feat: deploy verified local AgentTeams research stack

.env.example

@@ -2,6 +2,8 @@
 EGO_ENV=development
 EGO_API_HOST=0.0.0.0
 EGO_API_PORT=8000
+EGO_WEB_PORT=4173
+EGO_BASE_IMAGE_PULL_POLICY=missing
 EGO_DB_PATH=./artifacts/runtime/egoagentos.sqlite3
 # PostgreSQL takes precedence when set. Compose uses this owner only for one-shot
 # migration/security jobs; long-lived services receive the separate runtime logins below.
@@ -58,10 +60,11 @@ AGENTTEAMS_MODEL=
 # injected at runtime only and must never be committed or copied into an evidence bundle.
 EGO_AGENT_MODEL_BASE_URL=
 EGO_AGENT_MODEL_API_KEY=
-EGO_AGENT_MODEL=agnes-2.5-flash
-AGENTTEAMS_CONTROLLER_URL=http://127.0.0.1:18080
+EGO_AGENT_MODEL=agnes-2.5-pro
+AGENTTEAMS_CONTROLLER_URL=http://agentteams-controller:8090
+AGENTTEAMS_CONTROLLER_PORT=18090
 AGENTTEAMS_AUTH_TOKEN=
-AGENTTEAMS_MATRIX_URL=http://127.0.0.1:18080
+AGENTTEAMS_MATRIX_URL=http://agentteams-controller:6167
 AGENTTEAMS_MATRIX_ACCESS_TOKEN=
 # Explicit native PostgreSQL/PolarDB-PG bridge URLs. Keep the long-lived bridge in
 # verify mode with only its runtime URL; use the owner URL plus apply mode in a separate
@@ -72,6 +75,7 @@ EGO_AGENTTEAMS_MIGRATION_DATABASE_URL=
 EGO_AGENTTEAMS_MIGRATION_MODE=verify
 EGO_AGENTTEAMS_BRIDGE_DB=./artifacts/runtime/agentteams-bridge.sqlite3
 EGO_AGENTTEAMS_HTTP_TIMEOUT=15
+EGO_AGENTTEAMS_BRIDGE_PORT=8010
 # Reserved live benchmark opt-in. Until the per-scenario fault/replay harness exists,
 # both unset and set states return lowercase skip; the set state reports UNIMPLEMENTED.
 AGENTTEAMS_BENCHMARK_LIVE=

.gitignore

@@ -25,6 +25,7 @@ artifacts/runtime/
 data/agent-memory/
 submission/dist/
 .tmp/
+.runtime/
 
 # Local/stale setup output is not a submission input.
 ps.txt

README.md

@@ -55,7 +55,7 @@ digest，并在任何实验执行之前给出 `PASS/WARN/FAIL`。
 
 ```bash
 export EGO_AGENT_MODEL_BASE_URL=https://apihub.agnes-ai.com/v1
-export EGO_AGENT_MODEL=agnes-2.5-flash
+export EGO_AGENT_MODEL=agnes-2.5-pro
 read -s EGO_AGENT_MODEL_API_KEY
 export EGO_AGENT_MODEL_API_KEY
 export EGO_OPERATOR_KEY="$(openssl rand -hex 32)"
@@ -70,6 +70,37 @@ VITE_API_ROOT=http://127.0.0.1:8000/api/v1 npm --prefix apps/web run dev -- --po
 真实专家，必须另行部署 HTTPS FastAPI 服务并在构建时把 `VITE_API_ROOT` 指向它，不能把供应商
 API key 塞进 GitHub Pages。
 
+### 官方 AgentTeams 本地实机路径（GPU 延后）
+
+下面的一键部署固定使用官方 AgentTeams `v1.2.3`，创建 1 个 Manager、4 个 Worker、Team、
+L2 Human/Matrix 身份、GPU 门控 Project/Workflow，并启动 PostgreSQL、EgoAgentOS API、Web 与
+AgentTeams Bridge。密钥通过隐藏提示输入，之后只保存在 gitignored 的 `.runtime/live-stack.env`
+（0600）；命令和公开验收清单都不打印原值。
+
+```bash
+python3 scripts/deploy_local_live_stack.py all
+```
+
+本机入口：
+
+- Web：<http://127.0.0.1:4173>
+- EgoAgentOS API / OpenAPI：<http://127.0.0.1:8000> / <http://127.0.0.1:8000/docs>
+- AgentTeams Bridge：<http://127.0.0.1:8020>
+- Controller（只绑定本机）：<http://127.0.0.1:18090>
+- Matrix / Element：<http://127.0.0.1:18080> / <http://127.0.0.1:18088>
+
+Team 为 `ego-researchops`，Project 为 `egoagentos-gpu-gated-v1`。在 GPU 主机接入前，Workflow
+必须保持 `paused`，原因是 `GPU Worker intentionally not attached yet`。官方 Team 状态把 Leader
+单独计数，因此显示 `leaderReady=true + readyWorkers=3/3`；Controller 中实际存在并运行的是
+4 个 Worker 资源。可公开的地址、状态、房间 ID、digest 与验收结果写入
+`.runtime/live-stack-public.json`，Token、Matrix 初始密码和两个互不复用的操作密钥只在私有 env 中。
+
+2026-09-02 的真实验收区分两条链：官方 Matrix Team room 收到 4/4 个不同 Agent 的实时回复，
+基础设施为 `LIVE_LOCAL PASS`；同日自定义输入专家链真实调用 `agnes-2.5-pro`，PI 与 Scout 完成并
+写入 compact receipt，但 Architect 连续两次返回非合同 JSON，因而 `FAILED_CLOSED`，没有生成
+矩阵或执行任务。完整、无密钥的证据边界见
+[`docs/acceptance/live-local-2026-09-02.md`](docs/acceptance/live-local-2026-09-02.md)。
+
 本地评委复现的目标路径只需要 Docker：
 
