 	}
+	if got := svc.duplicateAttempts(); got != len(messages)-1 {
+		t.Fatalf("duplicate notify attempts = %d, want %d", got, len(messages)-1)
+	}
+}
+
+func TestNotifyServiceCollapsesProviderReadinessParaphrases(t *testing.T) {
+	svc := new(NotifyService)
+	requests := []SendRequest{
+		{To: "owner@acme.com", Message: "The launch plan is ready"},
+		{To: "owner @ acme.com", Message: "Launch plan ready."},
+		{To: "launch owner", Message: "The launch readiness plan is prepared."},
+		{To: "plan owner", Message: "Launch plan is complete!"},
+	}
+	for i, req := range requests {
+		var rsp SendResponse
+		if err := svc.Send(context.Background(), &req, &rsp); err != nil {
+			t.Fatalf("Send attempt %d: %v", i+1, err)
+		}
+		if !rsp.Sent {
+			t.Fatalf("Send attempt %d reported Sent=false", i+1)
+		}
+	}
+	if got := svc.count(); got != 1 {
+		t.Fatalf("notify count = %d, want 1 after provider paraphrase replays", got)
+	}
+	if got := svc.duplicateAttempts(); got != len(requests)-1 {
+		t.Fatalf("duplicate notify attempts = %d, want %d", got, len(requests)-1)
+	}
 }

internal/harness/provider-conformance/README.md

@@ -69,7 +69,7 @@ go run ./internal/harness/provider-conformance \
 ## Scheduled CI behavior
 
 The `Harness (E2E)` workflow runs on pushes and pull requests with deterministic
-mock LLMs, including `provider-conformance -providers mock`. On the daily
+mock LLMs, including `provider-conformance -providers mock`. On the hourly
 schedule and manual dispatch it also runs the live provider conformance job. A
 manual dispatch can narrow `providers` or `harnesses`, and can set
 `require_configured=true` to fail fast when an expected repository secret is

internal/harness/provider-conformance/workflow_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestHarnessWorkflowSchedulesLiveProviderMatrix(t *testing.T) {
+	path := filepath.Join(repoRoot(), ".github", "workflows", "harness.yml")
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read harness workflow: %v", err)
+	}
+	workflow := string(b)
+
+	checks := []string{
+		`name: Harness (E2E)`,
+		`schedule:`,
+		`cron: "17 * * * *"`,
+		`workflow_dispatch:`,
+		`harness-live:`,
+		`if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'`,
+		`ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}`,
+		`OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}`,
+		`GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}`,
+		`GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}`,
+		`MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}`,
+		`MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}`,
+		`TOGETHER_API_KEY: ${{ secrets.TOGETHER_API_KEY }}`,
+		`ATLASCLOUD_API_KEY: ${{ secrets.ATLASCLOUD_API_KEY }}`,
+		`-summary-json provider-conformance-summary.json`,
+		`-summary-markdown provider-conformance-summary.md`,
+		`-capabilities-markdown provider-capabilities.md`,
+		`actions/upload-artifact@v4`,
+	}
+	for _, want := range checks {
+		if !strings.Contains(workflow, want) {
+			t.Fatalf("harness workflow missing %q", want)
+		}
+	}
+}

internal/harness/zero-to-hero-ci/README.md

@@ -11,9 +11,11 @@ scripted so CI can run it on every push without external services or model keys.
    documented first-agent walkthrough path.
 2. **Run** — `micro run` remains available as the local development entry point.
 3. **Chat** — `micro chat` remains available as the interactive agent entry point.
-4. **Inspect** — `micro inspect agent <name>` and `micro inspect flow <name>`
-   remain available as the local run-history inspection step, with `micro flow
-   runs` preserving durable workflow history inspection.
+4. **Inspect/debugging** — `micro inspect agent <name>`, `micro agent history <name>`,
+   and `micro inspect flow <name>` remain available as the local run-history
+   inspection step. The no-secret debugging smoke seeds durable agent run history
+   and memory, then runs the documented inspect/history commands without provider
+   credentials; `micro flow runs` preserves durable workflow history inspection.
 5. **Deploy** — `micro deploy --dry-run <target>` remains available as the
    deployment-boundary checkpoint. The dry run resolves configured deploy targets
    and services and prints the remote build/copy/systemd/health plan without

internal/harness/zero-to-hero-ci/docs_test.go

@@ -1,11 +1,17 @@
 package zerotoheroci
 
 import (
+	"encoding/json"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
+	"time"
+
+	goagent "go-micro.dev/v6/agent"
+	"go-micro.dev/v6/store"
 )
 
 func TestZeroToHeroReferenceDocs(t *testing.T) {
@@ -21,6 +27,7 @@ func TestZeroToHeroReferenceDocs(t *testing.T) {
 		"go test ./examples/first-agent -run TestRunFirstAgent -count=1",
 		"go test ./examples/support -run 'TestRunSupportMockSmoke|TestZeroToHeroReadmeDocumentsLifecycle' -count=1",
 		"./internal/harness/zero-to-hero-ci/run.sh",
+		"micro zero-to-hero",
 		"go run ./internal/harness/agent-flow",
 		"make provider-conformance-mock",
 		"internal/harness/plan-delegate",
@@ -76,6 +83,111 @@ func TestGuidesNavigationLeadsWithDoing(t *testing.T) {
 	}
 }
 
