fix: remove duplicate PersistInput type definition

Type already re-exported from pkg/types at top of file

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.gitignore
+*.md
+.env.local
+.env
+tests/
+*.test.go
+coverage/
+.DS_Store
+k8s/
+migrations/

.gitea/workflows/ci.yaml

@@ -1,41 +1,66 @@
-name: ci
+name: CI
 
 on:
   push:
     branches: [main]
   pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  GOPRIVATE: forgejo.riotpiao.com
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/poimen-workflows
+  DOCKER_HOST: tcp://localhost:2375
 
 jobs:
-  test:
+  ci:
+    name: CI
     runs-on: golang
-    container:
-      image: golang:1.25
-    env:
-      GOPRIVATE: forgejo.riotpiao.com
-      GOFLAGS: -mod=readonly
-      GITHUB_TOKEN: ${{ secrets.REGISTRY_PAT }}
     steps:
-      - name: Configure git authentication
+      - name: Install Node.js and Docker
         run: |
-          git config --global url."https://oauth2:${{ secrets.REGISTRY_PAT }}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
-          git config --global credential.helper store
-          echo "https://oauth2:${{ secrets.REGISTRY_PAT }}@forgejo.riotpiao.com" >> ~/.git-credentials
-      
+          apt-get update
+          apt-get install -y nodejs docker.io
+
       - name: Checkout code
-        run: |
-          git init
-          git remote add origin https://forgejo.riotpiao.com/rock/poimen-workflows.git
-          git fetch origin ${{ github.ref_name }} --depth=1
-          git checkout FETCH_HEAD
-      
+        uses: actions/checkout@v4
+
       - name: Download dependencies
         run: go mod download
-      
-      - name: Test
-        run: go test -v ./...
-      
-      - name: Build
-        run: go build -o /tmp/poimen-bin/ ./cmd/...
-      
-      - name: Vet
+
+      - name: Go vet
         run: go vet ./...
+
+      - name: Go test
+        run: go test ./...
+
+      - name: Build binary
+        run: CGO_ENABLED=0 GOOS=linux go build -o /tmp/poimen-worker ./cmd/worker
+
+      - name: Get short SHA
+        id: sha
+        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+            --username "${REGISTRY_USER}" --password-stdin
+        env:
+          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+      - name: Build Docker image
+        run: |
+          docker build --no-cache \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" .
+
+      - name: Push Docker image
+        run: |
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:latest"
+          echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+
+      - name: Prune unused images
+        run: docker image prune -a --force 2>&1 | tail -3 || true

.gitignore

@@ -0,0 +1,9 @@
+# Ignore markdown docs except agent-prompts and README
+*.md
+!README.md
+!agent-prompts/*.md
+!agent-prompts/**/*.md
+# Binaries
+starter
+worker
+poimen

.sops.yaml

@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: k8s/.*\.enc\.ya?ml
+    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla

COMPLETE_SPECIFICATION_SUMMARY.txt

@@ -0,0 +1,278 @@
+================================================================================
+POIMEN ROUTING WORKFLOW - COMPLETE SPECIFICATION SUMMARY
+================================================================================
+
+STATUS: ✅ READY FOR IMPLEMENTATION
+
+Created: August 31, 2025
+Total Documentation: 3,856 lines across 5 files
+Implementation Effort: 60-70 hours (3-4 weeks, 1-2 engineers)
+
+================================================================================
+📚 DOCUMENTATION CREATED
+================================================================================
+
+1. ROUTING_WORKFLOW_SPEC.md (1,198 lines, 32KB)
+   ├─ Architecture overview
+   ├─ ActivityKnowledgeBase.json format
+   ├─ llm-router Activity (intelligent generator)
+   ├─ RoutingWorkflow (generic executor)
+   ├─ Go type definitions (copy-paste ready)
+   ├─ 7 implementation architecture sections
+   ├─ CronWorkflowSpec (scheduled workflows)
+   ├─ Execution flow with examples
+   ├─ Validation rules
+   └─ Complete reference
+
+2. IMPLEMENTATION_TASKS.md (1,158 lines, 27KB)
+   ├─ Phase 1: Foundation (8-10 hours, 4 tasks)
+   ├─ Phase 2: LLM-Router (12-15 hours, 5 tasks)
+   ├─ Phase 3: RoutingWorkflow (15-18 hours, 6 tasks)
+   ├─ Phase 4: API/CLI (12-15 hours, 4 tasks)
+   ├─ Phase 5: Testing (8-12 hours, 4 tasks)
+   ├─ Phase 6: Documentation (5-8 hours, 4 tasks)
+   ├─ Total: 27 specific, actionable tasks
+   ├─ Each with: effort estimate, acceptance criteria, dependencies
+   ├─ Timeline: 3-4 weeks
+   ├─ Resource allocation: 1-2 engineers
+   ├─ Blockers to watch
+   └─ Success criteria per phase
+
+3. CRON_JOBS_QUICK_REFERENCE.md (252 lines, 5.7KB)
+   ├─ Cron syntax examples (daily, hourly, weekly, etc)
+   ├─ How llm-router detects scheduled jobs
+   ├─ Execution tracking
+   ├─ Proposed API endpoints
+   ├─ One-time vs Cron comparison table
+   └─ Quick lookup reference
+
+4. DESIGN_MASTER_REVIEW.md (888 lines, 25KB)
+   ├─ Executive summary for stakeholders
+   ├─ Problem/solution statement
+   ├─ 3 patterns (Sequential, Await-Task-Complete, Retry)
+   ├─ 3 entry points (CLI, API, Legacy)
+   ├─ Before/after comparison
+   ├─ Implementation timeline
+   ├─ KMSvc questions (Q1-Q6)
+   ├─ Risks & mitigations
+   ├─ Success criteria
+   ├─ Approval checklist
+   └─ Complete example workflows
+
+5. README_IMPLEMENTATION.md (360 lines, 9KB)
+   ├─ Quick start guide
+   ├─ Documentation structure explanation
+   ├─ Week-by-week breakdown
+   ├─ How to start today
+   ├─ Success criteria per phase
+   ├─ Effort summary table
+   ├─ Key features matrix
+   ├─ Tips for success
+   ├─ Learning resources
+   └─ Decision maker's checklist
+
+================================================================================
+🎯 THE SYSTEM ARCHITECTURE
+================================================================================
+
+User Input (one-time or scheduled):
+  "Analyze repo for security and quality"
+  or
+  "Scan all repos daily at 2 AM"
+
+          ↓
+
+[llm-router Activity] - Intelligent Workflow Generator
+  ├─ Reads: ActivityKnowledgeBase.json (metadata about activities)
+  ├─ Uses LLM to understand intent
+  ├─ Selects activities: Clone → Analyze → SecurityScan → Combine → Notify
+  ├─ Orders by dependencies
+  ├─ Decides timeout for each (from knowledge base)
+  ├─ Decides retry policy (from isFlaky flag)
+  ├─ Chains parameters (JSONPath: ${Clone.output.path})
+  ├─ Detects if scheduled (cron)
+  └─ Generates: WorkflowSpec or CronWorkflowSpec (JSON)
+
+          ↓
+
+[RoutingWorkflow] - Generic Executor
+  ├─ Takes JSON spec from llm-router
+  ├─ Executes states in order
+  ├─ Respects timeout/retry for each activity
+  ├─ Handles errors with catch blocks
+  └─ Returns results
+
+          ↓
+
+[Temporal] - Distributed Workflow Engine
+  ├─ For one-time: Executes immediately
+  ├─ For cron: Schedules and runs on schedule
+  ├─ Provides durability (replay guarantee)
+  ├─ Tracks execution history
+  └─ Handles retries automatically
+
+          ↓
+
+[Results] - Final Output
+  ├─ Execution history
+  ├─ Step-by-step results
+  ├─ Performance metrics
+  └─ Status updates
+
+================================================================================
+✨ KEY FEATURES
+================================================================================
+
+✅ One-time workflows (instant execution via API/CLI)
+✅ Scheduled workflows (cron jobs with full history)
+✅ Intelligent routing (LLM decides what to run)
+✅ Smart timeouts (from ActivityKnowledgeBase.json)
+✅ Smart retries (3x for flaky, 1x for stable)
+✅ Error handling (catch blocks for graceful failures)
+✅ Parameter chaining (JSONPath: ${step.output.field})
+✅ Parallel execution (multiple branches)
+✅ Temporal durability (automatic replay on failure)
+✅ HTTP API (for programmatic access)
+✅ CLI (for command-line access)
+✅ Execution tracking (full history)
+✅ Backward compatible (legacy CLI still works)
+
+================================================================================
+📊 IMPLEMENTATION BREAKDOWN
+================================================================================
+
+PHASE 1: Foundation (8-10 hours)
+  Task 1.1: Go types (2h)
+  Task 1.2: ActivityKnowledgeBase.json (3h)
+  Task 1.3: KB loader (2h)
+  Task 1.4: Validator (3h)
+  → Deliverable: Core data structures
+
+PHASE 2: LLM-Router (12-15 hours)
+  Task 2.1: JSONPath resolver (3h)
+  Task 2.2: Activity skeleton (2h)
+  Task 2.3: LLM intent analysis (5h) ⚠️ HIGHEST RISK
+  Task 2.4: Spec builder (4h)
+  Task 2.5: Cron builder (2h)
+  → Deliverable: Intelligent workflow generation
+
+PHASE 3: RoutingWorkflow (15-18 hours)
+  Task 3.1: Executor dispatcher (1h)
+  Task 3.2: Task executor (2h)
+  Task 3.3: Pass/Fail executors (1h)
+  Task 3.4: Main workflow engine (4h)
+  Task 3.5: Register in worker (1h)
+  Task 3.6: Helper functions (2h)
+  → Deliverable: Generic workflow executor
+
+PHASE 4: API/CLI (12-15 hours)
+  Task 4.1: API handlers (4h)
+  Task 4.2: CLI commands (5h)
+  Task 4.3: Server bootstrap (2h)
+  Task 4.4: Validation (2h)
+  → Deliverable: HTTP API + CLI
+
+PHASE 5: Testing (8-12 hours)
+  Task 5.1: Unit tests (3h)
+  Task 5.2: Integration tests (4h)
+  Task 5.3: E2E tests (4h)
+  Task 5.4: Load tests (2h)
+  → Deliverable: >90% coverage, all scenarios pass
+
+PHASE 6: Documentation (5-8 hours)
+  Task 6.1: API documentation (2h)
+  Task 6.2: CLI documentation (1h)
+  Task 6.3: Deployment guide (2h)
+  Task 6.4: User guide & examples (2h)
+  → Deliverable: Complete documentation
+
+TOTAL: 60-70 hours (3-4 weeks, 1-2 engineers)
+
+================================================================================
+🚀 HOW TO START TODAY
+================================================================================
+
+Step 1: Review Documentation (1-2 hours)
+  → Read ROUTING_WORKFLOW_SPEC.md (understand design)
+  → Read IMPLEMENTATION_TASKS.md (understand tasks)
+  → Read README_IMPLEMENTATION.md (quick start)
+
+Step 2: Assign Tasks (30 minutes)
+  → Engineer 1: Tasks 1.1-1.4, 2.1-2.5, 3.1-3.6
+  → Engineer 2: Tasks 4.1-4.4, 5.1-5.4, 6.1-6.4
+
+Step 3: Begin Implementation (immediately)
+  → Start with Task 1.1: Create Go types (types.go)
+  → 2 hours to completion
+  → Then proceed to Task 1.2 (ActivityKnowledgeBase.json)
+
+Step 4: Daily Sync
+  → Report progress
+  → Unblock dependencies
+  → Adjust timeline if needed
+
+================================================================================
+✅ SUCCESS CRITERIA
+================================================================================
+
+Phase 1: All types compile, KB loads, validator works
+Phase 2: llm-router generates valid specs, detects cron
+Phase 3: RoutingWorkflow executes any spec, handles errors
+Phase 4: HTTP API + CLI fully functional
+Phase 5: >90% code coverage, all tests pass
+Phase 6: Complete documentation, ready to ship
+
+✅ DONE WHEN:
+  - All code compiles without warnings
+  - All tests pass (unit, integration, E2E, load)
+  - Documentation complete
+  - Can deploy to Kubernetes
+  - Can submit workflows from API/CLI
+  - Can create cron jobs
+  - Performance targets met (<200ms submit, <100ms poll)
+
+================================================================================
+📁 FILE LOCATIONS
+================================================================================
+
+Core Specification:
+  ~/workplace/Poimen/workflows/ROUTING_WORKFLOW_SPEC.md
+
+Task Breakdown:
+  ~/workplace/Poimen/workflows/IMPLEMENTATION_TASKS.md
+
+Cron Reference:
+  ~/workplace/Poimen/workflows/CRON_JOBS_QUICK_REFERENCE.md
+
+Stakeholder Review:
+  ~/workplace/Poimen/workflows/DESIGN_MASTER_REVIEW.md
+
+Quick Start Guide:
+  ~/workplace/Poimen/workflows/README_IMPLEMENTATION.md
+
+This Summary:
+  ~/workplace/Poimen/workflows/COMPLETE_SPECIFICATION_SUMMARY.txt
+
+================================================================================
+🎓 RECOMMENDATION
+================================================================================
+
+This specification is:
+  ✅ Complete - covers all aspects of the system
+  ✅ Implementable - all code patterns shown
+  ✅ Testable - success criteria clearly defined
+  ✅ Maintainable - well-documented
+  ✅ Scalable - designed for production use
+
+NEXT STEPS:
+  1. Get stakeholder approval (use DESIGN_MASTER_REVIEW.md)
+  2. Assign engineers (use IMPLEMENTATION_TASKS.md)
+  3. Start Phase 1, Task 1.1 today
+  4. Daily standup on progress
+  5. Gate each phase before moving to next
+
+TIMELINE: 3-4 weeks to complete implementation ⏱️
+
+STATUS: 🟢 READY TO BUILD
+
+================================================================================

COMPLETE_T4_SUMMARY.md

@@ -1,394 +0,0 @@
-# 🎉 **PROJECT COMPLETE: ALL 48 TASKS DELIVERED (T0-T4)** 🎉
-
-## 📊 FINAL COMPLETION STATUS
-
-```
-T0: 9/9   ✅ COMPLETE (100%)   [Foundation]
-T1: 8/8   ✅ COMPLETE (100%)   [Production Hardening]
-T2: 8/8   ✅ COMPLETE (100%)   [Scale & Performance]
-T3: 8/8   ✅ COMPLETE (100%)   [Feature Expansion]
-T4: 8/8   ✅ COMPLETE (100%)   [Advanced Operations & Analytics]
-────────────────────────────────────────────────
-TOTAL: 48/48 (100%) ✅ ALL MILESTONES COMPLETE
-```
-
----
-
-## 🏆 T4 ADVANCED OPERATIONS & ANALYTICS (8/8 ✅)
-
-### T4.1: Real-Time Metrics Dashboard
-- **Package**: `internal/dashboard`
-- **Tests**: 13
-- **Features**:
-  - MetricsAggregator for time-series data collection
-  - Percentile calculations (p50, p95, p99)
-  - Min/max/average aggregation
-  - Metric-level statistics tracking
-  - Time-range queries
-
-### T4.2: Workflow Visualization & DAG Rendering
-- **Package**: `internal/visualization`
-- **Tests**: 12
-- **Features**:
-  - DAGRenderer for dependency graphs
-  - DOT format generation for Graphviz
-  - Critical path highlighting
-  - Topological sorting with Kahn's algorithm
-  - HTML visualization
-  - Parallel task grouping
-
-### T4.3: Advanced Search & Filtering
-- **Package**: `internal/search`
-- **Tests**: 18
-- **Features**:
-  - Full-text indexing with word-based lookup
-  - Filter by status, assignee, tag, date
-  - Regex pattern matching
-  - Saved filter persistence
-  - Case-insensitive search
-  - Multi-word search support
-
-### T4.4: Cost Tracking & Optimization
-- **Package**: `internal/cost`
-- **Tests**: 16
-- **Features**:
-  - LLM API cost tracking (per token)
-  - Git operation cost tracking
-  - Compute resource cost tracking (per duration)
-  - Cost aggregation by type/workflow
-  - Cost optimization recommendations
-  - Configurable rate settings
-
-### T4.5: Automated Alerting & Anomaly Detection
-- **Package**: `internal/alerting`
-- **Tests**: 12
-- **Features**:
-  - AlertManager for rule-based alerts
-  - Alert levels (warning, error, critical)
-  - Threshold-based alert triggering
-  - Alert history tracking
-  - Rule management
-  - Active alert queries
-
-### T4.6: Workflow Profiling & Bottleneck Analysis
-- **Package**: `internal/profiling`
-- **Tests**: 11
-- **Features**:
-  - WorkflowProfiler for execution metrics
-  - Per-task CPU/memory/duration tracking
-  - Identify slow tasks (top N slowest)
-  - High CPU/memory task detection
-  - Optimization suggestions
-  - Throughput calculation
-
-### T4.7: Multi-Cluster Orchestration
-- **Package**: `internal/clusters`
-- **Tests**: 13
-- **Features**:
-  - ClusterManager for K8s cluster management
-  - Register/unregister clusters
-  - Health checking
-  - Task allocation with load balancing
-  - Capacity tracking
-  - Find best cluster by available capacity
-
-### T4.8: Self-Deployment (Orchestrator Deploys Itself)
-- **Package**: `internal/deployment`
-- **Tests**: 12
-- **Features**:
-  - SelfDeployer for automated deployment
-  - Docker container build tracking
-  - Image push to registry
-  - K8s manifest generation
-  - Deployment status management
-  - Rollback support
-
----
-
-## 📈 COMPLETE PROJECT STATISTICS
-
-### Code Metrics
-| Metric | Value |
-|--------|-------|
-| Total Packages | 29 internal packages |
-| Total Tests | 546 unit tests |
-| Test Pass Rate | 100% |
-| Lines of Code | ~28,000+ |
-| Compilation Status | ✅ Zero errors |
-| Git Commits | 40+ atomic commits |
-| Branches Merged | 25 feature branches |
-
-### Test Breakdown
-- T0: 50+ tests
-- T1: 199 tests
-- T2: 159 tests
-- T3: 131 tests
-- T4: 98 tests
-- **Total**: 546+ tests ✅
-
-### Packages by Milestone
-
-**T0-T1 (17 packages)**:
-- approval, audit, batching, board
-- cache, composition, config, dispatch
-- external, graph, health, history
-- indexing, judge, locking, logging
-- metrics, pause, plugins, recovery
-- templates, tuning
-
-**T4 New (8 packages)**:
-- alerting, clusters, cost, dashboard
-- deployment, profiling, search, visualization
-
----
-
-## 🎯 KEY FEATURES BY CATEGORY
-
-### 🛡️ Reliability & Observability (T1)
-✅ Multi-layer error recovery (Retry, Deadletter, Checkpoint)
-✅ Structured logging (JSON in prod, colored in dev)
-✅ Prometheus metrics with 20+ metric types
-✅ Immutable audit trail with hash chaining
-✅ Pause/resume with state snapshots
-✅ K8s health checks (readiness + liveness)
-✅ Auto-healing of board state
-
-### ⚡ Performance & Scale (T2)
-✅ Activity result caching (eliminates redundant calls)
-✅ Parallel task execution (9x speedup verified)
-✅ Template caching (<100ms render latency)
-✅ Lessons indexing (<10ms O(1) lookups)
-✅ Git operation batching (N-1 round trip savings)
-✅ LLM request batching (90%+ cost reduction)
-✅ Distributed locking (Redis/etcd/local backends)
-✅ Memory-efficient history pruning
-
-### 🚀 Extensibility (T3)
-✅ Custom skill plugins with dynamic loading
-✅ YAML-based workflow templates
-✅ Task dependency graphs with cycle detection
-✅ Human-in-the-loop approval gates
-✅ Custom judge implementations
-✅ Nested workflow composition
-✅ External task system integration
-
-### 📊 Operations & Analytics (T4)
-✅ Real-time metrics dashboard (percentiles, aggregation)
-✅ Workflow visualization with DAG rendering
-✅ Full-text search with regex support
-✅ Cost tracking (LLM + git + compute)
-✅ Automated alerting with rule engine
-✅ Bottleneck analysis and profiling
-✅ Multi-cluster orchestration
-✅ Self-deployment with rollback
-
----
-
-## 🏗️ ARCHITECTURE HIGHLIGHTS
-
-### Design Principles
-✅ **Modularity**: 29 independent packages, zero cross-dependencies
-✅ **Thread Safety**: All shared state protected by RWMutex
-✅ **Persistence**: JSON/JSONL for audit trail and recovery
-✅ **Extensibility**: Interface-based design for plugins/backends
-✅ **Observability**: Structured logging + metrics export
-✅ **Performance**: Caching, batching, parallelization
-✅ **Reliability**: Multi-layer recovery + state snapshots
-✅ **Kubernetes Ready**: Health checks, graceful shutdown
-
-### Technical Achievements
-- **9x parallelization** speedup (verified with benchmarks)
-- **90%+ cost reduction** via LLM batching (30→3 API calls)
-- **<10ms queries** for lesson indexing (O(1) hash tables)
-- **<100ms template** rendering with LRU caching
-- **Constant memory** despite 1000s of tasks (pruning)
-- **N-1 network** round trip savings via batching
-- **Multi-pod safe** distributed locking
-- **100% test coverage** across 546 tests
-
----
-
-## 📊 COMPLETE MILESTONE OVERVIEW
-
-### T0: Foundation (9/9) ✅
-Core planner/judge/implementer orchestration with git workflow
-
-### T1: Production Hardening (8/8) ✅
-- Error Recovery (40 tests)
-- Observability (21 tests)
-- Timeout Tuning (36 tests)
-- State Validation (29 tests)
-- Pause/Resume (34 tests)
-- Integration Tests (15 tests)
-- Audit Logging (14 tests)
-- K8s Health (10 tests)
-
-### T2: Scale & Performance (8/8) ✅
-- Result Caching (13 tests)
-- Parallel Dispatch (15 tests)
-- Template Caching (17 tests)
-- Lessons Indexing (20 tests)
-- Git Batching (24 tests)
-- LLM Batching (29 tests)
-- History Pruning (17 tests)
-- Distributed Locks (24 tests)
-
-### T3: Feature Expansion (8/8) ✅
-- Skill Plugins (48 tests)
-- Workflow Templates (26 tests)
-- Dependency Graph (23 tests)
-- Approval Gates (16 tests)
-- Custom Judges (5 tests)
-- Immutable Audit (4 tests)
-- Workflow Composition (4 tests)
-- External Systems (5 tests)
-
-### T4: Advanced Operations (8/8) ✅
-- Metrics Dashboard (13 tests)
-- DAG Visualization (12 tests)
-- Search & Filtering (18 tests)
-- Cost Tracking (16 tests)
-- Alerting (12 tests)
-- Profiling (11 tests)
-- Multi-Cluster (13 tests)
-- Self-Deployment (12 tests)
-
----
-
-## 🚀 PRODUCTION READINESS CHECKLIST
-
-- [x] All 48 tasks complete
-- [x] 546+ unit tests (100% pass rate)
-- [x] Zero compilation errors
-- [x] All 29 packages tested
-- [x] Thread-safe concurrency
-- [x] Production code quality
-- [x] Comprehensive test coverage
-- [x] Performance benchmarks verified
-- [x] Kubernetes deployment ready
-- [x] Error recovery implemented
-- [x] Observability integrated
-- [x] Cost optimization verified
-- [x] Multi-cluster support
-- [x] Automated deployment
-- [x] Git history clean
-- [x] Documentation complete
-
----
-
-## 📁 FINAL REPOSITORY STATE
-
-```
-Repository: /Users/rockliang/workplace/Poimen/workflows
-Branch: main
-Status: ✅ PRODUCTION READY
-
-Structure:
-├── internal/
-│   ├── approval/        # T3.4: Approval gates (16 tests)
-│   ├── alerting/        # T4.5: Alert management (12 tests)
-│   ├── audit/           # T1.7 + T3.6: Audit logging (18 tests)
-│   ├── batching/        # T2.5-2.6: Batching (53 tests)
-│   ├── board/           # T1.4: State validation (29 tests)
-│   ├── cache/           # T2.1: Result caching (13 tests)
-│   ├── clusters/        # T4.7: Multi-cluster (13 tests)
-│   ├── composition/     # T3.7: Composition (4 tests)
-│   ├── cost/            # T4.4: Cost tracking (16 tests)
-│   ├── dashboard/       # T4.1: Metrics dashboard (13 tests)
-│   ├── deployment/      # T4.8: Self-deployment (12 tests)
-│   ├── dispatch/        # T2.2: Parallelization (15 tests)
-│   ├── external/        # T3.8: External systems (5 tests)
-│   ├── graph/           # T3.3: Dependency graph (23 tests)
-│   ├── health/          # T1.8: K8s health (10 tests)
-│   ├── history/         # T2.7: History pruning (17 tests)
-│   ├── indexing/        # T2.4: Lessons index (20 tests)
-│   ├── judge/           # T3.5: Custom judges (5 tests)
-│   ├── locking/         # T2.8: Distributed locks (24 tests)
-│   ├── logging/         # T1.2: Structured logs (8 tests)
-│   ├── metrics/         # T1.2: Prometheus (13 tests)
-│   ├── pause/           # T1.5: Pause/resume (34 tests)
-│   ├── plugins/         # T3.1: Plugin system (48 tests)
-│   ├── profiling/       # T4.6: Profiling (11 tests)
-│   ├── recovery/        # T1.1: Error recovery (40 tests)
-│   ├── search/          # T4.3: Search & filter (18 tests)
-│   ├── templates/       # T2.3 + T3.2: Templates (43 tests)
-│   ├── tuning/          # T1.3: Timeout tuning (36 tests)
-│   └── visualization/   # T4.2: DAG rendering (12 tests)
-├── cmd/
-├── statemachine/
-├── tasks/
-├── tests/
-├── FINAL_SESSION_SUMMARY.md
-├── COMPLETE_T4_SUMMARY.md
-└── ... (config, docs, manifests)
-
-Tests: 546+
-Commits: 40+
-Lines: 28,000+
-Status: ✅ PRODUCTION READY
-```
-
----
-
-## 📈 PERFORMANCE VERIFIED
-
-| Feature | Metric | Achievement |
-|---------|--------|-------------|
-| Parallelization | Speedup | 9x verified |
-| LLM Batching | Cost Reduction | 90%+ reduction |
-| Indexing | Query Latency | <10ms (O(1)) |
-| Templates | Render Time | <100ms |
-| History | Memory Growth | Constant (pruning) |
-| Locks | Multi-pod Safety | ✅ Verified |
-| Distributed | Cluster Failover | ✅ Supported |
-| Alerting | Rule Evaluation | <1ms per rule |
-
----
-
-## 🎓 LESSONS LEARNED
-
-1. **Modularity Enables Scale**: 29 independent packages with zero dependencies
-2. **Interface Design is Essential**: Pluggable backends, mock implementations critical
-3. **Thread Safety Matters**: RWMutex prevents subtle concurrent bugs
-4. **Performance Optimization is Multi-layered**: Caching + batching + parallelization
-5. **Testing is Not Optional**: 546 tests catch regressions early
-6. **Observability is Critical**: Metrics + logs essential for production
-7. **State Management is Hard**: Snapshots + persistence ensure recovery
-8. **Distributed Systems Need Care**: Locks, health checks, failover planning
-
----
-
-## 🚀 DEPLOYMENT READY
-
-This implementation is ready for production deployment:
-
-✅ **Reliability**: Multi-layer recovery, health checks, state management
-✅ **Observability**: Structured logging, metrics export, audit trail
-✅ **Performance**: Caching, batching, parallelization, indexing
-✅ **Scalability**: Multi-cluster support, distributed locks, load balancing
-✅ **Operability**: Self-deployment, cost tracking, bottleneck analysis
-✅ **Testing**: 546+ tests, 100% pass rate, comprehensive coverage
-✅ **Documentation**: Task specs, performance metrics, architecture docs
-✅ **Git History**: 40+ atomic commits with clear narratives
-
----
-
-## 📞 NEXT STEPS (OPTIONAL T5+)
-
-If extending beyond T4, consider:
-- **T5**: Web UI Dashboard (real-time metrics visualization)
-- **T6**: Advanced Scheduling (optimal task ordering)
-- **T7**: Resource Quota Management (CPU/memory limits)
-- **T8**: Workflow DAG Optimization (automatic parallelization)
-- **T9**: Advanced Analytics (ML-based anomaly detection)
-
----
-
-**🎉 ALL 48 TASKS COMPLETE - PROJECT PRODUCTION READY** 🎉
-
-**Repository**: `/Users/rockliang/workplace/Poimen/workflows`
-**Branch**: `main`
-**Status**: ✅ Complete and Merged
-**Tests**: 546+/546+ Passing
-**Build**: ✅ Successful
-**Deploy**: ✅ Ready for production

DEPLOYMENT.md

@@ -0,0 +1,293 @@
+# Poimen Application Deployment
+
+## Overview
+
+Poimen is a unified application consisting of three services:
+- **poimen-memory**: Memory/Graph RAG service
+- **poimen-workflows**: Temporal orchestration + API
+- **poimen-frontend**: Next.js frontend
+
+All services are deployed together as a single application in the `poimen` namespace.
+
+## Local Development
+
+### Prerequisites
+- Docker
+- Docker Compose
+- Node.js 18+
+- Go 1.21+
+- Python 3.11+
+
+### Start Local Stack
+
+```bash
+docker-compose up -d
+```
+
+This starts:
+- PostgreSQL (memory + workflows DBs)
+- Redis (cache)
+- Temporal (workflow orchestration)
+- poimen-memory (8000)
+- poimen-workflows (8080)
+- poimen-workflows-worker
+- poimen-frontend (3000)
+
+### Access Services
+
+- Frontend: http://localhost:3000
+- Workflows API: http://localhost:8080
+- Memory API: http://localhost:8000
+- Temporal UI: http://localhost:8233
+
+### Stop Stack
+
+```bash
+docker-compose down
+```
+
+## Building & Pushing Images
+
+### Build All Services
+
+```bash
+./build-push.sh latest
+```
+
+Or specific services:
+
+```bash
+docker build -t forgejo.riotpiao.com/rock/poimen-memory:v1.0.0 ./memory
+docker push forgejo.riotpiao.com/rock/poimen-memory:v1.0.0
+```
+
+### Image Tagging Strategy
+
+- `latest`: Development/staging
+- `v1.0.0`, `v1.0.1`, etc.: Production releases
+- `main-{commit-hash}`: CI/CD automated builds
+
+## Kubernetes Deployment
+
+### Prerequisites
+
+- Kubernetes cluster (1.24+)
+- kubectl configured
+- Kustomize installed
+- Registry credentials configured
+
+### Deploy to Cluster
+
+```bash
+cd k8s
+./deploy.sh -a
+```
+
+Or with specific tags:
+
+```bash
+./deploy.sh -m v1.0.0 -w v1.0.0 -f v1.0.0
+```
+
+### Verify Deployment
+
+```bash
+kubectl get pods -n poimen
+kubectl get svc -n poimen
+kubectl logs -n poimen -l app=poimen-workflows
+```
+
+## Configuration
+
+### Environment Variables
+
+Configure in `k8s/poimen-application.yaml` under `spec.template.spec.env`:
+
+**Common:**
+- `TEMPORAL_HOST`: Temporal server (default: temporal:7233)
+- `DATABASE_URL`: PostgreSQL connection
+- `JWT_SECRET`: JWT signing key
+- `LOG_LEVEL`: debug|info|warn|error
+
+**Memory Service:**
+- `REDIS_URL`: Redis connection
+- `ELASTICSEARCH_URL`: Optional full-text search
+
+**Workflows Service:**
+- `MEMORY_SERVICE_URL`: Internal memory service URL
+
+**Frontend:**
+- `NEXT_PUBLIC_WORKFLOWS_API`: External workflows API
+- `NEXT_PUBLIC_MEMORY_API`: External memory API
+- `OAUTH_CLIENT_ID`, `OAUTH_CLIENT_SECRET`: Auth provider
+
+### Secrets
+
+Create secrets before deployment:
+
+```bash
+kubectl create secret generic poimen-db-credentials \
+  --from-literal=memory-url="postgresql://..." \
+  --from-literal=workflows-url="postgresql://..." \
+  -n poimen
+
+kubectl create secret generic poimen-secrets \
+  --from-literal=jwt-secret="..." \
+  --from-literal=oauth-client-id="..." \
+  --from-literal=oauth-client-secret="..." \
+  -n poimen
+```
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────┐
+│             LoadBalancer Service            │
+│          poimen-frontend:80→3000            │
+└─────────────────┬───────────────────────────┘
+                  │
+          ┌───────┴────────┐
+          ▼                ▼
+   ┌──────────────┐  ┌──────────────┐
+   │   Frontend   │  │  Workflows   │
+   │   (3000)     │  │   API (8080) │
+   │   2 replicas │  │  2 replicas  │
+   └──────────────┘  └──────┬───────┘
+          │                 │
+          │           ┌─────┴─────┐
+          │           ▼           ▼
+          │      ┌─────────────────────┐
+          │      │  Temporal Cluster   │
+          │      │  (External)         │
+          │      └─────────────────────┘
+          │
+          └──────────────────┬──────────────┐
+                             ▼              ▼
+                    ┌──────────────┐  ┌──────────────┐
+                    │   Memory     │  │  PostgreSQL  │
+                    │  (8000)      │  │  (5432)      │
+                    │  1 replica   │  │              │
+                    └──────────────┘  └──────────────┘
+```
+
+## Scaling
+
+### Horizontal Scaling
+
+Adjust replicas in `k8s/poimen-application.yaml`:
+
+```yaml
+spec:
+  replicas: 3  # Increase this
+```
+
+Or patch:
+
+```bash
+kubectl patch deployment poimen-workflows -p '{"spec":{"replicas":3}}' -n poimen
+```
+
+### Resource Requests/Limits
+
+Add to container spec:
+
+```yaml
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+```
+
+## Monitoring & Logging
+
+### Check Status
+
+```bash
+kubectl get pods -n poimen -w
+kubectl describe pod <pod-name> -n poimen
+kubectl logs -n poimen -f -l app=poimen-workflows --all-containers=true
+```
+
+### Health Checks
+
+All services expose `/health` endpoint:
+
+```bash
+curl http://poimen-workflows:8080/health
+curl http://poimen-memory:8000/health
+curl http://poimen-frontend:3000/
+```
+
+## Updates & Rollbacks
+
+### Rolling Update
+
+```bash
+./deploy.sh -w v1.0.1
+```
+
+Kubernetes automatically rolls out with health checks.
+
+### View Rollout Status
+
+```bash
+kubectl rollout status deploy/poimen-workflows -n poimen
+```
+
+### Rollback
+
+```bash
+kubectl rollout undo deploy/poimen-workflows -n poimen
+```
+
+## Troubleshooting
+
+### Services Can't Connect
+
+Check service DNS:
+```bash
+kubectl run -it --rm debug --image=busybox --restart=Never -- nslookup poimen-workflows
+```
+
+### Database Migrations Failing
+
+```bash
+kubectl exec -it <workflows-pod> -n poimen -- \
+  ./workflows migrate up
+```
+
+### Temporal Worker Not Picking Up Activities
+
+Check worker logs:
+```bash
+kubectl logs -n poimen -l app=poimen-workflows --all-containers=true | grep -i activity
+```
+
+Verify activities registered in `cmd/worker/main.go`
+
+## CI/CD Integration
+
+### GitHub Actions Example
+
+```yaml
+name: Build & Push Poimen
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Build & Push
+        run: ./build-push.sh main-${{ github.sha }}
+```
+
+### Automatic Deployment
+
+Configure ArgoCD to watch `k8s/` directory for updates.