 ```bash
@@ -90,10 +121,8 @@ docker compose up --build
 
 默认场景明确标记为 **SYNTHETIC DEMO DATA**。它真实运行控制面、本地 PostgreSQL 16 状态、审批、哈希、评测、证据门禁与审计，但不会声称已经使用 8×RTX 4090 训练，也不会伪造 TDSQL Nexa、TencentDB Agent Memory、AgentTeams、Nacos 或 Higress 在线状态。生产数据权威通过 `EGO_NEXA_DATABASE_URL` 指向 Nexa；直接启动 API 且不设置外部数据库时，使用 SQLite 开发 fallback。
 
-截至 2026-08-29，本机已通过 `docker compose config` 和真实 PostgreSQL 16.14
-数据层的 32/32 集成测试；API/Web 镜像构建在拉取 Docker Hub metadata 时网络超时，
-因此本仓库不把这次 `docker compose up --build` 记作已验证镜像构建。评委网络可用时可
-直接走上述一键路径；原生启动路径不依赖镜像拉取：
+截至 2026-09-02，本机已经完成 Compose 镜像构建、PostgreSQL 数据迁移与权限初始化、API/Web/
+Bridge 启动和端到端健康检查。原生启动路径仍可用于不希望运行完整 AgentTeams 的开发场景：
 
 若不使用 Docker：
 

apps/agentteams_bridge/Dockerfile

@@ -1,15 +1,17 @@
-FROM python:3.12-slim
+FROM python:3.11-slim
 
 WORKDIR /app
-COPY pyproject.toml requirements-api.lock ./
-COPY apps ./apps
-COPY benchmarks ./benchmarks
+COPY requirements-api.lock ./
 RUN pip install --no-cache-dir -r requirements-api.lock \
     && addgroup --system egoagentos \
     && adduser --system --ingroup egoagentos --home /nonexistent --no-create-home egoagentos \
     && mkdir -p /data \
     && chown -R egoagentos:egoagentos /data
 
+COPY pyproject.toml ./
+COPY apps ./apps
+COPY benchmarks ./benchmarks
+
 ENV EGO_AGENTTEAMS_BRIDGE_DB=/data/bridge.sqlite3
 VOLUME ["/data"]
 USER egoagentos

apps/api/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.9-slim AS runtime
+FROM python:3.11-slim AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
@@ -7,19 +7,20 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 WORKDIR /app
 
 COPY requirements-api.lock ./
+RUN pip install --no-cache-dir --require-hashes -r requirements-api.lock \
+    && addgroup --system egoagentos \
+    && adduser --system --ingroup egoagentos --home /nonexistent --no-create-home egoagentos \
+    && mkdir -p /data \
+    && chown -R egoagentos:egoagentos /data
+
 COPY apps/api ./apps/api
 COPY benchmarks ./benchmarks
 COPY contracts ./contracts
+COPY integrations ./integrations
 COPY protocols ./protocols
 COPY skill_runtime ./skill_runtime
 COPY skills ./skills
 