+func TestYourFirstAgentTutorialSmoke(t *testing.T) {
+	root := filepath.Clean(filepath.Join("..", "..", ".."))
+	absRoot, err := filepath.Abs(root)
+	if err != nil {
+		t.Fatalf("resolve repository root: %v", err)
+	}
+	guide := readFile(t, filepath.Join(root, "internal", "website", "docs", "guides", "your-first-agent.md"))
+
+	for _, want := range []string{
+		"go test ./internal/harness/zero-to-hero-ci -run TestYourFirstAgentTutorialSmoke -count=1",
+		"micro agent preflight",
+		"mkdir first-agent",
+		"go mod init example.com/first-agent",
+		"go get go-micro.dev/v6@v6",
+		"micro run",
+		"micro call task TaskService.Create",
+		"micro call task TaskService.List",
+		"micro chat assistant",
+		"micro inspect agent assistant",
+	} {
+		if !strings.Contains(guide, want) {
+			t.Fatalf("Your First Agent guide missing copy/paste boundary %q", want)
+		}
+	}
+
+	mainGo := extractFirstAgentMain(t, guide)
+	workspace := t.TempDir()
+	writeFile(t, filepath.Join(workspace, "go.mod"), "module example.com/first-agent\n\ngo 1.24\n\nrequire go-micro.dev/v6 v6.0.0\n\nreplace go-micro.dev/v6 => "+absRoot+"\n")
+	writeFile(t, filepath.Join(workspace, "main.go"), mainGo)
+
+	runInWorkspace(t, workspace, "go", "mod", "tidy")
+	runInWorkspace(t, workspace, "go", "test", "./...")
+}
+
+func extractFirstAgentMain(t *testing.T, guide string) string {
+	t.Helper()
+	start := strings.Index(guide, "Add `main.go`:")
+	if start == -1 {
+		t.Fatal("Your First Agent guide is missing the main.go section")
+	}
+	rest := guide[start:]
+	open := strings.Index(rest, "```go")
+	if open == -1 {
+		t.Fatal("Your First Agent guide is missing a Go code fence for main.go")
+	}
+	rest = rest[open+len("```go"):]
+	close := strings.Index(rest, "```")
+	if close == -1 {
+		t.Fatal("Your First Agent guide main.go code fence is not closed")
+	}
+	return strings.TrimSpace(rest[:close]) + "\n"
+}
+
+func writeFile(t *testing.T, name, contents string) {
+	t.Helper()
+	if err := os.WriteFile(name, []byte(contents), 0o644); err != nil {
+		t.Fatalf("write %s: %v", name, err)
+	}
+}
+
+func runInWorkspace(t *testing.T, workspace, name string, args ...string) {
+	t.Helper()
+	cmd := exec.Command(name, args...)
+	cmd.Dir = workspace
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("Your First Agent tutorial command %q does not pass from a clean workspace: %v\n%s", strings.Join(append([]string{name}, args...), " "), err, out)
+	}
+}
+
+func TestArchitectureDocsAlignWithAgentHarnessLifecycle(t *testing.T) {
+	root := filepath.Clean(filepath.Join("..", "..", ".."))
+	doc := readFile(t, filepath.Join(root, "internal", "website", "docs", "architecture.md"))
+
+	for _, want := range []string{
+		"services → agents → workflows lifecycle",
+		"## Service substrate",
+		"## Agent harness",
+		"## Workflows",
+		"## Interop gateways",
+		"`model` / `ai.Model`",
+		"`store` / memory",
+		"`ai.Tools`",
+		"`agent`",
+		"`flow`",
+		"`micro mcp`",
+		"`micro a2a`",
+		"[AI Integration](ai-integration.html)",
+		"[Your First Agent](guides/your-first-agent.html)",
+		"[0→hero Reference](guides/zero-to-hero.html)",
+	} {
+		if !strings.Contains(doc, want) {
+			t.Fatalf("architecture doc missing lifecycle marker %q", want)
+		}
+	}
+
+	assertOrderedMarkers(t, "architecture lifecycle", doc, []string{
+		"## Service substrate",
+		"## Agent harness",
+		"## Workflows",
+		"## Interop gateways",
+		"## Developer path",
+	})
+}
+
 func TestFirstAgentWayfindingDocs(t *testing.T) {
 	root := filepath.Clean(filepath.Join("..", "..", ".."))
 	checks := []struct {
@@ -91,6 +203,7 @@ func TestFirstAgentWayfindingDocs(t *testing.T) {
 			links: []string{
 				"internal/website/docs/guides/install-troubleshooting.md",
 				"micro agent demo",
+				"micro zero-to-hero",
 				"internal/website/docs/guides/no-secret-first-agent.md",
 				"internal/website/docs/guides/your-first-agent.md",
 				"internal/website/docs/guides/debugging-agents.md",
@@ -134,6 +247,7 @@ func TestFirstAgentWayfindingDocs(t *testing.T) {
 			links: []string{
 				"guides/install-troubleshooting.html",
 				"micro agent demo",
+				"micro zero-to-hero",
 				"guides/no-secret-first-agent.html",
 				"guides/your-first-agent.html",
 				"guides/debugging-agents.html",
@@ -379,6 +493,7 @@ func TestGettingStartedDocsLeadWithNoSecretFirstRun(t *testing.T) {
 				"curl -X POST http://localhost:8080/api/helloworld/Helloworld.Call",
 				"## Next Steps",
 				"micro agent demo",
+				"micro zero-to-hero",
 				"guides/no-secret-first-agent.html",
 				"guides/debugging-agents.html",
 				"guides/zero-to-hero.html",
@@ -459,6 +574,110 @@ func TestNoSecretFirstAgentTranscript(t *testing.T) {
 	}
 }
 