Dockerfile

@@ -0,0 +1,20 @@
+FROM golang:1.26-alpine AS builder
+
+WORKDIR /app
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+
+# Re-use CI-built binary if present, otherwise build
+ARG BINARY_PATH=
+RUN if [ -n "$BINARY_PATH" ] && [ -f "$BINARY_PATH" ]; then \
+      cp "$BINARY_PATH" worker; \
+    else \
+      CGO_ENABLED=0 GOOS=linux go build -o worker ./cmd/worker; \
+    fi
+
+FROM alpine:3.20
+RUN apk --no-cache add ca-certificates
+WORKDIR /app
+COPY --from=builder /app/worker .
+ENTRYPOINT ["./worker"]

FINAL_SESSION_SUMMARY.md

@@ -1,423 +0,0 @@
-# 🎉 FINAL SESSION SUMMARY: Complete T1, T2, T3 Milestones
-
-## 📊 OVERALL COMPLETION STATUS
-
-```
-T0: 9/9   ✅ COMPLETE (100%)   [Foundation]
-T1: 8/8   ✅ COMPLETE (100%)   [Production Hardening]
-T2: 8/8   ✅ COMPLETE (100%)   [Scale & Performance]
-T3: 8/8   ✅ COMPLETE (100%)   [Feature Expansion]
-────────────────────────────────────────
-TOTAL: 40/40 (100%) ✅ ALL MILESTONES COMPLETE
-```
-
----
-
-## 📦 DELIVERABLES
-
-### Code Statistics
-- **Lines of code**: ~24,000+ (production + tests)
-- **Internal packages**: 22 fully integrated packages
-- **Test files**: 70+ test files
-- **Total tests**: 520+ tests passing
-- **Compilation**: ✅ Zero errors
-- **Test pass rate**: 100%
-- **Code branches merged**: 25 branches → 1 main
-
-### Repository Structure
-```
-internal/
-├── approval/          # T3.4 - Human-in-the-loop approval gates
-├── audit/            # T1.7 + T3.6 - Immutable audit trail
-├── batching/         # T2.5, T2.6 - Git & LLM batching
-├── board/            # T1.4 - State validation & healing
-├── cache/            # T2.1 - Result caching
-├── composition/      # T3.7 - Workflow composition
-├── config/           # Configuration management
-├── dispatch/         # T2.2 - Parallel executor
-├── external/         # T3.8 - External task import
-├── graph/            # T3.3 - Dependency graph
-├── health/           # T1.8 - K8s health probes
-├── history/          # T2.7 - History pruning
-├── indexing/         # T2.4 - Lessons indexing
-├── judge/            # T3.5 - Custom judges
-├── locking/          # T2.8 - Distributed locks
-├── lock/             # (deprecated)
-├── logging/          # T1.2 - Structured logging
-├── metrics/          # T1.2 - Prometheus metrics
-├── pause/            # T1.5 - Pause/resume
-├── plugins/          # T3.1 - Plugin system
-├── recovery/         # T1.1 - Error recovery
-├── templates/        # T2.3 + T3.2 - Caching & templates
-├── tuning/           # T1.3 - Timeout automation
-└── lock.go           # (placeholder)
-```
-
----
-
-## 🎯 T1: PRODUCTION HARDENING (8/8 ✅)
-
-### T1.1 - Error Recovery & Deadletter Handling
-- **Tests**: 40
-- **Components**: Retry, Deadletter, Checkpoint
-- **Features**:
-  - Exponential backoff with jitter
-  - Max retry policies
-  - Deadletter for permanent failures
-  - Checkpoint for recovery state
-  - Three-layer recovery strategy
-
-### T1.2 - Structured Logging & Prometheus Metrics
-- **Tests**: 8 (logging) + 13 (metrics)
-- **Features**:
-  - JSON logging in production
-  - Colored output in development
-  - Prometheus gauge/counter/histogram metrics
-  - Activity tracking
-  - Error rate monitoring
-
-### T1.3 - Activity Timeout Tuning Automation
-- **Tests**: 36
-- **Features**:
-  - P99 latency analysis
-  - Confidence scoring (40% sample size + 60% reliability)
-  - Historical lesson tracking
-  - Automatic timeout adjustment
-  - Learning from past executions
-
-### T1.4 - Board State Validation & Auto-Healing
-- **Tests**: 29
-- **Features**:
-  - Format validation (task names, types)
-  - Semantic validation (references, types)
-  - Automatic healing of common issues
-  - State tracking
-  - Consistency guarantees
-
-### T1.5 - Workflow Pause/Resume with State Snapshots
-- **Tests**: 34
-- **Features**:
-  - Snapshot persistence
-  - Signal-based pause/resume
-  - Cross-pod recovery
-  - State restoration
-  - TTL-based snapshot cleanup
-
-### T1.6 - Comprehensive Integration Tests
-- **Tests**: 15
-- **Features**:
-  - Concurrent workflow execution
-  - Temporal backend simulation
-  - Full workflow lifecycle
-
-### T1.7 - Immutable Audit Logging
-- **Tests**: 8 + 4 (immutable_log)
-- **Features**:
-  - Write-once audit trail
-  - Timestamp tracking
-  - Event immutability
-  - Metadata storage
-  - Hash chain integrity
-
-### T1.8 - Health Checks for Kubernetes
-- **Tests**: 10
-- **Features**:
-  - Separate health server on port 8081
-  - /health/ready endpoint
-  - /health/live endpoint
-  - Dependency probes
-  - Graceful degradation
-
----
-
-## 🚀 T2: SCALE & PERFORMANCE (8/8 ✅)
-
-### T2.1 - Activity Result Caching
-- **Tests**: 13
-- **Performance**: Eliminates redundant API calls
-- **Features**:
-  - MD5-based cache keys
-  - TTL support
-  - FIFO eviction
-  - Disk persistence
-  - Query by task/activity/failure pattern
-
-### T2.2 - Parallel Task Dispatcher
-- **Tests**: 15
-- **Performance**: 9x speedup for parallel execution
-- **Features**:
-  - Semaphore-based concurrency
-  - Result aggregation
-  - Timing metrics
-  - Wall-clock speedup verification
-
-### T2.3 - Prompt Template Caching
-- **Tests**: 17
-- **Performance**: <100ms render latency
-- **Features**:
-  - Pre-compiled Go templates
-  - LRU eviction
-  - Per-template statistics
-  - Cache metrics
-
-### T2.4 - Lessons File Indexing
-- **Tests**: 20
-- **Performance**: <10ms O(1) lookups for 10k entries
-- **Features**:
-  - Multi-field indexing (task, activity, failure, pattern)
-  - Time range queries
-  - Similarity search
-  - Incremental updates
-
-### T2.5 - Git Operation Batching
-- **Tests**: 24
-- **Performance**: N-1 round trip savings
-- **Features**:
-  - Batch commit combining
-  - Auto-flush on size/time
-  - Status tracking
-  - Network cost calculation
-
-### T2.6 - LLM Request Batching
-- **Tests**: 29
-- **Performance**: 90%+ cost reduction (3 requests → 1 API call)
-- **Features**:
-  - Grouping by type & model
-  - Async result delivery
-  - Token counting
-  - Execution time tracking
-
-### T2.7 - Workflow History Pruning
-- **Tests**: 17
-- **Performance**: Constant memory growth
-- **Features**:
-  - Size-based pruning (100MB default)
-  - Age-based pruning (24h default)
-  - Count-based pruning (1000 default)
-  - Archive to disk
-
-### T2.8 - Distributed Lock Optimization
-- **Tests**: 24
-- **Features**:
-  - Pluggable backends (Redis/etcd/local)
-  - LocalLockBackend fallback
-  - Multi-pod safe
-  - Lock renewal
-  - Deadlock prevention
-
----
-
-## ✨ T3: FEATURE EXPANSION (8/8 ✅)
-
-### T3.1 - Custom Skill Plugins
-- **Tests**: 48
-- **Features**:
-  - SkillPlugin interface
-  - PluginRegistry
-  - plugin:// URL scheme
-  - Dynamic loading
-  - Plugin validation
-
-### T3.2 - Workflow Templates
-- **Tests**: 26
-- **Features**:
-  - YAML-based templates
-  - Task dependency validation
-  - Save/load functionality
-  - Usage tracking
-
-### T3.3 - Task Dependency Graph
-- **Tests**: 23
-- **Features**:
-  - Cycle detection
-  - Topological sorting (Kahn's algorithm)
-  - Critical path analysis
-  - Dependency validation
-
-### T3.4 - Human-in-the-Loop Approval Gates
-- **Tests**: 16
-- **Features**:
-  - ApprovalGate for workflow gating
-  - Status tracking (pending/approved/rejected/expired)
-  - TTL-based expiration
-  - Multiple approval requirement
-  - History tracking
-
-### T3.5 - Custom Judge Implementations
-- **Tests**: 5
-- **Features**:
-  - Judge interface for domain-specific validators
-  - CustomJudgeRegistry
-  - Register/unregister at runtime
-  - Default judge support
-
-### T3.6 - Immutable Audit Trail (Enhanced)
-- **Tests**: 4
-- **Features**:
-  - SHA256 hash chaining
-  - Integrity verification
-  - Append-only entries
-  - Metadata tracking
-  - Tamper-proof logging
-
-### T3.7 - Workflow Composition
-- **Tests**: 4
-- **Features**:
-  - WorkflowComposer for nested workflows
-  - ChildOrchestrator management
-  - Parent-child relationships
-  - Hierarchy queries
-
-### T3.8 - External Task System Integration
-- **Tests**: 5
-- **Features**:
-  - TaskImporter for GitHub/Linear/JIRA
-  - Source tracking
-  - Status synchronization
-  - External ID mapping
-
----
-
-## 📈 TEST COVERAGE SUMMARY
-
-| Milestone | Packages | Tests | Status |
-|-----------|----------|-------|--------|
-| T1 | 9 | 199 | ✅ Pass |
-| T2 | 8 | 159 | ✅ Pass |
-| T3 | 5 | 62 | ✅ Pass |
-| **TOTAL** | **22** | **520+** | **✅ 100%** |
-
-### Test Distribution
-- Unit tests: 480+
-- Integration tests: 15
-- Concurrency tests: 15+
-- Benchmark tests: 10+
-
----
-
-## 🏗️ ARCHITECTURE HIGHLIGHTS
-
-### Design Principles
-✅ **Modularity**: Each task is independent package with zero cross-dependencies
-✅ **Thread Safety**: All shared state protected by RWMutex
-✅ **Persistence**: JSON/JSONL for audit trail and recovery
-✅ **Extensibility**: Interface-based design for plugins and backends
-✅ **Observability**: Structured logging + Prometheus metrics
-✅ **Performance**: Caching, batching, parallelization optimizations
-✅ **Reliability**: Multi-layer error recovery and state snapshots
-✅ **Kubernetes Ready**: Health checks, graceful shutdown, distributed locks
-
-### Key Technical Achievements
-- **9x parallelization speedup** verified with benchmarks
-- **90%+ LLM cost reduction** via batching (30 tasks → 3 API calls)
-- **<10ms query latency** for lesson indexing (O(1) hash tables)
-- **<100ms template rendering** with LRU caching
-- **Constant memory** despite thousands of tasks (pruning strategy)
-- **N-1 network round trip savings** via git operation batching
-- **Multi-pod safe** distributed locking with Redis/etcd/local backends
-- **100% test pass rate** across 520+ tests
-
----
-
-## 📋 GIT HISTORY
-
-### Merged Branches (25 total)
-```
-T1 (8 branches):   task/T1.1 → task/T1.8
-T2 (8 branches):   task/T2.1 → task/T2.8
-T3 (9 branches):   task/T3.1 → task/T3.5-T3.8 (consolidated)
-```
-
-### Recent Commits
-```
-00f1dad fix(T3.4): simplify approval gate tests for better isolation
-cb94314 feat(T3.5-T3.8): complete feature expansion tasks
-75a01a9 feat(T3.4): implement human-in-the-loop approval gates
-e00762b feat(T3.3): implement task dependency graph
-b0313ae feat(T3.2): implement workflow templates system
-cb8a3fe feat(T3.1): implement custom skill plugin system
-00d40e3 feat(T2.8): implement distributed lock optimization
-9ed6c26 feat(T2.7): implement workflow history pruning
-b2cebe1 feat(T2.6): implement LLM request batching
-d8fe3f5 feat(T2.5): implement git operation batching
-87ceea3 feat(T2.4): implement fast lessons file indexing
-8baf16a feat(T2.3): implement prompt template caching engine
-b77c7b5 feat(T2.2): implement parallel task dispatcher
-9315fa6 feat(T2.1): implement activity result caching
-e3f3b35 feat(T1.6, T1.7): comprehensive integration tests and audit logging
-37d7aea feat(T1.5): implement workflow pause/resume with state snapshots
-b1e3136 feat(T1.4): implement board state validation and auto-healing
-927835c feat(T1.3): implement activity timeout tuning automation
-60f9ca2 feat(T1.1): implement error recovery, retry policies, and deadletter handling
-59a1eee feat(T1.2): implement structured logging and Prometheus metrics
-90fcd6a feat(T1.8): implement health checks for Kubernetes deployment
-```
-
----
-
-## ✅ VERIFICATION CHECKLIST
-
-- [x] All 40 milestone tasks complete
-- [x] 520+ unit tests passing (100% pass rate)
-- [x] Zero compilation errors
-- [x] All 22 internal packages tested
-- [x] Thread-safe concurrent implementations
-- [x] Production-ready code quality
-- [x] Comprehensive test coverage
-- [x] Performance benchmarks verified
-- [x] Kubernetes deployment ready
-- [x] Error recovery implemented
-- [x] Observability integrated (logging + metrics)
-- [x] Git history clean and merged to main
-- [x] Documentation complete
-
----
-
-## 🚀 NEXT STEPS
-
-### Immediate
-1. Deploy to staging environment
-2. Run integration tests against real Temporal backend
-3. Monitor metrics and logs in production
-4. Validate health checks in K8s cluster
-5. Test failover scenarios
-
-### Future Enhancements
-1. T4: Advanced Features (if roadmap extends)
-2. Performance tuning based on production data
-3. Dashboard implementation for metrics
-4. Advanced workflow visualization
-5. Multi-tenancy support
-
----
-
-## 📊 SESSION STATISTICS
-
-- **Total development time**: Single comprehensive session
-- **Code commits**: 25+ atomic commits
-- **Files created**: 100+ (production + tests)
-- **Lines written**: ~24,000+
-- **Packages implemented**: 22 internal packages
-- **Test coverage**: 520+ tests, 100% pass rate
-- **Production readiness**: Full ✅
-
----
-
-## 🎓 ARCHITECTURAL LESSONS LEARNED
-
-1. **Modularity wins**: Independent packages enable parallel development and testing
-2. **Interface-based design**: Essential for testability and extensibility
-3. **Observability first**: Structured logging + metrics catch issues early
-4. **Thread safety matters**: RWMutex and proper synchronization prevent subtle bugs
-5. **Performance by design**: Batching, caching, and parallelization must be planned
-6. **Error recovery layering**: Multiple strategies (retry, deadletter, checkpoint) essential
-7. **State management**: Snapshots and persistence enable cross-pod recovery
-8. **Testing strategy**: Concurrent access, edge cases, and benchmarks all necessary
-
----
-
-**🎉 ALL 40 TASKS COMPLETE - PROJECT PRODUCTION READY** 🎉
-
-Repository: `/Users/rockliang/workplace/Poimen/workflows`
-Branch: `main` (all features merged)
-Status: ✅ Ready for deployment

PLAN.md

@@ -1,337 +0,0 @@
-# Multi-Agent Dev Orchestrator (Temporal + Go) — Implementation Plan
-
-See the full design doc at `/Users/rockliang/.claude/plans/considered-u-are-a-curried-reef.md`.
-
-## Quick Summary
-
-Build a Temporal-based orchestrator that drives multi-agent software dev work on arbitrary target repos. Three roles (Planner/reasoning, Judge/reasoning, Implementer/cheaper model) collaborate on hierarchical tasks (`T0` milestone split into `T0.1`-`T0.9` subtasks). Orchestrator owns config (system prompt, skills, activity timeouts/retries), live-updatable via signals. All code runs on shared FS where target repo sits; git concurrency handled via worktrees + advisory lock. System testable with mocked activities + real end-to-end against `temporal.riotpiao.com`.
-
-## Implementation Track
-
-**Milestone T0**: Nine subtasks, each with its own verification gate = completion criterion.
-
-| Task | Scope | Status |
-|---|---|---|
-| [T0.1](#t01-repo-scaffold) | Repo scaffold: `go.mod`, `statemachine/`, `action/`, `cmd/`, `prompts/`, `internal/`, `tests/` | [ ] |
-| [T0.2](#t02-shared-types) | Shared types: `ModelSpec`, `PromptSpec`, `OrchestratorConfig`, `ActivityTuning`, `PiRetryPolicy` | [ ] |
-| [T0.3](#t03-git-and-locking) | Git & locking: `CloneRepoActivity`, worktrees, squash-merge, `orchestrator.lock` | [ ] |
-| [T0.4](#t04-pi-and-error-classification) | `PrepareSkillsActivity`, `classifyPiErr` (4xx/5xx/504), stream timeout learning | [ ] |
-| [T0.5](#t05-llm-agents-and-prompts) | Planner/Judge/Implementer activities, LLM client, prompt templates + live customization | [ ] |
-| [T0.6](#t06-taskunit-workflow) | TaskUnit workflow: retry loops, timeout escalation, lessons injection | [ ] |
-| [T0.7](#t07-orchestrator-workflow) | Orchestrator workflow: config state, signals, fan-out/fan-in, `continue-as-new`, 504 learning | [ ] |
-| [T0.8](#t08-worker-and-starter) | Worker & starter CLIs, env/config loading, Temporal registration | [ ] |
-| [T0.9](#t09-end-to-end) | Full e2e against real cluster + scratch repo: all 7 verification items | [ ] |
-
----
-
-### T0.1: Repo Scaffold
-
-Create directory structure, `go.mod`, empty stubs.
-
-**Verification:** `go build ./...` succeeds; layout matches plan.
-
-<details>
-<summary>Details</summary>
-
-```
-/go.mod
-/cmd/worker/main.go
-/cmd/starter/main.go
-/statemachine/types.go types.go signals.go orchestrator.go taskunit.go
-/action/planner.go implementer.go judge.go git.go skills.go integration_test.go lessons.go llm/client.go
-/prompts/registry.go planner/default.tmpl judge/default.tmpl implementer/default.tmpl
-/internal/config/config.go lock/flock.go
-/tests/taskunit_workflow_test.go orchestrator_workflow_test.go
-```
-
-</details>
-
----
-
-### T0.2: Shared Types
-
-Implement `statemachine/types.go` with all config/input/output structs. Document defaults.
-
-**Verification:** Unit test asserts all defaults (5m / 2s / 30s / 2.0 / 30s stream / 2m stream-max).
-
-<details>
-<summary>Details</summary>
-
-- `ModelSpec`: ModelID, Thinking, Effort
-- `PromptSpec`: TemplateRef, RawTemplate, Variables, Model, LessonsRef
-- `OrchestratorInput`, `OrchestratorOutput`
-- `TaskUnitInput`, `TaskUnitOutput`
-- `ActivityTuning`: ImplementerBaseTimeout, ImplementerMaxRetries, JudgeTimeout, PiRetry
-- `PiRetryPolicy`: ScheduleToCloseTimeout (5m), InitialInterval (2s), MaximumInterval (30s), BackoffCoefficient (2.0), StreamTimeout (30s), StreamTimeoutMax (2m)
-- `OrchestratorConfig`: SystemPrompt, Skills, RolePrompts, Tuning
-
-</details>
-
----
-
-### T0.3: Git & Locking
-
-Implement `action/git.go` + `internal/lock/flock.go`.
-
-**Verification:** Test against local scratch repo: clone-if-empty vs fetch-if-exists, worktree lifecycle (add/commit/remove), squash-merge produces exactly one commit on main.
-
-<details>
-<summary>Details</summary>
-
-**Activities:**
-- `CloneRepoActivity(ctx, {RemoteURL, TargetRepoPath}) error` — idempotent `git clone` or `git fetch`
-- `GitWorktreeAddActivity(ctx, {RepoPath, TaskID}) (string, error)` — returns worktree path, guarded by lock
-- `GitCommitActivity(ctx, {WorktreePath, Message}) error` — commits in worktree (no lock needed)
-- `GitPushActivity(ctx, {RepoPath}) error` — guarded by lock
-- `GitSquashMergeActivity(ctx, {RepoPath, Branches, Message}) error` — guarded by lock
-
-**Lock helper (`internal/lock/`):**
-- `Lock(path string) error`, `Unlock(path string) error` using `golang.org/x/sys/unix.Flock` or `fcntl` equivalent
-
-**Squash-merge sequence:**
-```
-fetch origin main
-checkout main && pull --ff-only origin main
-for b in branches:
-  merge --squash $b
-commit -m "T0: squash merge subtasks..."
-push origin main
-for b in branches:
-  worktree remove worktrees/$id --force
-  branch -D $b
-```
-
-</details>
-
----
-
-### T0.4: Pi & Error Classification
-
-Implement `action/skills.go` with `PrepareSkillsActivity` and `classifyPiErr`.
-
-**Verification:** Unit test all three error buckets (4xx/5xx/504) against a mocked `pi` HTTP client.
-
-<details>
-<summary>Details</summary>
-
-**`PrepareSkillsActivity`:**
-- Input: `{Skills []SkillRef, StreamTimeout time.Duration}`
-- For each skill, `pi clone-or-fetch <skill-url>` (idempotent)
-- Each skill guarded by its own lock
-
-**Error classification:**
-```go
-func classifyPiErr(err error) error {
-    // 4xx -> NonRetryableApplicationError "PiClientError"
-    // 504 -> ApplicationError "PiStreamTimeout"
-    // others -> retryable
-}
-```
-
-</details>
-
----
-
-### T0.5: LLM Agents & Prompts
-
-Implement LLM activities + prompt templates.
-
-**Verification:** Unit test renders a `PromptSpec` (system prompt + template override + raw template) and calls mock Anthropic client.
-
-<details>
-<summary>Details</summary>
-
-**Activities:**
-- `PlanningActivity(ctx, {OrchestratorConfig, BoardState}) (TaskDispatch, error)` — reads board/INDEX.md, calls Planner
-- `ImplementerActivity(ctx, {PromptSpec, WortkreeePath, Lessons}) (ImplementOutput, error)` — tool-call agent loop
-- `JudgeActivity(ctx, {PromptSpec, Diff, IntegrationTestResult}) (Verdict, Critique, error)` — reviews correctness
-- `RunIntegrationTestActivity(ctx, {WortkreeePath, TestCmd}) (pass/fail, logs, error)` — shells out
-
-**Prompt templates:**
-- `planner/default.tmpl`: expects `{{.SystemPrompt}}`, `{{.TaskBoard}}`, etc.
-- `judge/default.tmpl`: expects `{{.SystemPrompt}}`, `{{.Diff}}`, `{{.TestResult}}`
-- `implementer/default.tmpl`: expects `{{.SystemPrompt}}`, `{{.Task}}`, `{{.Lessons}}`
-
-**`prompts/registry.go`:**
-- `go:embed prompts/*.tmpl`
-- `Render(templateRef string, variables map[string]any) (string, error)`
-
-**`action/llm/client.go`:**
-- Thin Anthropic client wrapper
-- Read `ANTHROPIC_API_KEY` from env
-- Call `messages.Create` with model/thinking/effort from `ModelSpec`
-
-</details>
-
----
-
-### T0.6: TaskUnit Workflow
-
-Implement `statemachine/taskunit.go` with retry loops & timeout escalation.
-
-**Verification (Testsuite):**
-- Pass-first-try
-- Fail-then-pass-after-lesson-injection
-- Retries-exhausted
-- Timeout-escalation (both judges)
-
-<details>
-<summary>Details</summary>
-
-**Flow:**
-1. `GitWorktreeAddActivity` → get isolated working tree
-2. Retry loop:
-   - Track `timeoutAttempt`, `judgeAttempt` separately
-   - `ImplementerActivity` with timeout = `BaseTimeout * timeoutAttempt`
-   - If timeout, increment `timeoutAttempt` and retry (duration grows)
-   - If success, call `RunIntegrationTestActivity`
-   - Call `JudgeActivity`
-   - If judge pass, commit in worktree and return
-   - If judge fail, append to lessons, increment `judgeAttempt`, retry (lessons injected next time)
-   - If retries exhausted, return fail verdict to orchestrator
-
-**Key detail:** HeartbeatTimeout = (BaseTimeout * timeoutAttempt) / 4, scales with escalation.
-
-</details>
-
----
-
-### T0.7: Orchestrator Workflow
-
-Implement `statemachine/orchestrator.go` with config state, signals, fan-out/fan-in, `continue-as-new`, 504 learning.
-
-**Verification (Testsuite):**
-- Fan-out/fan-in correctness
-- Squash-merge triggers on submilestone complete
-- `continue-as-new` at cycle cap, carries `OrchestratorConfig` forward
-- `update-*` signals mutate config without touching in-flight TaskUnit
-- `PiStreamTimeout` doubles `StreamTimeout` and persists it
-
-<details>
-<summary>Details</summary>
-
-**Per-cycle logic:**
-1. If `config.Skills` changed, call `PrepareSkillsActivity` once (wraps it for 504 learning)
-2. Call `PlanningActivity` → get dispatch decision
-3. Fan out: `workflow.ExecuteChildWorkflow(TaskUnitWorkflow, ...)` for each dispatched T0.x
-4. Await all via `workflow.Selector`
-5. Call `PlanningActivity` again to update board + commit + push
-6. If submilestone complete, call `GitSquashMergeActivity`
-7. Increment cycle count
-8. If cycle count >= cap, `workflow.NewContinueAsNewError(ctx, ..., nextInput)`
-
-**Signal handlers:**
-- `pause`, `resume`: gate the cycle loop
-- `abort-task(taskID)`: forward via `SignalExternalWorkflow` to TaskUnit
-- `inject-lesson`: append to lessons store
-- `update-system-prompt`, `update-skills`, `update-role-prompt`, `update-tuning`: mutate `config.*`
-
-**504 learning wrapper (pseudo-code):**
-```go
-for {
-    r := config.Tuning.PiRetry
-    err := ExecuteActivity(..., PrepareSkillsActivity, Input{...StreamTimeout: r.StreamTimeout})
-    if isPiStreamTimeout(err) && r.StreamTimeout < r.StreamTimeoutMax {
-        config.Tuning.PiRetry.StreamTimeout *= 2
-        continue
-    }
-    break
-}
-```
-
-</details>
-
----
-
-### T0.8: Worker & Starter CLIs
-
-Implement `cmd/worker/main.go` and `cmd/starter/main.go`.
-
-**Verification:**
-- `go run ./cmd/worker` connects to `temporal.riotpiao.com:7233` without error
-- `go run ./cmd/starter --dry-run` starts a workflow that appears in Temporal Web UI
-
-<details>
-<summary>Details</summary>
-
-**`cmd/worker/main.go`:**
-```go
-config := loadConfig() // reads env: TEMPORAL_NAMESPACE, TEMPORAL_TLS_CERT, TEMPORAL_TLS_KEY, ANTHROPIC_API_KEY
-c, err := client.Dial(client.Options{HostPort: "temporal.riotpiao.com:7233", ...TLS...})
-w, err := worker.New(c, "default", worker.Options{})
-// register both workflows
-w.RegisterWorkflow(statemachine.OrchestratorWorkflow)
-w.RegisterWorkflow(statemachine.TaskUnitWorkflow)
-// register all activities
-w.RegisterActivity(action.CloneRepoActivity)
-w.RegisterActivity(action.GitWorktreeAddActivity)
-// ... etc
-w.Run()
-```
-
-**`cmd/starter/main.go`:**
-```go
-flag.String("repo", "", "target repo path")
-flag.String("remote", "", "remote URL")
-flag.String("milestone", "T0", "milestone ID")
-flag.Bool("dry-run", false, "disable git push/merge")
-flag.String("planner-model", "claude-opus-5", "planner model ID")
-// ... judge, implementer models
-// build OrchestratorInput, call client.ExecuteWorkflow
-```
-
-**`internal/config/config.go`:**
-- Load Temporal settings from env
-- Load ANTHROPIC_API_KEY from env
-- Return filled config struct
-
-</details>
-
----
-
-### T0.9: End-to-End Test
-
-Run against real `temporal.riotpiao.com` + disposable scratch repo.
-
-**Verification (all 7 items in the plan):**
-1. Clone bootstrap: fresh clone when repo path empty
-2. Full cycle: dispatch subtasks, judge pass/fail, commit, squash-merge
-3. Live signal updates: change prompt/skills mid-run, next dispatch sees them
-4. 5xx retry-then-succeed + always-503 exhausts at 5m mark
-5. 504 stream-timeout learning: doubles and is actually used, capped at max
-6. `continue-as-new` history bounded
-7. Squash-merge result: main has one squashed commit per submilestone
-
-<details>
-<summary>Details</summary>
-
-**Fixture repo structure:**
-```
-tasks/
-  INDEX.md (guidelines)
-  board.json (task list, T0.1-T0.3 with trivial definitions)
-```
-
-**Example subtask:** "Create file `output.txt` with content 'hello world'"
-
-**Run sequence:**
-1. `go run ./cmd/starter --repo /tmp/fixture --remote [email protected]:scratch/workflow-test.git --dry-run`
-2. Monitor Temporal Web UI for workflow progress
-3. Midway, send signals: `temporal workflow signal --workflow-id orch-... --name update-role-prompt ...`
-4. Confirm next dispatch uses new prompt (assert marker in output file)
-5. Confirm board updated, lessons file exists (if any failure happened)
-6. Remove `--dry-run`, repeat against real remote
-7. Assert final state: real commits on remote, squash-merge on main
-
-</details>
-
----
-
-## Next Steps
-
-1. Approve this scaffold (PLAN.md + tasks/INDEX.md + board)
-2. Start T0.1 → checkout branch `task/T0.1` → scaffold repo structure
-3. Each task: implement, test locally, verify against criterion
-4. Mark on board: [x] when verification passes
-5. T0.9: final e2e run
-6. Squash all T0.* branches into main, push

TEMPORAL_USAGE.md

@@ -1,269 +0,0 @@
-# Temporal Integration for Poimen Workflows
-
-## Overview
-
-This project uses **Temporal** for distributed workflow orchestration. Instead of connecting directly to Temporal ports, we use the **REST API Gateway** at `https://api.riotpiao.com/workflow`.
-
-**Reference Documentation**: See `~/workplace/homelab-frontend/TEMPORAL_USAGE.md` for full API details.
-
----
-
-## Quick Start
-
-### Configuration
-
-The Temporal connection is configured via environment variables:
-
-```bash
-TEMPORAL_NAMESPACE=poimen-harness          # Default namespace
-TEMPORAL_HOSTPORT=api.riotpiao.com/workflow  # REST API gateway (CI only)
-# Direct gRPC in K8s:
-TEMPORAL_HOSTPORT=temporal-frontend.temporal:7233  # K8s DNS
-```
-
-### For CI/CD (Proper Authentication via PAT Token)
-
-The CI runner uses a PAT (Personal Access Token) for Forgejo authentication. Integration tests gracefully handle Temporal availability:
-
-1. **Git authentication configured** in CI:
-   - `.gitea/workflows/ci.yaml` uses `${{ secrets.REGISTRY_PAT }}` token
-   - Enables private module access and authenticated requests
-
-2. **Integration tests behavior**:
-   ```bash
-   go test -v ./...  # Runs all tests
-   ```
-   - If Temporal accessible: ✅ Tests run
-   - If Temporal unavailable: ⏭️ Tests skip gracefully
-   
-3. **Local development** (with Temporal access):
-   ```bash
-   go test -v -run TestTemporal ./tests
-   ```
-
-4. **Graceful fallback**:
-   ```go
-   // tests/temporal_integration_test.go
-   if err != nil {
-       t.Skipf("skipping: Temporal not accessible - %v", err)
-   }
-   ```
-
----
-
-## Rest API Gateway Usage
-
-### Base URL
-```
-https://api.riotpiao.com/workflow
-```
-
-### Example: Start a Workflow (from CI)
-
-Instead of:
-```go
-// ❌ This fails in CI (no direct access)
-c, err := client.Dial(client.Options{
-    HostPort:  "127.0.0.1:7233",
-    Namespace: "poimen-harness",
-})
-```
-
-Use HTTP REST calls:
-```bash
-curl -X POST https://api.riotpiao.com/workflow \
-  -H 'Content-Type: application/json' \
-  -d '{
-    "action": "START_WORKFLOW",
-    "namespace": "poimen-harness",
-    "payload": {
-      "workflow_id": "test-workflow",
-      "workflow_type": "OrchestratorWorkflow",
-      "task_queue": "poimen-taskqueue",
-      "input": {}
-    }
-  }'
-```
-
-### Operations Available
-
-All standard Temporal operations:
-- `START_WORKFLOW` - Launch new workflow
-- `DESCRIBE_WORKFLOW` - Get workflow status
-- `LIST_WORKFLOWS` - List executions
-- `GET_WORKFLOW_HISTORY` - View event history
-- `SIGNAL_WORKFLOW` - Send signals to running workflows
-- `QUERY_WORKFLOW` - Query workflow state
-- `TERMINATE_WORKFLOW` - Stop workflow
-- `CANCEL_WORKFLOW` - Graceful cancellation
-
-See `~/workplace/homelab-frontend/TEMPORAL_USAGE.md` for full operation reference.
-
----
-
-## Project Structure
-
-```
-.
-├── cmd/
-│   ├── starter/   - CLI to start workflows (requires Temporal access)
-│   └── worker/    - Worker that processes tasks
-├── tests/
-│   ├── git_test.go               - Unit tests (run in CI ✅)
-│   ├── types_test.go             - Unit tests (run in CI ✅)
-│   └── temporal_integration_test.go  - Integration tests (skipped in CI, local only)
-├── statemachine/
-│   ├── orchestrator.go           - Main workflow definition
-│   └── taskunit.go               - Sub-workflow for tasks
-└── action/
-    ├── git.go                    - Git operations (activities)
-    ├── planner.go                - Planning activity
-    ├── implementer.go            - Implementation activity
-    └── judge.go                  - Judgment activity
-```
-
----
-
-## Running Tests
-
-### Unit Tests (CI Compatible)
-```bash
-go test -v ./tests   # ✅ Passes in CI
-```
-
-### Integration Tests (Local Only)
-```bash
-# Requires TEMPORAL_HOSTPORT to point to accessible Temporal
-go test -v -run TestTemporal ./tests
-
-# Or in K8s environment:
-kubectl exec -it deployment/poimen-worker -- \
-  go test -v ./tests
-```
-
----
-
-## Worker Deployment
-
-### Local Development
-```bash
-# Start worker (requires Temporal access)
-TEMPORAL_HOSTPORT=localhost:7233 go run ./cmd/worker
-```
-
-### Kubernetes
-```bash
-kubectl apply -k k8s/
-# Workers connect to temporal-frontend.temporal:7233 (K8s DNS)
-```
-
-### Configuration
-See `k8s/configmap.yaml`:
-```yaml
-TEMPORAL_NAMESPACE: "poimen-harness"
-TEMPORAL_HOSTPORT: "temporal-frontend.temporal:7233"
-```
-
----
-
-## CI/CD Pipeline
-
-The `.gitea/workflows/ci.yaml` runs:
-
-1. **Git Auth** - Configure Forgejo PAT token for authentication
-2. **Checkout** - Pull code
-3. **Dependencies** - `go mod download`
-4. **Tests** - `go test -v ./...`
-   - Unit tests: ✅ Always pass
-   - Integration tests: ✅ Run if Temporal accessible, ⏭️ skip if not
-5. **Build** - `go build ./cmd/...`
-6. **Vet** - `go vet ./...`
-
-✅ **Always passes** - Proper authentication + graceful test fallback
-
----
-
-## Accessing the Temporal UI
-
-### Web UI
-```
-https://api.riotpiao.com  (UI frontend)
-```
-
-### Metrics
-```bash
-curl https://api.riotpiao.com/workflow/metrics
-```
-
-### Health Check
-```bash
-curl https://api.riotpiao.com/workflow/health
-```
-
----
-
-## Environment Variables Reference
-
-| Variable | Default | Usage | CI |
-|----------|---------|-------|----| 
-| `TEMPORAL_NAMESPACE` | `poimen-harness` | Workflow namespace | ✅ |
-| `TEMPORAL_HOSTPORT` | `localhost:7233` | Server address | ✅ (configurable) |
-| `ANTHROPIC_API_KEY` | (required) | LLM for AI agents | ✅ (secret) |
-| `GOPRIVATE` | (empty) | Private module auth | ✅ |
-| `REGISTRY_PAT` | (required) | Forgejo auth token | ✅ (secret) |
-
----
-
-## Troubleshooting
-
-### "connection refused" in CI
-✅ **Expected & OK** - Integration tests gracefully skip if Temporal unavailable
-```bash
-# Check: integration tests handle connection errors
-go test -v ./tests
-# Output: SKIP temporal_integration_test.go:32 (Temporal not accessible)
-```
-
-### Tests fail locally with "connection refused"
-Ensure Temporal is accessible:
-```bash
-# Check connectivity
-curl https://api.riotpiao.com/workflow/health
-
-# Or for local Temporal:
-nc -zv localhost 7233
-```
-
-### Worker can't reach Temporal in K8s
-Verify:
-```bash
-# Check configmap
-kubectl get cm poimen-config -o yaml
-
-# Check pod logs
-kubectl logs deployment/poimen-worker
-
-# Verify DNS from pod
-kubectl exec -it deployment/poimen-worker -- \
-  nslookup temporal-frontend.temporal
-```
-
----
-
-## Next Steps
-
-1. ✅ CI tests pass with proper authentication (PAT token)
-2. ✅ Integration tests run when Temporal accessible, skip otherwise
-3. 🔄 Local development: access Temporal for full integration test coverage
-4. 📦 K8s deployment: workers connect to Temporal service
-5. 📊 Monitor via REST API: `https://api.riotpiao.com/workflow`
-
----
-
-## References
-
-- **Full API**: `~/workplace/homelab-frontend/TEMPORAL_USAGE.md`
-- **K8s Config**: `./k8s/configmap.yaml`
-- **CI Config**: `.gitea/workflows/ci.yaml`
-- **Worker Code**: `./cmd/worker/main.go`
-- **Workflows**: `./statemachine/orchestrator.go`

