loop: cut planner bookkeeping churn + cap diminishing-returns conformance work

An assessment of the last 100 commits found ~45% were pure "refresh planner priorities" bookkeeping and much of the rest was thrashing on one weak provider (AtlasCloud text-tool-call repair) and guarding docs the loop already wrote — motion, not progress. Two prompt-policy fixes: PLANNER (planner.md): - Default to NOT committing. Post the assessment and close the issue; open a PRIORITIES.md PR ONLY when the change is MATERIAL (top item changes, an item is added/removed, or a top item's issue closed). No PRs for reorders below the top, reword, or "keep it current" — that churn was the loop's #1 waste. - Add a diminishing-returns guard: don't queue the Nth doc-guard or the Nth robustness workaround for an already-tolerated class; mark exhausted areas needs-human and rank real-headroom capability instead. TRIAGE (triage.md): - Cap the AtlasCloud/plan-delegate tail-chase: another instance of a class the agent already tolerates is NOT filed as a routine patch — comment "recurred — capped" and, if worth more, needs-human. Real regressions (lint/tests/ govulncheck on master) and genuinely new defects still get filed. Prompt-only; reversible. Steers the loop toward outcomes over busy-work. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Refresh planner priorities for 4726 (#4727 )
2026-07-11 19:05:49 +00:00 · 2026-07-11 19:28:25 +01:00 · 2026-07-11 18:58:20 +01:00 · 2026-07-11 18:33:35 +01:00 · 2026-07-11 17:59:01 +01:00 · 2026-07-11 17:31:19 +01:00
49 changed files with 618 additions and 161 deletions
@@ -21,9 +21,8 @@ changes, architectural rewrites. Those go to the human.

 ## Work queue (ranked)

-1. **Ensure AtlasCloud plan-delegate harness persists plan** ([#4665](https://github.com/micro/go-micro/issues/4665)) — The zero-to-hero chat/inspect race is fixed, so the highest-value active gap is the live AtlasCloud plan/delegate conformance failure where the conductor completed side effects without persisting the built-in plan. Keep this first because plan/delegate is core to the services → agents → workflows story, and a red live harness weakens both developer trust and the roadmap's cross-provider hardening goal.
-2. **Add scheduled cross-provider agent conformance** ([#4649](https://github.com/micro/go-micro/issues/4649)) — Once the active AtlasCloud plan/delegate failure is closed, the Now roadmap still calls for battle-testing the same agent scenario across providers. Verify tool-calling, multi-step turns, plan/delegate, and guardrails on the live-provider matrix behind key-gated scheduled CI, without slowing the local harness.
-3. **Harden agent provider failure resilience** ([#4650](https://github.com/micro/go-micro/issues/4650)) — The next reliability seam is making timeouts, cancellation, rate limits, retry/backoff, and inspectable failure metadata predictable through the agent loop. Keep this scoped to existing behavior and tests; surface any breaking API or default changes as human review notes instead of queue work.
+1. **Gate mock provider plan-delegate resume scenarios** ([#4713](https://github.com/micro/go-micro/issues/4713)) — #4709 closed the live AtlasCloud nested tool-call rejection gap and #4725 closed the website first-agent wayfinding gap, so the highest-value remaining Now work is deterministic no-secret agent-loop coverage. Completed plan steps, notifications, unsafe fallback parsing, and resume semantics must stay stable without provider keys before broadening into live-provider conformance.
+2. **Migrate store/postgres from pgx/v4 to pgx/v5** ([#4556](https://github.com/micro/go-micro/issues/4556)) — Security upkeep matters to the service-framework half of the harness, and #4556 is the remaining open enhancement/security item. Keep it below the agent-loop contract because it is narrower than the current developer-adoption goal, but do not let reachable dependency risk drift indefinitely.

 _Seeded by Claude Code from the roadmap + open issues; thereafter maintained by the
 architecture-review pass._
@@ -7,10 +7,14 @@ Act as the architect — the founder lens — for go-micro, running continuously

 (1) TRACK STATE — scan recently merged PRs and open `codex` PRs/issues to see what shipped and what is being built right now, so the queue reflects reality (drop done items, don't re-queue in-flight work).

-(2) ASSESS against the North Star in `.github/loop/NORTH_STAR.md` — lead with its Mission (*make building an agent as easy as building a service, on one runtime*) and re-derive alignment from the CANON: the blog under `internal/website/blog`, the `README`, and the website (read these, don't rely on the North Star alone), then `ROADMAP.md` (Now → Next → Later). Judge every priority against the mission: does it make the services → agents → workflows lifecycle simpler, more cohesive, and more operable? CURRENT GOAL — developer adoption: weight the on-ramp (walkable first-agent tutorial, discoverable examples, docs wayfinding, install friction, debugging, 0→1 and 0→hero) at least as highly as internal hardening; do not let the queue fill entirely with internal depth work. Look at coherence and seams across the core packages (agent, ai, flow, gateway/mcp, gateway/a2a, model, server, store, registry) and the dev inner loop (scaffold → run → chat → inspect → deploy). Flag drift in either direction: work drifting from the mission, or the North Star/website drifting from the lived story in the blog.
+(2) ASSESS against the North Star in `.github/loop/NORTH_STAR.md` — lead with its Mission (*make building an agent as easy as building a service, on one runtime*) and re-derive alignment from the CANON: the blog under `internal/website/blog`, the `README`, and the website (read these, don't rely on the North Star alone), then `ROADMAP.md` (Now → Next → Later). Judge every priority against the mission: does it make the services → agents → workflows lifecycle simpler, more cohesive, and more operable? Weight real user-facing capability and the developer on-ramp; do not let the queue fill with internal depth work. Look at coherence and seams across the core packages (agent, ai, flow, gateway/mcp, gateway/a2a, model, server, store, registry) and the dev inner loop (scaffold → run → chat → inspect → deploy).

-(3) MAINTAIN THE QUEUE in `.github/loop/PRIORITIES.md` — a SINGLE ordered list, highest-value first, each item linking a scoped, CI-verifiable issue (#N); roadmap phase is the primary ordering, internal findings (cohesion gaps, DX friction, missing pieces) interleaved by value. For any prioritized gap with no issue, file one: `gh issue create --label codex --label enhancement --title "<scoped task>" --body "<goal, scope, acceptance criteria>"`.
+AVOID DIMINISHING-RETURNS CHURN — this is the most important judgment you make. Before ranking anything, ask: *would a real user notice this, or is it the loop grooming itself?* Do NOT queue: another regression-guard/breadcrumb/"verify the docs stay linked" test around docs the loop already wrote; the Nth robustness workaround for a weak provider's malformed output (e.g. AtlasCloud text-tool-call repair) once the agent already tolerates that class; another variation of a subsystem that has been hardened several times recently (e.g. plan/delegate notify/side-effect edge cases). If an area has had several increments with no user-visible gain, it is DONE for now — mark further work there `needs-human` and rank something with real headroom instead (new capability in gateway/flow/model/store, interop depth, observability). A full queue is not the goal; a queue of things that matter is.

-OUTPUT: post a concise assessment as a comment on this issue (#__ISSUE__) — what shipped, what's in flight, the top risks/gaps, and the reasoning behind the ranking. If the ranking actually changed, open ONE PR for `.github/loop/PRIORITIES.md`: `git switch -c codex/planner-__ISSUE__`, `git push -u origin codex/planner-__ISSUE__`, `gh pr create --base master --label codex --title "<title>" --body "<summary, Closes #__ISSUE__>"`, then `gh pr merge --squash --auto --delete-branch`. If the queue is already accurate, just close this issue (`gh issue close __ISSUE__`).
+(3) MAINTAIN THE QUEUE in `.github/loop/PRIORITIES.md` — a SINGLE ordered list, highest-value first, each item linking a scoped, CI-verifiable issue (#N). For any prioritized gap with no issue, file one: `gh issue create --label codex --label enhancement --title "<scoped task>" --body "<goal, scope, acceptance criteria>"`.

-Do NOT make breaking public-API or architectural changes yourself — surface those in the assessment as notes for the human, never as auto-merged changes. Open the PR yourself from the shell with `gh`; do not use the make_pr tool (it is a no-op stub).
+OUTPUT — default to NOT committing. Post a concise assessment as a comment on this issue (#__ISSUE__): what shipped, what's in flight, the top real gaps, and — honestly — whether the recent increments have been high-value or busy-work. Then, in almost all cases, just close this issue (`gh issue close __ISSUE__`) with NO PR.
+
+Open a PR for `.github/loop/PRIORITIES.md` ONLY when the change is MATERIAL — meaning it changes what the builder builds next: (a) the top open item changes, (b) an item is added or removed, or (c) a top item's issue closed and must be dropped. Do NOT open a PR to reorder items below the top, reword descriptions, refresh notes, or "keep it current" — a re-rank that doesn't change the next build is not worth a commit, and this churn is the loop's single biggest waste. When a PR IS warranted: `git switch -c codex/planner-__ISSUE__`, `git push -u origin codex/planner-__ISSUE__`, `gh pr create --base master --label codex --title "<title>" --body "<summary, Closes #__ISSUE__>"`, then `gh pr merge --squash --auto --delete-branch`.
+
+Do NOT make breaking public-API or architectural changes yourself — surface those in the assessment as notes for the human. Open the PR yourself from the shell with `gh`; do not use the make_pr tool (it is a no-op stub).
@@ -3,12 +3,17 @@ The TRIAGE prompt — go-micro's CI-failure feedback path. Editable policy; the
 workflow prepends the agent @mention and substitutes __ISSUE__ (this tracking
 issue) and __RUNURL__ (the failed run) before posting. Keep both literal.
 -->
-Triage the failed CI run at __RUNURL__. It may be the linter (Lint), the unit/integration tests (Run Tests), or the provider-conformance harness (Harness (E2E)).
+Triage the failed CI run at __RUNURL__. It may be the linter (Lint), the unit/integration tests (Run Tests), the vulnerability gate (govulncheck), or the provider-conformance harness (Harness (E2E)).

-Read the logs and root-cause each distinct failure. DEDUPE against open issues — if a failure matches an existing issue, comment "recurred" there instead of filing a duplicate.
+Read the logs and root-cause each distinct failure. DEDUPE hard against open AND recently-closed issues — if a failure matches an existing or recurring one, comment "recurred" on that issue rather than filing a new one.

-For each genuine, self-contained defect, file a scoped issue (`gh issue create --label codex --label enhancement --title "<scoped fix>" --body "<root cause, where, acceptance criteria>"`) so the increment loop builds it and the next CI/harness run verifies it. A lint or test failure on master is a real regression — file it so it is fixed promptly; do NOT ignore it.
+WHAT TO FILE:
+- **Lint, Run Tests, or govulncheck failing on master** — a real regression. File a scoped issue (`gh issue create --label codex --label enhancement --title "<scoped fix>" --body "<root cause, where, acceptance>"`) so it is fixed promptly.
+- **A genuinely NEW, distinct provider-conformance defect** — file it.

-IGNORE only genuine transient flakes — live-model latency, provider outages, rate limits, network timeouts with no code cause (mostly relevant to the harness). Anything needing a breaking or architectural change: file it as `needs-human` and describe it, rather than auto-queuing it as a routine fix.
+WHAT NOT TO FILE (this cap matters):
+- **Another instance of a class the agent already tolerates** — a weak provider (e.g. AtlasCloud) emitting malformed / text-rendered / partial tool calls, or another plan/delegate notify/side-effect edge case. These have been hardened repeatedly with diminishing returns. Do NOT auto-file yet another routine robustness patch. Comment "recurred — repeated class, capped" on the nearest existing issue and, if it seems genuinely worth more investment, label it `needs-human` for a human to decide. The loop should not keep chasing one weak provider's output shape.
+- **Transient flakes** — live-model latency, provider outages, rate limits, network timeouts with no code cause. Ignore.
+- **Anything needing a breaking or architectural change** — label `needs-human` and describe it.