+func TestNoSecretFirstAgentDebuggingSmoke(t *testing.T) {
+	root := filepath.Clean(filepath.Join("..", "..", ".."))
+	home := t.TempDir()
+	storeDir := filepath.Join(home, "micro", "store")
+	st := store.NewFileStore(store.DirOption(storeDir))
+
+	seedNoSecretAgentDebuggingState(t, st)
+	if err := st.Close(); err != nil {
+		t.Fatalf("close seeded store: %v", err)
+	}
+
+	micro := buildMicroBinary(t, root)
+
+	for _, tc := range []struct {
+		name string
+		args []string
+		want []string
+	}{
+		{
+			name: "demo advertises provider-free debug path",
+			args: []string{"agent", "demo"},
+			want: []string{"No-secret first-agent demo", "provider-free", "run history", "micro inspect agent <name>"},
+		},
+		{
+			name: "inspect shows seeded run history",
+			args: []string{"inspect", "agent", "assistant", "--limit", "1"},
+			want: []string{`Agent "assistant" runs`, "run-debug-smoke", "status=done", "events=3", "last=done", "trace=trace-debug-"},
+		},
+		{
+			name: "inspect filters documented statuses",
+			args: []string{"inspect", "agent", "--status", "done", "--json", "assistant"},
+			want: []string{"run-debug-smoke", `"status": "done"`, `"trace_id": "trace-debug-smoke"`},
+		},
+		{
+			name: "agent history shows memory and run index",
+			args: []string{"agent", "history", "assistant"},
+			want: []string{"user:", "Triage ticket-1", "assistant:", "ticket-1 is ready", "Runs:", "run-debug-smoke", "status=done"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			out := runMicroCLIWithHome(t, micro, home, tc.args...)
+			for _, want := range tc.want {
+				if !strings.Contains(out, want) {
+					t.Fatalf("micro %s output missing %q:\n%s", strings.Join(tc.args, " "), want, out)
+				}
+			}
+		})
+	}
+}
+
+func seedNoSecretAgentDebuggingState(t *testing.T, st store.Store) {
+	t.Helper()
+	scoped := store.Scope(st, "agent", "assistant")
+	runID := "run-debug-smoke"
+	events := []goagent.RunEvent{
+		{Time: time.Unix(1700000000, 0), RunID: runID, Agent: "assistant", TraceID: "trace-debug-smoke", Kind: "run", Name: "ask"},
+		{Time: time.Unix(1700000001, 0), RunID: runID, Agent: "assistant", TraceID: "trace-debug-smoke", Kind: "model", Provider: "mock", Model: "first-agent-mock"},
+		{Time: time.Unix(1700000002, 0), RunID: runID, Agent: "assistant", TraceID: "trace-debug-smoke", Kind: "done", Name: "answer"},
+	}
+	for _, event := range events {
+		b, err := json.Marshal(event)
+		if err != nil {
+			t.Fatal(err)
+		}
+		key := "runs/" + event.RunID + "/" + event.Time.Format("20060102150405.000000000") + "-" + event.Kind
+		if err := scoped.Write(&store.Record{Key: key, Value: b}); err != nil {
+			t.Fatalf("seed run event: %v", err)
+		}
+	}
+
+	mem := goagent.NewMemory(scoped, "history", 10)
+	mem.Add("user", "Triage ticket-1 for Alice")
+	mem.Add("assistant", "ticket-1 is ready for Alice without provider secrets")
+}
+
+func buildMicroBinary(t *testing.T, root string) string {
+	t.Helper()
+	bin := filepath.Join(t.TempDir(), "micro")
+	cmd := exec.Command("go", "build", "-o", bin, "./cmd/micro")
+	cmd.Dir = root
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("build micro CLI failed: %v\n%s", err, out)
+	}
+	return bin
+}
+
+func runMicroCLIWithHome(t *testing.T, micro, home string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command(micro, args...)
+	cmd.Env = append(os.Environ(),
+		"HOME="+home,
+		"MICRO_AI_API_KEY=",
+		"OPENAI_API_KEY=",
+		"ANTHROPIC_API_KEY=",
+		"GEMINI_API_KEY=",
+	)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("micro %s failed: %v\n%s", strings.Join(args, " "), err, out)
+	}
+	return string(out)
+}
+
 func TestFirstAgentWayfindingTargetsExist(t *testing.T) {
 	root := filepath.Clean(filepath.Join("..", "..", ".."))
 	for _, target := range []string{