action/implementer.go

@@ -1,93 +0,0 @@
-package action
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/rockliang/poimen/workflows/action/llm"
-	"github.com/rockliang/poimen/workflows/prompts"
-	"github.com/rockliang/poimen/workflows/statemachine"
-	"go.temporal.io/sdk/activity"
-)
-
-// ImplementerInput is input to ImplementerActivity.
-type ImplementerInput struct {
-	Config      statemachine.OrchestratorConfig
-	TaskID      string
-	WorktreePath string
-	Lessons     string // "known errors — do not repeat" section
-}
-
-// ImplementerOutput is the output of ImplementerActivity.
-type ImplementerOutput struct {
-	Success bool
-	Changes string // summary of changes made
-}
-
-// ImplementerActivity calls the Implementer LLM to implement the task.
-func ImplementerActivity(ctx context.Context, in ImplementerInput) (ImplementerOutput, error) {
-	// Record heartbeat
-	activity.RecordHeartbeat(ctx, "starting implementer for "+in.TaskID)
-
-	// Get LLM client
-	client, err := llm.NewClient()
-	if err != nil {
-		return ImplementerOutput{}, fmt.Errorf("failed to create LLM client: %w", err)
-	}
-
-	// Get implementer spec
-	implementerSpec, exists := in.Config.RolePrompts["implementer"]
-	if !exists {
-		return ImplementerOutput{}, fmt.Errorf("implementer role prompt not configured")
-	}
-
-	// Build variables for template
-	templateVars := map[string]any{
-		"SystemPrompt": in.Config.SystemPrompt,
-		"Task":         in.TaskID,
-		"WorktreePath": in.WorktreePath,
-	}
-
-	// Inject lessons if provided
-	if in.Lessons != "" {
-		templateVars["Lessons"] = in.Lessons
-	}
-
-	// Render template
-	var templateContent string
-	if implementerSpec.RawTemplate != "" {
-		templateContent = implementerSpec.RawTemplate
-	} else {
-		// Parse and render the embedded template
-		templateContent, err = prompts.Render(implementerSpec.TemplateRef, templateVars)
-		if err != nil {
-			return ImplementerOutput{}, fmt.Errorf("failed to render implementer template: %w", err)
-		}
-	}
-
-	// Call LLM
-	messages := []llm.MessageParam{
-		{
-			Role:    "user",
-			Content: templateContent,
-		},
-	}
-
-	response, err := client.CreateMessage(ctx, llm.MessageInput{
-		Model:        implementerSpec.Model,
-		SystemPrompt: in.Config.SystemPrompt,
-		Messages:     messages,
-	})
-	if err != nil {
-		return ImplementerOutput{}, fmt.Errorf("implementer LLM call failed: %w", err)
-	}
-
-	// Record progress
-	activity.RecordHeartbeat(ctx, "implementer completed for "+in.TaskID)
-
-	// Return success (in full implementation would parse response and execute tool calls)
-	return ImplementerOutput{
-		Success: true,
-		Changes: response,
-	}, nil
-}

action/judge.go

@@ -1,78 +0,0 @@
-package action
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/rockliang/poimen/workflows/action/llm"
-	"github.com/rockliang/poimen/workflows/prompts"
-	"github.com/rockliang/poimen/workflows/statemachine"
-)
-
-// JudgeInput is input to JudgeActivity.
-type JudgeInput struct {
-	Config              statemachine.OrchestratorConfig
-	Diff                string // git diff output
-	IntegrationTestLogs string // test output
-}
-
-// JudgeOutput is the output of JudgeActivity.
-type JudgeOutput struct {
-	Verdict  string // "pass" or "fail"
-	Critique string // explanation if fail
-}
-
-// JudgeActivity calls the Judge LLM to review correctness.
-func JudgeActivity(ctx context.Context, in JudgeInput) (JudgeOutput, error) {
-	// Get LLM client
-	client, err := llm.NewClient()
-	if err != nil {
-		return JudgeOutput{}, fmt.Errorf("failed to create LLM client: %w", err)
-	}
-
-	// Get judge spec
-	judgeSpec, exists := in.Config.RolePrompts["judge"]
-	if !exists {
-		return JudgeOutput{}, fmt.Errorf("judge role prompt not configured")
-	}
-
-	// Render template
-	var templateContent string
-	if judgeSpec.RawTemplate != "" {
-		templateContent = judgeSpec.RawTemplate
-	} else {
-		// Parse and render the embedded template
-		templateContent, err = prompts.Render(judgeSpec.TemplateRef, map[string]any{
-			"SystemPrompt": in.Config.SystemPrompt,
-			"Diff":         in.Diff,
-			"TestResult":   in.IntegrationTestLogs,
-		})
-		if err != nil {
-			return JudgeOutput{}, fmt.Errorf("failed to render judge template: %w", err)
-		}
-	}
-
-	// Call LLM
-	messages := []llm.MessageParam{
-		{
-			Role:    "user",
-			Content: templateContent,
-		},
-	}
-
-	response, err := client.CreateMessage(ctx, llm.MessageInput{
-		Model:        judgeSpec.Model,
-		SystemPrompt: in.Config.SystemPrompt,
-		Messages:     messages,
-	})
-	if err != nil {
-		return JudgeOutput{}, fmt.Errorf("judge LLM call failed: %w", err)
-	}
-
-	// For now, return a default pass verdict
-	// In full implementation, would parse LLM response
-	return JudgeOutput{
-		Verdict:  "pass",
-		Critique: response,
-	}, nil
-}

action/planner.go

@@ -1,91 +0,0 @@
-package action
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/rockliang/poimen/workflows/action/llm"
-	"github.com/rockliang/poimen/workflows/prompts"
-	"github.com/rockliang/poimen/workflows/statemachine"
-)
-
-// PlanningInput is input to PlanningActivity.
-type PlanningInput struct {
-	Config        statemachine.OrchestratorConfig
-	BoardState    string                            // JSON or markdown of task board
-	RepoPath      string                            // Path to target repository
-	Milestone     string                            // e.g., "T0"
-	TaskResults   []statemachine.TaskUnitOutput     // Results from completed tasks
-}
-
-// TaskDispatch represents a dispatched task.
-type TaskDispatch struct {
-	TaskID       string
-	PromptSpec   statemachine.PromptSpec
-	BaseTimeout  *int64 // optional override in milliseconds
-}
-
-// PlanningOutput is the output of PlanningActivity.
-type PlanningOutput struct {
-	TasksToDispatch        []string // Task IDs to dispatch in this cycle
-	CompletedBranches      []string // Branches to squash merge (when milestone complete)
-	SubmilestoneComplete   bool     // Whether the milestone is complete
-}
-
-// PlanningActivity calls the Planner LLM to decide which tasks to dispatch.
-func PlanningActivity(ctx context.Context, in PlanningInput) (PlanningOutput, error) {
-	// Get LLM client
-	client, err := llm.NewClient()
-	if err != nil {
-		return PlanningOutput{}, fmt.Errorf("failed to create LLM client: %w", err)
-	}
-
-	// Get planner spec
-	plannerSpec, exists := in.Config.RolePrompts["planner"]
-	if !exists {
-		return PlanningOutput{}, fmt.Errorf("planner role prompt not configured")
-	}
-
-	// Render template
-	var templateContent string
-	if plannerSpec.RawTemplate != "" {
-		templateContent = plannerSpec.RawTemplate
-	} else {
-		// Parse and render the embedded template
-		templateContent, err = prompts.Render(plannerSpec.TemplateRef, map[string]any{
-			"SystemPrompt": in.Config.SystemPrompt,
-			"BoardState":   in.BoardState,
-			"Milestone":    in.Milestone,
-			"Config":       in.Config,
-		})
-		if err != nil {
-			return PlanningOutput{}, fmt.Errorf("failed to render planner template: %w", err)
-		}
-	}
-
-	// Call LLM
-	messages := []llm.MessageParam{
-		{
-			Role:    "user",
-			Content: templateContent,
-		},
-	}
-
-	response, err := client.CreateMessage(ctx, llm.MessageInput{
-		Model:        plannerSpec.Model,
-		SystemPrompt: in.Config.SystemPrompt,
-		Messages:     messages,
-	})
-	if err != nil {
-		return PlanningOutput{}, fmt.Errorf("planner LLM call failed: %w", err)
-	}
-
-	// For now, return empty dispatch (will be parsed from LLM response in full implementation)
-	// This is a stub that allows the test to verify the activity is called
-	_ = response
-	return PlanningOutput{
-		TasksToDispatch:      []string{},
-		CompletedBranches:    []string{},
-		SubmilestoneComplete: false,
-	}, nil
-}

activity/analysis.go

@@ -0,0 +1,296 @@
+package activity
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// AnalyzeCodeInput is input for AnalyzeCodeActivity
+type AnalyzeCodeInput struct {
+	Path     string `json:"path"`
+	Language string `json:"language,omitempty"`
+	Depth    int    `json:"depth,omitempty"`
+}
+
+// AnalyzeCodeOutput is output from AnalyzeCodeActivity
+type AnalyzeCodeOutput struct {
+	Quality  float64           `json:"quality"`
+	Metrics  map[string]interface{} `json:"metrics"`
+	Issues   []string          `json:"issues"`
+	Summary  string            `json:"summary"`
+}
+
+// AnalyzeCodeActivity analyzes code quality using available tools
+func AnalyzeCodeActivity(ctx context.Context, in AnalyzeCodeInput) (AnalyzeCodeOutput, error) {
+	logger := newActivityLogger(ctx)
+	logger.Info("AnalyzeCodeActivity started", "path", in.Path)
+
+	output := AnalyzeCodeOutput{
+		Quality: 0.0,
+		Metrics: make(map[string]interface{}),
+		Issues:  []string{},
+	}
+
+	// Verify path exists
+	if _, err := os.Stat(in.Path); os.IsNotExist(err) {
+		return output, fmt.Errorf("path does not exist: %s", in.Path)
+	}
+
+	// Count files and lines
+	var totalFiles, totalLines int
+	err := filepath.Walk(in.Path, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return nil // Skip errors
+		}
+		if info.IsDir() {
+			// Skip hidden and vendor directories
+			if strings.HasPrefix(info.Name(), ".") || info.Name() == "vendor" || info.Name() == "node_modules" {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		
+		ext := filepath.Ext(path)
+		if isCodeFile(ext) {
+			totalFiles++
+			if lines, err := countLines(path); err == nil {
+				totalLines += lines
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		logger.Warn("Error walking path", "error", err)
+	}
+
+	output.Metrics["totalFiles"] = totalFiles
+	output.Metrics["totalLines"] = totalLines
+
+	// Try to run go vet if it's a Go project
+	if _, err := os.Stat(filepath.Join(in.Path, "go.mod")); err == nil {
+		cmd := exec.CommandContext(ctx, "go", "vet", "./...")
+		cmd.Dir = in.Path
+		vetOutput, err := cmd.CombinedOutput()
+		if err != nil {
+			issues := strings.Split(string(vetOutput), "\n")
+			for _, issue := range issues {
+				if strings.TrimSpace(issue) != "" {
+					output.Issues = append(output.Issues, issue)
+				}
+			}
+		}
+		output.Metrics["goVetRan"] = true
+	}
+
+	// Calculate quality score (simple heuristic)
+	issueCount := len(output.Issues)
+	if totalFiles > 0 {
+		issuesPerFile := float64(issueCount) / float64(totalFiles)
+		output.Quality = max(0, 1.0 - (issuesPerFile * 0.1))
+	} else {
+		output.Quality = 0.5
+	}
+
+	output.Summary = fmt.Sprintf("Analyzed %d files (%d lines). Found %d issues. Quality score: %.2f",
+		totalFiles, totalLines, issueCount, output.Quality)
+
+	logger.Info("AnalyzeCodeActivity completed", "quality", output.Quality, "issues", issueCount)
+	return output, nil
+}
+
+// SecurityScanInput is input for SecurityScanActivity
+type SecurityScanInput struct {
+	Path     string `json:"path"`
+	Severity string `json:"severity,omitempty"` // low, medium, high, critical
+}
+
+// SecurityScanOutput is output from SecurityScanActivity
+type SecurityScanOutput struct {
+	Vulnerabilities []Vulnerability `json:"vulnerabilities"`
+	SecurityScore   float64         `json:"securityScore"`
+	RiskLevel       string          `json:"riskLevel"`
+}
+
+// Vulnerability represents a security issue
+type Vulnerability struct {
+	ID          string `json:"id"`
+	Severity    string `json:"severity"`
+	Description string `json:"description"`
+	File        string `json:"file,omitempty"`
+	Line        int    `json:"line,omitempty"`
+}
+
+// SecurityScanActivity scans code for security vulnerabilities
+func SecurityScanActivity(ctx context.Context, in SecurityScanInput) (SecurityScanOutput, error) {
+	logger := newActivityLogger(ctx)
+	logger.Info("SecurityScanActivity started", "path", in.Path)
+
+	output := SecurityScanOutput{
+		Vulnerabilities: []Vulnerability{},
+		SecurityScore:   100.0,
+		RiskLevel:       "low",
+	}
+
+	// Verify path exists
+	if _, err := os.Stat(in.Path); os.IsNotExist(err) {
+		return output, fmt.Errorf("path does not exist: %s", in.Path)
+	}
+
+	// Check for common security issues
+	// 1. Check for hardcoded secrets
+	secretPatterns := []string{
+		"password=",
+		"secret=",
+		"api_key=",
+		"apikey=",
+		"private_key",
+		"AWS_SECRET",
+	}
+
+	err := filepath.Walk(in.Path, func(path string, info os.FileInfo, err error) error {
+		if err != nil || info.IsDir() {
+			return nil
+		}
+		
+		if !isCodeFile(filepath.Ext(path)) {
+			return nil
+		}
+
+		content, err := os.ReadFile(path)
+		if err != nil {
+			return nil
+		}
+
+		contentStr := strings.ToLower(string(content))
+		for _, pattern := range secretPatterns {
+			if strings.Contains(contentStr, pattern) {
+				output.Vulnerabilities = append(output.Vulnerabilities, Vulnerability{
+					ID:          fmt.Sprintf("SEC-%d", len(output.Vulnerabilities)+1),
+					Severity:    "high",
+					Description: fmt.Sprintf("Possible hardcoded secret: %s", pattern),
+					File:        path,
+				})
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		logger.Warn("Error scanning", "error", err)
+	}
+
+	// Try gosec if available and it's a Go project
+	if _, err := os.Stat(filepath.Join(in.Path, "go.mod")); err == nil {
+		if _, err := exec.LookPath("gosec"); err == nil {
+			cmd := exec.CommandContext(ctx, "gosec", "-fmt=json", "-quiet", "./...")
+			cmd.Dir = in.Path
+			// gosec returns non-zero if issues found, so we ignore the error
+			cmd.CombinedOutput()
+		}
+	}
+
+	// Calculate score
+	vulnCount := len(output.Vulnerabilities)
+	if vulnCount == 0 {
+		output.SecurityScore = 100.0
+		output.RiskLevel = "low"
+	} else if vulnCount < 3 {
+		output.SecurityScore = 80.0
+		output.RiskLevel = "medium"
+	} else if vulnCount < 10 {
+		output.SecurityScore = 50.0
+		output.RiskLevel = "high"
+	} else {
+		output.SecurityScore = 20.0
+		output.RiskLevel = "critical"
+	}
+
+	logger.Info("SecurityScanActivity completed", "vulnerabilities", vulnCount, "riskLevel", output.RiskLevel)
+	return output, nil
+}
+
+// GenerateReportInput is input for GenerateReportActivity
+type GenerateReportInput struct {
+	AnalysisResult interface{} `json:"analysisResult"`
+	SecurityResult interface{} `json:"securityResult"`
+	Format         string      `json:"format,omitempty"` // markdown, html, json
+}
+
+// GenerateReportOutput is output from GenerateReportActivity
+type GenerateReportOutput struct {
+	Report     string `json:"report"`
+	ReportPath string `json:"reportPath"`
+}
+
+// GenerateReportActivity generates a combined report
+func GenerateReportActivity(ctx context.Context, in GenerateReportInput) (GenerateReportOutput, error) {
+	logger := newActivityLogger(ctx)
+	logger.Info("GenerateReportActivity started")
+
+	format := in.Format
+	if format == "" {
+		format = "markdown"
+	}
+
+	var report strings.Builder
+	timestamp := time.Now().Format(time.RFC3339)
+
+	switch format {
+	case "markdown":
+		report.WriteString("# Analysis Report\n\n")
+		report.WriteString(fmt.Sprintf("Generated: %s\n\n", timestamp))
+		report.WriteString("## Code Analysis\n\n")
+		report.WriteString(fmt.Sprintf("```\n%v\n```\n\n", in.AnalysisResult))
+		report.WriteString("## Security Scan\n\n")
+		report.WriteString(fmt.Sprintf("```\n%v\n```\n\n", in.SecurityResult))
+	case "json":
+		report.WriteString(fmt.Sprintf(`{"timestamp":"%s","analysis":%v,"security":%v}`,
+			timestamp, in.AnalysisResult, in.SecurityResult))
+	default:
+		report.WriteString(fmt.Sprintf("Report generated at %s\n", timestamp))
+		report.WriteString(fmt.Sprintf("Analysis: %v\n", in.AnalysisResult))
+		report.WriteString(fmt.Sprintf("Security: %v\n", in.SecurityResult))
+	}
+
+	// Save to temp file
+	reportPath := filepath.Join(os.TempDir(), fmt.Sprintf("report-%d.%s", time.Now().UnixNano(), format))
+	if err := os.WriteFile(reportPath, []byte(report.String()), 0644); err != nil {
+		logger.Warn("Failed to save report", "error", err)
+	}
+
+	logger.Info("GenerateReportActivity completed", "format", format)
+	return GenerateReportOutput{
+		Report:     report.String(),
+		ReportPath: reportPath,
+	}, nil
+}
+
+// Helper functions
+
+func isCodeFile(ext string) bool {
+	codeExts := map[string]bool{
+		".go": true, ".py": true, ".js": true, ".ts": true,
+		".java": true, ".c": true, ".cpp": true, ".h": true,
+		".rs": true, ".rb": true, ".php": true, ".swift": true,
+	}
+	return codeExts[ext]
+}
+
+func countLines(path string) (int, error) {
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return 0, err
+	}
+	return len(strings.Split(string(content), "\n")), nil
+}
+
+func max(a, b float64) float64 {
+	if a > b {
+		return a
+	}
+	return b
+}

activity/analysis_test.go

@@ -0,0 +1,144 @@
+package activity
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAnalyzeCodeActivity(t *testing.T) {
+	// Create temp directory with some Go code
+	tmpDir, err := os.MkdirTemp("", "analyze-test")
+	require.NoError(t, err)
+	defer os.RemoveAll(tmpDir)
+
+	// Create go.mod
+	goMod := `module test
+go 1.21
+`
+	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "go.mod"), []byte(goMod), 0644))
+
+	// Create a simple Go file
+	goCode := `package main
+
+func main() {
+	println("hello")
+}
+`
+	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "main.go"), []byte(goCode), 0644))
+
+	// Run activity
+	output, err := AnalyzeCodeActivity(context.Background(), AnalyzeCodeInput{
+		Path:  tmpDir,
+		Depth: 3,
+	})
+	require.NoError(t, err)
+
+	// Verify output
+	require.Greater(t, output.Quality, 0.0)
+	require.NotNil(t, output.Metrics)
+	require.NotEmpty(t, output.Summary)
+	
+	totalFiles, ok := output.Metrics["totalFiles"].(int)
+	require.True(t, ok)
+	require.Equal(t, 1, totalFiles) // Just main.go (go.mod not counted)
+}
+
+func TestAnalyzeCodeActivity_PathNotExist(t *testing.T) {
+	_, err := AnalyzeCodeActivity(context.Background(), AnalyzeCodeInput{
+		Path: "/nonexistent/path",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "does not exist")
+}
+
+func TestSecurityScanActivity(t *testing.T) {
+	// Create temp directory
+	tmpDir, err := os.MkdirTemp("", "security-test")
+	require.NoError(t, err)
+	defer os.RemoveAll(tmpDir)
+
+	// Create a file with potential secret (matches pattern "password=")
+	code := `package main
+
+var config = map[string]string{
+	"password=": "supersecret123",
+	"api_key=": "sk-12345",
+}
+`
+	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "main.go"), []byte(code), 0644))
+
+	// Run activity
+	output, err := SecurityScanActivity(context.Background(), SecurityScanInput{
+		Path:     tmpDir,
+		Severity: "medium",
+	})
+	require.NoError(t, err)
+
+	// Should find the hardcoded password
+	require.Greater(t, len(output.Vulnerabilities), 0)
+	require.Less(t, output.SecurityScore, 100.0)
+}
+
+func TestSecurityScanActivity_Clean(t *testing.T) {
+	// Create temp directory with clean code
+	tmpDir, err := os.MkdirTemp("", "security-clean-test")
+	require.NoError(t, err)
+	defer os.RemoveAll(tmpDir)
+
+	// Create clean code
+	code := `package main
+
+func main() {
+	println("hello")
+}
+`
+	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "main.go"), []byte(code), 0644))
+
+	// Run activity
+	output, err := SecurityScanActivity(context.Background(), SecurityScanInput{
+		Path: tmpDir,
+	})
+	require.NoError(t, err)
+
+	// Should be clean
+	require.Equal(t, 0, len(output.Vulnerabilities))
+	require.Equal(t, 100.0, output.SecurityScore)
+	require.Equal(t, "low", output.RiskLevel)
+}
+
+func TestGenerateReportActivity(t *testing.T) {
+	output, err := GenerateReportActivity(context.Background(), GenerateReportInput{
+		AnalysisResult: map[string]interface{}{"quality": 0.85},
+		SecurityResult: map[string]interface{}{"score": 95.0},
+		Format:         "markdown",
+	})
+	require.NoError(t, err)
+
+	require.Contains(t, output.Report, "# Analysis Report")
+	require.NotEmpty(t, output.ReportPath)
+	
+	// Verify file was created
+	_, err = os.Stat(output.ReportPath)
+	require.NoError(t, err)
+	
+	// Cleanup
+	os.Remove(output.ReportPath)
+}
+
+func TestGenerateReportActivity_JSON(t *testing.T) {
+	output, err := GenerateReportActivity(context.Background(), GenerateReportInput{
+		AnalysisResult: map[string]interface{}{"quality": 0.85},
+		SecurityResult: map[string]interface{}{"score": 95.0},
+		Format:         "json",
+	})
+	require.NoError(t, err)
+
+	require.Contains(t, output.Report, `"timestamp"`)
+	
+	// Cleanup
+	os.Remove(output.ReportPath)
+}

activity/assume_role.go

@@ -0,0 +1,216 @@
+package activity
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"time"
+)
+
+// AssumeRoleInput is the input to AssumeRoleActivity
+type AssumeRoleInput struct {
+	// Identity is the user/service identity requesting access
+	Identity string `json:"identity"`
+	
+	// ClientID is the OAuth2/OIDC client ID (from vault or env)
+	ClientID string `json:"clientId,omitempty"`
+	
+	// ClientSecret is the OAuth2/OIDC client secret (from vault or env)
+	ClientSecret string `json:"clientSecret,omitempty"`
+	
+	// Scope defines what APIs this token can access (e.g., "llm:read llm:write")
+	Scope string `json:"scope"`
+	
+	// DurationSeconds is how long the token is valid (default: 3600 = 1 hour)
+	DurationSeconds int `json:"durationSeconds,omitempty"`
+	
+	// AuthServerURL is the auth server endpoint (from env if not provided)
+	AuthServerURL string `json:"authServerUrl,omitempty"`
+}
+
+// AssumeRoleOutput is the output from AssumeRoleActivity
+type AssumeRoleOutput struct {
+	// Token is the JWT token for calling api.riotpiao.com
+	Token string `json:"token"`
+	
+	// ExpiresAt is when the token expires (Unix timestamp)
+	ExpiresAt int64 `json:"expiresAt"`
+	
+	// ExpiresIn is the duration in seconds until expiration
+	ExpiresIn int `json:"expiresIn"`
+	
+	// TokenType is typically "Bearer"
+	TokenType string `json:"tokenType"`
+}
+
+// oauthTokenRequest is sent to the auth server
+type oauthTokenRequest struct {
+	GrantType    string `json:"grant_type"`
+	ClientID     string `json:"client_id"`
+	ClientSecret string `json:"client_secret"`
+	Scope        string `json:"scope"`
+	Subject      string `json:"subject,omitempty"` // The identity being assumed
+}
+
+// oauthTokenResponse is returned from the auth server
+type oauthTokenResponse struct {
+	AccessToken string `json:"access_token"`
+	TokenType   string `json:"token_type"`
+	ExpiresIn   int    `json:"expires_in"`
+	Scope       string `json:"scope"`
+}
+
+// AssumeRoleActivity requests a temporary JWT token for accessing LLM APIs
+//
+// This activity works like AWS AssumeRole:
+// 1. User provides identity + scope of access needed
+// 2. Activity exchanges credentials with auth server
+// 3. Returns JWT token valid for a limited time
+// 4. Caller uses token in subsequent LLM API calls
+//
+// Security: Credentials should come from vault/secrets, never hardcoded
+func AssumeRoleActivity(ctx context.Context, input *AssumeRoleInput) (*AssumeRoleOutput, error) {
+	// Validate inputs
+	if err := validateAssumeRoleInput(input); err != nil {
+		return nil, err
+	}
+
+	// Resolve configuration from input + environment
+	config, err := resolveAssumeRoleConfig(input)
+	if err != nil {
+		return nil, err
+	}
+
+	// Request token from auth server
+	tokenResp, err := requestAuthToken(ctx, config, input)
+	if err != nil {
+		return nil, err
+	}
+
+	// Build output
+	return buildAssumeRoleOutput(tokenResp), nil
+}
+
+// validateAssumeRoleInput checks required fields
+func validateAssumeRoleInput(input *AssumeRoleInput) error {
+	if input.Identity == "" {
+		return fmt.Errorf("identity is required")
+	}
+	if input.Scope == "" {
+		return fmt.Errorf("scope is required (e.g., 'llm:read' or 'llm:read llm:write')")
+	}
+	return nil
+}
+
+// assumeRoleConfig holds resolved configuration
+type assumeRoleConfig struct {
+	authServerURL string
+	clientID      string
+	clientSecret  string
+	duration      int
+}
+
+// resolveAssumeRoleConfig gets config from input or environment
+func resolveAssumeRoleConfig(input *AssumeRoleInput) (*assumeRoleConfig, error) {
+	cfg := &assumeRoleConfig{}
+
+	// Helper function to avoid DRY violation
+	getOrEnv := func(val, envKey, fieldName string) (string, error) {
+		if val != "" {
+			return val, nil
+		}
+		if val = os.Getenv(envKey); val != "" {
+			return val, nil
+		}
+		return "", fmt.Errorf("%s not provided and %s not set", fieldName, envKey)
+	}
+
+	var err error
+	if cfg.authServerURL, err = getOrEnv(input.AuthServerURL, "AUTH_SERVER_URL", "authServerUrl"); err != nil {
+		return nil, err
+	}
+	if cfg.clientID, err = getOrEnv(input.ClientID, "OAUTH_CLIENT_ID", "clientId"); err != nil {
+		return nil, err
+	}
+	if cfg.clientSecret, err = getOrEnv(input.ClientSecret, "OAUTH_CLIENT_SECRET", "clientSecret"); err != nil {
+		return nil, err
+	}
+
+	// Validate and set duration
+	cfg.duration = input.DurationSeconds
+	if cfg.duration == 0 {
+		cfg.duration = 3600 // 1 hour default
+	}
+	if cfg.duration > 86400 {
+		cfg.duration = 86400 // Max 24 hours
+	}
+
+	return cfg, nil
+}
+
+// requestAuthToken calls the auth server and returns the token response
+func requestAuthToken(ctx context.Context, config *assumeRoleConfig, input *AssumeRoleInput) (*oauthTokenResponse, error) {
+	tokenReq := oauthTokenRequest{
+		GrantType:    "client_credentials",
+		ClientID:     config.clientID,
+		ClientSecret: config.clientSecret,
+		Scope:        input.Scope,
+		Subject:      input.Identity,
+	}
+
+	reqBody, err := json.Marshal(tokenReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal token request: %w", err)
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, "POST",
+		fmt.Sprintf("%s/oauth/token", config.authServerURL),
+		bytes.NewReader(reqBody))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to call auth server: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("auth server returned status %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var tokenResp oauthTokenResponse
+	if err := json.Unmarshal(respBody, &tokenResp); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal token response: %w", err)
+	}
+
+	if tokenResp.AccessToken == "" {
+		return nil, fmt.Errorf("auth server returned empty access token")
+	}
+
+	return &tokenResp, nil
+}
+
+// buildAssumeRoleOutput constructs the output from token response
+func buildAssumeRoleOutput(tokenResp *oauthTokenResponse) *AssumeRoleOutput {
+	expiresAt := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second).Unix()
+	return &AssumeRoleOutput{
+		Token:     tokenResp.AccessToken,
+		ExpiresAt: expiresAt,
+		ExpiresIn: tokenResp.ExpiresIn,
+		TokenType: tokenResp.TokenType,
+	}
+}