-RUN pip install --no-cache-dir --require-hashes -r requirements-api.lock \
-    && addgroup --system egoagentos \
-    && adduser --system --ingroup egoagentos --home /nonexistent --no-create-home egoagentos \
-    && mkdir -p /data \
-    && chown -R egoagentos:egoagentos /data
-
 USER egoagentos
 
 EXPOSE 8000

apps/api/README.md

@@ -84,16 +84,18 @@ Configure the model plane only on the API process:
 
 ```bash
 export EGO_AGENT_MODEL_BASE_URL=https://apihub.agnes-ai.com/v1
-export EGO_AGENT_MODEL=agnes-2.5-flash
+export EGO_AGENT_MODEL=agnes-2.5-pro
 read -s EGO_AGENT_MODEL_API_KEY
 export EGO_AGENT_MODEL_API_KEY
 ```
 
 The returned truth boundary is intentionally narrower than an AgentTeams or experiment claim:
-the four provider responses are `LIVE`; deterministic compilation and private focus memory are
-`LIVE_LOCAL`; official AgentTeams/Matrix, repository or literature retrieval, and physical GPU
-execution remain `NOT_RUN` until their own receipts exist. A reviewer `PASS` or `WARN` produces
-`PLAN_READY_FOR_HUMAN_REVIEW`, never an automatic experiment dispatch.
+provider responses are `LIVE`; deterministic compilation and private focus memory are
+`LIVE_LOCAL`; repository/literature retrieval and physical GPU execution remain `NOT_RUN` until
+their own receipts exist. AgentTeams/Matrix truth is evaluated separately: the 2026-09-02 local
+stack has infrastructure-level `LIVE_LOCAL` receipts, but no completed Project workflow or GPU
+Decision. A reviewer `PASS` or `WARN` produces `PLAN_READY_FOR_HUMAN_REVIEW`, never an automatic
+experiment dispatch.
 
 Send the operator credential on every mutation, for example:
 

apps/api/expert_runs.py

@@ -37,6 +37,12 @@
 
 ZERO_HASH = "0" * 64
 ROLE_ORDER = ("research-pi", "scout", "experiment-architect", "reviewer")
+ROLE_MAX_TOKENS = {
+    "research-pi": 2400,
+    "scout": 2400,
+    "experiment-architect": 4096,
+    "reviewer": 4096,
+}
 
 
 def _now() -> str:
@@ -239,7 +245,7 @@ def from_environment(
     ) -> "ExpertRunService":
         base_url = os.getenv("EGO_AGENT_MODEL_BASE_URL", "").strip()
         api_key = os.getenv("EGO_AGENT_MODEL_API_KEY", "")
-        model = os.getenv("EGO_AGENT_MODEL", "agnes-2.5-flash").strip()
+        model = os.getenv("EGO_AGENT_MODEL", "agnes-2.5-pro").strip()
         gateway = None
         if base_url and api_key:
             gateway = OpenAICompatibleModelGateway(base_url, api_key, model)
@@ -424,7 +430,7 @@ def _call_role(
                     role=role,
                     system_prompt=prompt,
                     input_payload=payload,
-                    max_tokens=1800,
+                    max_tokens=ROLE_MAX_TOKENS[role],
                 )
                 _validate_role_output(
                     role,

apps/api/service.py

@@ -1,7 +1,10 @@
 """Application service implementing the deterministic ResearchOps workflow."""
 
 import hashlib
+import json
 import os
+import urllib.error
+import urllib.request
 import uuid
 from datetime import datetime, timezone
 from pathlib import Path
@@ -66,6 +69,7 @@
 GPU_ROLLBACK_POINT = (
     "Restore the baseline-ltx configuration pointer and preserve all failed-run evidence."
 )
+DIRECT_HTTP = urllib.request.build_opener(urllib.request.ProxyHandler({}))
 