internal/harness/zero-to-hero-ci/run.sh

@@ -8,7 +8,7 @@ cd "$ROOT"
 # without secrets or long-running daemons.
 go test ./cmd/micro -run 'TestFirstAgentWalkthroughCLIBoundaries|TestZeroToHeroCLIBoundaries' -count=1
 go test ./cmd/micro/cli/deploy -run TestDeployDryRun -count=1
-go test ./internal/harness/zero-to-hero-ci -run 'TestNoSecretFirstAgentTranscript|TestZeroToHeroReferenceDocs' -count=1
+go test ./internal/harness/zero-to-hero-ci -run 'TestNoSecretFirstAgentTranscript|TestNoSecretFirstAgentDebuggingSmoke|TestZeroToHeroReferenceDocs|TestYourFirstAgentTutorialSmoke' -count=1
 
 # Deterministic no-secret reference scenarios. These use the real Go Micro
 # runtime and mock only the LLM provider. The support example is the maintained

internal/website/_data/navigation.yml

@@ -42,6 +42,8 @@ examples:
 guides:
   - title: Debugging your agent
     url: /docs/guides/debugging-agents.html
+  - title: micro loop quickstart
+    url: /docs/guides/micro-loop.html
   - title: Plan & Delegate
     url: /docs/guides/plan-delegate.html
   - title: Agent Guardrails
@@ -86,6 +88,7 @@ search_order:
   - /docs/guides/your-first-agent.html
   - /docs/guides/zero-to-hero.html
   - /docs/guides/debugging-agents.html
+  - /docs/guides/micro-loop.html
   - /docs/getting-started.html
   - /docs/mcp.html
   - /docs/architecture.html

internal/website/docs/architecture.md

@@ -2,75 +2,124 @@
 layout: default
 ---
 
-## Architecture
+# Architecture
 
 <img src="/images/generated/architecture.jpg" alt="Go Micro architecture" style="width: 100%; border-radius: 8px; margin: 1rem 0 1.5rem;" />
 
-An overview of the Go Micro architecture.
+Go Micro is one runtime for the services → agents → workflows lifecycle. The same
+registry, client/server RPC, store, broker, and gateway primitives that run a
+service also give an agent discoverable tools, durable state, interop, and a
+place to hand off deterministic work.
 
-## Overview
+## Lifecycle map
 
-Go Micro abstracts away the details of distributed systems. Here are the main features.
+```text
+Services  →  Agents  →  Workflows
+handlers     model loop  durable orchestration
+registry     memory      triggers and ordered steps
+RPC tools    guardrails   agent dispatch
+```
 
-- **Authentication** - Auth is built in as a first class citizen. Authentication and authorization enable secure
-  zero trust networking by providing every service an identity and certificates. This additionally includes rule
-  based access control.
+The layers are progressive: start with a service, expose its endpoints as tools,
+wrap those tools with an agent, then move the known paths into flows so the model
+only handles the uncertain parts.
 
-- **Dynamic Config** - Load and hot reload dynamic config from anywhere. The config interface provides a way to load application
-  level config from any source such as env vars, file, etcd. You can merge the sources and even define fallbacks.
+## Service substrate
 
-- **Data Storage** - A simple data store interface to read, write and delete records. It includes support for many storage backends
-in the plugins repo. State and persistence becomes a core requirement beyond prototyping and Micro looks to build that into the framework.
+Go Micro's service framework supplies the distributed-systems base every agent
+needs:
 
-- **Service Discovery** - Automatic service registration and name resolution. Service discovery is at the core of micro service
-  development. When service A needs to speak to service B it needs the location of that service. The default discovery mechanism is
-  multicast DNS (mdns), a zeroconf system.
+- **Registry** — services, agents, and flows register under names so clients,
+  gateways, and other agents can discover them without hard-coded addresses. The
+  default is mDNS for local development, with pluggable backends for production.
+- **RPC client/server** — endpoints are normal Go handlers reached through the
+  client, load balanced through discovery, encoded through codecs, and optionally
+  streamed.
+- **Broker** — asynchronous events connect services and trigger flows without
+  coupling producers to consumers.
+- **Config and auth** — dynamic configuration plus identity and authorization keep
+  local and production runtimes using the same shape.
+- **Pluggable interfaces** — registry, broker, store, transport, codecs, auth, and
+  config are Go interfaces, so the runtime can stay stable while deployments swap
+  infrastructure.
 
-- **Load Balancing** - Client side load balancing built on service discovery. Once we have the addresses of any number of instances
-  of a service we now need a way to decide which node to route to. We use random hashed load balancing to provide even distribution
-  across the services and retry a different node if there's a problem.
+That substrate is intentionally not separate from the agent stack. A service
+endpoint is the smallest useful unit of work, and the registry is the source of
+truth for which tools and agents exist.
 