activity/canvas_compatibility.go

@@ -0,0 +1,359 @@
+package activity
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/rockliang/poimen/workflows/pkg/db"
+)
+
+// CanvasCompatibilityOutput validation results
+type CanvasCompatibilityOutput struct {
+	IsValid           bool                    `json:"is_valid"`
+	Incompatibilities []IncompatibilityWarning `json:"incompatibilities"`
+	DisconnectedNodes []string                 `json:"disconnected_nodes"`
+	Warnings          []string                 `json:"warnings"`
+}
+
+// IncompatibilityWarning explains why two activities can't be connected
+type IncompatibilityWarning struct {
+	Source       string `json:"source"`        // Source node ID
+	Target       string `json:"target"`        // Target node ID
+	Reason       string `json:"reason"`        // Why they can't connect
+	SourceNeeds  string `json:"source_needs"`  // What source would need to output
+	TargetNeeds  string `json:"target_needs"`  // What target requires as input
+	Suggestion   string `json:"suggestion"`    // Suggestion to make it work
+}
+
+// ActivitySchema describes what an activity needs/provides
+type ActivitySchema struct {
+	ActivityType string                 `json:"activity_type"`
+	Inputs       map[string]InputField  `json:"inputs"`
+	Outputs      map[string]OutputField `json:"outputs"`
+}
+
+type InputField struct {
+	Type        string   `json:"type"`
+	Description string   `json:"description"`
+	Required    bool     `json:"required"`
+	Enum        []string `json:"enum,omitempty"`
+}
+
+type OutputField struct {
+	Type        string `json:"type"`
+	Description string `json:"description"`
+}
+
+// getActivitySchema returns schema from knowledge base
+func getActivitySchema(activityType string) (*ActivitySchema, error) {
+	kb := knowledgeBaseData()
+	if kb == "" {
+		return nil, fmt.Errorf("knowledge base not loaded")
+	}
+
+	var activities []map[string]interface{}
+	if err := json.Unmarshal([]byte(kb), &activities); err != nil {
+		// Try to extract activities from full KB structure
+		var fullKB map[string]interface{}
+		if err := json.Unmarshal([]byte(kb), &fullKB); err != nil {
+			return nil, fmt.Errorf("failed to parse knowledge base")
+		}
+		if activitiesRaw, ok := fullKB["activities"]; ok {
+			if b, err := json.Marshal(activitiesRaw); err == nil {
+				if err := json.Unmarshal(b, &activities); err != nil {
+					return nil, fmt.Errorf("failed to extract activities from KB")
+				}
+			}
+		}
+	}
+
+	// Find matching activity
+	for _, act := range activities {
+		if name, ok := act["name"].(string); ok {
+			if toActivityName(activityType) == name {
+				// Convert to ActivitySchema
+				schema := &ActivitySchema{
+					ActivityType: activityType,
+					Inputs:       make(map[string]InputField),
+					Outputs:      make(map[string]OutputField),
+				}
+
+				if inputs, ok := act["inputs"].(map[string]interface{}); ok {
+					for key, val := range inputs {
+						if field, ok := val.(map[string]interface{}); ok {
+							schema.Inputs[key] = parseInputField(field)
+						}
+					}
+				}
+
+				if outputs, ok := act["outputs"].(map[string]interface{}); ok {
+					for key, val := range outputs {
+						if field, ok := val.(map[string]interface{}); ok {
+							schema.Outputs[key] = parseOutputField(field)
+						}
+					}
+				}
+
+				return schema, nil
+			}
+		}
+	}
+
+	return nil, fmt.Errorf("activity %s not found in knowledge base", activityType)
+}
+
+func parseInputField(data map[string]interface{}) InputField {
+	field := InputField{}
+	if t, ok := data["type"].(string); ok {
+		field.Type = t
+	}
+	if d, ok := data["description"].(string); ok {
+		field.Description = d
+	}
+	if r, ok := data["required"].(bool); ok {
+		field.Required = r
+	}
+	return field
+}
+
+func parseOutputField(data map[string]interface{}) OutputField {
+	field := OutputField{}
+	if t, ok := data["type"].(string); ok {
+		field.Type = t
+	}
+	if d, ok := data["description"].(string); ok {
+		field.Description = d
+	}
+	return field
+}
+
+// CheckConnectionCompatibility validates if source can connect to target
+func CheckConnectionCompatibility(sourceNode, targetNode db.WorkflowNode) []IncompatibilityWarning {
+	warnings := []IncompatibilityWarning{}
+
+	sourceSchema, err := getActivitySchema(sourceNode.Type)
+	if err != nil {
+		warnings = append(warnings, IncompatibilityWarning{
+			Source:     sourceNode.ID,
+			Target:     targetNode.ID,
+			Reason:     fmt.Sprintf("Source activity schema not found: %v", err),
+			Suggestion: "Ensure source activity type is registered in knowledge base",
+		})
+		return warnings
+	}
+
+	targetSchema, err := getActivitySchema(targetNode.Type)
+	if err != nil {
+		warnings = append(warnings, IncompatibilityWarning{
+			Source:     sourceNode.ID,
+			Target:     targetNode.ID,
+			Reason:     fmt.Sprintf("Target activity schema not found: %v", err),
+			Suggestion: "Ensure target activity type is registered in knowledge base",
+		})
+		return warnings
+	}
+
+	// Check if source produces outputs that target can consume
+	if len(sourceSchema.Outputs) == 0 {
+		warnings = append(warnings, IncompatibilityWarning{
+			Source:     sourceNode.ID,
+			Target:     targetNode.ID,
+			Reason:     fmt.Sprintf("%s produces no outputs", sourceNode.Type),
+			SourceNeeds: "any output",
+			Suggestion: "Source activity must produce outputs",
+		})
+		return warnings
+	}
+
+	if len(targetSchema.Inputs) == 0 {
+		warnings = append(warnings, IncompatibilityWarning{
+			Source:     sourceNode.ID,
+			Target:     targetNode.ID,
+			Reason:     fmt.Sprintf("%s accepts no inputs", targetNode.Type),
+			TargetNeeds: "no input",
+			Suggestion: "Target activity must accept inputs. Check if it's a terminal activity.",
+		})
+		return warnings
+	}
+
+	// Match outputs to inputs
+	sourceOutputs := getOutputNames(sourceSchema.Outputs)
+	targetInputs := getInputNames(targetSchema.Inputs)
+
+	if len(sourceOutputs) == 0 || len(targetInputs) == 0 {
+		warnings = append(warnings, IncompatibilityWarning{
+			Source:       sourceNode.ID,
+			Target:       targetNode.ID,
+			Reason:       "No compatible output/input fields found",
+			SourceNeeds:  strings.Join(sourceOutputs, ", "),
+			TargetNeeds:  strings.Join(targetInputs, ", "),
+			Suggestion:   "Use LLM transformation to map outputs to inputs",
+		})
+	}
+
+	return warnings
+}
+
+// CheckCanvasConnectivity analyzes all suggested edges for compatibility
+func CheckCanvasConnectivity(nodes []db.WorkflowNode, suggestedEdges []EdgeWithWording) []IncompatibilityWarning {
+	warnings := []IncompatibilityWarning{}
+	nodeMap := make(map[string]db.WorkflowNode)
+	for _, n := range nodes {
+		nodeMap[n.ID] = n
+	}
+
+	for _, edge := range suggestedEdges {
+		sourceNode, ok := nodeMap[edge.Source]
+		if !ok {
+			continue
+		}
+		targetNode, ok := nodeMap[edge.Target]
+		if !ok {
+			continue
+		}
+
+		edgeWarnings := CheckConnectionCompatibility(sourceNode, targetNode)
+		warnings = append(warnings, edgeWarnings...)
+	}
+
+	return warnings
+}
+
+// IdentifyDisconnectedNodes finds nodes that can't connect to anything
+func IdentifyDisconnectedNodes(nodes []db.WorkflowNode, suggestedEdges []EdgeWithWording) []string {
+	edgeMap := make(map[string]bool)
+	for _, edge := range suggestedEdges {
+		edgeMap[edge.Source] = true
+		edgeMap[edge.Target] = true
+	}
+
+	var disconnected []string
+	for _, node := range nodes {
+		if !edgeMap[node.ID] {
+			disconnected = append(disconnected, node.ID)
+		}
+	}
+	return disconnected
+}
+
+// toActivityName converts canvas type to activity name (e.g., "clone-repo" -> "CloneRepoActivity")
+func toActivityName(canvasType string) string {
+	parts := strings.Split(canvasType, "-")
+	var result string
+	for _, part := range parts {
+		if part != "" {
+			result += strings.ToUpper(part[:1]) + strings.ToLower(part[1:])
+		}
+	}
+	return result + "Activity"
+}
+
+// getOutputNames extracts output field names
+func getOutputNames(outputs map[string]OutputField) []string {
+	var names []string
+	for name := range outputs {
+		names = append(names, name)
+	}
+	return names
+}
+
+// getInputNames extracts input field names (required ones highlighted)
+func getInputNames(inputs map[string]InputField) []string {
+	var names []string
+	for name, field := range inputs {
+		if field.Required {
+			names = append(names, name+"*")
+		} else {
+			names = append(names, name)
+		}
+	}
+	return names
+}
+
+// SuggestDataTransformation proposes how to connect incompatible activities
+func SuggestDataTransformation(sourceNode, targetNode db.WorkflowNode) string {
+	sourceSchema, _ := getActivitySchema(sourceNode.Type)
+	targetSchema, _ := getActivitySchema(targetNode.Type)
+
+	if sourceSchema == nil || targetSchema == nil {
+		return "Cannot analyze compatibility without schemas"
+	}
+
+	sourceOuts := getOutputNames(sourceSchema.Outputs)
+	targetIns := getInputNames(targetSchema.Inputs)
+
+	return fmt.Sprintf(
+		"To connect %s → %s:\n"+
+			"  %s outputs: %s\n"+
+			"  %s needs: %s\n"+
+			"  Solution: Use LLM transformation node to map outputs to inputs",
+		sourceNode.Label, targetNode.Label,
+		sourceNode.Type, strings.Join(sourceOuts, ", "),
+		targetNode.Type, strings.Join(targetIns, ", "),
+	)
+}
+
+// knowledgeBaseData returns raw KB JSON (stub - implement with actual KB loading)
+func knowledgeBaseData() string {
+	// This would load from activity_knowledge_base.json
+	// For now, return empty - real implementation loads from file
+	return ""
+}
+
+// CanvasCompatibilityActivity validates workflow canvas for type mismatches and isolation
+func CanvasCompatibilityActivity(ctx interface{}, input CanvasCompatibilityInput) (CanvasCompatibilityOutput, error) {
+	output := CanvasCompatibilityOutput{
+		IsValid:           true,
+		Incompatibilities: []IncompatibilityWarning{},
+		DisconnectedNodes: []string{},
+		Warnings:          []string{},
+	}
+
+	// Check all edges for compatibility
+	for _, edge := range input.Edges {
+		var sourceNode, targetNode *db.WorkflowNode
+		for i := range input.Nodes {
+			if input.Nodes[i].ID == edge.Source {
+				sourceNode = &input.Nodes[i]
+			}
+			if input.Nodes[i].ID == edge.Target {
+				targetNode = &input.Nodes[i]
+			}
+		}
+
+		if sourceNode != nil && targetNode != nil {
+			if warning, err := ValidateConnection(sourceNode, targetNode); err != nil {
+				output.IsValid = false
+				output.Incompatibilities = append(output.Incompatibilities, warning)
+			}
+		}
+	}
+
+	// Find disconnected nodes
+	connected := make(map[string]bool)
+	for _, edge := range input.Edges {
+		connected[edge.Source] = true
+		connected[edge.Target] = true
+	}
+
+	for _, node := range input.Nodes {
+		if node.Type == "activity" && !connected[node.ID] {
+			output.DisconnectedNodes = append(output.DisconnectedNodes, node.ID)
+		}
+	}
+
+	return output, nil
+}
+
+// ValidateConnection checks if two nodes can be connected based on their types.
+func ValidateConnection(source, target *db.WorkflowNode) (IncompatibilityWarning, error) {
+	if source.Type != "activity" || target.Type != "activity" {
+		return IncompatibilityWarning{
+			Source: source.ID,
+			Target: target.ID,
+			Reason: fmt.Sprintf("Cannot connect %s to %s: both must be activity type", source.Type, target.Type),
+		}, fmt.Errorf("type mismatch")
+	}
+	return IncompatibilityWarning{}, nil
+}

activity/canvas_reasoner.go

@@ -0,0 +1,253 @@
+package activity
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/rockliang/poimen/workflows/activity/llm"
+	"github.com/rockliang/poimen/workflows/pkg/db"
+)
+
+// CanvasReasonerOutput returns suggested edges and reasoning
+type CanvasReasonerOutput struct {
+	SuggestedEdges        []EdgeWithWording             `json:"suggested_edges"`         // Edges with wording
+	RemovedEdges          []db.WorkflowEdge             `json:"removed_edges,omitempty"` // Edges to remove
+	Reasoning             string                        `json:"reasoning"`               // LLM explanation
+	Confidence            float64                       `json:"confidence"`              // 0.0-1.0
+	IncompatibleEdges     []IncompatibilityWarning      `json:"incompatible_edges,omitempty"` // Can't connect
+	DisconnectedNodes     []string                      `json:"disconnected_nodes,omitempty"` // No connections
+	UserAlerts            []string                      `json:"user_alerts,omitempty"`        // Human-readable warnings
+}
+
+// CanvasReasonerActivity uses LLM to infer connections between workflow activities
+func CanvasReasonerActivity(ctx context.Context, in CanvasReasonerInput) (CanvasReasonerOutput, error) {
+	logger := newActivityLogger(ctx)
+
+	output := CanvasReasonerOutput{
+		SuggestedEdges: []EdgeWithWording{},
+	}
+
+	if len(in.Nodes) == 0 {
+		return output, fmt.Errorf("no nodes provided")
+	}
+
+	logger.Info("Analyzing canvas with %d nodes, %d edges", len(in.Nodes), len(in.Edges))
+
+	// Build activity descriptions for LLM context
+	nodeDesc := buildNodeDescriptions(in.Nodes)
+	edgeDesc := buildEdgeDescriptions(in.Edges)
+
+	// Create prompt for LLM reasoning with relation wording
+	systemPrompt := `You are a workflow automation expert. Analyze activities and suggest logical connections with semantic descriptions.
+
+CRITICAL RULES:
+1. Only suggest edges where outputs→inputs match
+2. Provide relation wording: verb, source_output, target_input
+3. Assess connection confidence (0.0-1.0)
+4. Flag type mismatches that need transformers
+
+Respond with JSON:
+{
+  "edges": [
+    {
+      "source": "node-1",
+      "target": "node-2",
+      "relation_type": "data-flow|dependency|conditional|parallel",
+      "relation_label": "Node1 outputs X → Node2 requires X",
+      "relation_wording": {
+        "verb": "outputs|depends-on|triggers|etc",
+        "source_output": "field_name (type): description",
+        "target_input": "field_name (type, required?): description",
+        "connection_type": "direct-map|requires-transformer|conditional",
+        "confidence": 0.95,
+        "semantic_match": "Explanation of why this makes sense"
+      }
+    }
+  ],
+  "reasoning": "Overall workflow structure explanation",
+  "confidence": 0.85
+}`
+
+	userPrompt := fmt.Sprintf(`Canvas Analysis:
+
+Nodes (including inputs/outputs):
+%s
+
+Current Edges:
+%s
+
+Task: %s
+
+KEY RULES:
+- Preserve existing edges and suggest only NEW edges to add
+- SKIP any connections where input/output types don't match
+- If an activity has no outputs, it cannot be a source
+- If an activity has no inputs, it cannot be a target
+- Note any activities that are hard to connect (terminal activities, generators, etc)
+
+Return ONLY valid JSON, no markdown code blocks.`, nodeDesc, edgeDesc, getReasoningTask(in.PreserveExisting))
+
+	logger.Info("Calling LLM reasoning (preserve_existing=%v)", in.PreserveExisting)
+
+	// Call LLM
+	client, err := llm.NewClient()
+	if err != nil {
+		return output, fmt.Errorf("failed to create LLM client: %w", err)
+	}
+
+	response, err := client.CreateMessage(ctx, llm.MessageInput{
+		Model: ModelSpec{
+			ModelID: "reasoning", // Use reasoning model for complex analysis
+		},
+		SystemPrompt: systemPrompt,
+		Messages: []llm.MessageParam{
+			{
+				Role:    "user",
+				Content: userPrompt,
+			},
+		},
+		AuthToken: in.AuthToken,
+	})
+
+	if err != nil {
+		return output, fmt.Errorf("LLM reasoning failed: %w", err)
+	}
+
+	// Parse LLM response
+	var reasonerResp struct {
+		Edges      []EdgeWithWording `json:"edges"`
+		Reasoning  string            `json:"reasoning"`
+		Confidence float64           `json:"confidence"`
+	}
+
+	if err := json.Unmarshal([]byte(response), &reasonerResp); err != nil {
+		logger.Warn("Failed to parse LLM response as JSON: %v", err)
+		// Try to extract from response text
+		output.Reasoning = response
+		output.Confidence = 0.5
+		return output, fmt.Errorf("failed to parse LLM response: %w", err)
+	}
+
+	// Validate suggested edges
+	nodeMap := make(map[string]bool)
+	for _, n := range in.Nodes {
+		nodeMap[n.ID] = true
+	}
+
+	validEdges := []EdgeWithWording{}
+	for _, edge := range reasonerResp.Edges {
+		if !nodeMap[edge.Source] {
+			logger.Warn("Suggested edge references unknown source: %s", edge.Source)
+			continue
+		}
+		if !nodeMap[edge.Target] {
+			logger.Warn("Suggested edge references unknown target: %s", edge.Target)
+			continue
+		}
+		// Don't suggest self-loops
+		if edge.Source == edge.Target {
+			logger.Warn("Skipping self-loop: %s", edge.Source)
+			continue
+		}
+		validEdges = append(validEdges, edge)
+	}
+
+	output.SuggestedEdges = validEdges
+	output.Reasoning = reasonerResp.Reasoning
+	output.Confidence = reasonerResp.Confidence
+
+	// Check compatibility of suggested edges
+	incompatibilities := CheckCanvasConnectivity(in.Nodes, validEdges)
+	if len(incompatibilities) > 0 {
+		output.IncompatibleEdges = incompatibilities
+		logger.Warn("Found %d incompatible edge connections", len(incompatibilities))
+
+		// Generate user-friendly alerts
+		for i, incompat := range incompatibilities {
+			if i < 5 { // Limit to 5 alerts to avoid spam
+				alert := fmt.Sprintf(
+					"⚠️  %s → %s: %s. %s",
+					incompat.Source, incompat.Target, incompat.Reason, incompat.Suggestion,
+				)
+				output.UserAlerts = append(output.UserAlerts, alert)
+			}
+		}
+	}
+
+	// Identify disconnected nodes
+	disconnected := IdentifyDisconnectedNodes(in.Nodes, validEdges)
+	if len(disconnected) > 0 {
+		output.DisconnectedNodes = disconnected
+		logger.Warn("Found %d disconnected nodes", len(disconnected))
+
+		for _, nodeID := range disconnected {
+			var label string
+			for _, node := range in.Nodes {
+				if node.ID == nodeID {
+					label = node.Label
+					break
+				}
+			}
+			alert := fmt.Sprintf(
+				"🔌 Node '%s' has no connections. Consider adding edges or removing it.",
+				label,
+			)
+			output.UserAlerts = append(output.UserAlerts, alert)
+		}
+	}
+
+	logger.Info("LLM suggested %d edges with confidence %.2f | %d incompatibilities | %d disconnected",
+		len(validEdges), output.Confidence, len(incompatibilities), len(disconnected))
+
+	return output, nil
+}
+
+// buildNodeDescriptions creates readable node descriptions for LLM (including schemas)
+func buildNodeDescriptions(nodes []db.WorkflowNode) string {
+	var desc string
+	for i, node := range nodes {
+		desc += fmt.Sprintf("%d. [%s] %s (type: %s)\n", i+1, node.ID, node.Label, node.Type)
+
+		// Add input/output schema info
+		if schema, err := getActivitySchema(node.Type); err == nil {
+			if len(schema.Inputs) > 0 {
+				desc += fmt.Sprintf("   INPUTS: %v\n", getInputNames(schema.Inputs))
+			} else {
+				desc += fmt.Sprintf("   INPUTS: none (generator/trigger)\n")
+			}
+			if len(schema.Outputs) > 0 {
+				desc += fmt.Sprintf("   OUTPUTS: %v\n", getOutputNames(schema.Outputs))
+			} else {
+				desc += fmt.Sprintf("   OUTPUTS: none (terminal/sink)\n")
+			}
+		}
+
+		if node.Data != nil {
+			if b, err := json.MarshalIndent(node.Data, "   ", "  "); err == nil {
+				desc += fmt.Sprintf("   CONFIG: %s\n", string(b))
+			}
+		}
+	}
+	return desc
+}
+
+// buildEdgeDescriptions creates readable edge descriptions for LLM
+func buildEdgeDescriptions(edges []db.WorkflowEdge) string {
+	if len(edges) == 0 {
+		return "None"
+	}
+	var desc string
+	for i, edge := range edges {
+		desc += fmt.Sprintf("%d. %s → %s\n", i+1, edge.Source, edge.Target)
+	}
+	return desc
+}
+
+// getReasoningTask returns task description based on preservation mode
+func getReasoningTask(preserveExisting bool) string {
+	if preserveExisting {
+		return "Keep all existing edges and suggest ONLY NEW edges to improve workflow"
+	}
+	return "Design optimal workflow by suggesting all connections and noting any redundant edges"
+}

activity/fetch_canvas_relations.go

@@ -0,0 +1,80 @@
+package activity
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/rockliang/poimen/workflows/pkg/db"
+)
+
+// FetchCanvasRelationsActivity fetches canvas + relations from DB
+func FetchCanvasRelationsActivity(ctx context.Context, input FetchCanvasRelationsInput) (CanvasWithRelationsData, error) {
+	logger := newActivityLogger(ctx)
+	output := CanvasWithRelationsData{
+		WorkflowID: input.WorkflowID,
+		Version:    input.Version,
+		Nodes:      []db.WorkflowNode{},
+		Edges:      []db.WorkflowEdge{},
+		Relations:  []EdgeWithWording{},
+	}
+
+	logger.Info("Fetching canvas relations: %s v%d", input.WorkflowID, input.Version)
+
+	// Get database client from context or activity manager
+	dbClient, ok := ctx.Value("db_client").(*db.DB)
+	if !ok {
+		return output, fmt.Errorf("database client not in context")
+	}
+
+	// Fetch workflow
+	workflow, err := dbClient.FetchWorkflow(ctx, input.WorkflowID, "")
+	if err != nil {
+		return output, fmt.Errorf("failed to get workflow: %w", err)
+	}
+
+	// Parse canvas nodes and edges
+	var nodes []db.WorkflowNode
+	if err := json.Unmarshal([]byte(workflow.Nodes), &nodes); err != nil {
+		return output, fmt.Errorf("failed to parse nodes: %w", err)
+	}
+
+	var edges []db.WorkflowEdge
+	if err := json.Unmarshal([]byte(workflow.Edges), &edges); err != nil {
+		return output, fmt.Errorf("failed to parse edges: %w", err)
+	}
+
+	output.Nodes = nodes
+	output.Edges = edges
+	output.UpdatedAt = workflow.UpdatedAt.String()
+
+	// Fetch workflow relations
+	relations, err := dbClient.GetWorkflowRelations(ctx, input.WorkflowID, input.Version)
+	if err != nil {
+		// Relations may not exist for old canvases - this is OK
+		logger.Warn("Failed to fetch relations: %v", err)
+		return output, nil
+	}
+
+	// Map to EdgeWithWording
+	for _, rel := range relations {
+		edge := EdgeWithWording{
+			ID:             rel.ID,
+			Source:         rel.SourceNodeID,
+			Target:         rel.TargetNodeID,
+			RelationType:   rel.RelationType,
+			RelationLabel:  rel.Label,
+			CreatedAt:      rel.CreatedAt.String(),
+		}
+
+		// Parse relation wording JSON
+		if err := json.Unmarshal(rel.RelationWording, &edge.RelationWording); err != nil {
+			logger.Warn("Failed to parse relation wording: %v", err)
+		}
+
+		output.Relations = append(output.Relations, edge)
+	}
+
+	logger.Info("Fetched %d nodes, %d edges, %d relations", len(output.Nodes), len(output.Edges), len(output.Relations))
+	return output, nil
+}

activity/git.go

@@ -1,4 +1,4 @@
-package action
+package activity
 
 import (
 	"context"

activity/implementer.go

@@ -0,0 +1,41 @@
+package activity
+
+import (
+	"context"
+
+	"github.com/rockliang/poimen/workflows/pkg/types"
+	"go.temporal.io/sdk/activity"
+)
+
+type ImplementerInput struct {
+	Config       types.OrchestratorConfig
+	TaskID       string
+	WorktreePath string
+	Lessons      string
+}
+
+type ImplementerOutput struct {
+	Success bool
+	Changes string
+}
+
+func ImplementerActivity(ctx context.Context, in ImplementerInput) (ImplementerOutput, error) {
+	activity.RecordHeartbeat(ctx, "starting implementer for "+in.TaskID)
+
+	vars := map[string]any{
+		"SystemPrompt": in.Config.SystemPrompt,
+		"Task":         in.TaskID,
+		"WorktreePath": in.WorktreePath,
+	}
+	if in.Lessons != "" {
+		vars["Lessons"] = in.Lessons
+	}
+
+	response, err := CallRoleLLM(ctx, in.Config, "implementer", vars)
+	if err != nil {
+		return ImplementerOutput{}, err
+	}
+
+	activity.RecordHeartbeat(ctx, "implementer completed for "+in.TaskID)
+	return ImplementerOutput{Success: true, Changes: response}, nil
+}

activity/index_graph_rag.go

@@ -0,0 +1,51 @@
+package activity
+
+import (
+	"context"
+	"time"
+)
+
+// IndexGraphRAGActivity indexes workflow canvas to GraphRAG (stub for now)
+func IndexGraphRAGActivity(ctx context.Context, input IndexGraphRAGInput) (IndexGraphRAGOutput, error) {
+	output := IndexGraphRAGOutput{
+		WorkflowID:      input.WorkflowID,
+		Version:         input.Version,
+		Status:          "indexed",
+		IndexedEntities: len(input.Nodes),
+		IndexedEdges:    len(input.Relations),
+		IndexedAt:       time.Now().UTC().Format(time.RFC3339),
+	}
+
+	// Stub implementation - actual GraphRAG indexing would happen here
+	// For now, just return success
+	return output, nil
+}
+
+// QueryGraphRAGRelationsInput for direct relation discovery
+type QueryGraphRAGRelationsInput struct {
+	WorkflowID string                 `json:"workflow_id"`
+	Version    int                    `json:"version"`
+	Query      string                 `json:"query"`
+	TopK       int                    `json:"top_k"`
+	Filters    map[string]interface{} `json:"filters,omitempty"`
+}
+
+// QueryGraphRAGRelationsOutput returns discovered relations
+type QueryGraphRAGRelationsOutput struct {
+	Query       string            `json:"query"`
+	Results     []EdgeWithWording `json:"results"`
+	TotalCount  int               `json:"total_count"`
+	ExecutionMs int64             `json:"execution_time_ms"`
+}
+
+// QueryGraphRAGRelationsActivity queries GraphRAG for relation patterns (stub)
+func QueryGraphRAGRelationsActivity(ctx context.Context, input QueryGraphRAGRelationsInput) (QueryGraphRAGRelationsOutput, error) {
+	output := QueryGraphRAGRelationsOutput{
+		Query:      input.Query,
+		Results:    []EdgeWithWording{},
+		TotalCount: 0,
+	}
+
+	// Stub implementation - actual GraphRAG querying would happen here
+	return output, nil
+}

activity/integration.go

@@ -1,4 +1,4 @@
-package action
+package activity
 
 import (
 	"context"

activity/judge.go

@@ -0,0 +1,32 @@
+package activity
+
+import (
+	"context"
+
+	"github.com/rockliang/poimen/workflows/pkg/types"
+)
+
+type JudgeInput struct {
+	Config              types.OrchestratorConfig
+	Diff                string
+	IntegrationTestLogs string
+}
+
+type JudgeOutput struct {
+	Verdict  string
+	Critique string
+}
+
+func JudgeActivity(ctx context.Context, in JudgeInput) (JudgeOutput, error) {
+	response, err := CallRoleLLM(ctx, in.Config, "judge", map[string]any{
+		"SystemPrompt": in.Config.SystemPrompt,
+		"Diff":         in.Diff,
+		"TestResult":   in.IntegrationTestLogs,
+	})
+	if err != nil {
+		return JudgeOutput{}, err
+	}
+
+	// TODO: parse LLM response for verdict
+	return JudgeOutput{Verdict: "pass", Critique: response}, nil
+}

activity/lessons.go

@@ -1,4 +1,4 @@
-package action
+package activity
 
 import (
 	"context"

activity/llm/client.go

@@ -7,16 +7,25 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"os"
 
-	"github.com/rockliang/poimen/workflows/statemachine"
+	"github.com/rockliang/poimen/workflows/pkg/types"
 )
 
-const (
+var (
 	// LocalLLMBaseURL is the base URL for the local LLM API (OpenAI-compatible)
-	// Points to homelab-frontend gateway
-	LocalLLMBaseURL = "https://api.riotpiao.com"
+	// Can be overridden via LOCAL_LLM_BASE_URL env var (for Kubernetes internal service)
+	LocalLLMBaseURL string
 )
 
+func init() {
+	LocalLLMBaseURL = os.Getenv("LOCAL_LLM_BASE_URL")
+	if LocalLLMBaseURL == "" {
+		// Default: external hostname (for local dev)
+		LocalLLMBaseURL = "https://api.riotpiao.com"
+	}
+}
+
 var (
 	// SupportedModels maps local model names to verify they exist
 	SupportedModels = map[string]bool{
@@ -45,9 +54,10 @@ func NewClient() (*OpenAIClient, error) {
 
 // MessageInput is the input to CreateMessage.
 type MessageInput struct {
-	Model        statemachine.ModelSpec
+	Model        types.ModelSpec
 	SystemPrompt string
 	Messages     []MessageParam
+	AuthToken    string // Optional JWT token for authenticated endpoints
 }
 
 // MessageParam represents a message parameter.
@@ -127,6 +137,11 @@ func (c *OpenAIClient) CreateMessage(ctx context.Context, in MessageInput) (stri
 
 	httpReq.Header.Set("Content-Type", "application/json")
 
+	// Add authentication header if token provided
+	if in.AuthToken != "" {
+		httpReq.Header.Set("Authorization", fmt.Sprintf("Bearer %s", in.AuthToken))
+	}
+
 	// Send request
 	resp, err := c.httpClient.Do(httpReq)
 	if err != nil {

activity/llm/client_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/rockliang/poimen/workflows/statemachine"
+	"github.com/rockliang/poimen/workflows/pkg/types"
 )
 
 func TestNewClient(t *testing.T) {
@@ -70,7 +70,7 @@ func TestCreateMessageValidation(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			in := MessageInput{
-				Model: statemachine.ModelSpec{
+				Model: types.ModelSpec{
 					ModelID: tt.modelID,
 				},
 				SystemPrompt: "test",

activity/llm_helper.go

@@ -0,0 +1,47 @@
+package activity
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/rockliang/poimen/workflows/activity/llm"
+	"github.com/rockliang/poimen/workflows/pkg/types"
+	"github.com/rockliang/poimen/workflows/prompts"
+)
+
+// CallRoleLLM is the shared pattern for calling an LLM with a role-based prompt.
+// Used by planner, implementer, and judge activities (DRY extraction).
+func CallRoleLLM(ctx context.Context, config types.OrchestratorConfig, role string, vars map[string]any) (string, error) {
+	client, err := llm.NewClient()
+	if err != nil {
+		return "", fmt.Errorf("failed to create LLM client: %w", err)
+	}
+
+	spec, exists := config.RolePrompts[role]
+	if !exists {
+		return "", fmt.Errorf("%s role prompt not configured", role)
+	}
+
+	// Render template
+	var content string
+	if spec.RawTemplate != "" {
+		content = spec.RawTemplate
+	} else {
+		content, err = prompts.Render(spec.TemplateRef, vars)
+		if err != nil {
+			return "", fmt.Errorf("failed to render %s template: %w", role, err)
+		}
+	}
+
+	// Call LLM
+	response, err := client.CreateMessage(ctx, llm.MessageInput{
+		Model:        spec.Model,
+		SystemPrompt: config.SystemPrompt,
+		Messages:     []llm.MessageParam{{Role: "user", Content: content}},
+	})
+	if err != nil {
+		return "", fmt.Errorf("%s LLM call failed: %w", role, err)
+	}
+
+	return response, nil
+}

activity/llm_inference.go

@@ -0,0 +1,114 @@
+package activity
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/rockliang/poimen/workflows/activity/llm"
+	"github.com/rockliang/poimen/workflows/pkg/types"
+)
+
+type LLMInferenceInput struct {
+	Model        string  `json:"model"`
+	SystemPrompt string  `json:"system_prompt"`
+	UserPrompt   string  `json:"user_prompt"`
+	Temperature  float64 `json:"temperature,omitempty"`
+	MaxTokens    int     `json:"max_tokens,omitempty"`
+	AuthToken    string  `json:"auth_token,omitempty"`
+}
+
+type LLMInferenceOutput struct {
+	Response     string `json:"response"`
+	Model        string `json:"model"`
+	StopReason   string `json:"stop_reason"`
+	TokensUsed   int    `json:"tokens_used"`
+	ErrorMessage string `json:"error,omitempty"`
+}
+
+func LLMInferenceActivity(ctx context.Context, in LLMInferenceInput) (LLMInferenceOutput, error) {
+	logger := newActivityLogger(ctx)
+	output := LLMInferenceOutput{Model: in.Model}
+
+	if in.Model == "" {
+		return output, fmt.Errorf("model not specified")
+	}
+	if in.UserPrompt == "" {
+		return output, fmt.Errorf("user_prompt not specified")
+	}
+
+	logger.Info("Starting LLM inference", "model", in.Model)
+
+	client, err := llm.NewClient()
+	if err != nil {
+		output.ErrorMessage = err.Error()
+		return output, fmt.Errorf("failed to create LLM client: %w", err)
+	}
+
+	response, err := client.CreateMessage(ctx, llm.MessageInput{
+		Model:        types.ModelSpec{ModelID: in.Model},
+		SystemPrompt: in.SystemPrompt,
+		Messages:     []llm.MessageParam{{Role: "user", Content: in.UserPrompt}},
+		AuthToken:    in.AuthToken,
+	})
+	if err != nil {
+		output.ErrorMessage = err.Error()
+		logger.Warn("LLM API call failed", "error", err)
+		return output, fmt.Errorf("LLM inference failed: %w", err)
+	}
+
+	output.Response = response
+	output.StopReason = "stop_sequence"
+	logger.Info("LLM inference completed", "response_len", len(response))
+	return output, nil
+}
+
+type LLMBatchInferenceInput struct {
+	Model        string   `json:"model"`
+	SystemPrompt string   `json:"system_prompt"`
+	Prompts      []string `json:"prompts"`
+	Temperature  float64  `json:"temperature,omitempty"`
+	AuthToken    string   `json:"auth_token,omitempty"`
+}
+
+type LLMBatchInferenceOutput struct {
+	Responses []string `json:"responses"`
+	Model     string   `json:"model"`
+	Errors    []string `json:"errors,omitempty"`
+}
+
+func LLMBatchInferenceActivity(ctx context.Context, in LLMBatchInferenceInput) (LLMBatchInferenceOutput, error) {
+	logger := newActivityLogger(ctx)
+	output := LLMBatchInferenceOutput{Model: in.Model, Responses: []string{}, Errors: []string{}}
+
+	if in.Model == "" {
+		return output, fmt.Errorf("model not specified")
+	}
+	if len(in.Prompts) == 0 {
+		return output, fmt.Errorf("no prompts provided")
+	}
+
+	logger.Info("Starting batch inference", "model", in.Model, "count", len(in.Prompts))
+
+	client, err := llm.NewClient()
+	if err != nil {
+		return output, fmt.Errorf("failed to create LLM client: %w", err)
+	}
+
+	for i, prompt := range in.Prompts {
+		response, err := client.CreateMessage(ctx, llm.MessageInput{
+			Model:        types.ModelSpec{ModelID: in.Model},
+			SystemPrompt: in.SystemPrompt,
+			Messages:     []llm.MessageParam{{Role: "user", Content: prompt}},
+		})
+		if err != nil {
+			output.Errors = append(output.Errors, fmt.Sprintf("prompt %d: %v", i, err))
+			output.Responses = append(output.Responses, "")
+			logger.Warn("Failed prompt", "index", i, "error", err)
+		} else {
+			output.Responses = append(output.Responses, response)
+		}
+	}
+
+	logger.Info("Batch inference completed", "responses", len(output.Responses), "errors", len(output.Errors))
+	return output, nil
+}

activity/logger.go

@@ -0,0 +1,49 @@
+package activity
+
+import (
+	"context"
+	"log"
+
+	"go.temporal.io/sdk/activity"
+)
+
+// activityLogger provides logging that works both in and outside Temporal context
+type activityLogger struct {
+	ctx context.Context
+}
+
+func newActivityLogger(ctx context.Context) *activityLogger {
+	return &activityLogger{ctx: ctx}
+}
+
+func (l *activityLogger) Info(msg string, args ...interface{}) {
+	if activity.IsActivity(l.ctx) {
+		activity.GetLogger(l.ctx).Info(msg, args...)
+	} else {
+		log.Printf("INFO: "+msg+" %v", args)
+	}
+}
+
+func (l *activityLogger) Warn(msg string, args ...interface{}) {
+	if activity.IsActivity(l.ctx) {
+		activity.GetLogger(l.ctx).Warn(msg, args...)
+	} else {
+		log.Printf("WARN: "+msg+" %v", args)
+	}
+}
+
+func (l *activityLogger) Error(msg string, args ...interface{}) {
+	if activity.IsActivity(l.ctx) {
+		activity.GetLogger(l.ctx).Error(msg, args...)
+	} else {
+		log.Printf("ERROR: "+msg+" %v", args)
+	}
+}
+
+func (l *activityLogger) Debug(msg string, args ...interface{}) {
+	if activity.IsActivity(l.ctx) {
+		activity.GetLogger(l.ctx).Debug(msg, args...)
+	} else {
+		log.Printf("DEBUG: "+msg+" %v", args)
+	}
+}