 Close this issue (`gh issue close __ISSUE__`) when triage is done. Open any PR yourself from the shell with `gh`; do not use the make_pr tool.
@@ -17,8 +17,33 @@ below is kept current between tags and rolled into the next version when it ship

 ## [Unreleased]

+### Added
+- **First-agent chat/inspect fixture** — the maintained first-agent CLI fixture now covers chat and inspect boundaries together. (`internal/harness/`, `cmd/micro/`)
+- **Zero-to-hero inspect transcript check** — the 0→hero harness now verifies the inspect transcript path stays visible in the lifecycle walkthrough. (`internal/harness/zero-to-hero-ci/`, `internal/website/docs/`)
+
+### Changed
+- **Plan-delegate plan persistence** — plan/delegate runs now persist plan state more defensively across harness scenarios. (`agent/`, `internal/harness/`)
+
+### Fixed
+- **Zero-to-hero fixture output race** — 0→hero fixture output is less race-prone during harness runs. (`internal/harness/zero-to-hero-ci/`)
+
+---
+
+## [6.6.0] - July 2026
+
 ### Added
 - **First-agent guide chain contract** — the harness now verifies the install → demo → examples → 0→hero guide chain stays connected for new agent builders. (`internal/harness/`, `internal/website/docs/`)
+- **First-agent docs wayfinding guard** — the local harness now includes a focused no-network check for first-agent and 0→hero docs links. (`Makefile`, `internal/harness/`)
+- **First-agent quickcheck breadcrumbs** — first-agent docs now surface quickcheck wayfinding for install, scaffold, chat, inspect, and recovery paths. (`internal/website/docs/`, `README.md`)
+- **First-agent chat wayfinding verification** — the harness now verifies first-agent chat wayfinding remains discoverable from the public docs route. (`internal/harness/`, `internal/website/docs/`)
+
+### Changed
+- **Universe A2A reachability probe** — the universe harness now exercises A2A reachability more defensively. (`internal/harness/`)
+- **AtlasCloud workspace repair fallback** — AtlasCloud fallback handling now recovers workspace-repair tool calls more reliably. (`ai/atlascloud/`, `agent/`)
+- **AtlasCloud empty-argument tool repair** — AtlasCloud text tool-call repair now handles empty-argument calls more consistently. (`ai/atlascloud/`, `agent/`)
+
+### Removed
+- **`go-micro.dev/v6/ai/flow`** — the alias-only backward-compatibility shim is removed; import the canonical [`go-micro.dev/v6/flow`](flow) instead (same types and functions). It had no internal callers. (`ai/flow/`)

 ### Fixed
 - **A2A fallback artifact text** — A2A fallback responses now avoid leaking provider artifact text into agent-visible output. (`gateway/a2a/`, `agent/`)
@@ -26,6 +51,20 @@ below is kept current between tags and rolled into the next version when it ship
 - **Plan-delegate harness cleanup** — plan/delegate harness cleanup is more reliable after conformance runs. (`internal/harness/`)
 - **AtlasCloud spoken notify replays** — AtlasCloud fallback handling now collapses spoken notification replays more consistently. (`ai/atlascloud/`, `agent/`)
 - **Agent-flow onboarding side effects** — onboarding side-effect checks are more stable across the agent-flow harness. (`agent/`, `internal/harness/`)
+- **Plan-delegate plan-only side effects** — plan/delegate recovery now preserves plan-only side effects more reliably. (`agent/`, `internal/harness/`)
+- **Checkpointed tool result recording** — checkpoint resume paths now guard tool-result recording against duplicate or stale writes. (`agent/`)
+- **Agent timeout notification completion** — universe runs now finalize observed notifications more reliably after agent timeouts. (`agent/`, `internal/harness/`)
+- **Completed plan-delegate side effects** — completed plan/delegate side effects are accepted more consistently in recovery paths. (`agent/`, `internal/harness/`)
+- **Agent-flow onboarding notifications** — agent-flow onboarding notification recovery is more reliable across replay scenarios. (`agent/`, `internal/harness/`)
+
+### Documentation
+- **Agent-agnostic mention model** — loop docs now describe the mention-driven agent model without binding it to one coding agent. (`internal/docs/`, `.github/loop/`)
+- **First-agent quickcheck docs** — public docs now surface the first-agent quickcheck path for faster troubleshooting. (`internal/website/docs/`)
+- **Agent resume breadcrumbs** — docs now add clearer resume breadcrumbs for checkpointed agent runs. (`internal/website/docs/`)
+
+### Security
+- **Govulncheck vulnerability gate** — CI now includes a govulncheck gate and wires vulnerability failures into loop triage. (`.github/workflows/`, `cmd/micro/loop/`)
+- **Dependency vulnerability patches** — toolchain and dependency updates patch reachable CVEs across the project. (`go.mod`, `go.sum`)

 ---

@@ -8,7 +8,7 @@ LDFLAGS = -X $(GIT_IMPORT).BuildDate=$(BUILD_DATE) -X $(GIT_IMPORT).GitCommit=$(
 # GORELEASER_DOCKER_IMAGE = ghcr.io/goreleaser/goreleaser-cross:v1.25.7
 GORELEASER_DOCKER_IMAGE = ghcr.io/goreleaser/goreleaser:latest

-.PHONY: test test-race test-coverage harness inner-loop cli-wayfinding docs-wayfinding install-smoke provider-conformance-mock provider-conformance lint fmt install-tools proto clean help gorelease-dry-run gorelease-dry-run-docker
+.PHONY: test test-race test-coverage harness zero-to-hero-transcript inner-loop cli-wayfinding docs-wayfinding install-smoke provider-conformance-mock provider-conformance lint fmt install-tools proto clean help gorelease-dry-run gorelease-dry-run-docker

 # Default target
 help:
@@ -19,6 +19,7 @@ help:
 	@echo "  make test-coverage - Run tests with coverage"
 	@echo "  make lint          - Run linter"
 	@echo "  make harness       - Run deterministic getting-started and end-to-end harnesses"
+	@echo "  make zero-to-hero-transcript - Verify the ordered 0→hero lifecycle transcript"
 	@echo "  make inner-loop    - Verify scaffold → run/chat/inspect → deploy dry-run contract"
 	@echo "  make cli-wayfinding - Verify installed first-agent CLI wayfinding commands"
 	@echo "  make docs-wayfinding - Verify first-agent docs/CLI wayfinding stays in sync"
@@ -54,10 +55,16 @@ test-coverage:
 harness:
 	$(MAKE) cli-wayfinding
 	$(MAKE) inner-loop
-	./internal/harness/zero-to-hero-ci/run.sh
+	$(MAKE) zero-to-hero-transcript
 	go run ./internal/harness/agent-flow
 	$(MAKE) provider-conformance-mock

+# Verify the maintained 0→hero transcript in the same order documented for new
+# developers: scaffold → run/chat/inspect → support-agent chat → flow history →
+# deploy dry-run. This is the focused CI contract for the full lifecycle path.
+zero-to-hero-transcript:
+	./internal/harness/zero-to-hero-ci/run.sh
+
 # Focused provider-free CLI inner-loop contract: scaffold a service, keep the
 # run/chat/inspect commands discoverable, and prove deploy dry-run reaches the
 # documented boundary without remote side effects. Use this when README/docs/CLI
@@ -1,4 +1,4 @@
-# Go Micro [![Go.Dev reference](https://img.shields.io/badge/go.dev-reference-007d9c?logo=go&logoColor=white&style=flat-square)](https://pkg.go.dev/go-micro.dev/v6?tab=doc) [![Go Report Card](https://goreportcard.com/badge/github.com/go-micro/go-micro)](https://goreportcard.com/report/github.com/go-micro/go-micro) [![Discord](https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/G8Gk5j3uXr)
+# Go Micro [![Go.Dev reference](https://img.shields.io/badge/go.dev-reference-007d9c?logo=go&logoColor=white&style=flat-square)](https://pkg.go.dev/go-micro.dev/v6?tab=doc) [![Discord](https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/G8Gk5j3uXr)

 Go Micro is an **agent harness** and service framework for Go.

@@ -84,8 +84,13 @@ To verify the focused CLI inner-loop contract — scaffold → run/chat/inspect
 make inner-loop
 ```

-To run the broader local contract (including the [0→hero services → agents → workflows path](internal/website/docs/guides/zero-to-hero.md),
-chat/inspect CLI boundaries, and deploy dry-run), use:
+To run only the ordered [0→hero services → agents → workflows transcript](internal/website/docs/guides/zero-to-hero.md) that CI guards, use:
+
+```bash
+make zero-to-hero-transcript
+```
+
+To run the broader local contract (including that transcript, chat/inspect CLI boundaries, and deploy dry-run), use:

 ```bash
 make harness
@@ -97,6 +102,9 @@ After install and the first `micro new`/`micro run` smoke check, take the
 walkable agent path in this order:

 1. [Install troubleshooting](internal/website/docs/guides/install-troubleshooting.md) — verify the binary installer or `go install`, `PATH`, `micro --version`, and the no-secret smoke path before agent work.
+
+Run `make docs-wayfinding` to verify the focused no-secret docs/CLI contract that keeps these README and website commands aligned with the installed CLI.
+
 2. `micro agent demo` — print the provider-free first-agent demo command and next docs steps from the installed CLI.
 3. `micro agent quickcheck` (or `micro agent debug`) — when scaffold → run → chat → inspect stalls, print the short recovery map before you dive into the full debugging guide.
 4. `micro examples` — print the maintained provider-free runnable examples in copy/paste order.
@@ -355,6 +355,8 @@ func (a *agentImpl) askLocked(ctx context.Context, runID, message, parentRunID s
 		})
 		if err != nil {
 			run.Status = agentRunFailureStatus(err)
+			failureKind := ai.ClassifyError(err)
+			attempts := agentRunFailureAttempts(err)
 			err = agentOperationalError(err)
 			if a.currentRun != nil {
 				run.Steps = a.currentRun.Steps
@@ -363,7 +365,9 @@ func (a *agentImpl) askLocked(ctx context.Context, runID, message, parentRunID s
 				run.Steps = []flow.StepRecord{{Name: agentAskStep}}
 			}
 			run.Steps[0].Status = run.Status
+			run.Steps[0].Attempts = attempts
 			run.Steps[0].Error = err.Error()
+			run.Steps[0].ErrorKind = string(failureKind)
 			_ = a.saveRun(ctx, run)
 			return nil, err
 		}
@@ -296,6 +296,9 @@ func (a *agentImpl) planWrap(next ai.ToolHandler) ai.ToolHandler {
 		if call.Name == toolPlan {
 			return a.handlePlan(call)
 		}
+		if containsNestedTextToolCall(call.Input) {
+			return refused(call.ID, ai.RefusedApproval, "malformed tool call: nested text tool-call markup found inside arguments; call the intended tool directly with clean JSON arguments")
+		}
 		if call.Name == toolDelegate {
 			if blocked := a.unfinishedPlanStepsBeforeDelegation(); len(blocked) > 0 {
 				return refused(call.ID, ai.RefusedApproval, "complete these plan steps before delegating: "+strings.Join(blocked, ", "))
@@ -3,6 +3,7 @@ package agent
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -215,6 +216,14 @@ func (e *operationalError) Unwrap() error {
 	return e.err
 }