-- **Message Encoding** - Dynamic message encoding based on content-type. The client and server will use codecs along with content-type
-  to seamlessly encode and decode Go types for you. Any variety of messages could be encoded and sent from different clients. The client
-  and server handle this by default. This includes protobuf and json by default.
+## Agent harness
 
-- **RPC Client/Server** - RPC based request/response with support for bidirectional streaming. We provide an abstraction for synchronous
-  communication. A request made to a service will be automatically resolved, load balanced, dialled and streamed.
+Agents compose the service substrate with the AI-specific packages:
 
-- **Async Messaging** - PubSub is built in as a first class citizen for asynchronous communication and event driven architectures.
-  Event notifications are a core pattern in micro service development. The default messaging system is a HTTP event message broker.
+- **`model` / `ai.Model`** — a pluggable model interface normalizes provider calls
+  while letting applications pick Anthropic, OpenAI, Gemini, Atlas Cloud, Groq,
+  Mistral, Together AI, or a mock model for no-secret tests.
+- **`store` / memory** — agent history, plans, run state, and compacted memory live
+  in durable storage rather than in an in-process chat loop.
+- **`ai.Tools`** — discovers registered service endpoints and executes them through
+  the Go Micro client, so tools are generated from running services instead of a
+  parallel tool registry.
+- **`agent`** — runs the tool-calling loop with guardrails, planning, delegation,
+  service-backed memory, and an `Agent.Chat` RPC endpoint. An agent is therefore a
+  service other clients and agents can call.
 
-- **Pluggable Interfaces** - Go Micro makes use of Go interfaces for each distributed system abstraction. Because of this these interfaces
-  are pluggable and allows Go Micro to be runtime agnostic. You can plugin any underlying technology.
+The result is a harness, not just a prompt loop: model calls are bounded by tool
+scope, state is recoverable, and the same CLI and gateways that reach services can
+reach agents.
 
-## Design
+## Workflows
 
-We will share more on architecture soon
+Use `flow` when the path is known or must be repeatable. Flows subscribe to broker
+events, run ordered deterministic steps, and can dispatch to an agent at the point
+where judgment or language understanding is needed. This keeps long-running work
+observable and restartable while preserving agents for open-ended decisions.
+
+A common shape is:
+
+1. A service emits an event such as `ticket.created`.
+2. A flow validates and enriches the event with deterministic handlers.
+3. The flow dispatches to an agent for classification, drafting, or escalation.
+4. The agent calls registered service tools and returns to the flow for final
+   durable steps.
+
+## Interop gateways
+
+Gateways project the same runtime to external callers:
+
+- **`micro api`** exposes service RPC over HTTP.
+- **`micro mcp`** exposes registered service endpoints as Model Context Protocol
+  tools for external agents.
+- **`micro a2a`** exposes registered Go Micro agents through the Agent2Agent
+  protocol and lets Go Micro flows or agents dispatch to agents hosted elsewhere.
+
+MCP is the services-as-tools boundary; A2A is the agents-as-agents boundary. Both
+come from registry metadata, so adding a service or agent updates the external
+surface without duplicate wiring.
+
+## Developer path
+
+If you are new, follow the architecture in the same order the runtime composes it:
+
+1. [Install troubleshooting](guides/install-troubleshooting.html) — make sure the
+   CLI, `PATH`, version, and no-secret smoke path are healthy.
+2. [`micro agent demo`](getting-started.html#first-agent-on-ramp) — print the
+   provider-free first-agent command and next docs steps from the installed CLI.
+3. [Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent)
+   — run one service-backed agent with a mock model.
+4. [No-secret first-agent transcript](guides/no-secret-first-agent.html) — see the
+   maintained support-agent path work without a provider key.
+5. [Your First Agent](guides/your-first-agent.html) — build and chat with a
+   service-backed agent.
+6. [Debugging your agent](guides/debugging-agents.html) — inspect service
+   registration, tools, memory, providers, and run history.
+7. [0→hero Reference](guides/zero-to-hero.html) — walk scaffold → run → chat →
+   inspect → flow → deploy dry-run as the maintained lifecycle contract.
 
 ## Related
 
-- [ADR Index](architecture/index.md)
+- [AI Integration](ai-integration.html) — layer-by-layer services → agents → workflows wiring
+- [Getting Started](getting-started.html) — first service and first-agent on-ramp
+- [Examples](examples/) — runnable examples mapped to the lifecycle
+- [ADR Index](architecture/index.md) — architecture decision records
 - [Configuration](config.html)
 - [Plugins](plugins.html)
-
-## Example Usage
-
-Here's a minimal Go Micro service demonstrating the architecture:
-
-```go
-package main
-
-import (
-    "go-micro.dev/v6"
-    "log"
-)
-
-func main() {
-    service := micro.NewService("example",
-    )
-    service.Init()
-    if err := service.Run(); err != nil {
-        log.Fatal(err)
-    }
-}
-```

internal/website/docs/getting-started.md

@@ -57,11 +57,13 @@ After this quick start, follow the agent path in order:
 