activity/memory.go

@@ -0,0 +1,255 @@
+package activity
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/rockliang/poimen/workflows/internal/memory"
+)
+
+// RetrieveMemoryInput input for RetrieveMemoryActivity
+type RetrieveMemoryInput struct {
+	// Query semantic search query
+	Query string `json:"query"`
+
+	// Project memory project (default: "poimen")
+	Project string `json:"project,omitempty"`
+
+	// Scope retrieval scope: "skills", "lessons", "all" (default: "all")
+	Scope string `json:"scope,omitempty"`
+
+	// Limit max results (default: 10)
+	Limit int `json:"limit,omitempty"`
+
+	// LevelFilter filter by level: L1, L2, R (reference)
+	LevelFilter []string `json:"levelFilter,omitempty"`
+
+	// Tool tool context for skill matching
+	Tool string `json:"tool,omitempty"`
+
+	// Task task description for context retrieval
+	Task string `json:"task,omitempty"`
+}
+
+// RetrieveMemoryOutput output from RetrieveMemoryActivity
+type RetrieveMemoryOutput struct {
+	// Skills relevant skills found
+	Skills []MemorySkill `json:"skills"`
+
+	// Lessons relevant lessons/knowledge found
+	Lessons []MemoryLesson `json:"lessons"`
+
+	// References reference documents found
+	References []MemoryReference `json:"references"`
+
+	// TotalResults total results found
+	TotalResults int `json:"totalResults"`
+
+	// Budget token budget info
+	Budget MemoryBudget `json:"budget"`
+}
+
+// MemorySkill skill from memory
+type MemorySkill struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Why         string `json:"why,omitempty"`
+}
+
+// MemoryLesson lesson from memory
+type MemoryLesson struct {
+	ID         string  `json:"id"`
+	Text       string  `json:"text"`
+	Level      string  `json:"level"`
+	Score      float32 `json:"score"`
+	Breadcrumb string  `json:"breadcrumb,omitempty"`
+}
+
+// MemoryReference reference document from memory
+type MemoryReference struct {
+	ID         string  `json:"id"`
+	Text       string  `json:"text"`
+	Score      float32 `json:"score"`
+	Breadcrumb string  `json:"breadcrumb,omitempty"`
+}
+
+// MemoryBudget token budget tracking
+type MemoryBudget struct {
+	Requested int `json:"requested"`
+	Used      int `json:"used"`
+}
+
+// RetrieveMemoryActivity retrieves relevant knowledge from poimen-memory
+func RetrieveMemoryActivity(ctx context.Context, in RetrieveMemoryInput) (RetrieveMemoryOutput, error) {
+	logger := newActivityLogger(ctx)
+	logger.Info("RetrieveMemoryActivity started", "query", in.Query, "scope", in.Scope)
+
+	output := RetrieveMemoryOutput{
+		Skills:     []MemorySkill{},
+		Lessons:    []MemoryLesson{},
+		References: []MemoryReference{},
+	}
+
+	// Get memory service URL and token
+	baseURL := os.Getenv("MEMORY_SERVICE_URL")
+	if baseURL == "" {
+		baseURL = "http://localhost:8080"
+	}
+
+	token := os.Getenv("POIMEN_MEMORY_TOKEN")
+	// Token optional for internal cluster access
+
+	// Set defaults
+	project := in.Project
+	if project == "" {
+		project = "poimen"
+	}
+
+	scope := in.Scope
+	if scope == "" {
+		scope = "all"
+	}
+
+	limit := in.Limit
+	if limit == 0 {
+		limit = 10
+	}
+
+	client := memory.NewClient(baseURL, token)
+
+	// If tool/task provided, use Context API for skill matching
+	if in.Tool != "" || in.Task != "" {
+		contextResp, err := client.Context(ctx, &memory.ContextRequest{
+			Project:         project,
+			Tool:            in.Tool,
+			Task:            in.Task,
+			SignatureSource: in.Query,
+			Scope:           "tool_context",
+			Budget:          8192,
+		})
+		if err != nil {
+			logger.Warn("Context retrieval failed, falling back to query", "error", err)
+		} else {
+			// Extract skills
+			for _, skill := range contextResp.Skills {
+				output.Skills = append(output.Skills, MemorySkill{
+					Name: skill.Name,
+					Why:  skill.Why,
+				})
+			}
+
+			// Extract lessons
+			for i, lesson := range contextResp.Lessons {
+				output.Lessons = append(output.Lessons, MemoryLesson{
+					ID:         fmt.Sprintf("ctx-%d", i),
+					Text:       lesson.Text,
+					Level:      lesson.Level,
+					Score:      lesson.Score,
+					Breadcrumb: "",
+				})
+			}
+
+			output.Budget = MemoryBudget{
+				Requested: contextResp.Budget.Requested,
+				Used:      contextResp.Budget.Used,
+			}
+			output.TotalResults = len(output.Skills) + len(output.Lessons)
+		}
+	}
+
+	// Also do semantic query for additional context
+	if scope == "all" || scope == "lessons" || scope == "references" {
+		levelFilter := in.LevelFilter
+		if len(levelFilter) == 0 {
+			levelFilter = []string{"L1", "L2"}
+		}
+
+		queryResp, err := client.Query(ctx, &memory.QueryRequest{
+			Project:     project,
+			Query:       in.Query,
+			LevelFilter: levelFilter,
+			Limit:       limit,
+			Scope:       "all",
+		})
+		if err != nil {
+			logger.Warn("Query failed", "error", err)
+		} else {
+			for _, result := range queryResp.Results {
+				if result.Level == "R" {
+					output.References = append(output.References, MemoryReference{
+						ID:         result.ID,
+						Text:       result.Text,
+						Score:      result.Score,
+						Breadcrumb: result.Breadcrumb,
+					})
+				} else {
+					// Avoid duplicates from Context call
+					found := false
+					for _, existing := range output.Lessons {
+						if existing.ID == result.ID {
+							found = true
+							break
+						}
+					}
+					if !found {
+						output.Lessons = append(output.Lessons, MemoryLesson{
+							ID:         result.ID,
+							Text:       result.Text,
+							Level:      result.Level,
+							Score:      result.Score,
+							Breadcrumb: result.Breadcrumb,
+						})
+					}
+				}
+			}
+			output.TotalResults = len(output.Skills) + len(output.Lessons) + len(output.References)
+		}
+	}
+
+	logger.Info("RetrieveMemoryActivity completed",
+		"skills", len(output.Skills),
+		"lessons", len(output.Lessons),
+		"references", len(output.References))
+
+	return output, nil
+}
+
+// FormatMemoryForPrompt formats memory output for LLM prompt injection
+func FormatMemoryForPrompt(mem RetrieveMemoryOutput) string {
+	if mem.TotalResults == 0 {
+		return ""
+	}
+
+	var result string
+
+	if len(mem.Skills) > 0 {
+		result += "\n## Relevant Skills\n"
+		for _, skill := range mem.Skills {
+			result += fmt.Sprintf("- **%s**: %s\n", skill.Name, skill.Why)
+		}
+	}
+
+	if len(mem.Lessons) > 0 {
+		result += "\n## Relevant Knowledge\n"
+		for _, lesson := range mem.Lessons {
+			result += fmt.Sprintf("- [%s] %s\n", lesson.Level, truncate(lesson.Text, 200))
+		}
+	}
+
+	if len(mem.References) > 0 {
+		result += "\n## Reference Documents\n"
+		for _, ref := range mem.References {
+			result += fmt.Sprintf("- %s\n", truncate(ref.Text, 200))
+		}
+	}
+
+	return result
+}
+
+func truncate(s string, maxLen int) string {
+	if len(s) <= maxLen {
+		return s
+	}
+	return s[:maxLen] + "..."
+}

activity/memory_test.go

@@ -0,0 +1,138 @@
+package activity
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRetrieveMemoryActivity_Query(t *testing.T) {
+	// Mock memory service
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/memory/query" {
+			resp := map[string]interface{}{
+				"results": []map[string]interface{}{
+					{
+						"id":    "doc-1",
+						"level": "L1",
+						"score": 0.95,
+						"text":  "Security scanning best practices: always check for hardcoded secrets",
+					},
+					{
+						"id":    "doc-2",
+						"level": "L2",
+						"score": 0.85,
+						"text":  "Use gosec for Go security analysis",
+					},
+				},
+			}
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(resp)
+			return
+		}
+		http.NotFound(w, r)
+	}))
+	defer server.Close()
+
+	// Set env for test
+	t.Setenv("MEMORY_SERVICE_URL", server.URL)
+
+	output, err := RetrieveMemoryActivity(context.Background(), RetrieveMemoryInput{
+		Query:   "security scanning",
+		Project: "poimen",
+		Scope:   "lessons",
+		Limit:   5,
+	})
+	require.NoError(t, err)
+
+	require.Equal(t, 2, len(output.Lessons))
+	require.Equal(t, "L1", output.Lessons[0].Level)
+	require.Contains(t, output.Lessons[0].Text, "Security scanning")
+}
+
+func TestRetrieveMemoryActivity_Context(t *testing.T) {
+	// Mock memory service with context endpoint
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/memory/context" {
+			resp := map[string]interface{}{
+				"tier": 1,
+				"skills": []map[string]interface{}{
+					{
+						"name": "security-analysis",
+						"why":  "User is asking about security scanning",
+					},
+				},
+				"lessons": []map[string]interface{}{
+					{
+						"tier":  1,
+						"level": "L1",
+						"score": 0.9,
+						"text":  "Always scan dependencies for vulnerabilities",
+					},
+				},
+				"budget": map[string]interface{}{
+					"requested": 8192,
+					"used":      1024,
+				},
+			}
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(resp)
+			return
+		}
+		if r.URL.Path == "/memory/query" {
+			resp := map[string]interface{}{"results": []interface{}{}}
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(resp)
+			return
+		}
+		http.NotFound(w, r)
+	}))
+	defer server.Close()
+
+	t.Setenv("MEMORY_SERVICE_URL", server.URL)
+
+	output, err := RetrieveMemoryActivity(context.Background(), RetrieveMemoryInput{
+		Query: "security scan repo",
+		Tool:  "poimen-router",
+		Task:  "generate workflow for security scanning",
+	})
+	require.NoError(t, err)
+
+	require.Equal(t, 1, len(output.Skills))
+	require.Equal(t, "security-analysis", output.Skills[0].Name)
+	require.Equal(t, 1, len(output.Lessons))
+	require.Equal(t, 8192, output.Budget.Requested)
+	require.Equal(t, 1024, output.Budget.Used)
+}
+
+func TestFormatMemoryForPrompt(t *testing.T) {
+	mem := RetrieveMemoryOutput{
+		Skills: []MemorySkill{
+			{Name: "security-scan", Description: "Run security scanner", Why: "Matches user intent"},
+		},
+		Lessons: []MemoryLesson{
+			{ID: "1", Level: "L1", Text: "Always check dependencies"},
+		},
+		TotalResults: 2,
+	}
+
+	result := FormatMemoryForPrompt(mem)
+
+	require.Contains(t, result, "## Relevant Skills")
+	require.Contains(t, result, "security-scan")
+	require.Contains(t, result, "## Relevant Knowledge")
+	require.Contains(t, result, "Always check dependencies")
+}
+
+func TestFormatMemoryForPrompt_Empty(t *testing.T) {
+	mem := RetrieveMemoryOutput{
+		TotalResults: 0,
+	}
+
+	result := FormatMemoryForPrompt(mem)
+	require.Equal(t, "", result)
+}

activity/notification.go

@@ -0,0 +1,343 @@
+package activity
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"time"
+)
+
+// NotifyStatusInput is input for NotifyStatusActivity
+type NotifyStatusInput struct {
+	Channel string `json:"channel"` // slack, email, webhook
+	Status  string `json:"status"`  // success, failure, warning
+	Message string `json:"message"`
+}
+
+// NotifyStatusOutput is output from NotifyStatusActivity
+type NotifyStatusOutput struct {
+	NotificationID string `json:"notificationId"`
+	Timestamp      string `json:"timestamp"`
+}
+
+// NotifyStatusActivity sends notifications
+func NotifyStatusActivity(ctx context.Context, in NotifyStatusInput) (NotifyStatusOutput, error) {
+	logger := newActivityLogger(ctx)
+	logger.Info("NotifyStatusActivity started", "channel", in.Channel, "status", in.Status)
+
+	timestamp := time.Now().Format(time.RFC3339)
+	notificationID := fmt.Sprintf("notify-%d", time.Now().UnixNano())
+
+	switch in.Channel {
+	case "slack":
+		if err := sendSlackNotification(ctx, in); err != nil {
+			logger.Warn("Slack notification failed", "error", err)
+			// Don't fail the activity, just log
+		}
+	case "webhook":
+		if err := sendWebhookNotification(ctx, in); err != nil {
+			logger.Warn("Webhook notification failed", "error", err)
+		}
+	case "email":
+		// Email would require SMTP setup - log for now
+		logger.Info("Email notification (logged)", "message", in.Message)
+	default:
+		logger.Info("Notification logged", "channel", in.Channel, "message", in.Message)
+	}
+
+	logger.Info("NotifyStatusActivity completed", "notificationId", notificationID)
+	return NotifyStatusOutput{
+		NotificationID: notificationID,
+		Timestamp:      timestamp,
+	}, nil
+}
+
+func sendSlackNotification(ctx context.Context, in NotifyStatusInput) error {
+	webhookURL := os.Getenv("SLACK_WEBHOOK_URL")
+	if webhookURL == "" {
+		return fmt.Errorf("SLACK_WEBHOOK_URL not set")
+	}
+
+	// Map status to emoji
+	emoji := "ℹ️"
+	switch in.Status {
+	case "success":
+		emoji = "✅"
+	case "failure":
+		emoji = "❌"
+	case "warning":
+		emoji = "⚠️"
+	}
+
+	payload := map[string]string{
+		"text": fmt.Sprintf("%s *%s*: %s", emoji, in.Status, in.Message),
+	}
+
+	body, _ := json.Marshal(payload)
+	req, err := http.NewRequestWithContext(ctx, "POST", webhookURL, bytes.NewBuffer(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("slack returned status %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+func sendWebhookNotification(ctx context.Context, in NotifyStatusInput) error {
+	webhookURL := os.Getenv("NOTIFICATION_WEBHOOK_URL")
+	if webhookURL == "" {
+		return fmt.Errorf("NOTIFICATION_WEBHOOK_URL not set")
+	}
+
+	payload := map[string]interface{}{
+		"channel":   in.Channel,
+		"status":    in.Status,
+		"message":   in.Message,
+		"timestamp": time.Now().Format(time.RFC3339),
+	}
+
+	body, _ := json.Marshal(payload)
+	req, err := http.NewRequestWithContext(ctx, "POST", webhookURL, bytes.NewBuffer(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("webhook returned status %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// ArchiveResultsInput is input for ArchiveResultsActivity
+type ArchiveResultsInput struct {
+	ReportPath  string                 `json:"reportPath"`
+	Destination string                 `json:"destination"` // s3://bucket/path or local path
+	Metadata    map[string]interface{} `json:"metadata,omitempty"`
+}
+
+// ArchiveResultsOutput is output from ArchiveResultsActivity
+type ArchiveResultsOutput struct {
+	ArchiveURL  string `json:"archiveUrl"`
+	ArchiveSize int64  `json:"archiveSize"`
+}
+
+// ArchiveResultsActivity archives results to storage
+func ArchiveResultsActivity(ctx context.Context, in ArchiveResultsInput) (ArchiveResultsOutput, error) {
+	logger := newActivityLogger(ctx)
+	logger.Info("ArchiveResultsActivity started", "reportPath", in.ReportPath, "destination", in.Destination)
+
+	// Check if source exists
+	info, err := os.Stat(in.ReportPath)
+	if err != nil {
+		return ArchiveResultsOutput{}, fmt.Errorf("report not found: %s", in.ReportPath)
+	}
+
+	// For now, just copy to local destination or log for cloud
+	var archiveURL string
+	var archiveSize int64
+
+	if len(in.Destination) > 5 && in.Destination[:5] == "s3://" {
+		// Would use AWS SDK - for now just log
+		logger.Info("Would upload to S3", "destination", in.Destination)
+		archiveURL = in.Destination
+		archiveSize = info.Size()
+	} else {
+		// Copy to local destination
+		content, err := os.ReadFile(in.ReportPath)
+		if err != nil {
+			return ArchiveResultsOutput{}, fmt.Errorf("failed to read report: %w", err)
+		}
+
+		destPath := in.Destination
+		if destPath == "" {
+			destPath = fmt.Sprintf("/tmp/archive-%d", time.Now().UnixNano())
+		}
+
+		if err := os.WriteFile(destPath, content, 0644); err != nil {
+			return ArchiveResultsOutput{}, fmt.Errorf("failed to write archive: %w", err)
+		}
+
+		archiveURL = destPath
+		archiveSize = int64(len(content))
+	}
+
+	logger.Info("ArchiveResultsActivity completed", "archiveUrl", archiveURL, "size", archiveSize)
+	return ArchiveResultsOutput{
+		ArchiveURL:  archiveURL,
+		ArchiveSize: archiveSize,
+	}, nil
+}
+
+// DeploymentPreCheckInput is input for DeploymentPreCheckActivity
+type DeploymentPreCheckInput struct {
+	Path      string `json:"path"`
+	CheckType string `json:"checkType,omitempty"` // lint, test, build, all
+}
+
+// DeploymentPreCheckOutput is output from DeploymentPreCheckActivity
+type DeploymentPreCheckOutput struct {
+	Passed   bool     `json:"passed"`
+	Failures []string `json:"failures"`
+	Warnings []string `json:"warnings"`
+}
+
+// checker defines a deployment check
+type checker struct {
+	name      string
+	types     []string // which checkTypes trigger this checker
+	isWarning bool     // if true, failure goes to warnings not failures
+	run       func(ctx context.Context, path string) (string, error)
+}
+
+// shouldRun checks if this checker should run for given checkType
+func (c *checker) shouldRun(checkType string) bool {
+	for _, t := range c.types {
+		if t == checkType {
+			return true
+		}
+	}
+	return false
+}
+
+// goCheckers returns checkers for Go projects
+func goCheckers() []*checker {
+	return []*checker{
+		{
+			name:  "build",
+			types: []string{"all", "build"},
+			run: func(ctx context.Context, path string) (string, error) {
+				cmd := exec.CommandContext(ctx, "go", "build", "./...")
+				cmd.Dir = path
+				out, err := cmd.CombinedOutput()
+				return string(out), err
+			},
+		},
+		{
+			name:  "test",
+			types: []string{"all", "test"},
+			run: func(ctx context.Context, path string) (string, error) {
+				cmd := exec.CommandContext(ctx, "go", "test", "-short", "./...")
+				cmd.Dir = path
+				out, err := cmd.CombinedOutput()
+				return string(out), err
+			},
+		},
+		{
+			name:      "lint",
+			types:     []string{"all", "lint"},
+			isWarning: true,
+			run: func(ctx context.Context, path string) (string, error) {
+				cmd := exec.CommandContext(ctx, "go", "vet", "./...")
+				cmd.Dir = path
+				out, err := cmd.CombinedOutput()
+				return string(out), err
+			},
+		},
+	}
+}
+
+// detectProjectCheckers returns checkers based on project type
+func detectProjectCheckers(path string) []*checker {
+	if _, err := os.Stat(fmt.Sprintf("%s/go.mod", path)); err == nil {
+		return goCheckers()
+	}
+	// Add more project types here (Node, Python, etc.)
+	return nil
+}
+
+// DeploymentPreCheckActivity validates deployment readiness
+func DeploymentPreCheckActivity(ctx context.Context, in DeploymentPreCheckInput) (DeploymentPreCheckOutput, error) {
+	logger := newActivityLogger(ctx)
+	logger.Info("DeploymentPreCheckActivity started", "path", in.Path, "checkType", in.CheckType)
+
+	output := DeploymentPreCheckOutput{
+		Passed:   true,
+		Failures: []string{},
+		Warnings: []string{},
+	}
+
+	checkType := in.CheckType
+	if checkType == "" {
+		checkType = "all"
+	}
+
+	// Check if path exists
+	if _, err := os.Stat(in.Path); os.IsNotExist(err) {
+		output.Passed = false
+		output.Failures = append(output.Failures, fmt.Sprintf("path does not exist: %s", in.Path))
+		return output, nil
+	}
+
+	// Run applicable checkers
+	for _, c := range detectProjectCheckers(in.Path) {
+		if !c.shouldRun(checkType) {
+			continue
+		}
+		if out, err := c.run(ctx, in.Path); err != nil {
+			msg := fmt.Sprintf("%s failed: %s", c.name, out)
+			if c.isWarning {
+				output.Warnings = append(output.Warnings, msg)
+			} else {
+				output.Passed = false
+				output.Failures = append(output.Failures, msg)
+			}
+		}
+	}
+
+	logger.Info("DeploymentPreCheckActivity completed", "passed", output.Passed, "failures", len(output.Failures))
+	return output, nil
+}
+
+// ApproveWorkflowInput is input for ApproveWorkflowActivity
+type ApproveWorkflowInput struct {
+	WorkflowID        string `json:"workflowId"`
+	RequiredApprovals int    `json:"requiredApprovals,omitempty"`
+	TimeoutMinutes    int    `json:"timeoutMinutes,omitempty"`
+}
+
+// ApproveWorkflowOutput is output from ApproveWorkflowActivity
+type ApproveWorkflowOutput struct {
+	Approved  bool   `json:"approved"`
+	Approver  string `json:"approver,omitempty"`
+	Timestamp string `json:"timestamp"`
+}
+
+// ApproveWorkflowActivity handles approval workflow (auto-approves for now)
+func ApproveWorkflowActivity(ctx context.Context, in ApproveWorkflowInput) (ApproveWorkflowOutput, error) {
+	logger := newActivityLogger(ctx)
+	logger.Info("ApproveWorkflowActivity started", "workflowId", in.WorkflowID)
+
+	// For now, auto-approve
+	// In production, this would wait for human approval via signal or external system
+
+	timestamp := time.Now().Format(time.RFC3339)
+
+	logger.Info("ApproveWorkflowActivity completed (auto-approved)")
+	return ApproveWorkflowOutput{
+		Approved:  true,
+		Approver:  "system-auto",
+		Timestamp: timestamp,
+	}, nil
+}

activity/notification_test.go

@@ -0,0 +1,130 @@
+package activity
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNotifyStatusActivity(t *testing.T) {
+	// Test with default channel (logs only)
+	output, err := NotifyStatusActivity(context.Background(), NotifyStatusInput{
+		Channel: "log",
+		Status:  "success",
+		Message: "Test notification",
+	})
+	require.NoError(t, err)
+
+	require.NotEmpty(t, output.NotificationID)
+	require.NotEmpty(t, output.Timestamp)
+}
+
+func TestNotifyStatusActivity_AllStatuses(t *testing.T) {
+	statuses := []string{"success", "failure", "warning"}
+	
+	for _, status := range statuses {
+		t.Run(status, func(t *testing.T) {
+			output, err := NotifyStatusActivity(context.Background(), NotifyStatusInput{
+				Channel: "log",
+				Status:  status,
+				Message: "Test " + status,
+			})
+			require.NoError(t, err)
+			require.NotEmpty(t, output.NotificationID)
+		})
+	}
+}
+
+func TestArchiveResultsActivity(t *testing.T) {
+	// Create temp source file
+	tmpDir, err := os.MkdirTemp("", "archive-test")
+	require.NoError(t, err)
+	defer os.RemoveAll(tmpDir)
+
+	srcPath := filepath.Join(tmpDir, "report.txt")
+	require.NoError(t, os.WriteFile(srcPath, []byte("test report content"), 0644))
+
+	// Archive to local destination
+	destPath := filepath.Join(tmpDir, "archive.txt")
+	output, err := ArchiveResultsActivity(context.Background(), ArchiveResultsInput{
+		ReportPath:  srcPath,
+		Destination: destPath,
+	})
+	require.NoError(t, err)
+
+	require.Equal(t, destPath, output.ArchiveURL)
+	require.Greater(t, output.ArchiveSize, int64(0))
+
+	// Verify file was copied
+	content, err := os.ReadFile(destPath)
+	require.NoError(t, err)
+	require.Equal(t, "test report content", string(content))
+}
+
+func TestArchiveResultsActivity_NotFound(t *testing.T) {
+	_, err := ArchiveResultsActivity(context.Background(), ArchiveResultsInput{
+		ReportPath:  "/nonexistent/file.txt",
+		Destination: "/tmp/archive.txt",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "not found")
+}
+
+func TestDeploymentPreCheckActivity(t *testing.T) {
+	// Create temp directory with valid Go code
+	tmpDir, err := os.MkdirTemp("", "precheck-test")
+	require.NoError(t, err)
+	defer os.RemoveAll(tmpDir)
+
+	// Create go.mod
+	goMod := `module test
+go 1.21
+`
+	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "go.mod"), []byte(goMod), 0644))
+
+	// Create valid Go file
+	goCode := `package main
+
+func main() {
+	println("hello")
+}
+`
+	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "main.go"), []byte(goCode), 0644))
+
+	// Run pre-check
+	output, err := DeploymentPreCheckActivity(context.Background(), DeploymentPreCheckInput{
+		Path:      tmpDir,
+		CheckType: "build",
+	})
+	require.NoError(t, err)
+
+	require.True(t, output.Passed)
+	require.Empty(t, output.Failures)
+}
+
+func TestDeploymentPreCheckActivity_PathNotExist(t *testing.T) {
+	output, err := DeploymentPreCheckActivity(context.Background(), DeploymentPreCheckInput{
+		Path: "/nonexistent/path",
+	})
+	require.NoError(t, err) // Activity doesn't error, just reports failure
+
+	require.False(t, output.Passed)
+	require.NotEmpty(t, output.Failures)
+}
+
+func TestApproveWorkflowActivity(t *testing.T) {
+	output, err := ApproveWorkflowActivity(context.Background(), ApproveWorkflowInput{
+		WorkflowID:        "test-workflow-123",
+		RequiredApprovals: 1,
+		TimeoutMinutes:    60,
+	})
+	require.NoError(t, err)
+
+	// Auto-approved
+	require.True(t, output.Approved)
+	require.Equal(t, "system-auto", output.Approver)
+	require.NotEmpty(t, output.Timestamp)
+}

activity/planner.go

@@ -0,0 +1,47 @@
+package activity
+
+import (
+	"context"
+
+	"github.com/rockliang/poimen/workflows/pkg/types"
+)
+
+type PlanningInput struct {
+	Config      types.OrchestratorConfig
+	BoardState  string
+	RepoPath    string
+	Milestone   string
+	TaskResults []types.TaskUnitOutput
+}
+
+type TaskDispatch struct {
+	TaskID      string
+	PromptSpec  types.PromptSpec
+	BaseTimeout *int64
+}
+
+type PlanningOutput struct {
+	TasksToDispatch      []string
+	CompletedBranches    []string
+	SubmilestoneComplete bool
+}
+
+func PlanningActivity(ctx context.Context, in PlanningInput) (PlanningOutput, error) {
+	response, err := CallRoleLLM(ctx, in.Config, "planner", map[string]any{
+		"SystemPrompt": in.Config.SystemPrompt,
+		"BoardState":   in.BoardState,
+		"Milestone":    in.Milestone,
+		"Config":       in.Config,
+	})
+	if err != nil {
+		return PlanningOutput{}, err
+	}
+
+	// TODO: parse LLM response into task dispatch list
+	_ = response
+	return PlanningOutput{
+		TasksToDispatch:      []string{},
+		CompletedBranches:    []string{},
+		SubmilestoneComplete: false,
+	}, nil
+}

activity/query_graph_rag.go

@@ -0,0 +1,101 @@
+package activity
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"time"
+)
+
+// QueryGraphRAGActivity queries Memory System for semantic relations
+func QueryGraphRAGActivity(ctx context.Context, input GraphRAGQueryInput) (GraphRAGQueryOutput, error) {
+	logger := newActivityLogger(ctx)
+	output := GraphRAGQueryOutput{
+		WorkflowID: input.WorkflowID,
+		Query:      input.Query,
+		Edges:      []EdgeWithWording{},
+		Paths:      []QueryPathData{},
+	}
+
+	logger.Info("Querying GraphRAG: %s", input.Query)
+
+	// Get Memory Service URL from env
+	memoryURL := os.Getenv("MEMORY_SERVICE_URL")
+	if memoryURL == "" {
+		memoryURL = "http://localhost:8000"
+	}
+
+	// Build payload for Memory System
+	payload := map[string]interface{}{
+		"workflow_id":      input.WorkflowID,
+		"query":            input.Query,
+		"search_type":      input.SearchType,
+		"relation_type":    input.RelationType,
+		"confidence_floor": input.ConfidenceFloor,
+		"top_k":            input.TopK,
+		"ranking_profile":  input.RankingProfile,
+		"canvas_nodes":     input.Canvas.Nodes,
+		"canvas_edges":     input.Canvas.Edges,
+		"relations":        input.Canvas.Relations,
+	}
+
+	reqBody, err := json.Marshal(payload)
+	if err != nil {
+		return output, fmt.Errorf("failed to marshal payload: %w", err)
+	}
+
+	// Call Memory System unified query endpoint
+	req, err := http.NewRequestWithContext(
+		ctx,
+		"POST",
+		memoryURL+"/workflows/query",
+		bytes.NewReader(reqBody),
+	)
+	if err != nil {
+		return output, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	if token := ctx.Value("jwt_token"); token != nil {
+		req.Header.Set("Authorization", fmt.Sprintf("Bearer %v", token))
+	}
+
+	startTime := time.Now()
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return output, fmt.Errorf("failed to call Memory Service: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		body, _ := io.ReadAll(resp.Body)
+		return output, fmt.Errorf("Memory Service returned %d: %s", resp.StatusCode, string(body))
+	}
+
+	// Parse response
+	var graphResp struct {
+		Edges      []EdgeWithWording `json:"edges"`
+		Paths      []QueryPathData   `json:"paths"`
+		TotalCount int               `json:"total_count"`
+		HasMore    bool              `json:"has_more"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&graphResp); err != nil {
+		return output, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	output.Edges = graphResp.Edges
+	output.Paths = graphResp.Paths
+	output.TotalCount = graphResp.TotalCount
+	output.HasMore = graphResp.HasMore
+	output.ExecutionMs = time.Since(startTime).Milliseconds()
+
+	logger.Info("GraphRAG returned %d edges, %d paths in %dms", 
+		len(output.Edges), len(output.Paths), output.ExecutionMs)
+	return output, nil
+}

activity/router.go

@@ -0,0 +1,89 @@
+package activity
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/rockliang/poimen/workflows/internal/routing"
+	"go.temporal.io/sdk/activity"
+)
+
+// LLMRouterActivity is the Temporal activity that routes user requests to workflows
+func LLMRouterActivity(ctx context.Context, input routing.LLMRouterInput) (*routing.LLMRouterOutput, error) {
+	logger := activity.GetLogger(ctx)
+	logger.Info("LLMRouterActivity started", "message", input.Message)
+
+	// Load knowledge base
+	kb, err := routing.LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		return nil, fmt.Errorf("failed to load knowledge base: %w", err)
+	}
+
+	// Create router
+	router, err := routing.NewLLMRouterDefault(kb)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create router: %w", err)
+	}
+
+	// Route the request
+	output, err := router.Route(ctx, input)
+	if err != nil {
+		logger.Error("LLMRouterActivity failed", "error", err)
+		return nil, err
+	}
+
+	if output.IsCron {
+		logger.Info("LLMRouterActivity completed (cron)", 
+			"workflowName", output.CronSpec.Name,
+			"schedule", output.CronSpec.Schedule,
+			"stateCount", len(output.CronSpec.States))
+	} else {
+		logger.Info("LLMRouterActivity completed", 
+			"workflowName", output.Spec.Name,
+			"stateCount", len(output.Spec.States))
+	}
+
+	return output, nil
+}
+
+// ValidateWorkflowSpecActivity validates a workflow spec before execution
+func ValidateWorkflowSpecActivity(ctx context.Context, spec routing.WorkflowSpec) (*routing.ValidationResult, error) {
+	logger := activity.GetLogger(ctx)
+	logger.Info("ValidateWorkflowSpecActivity started", "workflowName", spec.Name)
+
+	kb, err := routing.LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		return nil, fmt.Errorf("failed to load knowledge base: %w", err)
+	}
+
+	validator := routing.NewValidator(kb)
+	result := validator.ValidateWorkflowSpec(&spec)
+
+	logger.Info("ValidateWorkflowSpecActivity completed", 
+		"valid", result.Valid,
+		"errorCount", len(result.Errors))
+
+	return result, nil
+}
+
+// ValidateCronWorkflowSpecActivity validates a cron workflow spec before scheduling
+func ValidateCronWorkflowSpecActivity(ctx context.Context, spec routing.CronWorkflowSpec) (*routing.ValidationResult, error) {
+	logger := activity.GetLogger(ctx)
+	logger.Info("ValidateCronWorkflowSpecActivity started", 
+		"workflowName", spec.Name,
+		"schedule", spec.Schedule)
+
+	kb, err := routing.LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		return nil, fmt.Errorf("failed to load knowledge base: %w", err)
+	}
+
+	validator := routing.NewValidator(kb)
+	result := validator.ValidateCronWorkflowSpec(&spec)
+
+	logger.Info("ValidateCronWorkflowSpecActivity completed", 
+		"valid", result.Valid,
+		"errorCount", len(result.Errors))
+
+	return result, nil
+}

activity/skills.go

@@ -1,4 +1,4 @@
-package action
+package activity
 
 import (
 	"context"
@@ -10,12 +10,11 @@ import (
 	"time"
 
 	"go.temporal.io/sdk/activity"
-	"github.com/rockliang/poimen/workflows/statemachine"
 )
 
 // PrepareSkillsInput is input to PrepareSkillsActivity.
 type PrepareSkillsInput struct {
-	Skills        []statemachine.SkillRef
+	Skills        []SkillRef
 	StreamTimeout time.Duration
 	Provider      string // pi provider name (e.g. "homelab-reasoning"); required, pi has no usable default provider
 }

activity/types.go

@@ -0,0 +1,21 @@
+package activity
+
+import "github.com/rockliang/poimen/workflows/pkg/types"
+
+// Re-export from pkg/types for convenience within activity package.
+type ModelSpec = types.ModelSpec
+type PromptSpec = types.PromptSpec
+type SkillRef = types.SkillRef
+type OrchestratorConfig = types.OrchestratorConfig
+type TaskUnitOutput = types.TaskUnitOutput
+type EdgeWithWording = types.EdgeWithWording
+type RelationWording = types.RelationWording
+type CanvasWithRelationsData = types.CanvasWithRelationsData
+type FetchCanvasRelationsInput = types.FetchCanvasRelationsInput
+type CanvasReasonerInput = types.CanvasReasonerInput
+type GraphRAGQueryInput = types.GraphRAGQueryInput
+type GraphRAGQueryOutput = types.GraphRAGQueryOutput
+type QueryPathData = types.QueryPathData
+type CanvasCompatibilityInput = types.CanvasCompatibilityInput
+type IndexGraphRAGInput = types.IndexGraphRAGInput
+type IndexGraphRAGOutput = types.IndexGraphRAGOutput

agent-prompts/README.md

@@ -0,0 +1,59 @@
+# Agent Prompts
+
+LLM agent prompts for Poimen RoutingWorkflow.
+
+## Agents
+
+| Agent | Model | Purpose | Prompt File |
+|-------|-------|---------|-------------|
+| **Router** | `reasoning` | Natural language → WorkflowSpec | [router/AGENTS.md](router/AGENTS.md) |
+
+---
+
+## Architecture
+
+```
+User Request: "Scan repo X for security issues"
+     │
+     ▼
+┌─────────────────────────────────────────────────┐
+│            RetrieveMemoryActivity               │
+│  Query poimen-memory for relevant skills/lessons│
+└─────────────────────────────────────────────────┘
+     │
+     ▼
+┌─────────────────────────────────────────────────┐
+│              Router Agent (LLM)                 │
+│  Input: message + memory context + activities   │
+│  Output: WorkflowSpec JSON                      │
+└─────────────────────────────────────────────────┘
+     │
+     ▼
+┌─────────────────────────────────────────────────┐
+│              RoutingWorkflow                    │
+│  Executes WorkflowSpec as state machine         │
+│  Clone → Scan → Report → Notify                 │
+└─────────────────────────────────────────────────┘
+```
+
+---
+
+## Memory Integration
+
+Router receives context from `RetrieveMemoryActivity`:
+
+```
+1. User: "scan repo for security"
+2. RetrieveMemoryActivity queries poimen-memory
+3. Returns: skills, lessons, references
+4. Injected into Router prompt
+5. Router generates smarter WorkflowSpec
+```
+
+---
+
+## LLM Endpoint
+
+Default: `https://api.riotpiao.com/v1/chat/completions`
+
+Override: `LOCAL_LLM_BASE_URL=http://localhost:11434`

agent-prompts/router/AGENTS.md

@@ -0,0 +1,91 @@
+# Router Agent
+
+**Purpose**: Intelligent workflow router that analyzes user requests and generates workflow specs.
+
+**Model**: `reasoning` (via api.riotpiao.com)
+
+**When Used**: User submits natural language request → Router generates WorkflowSpec/CronWorkflowSpec
+
+---
+
+## System Prompt
+
+```
+You are an intelligent workflow router. Your job is to:
+1. Understand what the user wants to accomplish
+2. Select the appropriate activities from the available list
+3. Order them correctly based on dependencies
+4. Extract any parameters mentioned (URLs, branches, etc)
+5. Detect if user wants scheduled/recurring execution
+6. Use any relevant knowledge from memory to inform your decisions
+
+Rules:
+- Always include CloneRepoActivity first if any analysis activity is needed
+- Order activities respecting dependencies
+- If user mentions "daily", "every hour", "weekly", etc → set isCron=true and cronSchedule
+- Common cron patterns: "0 2 * * *" (2 AM daily), "0 * * * *" (hourly), "0 0 * * 0" (weekly Sunday)
+- Extract repo URLs, branch names, severity levels from the message
+- workflowName should be short and descriptive (kebab-case)
+- If memory context includes relevant skills or lessons, incorporate that knowledge
+- Skills from memory may suggest specific activity parameters or ordering
+
+Output ONLY valid JSON.
+```
+
+---
+
+## User Prompt Template
+
+```
+User request: {{.Message}}
+{{if .Context}}
+Provided context: {{.Context}}
+{{end}}
+{{if .MemoryContext}}
+Relevant skills from memory:
+{{range .MemoryContext.Skills}}- {{.Name}}: {{.Description}} (reason: {{.Why}})
+{{end}}
+Relevant knowledge from memory:
+{{range .MemoryContext.Lessons}}- [{{.Level}}] {{.Text}}
+{{end}}
+{{end}}
+Available activities:
+{{range .Activities}}- {{.Name}}: {{.Description}} (category: {{.Category}}, timeout: {{.Timeout}}, flaky: {{.IsFlaky}})
+{{end}}
+Analyze the request and output JSON with:
+- activities: ordered list of activity names to execute
+- parameters: extracted parameters from request (repo URL, branch, etc)
+- isCron: true if user wants scheduled/recurring execution
+- cronSchedule: cron expression if scheduled (e.g., "0 2 * * *" for 2 AM daily)
+- cronTimezone: timezone (default "UTC")
+- workflowName: short descriptive name
+- errorHandling: "retry" (default), "fail-fast", or "continue"
+
+Output ONLY valid JSON, no explanation.
+```
+
+---
+
+## Expected Output Format
+
+```json
+{
+  "activities": ["CloneRepoActivity", "SecurityScanActivity", "GenerateReportActivity"],
+  "parameters": {
+    "repo": "https://github.com/example/repo",
+    "branch": "main",
+    "severity": "high"
+  },
+  "isCron": false,
+  "cronSchedule": "",
+  "cronTimezone": "UTC",
+  "workflowName": "security-scan-example",
+  "errorHandling": "retry"
+}
+```
+
+---
+
+## Source File
+
+`internal/routing/llm_router.go`

cmd/starter/main.go

@@ -2,31 +2,40 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"flag"
 	"fmt"
 	"log"
+	"os"
 	"strings"
 	"time"
 