+func agentRunFailureAttempts(err error) int {
+	var retryErr *ai.RetryError
+	if err != nil && errors.As(err, &retryErr) && retryErr.Attempts > 0 {
+		return retryErr.Attempts
+	}
+	return 1
+}
+
 func agentOperationalError(err error) error {
 	if err == nil {
 		return nil
@@ -90,3 +90,23 @@ func TestApproveToolDoesNotGatePlan(t *testing.T) {
 		t.Error("plan should have been persisted despite the denying approver")
 	}
 }
+
+func TestNestedTextToolCallArgumentsAreRefused(t *testing.T) {
+	called := false
+	a := newTestAgent(Name("nested-tool-arg"),
+		WithTool("task.add", "add task", nil, func(context.Context, map[string]any) (string, error) {
+			called = true
+			return "created", nil
+		}),
+	)
+
+	content := toolContent(a.toolHandler(), "task.add", map[string]any{
+		"title": `Continue the launch plan. <tool_call name="plan">{"steps":[{"task":"Design","status":"pending"}]}</tool_call>`,
+	})
+	if called {
+		t.Fatal("tool handler ran despite nested text tool-call markup in arguments")
+	}
+	if !strings.Contains(content, "nested text tool-call markup") {
+		t.Fatalf("content = %q, want nested tool-call refusal", content)
+	}
+}
@@ -327,6 +327,12 @@ func TestAskCheckpointRecordsTerminalOperationalFailureStatus(t *testing.T) {
 			if len(runs[0].Steps) == 0 || runs[0].Steps[0].Status != tt.want {
 				t.Fatalf("step status = %#v, want %q", runs[0].Steps, tt.want)
 			}
+			if runs[0].Steps[0].Attempts != 1 {
+				t.Fatalf("step attempts = %d, want 1", runs[0].Steps[0].Attempts)
+			}
+			if got := runs[0].Steps[0].ErrorKind; got != string(ai.ClassifyError(tt.err)) {
+				t.Fatalf("step error kind = %q, want %q", got, ai.ClassifyError(tt.err))
+			}
 			if pending, err := Pending(context.Background(), a); err != nil || len(pending) != 0 {
 				t.Fatalf("Pending = %#v, %v; want no terminal run", pending, err)
 			}
@@ -263,6 +263,27 @@ func textToolArguments(raw any) map[string]any {
 	return nil
 }

+func containsNestedTextToolCall(v any) bool {
+	switch x := v.(type) {
+	case string:
+		text := html.UnescapeString(x)
+		return openingTaggedToolCall.MatchString(text) || singleTaggedToolCall.MatchString(text)
+	case map[string]any:
+		for _, item := range x {
+			if containsNestedTextToolCall(item) {
+				return true
+			}
+		}
+	case []any:
+		for _, item := range x {
+			if containsNestedTextToolCall(item) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func decodeTaggedTextToolCalls(text string, allowed map[string]string) []ai.ToolCall {
 	var out []ai.ToolCall
 	for _, match := range singleTaggedToolCall.FindAllStringSubmatch(text, -1) {
@@ -1,22 +0,0 @@
-// Package flow is maintained for backward compatibility.
-// The canonical import is go-micro.dev/v6/flow.
-package flow
-
-import "go-micro.dev/v6/flow"
-
-// Re-export types for backward compatibility.
-type Flow = flow.Flow
-type Options = flow.Options
-type Option = flow.Option
-type Result = flow.Result
-
-var New = flow.New
-var Trigger = flow.Trigger
-var Prompt = flow.Prompt
-var SystemPrompt = flow.SystemPrompt
-var Provider = flow.Provider
-var APIKey = flow.APIKey
-var Model = flow.Model
-var BaseURL = flow.BaseURL
-var HistoryLimit = flow.HistoryLimit
-var OnResult = flow.OnResult
@@ -69,6 +69,50 @@ func TestGenerateWithRetryDoesNotRetryCallerCancellation(t *testing.T) {
 	}
 }

+func TestGenerateWithRetryCancellationDuringBackoffStopsRetry(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	attempts := 0
+	firstAttemptDone := make(chan struct{})
+	model := retryModel{generate: func(context.Context, *Request, ...GenerateOption) (*Response, error) {
+		attempts++
+		if attempts == 1 {
+			close(firstAttemptDone)
+			return nil, retryAfterErr{delay: time.Hour}
+		}
+		return &Response{Reply: "unexpected retry"}, nil
+	}}
+
+	errc := make(chan error, 1)
+	go func() {
+		_, err := GenerateWithRetry(ctx, model, &Request{Prompt: "hi"}, GeneratePolicy{
+			MaxAttempts: 3,
+			Backoff:     time.Hour,
+		})
+		errc <- err
+	}()
+
+	select {
+	case <-firstAttemptDone:
+	case <-time.After(time.Second):
+		t.Fatal("first provider attempt did not run")
+	}
+	cancel()
+
+	select {
+	case err := <-errc:
+		if !errors.Is(err, context.Canceled) {
+			t.Fatalf("error = %v, want context.Canceled", err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("GenerateWithRetry did not stop after cancellation during backoff")
+	}
+	if attempts != 1 {
+		t.Fatalf("attempts = %d, want cancellation to prevent retry", attempts)
+	}
+}
+
 func TestGenerateWithRetryHonorsPerAttemptTimeout(t *testing.T) {
 	var attempts atomic.Int32
 	model := retryModel{generate: func(ctx context.Context, _ *Request, _ ...GenerateOption) (*Response, error) {
@@ -62,16 +62,17 @@ curl -X POST http://localhost:8080/api/helloworld/Helloworld.Call \
 ## First agent on-ramp

 Once the scaffold → run → call path works, ask the installed CLI for the
-provider-free agent path:
+provider-free agent path. The focused no-secret docs/CLI contract is
+`make docs-wayfinding`:

 ```
 micro agent demo
+micro agent quickcheck
 micro examples
 micro zero-to-hero
 ```

-Those commands point at the smallest mock-model first-agent example, the no-secret
-transcript, and the 0→hero support app before you add provider-backed chat.
+`micro agent quickcheck` (alias: `micro agent debug`) prints the short recovery map when scaffold → run → chat → inspect stalls. Those commands point at the smallest mock-model first-agent example, the no-secret transcript, and the 0→hero support app before you add provider-backed chat.

 ### Output

@@ -35,6 +35,7 @@ smallest provider-free recovery loop before reading the full docs.
 5. If provider chat is not configured yet, prove the no-secret path still works:
   micro agent demo
   go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentTranscript -count=1
+   go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentDebuggingSmoke -count=1

 Recovery docs:
  https://go-micro.dev/docs/guides/debugging-agents.html
@@ -52,6 +53,7 @@ What this proves:
  - service tools can be called by an agent
  - chat behavior is exercised without contacting a live provider
  - run history can be inspected after the prompt
+  - the debug smoke seeds a stalled-first-agent recovery transcript

 After it passes:
  - Build your own service-backed agent: https://go-micro.dev/docs/guides/your-first-agent.html
@@ -63,7 +65,10 @@ Use live-provider chat when you are ready for real model behavior:
  micro run
  micro chat
  micro agent doctor     # after micro run: chat/gateway/inspect recovery
-  micro inspect agent <name>`
+  micro inspect agent <name>
+
+Debug transcript smoke:
+  go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentDebuggingSmoke -count=1`

 func init() {
 	cmd.Register(&cli.Command{
@@ -86,6 +86,7 @@ func TestAgentQuickcheckPrintsProviderFreeFailureModeBreadcrumbs(t *testing.T) {
 		"micro runs <name>",
 		"micro agent demo",
 		"go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentTranscript -count=1",
+		"go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentDebuggingSmoke -count=1",
 		"debugging-agents.html",
 		"no-secret-first-agent.html",
 	} {
@@ -246,17 +246,17 @@ func Compose(c *cli.Context) error {
 			imageName = registry + "/" + imageName
 		}

-		sb.WriteString(fmt.Sprintf("  %s:\n", svc.Name))
-		sb.WriteString(fmt.Sprintf("    image: %s\n", imageName))
+		fmt.Fprintf(&sb, "  %s:\n", svc.Name)
+		fmt.Fprintf(&sb, "    image: %s\n", imageName)

 		if svc.Port > 0 {
-			sb.WriteString(fmt.Sprintf("    ports:\n      - \"%d:%d\"\n", svc.Port, svc.Port))
+			fmt.Fprintf(&sb, "    ports:\n      - \"%d:%d\"\n", svc.Port, svc.Port)
 		}

 		if len(svc.Depends) > 0 {
 			sb.WriteString("    depends_on:\n")
 			for _, dep := range svc.Depends {
-				sb.WriteString(fmt.Sprintf("      - %s\n", dep))
+				fmt.Fprintf(&sb, "      - %s\n", dep)
 			}
 		}

@@ -93,7 +93,7 @@ func showDeployTargets(cfg *config.Config) error {
 	var sb strings.Builder
 	sb.WriteString("Available deploy targets:\n\n")
 	for name, dt := range cfg.Deploy {
-		sb.WriteString(fmt.Sprintf("  %s -> %s\n", name, dt.SSH))
+		fmt.Fprintf(&sb, "  %s -> %s\n", name, dt.SSH)
 	}
 	sb.WriteString("\nDeploy with: micro deploy <target>")
 	return fmt.Errorf("%s", sb.String())
@@ -502,18 +502,18 @@ func newModel(provider, apiKey, model string) ai.Model {

 func buildProto(dehyphen, titleName string, svc ServiceSpec) string {
 	var b strings.Builder
-	b.WriteString(fmt.Sprintf("syntax = \"proto3\";\n\npackage %s;\n\noption go_package = \"./proto;%s\";\n\n", dehyphen, dehyphen))
+	fmt.Fprintf(&b, "syntax = \"proto3\";\n\npackage %s;\n\noption go_package = \"./proto;%s\";\n\n", dehyphen, dehyphen)

-	b.WriteString(fmt.Sprintf("service %s {\n", titleName))
+	fmt.Fprintf(&b, "service %s {\n", titleName)
 	for _, ep := range svc.Endpoints {
-		b.WriteString(fmt.Sprintf("\trpc %s(%sRequest) returns (%sResponse) {}\n", ep.Name, ep.Name, ep.Name))
+		fmt.Fprintf(&b, "\trpc %s(%sRequest) returns (%sResponse) {}\n", ep.Name, ep.Name, ep.Name)
 	}
 	b.WriteString("}\n\n")

 	// Record message
-	b.WriteString(fmt.Sprintf("message %sRecord {\n", titleName))
+	fmt.Fprintf(&b, "message %sRecord {\n", titleName)
 	for i, f := range svc.Fields {
-		b.WriteString(fmt.Sprintf("\t%s %s = %d; // %s\n", protoType(f.Type), f.Name, i+1, f.Description))
+		fmt.Fprintf(&b, "\t%s %s = %d; // %s\n", protoType(f.Type), f.Name, i+1, f.Description)
 	}
 	b.WriteString("}\n\n")