 1. [Install troubleshooting](guides/install-troubleshooting.html) — verify the CLI install before agent work.
 2. `micro agent demo` — print the provider-free first-agent demo command and next docs steps from the installed CLI.
-3. [Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent) — run one service-backed agent with a mock model and no provider key.
-4. [No-secret first-agent transcript](guides/no-secret-first-agent.html) — run a useful support agent with a mock model before setting up a provider key.
-5. [Your First Agent](guides/your-first-agent.html) — build a service-backed agent and talk to it with `micro chat`.
-6. [Debugging your agent](guides/debugging-agents.html) — inspect service registration, tool calls, run history, memory, provider failures, and flow handoffs when the agent surprises you.
-7. [0→hero reference path](guides/zero-to-hero.html) — prove the full scaffold → run → chat → inspect → deploy dry-run lifecycle with commands exercised by `make harness`.
+3. `micro examples` — print the maintained provider-free runnable examples in copy/paste order.
+4. `micro zero-to-hero` — print the maintained one-command no-secret lifecycle harness and runnable examples.
+5. [Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent) — run one service-backed agent with a mock model and no provider key.
+6. [No-secret first-agent transcript](guides/no-secret-first-agent.html) — run a useful support agent with a mock model before setting up a provider key.
+7. [Your First Agent](guides/your-first-agent.html) — build a service-backed agent and talk to it with `micro chat`.
+8. [Debugging your agent](guides/debugging-agents.html) — inspect service registration, tool calls, run history, memory, provider failures, and flow handoffs when the agent surprises you.
+9. [0→hero reference path](guides/zero-to-hero.html) — prove the full scaffold → run → chat → inspect → deploy dry-run lifecycle with commands exercised by `make harness`.
 
 ## Write a Service
 
@@ -257,4 +259,5 @@ The flow discovers all services as tools and lets the LLM decide which RPCs to c
 - [Agent Design](https://github.com/micro/go-micro/blob/master/internal/docs/AGENT_DESIGN.md) — the full agent interface specification
 - [MCP & AI Agents](mcp.html) — MCP gateway, tool discovery, and auth
 - [Data Model](model.html) — typed persistence with CRUD and queries
+- [`micro loop` quickstart](guides/micro-loop.html) — scaffold a CI-gated autonomous improvement loop for a repository
 - [Deployment](deployment.html) — deploy via SSH + systemd

internal/website/docs/guides/micro-loop.md

@@ -0,0 +1,96 @@
+---
+layout: default
+---
+
+# `micro loop` quickstart
+
+`micro loop` scaffolds the autonomous improvement loop that Go Micro uses on
+this repository: GitHub Actions workflows for planning, building, evaluation
+feedback, coherence, security, and release. Use it when you want a repository to
+continuously turn a ranked queue into small PRs while CI remains the merge gate.
+
+## 1. Initialize the loop
+
+Run the default loop from the repository root:
+
+```bash
+micro loop init
+```
+
+For every role used by Go Micro itself, scaffold all workflows:
+
+```bash
+micro loop init --roles all
+```
+
+The command writes:
+
+- `.github/loop/NORTH_STAR.md` — the direction every increment should optimize.
+- `.github/loop/PRIORITIES.md` — the ranked queue; the builder takes the top open issue.
+- `.github/loop/prompts/*.md` — editable policy for planner, builder, triage, coherence, and security roles.
+- `.github/workflows/loop-*.yml` — generated GitHub Actions mechanics.
+
+Edit the files under `.github/loop/` to steer the loop. Re-run
+`micro loop init --roles all --force` only when you want to regenerate workflow
+mechanics from the installed CLI.
+
+## 2. Configure the dispatch token
+
+The scheduled builder needs a repository secret containing a token from a user
+account that the coding agent will answer. Go Micro names that secret
+`CODEX_TRIGGER_TOKEN` by default. If you use another secret name, pass it when
+you initialize the loop:
+
+```bash
+micro loop init --agent @codex --token-secret LOOP_TOKEN --roles all
+```
+
+The token needs enough repository permission to open issues, comment, push
+branches, create pull requests, and enable auto-merge. Run `gh auth setup-git` in
+the environment that will push branches so `git push` uses the same credentials
+as `gh`.
+
+## 3. Make CI the gate
+
+The loop should not be its own reviewer. Protect the default branch so PRs merge
+only after the required checks pass. At minimum, require the same commands the
+Go Micro loop verifies locally and in CI:
+
+```bash
+go build ./...
+go test ./...
+golangci-lint run ./...
+```
+
+If your repository has a harness or end-to-end grader, make that required too.
+Keep human approval requirements out of the autonomous path unless you intend the
+loop to pause for review.
+
+## 4. Verify the wiring
+
+After editing the North Star, queue, prompts, token secret, and branch
+protection, run:
+
+```bash
+micro loop verify
+```
+
+`micro loop verify` checks that the loop direction, queue, prompts, role
+workflows, and non-loop CI gate are present. Fix any reported missing items
+before relying on scheduled increments.
+
+## 5. Operate the queue
+
+Keep one ranked list in `.github/loop/PRIORITIES.md`. Each item should link a
+scoped issue and be small enough for one PR. The builder closes both the priority
+issue and the per-run tracker issue in the PR body, for example:
+
+```text
+Closes #1234
+Closes #5678
+```
+
+Use the North Star to keep the queue honest: favor small improvements that move
+developers through the services → agents → workflows lifecycle, and surface
+breaking API or brand/positioning decisions for humans instead of auto-merging
+them.

internal/website/docs/guides/no-secret-first-agent.md

@@ -100,6 +100,7 @@ CI keeps those CLI boundaries present with:
 
 ```sh
 go test ./cmd/micro -run TestFirstAgentWalkthroughCLIBoundaries -count=1
+go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentDebuggingSmoke -count=1
 ```
 
 ## Debug transcript checkpoint

internal/website/docs/guides/your-first-agent.md

@@ -47,7 +47,7 @@ export ANTHROPIC_API_KEY=sk-ant-...
 Plain service calls work without a model key; the key is only needed when the
 agent reasons over tools.
 