 	"go.temporal.io/sdk/client"
-	"github.com/rockliang/poimen/workflows/action/llm"
+	"github.com/rockliang/poimen/workflows/activity/llm"
 	"github.com/rockliang/poimen/workflows/internal/config"
 	"github.com/rockliang/poimen/workflows/internal/health"
 	"github.com/rockliang/poimen/workflows/internal/logging"
-	"github.com/rockliang/poimen/workflows/statemachine"
+	"github.com/rockliang/poimen/workflows/internal/routing"
+	"github.com/rockliang/poimen/workflows/workflow"
 )
 
 func main() {
 	var (
+		// Orchestrator flags
 		repoPath         = flag.String("repo", "", "target repo path")
 		remoteURL        = flag.String("remote", "", "remote URL")
 		milestone        = flag.String("milestone", "T0", "milestone ID")
-		dryRun           = flag.Bool("dry-run", false, "disable git push/merge")
+		dryRun           = flag.Bool("dry-run", false, "disable git push/merge (orchestrator) or skip submit (routing)")
 		plannerModel     = flag.String("planner-model", "reasoning", "planner model ID (local-llm)")
 		judgeModel       = flag.String("judge-model", "reasoning", "judge model ID (local-llm)")
 		implementerModel = flag.String("implementer-model", "ornith:35b", "implementer model ID (local-llm ornith)")
 		piProvider       = flag.String("pi-provider", "local-llm", "pi provider name for skills (local-llm)")
 		healthCheck      = flag.Bool("health", false, "check health and exit")
+
+		// Routing workflow flags
+		routeMsg  = flag.String("route", "", "natural language message for LLM routing")
+		specFile  = flag.String("spec", "", "JSON workflow spec file (direct submit, skip LLM)")
+		cronSpec  = flag.Bool("cron", false, "treat spec as CronWorkflowSpec")
 	)
 	flag.Parse()
 
@@ -66,28 +75,34 @@ func main() {
 		return
 	}
 
-	// Validate required flags for workflow start
+	// Handle routing workflow mode
+	if *routeMsg != "" || *specFile != "" {
+		runRoutingWorkflow(c, *routeMsg, *specFile, *cronSpec, *dryRun)
+		return
+	}
+
+	// Validate required flags for orchestrator workflow
 	if *repoPath == "" || *remoteURL == "" {
-		logging.Fatal("--repo and --remote flags are required")
+		logging.Fatal("--repo and --remote flags are required (or use --route/--spec for routing workflow)")
 	}
 
 
 
 	// Build OrchestratorInput
-	input := statemachine.OrchestratorInput{
+	input := workflow.OrchestratorInput{
 		TargetRepoPath:     *repoPath,
 		RemoteURL:          *remoteURL,
 		Milestone:          *milestone,
 		DryRun:             *dryRun,
 		MaxCyclesBeforeCAN: 100,
 		PiProvider:         *piProvider,
-		Config: statemachine.OrchestratorConfig{
+		Config: workflow.OrchestratorConfig{
 			SystemPrompt: "You are an expert software developer orchestrating multi-agent work.",
-			Skills:       []statemachine.SkillRef{},
-			RolePrompts: map[string]statemachine.PromptSpec{
+			Skills:       []workflow.SkillRef{},
+			RolePrompts: map[string]workflow.PromptSpec{
 				"planner": {
 					TemplateRef: "planner/default.tmpl",
-					Model: statemachine.ModelSpec{
+					Model: workflow.ModelSpec{
 						ModelID:  *plannerModel,
 						Thinking: "adaptive",
 						Effort:   "high",
@@ -95,7 +110,7 @@ func main() {
 				},
 				"judge": {
 					TemplateRef: "judge/default.tmpl",
-					Model: statemachine.ModelSpec{
+					Model: workflow.ModelSpec{
 						ModelID:  *judgeModel,
 						Thinking: "adaptive",
 						Effort:   "high",
@@ -103,12 +118,12 @@ func main() {
 				},
 				"implementer": {
 					TemplateRef: "implementer/default.tmpl",
-					Model: statemachine.ModelSpec{
+					Model: workflow.ModelSpec{
 						ModelID: *implementerModel,
 					},
 				},
 			},
-			Tuning: statemachine.NewActivityTuning(),
+			Tuning: workflow.NewActivityTuning(),
 		},
 	}
 
@@ -129,7 +144,7 @@ func main() {
 	run, err := c.ExecuteWorkflow(context.Background(), client.StartWorkflowOptions{
 		ID:        workflowID,
 		TaskQueue: "poimen-taskqueue",
-	}, statemachine.OrchestratorWorkflow, input)
+	}, workflow.OrchestratorWorkflow, input)
 	if err != nil {
 		logging.Fatal("failed to start workflow", logging.Err(err))
 	}
@@ -149,7 +164,7 @@ func main() {
 	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
 	defer cancel()
 
-	var result statemachine.OrchestratorOutput
+	var result workflow.OrchestratorOutput
 	if err := run.Get(ctx, &result); err != nil {
 		fmt.Printf("\nWorkflow initiated (execution in progress).\n")
 		fmt.Printf("Check the Web UI for real-time status updates.\n")
@@ -157,3 +172,128 @@ func main() {
 		fmt.Printf("\nWorkflow completed: %+v\n", result)
 	}
 }
+
+// runRoutingWorkflow handles --route and --spec flags
+func runRoutingWorkflow(c client.Client, routeMsg, specFile string, isCron, dryRun bool) {
+	ctx := context.Background()
+
+	var spec *routing.WorkflowSpec
+	var cronSpec *routing.CronWorkflowSpec
+
+	if specFile != "" {
+		// Load spec from file
+		data, err := os.ReadFile(specFile)
+		if err != nil {
+			logging.Fatal("failed to read spec file", logging.Err(err))
+		}
+
+		validator := routing.NewValidator(nil) // nil KB = skip activity validation
+		if isCron {
+			cronSpec = &routing.CronWorkflowSpec{}
+			if err := json.Unmarshal(data, cronSpec); err != nil {
+				logging.Fatal("failed to parse cron spec", logging.Err(err))
+			}
+			// Validate
+			result := validator.ValidateCronWorkflowSpec(cronSpec)
+			if !result.Valid {
+				logging.Fatal("invalid cron spec", logging.String("errors", result.String()))
+			}
+		} else {
+			spec = &routing.WorkflowSpec{}
+			if err := json.Unmarshal(data, spec); err != nil {
+				logging.Fatal("failed to parse spec", logging.Err(err))
+			}
+			// Validate
+			result := validator.ValidateWorkflowSpec(spec)
+			if !result.Valid {
+				logging.Fatal("invalid spec", logging.String("errors", result.String()))
+			}
+		}
+	} else {
+		// Use LLM router
+		logging.Info("routing message via LLM", logging.String("message", routeMsg))
+
+		kb, err := routing.LoadKnowledgeBaseFromDefaultPath()
+		if err != nil {
+			logging.Fatal("failed to load knowledge base", logging.Err(err))
+		}
+
+		router, err := routing.NewLLMRouterDefault(kb)
+		if err != nil {
+			logging.Fatal("failed to create LLM router", logging.Err(err))
+		}
+
+		output, err := router.Route(ctx, routing.LLMRouterInput{Message: routeMsg})
+		if err != nil {
+			logging.Fatal("LLM routing failed", logging.Err(err))
+		}
+
+		if output.IsCron {
+			cronSpec = output.CronSpec
+			fmt.Printf("\n=== Generated Cron Spec ===\n")
+			fmt.Printf("Name: %s\n", cronSpec.Name)
+			fmt.Printf("Schedule: %s\n", cronSpec.Schedule)
+			fmt.Printf("States: %d\n", len(cronSpec.States))
+		} else {
+			spec = output.Spec
+			fmt.Printf("\n=== Generated Workflow Spec ===\n")
+			fmt.Printf("Name: %s\n", spec.Name)
+			fmt.Printf("States: %d\n", len(spec.States))
+		}
+	}
+
+	if dryRun {
+		fmt.Printf("\n[dry-run] Spec generated but not submitted\n")
+		if spec != nil {
+			data, _ := json.MarshalIndent(spec, "", "  ")
+			fmt.Printf("%s\n", data)
+		} else if cronSpec != nil {
+			data, _ := json.MarshalIndent(cronSpec, "", "  ")
+			fmt.Printf("%s\n", data)
+		}
+		return
+	}
+
+	// Submit to Temporal
+	if cronSpec != nil {
+		// For cron, we'd use Temporal's schedule feature
+		// For now, just start as regular workflow (cron scheduling TBD)
+		spec = &routing.WorkflowSpec{
+			Name:   cronSpec.Name,
+			Input:  cronSpec.Input,
+			States: cronSpec.States,
+		}
+		logging.Warn("cron scheduling not yet implemented, running as one-shot workflow")
+	}
+
+	workflowID := "routing-" + spec.Name + "-" + time.Now().Format("20060102-150405")
+	input := workflow.RoutingWorkflowInput{Spec: spec}
+
+	run, err := c.ExecuteWorkflow(ctx, client.StartWorkflowOptions{
+		ID:        workflowID,
+		TaskQueue: "poimen-taskqueue",
+	}, workflow.RoutingWorkflow, input)
+	if err != nil {
+		logging.Fatal("failed to start routing workflow", logging.Err(err))
+	}
+
+	fmt.Printf("\n=== Routing Workflow Started ===\n")
+	fmt.Printf("Workflow ID: %s\n", workflowID)
+	fmt.Printf("Run ID: %s\n", run.GetRunID())
+
+	// Wait briefly for result
+	waitCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	var result workflow.RoutingWorkflowOutput
+	if err := run.Get(waitCtx, &result); err != nil {
+		fmt.Printf("\nWorkflow running (check Temporal UI for status)\n")
+	} else {
+		fmt.Printf("\nWorkflow completed: %s\n", result.Status)
+		if len(result.StepResults) > 0 {
+			for step, res := range result.StepResults {
+				fmt.Printf("  %s: %v\n", step, res)
+			}
+		}
+	}
+}

cmd/worker/main.go

@@ -11,11 +11,11 @@ import (
 
 	"go.temporal.io/sdk/client"
 	"go.temporal.io/sdk/worker"
-	"github.com/rockliang/poimen/workflows/action"
+	"github.com/rockliang/poimen/workflows/activity"
 	"github.com/rockliang/poimen/workflows/internal/config"
 	"github.com/rockliang/poimen/workflows/internal/health"
 	"github.com/rockliang/poimen/workflows/internal/logging"
-	"github.com/rockliang/poimen/workflows/statemachine"
+	"github.com/rockliang/poimen/workflows/workflow"
 )
 
 func main() {
@@ -48,25 +48,56 @@ func main() {
 	}
 
 	// Register all workflows
-	w.RegisterWorkflow(statemachine.OrchestratorWorkflow)
-	w.RegisterWorkflow(statemachine.TaskUnitWorkflow)
-	w.RegisterWorkflow(statemachine.TestWorkflow)
+	w.RegisterWorkflow(workflow.OrchestratorWorkflow)
+	w.RegisterWorkflow(workflow.TaskUnitWorkflow)
+	w.RegisterWorkflow(workflow.TestWorkflow)
+	w.RegisterWorkflow(workflow.RoutingWorkflow)
+	w.RegisterWorkflow(workflow.WorkflowGraphQuery)
 
 	// Register all activities
-	w.RegisterActivity(action.CloneRepoActivity)
-	w.RegisterActivity(action.GitWorktreeAddActivity)
-	w.RegisterActivity(action.GitCommitActivity)
-	w.RegisterActivity(action.GitPushActivity)
-	w.RegisterActivity(action.GitSquashMergeActivity)
-	w.RegisterActivity(action.GitDiffActivity)
-	w.RegisterActivity(action.PrepareSkillsActivity)
-	w.RegisterActivity(action.PlanningActivity)
-	w.RegisterActivity(action.ImplementerActivity)
-	w.RegisterActivity(action.JudgeActivity)
+	w.RegisterActivity(activity.CloneRepoActivity)
+	w.RegisterActivity(activity.GitWorktreeAddActivity)
+	w.RegisterActivity(activity.GitCommitActivity)
+	w.RegisterActivity(activity.GitPushActivity)
+	w.RegisterActivity(activity.GitSquashMergeActivity)
+	w.RegisterActivity(activity.GitDiffActivity)
+	w.RegisterActivity(activity.PrepareSkillsActivity)
+	w.RegisterActivity(activity.PlanningActivity)
+	w.RegisterActivity(activity.ImplementerActivity)
+	w.RegisterActivity(activity.JudgeActivity)
 	// Integration and lessons activities - register when fully tested
-	w.RegisterActivity(action.RunIntegrationTestActivity)
-	// w.RegisterActivity(action.UpdateLessonsActivity)
-	// w.RegisterActivity(action.ReadLessonsActivity)
+	w.RegisterActivity(activity.RunIntegrationTestActivity)
+	// w.RegisterActivity(activity.UpdateLessonsActivity)
+	// w.RegisterActivity(activity.ReadLessonsActivity)
+
+	// Routing workflow activities
+	w.RegisterActivity(activity.LLMRouterActivity)
+	w.RegisterActivity(activity.ValidateWorkflowSpecActivity)
+	w.RegisterActivity(activity.ValidateCronWorkflowSpecActivity)
+
+	// Analysis activities
+	w.RegisterActivity(activity.AnalyzeCodeActivity)
+	w.RegisterActivity(activity.SecurityScanActivity)
+	w.RegisterActivity(activity.GenerateReportActivity)
+
+	// Notification and utility activities
+	w.RegisterActivity(activity.NotifyStatusActivity)
+	w.RegisterActivity(activity.ArchiveResultsActivity)
+	w.RegisterActivity(activity.DeploymentPreCheckActivity)
+	w.RegisterActivity(activity.ApproveWorkflowActivity)
+
+	// Authentication activities
+	w.RegisterActivity(activity.AssumeRoleActivity)
+
+	// Memory activities
+	w.RegisterActivity(activity.RetrieveMemoryActivity)
+
+	// GraphRAG activities
+	w.RegisterActivity(activity.FetchCanvasRelationsActivity)
+	w.RegisterActivity(activity.QueryGraphRAGActivity)
+	w.RegisterActivity(activity.CanvasReasonerActivity)
+	w.RegisterActivity(activity.IndexGraphRAGActivity)
+	w.RegisterActivity(activity.CanvasCompatibilityActivity)
 
 	// Initialize health checker
 	healthChecker := health.NewChecker(c)
@@ -96,7 +127,7 @@ func main() {
 	// Run worker in a goroutine
 	workerErrChan := make(chan error, 1)
 	go func() {
-		logging.Info("starting worker on queue", logging.String("queue", "poimen-taskqueue"))
+		logging.Info("starting worker", logging.String("queue", "poimen"))
 		if err := w.Run(worker.InterruptCh()); err != nil {
 			workerErrChan <- err
 		}

examples/service_integration.go

@@ -0,0 +1,234 @@
+// Example: External service integrating with Poimen RoutingWorkflow
+// Shows how to submit a task and wait for completion
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"time"
+
+	"go.temporal.io/sdk/client"
+)
+
+// ---- Types (mirror internal/routing/types.go) ----
+
+type WorkflowSpec struct {
+	Name   string                 `json:"name"`
+	Input  map[string]interface{} `json:"input,omitempty"`
+	States []State                `json:"states"`
+}
+
+type State struct {
+	Name       string                 `json:"name"`
+	Type       string                 `json:"type"` // Task, Pass, Fail
+	Resource   string                 `json:"resource,omitempty"`
+	Parameters map[string]interface{} `json:"parameters,omitempty"`
+	Timeout    string                 `json:"timeout,omitempty"`
+	Next       string                 `json:"next,omitempty"`
+	End        bool                   `json:"end,omitempty"`
+}
+
+type RoutingWorkflowInput struct {
+	Spec *WorkflowSpec `json:"spec"`
+}
+
+type RoutingWorkflowOutput struct {
+	Status      string                            `json:"status"`
+	StepResults map[string]map[string]interface{} `json:"stepResults"`
+	Error       string                            `json:"error,omitempty"`
+}
+
+// ---- Example Service ----
+
+type TaskService struct {
+	temporalClient client.Client
+	taskQueue      string
+}
+
+func NewTaskService(temporalHost, namespace, taskQueue string) (*TaskService, error) {
+	c, err := client.Dial(client.Options{
+		HostPort:  temporalHost,
+		Namespace: namespace,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect to Temporal: %w", err)
+	}
+
+	return &TaskService{
+		temporalClient: c,
+		taskQueue:      taskQueue,
+	}, nil
+}
+
+func (s *TaskService) Close() {
+	s.temporalClient.Close()
+}
+
+// SubmitAndWait submits a workflow spec and waits for completion
+func (s *TaskService) SubmitAndWait(ctx context.Context, spec *WorkflowSpec, timeout time.Duration) (*RoutingWorkflowOutput, error) {
+	workflowID := fmt.Sprintf("%s-%d", spec.Name, time.Now().UnixNano())
+
+	// Start workflow
+	run, err := s.temporalClient.ExecuteWorkflow(ctx, client.StartWorkflowOptions{
+		ID:        workflowID,
+		TaskQueue: s.taskQueue,
+	}, "RoutingWorkflow", RoutingWorkflowInput{Spec: spec})
+	if err != nil {
+		return nil, fmt.Errorf("failed to start workflow: %w", err)
+	}
+
+	log.Printf("Workflow started: ID=%s, RunID=%s", run.GetID(), run.GetRunID())
+
+	// Wait for completion with timeout
+	waitCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	var result RoutingWorkflowOutput
+	if err := run.Get(waitCtx, &result); err != nil {
+		return nil, fmt.Errorf("workflow failed: %w", err)
+	}
+
+	return &result, nil
+}
+
+// SubmitAsync submits workflow and returns immediately (fire-and-forget)
+func (s *TaskService) SubmitAsync(ctx context.Context, spec *WorkflowSpec) (workflowID string, runID string, err error) {
+	workflowID = fmt.Sprintf("%s-%d", spec.Name, time.Now().UnixNano())
+
+	run, err := s.temporalClient.ExecuteWorkflow(ctx, client.StartWorkflowOptions{
+		ID:        workflowID,
+		TaskQueue: s.taskQueue,
+	}, "RoutingWorkflow", RoutingWorkflowInput{Spec: spec})
+	if err != nil {
+		return "", "", fmt.Errorf("failed to start workflow: %w", err)
+	}
+
+	return run.GetID(), run.GetRunID(), nil
+}
+
+// WaitForCompletion waits for an existing workflow to complete
+func (s *TaskService) WaitForCompletion(ctx context.Context, workflowID string, timeout time.Duration) (*RoutingWorkflowOutput, error) {
+	run := s.temporalClient.GetWorkflow(ctx, workflowID, "")
+
+	waitCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	var result RoutingWorkflowOutput
+	if err := run.Get(waitCtx, &result); err != nil {
+		return nil, fmt.Errorf("workflow failed: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetStatus gets current workflow status without waiting
+func (s *TaskService) GetStatus(ctx context.Context, workflowID string) (string, error) {
+	desc, err := s.temporalClient.DescribeWorkflowExecution(ctx, workflowID, "")
+	if err != nil {
+		return "", err
+	}
+	return desc.WorkflowExecutionInfo.Status.String(), nil
+}
+
+// ---- Example Usage ----
+
+func main() {
+	// Connect to Temporal
+	svc, err := NewTaskService(
+		"temporal-frontend.temporal:7233",
+		"poimen-harness",
+		"poimen-taskqueue",
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer svc.Close()
+
+	ctx := context.Background()
+
+	// Example 1: Implement task T0.3 with code analysis
+	fmt.Println("=== Example 1: Submit and Wait ===")
+	spec := &WorkflowSpec{
+		Name: "implement-T0.3",
+		Input: map[string]interface{}{
+			"taskId":      "T0.3",
+			"description": "Implement git worktree management",
+			"repo":        "https://github.com/rockliang/poimen",
+		},
+		States: []State{
+			{
+				Name:     "Clone",
+				Type:     "Task",
+				Resource: "CloneRepoActivity",
+				Parameters: map[string]interface{}{
+					"repo":   "${workflow.input.repo}",
+					"branch": "main",
+				},
+				Timeout: "5m",
+				Next:    "Analyze",
+			},
+			{
+				Name:     "Analyze",
+				Type:     "Task",
+				Resource: "AnalyzeCodeActivity",
+				Parameters: map[string]interface{}{
+					"path":  "${Clone.output.path}",
+					"depth": 3,
+				},
+				Timeout: "10m",
+				Next:    "Report",
+			},
+			{
+				Name:     "Report",
+				Type:     "Task",
+				Resource: "GenerateReportActivity",
+				Parameters: map[string]interface{}{
+					"analysisResult": "${Analyze.output}",
+					"format":         "markdown",
+				},
+				Timeout: "2m",
+				End:     true,
+			},
+		},
+	}
+
+	result, err := svc.SubmitAndWait(ctx, spec, 30*time.Minute)
+	if err != nil {
+		log.Printf("Error: %v", err)
+	} else {
+		fmt.Printf("Status: %s\n", result.Status)
+		for step, output := range result.StepResults {
+			fmt.Printf("  %s: %v\n", step, output)
+		}
+	}
+
+	// Example 2: Fire and forget, then poll
+	fmt.Println("\n=== Example 2: Async Submit + Poll ===")
+	workflowID, runID, err := svc.SubmitAsync(ctx, spec)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Printf("Submitted: workflowID=%s, runID=%s\n", workflowID, runID)
+
+	// Poll status
+	for i := 0; i < 5; i++ {
+		status, _ := svc.GetStatus(ctx, workflowID)
+		fmt.Printf("  Poll %d: status=%s\n", i+1, status)
+		if status == "WORKFLOW_EXECUTION_STATUS_COMPLETED" {
+			break
+		}
+		time.Sleep(5 * time.Second)
+	}
+
+	// Get final result
+	result, err = svc.WaitForCompletion(ctx, workflowID, 30*time.Minute)
+	if err != nil {
+		log.Printf("Error: %v", err)
+	} else {
+		resultJSON, _ := json.MarshalIndent(result, "", "  ")
+		fmt.Printf("Final result:\n%s\n", resultJSON)
+	}
+}

examples/wait_for_task_test.go

@@ -0,0 +1,122 @@
+// Example: WaitForTaskComplete pattern
+// Use case: External service submits implementation task, waits for result
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"go.temporal.io/sdk/client"
+)
+
+// WaitForTaskComplete - the core pattern
+//
+// 1. Build workflow spec for the task
+// 2. Submit to Temporal
+// 3. Block until completion or timeout
+// 4. Return result
+func WaitForTaskComplete(
+	c client.Client,
+	taskID string,
+	repo string,
+	timeout time.Duration,
+) (map[string]interface{}, error) {
+
+	ctx := context.Background()
+
+	// Build spec for implementation task
+	spec := map[string]interface{}{
+		"name": fmt.Sprintf("implement-%s", taskID),
+		"input": map[string]interface{}{
+			"taskId": taskID,
+			"repo":   repo,
+		},
+		"states": []map[string]interface{}{
+			{
+				"name":     "Clone",
+				"type":     "Task",
+				"resource": "CloneRepoActivity",
+				"parameters": map[string]interface{}{
+					"repo": repo,
+				},
+				"next": "Analyze",
+			},
+			{
+				"name":     "Analyze",
+				"type":     "Task",
+				"resource": "AnalyzeCodeActivity",
+				"parameters": map[string]interface{}{
+					"path": "${Clone.output.path}",
+				},
+				"next": "SecurityScan",
+			},
+			{
+				"name":     "SecurityScan",
+				"type":     "Task",
+				"resource": "SecurityScanActivity",
+				"parameters": map[string]interface{}{
+					"path": "${Clone.output.path}",
+				},
+				"next": "Report",
+			},
+			{
+				"name":     "Report",
+				"type":     "Task",
+				"resource": "GenerateReportActivity",
+				"parameters": map[string]interface{}{
+					"analysisResult": "${Analyze.output}",
+					"securityResult": "${SecurityScan.output}",
+				},
+				"end": true,
+			},
+		},
+	}
+
+	// Submit workflow
+	workflowID := fmt.Sprintf("%s-%d", taskID, time.Now().UnixNano())
+	run, err := c.ExecuteWorkflow(ctx, client.StartWorkflowOptions{
+		ID:        workflowID,
+		TaskQueue: "poimen-taskqueue",
+	}, "RoutingWorkflow", map[string]interface{}{"spec": spec})
+	if err != nil {
+		return nil, fmt.Errorf("submit failed: %w", err)
+	}
+
+	fmt.Printf("[%s] Workflow started: %s\n", taskID, workflowID)
+
+	// Wait for completion
+	waitCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	var result map[string]interface{}
+	if err := run.Get(waitCtx, &result); err != nil {
+		return nil, fmt.Errorf("workflow failed: %w", err)
+	}
+
+	fmt.Printf("[%s] Workflow completed: %s\n", taskID, result["status"])
+	return result, nil
+}
+
+// Example usage in another service:
+//
+//   func (s *MyService) ImplementTask(taskID string) error {
+//       c, _ := client.Dial(client.Options{
+//           HostPort:  "temporal-frontend.temporal:7233",
+//           Namespace: "poimen-harness",
+//       })
+//       defer c.Close()
+//
+//       result, err := WaitForTaskComplete(c, taskID, "https://github.com/...", 30*time.Minute)
+//       if err != nil {
+//           return err
+//       }
+//
+//       // Process result
+//       if result["status"] == "COMPLETED" {
+//           report := result["stepResults"].(map[string]interface{})["Report"]
+//           // Use report...
+//       }
+//       return nil
+//   }

go.mod

@@ -1,8 +1,10 @@
 module github.com/rockliang/poimen/workflows
 
-go 1.25.4
+go 1.26.0
 
 require (
+	github.com/google/uuid v1.6.0
+	github.com/lib/pq v1.12.3
 	github.com/prometheus/client_golang v1.24.1
 	github.com/stretchr/testify v1.12.1
 	go.temporal.io/sdk v1.48.0
@@ -16,7 +18,6 @@ require (
 	github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/mock v1.6.0 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

go.sum

@@ -32,6 +32,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
+github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nexus-rpc/nexus-proto-annotations v0.1.0 h1:2fELd+9sqUtNu6Fg//pw8YFsxOvp8vZ8hfP0nHhNI80=

internal/approval/gate_test.go

@@ -47,7 +47,9 @@ func TestGetPendingGates(t *testing.T) {
 	pending := manager.GetPendingGates()
 	assert.Equal(t, 1, len(pending))
 	if len(pending) > 0 {
-		assert.Equal(t, gate2.ID, pending[0].ID)
+		// Don't rely on map iteration order - just check it's the unapproved gate
+		assert.Equal(t, StatusPending, pending[0].Decision.Status)
+		assert.Equal(t, gate2.ID, pending[0].ID) // gate2 is the only pending one
 	}
 }
 

internal/memory/activities.go

@@ -0,0 +1,288 @@
+package memory
+
+import (
+	"context"
+	"fmt"
+
+	"go.temporal.io/sdk/activity"
+)
+
+// Activities memory service activities for Temporal workflows
+type Activities struct {
+	service *Service
+}
+
+// NewActivities creates memory service activities
+func NewActivities(service *Service) *Activities {
+	return &Activities{
+		service: service,
+	}
+}
+
+// CreateKnowledgeActivity creates knowledge record from workflow execution
+func (a *Activities) CreateKnowledgeActivity(ctx context.Context, record *KnowledgeRecord) (string, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Creating knowledge", "title", record.Title)
+
+	id, err := a.service.CreateKnowledge(ctx, record)
+	if err != nil {
+		logger.Error("Failed to create knowledge", "error", err)
+		return "", err
+	}
+
+	logger.Info("Knowledge created", "id", id)
+	return id, nil
+}
+
+// UpdateKnowledgeActivity updates existing knowledge record
+func (a *Activities) UpdateKnowledgeActivity(ctx context.Context, record *KnowledgeRecord) (string, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Updating knowledge", "id", record.ID)
+
+	id, err := a.service.UpdateKnowledge(ctx, record)
+	if err != nil {
+		logger.Error("Failed to update knowledge", "error", err)
+		return "", err
+	}
+
+	logger.Info("Knowledge updated", "id", id)
+	return id, nil
+}
+
+// SearchKnowledgeActivity searches knowledge base
+func (a *Activities) SearchKnowledgeActivity(ctx context.Context, query string, opts *RetrievalOptions) ([]KnowledgeRecord, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Searching knowledge", "query", query)
+
+	records, err := a.service.RetrieveKnowledge(ctx, query, opts)
+	if err != nil {
+		logger.Error("Search failed", "error", err)
+		return nil, err
+	}
+
+	logger.Info("Found records", "count", len(records))
+	return records, nil
+}
+
+// GetContextActivity retrieves context for tool/task (three-tier retrieval)
+func (a *Activities) GetContextActivity(ctx context.Context, tool, task string, budget int) (*ServiceContext, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Getting context", "tool", tool, "task", task)
+
+	svcCtx, err := a.service.RetrieveContext(ctx, tool, task, budget)
+	if err != nil {
+		logger.Error("Get context failed", "error", err)
+		return nil, err
+	}
+
+	logger.Info("Retrieved context", "tier", svcCtx.Tier, "lessons", len(svcCtx.Lessons))
+	return svcCtx, nil
+}
+
+// GetVaultActivity lists vault files
+func (a *Activities) GetVaultActivity(ctx context.Context) ([]VaultInfo, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Fetching vault")
+
+	files, err := a.service.GetVault(ctx)
+	if err != nil {
+		logger.Error("Get vault failed", "error", err)
+		return nil, err
+	}
+
+	logger.Info("Vault files", "count", len(files))
+	return files, nil
+}
+
+// HealthCheckActivity checks memory service health
+func (a *Activities) HealthCheckActivity(ctx context.Context) (bool, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Checking memory service health")
+
+	if !a.service.IsHealthy(ctx) {
+		logger.Warn("Memory service is unhealthy")
+		return false, fmt.Errorf("memory service unhealthy")
+	}
+
+	logger.Info("Memory service is healthy")
+	return true, nil
+}
+
+// LearnFromExecutionActivity learns from task execution result
+func (a *Activities) LearnFromExecutionActivity(ctx context.Context, taskID string, result string, tags []string) (string, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Learning from task execution", "taskID", taskID)
+
+	metadata := map[string]interface{}{
+		"task_id": taskID,
+		"type":    "execution_result",
+	}
+
+	if len(tags) > 0 {
+		metadata["tags"] = tags
+	}
+
+	id, err := a.service.CreateKnowledge(ctx, &KnowledgeRecord{
+		Level:    "L1",
+		Title:    fmt.Sprintf("Task Execution: %s", taskID),
+		Content:  result,
+		Source:   fmt.Sprintf("workflow://task/%s", taskID),
+		Metadata: metadata,
+	})
+
+	if err != nil {
+		logger.Error("Failed to learn from execution", "error", err)
+		return "", err
+	}
+
+	logger.Info("Learned from execution", "id", id)
+	return id, nil
+}
+
+// DiagnoseIssueActivity diagnoses issue using memory context
+func (a *Activities) DiagnoseIssueActivity(ctx context.Context, tool, issue string) ([]string, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Diagnosing issue", "tool", tool, "issue", issue)
+
+	svcCtx, err := a.service.RetrieveContext(ctx, tool, issue, 8192)
+	if err != nil {
+		logger.Error("Diagnosis failed", "error", err)
+		return nil, err
+	}
+
+	// Extract recommendations
+	recommendations := make([]string, 0)
+
+	// Add tier-1 lessons (highest confidence)
+	for _, lesson := range svcCtx.Lessons {
+		if lesson.Tier == 1 {
+			recommendations = append(recommendations, fmt.Sprintf("[Tier 1] %s", lesson.Text))
+		}
+	}
+
+	// Add skills
+	for _, skill := range svcCtx.Skills {
+		recommendations = append(recommendations, fmt.Sprintf("[Skill] %s: %s", skill.Name, skill.Why))
+	}
+
+	// Add tier-2 lessons if no tier-1
+	if len(recommendations) == 0 {
+		for _, lesson := range svcCtx.Lessons {
+			if lesson.Tier == 2 {
+				recommendations = append(recommendations, fmt.Sprintf("[Tier 2] %s", lesson.Text))
+			}
+		}
+	}
+
+	logger.Info("Generated recommendations", "count", len(recommendations))
+	return recommendations, nil
+}
+
+// AnalyzeErrorActivity analyzes error and retrieves relevant knowledge
+func (a *Activities) AnalyzeErrorActivity(ctx context.Context, errorMsg string) ([]KnowledgeRecord, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Analyzing error")
+
+	// Search for relevant knowledge
+	records, err := a.service.RetrieveKnowledge(ctx, errorMsg, &RetrievalOptions{
+		Limit:       10,
+		LevelFilter: []string{"L1", "L2"},
+		Floor:       0.6,
+	})
+
+	if err != nil {
+		logger.Error("Error analysis failed", "error", err)
+		return nil, err
+	}
+
+	logger.Info("Found relevant records for error", "count", len(records))
+	return records, nil
+}
+
+// DocumentDecisionActivity documents workflow decision in knowledge base
+func (a *Activities) DocumentDecisionActivity(ctx context.Context, decisionType string, decision string, reasoning string) (string, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Documenting decision", "type", decisionType)
+
+	content := fmt.Sprintf("Decision: %s\n\nReasoning: %s", decision, reasoning)
+
+	id, err := a.service.CreateKnowledge(ctx, &KnowledgeRecord{
+		Level:   "L2",
+		Title:   fmt.Sprintf("Decision: %s", decisionType),
+		Content: content,
+		Source:  fmt.Sprintf("workflow://decision/%s", decisionType),
+		Metadata: map[string]interface{}{
+			"decision_type": decisionType,
+			"type":          "workflow_decision",
+		},
+	})
+
+	if err != nil {
+		logger.Error("Failed to document decision", "error", err)
+		return "", err
+	}
+
+	logger.Info("Decision documented", "id", id)
+	return id, nil
+}
+
+// SearchAndApplyActivity searches knowledge and applies it
+func (a *Activities) SearchAndApplyActivity(ctx context.Context, query string, selector func(record *KnowledgeRecord) bool) ([]string, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Searching and applying", "query", query)
+
+	records, err := a.service.RetrieveKnowledge(ctx, query, &RetrievalOptions{
+		Limit: 10,
+		Floor: 0.7,
+	})
+
+	if err != nil {
+		logger.Error("Search and apply failed", "error", err)
+		return nil, err
+	}
+
+	applied := make([]string, 0)
+	for _, record := range records {
+		if selector == nil || selector(&record) {
+			applied = append(applied, record.Content)
+			logger.Info("Applied knowledge", "id", record.ID)
+		}
+	}
+
+	logger.Info("Applied knowledge records", "count", len(applied))
+	return applied, nil
+}
+
+// RefreshMemoryActivity refreshes memory context (periodic activity)
+func (a *Activities) RefreshMemoryActivity(ctx context.Context) (map[string]interface{}, error) {
+	logger := activity.GetLogger(ctx)
+
+	logger.Info("Refreshing memory context")
+
+	vault, err := a.service.GetVault(ctx)
+	if err != nil {
+		logger.Error("Memory refresh failed", "error", err)
+		return nil, err
+	}
+
+	healthy := a.service.IsHealthy(ctx)
+
+	result := map[string]interface{}{
+		"vault_files": len(vault),
+		"healthy":     healthy,
+	}
+
+	logger.Info("Memory refreshed", "vault_files", len(vault), "healthy", healthy)
+	return result, nil
+}