@@ -527,12 +527,12 @@ func buildProto(dehyphen, titleName string, svc ServiceSpec) string {
 				if f.Name == "id" || f.Name == "created" || f.Name == "updated" {
 					continue
 				}
-				b.WriteString(fmt.Sprintf("\t%s %s = %d;\n", protoType(f.Type), f.Name, n))
+				fmt.Fprintf(&b, "\t%s %s = %d;\n", protoType(f.Type), f.Name, n)
 				n++
 			}
-			b.WriteString(fmt.Sprintf("}\n\nmessage CreateResponse {\n\t%sRecord record = 1;\n}\n\n", titleName))
+			fmt.Fprintf(&b, "}\n\nmessage CreateResponse {\n\t%sRecord record = 1;\n}\n\n", titleName)
 		case "Read":
-			b.WriteString(fmt.Sprintf("message ReadRequest {\n\tstring id = 1;\n}\n\nmessage ReadResponse {\n\t%sRecord record = 1;\n}\n\n", titleName))
+			fmt.Fprintf(&b, "message ReadRequest {\n\tstring id = 1;\n}\n\nmessage ReadResponse {\n\t%sRecord record = 1;\n}\n\n", titleName)
 		case "Update":
 			b.WriteString("message UpdateRequest {\n\tstring id = 1;\n")
 			n := 2
@@ -540,26 +540,26 @@ func buildProto(dehyphen, titleName string, svc ServiceSpec) string {
 				if f.Name == "id" || f.Name == "created" || f.Name == "updated" {
 					continue
 				}
-				b.WriteString(fmt.Sprintf("\t%s %s = %d;\n", protoType(f.Type), f.Name, n))
+				fmt.Fprintf(&b, "\t%s %s = %d;\n", protoType(f.Type), f.Name, n)
 				n++
 			}
-			b.WriteString(fmt.Sprintf("}\n\nmessage UpdateResponse {\n\t%sRecord record = 1;\n}\n\n", titleName))
+			fmt.Fprintf(&b, "}\n\nmessage UpdateResponse {\n\t%sRecord record = 1;\n}\n\n", titleName)
 		case "Delete":
 			b.WriteString("message DeleteRequest {\n\tstring id = 1;\n}\n\nmessage DeleteResponse {\n\tbool deleted = 1;\n}\n\n")
 		case "List":
-			b.WriteString(fmt.Sprintf("message ListRequest {\n\tint64 limit = 1;\n\tint64 offset = 2;\n\tstring query = 3;\n}\n\nmessage ListResponse {\n\trepeated %sRecord records = 1;\n\tint64 total = 2;\n}\n\n", titleName))
+			fmt.Fprintf(&b, "message ListRequest {\n\tint64 limit = 1;\n\tint64 offset = 2;\n\tstring query = 3;\n}\n\nmessage ListResponse {\n\trepeated %sRecord records = 1;\n\tint64 total = 2;\n}\n\n", titleName)
 		default:
 			// Custom endpoint — use all fields as input, record as output
-			b.WriteString(fmt.Sprintf("message %sRequest {\n", ep.Name))
+			fmt.Fprintf(&b, "message %sRequest {\n", ep.Name)
 			n := 1
 			for _, f := range svc.Fields {
 				if f.Name == "created" || f.Name == "updated" {
 					continue
 				}
-				b.WriteString(fmt.Sprintf("\t%s %s = %d;\n", protoType(f.Type), f.Name, n))
+				fmt.Fprintf(&b, "\t%s %s = %d;\n", protoType(f.Type), f.Name, n)
 				n++
 			}
-			b.WriteString(fmt.Sprintf("}\n\nmessage %sResponse {\n\t%sRecord record = 1;\n\tstring message = 2;\n\tbool success = 3;\n}\n\n", ep.Name, titleName))
+			fmt.Fprintf(&b, "}\n\nmessage %sResponse {\n\t%sRecord record = 1;\n\tstring message = 2;\n\tbool success = 3;\n}\n\n", ep.Name, titleName)
 		}
 	}
 	return b.String()
@@ -136,6 +136,7 @@ func TestFirstAgentWalkthroughCLIBoundaries(t *testing.T) {
 		"micro runs <name>",
 		"micro agent demo",
 		"go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentTranscript -count=1",
+		"go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentDebuggingSmoke -count=1",
 		"debugging-agents.html",
 	} {
 		if !strings.Contains(out.String(), want) {
@@ -151,7 +152,9 @@ func TestFirstAgentWalkthroughCLIBoundaries(t *testing.T) {
 	for _, want := range []string{
 		"No-secret first-agent demo",
 		"go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentTranscript -count=1",
+		"go test ./internal/harness/zero-to-hero-ci -run TestNoSecretFirstAgentDebuggingSmoke -count=1",
 		"provider-free",
+		"stalled-first-agent recovery transcript",
 		"micro agent preflight  # before micro run: prerequisites",
 		"micro chat",
 		"micro agent doctor     # after micro run: chat/gateway/inspect recovery",
@@ -193,6 +196,7 @@ func TestFirstAgentDocsMatchCLIOutput(t *testing.T) {
 				"micro inspect agent <name>",
 				"micro examples",
 				"micro zero-to-hero",
+				"make docs-wayfinding",
 				"examples/first-agent/",
 				"examples/support/",
 				"internal/website/docs/guides/no-secret-first-agent.md",
@@ -212,6 +216,7 @@ func TestFirstAgentDocsMatchCLIOutput(t *testing.T) {
 				"micro inspect agent <name>",
 				"micro examples",
 				"micro zero-to-hero",
+				"make docs-wayfinding",
 				"github.com/micro/go-micro/tree/master/examples/first-agent",
 				"github.com/micro/go-micro/tree/master/examples/support",
 				"guides/no-secret-first-agent.html",
@@ -36,6 +36,9 @@ type subscriber struct {
 	retryLimit int
 	autoAck    bool
 	ackWait    time.Duration
+
+	pending []Event
+	notify  chan struct{}
 }

 type mem struct {
@@ -124,6 +127,7 @@ func (m *mem) Consume(topic string, opts ...ConsumeOption) (<-chan Event, error)
 		retryMap:   map[string]int{},
 		autoAck:    true,
 		retryLimit: options.GetRetryLimit(),
+		notify:     make(chan struct{}, 1),
 	}

 	if !options.AutoAck {
@@ -132,6 +136,7 @@ func (m *mem) Consume(topic string, opts ...ConsumeOption) (<-chan Event, error)
 		}
 		sub.autoAck = options.AutoAck
 		sub.ackWait = options.AckWait
+		go sub.dispatchManualAck()
 	}

 	// register the subscriber
@@ -197,56 +202,98 @@ func (m *mem) handleEvent(ev *Event) {
 }

 func sendEvent(ev *Event, sub *subscriber) {
-	go func(s *subscriber) {
-		evCopy := *ev
-		if s.autoAck {
-			s.Channel <- evCopy
-			return
-		}
-		evCopy.SetAckFunc(ackFunc(s, evCopy))
-		evCopy.SetNackFunc(nackFunc(s, evCopy))
-		s.Lock()
-		s.retryMap[evCopy.ID] = 0
-		s.Unlock()
-		tick := time.NewTicker(s.ackWait)
-		defer tick.Stop()
-		for range tick.C {
-			s.Lock()
-			count, ok := s.retryMap[evCopy.ID]
-			s.Unlock()
-			if !ok {
-				// success
-				break
-			}
+	evCopy := *ev
+	if !sub.autoAck {
+		sub.Lock()
+		sub.pending = append(sub.pending, evCopy)
+		sub.Unlock()
+		sub.wake()
+		return
+	}

-			if s.retryLimit > -1 && count > s.retryLimit {
-				if logger.V(logger.ErrorLevel, logger.DefaultLogger) {
-					logger.Errorf("Message retry limit reached, discarding: %v %d %d", evCopy.ID, count, s.retryLimit)
-				}
-				s.Lock()
-				delete(s.retryMap, evCopy.ID)
-				s.Unlock()
-				return
-			}
-			s.Channel <- evCopy
-			s.Lock()
-			s.retryMap[evCopy.ID] = count + 1
-			s.Unlock()
-		}
+	go func(s *subscriber) {
+		s.Channel <- evCopy
 	}(sub)
 }

-func ackFunc(s *subscriber, evCopy Event) func() error {
-	return func() error {
-		s.Lock()
-		delete(s.retryMap, evCopy.ID)
-		s.Unlock()
-		return nil
+func (s *subscriber) wake() {
+	select {
+	case s.notify <- struct{}{}:
+	default:
 	}
 }

-func nackFunc(_ *subscriber, _ Event) func() error {
-	return func() error {
-		return nil
+func (s *subscriber) dispatchManualAck() {
+	for {
+		s.Lock()
+		for len(s.pending) == 0 {
+			s.Unlock()
+			<-s.notify
+			s.Lock()
+		}
+		ev := s.pending[0]
+		s.pending = s.pending[1:]
+		s.retryMap[ev.ID] = 0
+		s.Unlock()
+
+		s.deliverManualAck(ev)
+	}
+}
+
+func (s *subscriber) deliverManualAck(ev Event) {
+	retries := 0
+	for {
+		if s.retryLimit > -1 && retries > s.retryLimit {
+			if logger.V(logger.ErrorLevel, logger.DefaultLogger) {
+				logger.Errorf("Message retry limit reached, discarding: %v %d %d", ev.ID, retries, s.retryLimit)
+			}
+			s.Lock()
+			delete(s.retryMap, ev.ID)
+			s.Unlock()
+			return
+		}
+
+		result := make(chan bool, 1)
+		evCopy := ev
+		evCopy.SetAckFunc(func() error {
+			select {
+			case result <- true:
+			default:
+			}
+			return nil
+		})
+		evCopy.SetNackFunc(func() error {
+			select {
+			case result <- false:
+			default:
+			}
+			return nil
+		})
+
+		s.Channel <- evCopy
+
+		timer := time.NewTimer(s.ackWait)
+		select {
+		case acked := <-result:
+			if !timer.Stop() {
+				select {
+				case <-timer.C:
+				default:
+				}
+			}
+			if acked {
+				s.Lock()
+				delete(s.retryMap, ev.ID)
+				s.Unlock()
+				return
+			}
+			retries++
+		case <-timer.C:
+			retries++
+		}
+
+		s.Lock()
+		s.retryMap[ev.ID] = retries
+		s.Unlock()
 	}
 }
@@ -157,6 +157,7 @@ func runTestStream(t *testing.T, stream Stream) {
 		assert.NoError(t, err, "Unexpected error subscribing")
 		assert.NoError(t, stream.Publish("foobarAck", map[string]string{"foo": "message 1"}))
 		assert.NoError(t, stream.Publish("foobarAck", map[string]string{"foo": "message 2"}))
+		assert.NoError(t, stream.Publish("foobarAck", map[string]string{"foo": "message 3"}))

 		ev := <-ch
 		ev.Ack()
@@ -170,6 +171,13 @@ func runTestStream(t *testing.T, stream Stream) {
 		case <-time.After(7 * time.Second):
 			t.Fatalf("Timed out waiting for message to be put back on queue")
 		}
+		select {
+		case ev = <-ch:
+			assert.NotEqual(t, ev.ID, nacked, "Queued message should only be received after the nacked message is redelivered")
+			assert.NoError(t, ev.Ack())
+		case <-time.After(7 * time.Second):
+			t.Fatalf("Timed out waiting for queued message")
+		}

 	})

@@ -43,7 +43,20 @@ live model credits.

 Use `make provider-conformance` when you want the live-provider sweep: providers
 without keys are skipped, and configured providers must satisfy the same harness
-contract.
+contract. For the exact scheduled command, run:
+
+```sh
+go run ./internal/harness/provider-conformance \
+  -providers anthropic,openai,gemini,groq,minimax,mistral,together,atlascloud \
+  -harnesses agent,universe,agent-flow,plan-delegate,a2a-stream-fallback \
+  -summary-json provider-conformance-summary.json \
+  -summary-markdown provider-conformance-summary.md \
+  -capabilities-markdown provider-capabilities.md
+```
+
+The generated summary records one row for every selected provider/harness pair;
+missing live-provider keys become skipped rows for each harness, while configured
+providers produce pass/fail rows per harness.