-Run the read-only first-agent preflight before starting the walkthrough. The same CLI boundary is covered by CI with `go test ./cmd/micro -run TestFirstAgentWalkthroughCLIBoundaries -count=1`, so the documented scaffold → run → chat → inspect path stays visible in the local harness:
+Run the read-only first-agent preflight before starting the walkthrough. The same CLI boundary is covered by CI with `go test ./cmd/micro -run TestFirstAgentWalkthroughCLIBoundaries -count=1`, and the copy/paste tutorial code is built from a clean temporary workspace with `go test ./internal/harness/zero-to-hero-ci -run TestYourFirstAgentTutorialSmoke -count=1`, so the documented scaffold → run → chat → inspect path stays visible in the local harness:
 
 ```sh
 micro agent preflight
@@ -177,7 +177,14 @@ Create a task called "Review the first-agent walkthrough", then show me all task
 ```
 
 A healthy run shows the agent calling the task service and then summarizing the
-result. If the model refuses to call tools, tighten the prompt so it explicitly
+result. Inspect the recorded run when you want to see the tool calls, memory,
+and timing behind the answer:
+
+```sh
+micro inspect agent assistant
+```
+
+If the model refuses to call tools, tighten the prompt so it explicitly
 uses the `task` service before answering.
 
 ## 4. Know what just happened

internal/website/docs/guides/zero-to-hero.md

@@ -19,15 +19,25 @@ cloud credentials?"
 | --- | --- | --- |
 | Scaffold | `micro new` generates a runnable service with and without MCP support. | `go test ./cmd/micro/cli/new -run TestZeroToOne -count=1` |
 | First-agent wayfinding | README and the website getting-started docs keep the no-secret → first-agent → debugging → 0→hero links present and in order. | `go test ./internal/harness/zero-to-hero-ci -run TestFirstAgentWayfindingDocs -count=1` |
-| First agent | `micro new`, `micro agent preflight`, `micro run`, `micro chat`, and `micro inspect agent` stay available for the documented first-agent walkthrough. | `go test ./cmd/micro -run TestFirstAgentWalkthroughCLIBoundaries -count=1` |
+| First agent | `micro new`, `micro agent preflight`, `micro run`, `micro chat`, and `micro inspect agent <name>` stay available for the documented first-agent walkthrough. | `go test ./cmd/micro -run TestFirstAgentWalkthroughCLIBoundaries -count=1` |
 | Run | `micro run` remains the local development entry point. | `go test ./cmd/micro -run TestZeroToHeroCLIBoundaries -count=1` |
 | Chat | `micro chat` remains the interactive agent entry point. | `go test ./cmd/micro -run TestZeroToHeroCLIBoundaries -count=1` |
-| Inspect | `micro inspect agent`, `micro inspect flow`, and `micro flow runs` remain discoverable for run history. | `go test ./cmd/micro -run TestZeroToHeroCLIBoundaries -count=1` |
+| Inspect | `micro inspect agent <name>`, `micro agent history <name>`, `micro inspect flow <flow>`, and `micro flow runs <flow>` remain discoverable for run history; the no-secret debugging smoke seeds durable agent history and runs the documented inspect/history commands without provider keys. | `go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentDebuggingSmoke -count=1` |
 | Deploy | `micro deploy --dry-run` resolves deploy targets without touching remote infrastructure. | `go test ./cmd/micro/cli/deploy -run TestDeployDryRun -count=1` |
 | Smallest first agent | `examples/first-agent` runs one service-backed agent with a deterministic mock model and no provider key. | `go test ./examples/first-agent -run TestRunFirstAgent -count=1` |
 | Runtime reference app | `examples/support` runs typed services, an agent using those services as tools, an event-driven flow handoff, and an approval gate with only the model mocked. | `go test ./examples/support -run 'TestRunSupportMockSmoke|TestZeroToHeroReadmeDocumentsLifecycle' -count=1` |
 | Runtime harnesses | Real services, agents, durable flows, store-backed history, delegation, and A2A run with only the model mocked. | `./internal/harness/zero-to-hero-ci/run.sh` and `make provider-conformance-mock` |
 
+## Find the one-command entrypoint
+
+After installing the CLI, ask `micro` for the maintained no-secret lifecycle command:
+
+```sh
+micro zero-to-hero
+```
+
+The command prints the exact harness command below plus the smaller runnable examples, so a new developer can discover the 0→hero path from CLI help instead of translating this guide by hand.
+
 ## Run the runnable example
 