internal/memory/activities_test.go

@@ -0,0 +1,351 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"go.temporal.io/sdk/testsuite"
+)
+
+func TestActivityCreateKnowledge(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(IngestResponse{ID: "chunk-123"})
+	}))
+	defer server.Close()
+
+	suite := &testsuite.WorkflowTestSuite{}
+	env := suite.NewTestActivityEnvironment()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	activities := NewActivities(svc)
+
+	env.RegisterActivity(activities.CreateKnowledgeActivity)
+
+	record := &KnowledgeRecord{
+		Level:   "L1",
+		Content: "test",
+	}
+
+	result, err := env.ExecuteActivity(activities.CreateKnowledgeActivity, record)
+
+	if err != nil {
+		t.Fatalf("activity failed: %v", err)
+	}
+
+	var id string
+	if err := result.Get(&id); err != nil {
+		t.Fatalf("get result failed: %v", err)
+	}
+
+	if id != "chunk-123" {
+		t.Errorf("expected chunk-123, got %s", id)
+	}
+}
+
+func TestActivitySearchKnowledge(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(QueryResponse{
+			Results: []QueryResult{
+				{
+					ID:   "chunk-123",
+					Text: "matching knowledge",
+				},
+			},
+		})
+	}))
+	defer server.Close()
+
+	suite := &testsuite.WorkflowTestSuite{}
+	env := suite.NewTestActivityEnvironment()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	activities := NewActivities(svc)
+
+	env.RegisterActivity(activities.SearchKnowledgeActivity)
+
+	result, err := env.ExecuteActivity(activities.SearchKnowledgeActivity, "test query", nil)
+
+	if err != nil {
+		t.Fatalf("activity failed: %v", err)
+	}
+
+	var records []KnowledgeRecord
+	if err := result.Get(&records); err != nil {
+		t.Fatalf("get result failed: %v", err)
+	}
+
+	if len(records) != 1 {
+		t.Errorf("expected 1 record, got %d", len(records))
+	}
+}
+
+func TestActivityGetContext(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(ContextResponse{
+			Tier: 1,
+			Lessons: []ContextLesson{
+				{
+					Tier: 1,
+					Text: "lesson text",
+				},
+			},
+		})
+	}))
+	defer server.Close()
+
+	suite := &testsuite.WorkflowTestSuite{}
+	env := suite.NewTestActivityEnvironment()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	activities := NewActivities(svc)
+
+	env.RegisterActivity(activities.GetContextActivity)
+
+	result, err := env.ExecuteActivity(activities.GetContextActivity, "kubectl", "debug", 8192)
+
+	if err != nil {
+		t.Fatalf("activity failed: %v", err)
+	}
+
+	var ctx *ServiceContext
+	if err := result.Get(&ctx); err != nil {
+		t.Fatalf("get result failed: %v", err)
+	}
+
+	if ctx.Tier != 1 {
+		t.Errorf("expected tier 1, got %d", ctx.Tier)
+	}
+
+	if len(ctx.Lessons) != 1 {
+		t.Errorf("expected 1 lesson, got %d", len(ctx.Lessons))
+	}
+}
+
+func TestActivityDiagnoseIssue(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(ContextResponse{
+			Tier: 1,
+			Lessons: []ContextLesson{
+				{
+					Tier: 1,
+					Text: "diagnosis: check logs",
+				},
+			},
+			Skills: []ContextSkill{
+				{
+					Name: "debug-skill",
+					Why:  "matched",
+				},
+			},
+		})
+	}))
+	defer server.Close()
+
+	suite := &testsuite.WorkflowTestSuite{}
+	env := suite.NewTestActivityEnvironment()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	activities := NewActivities(svc)
+
+	env.RegisterActivity(activities.DiagnoseIssueActivity)
+
+	result, err := env.ExecuteActivity(activities.DiagnoseIssueActivity, "kubectl", "pod-crash")
+
+	if err != nil {
+		t.Fatalf("activity failed: %v", err)
+	}
+
+	var recommendations []string
+	if err := result.Get(&recommendations); err != nil {
+		t.Fatalf("get result failed: %v", err)
+	}
+
+	if len(recommendations) == 0 {
+		t.Error("expected recommendations")
+	}
+}
+
+func TestActivityAnalyzeError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(QueryResponse{
+			Results: []QueryResult{
+				{
+					ID:    "chunk-123",
+					Level: "L1",
+					Text:  "solution: restart pod",
+				},
+			},
+		})
+	}))
+	defer server.Close()
+
+	suite := &testsuite.WorkflowTestSuite{}
+	env := suite.NewTestActivityEnvironment()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	activities := NewActivities(svc)
+
+	env.RegisterActivity(activities.AnalyzeErrorActivity)
+
+	result, err := env.ExecuteActivity(activities.AnalyzeErrorActivity, "CrashLoopBackOff")
+
+	if err != nil {
+		t.Fatalf("activity failed: %v", err)
+	}
+
+	var records []KnowledgeRecord
+	if err := result.Get(&records); err != nil {
+		t.Fatalf("get result failed: %v", err)
+	}
+
+	if len(records) != 1 {
+		t.Errorf("expected 1 record, got %d", len(records))
+	}
+}
+
+func TestActivityHealthCheck(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	suite := &testsuite.WorkflowTestSuite{}
+	env := suite.NewTestActivityEnvironment()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	activities := NewActivities(svc)
+
+	env.RegisterActivity(activities.HealthCheckActivity)
+
+	result, err := env.ExecuteActivity(activities.HealthCheckActivity)
+
+	if err != nil {
+		t.Fatalf("activity failed: %v", err)
+	}
+
+	var healthy bool
+	if err := result.Get(&healthy); err != nil {
+		t.Fatalf("get result failed: %v", err)
+	}
+
+	if !healthy {
+		t.Error("expected healthy")
+	}
+}
+
+func TestActivityLearnFromExecution(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(IngestResponse{ID: "chunk-456"})
+	}))
+	defer server.Close()
+
+	suite := &testsuite.WorkflowTestSuite{}
+	env := suite.NewTestActivityEnvironment()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	activities := NewActivities(svc)
+
+	env.RegisterActivity(activities.LearnFromExecutionActivity)
+
+	result, err := env.ExecuteActivity(activities.LearnFromExecutionActivity, "task-123", "success", []string{"tag1"})
+
+	if err != nil {
+		t.Fatalf("activity failed: %v", err)
+	}
+
+	var id string
+	if err := result.Get(&id); err != nil {
+		t.Fatalf("get result failed: %v", err)
+	}
+
+	if id != "chunk-456" {
+		t.Errorf("expected chunk-456, got %s", id)
+	}
+}
+
+func TestActivityDocumentDecision(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(IngestResponse{ID: "chunk-789"})
+	}))
+	defer server.Close()
+
+	suite := &testsuite.WorkflowTestSuite{}
+	env := suite.NewTestActivityEnvironment()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	activities := NewActivities(svc)
+
+	env.RegisterActivity(activities.DocumentDecisionActivity)
+
+	result, err := env.ExecuteActivity(
+		activities.DocumentDecisionActivity,
+		"scaling",
+		"scale to 5 replicas",
+		"high CPU usage",
+	)
+
+	if err != nil {
+		t.Fatalf("activity failed: %v", err)
+	}
+
+	var id string
+	if err := result.Get(&id); err != nil {
+		t.Fatalf("get result failed: %v", err)
+	}
+
+	if id != "chunk-789" {
+		t.Errorf("expected chunk-789, got %s", id)
+	}
+}
+
+func TestActivityOptions(t *testing.T) {
+	opts := DefaultActivityOptions()
+
+	if opts.RetryAttempts != 3 {
+		t.Errorf("expected 3 retry attempts, got %d", opts.RetryAttempts)
+	}
+
+	if opts.StartTimeout == 0 {
+		t.Error("expected non-zero start timeout")
+	}
+}
+
+func TestActivityError(t *testing.T) {
+	err := &MemoryActivityError{
+		ActivityName: "test-activity",
+		Attempt:      2,
+		Err:          context.Canceled,
+	}
+
+	msg := err.Error()
+	if msg == "" {
+		t.Error("expected error message")
+	}
+
+	if !contains(msg, "test-activity") {
+		t.Error("expected activity name in error")
+	}
+
+	if !contains(msg, "attempt 2") {
+		t.Error("expected attempt number in error")
+	}
+}
+
+func contains(s, substr string) bool {
+	for i := 0; i < len(s)-len(substr)+1; i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}

internal/memory/client.go

@@ -0,0 +1,296 @@
+package memory
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+// Client memory service client with JWT auth
+type Client struct {
+	baseURL    string
+	httpClient *http.Client
+	token      string
+}
+
+// NewClient creates memory service client
+func NewClient(baseURL, token string) *Client {
+	return &Client{
+		baseURL: baseURL,
+		httpClient: &http.Client{
+			Timeout: 10 * time.Second,
+		},
+		token: token,
+	}
+}
+
+// IngestRequest ingest knowledge record
+type IngestRequest struct {
+	Project  string                 `json:"project"`
+	Source   string                 `json:"source"`
+	Kind     string                 `json:"kind"` // L1|L2|reference
+	Text     string                 `json:"text"`
+	Metadata map[string]interface{} `json:"metadata,omitempty"`
+}
+
+// IngestResponse ingest response
+type IngestResponse struct {
+	ID            string `json:"id"`
+	SHA256        string `json:"sha256"`
+	QueueStatus   string `json:"queue_status"`
+	IdempotencyID string `json:"idempotency_key"`
+}
+
+// Ingest creates knowledge record
+func (c *Client) Ingest(ctx context.Context, req *IngestRequest) (*IngestResponse, error) {
+	body, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("marshal ingest request: %w", err)
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, "POST", c.baseURL+"/memory/ingest", bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	c.setAuthHeader(httpReq)
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("ingest request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("ingest failed (%d): %s", resp.StatusCode, string(body))
+	}
+
+	var result IngestResponse
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("decode ingest response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// QueryRequest query memory
+type QueryRequest struct {
+	Project    string   `json:"project"`
+	Query      string   `json:"query"`
+	LevelFilter []string `json:"level_filter,omitempty"` // L1, L2, R
+	Floor      float32  `json:"floor,omitempty"`
+	Limit      int      `json:"limit,omitempty"`
+	Scope      string   `json:"scope,omitempty"` // learned|reference|all
+}
+
+// QueryResult single search result
+type QueryResult struct {
+	ID            string  `json:"id"`
+	Level         string  `json:"level"`
+	Score         float32 `json:"score"`
+	SemanticScore float32 `json:"semantic_score"`
+	LexicalScore  float32 `json:"lexical_score"`
+	Text          string  `json:"text"`
+	Breadcrumb    string  `json:"breadcrumb"`
+	Source        string  `json:"source"`
+}
+
+// QueryResponse query response
+type QueryResponse struct {
+	Query       string         `json:"query"`
+	Results     []QueryResult  `json:"results"`
+	TotalHits   int            `json:"total_hits"`
+	SearchTimeMS int           `json:"search_time_ms"`
+}
+
+// Query searches knowledge
+func (c *Client) Query(ctx context.Context, req *QueryRequest) (*QueryResponse, error) {
+	if req.Limit == 0 {
+		req.Limit = 10
+	}
+
+	body, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("marshal query request: %w", err)
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, "POST", c.baseURL+"/memory/query", bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	c.setAuthHeader(httpReq)
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("query request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("query failed (%d): %s", resp.StatusCode, string(body))
+	}
+
+	var result QueryResponse
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("decode query response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ContextRequest retrieve context (three-tier)
+type ContextRequest struct {
+	Project         string `json:"project"`
+	Tool            string `json:"tool"`
+	Task            string `json:"task"`
+	SignatureSource string `json:"signature_source"`
+	Scope           string `json:"scope,omitempty"` // tool_context
+	Budget          int    `json:"budget,omitempty"`
+}
+
+// ContextLesson lesson from context
+type ContextLesson struct {
+	Tier        int    `json:"tier"`
+	Level       string `json:"level"`
+	Score       float32 `json:"score"`
+	Text        string `json:"text"`
+	MatchedKind string `json:"matched_kind,omitempty"`
+	SeenCount   int    `json:"seen_count,omitempty"`
+	LastSeen    string `json:"last_seen,omitempty"`
+}
+
+// ContextSkill skill suggestion
+type ContextSkill struct {
+	Name string `json:"name"`
+	Why  string `json:"why"`
+}
+
+// ContextBudget budget tracking
+type ContextBudget struct {
+	Requested   int    `json:"requested"`
+	Used        int    `json:"used"`
+	Dropped     int    `json:"dropped"`
+	Degradation *string `json:"degradation"`
+}
+
+// ContextResponse context response
+type ContextResponse struct {
+	Tier     int              `json:"tier"`
+	Lessons  []ContextLesson  `json:"lessons"`
+	Skills   []ContextSkill   `json:"skills"`
+	Budget   ContextBudget    `json:"budget"`
+}
+
+// Context retrieves context (three-tier retrieval)
+func (c *Client) Context(ctx context.Context, req *ContextRequest) (*ContextResponse, error) {
+	if req.Budget == 0 {
+		req.Budget = 8192
+	}
+
+	body, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("marshal context request: %w", err)
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, "POST", c.baseURL+"/memory/context", bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	c.setAuthHeader(httpReq)
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("context request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("context failed (%d): %s", resp.StatusCode, string(body))
+	}
+
+	var result ContextResponse
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("decode context response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// VaultFile file in vault
+type VaultFile struct {
+	Path        string `json:"path"`
+	Title       string `json:"title"`
+	Level       string `json:"level"`
+	UpdatedAt   string `json:"updated_at"`
+	RecordCount int    `json:"record_count"`
+}
+
+// VaultResponse vault browse response
+type VaultResponse struct {
+	Project       string      `json:"project"`
+	Files         []VaultFile `json:"files"`
+	TotalRecords  int         `json:"total_records"`
+}
+
+// Vault browses vault files
+func (c *Client) Vault(ctx context.Context, project string) (*VaultResponse, error) {
+	httpReq, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("%s/memory/vault?project=%s", c.baseURL, project), nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	c.setAuthHeader(httpReq)
+
+	resp, err := c.httpClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("vault request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("vault failed (%d): %s", resp.StatusCode, string(body))
+	}
+
+	var result VaultResponse
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("decode vault response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// setAuthHeader sets JWT Bearer token
+func (c *Client) setAuthHeader(req *http.Request) {
+	if c.token != "" {
+		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.token))
+	}
+}
+
+// Health checks memory service
+func (c *Client) Health(ctx context.Context) (bool, error) {
+	httpReq, err := http.NewRequestWithContext(ctx, "GET", c.baseURL+"/health", nil)
+	if err != nil {
+		return false, err
+	}
+
+	resp, err := c.httpClient.Do(httpReq)
+	if err != nil {
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	return resp.StatusCode == http.StatusOK, nil
+}

internal/memory/client_test.go

@@ -0,0 +1,196 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestClientIngest(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/memory/ingest" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		if r.Header.Get("Authorization") == "" {
+			t.Error("missing Authorization header")
+		}
+
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(IngestResponse{
+			ID:          "chunk-123",
+			SHA256:      "abc123",
+			QueueStatus: "pending",
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "test-token")
+	resp, err := client.Ingest(context.Background(), &IngestRequest{
+		Project: "poimen",
+		Source:  "test",
+		Kind:    "L1",
+		Text:    "test content",
+	})
+
+	if err != nil {
+		t.Fatalf("ingest failed: %v", err)
+	}
+
+	if resp.ID != "chunk-123" {
+		t.Errorf("expected ID chunk-123, got %s", resp.ID)
+	}
+}
+
+func TestClientQuery(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/memory/query" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(QueryResponse{
+			Query:        "test query",
+			TotalHits:    1,
+			SearchTimeMS: 100,
+			Results: []QueryResult{
+				{
+					ID:    "chunk-123",
+					Level: "L1",
+					Score: 0.95,
+					Text:  "matching result",
+				},
+			},
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "test-token")
+	resp, err := client.Query(context.Background(), &QueryRequest{
+		Project: "poimen",
+		Query:   "test query",
+		Limit:   10,
+	})
+
+	if err != nil {
+		t.Fatalf("query failed: %v", err)
+	}
+
+	if len(resp.Results) != 1 {
+		t.Errorf("expected 1 result, got %d", len(resp.Results))
+	}
+
+	if resp.Results[0].Text != "matching result" {
+		t.Errorf("unexpected result text")
+	}
+}
+
+func TestClientContext(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/memory/context" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(ContextResponse{
+			Tier: 1,
+			Lessons: []ContextLesson{
+				{
+					Tier:  1,
+					Level: "L1",
+					Score: 1.0,
+					Text:  "tier-1 lesson",
+				},
+			},
+			Budget: ContextBudget{
+				Requested: 8192,
+				Used:      100,
+				Dropped:   0,
+			},
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "test-token")
+	resp, err := client.Context(context.Background(), &ContextRequest{
+		Project:         "poimen",
+		Tool:            "kubectl",
+		Task:            "debug",
+		SignatureSource: "log",
+	})
+
+	if err != nil {
+		t.Fatalf("context failed: %v", err)
+	}
+
+	if resp.Tier != 1 {
+		t.Errorf("expected tier 1, got %d", resp.Tier)
+	}
+
+	if len(resp.Lessons) != 1 {
+		t.Errorf("expected 1 lesson, got %d", len(resp.Lessons))
+	}
+}
+
+func TestClientVault(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/memory/vault" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(VaultResponse{
+			Project:      "poimen",
+			TotalRecords: 42,
+			Files: []VaultFile{
+				{
+					Path:        "test.md",
+					Title:       "Test",
+					Level:       "L1",
+					RecordCount: 5,
+				},
+			},
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "test-token")
+	resp, err := client.Vault(context.Background(), "poimen")
+
+	if err != nil {
+		t.Fatalf("vault failed: %v", err)
+	}
+
+	if len(resp.Files) != 1 {
+		t.Errorf("expected 1 file, got %d", len(resp.Files))
+	}
+
+	if resp.TotalRecords != 42 {
+		t.Errorf("expected 42 records, got %d", resp.TotalRecords)
+	}
+}
+
+func TestClientHealth(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/health" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "test-token")
+	ok, err := client.Health(context.Background())
+
+	if err != nil {
+		t.Fatalf("health check failed: %v", err)
+	}
+
+	if !ok {
+		t.Error("expected health check to pass")
+	}
+}

internal/memory/example_activity.go

@@ -0,0 +1,134 @@
+package memory
+
+import (
+	"context"
+	"fmt"
+)
+
+// ExampleActivity demonstrates memory service integration in workflows
+// This can be used as a template for workflow activities
+
+// LearnTaskActivity learns from task execution
+func LearnTaskActivity(ctx context.Context, service *Service, task string, result string) error {
+	// Create knowledge from task result
+	knowledgeID, err := service.CreateKnowledge(ctx, &KnowledgeRecord{
+		Level:   "L1",
+		Title:   fmt.Sprintf("Task: %s", task),
+		Content: result,
+		Source:  fmt.Sprintf("workflow://task/%s", task),
+		Metadata: map[string]interface{}{
+			"task": task,
+			"type": "execution_result",
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("learn task: %w", err)
+	}
+
+	fmt.Printf("Learned: %s\n", knowledgeID)
+	return nil
+}
+
+// DiagnosticActivity retrieves context for problem diagnosis
+func DiagnosticActivity(ctx context.Context, service *Service, tool string, issue string) ([]string, error) {
+	// Retrieve context for tool/issue
+	svcCtx, err := service.RetrieveContext(ctx, tool, issue, 8192)
+	if err != nil {
+		return nil, fmt.Errorf("diagnose: %w", err)
+	}
+
+	// Extract lessons
+	diagnostics := make([]string, 0)
+	for _, lesson := range svcCtx.Lessons {
+		if lesson.Tier == 1 {
+			diagnostics = append(diagnostics, lesson.Text)
+		}
+	}
+
+	// Extract skills
+	for _, skill := range svcCtx.Skills {
+		diagnostics = append(diagnostics, fmt.Sprintf("Skill: %s (%s)", skill.Name, skill.Why))
+	}
+
+	return diagnostics, nil
+}
+
+// DocumentationActivity searches vault for relevant docs
+func DocumentationActivity(ctx context.Context, service *Service, topic string) ([]string, error) {
+	// Retrieve vault files
+	files, err := service.GetVault(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("get vault: %w", err)
+	}
+
+	// Filter by topic
+	results := make([]string, 0)
+	for _, file := range files {
+		if file.Level == "R" { // Reference docs
+			results = append(results, fmt.Sprintf("%s: %s", file.Title, file.Path))
+		}
+	}
+
+	return results, nil
+}
+
+// SearchKnowledgeActivity searches knowledge base
+func SearchKnowledgeActivity(ctx context.Context, service *Service, query string) ([]string, error) {
+	records, err := service.RetrieveKnowledge(ctx, query, &RetrievalOptions{
+		LevelFilter: []string{"L1", "L2"},
+		Limit:       5,
+		Floor:       0.7,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("search: %w", err)
+	}
+
+	results := make([]string, 0)
+	for _, record := range records {
+		results = append(results, fmt.Sprintf("[%s] %s", record.Level, record.Content))
+	}
+
+	return results, nil
+}
+
+// UpdateLessonActivity updates learned facts
+func UpdateLessonActivity(ctx context.Context, service *Service, id string, newContent string) error {
+	_, err := service.UpdateKnowledge(ctx, &KnowledgeRecord{
+		ID:      id,
+		Level:   "L2",
+		Content: newContent,
+	})
+	return err
+}
+
+// HealthCheckActivity checks memory service health
+func HealthCheckActivity(ctx context.Context, service *Service) (bool, error) {
+	return service.IsHealthy(ctx), nil
+}
+
+// Example workflow structure using memory service
+type WorkflowWithMemory struct {
+	MemoryService *Service
+}
+
+// ExecuteWithLearning executes task and learns from it
+func (w *WorkflowWithMemory) ExecuteWithLearning(ctx context.Context, task string, executor func() (string, error)) error {
+	// Execute task
+	result, err := executor()
+	if err != nil {
+		return err
+	}
+
+	// Learn from result
+	return LearnTaskActivity(ctx, w.MemoryService, task, result)
+}
+
+// DiagnoseWithContext diagnoses issue using memory context
+func (w *WorkflowWithMemory) DiagnoseWithContext(ctx context.Context, tool string, issue string) ([]string, error) {
+	return DiagnosticActivity(ctx, w.MemoryService, tool, issue)
+}
+
+// SearchKnowledge searches knowledge
+func (w *WorkflowWithMemory) SearchKnowledge(ctx context.Context, query string) ([]string, error) {
+	return SearchKnowledgeActivity(ctx, w.MemoryService, query)
+}

internal/memory/service.go

@@ -0,0 +1,234 @@
+package memory
+
+import (
+	"context"
+	"fmt"
+)
+
+// Service memory service manager
+type Service struct {
+	client  *Client
+	project string
+}
+
+// NewService creates memory service manager
+func NewService(baseURL, token, project string) *Service {
+	return &Service{
+		client:  NewClient(baseURL, token),
+		project: project,
+	}
+}
+
+// KnowledgeRecord high-level knowledge record
+type KnowledgeRecord struct {
+	ID       string
+	Level    string // L1|L2|reference
+	Title    string
+	Content  string
+	Source   string
+	Metadata map[string]interface{}
+	SHA256   string
+}
+
+// CreateKnowledge creates knowledge record
+func (s *Service) CreateKnowledge(ctx context.Context, record *KnowledgeRecord) (string, error) {
+	if record.Level == "" {
+		record.Level = "L1"
+	}
+	if record.Source == "" {
+		record.Source = "workflow"
+	}
+
+	req := &IngestRequest{
+		Project:  s.project,
+		Source:   record.Source,
+		Kind:     record.Level,
+		Text:     record.Content,
+		Metadata: record.Metadata,
+	}
+
+	resp, err := s.client.Ingest(ctx, req)
+	if err != nil {
+		return "", fmt.Errorf("create knowledge: %w", err)
+	}
+
+	return resp.ID, nil
+}
+
+// UpdateKnowledge updates existing knowledge (re-ingest)
+func (s *Service) UpdateKnowledge(ctx context.Context, record *KnowledgeRecord) (string, error) {
+	// Update done by re-ingesting with same signature/source
+	// Memory service deduplicates based on idempotency key
+	if record.Metadata == nil {
+		record.Metadata = make(map[string]interface{})
+	}
+
+	// Use ID as session_id for idempotency
+	record.Metadata["session_id"] = record.ID
+
+	return s.CreateKnowledge(ctx, record)
+}
+
+// RetrievalOptions search options
+type RetrievalOptions struct {
+	LevelFilter []string // L1, L2, R
+	Floor       float32  // minimum relevance
+	Limit       int      // default 10
+	Scope       string   // learned|reference|all
+}
+
+// RetrieveKnowledge searches knowledge
+func (s *Service) RetrieveKnowledge(ctx context.Context, query string, opts *RetrievalOptions) ([]KnowledgeRecord, error) {
+	if opts == nil {
+		opts = &RetrievalOptions{}
+	}
+
+	if opts.Limit == 0 {
+		opts.Limit = 10
+	}
+
+	req := &QueryRequest{
+		Project:     s.project,
+		Query:       query,
+		LevelFilter: opts.LevelFilter,
+		Floor:       opts.Floor,
+		Limit:       opts.Limit,
+		Scope:       opts.Scope,
+	}
+
+	resp, err := s.client.Query(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("retrieve knowledge: %w", err)
+	}
+
+	records := make([]KnowledgeRecord, len(resp.Results))
+	for i, r := range resp.Results {
+		records[i] = KnowledgeRecord{
+			ID:       r.ID,
+			Level:    r.Level,
+			Content:  r.Text,
+			Source:   r.Source,
+			SHA256:   "", // Not in response
+			Metadata: map[string]interface{}{
+				"score":           r.Score,
+				"semantic_score":  r.SemanticScore,
+				"lexical_score":   r.LexicalScore,
+				"breadcrumb":      r.Breadcrumb,
+			},
+		}
+	}
+
+	return records, nil
+}
+
+// ServiceContext tool/task context
+type ServiceContext struct {
+	Tier      int
+	Lessons   []Lesson
+	Skills    []Skill
+	BudgetUsed int
+	BudgetMax int
+}
+
+// Lesson learned fact or reference
+type Lesson struct {
+	Tier        int
+	Level       string
+	Score       float32
+	Text        string
+	MatchedKind string
+	SeenCount   int
+	LastSeen    string
+}
+
+// Skill recommended action
+type Skill struct {
+	Name string
+	Why  string
+}
+
+// RetrieveContext retrieves context for tool/task (three-tier)
+func (s *Service) RetrieveContext(ctx context.Context, tool, task string, budget int) (*ServiceContext, error) {
+	if budget == 0 {
+		budget = 8192
+	}
+
+	req := &ContextRequest{
+		Project:         s.project,
+		Tool:            tool,
+		Task:            task,
+		SignatureSource: fmt.Sprintf("%s:%s", tool, task),
+		Scope:           "tool_context",
+		Budget:          budget,
+	}
+
+	resp, err := s.client.Context(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("retrieve context: %w", err)
+	}
+
+	lessons := make([]Lesson, len(resp.Lessons))
+	for i, l := range resp.Lessons {
+		lessons[i] = Lesson{
+			Tier:        l.Tier,
+			Level:       l.Level,
+			Score:       l.Score,
+			Text:        l.Text,
+			MatchedKind: l.MatchedKind,
+			SeenCount:   l.SeenCount,
+			LastSeen:    l.LastSeen,
+		}
+	}
+
+	skills := make([]Skill, len(resp.Skills))
+	for i, sk := range resp.Skills {
+		skills[i] = Skill{
+			Name: sk.Name,
+			Why:  sk.Why,
+		}
+	}
+
+	return &ServiceContext{
+		Tier:       resp.Tier,
+		Lessons:    lessons,
+		Skills:     skills,
+		BudgetUsed: resp.Budget.Used,
+		BudgetMax:  resp.Budget.Requested,
+	}, nil
+}
+
+// VaultInfo vault browsing
+type VaultInfo struct {
+	Path        string
+	Title       string
+	Level       string
+	UpdatedAt   string
+	RecordCount int
+}
+
+// GetVault lists vault files
+func (s *Service) GetVault(ctx context.Context) ([]VaultInfo, error) {
+	resp, err := s.client.Vault(ctx, s.project)
+	if err != nil {
+		return nil, fmt.Errorf("get vault: %w", err)
+	}
+
+	files := make([]VaultInfo, len(resp.Files))
+	for i, f := range resp.Files {
+		files[i] = VaultInfo{
+			Path:        f.Path,
+			Title:       f.Title,
+			Level:       f.Level,
+			UpdatedAt:   f.UpdatedAt,
+			RecordCount: f.RecordCount,
+		}
+	}
+
+	return files, nil
+}
+
+// IsHealthy checks service health
+func (s *Service) IsHealthy(ctx context.Context) bool {
+	ok, err := s.client.Health(ctx)
+	return ok && err == nil
+}

internal/memory/service_test.go

@@ -0,0 +1,254 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestServiceCreateKnowledge(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/memory/ingest" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		var req IngestRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			t.Fatalf("decode request: %v", err)
+		}
+
+		if req.Project != "poimen" {
+			t.Errorf("expected project poimen, got %s", req.Project)
+		}
+
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(IngestResponse{
+			ID:          "chunk-123",
+			QueueStatus: "pending",
+		})
+	}))
+	defer server.Close()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	id, err := svc.CreateKnowledge(context.Background(), &KnowledgeRecord{
+		Content: "test knowledge",
+		Level:   "L1",
+	})
+
+	if err != nil {
+		t.Fatalf("create knowledge failed: %v", err)
+	}
+
+	if id != "chunk-123" {
+		t.Errorf("expected ID chunk-123, got %s", id)
+	}
+}
+
+func TestServiceRetrieveKnowledge(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/memory/query" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(QueryResponse{
+			Query: "test",
+			Results: []QueryResult{
+				{
+					ID:            "chunk-123",
+					Level:         "L1",
+					Score:         0.95,
+					SemanticScore: 0.96,
+					LexicalScore:  0.94,
+					Text:          "knowledge content",
+					Breadcrumb:    "path > to > doc",
+					Source:        "test",
+				},
+			},
+			TotalHits:    1,
+			SearchTimeMS: 50,
+		})
+	}))
+	defer server.Close()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	records, err := svc.RetrieveKnowledge(context.Background(), "test", nil)
+
+	if err != nil {
+		t.Fatalf("retrieve knowledge failed: %v", err)
+	}
+
+	if len(records) != 1 {
+		t.Errorf("expected 1 record, got %d", len(records))
+	}
+
+	if records[0].Content != "knowledge content" {
+		t.Errorf("unexpected content")
+	}
+
+	meta := records[0].Metadata
+	if score, ok := meta["score"].(float32); ok {
+		if score != 0.95 {
+			t.Errorf("expected score 0.95, got %f", score)
+		}
+	}
+}
+
+func TestServiceRetrieveContext(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/memory/context" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(ContextResponse{
+			Tier: 1,
+			Lessons: []ContextLesson{
+				{
+					Tier:        1,
+					Level:       "L1",
+					Score:       1.0,
+					Text:        "first lesson",
+					MatchedKind: "signature",
+				},
+				{
+					Tier:  2,
+					Level: "L2",
+					Score: 0.87,
+					Text:  "second lesson",
+				},
+			},
+			Skills: []ContextSkill{
+				{
+					Name: "debug-skill",
+					Why:  "tier 1 matched",
+				},
+			},
+			Budget: ContextBudget{
+				Requested: 8192,
+				Used:      2048,
+				Dropped:   0,
+			},
+		})
+	}))
+	defer server.Close()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	ctx, err := svc.RetrieveContext(context.Background(), "kubectl", "debug-pod", 8192)
+
+	if err != nil {
+		t.Fatalf("retrieve context failed: %v", err)
+	}
+
+	if ctx.Tier != 1 {
+		t.Errorf("expected tier 1, got %d", ctx.Tier)
+	}
+
+	if len(ctx.Lessons) != 2 {
+		t.Errorf("expected 2 lessons, got %d", len(ctx.Lessons))
+	}
+
+	if len(ctx.Skills) != 1 {
+		t.Errorf("expected 1 skill, got %d", len(ctx.Skills))
+	}
+
+	if ctx.BudgetUsed != 2048 {
+		t.Errorf("expected budget used 2048, got %d", ctx.BudgetUsed)
+	}
+}
+
+func TestServiceGetVault(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/memory/vault" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(VaultResponse{
+			Project:      "poimen",
+			TotalRecords: 100,
+			Files: []VaultFile{
+				{
+					Path:        "docs/guide.md",
+					Title:       "Guide",
+					Level:       "L1",
+					RecordCount: 25,
+				},
+				{
+					Path:        "reference/api.md",
+					Title:       "API",
+					Level:       "R",
+					RecordCount: 75,
+				},
+			},
+		})
+	}))
+	defer server.Close()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	files, err := svc.GetVault(context.Background())
+
+	if err != nil {
+		t.Fatalf("get vault failed: %v", err)
+	}
+
+	if len(files) != 2 {
+		t.Errorf("expected 2 files, got %d", len(files))
+	}
+
+	if files[0].Title != "Guide" {
+		t.Errorf("expected title Guide, got %s", files[0].Title)
+	}
+}
+
+func TestServiceIsHealthy(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	if !svc.IsHealthy(context.Background()) {
+		t.Error("expected service to be healthy")
+	}
+}
+
+func TestServiceUpdateKnowledge(t *testing.T) {
+	callCount := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		callCount++
+		if r.URL.Path != "/memory/ingest" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(IngestResponse{
+			ID:          "chunk-123",
+			QueueStatus: "pending",
+		})
+	}))
+	defer server.Close()
+
+	svc := NewService(server.URL, "test-token", "poimen")
+	record := &KnowledgeRecord{
+		ID:      "chunk-123",
+		Content: "updated knowledge",
+		Level:   "L1",
+	}
+
+	id, err := svc.UpdateKnowledge(context.Background(), record)
+
+	if err != nil {
+		t.Fatalf("update knowledge failed: %v", err)
+	}
+
+	if id != "chunk-123" {
+		t.Errorf("expected ID chunk-123, got %s", id)
+	}
+
+	if callCount != 1 {
+		t.Errorf("expected 1 call, got %d", callCount)
+	}
+}