 ## Scheduled CI

@@ -474,10 +474,11 @@ func runPlanDelegate(provider string) error {
 		agent.Name("conductor"),
 		agent.Address("127.0.0.1:0"),
 		agent.Services("task"),
-		agent.Prompt("You coordinate launch work. Plan first, create exactly one Design task, one Build task, and one Ship task, then delegate exactly one readiness notification to the \"comms\" agent. Do not create duplicate tasks and do not send notifications yourself."),
+		agent.Prompt("You coordinate launch work. Before any task or delegate tool call, you must persist the launch-readiness plan with the built-in plan tool. Then create exactly one Design task, one Build task, and one Ship task, then delegate exactly one readiness notification to the \"comms\" agent. Do not create duplicate tasks and do not send notifications yourself."),
 		agent.Provider(provider), agent.APIKey(apiKey),
 		agent.WithRegistry(reg), agent.WithClient(cl), agent.WithStore(mem),
 		agent.WithCheckpoint(conductorCheckpoint),
+		agent.WrapTool(requirePersistedPlanBeforeConductorActions(mem)),
 	}
 	conductorOpts = append(conductorOpts, liveAgentOpts...)
 	conductor := agent.New(conductorOpts...)
@@ -542,6 +543,26 @@ func runPlanDelegate(provider string) error {
 	return nil
 }

+func requirePersistedPlanBeforeConductorActions(mem store.Store) ai.ToolWrapper {
+	return func(next ai.ToolHandler) ai.ToolHandler {
+		return func(ctx context.Context, call ai.ToolCall) ai.ToolResult {
+			if call.Name == "plan" {
+				return next(ctx, call)
+			}
+			if recs, err := store.Scope(mem, "agent", "conductor").Read("plan"); err == nil && len(recs) > 0 {
+				return next(ctx, call)
+			}
+			msg := "persist the launch-readiness plan first by calling the built-in plan tool before task or delegate side effects"
+			return ai.ToolResult{
+				ID:      call.ID,
+				Value:   map[string]string{"error": msg},
+				Content: `{"error":"` + msg + `"}`,
+				Refused: ai.RefusedApproval,
+			}
+		}
+	}
+}
+
 func requireConductorPlan(ctx context.Context, mem store.Store, conductor agent.Agent) error {
 	recs, _ := store.Scope(mem, "agent", "conductor").Read("plan")
 	if len(recs) == 0 && conductor != nil {
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"errors"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -439,6 +440,50 @@ func TestRequireConductorPlanFailureNamesScopedRecord(t *testing.T) {
 	}
 }

+func TestRequirePersistedPlanBeforeConductorActionsBlocksSideEffects(t *testing.T) {
+	mem := store.NewMemoryStore()
+	called := false
+	wrapped := requirePersistedPlanBeforeConductorActions(mem)(func(context.Context, ai.ToolCall) ai.ToolResult {
+		called = true
+		return ai.ToolResult{ID: "call-1", Content: `{"ok":true}`}
+	})
+
+	res := wrapped(context.Background(), ai.ToolCall{ID: "call-1", Name: "task.Add"})
+	if called {
+		t.Fatal("side-effecting tool ran before persisted plan")
+	}
+	if res.Refused != ai.RefusedApproval {
+		t.Fatalf("Refused = %q, want %q", res.Refused, ai.RefusedApproval)
+	}
+	if !strings.Contains(res.Content, "built-in plan tool") {
+		t.Fatalf("Content = %q, want plan-first steering message", res.Content)
+	}
+}
+
+func TestRequirePersistedPlanBeforeConductorActionsAllowsPlanAndPlannedActions(t *testing.T) {
+	mem := store.NewMemoryStore()
+	var calls []string
+	wrapped := requirePersistedPlanBeforeConductorActions(mem)(func(ctx context.Context, call ai.ToolCall) ai.ToolResult {
+		calls = append(calls, call.Name)
+		if call.Name == "plan" {
+			if err := store.Scope(mem, "agent", "conductor").Write(&store.Record{Key: "plan", Value: []byte(`{"steps":[{"task":"Design","status":"pending"}]}`)}); err != nil {
+				t.Fatalf("write plan: %v", err)
+			}
+		}
+		return ai.ToolResult{ID: call.ID, Content: `{"ok":true}`}
+	})
+
+	if res := wrapped(context.Background(), ai.ToolCall{ID: "call-1", Name: "plan"}); res.Refused != "" {
+		t.Fatalf("plan Refused = %q, want allowed", res.Refused)
+	}
+	if res := wrapped(context.Background(), ai.ToolCall{ID: "call-2", Name: "task.Add"}); res.Refused != "" {
+		t.Fatalf("planned action Refused = %q, want allowed", res.Refused)
+	}
+	if want := []string{"plan", "task.Add"}; !reflect.DeepEqual(calls, want) {
+		t.Fatalf("calls = %v, want %v", calls, want)
+	}
+}
+
 func TestPlanDelegateConductorRetriesAfterPlanOnlySuccess(t *testing.T) {
 	taskSvc := new(TaskService)
 	notifySvc := new(NotifyService)
@@ -92,11 +92,11 @@ func main() {
 			if *requireConfiguredFlag {
 				fmt.Printf("FAIL %s: missing API key (%s)\n", provider, msg)
 				failed++
-				results = append(results, conformanceResult{Provider: provider, Status: statusFailed, Error: "missing API key: " + msg})
+				results = append(results, missingKeyResults(provider, harnesses, statusFailed, "missing API key: "+msg)...)
 			} else {
 				fmt.Printf("- %s: skipped (%s)\n", provider, msg)
 				skipped++
-				results = append(results, conformanceResult{Provider: provider, Status: statusSkipped, Error: msg})
+				results = append(results, missingKeyResults(provider, harnesses, statusSkipped, msg)...)
 			}
 			continue
 		}
@@ -166,6 +166,20 @@ type conformanceSummary struct {
 	Failed       int                 `json:"failed"`
 }

+func missingKeyResults(provider string, harnesses []string, status, detail string) []conformanceResult {
+	results := make([]conformanceResult, 0, len(harnesses))
+	for _, harness := range harnesses {
+		results = append(results, conformanceResult{
+			Provider: provider,
+			Harness:  harness,
+			Phase:    harnessPhase(harness),
+			Status:   status,
+			Error:    detail,
+		})
+	}
+	return results
+}
+
 func writeSummaryJSON(path string, summary conformanceSummary) error {
 	b, err := json.MarshalIndent(summary, "", "  ")
 	if err != nil {
@@ -77,6 +77,23 @@ func TestCapabilityMatrixHasRegisteredProviders(t *testing.T) {
 	}
 }

+func TestMissingKeyResultsReportsEachHarness(t *testing.T) {
+	results := missingKeyResults("openai", []string{"agent", "plan-delegate"}, statusSkipped, "set OPENAI_API_KEY")
+	if len(results) != 2 {
+		t.Fatalf("missingKeyResults returned %d results, want 2", len(results))
+	}
+
+	wants := []conformanceResult{
+		{Provider: "openai", Harness: "agent", Phase: harnessPhase("agent"), Status: statusSkipped, Error: "set OPENAI_API_KEY"},
+		{Provider: "openai", Harness: "plan-delegate", Phase: harnessPhase("plan-delegate"), Status: statusSkipped, Error: "set OPENAI_API_KEY"},
+	}
+	for i, want := range wants {
+		if results[i] != want {
+			t.Fatalf("result[%d] = %#v, want %#v", i, results[i], want)
+		}
+	}
+}
+
 func TestWriteCapabilityMarkdown(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "capabilities.md")
 	rows := []ai.CapabilityRow{
@@ -21,6 +21,7 @@ func TestZeroToHeroReferenceDocs(t *testing.T) {
 	guide := readFile(t, filepath.Join(root, "internal", "website", "docs", "guides", "zero-to-hero.md"))
 	for _, want := range []string{
 		"make harness",
+		"make zero-to-hero-transcript",
 		"make inner-loop",
 		"go test ./cmd/micro/cli/new -run TestZeroToOne -count=1",
 		"go test ./cmd/micro -run TestFirstAgentWalkthroughCLIBoundaries -count=1",
@@ -70,6 +71,9 @@ func TestZeroToHeroReferenceDocs(t *testing.T) {
 	if !strings.Contains(readme, "internal/website/docs/guides/zero-to-hero.md") {
 		t.Fatal("README does not point to the canonical 0→hero guide")
 	}
+	if !strings.Contains(readme, "make zero-to-hero-transcript") {
+		t.Fatal("README does not expose the focused ordered 0→hero transcript contract")
+	}
 	if !strings.Contains(readme, "make inner-loop") {
 		t.Fatal("README does not expose the focused CLI inner-loop contract")
 	}
@@ -80,6 +84,33 @@ func TestZeroToHeroReferenceDocs(t *testing.T) {
 	}
 }

+func TestZeroToHeroTranscriptTargetStaysOrdered(t *testing.T) {
+	root := filepath.Clean(filepath.Join("..", "..", ".."))
+	makefile := readFile(t, filepath.Join(root, "Makefile"))
+	if !strings.Contains(makefile, "zero-to-hero-transcript:") {
+		t.Fatal("Makefile missing focused zero-to-hero-transcript target")
+	}
+	if !strings.Contains(makefile, "./internal/harness/zero-to-hero-ci/run.sh") {
+		t.Fatal("zero-to-hero-transcript target must run the maintained CI transcript")
+	}
+
+	runScript := readFile(t, filepath.Join(root, "internal", "harness", "zero-to-hero-ci", "run.sh"))
+	assertOrderedMarkers(t, "0→hero CI transcript", runScript, []string{
+		`run_step "scaffold: 0→1 service contract"`,
+		`run_step "run/chat/inspect: first-agent CLI boundaries"`,
+		`run_step "chat/inspect: no-secret first-agent transcript and docs"`,
+		`run_step "first-agent app: runnable provider-free example"`,
+		`run_step "0→hero app: support lifecycle smoke"`,
+		`run_step "flow history: deterministic services → agents → workflows harnesses"`,
+		`run_step "deploy dry-run: configured target plan"`,
+	})
+
+	guide := readFile(t, filepath.Join(root, "internal", "website", "docs", "guides", "zero-to-hero.md"))
+	if !strings.Contains(guide, "make zero-to-hero-transcript") {
+		t.Fatal("0→hero guide must point developers at the focused ordered transcript target")
+	}
+}
+
 func TestZeroToHeroDeployDryRunCommandSmoke(t *testing.T) {
 	root := filepath.Clean(filepath.Join("..", "..", ".."))
 	absRoot, err := filepath.Abs(root)
@@ -289,7 +320,9 @@ func TestFirstAgentWayfindingDocs(t *testing.T) {
 			heading: "### First agent on-ramp",
 			links: []string{
 				"internal/website/docs/guides/install-troubleshooting.md",
+				"make docs-wayfinding",
 				"micro agent demo",
+				"micro agent quickcheck",
 				"micro examples",
 				"micro zero-to-hero",
 				"internal/website/docs/guides/no-secret-first-agent.md",
@@ -333,7 +366,9 @@ func TestFirstAgentWayfindingDocs(t *testing.T) {
 			file:    filepath.Join(root, "cmd", "micro", "README.md"),
 			heading: "## First agent on-ramp",
 			links: []string{
+				"make docs-wayfinding",
 				"micro agent demo",
+				"micro agent quickcheck",
 				"micro examples",
 				"micro zero-to-hero",
 			},
@@ -356,7 +391,9 @@ func TestFirstAgentWayfindingDocs(t *testing.T) {
 			heading: "### First-agent on-ramp",
 			links: []string{
 				"guides/install-troubleshooting.html",
+				"make docs-wayfinding",
 				"micro agent demo",
+				"micro agent quickcheck",
 				"micro examples",
 				"micro zero-to-hero",
 				"https://github.com/micro/go-micro/blob/master/examples/INDEX.md",
@@ -377,6 +414,7 @@ func TestFirstAgentWayfindingDocs(t *testing.T) {
 			links: []string{
 				"guides/install-troubleshooting.html",
 				"micro agent demo",
+				"micro agent quickcheck",
 				"micro examples",
 				"micro zero-to-hero",
 				"https://github.com/micro/go-micro/blob/master/examples/INDEX.md",
@@ -431,6 +469,7 @@ func TestFirstAgentWayfindingCanonicalTrailStaysInSync(t *testing.T) {
 	root := filepath.Clean(filepath.Join("..", "..", ".."))
 	onRampTrail := []string{
 		"micro agent demo",
+		"micro agent quickcheck",
 		"micro examples",
 		"micro zero-to-hero",
 		"examples/INDEX.md",
@@ -855,6 +894,7 @@ func TestGettingStartedDocsLeadWithNoSecretFirstRun(t *testing.T) {
 				"curl -X POST http://localhost:8080/api/helloworld/Helloworld.Call",
 				"## Next Steps",
 				"micro agent demo",
+				"micro agent quickcheck",
 				"micro zero-to-hero",
 				"guides/no-secret-first-agent.html",
 				"guides/debugging-agents.html",
@@ -1047,6 +1087,7 @@ func TestFirstAgentCLIChatInspectFixture(t *testing.T) {
 	}()

 	waitForCLIOutput(t, &fixtureOut, "first-agent fixture ready", 15*time.Second)
+	waitForRegisteredAgent(t, micro, home, "assistant", &fixtureOut, 15*time.Second)

 	chat := runMicroCLIWithHome(t, micro, home, "chat", "--prompt", "Summarize my first-agent next steps", "assistant")
 	for _, want := range []string{"assistant:", "install the CLI", "run a service", "chat with an agent"} {
@@ -1093,6 +1134,23 @@ func waitForCLIOutput(t *testing.T, out *lockedBuffer, want string, timeout time
 	t.Fatalf("timed out waiting for fixture output %q; got:\n%s", want, out.String())
 }

+func waitForRegisteredAgent(t *testing.T, micro, home, agent string, fixtureOut *lockedBuffer, timeout time.Duration) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	var lastOut []byte
+	var lastErr error
+	for time.Now().Before(deadline) {
+		cmd := exec.Command(micro, "agent", "list")
+		cmd.Env = microCLIEnv(home)
+		lastOut, lastErr = cmd.CombinedOutput()
+		if lastErr == nil && strings.Contains(string(lastOut), agent) {
+			return
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for registered agent %q; last micro agent list error: %v\nlast output:\n%s\nfixture output:\n%s", agent, lastErr, lastOut, fixtureOut.String())
+}
+
 type lockedBuffer struct {
 	mu sync.Mutex
 	b  strings.Builder
@@ -1211,18 +1269,22 @@ func buildMicroBinary(t *testing.T, root string) string {
 func runMicroCLIWithHome(t *testing.T, micro, home string, args ...string) string {
 	t.Helper()
 	cmd := exec.Command(micro, args...)
-	cmd.Env = append(os.Environ(),
+	cmd.Env = microCLIEnv(home)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("micro %s failed: %v\n%s", strings.Join(args, " "), err, out)
+	}
+	return string(out)
+}
+
+func microCLIEnv(home string) []string {
+	return append(os.Environ(),
 		"HOME="+home,
 		"MICRO_AI_API_KEY=",
 		"OPENAI_API_KEY=",
 		"ANTHROPIC_API_KEY=",
 		"GEMINI_API_KEY=",
 	)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("micro %s failed: %v\n%s", strings.Join(args, " "), err, out)
-	}
-	return string(out)
 }

 func TestFirstAgentWayfindingTargetsExist(t *testing.T) {
@@ -22,8 +22,6 @@ run_step "scaffold: 0→1 service contract" \
  go test ./cmd/micro/cli/new -run TestZeroToOne -count=1
 run_step "run/chat/inspect: first-agent CLI boundaries" \
  go test ./cmd/micro -run 'TestFirstAgentWalkthroughCLIBoundaries|TestExamplesWayfindingIndexStaysLinked|TestExamplesCommandPointsAtWayfindingIndex|TestZeroToHeroCLIBoundaries|TestZeroToHeroCommandPrintsMaintainedNoSecretPath' -count=1
-run_step "deploy dry-run: configured target plan" \
-  go test ./cmd/micro/cli/deploy -run TestDeployDryRun -count=1
 run_step "chat/inspect: no-secret first-agent transcript and docs" \
  go test ./internal/harness/zero-to-hero-ci -run 'TestNoSecretFirstAgentTranscript|TestFirstAgentCLIChatInspectFixture|TestNoSecretFirstAgentDebuggingSmoke|TestZeroToHeroReferenceDocs|TestZeroToHeroDeployDryRunCommandSmoke|TestYourFirstAgentTutorialSmoke' -count=1

@@ -37,3 +35,5 @@ run_step "0→hero app: support lifecycle smoke" \
  go test ./examples/support -run 'TestRunSupportMockSmoke|TestZeroToHeroReadmeDocumentsLifecycle|TestZeroToHeroInspectTranscript' -count=1
 run_step "flow history: deterministic services → agents → workflows harnesses" \
  go test ./internal/harness/universe ./internal/harness/plan-delegate -run 'Test.*Harness|TestPlanDelegateEndToEnd|TestPlanDelegateFlowHandoff' -count=1
+run_step "deploy dry-run: configured target plan" \
+  go test ./cmd/micro/cli/deploy -run TestDeployDryRun -count=1
@@ -0,0 +1,43 @@
+---
+layout: blog
+title: "What's New in Go Micro: v6.6.0"
+permalink: /blog/35
+description: "Go Micro v6.6.0 strengthens the first-agent on-ramp, hardens plan/delegate recovery, and adds CI-backed security checks."
+---
+
+# What's New in Go Micro: v6.6.0
+
+*July 11, 2026 • By the Go Micro Team*
+
+Go Micro v6.6.0 is a harness reliability release. The theme is the same services → agents → workflows lifecycle, but with more of the first-agent path covered by local checks and more recovery paths made deterministic when agents resume, retry, delegate, or notify.
+
+## The first-agent path is harder to break
+
+The README, website docs, examples, and 0→hero guide chain now have more harness coverage. The CLI and docs keep the path from install troubleshooting through `micro agent demo`, quickcheck, examples, the smallest first-agent, debugging, and 0→hero in one consistent order.
+
+That matters because the first agent is where framework promises become real: scaffold a service, run it, chat with an agent, inspect what happened, and then graduate to workflows.
+
+## Plan/delegate recovery is steadier
+
+Plan/delegate got another reliability pass across side effects, notification replay, plan-only actions, timeout completion, and completed-plan recovery. These fixes are not flashy, but they are exactly the kind of harness work that keeps an agent from repeating work or losing state when a multi-step run is interrupted.
+
+## Provider fallback keeps improving
+
+AtlasCloud fallback handling now recovers more awkward provider outputs, including workspace repair calls, empty-argument text tool calls, spoken notification replays, and A2A fallback artifact text. The goal is pragmatic interop: when a provider response is close enough to a safe tool call, the harness should repair it; when it is not, the failure should stay visible.
+
+## Security checks joined the loop
+
+CI now includes a govulncheck gate and the autonomous loop can route vulnerability failures into triage. The release also includes toolchain and dependency updates for reachable CVEs, keeping the service framework side of the harness current while agent features continue to land.
+
+## Read the changelog
+
+The full release notes are in the [CHANGELOG](https://github.com/micro/go-micro/blob/master/CHANGELOG.md).
+
+---
+
+*Go Micro is an open source agent harness and service framework for Go. [Star us on GitHub](https://github.com/micro/go-micro).*
+
+<div class="post-nav">
+  <div><a href="/blog/34">&larr; What's New in Go Micro: v6.3.15</a></div>
+  <div><a href="/blog/">All Posts</a></div>
+</div>
@@ -11,6 +11,13 @@ permalink: /blog/

 <div class="posts">

+  <article style="margin-bottom: 2rem; padding-bottom: 1.5rem; border-bottom: 1px solid #e5e5e5;">
+    <h2 style="margin: 0 0 0.5rem;"><a href="/blog/35">What's New in Go Micro: v6.6.0</a></h2>
+    <p class="meta" style="color: #666; font-size: 0.85rem;">July 11, 2026</p>
+    <p>Go Micro v6.6.0 strengthens the first-agent on-ramp, hardens plan/delegate recovery, improves provider fallback repair, and adds CI-backed security checks.</p>
+    <a href="/blog/35">Read more &rarr;</a>
+  </article>
+
  <article style="margin-bottom: 2rem; padding-bottom: 1.5rem; border-bottom: 1px solid #e5e5e5;">
    <h2 style="margin: 0 0 0.5rem;"><a href="/blog/34">What's New in Go Micro: v6.3.15</a></h2>
    <p class="meta" style="color: #666; font-size: 0.85rem;">July 5, 2026</p>
@@ -104,16 +104,25 @@ If you are new, follow the architecture in the same order the runtime composes i
   CLI, `PATH`, version, and no-secret smoke path are healthy.
 2. [`micro agent demo`](getting-started.html#first-agent-on-ramp) — print the
   provider-free first-agent command and next docs steps from the installed CLI.
-3. [Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent)
+3. `micro agent quickcheck` (or `micro agent debug`) — print the short recovery
+   map when scaffold → run → chat → inspect stalls.
+4. `micro examples` — list the maintained provider-free runnable examples in
+   copy/paste order.
+5. `micro zero-to-hero` — print the maintained one-command no-secret lifecycle
+   harness and runnable examples.
+6. [Examples wayfinding index](https://github.com/micro/go-micro/blob/master/examples/INDEX.md)
+   — choose the smallest no-secret first-agent, support reference, and interop
+   examples from one map.
+7. [Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent)
   — run one service-backed agent with a mock model.
-4. [No-secret first-agent transcript](guides/no-secret-first-agent.html) — see the
+8. [No-secret first-agent transcript](guides/no-secret-first-agent.html) — see the
   maintained support-agent path work without a provider key.
-5. [Your First Agent](guides/your-first-agent.html) — build and chat with a
+9. [Your First Agent](guides/your-first-agent.html) — build and chat with a
   service-backed agent.
-6. [Debugging your agent](guides/debugging-agents.html) — inspect service
-   registration, tools, memory, providers, and run history.
-7. [0→hero Reference](guides/zero-to-hero.html) — walk scaffold → run → chat →
-   inspect → flow → deploy dry-run as the maintained lifecycle contract.
+10. [Debugging your agent](guides/debugging-agents.html) — inspect service
+    registration, tools, memory, providers, and run history.
+11. [0→hero Reference](guides/zero-to-hero.html) — walk scaffold → run → chat →
+    inspect → flow → deploy dry-run as the maintained lifecycle contract.

 ## Related

@@ -56,6 +56,9 @@ That install → scaffold → run → call loop is the 0→1 contract. It requir
 After this quick start, follow the agent path in order:

 1. [Install troubleshooting](guides/install-troubleshooting.html) — verify the CLI install before agent work.
+
+Run `make docs-wayfinding` to verify the focused no-secret docs/CLI contract that keeps these website and README commands aligned with the installed CLI.
+
 2. `micro agent demo` — print the provider-free first-agent demo command and next docs steps from the installed CLI.
 3. `micro agent quickcheck` (or `micro agent debug`) — when scaffold → run → chat → inspect stalls, print the short recovery map before you dive into the full debugging guide.
 4. `micro examples` — print the maintained provider-free runnable examples in copy/paste order.
@@ -26,6 +26,7 @@ cloud credentials?"
 | Deploy | `micro deploy --dry-run prod` resolves the documented deploy target without touching remote infrastructure. | `go test ./internal/harness/zero-to-hero-ci -run TestZeroToHeroDeployDryRunCommandSmoke -count=1` |
 | Smallest first agent | `examples/first-agent` runs one service-backed agent with a deterministic mock model and no provider key. | `go test ./examples/first-agent -run TestRunFirstAgent -count=1` |
 | Runtime reference app | `examples/support` runs typed services, an agent using those services as tools, an event-driven flow handoff, and an approval gate with only the model mocked. | `go test ./examples/support -run 'TestRunSupportMockSmoke|TestZeroToHeroReadmeDocumentsLifecycle|TestZeroToHeroInspectTranscript' -count=1` |
+| Ordered 0→hero transcript | The maintained CI transcript walks scaffold → run/chat/inspect → support-agent chat → flow history → deploy dry-run without provider keys. | `make zero-to-hero-transcript` |
 | Runtime harnesses | Real services, agents, durable flows, store-backed history, delegation, and A2A run with only the model mocked. | `./internal/harness/zero-to-hero-ci/run.sh` and `make provider-conformance-mock` |

 ## Find the one-command entrypoint
@@ -62,6 +63,12 @@ From the repository root:
 make harness
 ```

+For the focused ordered transcript only, run:
+
+```sh
+make zero-to-hero-transcript
+```
+
 That target runs the scaffold contract, the CLI boundary smoke tests, the
 0→hero runtime harnesses, the event-driven agent-flow harness, and mock provider
 conformance. It is intentionally deterministic: no provider key, cloud account,
@@ -16,7 +16,7 @@ It's built on a pluggable architecture of Go interfaces: service discovery, clie

 ## Learn More

-Start with [Getting Started](getting-started.html) for install and the first local service. Then follow the first-agent on-ramp in the same order as the README: `micro agent demo` for the installed no-secret CLI affordance, `micro examples` for the provider-free examples map, `micro zero-to-hero` for the maintained lifecycle harness, [examples wayfinding index](https://github.com/micro/go-micro/blob/master/examples/INDEX.md) for the runnable examples map, [the smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent) for the fastest provider-free run, [the 0→hero support reference](https://github.com/micro/go-micro/tree/master/examples/support) for the full no-secret lifecycle example, [No-secret first-agent transcript](guides/no-secret-first-agent.html) to run a mock-model support agent, [Your First Agent](guides/your-first-agent.html) to build a service-backed agent and talk to it with `micro chat`, [Debugging your agent](guides/debugging-agents.html) to use `micro inspect agent <name>` for runs and memory, and the [0→hero reference path](guides/zero-to-hero.html) to walk the full scaffold → run → chat → inspect → deploy dry-run lifecycle covered by CI.
+Start with [Getting Started](getting-started.html) for install and the first local service. Then follow the first-agent on-ramp in the same order as the README: `micro agent demo` for the installed no-secret CLI affordance, `micro agent quickcheck` (or `micro agent debug`) for the short recovery map, `micro examples` for the provider-free examples map, `micro zero-to-hero` for the maintained lifecycle harness, [examples wayfinding index](https://github.com/micro/go-micro/blob/master/examples/INDEX.md) for the runnable examples map, [the smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent) for the fastest provider-free run, [the 0→hero support reference](https://github.com/micro/go-micro/tree/master/examples/support) for the full no-secret lifecycle example, [No-secret first-agent transcript](guides/no-secret-first-agent.html) to run a mock-model support agent, [Your First Agent](guides/your-first-agent.html) to build a service-backed agent and talk to it with `micro chat`, [Debugging your agent](guides/debugging-agents.html) to use `micro inspect agent <name>` for runs and memory, and the [0→hero reference path](guides/zero-to-hero.html) to walk the full scaffold → run → chat → inspect → deploy dry-run lifecycle covered by CI.

 Otherwise continue to read the docs for more information about the framework.

@@ -25,6 +25,7 @@ Otherwise continue to read the docs for more information about the framework.
 - [Getting Started](getting-started.html)
 - [0→hero Reference](guides/zero-to-hero.html) - Walk scaffold → run → chat → `micro inspect agent <name>` → deploy dry-run with CI-backed commands
 - `micro agent demo` - Show the provider-free first-agent demo command and next docs steps
+- `micro agent quickcheck` (alias: `micro agent debug`) - Show the stalled first-agent recovery map before the full debugging guide
 - `micro examples` - Show provider-free first-agent examples in copy/paste order
 - [Examples wayfinding index](https://github.com/micro/go-micro/blob/master/examples/INDEX.md) - Choose the first-agent, support, and interop examples from one map
 - [Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent) - Run one service-backed agent with a deterministic mock model
@@ -43,14 +43,15 @@ You now have the service half of the services → agents → workflows lifecycle

 1. **[Install troubleshooting](guides/install-troubleshooting.html)** - verify the binary installer or `go install`, `PATH`, `micro --version`, and the no-secret smoke path.
 2. `micro agent demo` - print the provider-free first-agent demo command and the next docs steps from the installed CLI.
-3. `micro examples` - print the maintained provider-free runnable examples in copy/paste order.
-4. `micro zero-to-hero` - print the maintained one-command no-secret lifecycle harness and runnable examples.
-5. **[Examples wayfinding index](https://github.com/micro/go-micro/blob/master/examples/INDEX.md)** - choose the smallest no-secret first-agent, maintained **[0→hero support reference](https://github.com/micro/go-micro/tree/master/examples/support)**, and next interop examples from one map.
-6. **[Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent)** - run a mock-model, no-secret agent before adding provider keys.
-7. **[No-secret first-agent transcript](guides/no-secret-first-agent.html)** - run a useful support agent with a mock model before setting up a provider key.
-8. **[Your First Agent](guides/your-first-agent.html)** - turn this service into an agent-callable tool, chat with it, and learn the `micro agent preflight` → `micro run` → `micro chat` loop.
-9. **[Debugging your agent](guides/debugging-agents.html)** - use `micro inspect agent <name>` to inspect service registration, tool calls, run history, memory, provider failures, and flow handoffs when the agent does something surprising.
-10. **[0→hero Reference](guides/zero-to-hero.html)** - walk the maintained scaffold → run → chat → inspect → deploy dry-run path that proves services, agents, and workflows together.
+3. `micro agent quickcheck` (or `micro agent debug`) - print the short recovery map when scaffold → run → chat → inspect stalls.
+4. `micro examples` - print the maintained provider-free runnable examples in copy/paste order.
+5. `micro zero-to-hero` - print the maintained one-command no-secret lifecycle harness and runnable examples.
+6. **[Examples wayfinding index](https://github.com/micro/go-micro/blob/master/examples/INDEX.md)** - choose the smallest no-secret first-agent, maintained **[0→hero support reference](https://github.com/micro/go-micro/tree/master/examples/support)**, and next interop examples from one map.
+7. **[Smallest first-agent example](https://github.com/micro/go-micro/tree/master/examples/first-agent)** - run a mock-model, no-secret agent before adding provider keys.
+8. **[No-secret first-agent transcript](guides/no-secret-first-agent.html)** - run a useful support agent with a mock model before setting up a provider key.
+9. **[Your First Agent](guides/your-first-agent.html)** - turn this service into an agent-callable tool, chat with it, and learn the `micro agent preflight` → `micro run` → `micro chat` loop.
+10. **[Debugging your agent](guides/debugging-agents.html)** - use `micro inspect agent <name>` to inspect service registration, tool calls, run history, memory, provider failures, and flow handoffs when the agent does something surprising.
+11. **[0→hero Reference](guides/zero-to-hero.html)** - walk the maintained scaffold → run → chat → inspect → deploy dry-run path that proves services, agents, and workflows together.

 After that first-agent path, branch out to:

@@ -143,13 +143,13 @@ func (m *memoryModel) Delete(ctx context.Context, key string, v interface{}) err
 func (m *memoryModel) List(ctx context.Context, result interface{}, opts ...QueryOption) error {
 	// result must be *[]*T
 	rv := reflect.ValueOf(result)
-	if rv.Kind() != reflect.Ptr || rv.Elem().Kind() != reflect.Slice {
+	if rv.Kind() != reflect.Pointer || rv.Elem().Kind() != reflect.Slice {
 		return fmt.Errorf("model: result must be a pointer to a slice")
 	}
 	sliceVal := rv.Elem()
 	elemType := sliceVal.Type().Elem() // *T
 	structType := elemType
-	if structType.Kind() == reflect.Ptr {
+	if structType.Kind() == reflect.Pointer {
 		structType = structType.Elem()
 	}

@@ -193,7 +193,7 @@ func (m *memoryModel) List(ctx context.Context, result interface{}, opts ...Quer
 	for i, row := range rows {
 		vp := reflect.New(structType)
 		MapToStruct(s, row, vp.Interface())
-		if elemType.Kind() == reflect.Ptr {
+		if elemType.Kind() == reflect.Pointer {
 			results.Index(i).Set(vp)
 		} else {
 			results.Index(i).Set(vp.Elem())
@@ -166,13 +166,13 @@ func (d *postgresModel) Delete(ctx context.Context, key string, v interface{}) e

 func (d *postgresModel) List(ctx context.Context, result interface{}, opts ...model.QueryOption) error {
 	rv := reflect.ValueOf(result)
-	if rv.Kind() != reflect.Ptr || rv.Elem().Kind() != reflect.Slice {
+	if rv.Kind() != reflect.Pointer || rv.Elem().Kind() != reflect.Slice {
 		return fmt.Errorf("model/postgres: result must be a pointer to a slice")
 	}
 	sliceVal := rv.Elem()
 	elemType := sliceVal.Type().Elem()
 	structType := elemType
-	if structType.Kind() == reflect.Ptr {
+	if structType.Kind() == reflect.Pointer {
 		structType = structType.Elem()
 	}

@@ -226,7 +226,7 @@ func (d *postgresModel) List(ctx context.Context, result interface{}, opts ...mo
 	for i, fields := range fieldMaps {
 		vp := reflect.New(structType)
 		model.MapToStruct(schema, fields, vp.Interface())
-		if elemType.Kind() == reflect.Ptr {
+		if elemType.Kind() == reflect.Pointer {
 			results.Index(i).Set(vp)
 		} else {
 			results.Index(i).Set(vp.Elem())
@@ -33,7 +33,7 @@ type Field struct {
 // BuildSchema extracts a Schema from a struct type using reflection.
 func BuildSchema(v interface{}, opts ...RegisterOption) *Schema {
 	t := reflect.TypeOf(v)
-	if t.Kind() == reflect.Ptr {
+	if t.Kind() == reflect.Pointer {
 		t = t.Elem()
 	}

@@ -100,7 +100,7 @@ func BuildSchema(v interface{}, opts ...RegisterOption) *Schema {
 // StructToMap converts a struct pointer to a map of column name → value.
 func StructToMap(schema *Schema, v interface{}) map[string]any {
 	rv := reflect.ValueOf(v)
-	if rv.Kind() == reflect.Ptr {
+	if rv.Kind() == reflect.Pointer {
 		rv = rv.Elem()
 	}
 	fields := make(map[string]any, len(schema.Fields))
@@ -116,7 +116,7 @@ func StructToMap(schema *Schema, v interface{}) map[string]any {
 // MapToStruct fills a struct pointer from a map of column name → value.
 func MapToStruct(schema *Schema, fields map[string]any, v interface{}) {
 	rv := reflect.ValueOf(v)
-	if rv.Kind() == reflect.Ptr {
+	if rv.Kind() == reflect.Pointer {
 		rv = rv.Elem()
 	}
 	for _, f := range schema.Fields {
@@ -155,7 +155,7 @@ func KeyValue(schema *Schema, v interface{}) string {
 // ResolveType returns the struct reflect.Type from a value (handles pointers and slices).
 func ResolveType(v interface{}) reflect.Type {
 	t := reflect.TypeOf(v)
-	for t.Kind() == reflect.Ptr || t.Kind() == reflect.Slice {
+	for t.Kind() == reflect.Pointer || t.Kind() == reflect.Slice {
 		t = t.Elem()
 	}
 	return t
@@ -167,13 +167,13 @@ func (d *sqliteModel) Delete(ctx context.Context, key string, v interface{}) err
 func (d *sqliteModel) List(ctx context.Context, result interface{}, opts ...model.QueryOption) error {
 	// result must be *[]*T
 	rv := reflect.ValueOf(result)
-	if rv.Kind() != reflect.Ptr || rv.Elem().Kind() != reflect.Slice {
+	if rv.Kind() != reflect.Pointer || rv.Elem().Kind() != reflect.Slice {
 		return fmt.Errorf("model/sqlite: result must be a pointer to a slice")
 	}
 	sliceVal := rv.Elem()
 	elemType := sliceVal.Type().Elem()
 	structType := elemType
-	if structType.Kind() == reflect.Ptr {
+	if structType.Kind() == reflect.Pointer {
 		structType = structType.Elem()
 	}

@@ -226,7 +226,7 @@ func (d *sqliteModel) List(ctx context.Context, result interface{}, opts ...mode
 	for i, fields := range fieldMaps {
 		vp := reflect.New(structType)
 		model.MapToStruct(schema, fields, vp.Interface())
-		if elemType.Kind() == reflect.Ptr {
+		if elemType.Kind() == reflect.Pointer {
 			results.Index(i).Set(vp)
 		} else {
 			results.Index(i).Set(vp.Elem())
@@ -48,7 +48,7 @@ func extractMethodDoc(method reflect.Method, rcvrType reflect.Type) (description

 	// Find the receiver type name (e.g., "Users" from *Users)
 	rcvrTypeName := rcvrType.Name()
-	if rcvrTypeName == "" && rcvrType.Kind() == reflect.Ptr {
+	if rcvrTypeName == "" && rcvrType.Kind() == reflect.Pointer {
 		rcvrTypeName = rcvrType.Elem().Name()
 	}

@@ -133,7 +133,7 @@ func extractHandlerDocs(handler interface{}) map[string]map[string]string {

 	// Get the receiver type for methods
 	rcvrType := typ
-	if rcvrType.Kind() == reflect.Ptr {
+	if rcvrType.Kind() == reflect.Pointer {
 		rcvrType = rcvrType.Elem()
 	}

@@ -56,7 +56,7 @@ func TestExtractHandlerDocs(t *testing.T) {
 	}

 	// Test NoDoc (should have no metadata or only empty metadata)
-	if docs["NoDoc"] != nil && len(docs["NoDoc"]) > 0 {
+	if len(docs["NoDoc"]) > 0 {
 		t.Logf("NoDoc metadata: %+v", docs["NoDoc"])
 		// Check if all values are empty
 		allEmpty := true
@@ -16,7 +16,7 @@ func extractValue(v reflect.Type, d int) *registry.Value {
 		return nil
 	}

-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}

@@ -62,7 +62,7 @@ func extractValue(v reflect.Type, d int) *registry.Value {
 		}
 	case reflect.Slice:
 		p := v.Elem()
-		if p.Kind() == reflect.Ptr {
+		if p.Kind() == reflect.Pointer {
 			p = p.Elem()
 		}
 		arg.Type = "[]" + p.Name()
@@ -16,7 +16,7 @@ func extractValue(v reflect.Type, d int) *registry.Value {
 		return nil
 	}

-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}

@@ -55,7 +55,7 @@ func extractValue(v reflect.Type, d int) *registry.Value {
 		}
 	case reflect.Slice:
 		p := v.Elem()
-		if p.Kind() == reflect.Ptr {
+		if p.Kind() == reflect.Pointer {
 			p = p.Elem()
 		}
 		arg.Type = "[]" + p.Name()
@@ -367,7 +367,7 @@ func (g *grpcServer) processRequest(stream grpc.ServerStream, service *service,

 	// Decode the argument value.
 	argIsValue := false // if true, need to indirect before calling.
-	if mtype.ArgType.Kind() == reflect.Ptr {
+	if mtype.ArgType.Kind() == reflect.Pointer {
 		argv = reflect.New(mtype.ArgType.Elem())
 	} else {
 		argv = reflect.New(mtype.ArgType)
@@ -54,7 +54,7 @@ func isExported(name string) bool {

 // Is this type exported or a builtin?
 func isExportedOrBuiltinType(t reflect.Type) bool {
-	for t.Kind() == reflect.Ptr {
+	for t.Kind() == reflect.Pointer {
 		t = t.Elem()
 	}
 	// PkgPath will be non-empty even for an exported type,
@@ -107,7 +107,7 @@ func prepareEndpoint(method reflect.Method, log logger.Logger) *methodType {
 			return nil
 		}

-		if replyType.Kind() != reflect.Ptr {
+		if replyType.Kind() != reflect.Pointer {
 			log.Logf(logger.ErrorLevel, "method %v reply type not a pointer: %v", mname, replyType)
 			return nil
 		}
@@ -207,7 +207,7 @@ func (g *grpcServer) createSubHandler(sb *subscriber, opts server.Options) broke
 			var isVal bool
 			var req reflect.Value

-			if handler.reqType.Kind() == reflect.Ptr {
+			if handler.reqType.Kind() == reflect.Pointer {
 				req = reflect.New(handler.reqType.Elem())
 			} else {
 				req = reflect.New(handler.reqType)
@@ -107,7 +107,7 @@ func isExported(name string) bool {

 // Is this type exported or a builtin?
 func isExportedOrBuiltinType(t reflect.Type) bool {
-	for t.Kind() == reflect.Ptr {
+	for t.Kind() == reflect.Pointer {
 		t = t.Elem()
 	}
 	// PkgPath will be non-empty even for an exported type,
@@ -160,7 +160,7 @@ func prepareMethod(method reflect.Method, logger log.Logger) *methodType {
 			return nil
 		}

-		if replyType.Kind() != reflect.Ptr {
+		if replyType.Kind() != reflect.Pointer {
 			logger.Logf(log.ErrorLevel, "method %v reply type not a pointer: %v", mname, replyType)
 			return nil
 		}
@@ -376,7 +376,7 @@ func (router *router) readRequest(r Request) (service *service, mtype *methodTyp

 	// Decode the argument value.
 	argIsValue := false // if true, need to indirect before calling.
-	if mtype.ArgType.Kind() == reflect.Ptr {
+	if mtype.ArgType.Kind() == reflect.Pointer {
 		argv = reflect.New(mtype.ArgType.Elem())
 	} else {
 		argv = reflect.New(mtype.ArgType)
@@ -576,7 +576,7 @@ func (router *router) ProcessMessage(ctx context.Context, subscriber string, msg
 			var req reflect.Value

 			// check whether the handler is a pointer
-			if handler.reqType.Kind() == reflect.Ptr {
+			if handler.reqType.Kind() == reflect.Pointer {
 				req = reflect.New(handler.reqType.Elem())
 			} else {
 				req = reflect.New(handler.reqType)
Author	SHA1	Message	Date
Claude	3a6651611f	loop: cut planner bookkeeping churn + cap diminishing-returns conformance work govulncheck / govulncheck (push) Waiting to run Details Harness (E2E) / Harnesses (mock LLM) (push) Waiting to run Details Harness (E2E) / Provider harnesses (live LLM conformance) (push) Waiting to run Details Lint / golangci-lint (push) Waiting to run Details Run Tests / Unit Tests (push) Waiting to run Details Run Tests / Etcd Integration Tests (push) Waiting to run Details An assessment of the last 100 commits found ~45% were pure "refresh planner priorities" bookkeeping and much of the rest was thrashing on one weak provider (AtlasCloud text-tool-call repair) and guarding docs the loop already wrote — motion, not progress. Two prompt-policy fixes: PLANNER (planner.md): - Default to NOT committing. Post the assessment and close the issue; open a PRIORITIES.md PR ONLY when the change is MATERIAL (top item changes, an item is added/removed, or a top item's issue closed). No PRs for reorders below the top, reword, or "keep it current" — that churn was the loop's #1 waste. - Add a diminishing-returns guard: don't queue the Nth doc-guard or the Nth robustness workaround for an already-tolerated class; mark exhausted areas needs-human and rank real-headroom capability instead. TRIAGE (triage.md): - Cap the AtlasCloud/plan-delegate tail-chase: another instance of a class the agent already tolerates is NOT filed as a routine patch — comment "recurred — capped" and, if worth more, needs-human. Real regressions (lint/tests/ govulncheck on master) and genuinely new defects still get filed. Prompt-only; reversible. Steers the loop toward outcomes over busy-work. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL	2026-07-11 19:05:49 +00:00
Asim Aslam	25189cd0ca	Refresh planner priorities for 4726 (#4727 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 19:28:25 +01:00
Asim Aslam	85e2091ec9	docs: gate first-agent quickcheck wayfinding (#4725 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 18:58:20 +01:00
Asim Aslam	c15cc8122b	Refresh planner priorities for 4721 (#4723 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 18:33:35 +01:00
Asim Aslam	2452647d7b	Add first-agent debug smoke breadcrumbs (#4720 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 17:59:01 +01:00
Asim Aslam	e3aad233c1	Refresh planner priorities for 4717 (#4718 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 17:31:19 +01:00
Asim Aslam	eddecc3dad	ci: verify ordered zero-to-hero transcript (#4716 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 17:04:19 +01:00
Asim Aslam	9a75948e78	Refresh planner queue for 4710 (#4714 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 16:33:36 +01:00
Asim Aslam	6190712679	Reject nested text tool calls in arguments (#4709 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 15:55:48 +01:00
Asim Aslam	7d00219b5d	docs: verify first-agent wayfinding contract (#4707 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 15:38:42 +01:00
Asim Aslam	f88f7d1adf	Refresh planner queue for 4703 (#4704 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 14:40:31 +01:00
Asim Aslam	294f94ef74	test ai retry cancellation during backoff (#4702 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 13:59:30 +01:00
Asim Aslam	cf01fbdc37	Update README to remove Go Report Card badge (#4701 ) Removed Go Report Card badge from README.	2026-07-11 13:57:19 +01:00
Asim Aslam	50fc743b6d	ai: remove the ai/flow backward-compat shim (#4653 ) `ai/flow` was an alias-only package re-exporting go-micro.dev/v6/flow (the canonical location). It had no callers anywhere in the repo. Remove it; users should import `go-micro.dev/v6/flow` directly (identical types/functions). Classified as a Removed (breaking) change in the CHANGELOG since it deletes a public import path — see the PR for the versioning note. Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL Co-authored-by: Claude <noreply@anthropic.com>	2026-07-11 13:56:01 +01:00
Asim Aslam	a11b84e817	blog: add v6.6.0 whats new (#4672 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 13:55:30 +01:00
Asim Aslam	c80d0c62d8	Refresh planner queue for 4695 (#4697 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 13:30:12 +01:00
Asim Aslam	7c2d80a18e	Fix memory stream nack ordering (#4694 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 13:02:02 +01:00
Asim Aslam	7d2e9ec6ac	Refresh planner priorities for 4691 (#4692 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 12:32:15 +01:00
Asim Aslam	2281175bbc	Record agent provider failure metadata (#4688 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 11:59:23 +01:00
Asim Aslam	a421a54a77	Refresh planner queue for 4685 (#4686 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 11:39:57 +01:00
Asim Aslam	599e48b2d3	Stabilize first-agent fixture registration wait (#4684 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 11:17:29 +01:00
Asim Aslam	c74c067a09	Refresh planner priorities for 4681 (#4682 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 10:43:36 +01:00
Asim Aslam	ce29d7104c	Report provider conformance skips per harness (#4678 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 10:16:06 +01:00
Asim Aslam	6b855365df	Refresh planner priorities for 4675 (#4676 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 09:45:16 +01:00
Asim Aslam	6901937a03	Harden plan-delegate plan persistence (#4674 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 09:28:06 +01:00
Asim Aslam	1814df3e76	docs: refresh coherence changelog (#4671 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 08:41:42 +01:00
Asim Aslam	ca3aa27ad2	Refresh planner priorities for 4669 (#4670 ) Co-authored-by: Codex <codex@openai.com>	2026-07-11 08:41:30 +01:00