 AGENT_ROLES = [
     ("research-pi", "Research PI", "Decomposes goals and owns state transitions"),
@@ -1511,27 +1515,67 @@ def integrations() -> Dict[str, Any]:
         ]
         states = []
         for integration_id, name, role, environment_key in definitions:
-            configured = bool(os.getenv(environment_key))
+            endpoint = os.getenv(environment_key, "").strip()
+            configured = bool(endpoint)
+            status = (
+                IntegrationTruth.CONFIGURED_UNVERIFIED
+                if configured
+                else IntegrationTruth.NOT_CONFIGURED
+            )
+            detail = (
+                "Endpoint is configured, but this local adapter does not claim a live handshake."
+                if configured
+                else "Optional external adapter is not configured; deterministic local mode remains available."
+            )
+            if integration_id == "hiclaw" and configured:
+                try:
+                    with DIRECT_HTTP.open(endpoint, timeout=3) as response:
+                        payload = json.loads(response.read())
+                    if not isinstance(payload, dict):
+                        raise TypeError("AgentTeams Bridge payload must be an object")
+                    team = payload.get("team")
+                    if (
+                        response.status == 200
+                        and payload.get("live") is True
+                        and isinstance(team, dict)
+                    ):
+                        status = IntegrationTruth.READY
+                        detail = (
+                            "Verified through AgentTeams Bridge: Team %s is %s; "
+                            "leaderReady=%s and subordinate Workers=%s/%s."
+                            % (
+                                team.get("name", "unknown"),
+                                team.get("phase", "unknown"),
+                                team.get("leaderReady", False),
+                                team.get("readyWorkers", 0),
+                                team.get("totalWorkers", 0),
+                            )
+                        )
+                    else:
+                        status = IntegrationTruth.UNAVAILABLE
+                        detail = "AgentTeams Bridge responded without a verified live handshake."
+                except (
+                    OSError,
+                    TypeError,
+                    json.JSONDecodeError,
+                    urllib.error.URLError,
+                ):
+                    status = IntegrationTruth.UNAVAILABLE
+                    detail = (
+                        "AgentTeams Bridge is configured but its live handshake is unavailable."
+                    )
             state = IntegrationState(
                 id=integration_id,
                 name=name,
                 role=role,
-                status=(
-                    IntegrationTruth.CONFIGURED_UNVERIFIED
-                    if configured
-                    else IntegrationTruth.NOT_CONFIGURED
-                ),
+                status=status,
                 endpoint_configured=configured,
                 checked_at=now,
-                detail=(
-                    "Endpoint is configured, but this local adapter does not claim a live handshake."
-                    if configured
-                    else "Optional external adapter is not configured; deterministic local mode remains available."
-                ),
+                detail=detail,
             )
             states.append(state.model_dump(mode="json"))
         return {
-            "mode": "adapter_metadata_only",
+            "mode": "verified_handshake_or_metadata",
             "truth_policy": (
                 "No external integration is reported ready without a verified handshake. "
                 "This build intentionally performs no fake cloud calls."

apps/web/src/App.tsx

@@ -1341,7 +1341,7 @@ function AcceptanceReadiness({
       </AnimatePresence>
       <div className="acceptance-boundary">
         <span>{language === "zh" ? "本地每 Agent 数据库 + FOCUS.MD · 合同已验证" : "LOCAL PER-AGENT DB + FOCUS.MD · CONTRACT VERIFIED"}</span>
-        <span>{language === "zh" ? "TDSQL NEXA / AGENT MEMORY / 官方 AGENTTEAMS / GPU · 未运行" : "TDSQL NEXA / AGENT MEMORY / OFFICIAL AGENTTEAMS / GPU · NOT RUN"}</span>
+        <span>{language === "zh" ? "TDSQL NEXA / AGENT MEMORY / GPU · 未运行 · AGENTTEAMS 状态见集成事实" : "TDSQL NEXA / AGENT MEMORY / GPU · NOT RUN · SEE INTEGRATION TRUTH FOR AGENTTEAMS"}</span>
         <a
           href="https://github.com/mythrise/ego_agent_infra/blob/main/docs/judge-feedback-implementation.md"
           target="_blank"

apps/web/src/styles.css

@@ -4057,3 +4057,30 @@ p {
     grid-template-columns: 1fr;
   }
 }
+
+/* Keep in-page navigation targets below the sticky task and operator bars. */
+#compose,
+#cockpit,
+#protocol,
+#acceptance,
+#experiments,
+#evidence,
+#trace,
+#memory,
+#integrations {
+  scroll-margin-top: 122px;
+}
+
+@media (max-width: 840px) {
+  #compose,
+  #cockpit,
+  #protocol,
+  #acceptance,
+  #experiments,
+  #evidence,
+  #trace,
+  #memory,
+  #integrations {
+    scroll-margin-top: 120px;
+  }
+}