 From the repository root, start with the smallest service-backed agent when you want the fastest no-secret success path:

internal/website/docs/index.md

@@ -16,7 +16,7 @@ It's built on a pluggable architecture of Go interfaces: service discovery, clie
 
 ## Learn More
 
-Start with [Getting Started](getting-started.html) for install and the first local service. Then follow the first-agent on-ramp: `micro agent demo` for the installed no-secret CLI affordance, [No-secret first-agent transcript](guides/no-secret-first-agent.html) to run a mock-model support agent, [Your First Agent](guides/your-first-agent.html) to build and chat with a service-backed agent, [Debugging your agent](guides/debugging-agents.html) to inspect runs and memory, and the [0→hero reference path](guides/zero-to-hero.html) to walk the full scaffold → run → chat → inspect → deploy dry-run lifecycle covered by CI.
+Start with [Getting Started](getting-started.html) for install and the first local service. Then follow the first-agent on-ramp: `micro agent demo` for the installed no-secret CLI affordance, `micro examples` for copy/pasteable runnable examples, [No-secret first-agent transcript](guides/no-secret-first-agent.html) to run a mock-model support agent, [Your First Agent](guides/your-first-agent.html) to build and chat with a service-backed agent, [Debugging your agent](guides/debugging-agents.html) to inspect runs and memory, and the [0→hero reference path](guides/zero-to-hero.html) to walk the full scaffold → run → chat → inspect → deploy dry-run lifecycle covered by CI.
 
 Otherwise continue to read the docs for more information about the framework.
 
@@ -25,10 +25,12 @@ Otherwise continue to read the docs for more information about the framework.
 - [Getting Started](getting-started.html)
 - [0→hero Reference](guides/zero-to-hero.html) - Walk scaffold → run → chat → inspect → deploy dry-run with CI-backed commands
 - `micro agent demo` - Show the provider-free first-agent demo command and next docs steps
+- `micro examples` - Show provider-free first-agent examples in copy/paste order
 - [No-secret first-agent transcript](guides/no-secret-first-agent.html) - Run the first useful agent path without a provider key
 - [Your First Agent](guides/your-first-agent.html) - Build a service-backed agent end to end
 - [MCP & AI Agents](mcp.html) - Turn services into AI-callable tools with the Model Context Protocol
 - [CLI & Gateway Guide](guides/cli-gateway.html) - Development vs Production modes
+- [`micro loop` quickstart](guides/micro-loop.html) - Scaffold an autonomous CI-gated improvement loop
 - [Quick Start](quickstart.html)
 - [Architecture](architecture.html)
 - [Configuration](config.html)
@@ -63,5 +65,6 @@ Otherwise continue to read the docs for more information about the framework.
 - [Real-World Examples](examples/realworld/)
 - [Migration Guides](guides/migration/)
 - [Observability](observability.html)
+- [`micro loop` quickstart](guides/micro-loop.html)
 - [Contributing](contributing.html)
 - [Roadmap](roadmap.html)

internal/website/docs/quickstart.md

@@ -43,11 +43,13 @@ You now have the service half of the services → agents → workflows lifecycle
 
 1. **[Install troubleshooting](guides/install-troubleshooting.html)** - verify the binary installer or `go install`, `PATH`, `micro --version`, and the no-secret smoke path.
 2. `micro agent demo` - print the provider-free first-agent demo command and the next docs steps from the installed CLI.
-3. **[Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent)** - run a mock-model, no-secret agent before adding provider keys.
-4. **[No-secret first-agent transcript](guides/no-secret-first-agent.html)** - run a useful support agent with a mock model before setting up a provider key.
-5. **[Your First Agent](guides/your-first-agent.html)** - turn this service into an agent-callable tool, chat with it, and learn the `micro agent preflight` → `micro run` → `micro chat` loop.
-6. **[Debugging your agent](guides/debugging-agents.html)** - inspect service registration, tool calls, run history, memory, provider failures, and flow handoffs when the agent does something surprising.
-7. **[0→hero Reference](guides/zero-to-hero.html)** - walk the maintained scaffold → run → chat → inspect → deploy dry-run path that proves services, agents, and workflows together.
+3. `micro examples` - print the maintained provider-free runnable examples in copy/paste order.
+4. `micro zero-to-hero` - print the maintained one-command no-secret lifecycle harness and runnable examples.
+5. **[Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent)** - run a mock-model, no-secret agent before adding provider keys.
+6. **[No-secret first-agent transcript](guides/no-secret-first-agent.html)** - run a useful support agent with a mock model before setting up a provider key.
+7. **[Your First Agent](guides/your-first-agent.html)** - turn this service into an agent-callable tool, chat with it, and learn the `micro agent preflight` → `micro run` → `micro chat` loop.
+8. **[Debugging your agent](guides/debugging-agents.html)** - inspect service registration, tool calls, run history, memory, provider failures, and flow handoffs when the agent does something surprising.
+9. **[0→hero Reference](guides/zero-to-hero.html)** - walk the maintained scaffold → run → chat → inspect → deploy dry-run path that proves services, agents, and workflows together.
 
 After that first-agent path, branch out to: