v0.4.0 — AMH WT Agent Harness

AMH WT Agent Harness — bounded delegation behind the MCP

The master model delegates; small K2-class workers execute the tasks they are good at; an independent verifier checks; the master accepts. Nothing self-applies.

New private companion Worker (agent/):

• Coordinator (Durable Object) — versioned job packets with acknowledgement hashes, tamper-evident hash-chained audit log, per-user tenant isolation
• Continuity Keeper — compact project briefing; keep / archive / drop / reload-by-ID memory layers; automatic 4/7/30-day retention with byte budgets
• SafeTry — read / plan / approval-required / blocked capability lanes; HTTPS-only allowlisted crawling with SSRF guards; no raw shell, no secret exposure
• Guided templates — web research, secondary deep dive, citation verify, UI check, Cloudflare diagnose/inventory, config compare, missed items, zero-AI site health, revision proposals
• Honest model lanes — free profile (GLM Flash primary + Gemma verifier) with clear labeling; paid-k2 profile enables Kimi K2.6 primary + verifier
• Agent profiles — friendly names (auto-named if you skip it), a permanent renameable office-manager, rename/remove with audit events, immutable version scorecards
• Revisions — workers file candidate improvements as diffs with evidence; master approval required before anything becomes active
• Web console — session + CSRF + Turnstile-ready auth, strict CSP, live progress bars with visible handoffs, Done tab, opt-in redacted local cache/export
• Terminal watcher — npm run watch in agent/: running agents pinned on top with live bars; operator commands agents, job <id>, name <id> <new name> applied through the internal API and audit-logged
• Email loopback verifier — real deliverability receipts, not a vague "sent" badge
• Knowledge vault — approved redacted lessons land in Git under agent/knowledge-vault/<site>/<date-time>_<type>.json; private stashes stay ignored

Main MCP worker v0.4.0: new tools agent_research_start, agent_research_status, agent_research_list, agent_briefing, agent_control over a private Worker-to-Worker service binding — worker models never see the internal key or any Cloudflare token.

Tests: 71 worker + 11 harness passing. Both Wrangler bundles dry-run clean.