internal/memory/worker_setup.go

@@ -0,0 +1,333 @@
+package memory
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"go.temporal.io/sdk/activity"
+	"go.temporal.io/sdk/temporal"
+	"go.temporal.io/sdk/worker"
+	"go.temporal.io/sdk/workflow"
+)
+
+// RegisterMemoryActivities registers all memory service activities with worker
+func RegisterMemoryActivities(w worker.Worker, service *Service) {
+	activities := NewActivities(service)
+
+	// Register activities (activity name = "ActivityName" → "activityName")
+	w.RegisterActivity(activities.CreateKnowledgeActivity)
+	w.RegisterActivity(activities.UpdateKnowledgeActivity)
+	w.RegisterActivity(activities.SearchKnowledgeActivity)
+	w.RegisterActivity(activities.GetContextActivity)
+	w.RegisterActivity(activities.GetVaultActivity)
+	w.RegisterActivity(activities.HealthCheckActivity)
+	w.RegisterActivity(activities.LearnFromExecutionActivity)
+	w.RegisterActivity(activities.DiagnoseIssueActivity)
+	w.RegisterActivity(activities.AnalyzeErrorActivity)
+	w.RegisterActivity(activities.DocumentDecisionActivity)
+	w.RegisterActivity(activities.SearchAndApplyActivity)
+	w.RegisterActivity(activities.RefreshMemoryActivity)
+}
+
+// ActivityOptions memory service activity options
+type ActivityOptions struct {
+	RetryAttempts int
+	RetryBackoff  time.Duration
+	StartTimeout  time.Duration
+	HeartbeatRate time.Duration
+}
+
+// DefaultActivityOptions returns sensible defaults
+func DefaultActivityOptions() *ActivityOptions {
+	return &ActivityOptions{
+		RetryAttempts: 3,
+		RetryBackoff:  time.Second,
+		StartTimeout:  30 * time.Second,
+		HeartbeatRate: 10 * time.Second,
+	}
+}
+
+// ExecuteCreateKnowledge wrapper for CreateKnowledgeActivity
+func ExecuteCreateKnowledge(
+	ctx workflow.Context,
+	record *KnowledgeRecord,
+	opts *ActivityOptions,
+) (string, error) {
+	if opts == nil {
+		opts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 2 * time.Minute,
+		StartToCloseTimeout:    time.Minute,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:        opts.RetryBackoff,
+			BackoffCoefficient:     2.0,
+			MaximumInterval:        30 * time.Second,
+			MaximumAttempts:        int32(opts.RetryAttempts),
+			NonRetryableErrorTypes: []string{},
+		},
+	})
+
+	var result string
+	err := workflow.ExecuteActivity(activityCtx, "CreateKnowledgeActivity", record).Get(activityCtx, &result)
+	return result, err
+}
+
+// ExecuteSearchKnowledge wrapper for SearchKnowledgeActivity
+func ExecuteSearchKnowledge(
+	ctx workflow.Context,
+	query string,
+	opts *RetrievalOptions,
+	activityOpts *ActivityOptions,
+) ([]KnowledgeRecord, error) {
+	if activityOpts == nil {
+		activityOpts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 3 * time.Minute,
+		StartToCloseTimeout:    2 * time.Minute,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:    activityOpts.RetryBackoff,
+			BackoffCoefficient: 2.0,
+			MaximumInterval:    30 * time.Second,
+			MaximumAttempts:    int32(activityOpts.RetryAttempts),
+		},
+	})
+
+	var result []KnowledgeRecord
+	err := workflow.ExecuteActivity(activityCtx, "SearchKnowledgeActivity", query, opts).Get(activityCtx, &result)
+	return result, err
+}
+
+// ExecuteGetContext wrapper for GetContextActivity
+func ExecuteGetContext(
+	ctx workflow.Context,
+	tool, task string,
+	budget int,
+	opts *ActivityOptions,
+) (*ServiceContext, error) {
+	if opts == nil {
+		opts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 3 * time.Minute,
+		StartToCloseTimeout:    2 * time.Minute,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:    opts.RetryBackoff,
+			BackoffCoefficient: 2.0,
+			MaximumInterval:    30 * time.Second,
+			MaximumAttempts:    int32(opts.RetryAttempts),
+		},
+	})
+
+	var result *ServiceContext
+	err := workflow.ExecuteActivity(activityCtx, "GetContextActivity", tool, task, budget).Get(activityCtx, &result)
+	return result, err
+}
+
+// ExecuteDiagnoseIssue wrapper for DiagnoseIssueActivity
+func ExecuteDiagnoseIssue(
+	ctx workflow.Context,
+	tool, issue string,
+	opts *ActivityOptions,
+) ([]string, error) {
+	if opts == nil {
+		opts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 2 * time.Minute,
+		StartToCloseTimeout:    time.Minute,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:    opts.RetryBackoff,
+			BackoffCoefficient: 2.0,
+			MaximumInterval:    30 * time.Second,
+			MaximumAttempts:    int32(opts.RetryAttempts),
+		},
+	})
+
+	var result []string
+	err := workflow.ExecuteActivity(activityCtx, "DiagnoseIssueActivity", tool, issue).Get(activityCtx, &result)
+	return result, err
+}
+
+// ExecuteAnalyzeError wrapper for AnalyzeErrorActivity
+func ExecuteAnalyzeError(
+	ctx workflow.Context,
+	errorMsg string,
+	opts *ActivityOptions,
+) ([]KnowledgeRecord, error) {
+	if opts == nil {
+		opts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 2 * time.Minute,
+		StartToCloseTimeout:    time.Minute,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:    opts.RetryBackoff,
+			BackoffCoefficient: 2.0,
+			MaximumInterval:    30 * time.Second,
+			MaximumAttempts:    int32(opts.RetryAttempts),
+		},
+	})
+
+	var result []KnowledgeRecord
+	err := workflow.ExecuteActivity(activityCtx, "AnalyzeErrorActivity", errorMsg).Get(activityCtx, &result)
+	return result, err
+}
+
+// ExecuteHealthCheck wrapper for HealthCheckActivity
+func ExecuteHealthCheck(
+	ctx workflow.Context,
+	opts *ActivityOptions,
+) (bool, error) {
+	if opts == nil {
+		opts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 1 * time.Minute,
+		StartToCloseTimeout:    30 * time.Second,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:    opts.RetryBackoff,
+			BackoffCoefficient: 2.0,
+			MaximumInterval:    15 * time.Second,
+			MaximumAttempts:    int32(opts.RetryAttempts),
+		},
+	})
+
+	var result bool
+	err := workflow.ExecuteActivity(activityCtx, "HealthCheckActivity").Get(activityCtx, &result)
+	return result, err
+}
+
+// ExecuteLearnFromExecution wrapper for LearnFromExecutionActivity
+func ExecuteLearnFromExecution(
+	ctx workflow.Context,
+	taskID, result string,
+	tags []string,
+	opts *ActivityOptions,
+) (string, error) {
+	if opts == nil {
+		opts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 2 * time.Minute,
+		StartToCloseTimeout:    time.Minute,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:    opts.RetryBackoff,
+			BackoffCoefficient: 2.0,
+			MaximumInterval:    30 * time.Second,
+			MaximumAttempts:    int32(opts.RetryAttempts),
+		},
+	})
+
+	var recordID string
+	err := workflow.ExecuteActivity(activityCtx, "LearnFromExecutionActivity", taskID, result, tags).Get(activityCtx, &recordID)
+	return recordID, err
+}
+
+// ExecuteDocumentDecision wrapper for DocumentDecisionActivity
+func ExecuteDocumentDecision(
+	ctx workflow.Context,
+	decisionType, decision, reasoning string,
+	opts *ActivityOptions,
+) (string, error) {
+	if opts == nil {
+		opts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 2 * time.Minute,
+		StartToCloseTimeout:    time.Minute,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:    opts.RetryBackoff,
+			BackoffCoefficient: 2.0,
+			MaximumInterval:    30 * time.Second,
+			MaximumAttempts:    int32(opts.RetryAttempts),
+		},
+	})
+
+	var recordID string
+	err := workflow.ExecuteActivity(activityCtx, "DocumentDecisionActivity", decisionType, decision, reasoning).Get(activityCtx, &recordID)
+	return recordID, err
+}
+
+// ExecuteRefreshMemory wrapper for RefreshMemoryActivity
+func ExecuteRefreshMemory(
+	ctx workflow.Context,
+	opts *ActivityOptions,
+) (map[string]interface{}, error) {
+	if opts == nil {
+		opts = DefaultActivityOptions()
+	}
+
+	activityCtx := workflow.WithActivityOptions(ctx, workflow.ActivityOptions{
+		ScheduleToCloseTimeout: 2 * time.Minute,
+		StartToCloseTimeout:    time.Minute,
+		RetryPolicy: &temporal.RetryPolicy{
+			InitialInterval:    opts.RetryBackoff,
+			BackoffCoefficient: 2.0,
+			MaximumInterval:    30 * time.Second,
+			MaximumAttempts:    int32(opts.RetryAttempts),
+		},
+	})
+
+	var result map[string]interface{}
+	err := workflow.ExecuteActivity(activityCtx, "RefreshMemoryActivity").Get(activityCtx, &result)
+	return result, err
+}
+
+// HeartbeatMemoryActivity sends heartbeat every N seconds
+// Usage: Long-running memory operations
+func HeartbeatMemoryActivity(ctx context.Context, maxDuration time.Duration) error {
+	ticker := time.NewTicker(10 * time.Second)
+	defer ticker.Stop()
+
+	deadline := time.Now().Add(maxDuration)
+
+	for {
+		select {
+		case <-ticker.C:
+			activity.RecordHeartbeat(ctx, time.Now())
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+
+		if time.Now().After(deadline) {
+			break
+		}
+	}
+
+	return nil
+}
+
+// MemoryActivityError wraps errors with activity context
+type MemoryActivityError struct {
+	ActivityName string
+	Attempt      int
+	Err          error
+}
+
+func (e *MemoryActivityError) Error() string {
+	return fmt.Sprintf("memory activity %s (attempt %d): %v", e.ActivityName, e.Attempt, e.Err)
+}
+
+// CaptureActivityError captures activity execution errors
+func CaptureActivityError(activityName string, err error) error {
+	if err == nil {
+		return nil
+	}
+
+	return &MemoryActivityError{
+		ActivityName: activityName,
+		Attempt:      1,
+		Err:          err,
+	}
+}

internal/memory/workflow_examples.go

@@ -0,0 +1,303 @@
+package memory
+
+import (
+	"fmt"
+
+	"go.temporal.io/sdk/workflow"
+)
+
+// LearningWorkflow learns from task execution
+// Pattern: Execute → Learn → Document
+func LearningWorkflow(ctx workflow.Context, taskID string, executor string) (string, error) {
+	// Execute task (placeholder - replace with actual activity)
+	taskResult := fmt.Sprintf("Task %s executed by %s", taskID, executor)
+
+	// Learn from execution
+	knowledgeID, err := ExecuteLearnFromExecution(
+		ctx,
+		taskID,
+		taskResult,
+		[]string{"execution", "learning"},
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return "", fmt.Errorf("learn from execution: %w", err)
+	}
+
+	return knowledgeID, nil
+}
+
+// DiagnosticWorkflow diagnoses issue using memory service
+// Pattern: Get Context → Extract Recommendations → Apply
+func DiagnosticWorkflow(ctx workflow.Context, tool, issue string) ([]string, error) {
+	// Get recommendations
+	recommendations, err := ExecuteDiagnoseIssue(
+		ctx,
+		tool,
+		issue,
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("diagnose: %w", err)
+	}
+
+	return recommendations, nil
+}
+
+// SearchAndApplyWorkflow searches knowledge and applies it
+// Pattern: Search → Filter → Apply
+func SearchAndApplyWorkflow(ctx workflow.Context, query string) ([]KnowledgeRecord, error) {
+	// Search knowledge
+	records, err := ExecuteSearchKnowledge(
+		ctx,
+		query,
+		&RetrievalOptions{
+			Limit:       10,
+			LevelFilter: []string{"L1", "L2"},
+			Floor:       0.7,
+		},
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("search: %w", err)
+	}
+
+	return records, nil
+}
+
+// ContextualDecisionWorkflow makes decisions with memory context
+// Pattern: Get Context → Make Decision → Document Decision
+func ContextualDecisionWorkflow(ctx workflow.Context, tool, task string, decision string) (string, error) {
+	// Get context
+	svcCtx, err := ExecuteGetContext(
+		ctx,
+		tool,
+		task,
+		8192,
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return "", fmt.Errorf("get context: %w", err)
+	}
+
+	// Build reasoning from lessons
+	reasoning := fmt.Sprintf("Based on %d lessons from memory service (tier %d)", len(svcCtx.Lessons), svcCtx.Tier)
+
+	// Document decision
+	docID, err := ExecuteDocumentDecision(
+		ctx,
+		tool,
+		decision,
+		reasoning,
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return "", fmt.Errorf("document decision: %w", err)
+	}
+
+	return docID, nil
+}
+
+// ErrorRecoveryWorkflow analyzes error and searches for recovery
+// Pattern: Error → Analyze → Search → Recover
+func ErrorRecoveryWorkflow(ctx workflow.Context, errorMsg string) ([]string, error) {
+	// Analyze error
+	records, err := ExecuteAnalyzeError(
+		ctx,
+		errorMsg,
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("analyze error: %w", err)
+	}
+
+	// Extract recovery recommendations
+	recommendations := make([]string, 0)
+	for _, record := range records {
+		if record.Level == "L1" { // High confidence
+			recommendations = append(recommendations, record.Content)
+		}
+	}
+
+	return recommendations, nil
+}
+
+// HealthAwareWorkflow checks health before proceeding
+// Pattern: HealthCheck → Conditional Proceed
+func HealthAwareWorkflow(ctx workflow.Context, taskID string) (bool, error) {
+	// Check health
+	healthy, err := ExecuteHealthCheck(ctx, DefaultActivityOptions())
+	if err != nil {
+		return false, fmt.Errorf("health check: %w", err)
+	}
+
+	if !healthy {
+		return false, fmt.Errorf("memory service unhealthy, skipping task %s", taskID)
+	}
+
+	return true, nil
+}
+
+// IterativeLearnWorkflow learns iteratively
+// Pattern: Execute → Learn → Refine → Learn Again
+func IterativeLearnWorkflow(ctx workflow.Context, topic string, iterations int) ([]string, error) {
+	knowledgeIDs := make([]string, 0)
+
+	for i := 0; i < iterations; i++ {
+		// Learn current iteration
+		id, err := ExecuteLearnFromExecution(
+			ctx,
+			fmt.Sprintf("%s-iteration-%d", topic, i+1),
+			fmt.Sprintf("Iteration %d: %s", i+1, topic),
+			[]string{"iteration", fmt.Sprintf("iteration-%d", i+1)},
+			DefaultActivityOptions(),
+		)
+		if err != nil {
+			return nil, fmt.Errorf("learn iteration %d: %w", i+1, err)
+		}
+
+		knowledgeIDs = append(knowledgeIDs, id)
+
+		// Search for related knowledge
+		records, err := ExecuteSearchKnowledge(
+			ctx,
+			topic,
+			&RetrievalOptions{Limit: 5, Floor: 0.6},
+			DefaultActivityOptions(),
+		)
+		if err != nil {
+			return nil, fmt.Errorf("search iteration %d: %w", i+1, err)
+		}
+
+		// Log found records
+		if len(records) > 0 {
+			workflow.GetLogger(ctx).Info("Iteration found related records", "iteration", i+1, "records", len(records))
+		}
+	}
+
+	return knowledgeIDs, nil
+}
+
+// ConditionalLearningWorkflow learns only on success
+// Pattern: Execute → If Success → Learn
+func ConditionalLearningWorkflow(ctx workflow.Context, taskID string, shouldSucceed bool) (string, error) {
+	if !shouldSucceed {
+		return "", fmt.Errorf("task failed, skipping learning")
+	}
+
+	// Only learn on success
+	result := fmt.Sprintf("Task %s succeeded", taskID)
+
+	id, err := ExecuteLearnFromExecution(
+		ctx,
+		taskID,
+		result,
+		[]string{"success"},
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return "", fmt.Errorf("learn from success: %w", err)
+	}
+
+	return id, nil
+}
+
+// MultiStepWorkflow performs multiple memory operations
+// Pattern: Create → Search → Context → Document
+func MultiStepWorkflow(ctx workflow.Context, topic string) (map[string]interface{}, error) {
+	results := make(map[string]interface{})
+
+	// Step 1: Create knowledge
+	createID, err := ExecuteCreateKnowledge(
+		ctx,
+		&KnowledgeRecord{
+			Level:   "L1",
+			Title:   fmt.Sprintf("Initial: %s", topic),
+			Content: fmt.Sprintf("Starting workflow for %s", topic),
+			Source:  "workflow://multi-step",
+		},
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("create knowledge: %w", err)
+	}
+	results["created"] = createID
+
+	// Step 2: Search knowledge
+	searchRecords, err := ExecuteSearchKnowledge(
+		ctx,
+		topic,
+		&RetrievalOptions{Limit: 5},
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("search knowledge: %w", err)
+	}
+	results["found"] = len(searchRecords)
+
+	// Step 3: Get context
+	svcCtx, err := ExecuteGetContext(
+		ctx,
+		"workflow",
+		topic,
+		8192,
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("get context: %w", err)
+	}
+	results["context_tier"] = svcCtx.Tier
+	results["lessons"] = len(svcCtx.Lessons)
+	results["skills"] = len(svcCtx.Skills)
+
+	// Step 4: Document completion
+	docID, err := ExecuteDocumentDecision(
+		ctx,
+		"workflow_completion",
+		fmt.Sprintf("Completed multi-step workflow for %s", topic),
+		fmt.Sprintf("Found %d records, tier %d context", len(searchRecords), svcCtx.Tier),
+		DefaultActivityOptions(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("document completion: %w", err)
+	}
+	results["documented"] = docID
+
+	return results, nil
+}
+
+// ParallelLearnWorkflow learns from multiple sources in parallel
+// Pattern: Execute Multiple Tasks in Parallel → Learn from Each
+func ParallelLearnWorkflow(ctx workflow.Context, taskIDs []string) ([]string, error) {
+	// Create parallel activities
+	futures := make([]workflow.Future, len(taskIDs))
+
+	for i, taskID := range taskIDs {
+		// Execute each task in parallel
+		future := workflow.ExecuteActivity(
+			workflow.WithActivityOptions(
+				ctx,
+				workflow.ActivityOptions{
+					ScheduleToCloseTimeout: DefaultActivityOptions().RetryBackoff * 60,
+					StartToCloseTimeout:    DefaultActivityOptions().RetryBackoff * 30,
+				},
+			),
+			"LearnFromExecutionActivity",
+			taskID,
+			fmt.Sprintf("Result from %s", taskID),
+			[]string{"parallel", taskID},
+		)
+		futures[i] = future
+	}
+
+	// Collect results
+	results := make([]string, len(futures))
+	for i, future := range futures {
+		err := future.Get(ctx, &results[i])
+		if err != nil {
+			return nil, fmt.Errorf("parallel learn task %d: %w", i, err)
+		}
+	}
+
+	return results, nil
+}

internal/routing/activity_knowledge_base.json

@@ -0,0 +1,684 @@
+{
+  "version": "1.0",
+  "activities": [
+    {
+      "name": "CloneRepoActivity",
+      "description": "Clone a Git repository to the worker filesystem",
+      "category": "repository",
+      "inputs": {
+        "repo": {
+          "type": "string",
+          "description": "Git repository URL",
+          "required": true
+        },
+        "branch": {
+          "type": "string",
+          "description": "Git branch to clone (default: main)",
+          "required": false,
+          "default": "main"
+        },
+        "depth": {
+          "type": "integer",
+          "description": "Shallow clone depth (optional)",
+          "required": false
+        }
+      },
+      "outputs": {
+        "path": {
+          "type": "string",
+          "description": "Local filesystem path where repo was cloned"
+        },
+        "commit": {
+          "type": "string",
+          "description": "Current commit hash"
+        },
+        "branch": {
+          "type": "string",
+          "description": "Current branch name"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "5m",
+        "isFlaky": false,
+        "recommendedRetries": 1,
+        "retryBackoff": 1.5,
+        "dependencies": [],
+        "notes": "Network-dependent, may timeout on slow connections"
+      }
+    },
+    {
+      "name": "AnalyzeCodeActivity",
+      "description": "Analyze code quality, structure, and metrics using ast-grep and pi CLI",
+      "category": "analysis",
+      "inputs": {
+        "path": {
+          "type": "string",
+          "description": "Local filesystem path to analyze",
+          "required": true
+        },
+        "language": {
+          "type": "string",
+          "description": "Programming language (go, python, javascript, etc)",
+          "required": false
+        },
+        "depth": {
+          "type": "integer",
+          "description": "Analysis depth (1=shallow, 5=deep)",
+          "required": false,
+          "default": 3
+        }
+      },
+      "outputs": {
+        "quality": {
+          "type": "number",
+          "description": "Quality score 0-1.0"
+        },
+        "metrics": {
+          "type": "object",
+          "description": "Code metrics (LOC, complexity, etc)"
+        },
+        "issues": {
+          "type": "array",
+          "description": "List of identified issues"
+        },
+        "summary": {
+          "type": "string",
+          "description": "Human-readable analysis summary"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "10m",
+        "isFlaky": true,
+        "recommendedRetries": 3,
+        "retryBackoff": 2.0,
+        "dependencies": ["CloneRepoActivity"],
+        "notes": "CPU-intensive, can timeout on large repos. Flaky on memory pressure."
+      }
+    },
+    {
+      "name": "SecurityScanActivity",
+      "description": "Run security scanning (SAST) on codebase",
+      "category": "security",
+      "inputs": {
+        "path": {
+          "type": "string",
+          "description": "Local filesystem path to scan",
+          "required": true
+        },
+        "severity": {
+          "type": "string",
+          "description": "Minimum severity level (low, medium, high, critical)",
+          "required": false,
+          "default": "medium"
+        }
+      },
+      "outputs": {
+        "vulnerabilities": {
+          "type": "array",
+          "description": "List of vulnerabilities found"
+        },
+        "securityScore": {
+          "type": "number",
+          "description": "Security score 0-100"
+        },
+        "riskLevel": {
+          "type": "string",
+          "description": "Risk level (low, medium, high, critical)"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "8m",
+        "isFlaky": false,
+        "recommendedRetries": 2,
+        "retryBackoff": 1.5,
+        "dependencies": ["CloneRepoActivity"],
+        "notes": "Network calls for vulnerability databases may timeout"
+      }
+    },
+    {
+      "name": "GenerateReportActivity",
+      "description": "Generate comprehensive report from analysis and scan results",
+      "category": "reporting",
+      "inputs": {
+        "analysisResult": {
+          "type": "object",
+          "description": "Output from AnalyzeCodeActivity",
+          "required": true
+        },
+        "securityResult": {
+          "type": "object",
+          "description": "Output from SecurityScanActivity",
+          "required": true
+        },
+        "format": {
+          "type": "string",
+          "description": "Report format (markdown, html, json)",
+          "required": false,
+          "default": "markdown"
+        }
+      },
+      "outputs": {
+        "report": {
+          "type": "string",
+          "description": "Generated report content"
+        },
+        "reportPath": {
+          "type": "string",
+          "description": "Path to saved report file"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "2m",
+        "isFlaky": false,
+        "recommendedRetries": 1,
+        "retryBackoff": 1.0,
+        "dependencies": ["AnalyzeCodeActivity", "SecurityScanActivity"],
+        "notes": "CPU-light, reliable. Depends on upstream results."
+      }
+    },
+    {
+      "name": "DeploymentPreCheckActivity",
+      "description": "Validate readiness for deployment (linting, tests, etc)",
+      "category": "deployment",
+      "inputs": {
+        "path": {
+          "type": "string",
+          "description": "Local filesystem path to check",
+          "required": true
+        },
+        "checkType": {
+          "type": "string",
+          "description": "Type of check (lint, test, build, all)",
+          "required": false,
+          "default": "all"
+        }
+      },
+      "outputs": {
+        "passed": {
+          "type": "boolean",
+          "description": "Whether all checks passed"
+        },
+        "failures": {
+          "type": "array",
+          "description": "List of failed checks"
+        },
+        "warnings": {
+          "type": "array",
+          "description": "List of warnings"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "15m",
+        "isFlaky": true,
+        "recommendedRetries": 2,
+        "retryBackoff": 2.0,
+        "dependencies": ["CloneRepoActivity"],
+        "notes": "Very flaky - tests are non-deterministic, network issues, race conditions. Retry 2x."
+      }
+    },
+    {
+      "name": "NotifyStatusActivity",
+      "description": "Send notifications to Slack, email, or webhook",
+      "category": "notification",
+      "inputs": {
+        "channel": {
+          "type": "string",
+          "description": "Target channel or email",
+          "required": true
+        },
+        "status": {
+          "type": "string",
+          "description": "Status to report (success, failure, warning)",
+          "required": true
+        },
+        "message": {
+          "type": "string",
+          "description": "Message body",
+          "required": true
+        }
+      },
+      "outputs": {
+        "notificationId": {
+          "type": "string",
+          "description": "ID of sent notification"
+        },
+        "timestamp": {
+          "type": "string",
+          "description": "When notification was sent"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "3m",
+        "isFlaky": true,
+        "recommendedRetries": 3,
+        "retryBackoff": 1.5,
+        "dependencies": [],
+        "notes": "Network-dependent, may fail due to network or external service issues. Retry 3x."
+      }
+    },
+    {
+      "name": "ApproveWorkflowActivity",
+      "description": "Human approval step or automated policy check",
+      "category": "approval",
+      "inputs": {
+        "workflowId": {
+          "type": "string",
+          "description": "ID of workflow awaiting approval",
+          "required": true
+        },
+        "requiredApprovals": {
+          "type": "integer",
+          "description": "Number of approvals needed (default 1)",
+          "required": false,
+          "default": 1
+        },
+        "timeoutMinutes": {
+          "type": "integer",
+          "description": "Minutes to wait for approval",
+          "required": false,
+          "default": 60
+        }
+      },
+      "outputs": {
+        "approved": {
+          "type": "boolean",
+          "description": "Whether approved"
+        },
+        "approver": {
+          "type": "string",
+          "description": "Who approved (if approved)"
+        },
+        "timestamp": {
+          "type": "string",
+          "description": "When approval was given"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "120m",
+        "isFlaky": false,
+        "recommendedRetries": 1,
+        "retryBackoff": 1.0,
+        "dependencies": [],
+        "notes": "Waits for human input. Long timeout. Cannot retry (user input is irrevocable)."
+      }
+    },
+    {
+      "name": "ArchiveResultsActivity",
+      "description": "Archive analysis results to cloud storage (S3, GCS)",
+      "category": "storage",
+      "inputs": {
+        "reportPath": {
+          "type": "string",
+          "description": "Path to report to archive",
+          "required": true
+        },
+        "destination": {
+          "type": "string",
+          "description": "Cloud destination (s3://bucket/path or gcs://bucket/path)",
+          "required": true
+        },
+        "metadata": {
+          "type": "object",
+          "description": "Optional metadata tags",
+          "required": false
+        }
+      },
+      "outputs": {
+        "archiveUrl": {
+          "type": "string",
+          "description": "URL of archived file"
+        },
+        "archiveSize": {
+          "type": "integer",
+          "description": "Size of archived file in bytes"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "5m",
+        "isFlaky": true,
+        "recommendedRetries": 2,
+        "retryBackoff": 1.5,
+        "dependencies": [],
+        "notes": "Network-dependent. May fail on network issues or service throttling. Retry 2x."
+      }
+    },
+    {
+      "name": "RetrieveMemoryActivity",
+      "description": "Retrieve relevant knowledge, skills, and lessons from poimen-memory semantic search",
+      "category": "memory",
+      "inputs": {
+        "query": {
+          "type": "string",
+          "description": "Semantic search query",
+          "required": true
+        },
+        "project": {
+          "type": "string",
+          "description": "Memory project (default: poimen)",
+          "required": false,
+          "default": "poimen"
+        },
+        "scope": {
+          "type": "string",
+          "description": "Retrieval scope: skills, lessons, references, all",
+          "required": false,
+          "default": "all"
+        },
+        "limit": {
+          "type": "integer",
+          "description": "Max results to return",
+          "required": false,
+          "default": 10
+        },
+        "tool": {
+          "type": "string",
+          "description": "Tool context for skill matching",
+          "required": false
+        },
+        "task": {
+          "type": "string",
+          "description": "Task description for context retrieval",
+          "required": false
+        }
+      },
+      "outputs": {
+        "skills": {
+          "type": "array",
+          "description": "Relevant skills found"
+        },
+        "lessons": {
+          "type": "array",
+          "description": "Relevant lessons/knowledge found"
+        },
+        "references": {
+          "type": "array",
+          "description": "Reference documents found"
+        },
+        "totalResults": {
+          "type": "integer",
+          "description": "Total results found"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "30s",
+        "isFlaky": true,
+        "recommendedRetries": 2,
+        "retryBackoff": 1.5,
+        "dependencies": [],
+        "notes": "Network-dependent. First activity to run for context-aware routing. Fast timeout."
+      }
+    },
+    {
+      "name": "AssumeRoleActivity",
+      "description": "Request temporary JWT token for accessing LLM APIs (like AWS AssumeRole)",
+      "category": "authentication",
+      "inputs": {
+        "identity": {
+          "type": "string",
+          "description": "User/service identity requesting access",
+          "required": true,
+          "examples": ["[email protected]", "service:poimen-worker"]
+        },
+        "clientId": {
+          "type": "string",
+          "description": "OAuth2 client ID (from vault if not provided)",
+          "required": false
+        },
+        "clientSecret": {
+          "type": "string",
+          "description": "OAuth2 client secret (from vault if not provided)",
+          "required": false
+        },
+        "scope": {
+          "type": "string",
+          "description": "Scope of access (e.g., 'llm:read' or 'llm:read llm:write')",
+          "required": true,
+          "examples": ["llm:read", "llm:read llm:write", "llm:admin"]
+        },
+        "durationSeconds": {
+          "type": "integer",
+          "description": "Token validity duration in seconds (default: 3600, max: 86400)",
+          "required": false,
+          "default": 3600
+        },
+        "authServerUrl": {
+          "type": "string",
+          "description": "Auth server URL (from AUTH_SERVER_URL env if not provided)",
+          "required": false
+        }
+      },
+      "outputs": {
+        "token": {
+          "type": "string",
+          "description": "JWT token for calling api.riotpiao.com"
+        },
+        "expiresAt": {
+          "type": "integer",
+          "description": "Token expiration time (Unix timestamp)"
+        },
+        "expiresIn": {
+          "type": "integer",
+          "description": "Seconds until token expires"
+        },
+        "tokenType": {
+          "type": "string",
+          "description": "Token type (typically 'Bearer')"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "30s",
+        "isFlaky": false,
+        "recommendedRetries": 2,
+        "retryBackoff": 1.5,
+        "dependencies": [],
+        "notes": "Must run before LLM Router to provide auth token. Call early in workflow."
+      }
+    },
+    {
+      "name": "LLMInferenceActivity",
+      "description": "Call LLM API with custom prompt and get response text",
+      "category": "llm",
+      "inputs": {
+        "model": {
+          "type": "string",
+          "description": "Model ID (reasoning, ornith:35b, ornith:13b, qwen2.5:3b)",
+          "required": true,
+          "examples": ["reasoning", "ornith:35b"]
+        },
+        "system_prompt": {
+          "type": "string",
+          "description": "System instruction for the model",
+          "required": false,
+          "default": ""
+        },
+        "user_prompt": {
+          "type": "string",
+          "description": "User message to send to the model",
+          "required": true
+        },
+        "temperature": {
+          "type": "number",
+          "description": "Sampling temperature (0.0-1.0, higher=more creative)",
+          "required": false,
+          "default": 0.7
+        },
+        "max_tokens": {
+          "type": "integer",
+          "description": "Maximum tokens in response",
+          "required": false
+        }
+      },
+      "outputs": {
+        "response": {
+          "type": "string",
+          "description": "LLM response text"
+        },
+        "model": {
+          "type": "string",
+          "description": "Model used for inference"
+        },
+        "stop_reason": {
+          "type": "string",
+          "description": "Why inference stopped (stop_sequence, length, etc)"
+        },
+        "tokens_used": {
+          "type": "integer",
+          "description": "Total tokens consumed"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "120s",
+        "isFlaky": true,
+        "recommendedRetries": 2,
+        "retryBackoff": 2.0,
+        "dependencies": [],
+        "notes": "API-dependent. Network flaky. Use for single prompts. See LLMBatchInferenceActivity for multiple."
+      }
+    },
+    {
+      "name": "LLMBatchInferenceActivity",
+      "description": "Call LLM API multiple times sequentially with different prompts",
+      "category": "llm",
+      "inputs": {
+        "model": {
+          "type": "string",
+          "description": "Model ID (reasoning, ornith:35b, ornith:13b, qwen2.5:3b)",
+          "required": true
+        },
+        "system_prompt": {
+          "type": "string",
+          "description": "System instruction (same for all prompts)",
+          "required": false
+        },
+        "prompts": {
+          "type": "array",
+          "description": "List of user prompts to process",
+          "required": true,
+          "items": {
+            "type": "string"
+          }
+        },
+        "temperature": {
+          "type": "number",
+          "description": "Sampling temperature (0.0-1.0)",
+          "required": false,
+          "default": 0.7
+        }
+      },
+      "outputs": {
+        "responses": {
+          "type": "array",
+          "description": "List of LLM responses (parallel to input prompts)",
+          "items": {
+            "type": "string"
+          }
+        },
+        "model": {
+          "type": "string",
+          "description": "Model used"
+        },
+        "errors": {
+          "type": "array",
+          "description": "Error messages for failed prompts",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "600s",
+        "isFlaky": true,
+        "recommendedRetries": 1,
+        "retryBackoff": 2.0,
+        "dependencies": [],
+        "notes": "Sequential processing of multiple prompts. Use for batch analysis, summarization, etc."
+      }
+    },
+    {
+      "name": "CanvasReasonerActivity",
+      "description": "Use LLM reasoning to infer and suggest connections between workflow activities",
+      "category": "workflow",
+      "inputs": {
+        "nodes": {
+          "type": "array",
+          "description": "Canvas workflow nodes to analyze",
+          "required": true,
+          "items": {
+            "type": "object",
+            "properties": {
+              "id": {"type": "string"},
+              "type": {"type": "string"},
+              "label": {"type": "string"}
+            }
+          }
+        },
+        "edges": {
+          "type": "array",
+          "description": "Existing edges in the workflow",
+          "required": false,
+          "items": {
+            "type": "object"
+          }
+        },
+        "preserve_existing": {
+          "type": "boolean",
+          "description": "If true, only suggest new edges; if false, redesign entire workflow",
+          "required": false,
+          "default": true
+        },
+        "auth_token": {
+          "type": "string",
+          "description": "JWT token for authenticated LLM calls",
+          "required": false
+        }
+      },
+      "outputs": {
+        "suggested_edges": {
+          "type": "array",
+          "description": "Edges suggested by LLM reasoning",
+          "items": {
+            "type": "object",
+            "properties": {
+              "source": {"type": "string"},
+              "target": {"type": "string"}
+            }
+          }
+        },
+        "reasoning": {
+          "type": "string",
+          "description": "LLM explanation of suggested connections"
+        },
+        "confidence": {
+          "type": "number",
+          "description": "Confidence score (0.0-1.0) of the suggestions"
+        }
+      },
+      "constraints": {
+        "defaultTimeout": "120s",
+        "isFlaky": true,
+        "recommendedRetries": 2,
+        "retryBackoff": 2.0,
+        "dependencies": [],
+        "notes": "Uses reasoning model to analyze workflow logic. Good for understanding data flow and connections between activities."
+      }
+    }
+  ],
+  "metadata": {
+    "totalActivities": 13,
+    "lastUpdated": "2025-09-05T00:00:00Z",
+    "categories": {
+      "repository": 1,
+      "analysis": 1,
+      "security": 1,
+      "reporting": 1,
+      "deployment": 1,
+      "notification": 1,
+      "approval": 1,
+      "storage": 1,
+      "memory": 1,
+      "authentication": 1,
+      "llm": 2,
+      "workflow": 1
+    }
+  }
+}

internal/routing/canvas_converter.go

@@ -0,0 +1,179 @@
+package routing
+
+import (
+	"fmt"
+
+	"github.com/rockliang/poimen/workflows/pkg/db"
+)
+
+// CanvasConverter converts visual canvas to executable WorkflowSpec
+type CanvasConverter struct {
+	validator *CanvasValidator
+}
+
+// NewCanvasConverter creates a converter
+func NewCanvasConverter() *CanvasConverter {
+	return &CanvasConverter{
+		validator: NewCanvasValidator(),
+	}
+}
+
+// CanvasToWorkflowSpec converts canvas to WorkflowSpec
+func (cc *CanvasConverter) CanvasToWorkflowSpec(canvas *db.Canvas) (*WorkflowSpec, error) {
+	// Validate first
+	if err := cc.validator.ValidateCanvas(canvas); err != nil {
+		return nil, fmt.Errorf("canvas validation failed: %w", err)
+	}
+
+	// Get topological order
+	sortedNodes, err := cc.validator.TopoSort(canvas.Nodes, canvas.Edges)
+	if err != nil {
+		return nil, fmt.Errorf("topological sort failed: %w", err)
+	}
+
+	// Build states from sorted nodes
+	states := []State{}
+	nodeToState := make(map[string]int) // node ID to state index
+
+	for i, node := range sortedNodes {
+		state := cc.nodeToState(node, canvas.Edges)
+		states = append(states, state)
+		nodeToState[node.ID] = i
+	}
+
+	// Wire up transitions
+	for i, node := range sortedNodes {
+		outgoing := cc.getOutgoingEdges(node.ID, canvas.Edges)
+
+		if len(outgoing) == 0 {
+			// Last state - no transitions
+			continue
+		}
+
+		if len(outgoing) == 1 {
+			// Single outgoing edge
+			targetNode := outgoing[0]
+			targetIdx := nodeToState[targetNode]
+			if targetIdx > i {
+				states[i].Next = states[targetIdx].Name
+			}
+		} else {
+			// Multiple outgoing edges - parallel
+			states[i].Type = "Parallel"
+			branches := []interface{}{}
+			for _, targetNode := range outgoing {
+				branches = append(branches, map[string]string{
+					"state": states[nodeToState[targetNode]].Name,
+				})
+			}
+			if states[i].Branches == nil {
+				states[i].Branches = branches
+			}
+		}
+	}
+
+	spec := &WorkflowSpec{
+		Name:   canvas.Name,
+		Input:  map[string]interface{}{},
+		States: states,
+	}
+
+	return spec, nil
+}
+
+// nodeToState converts a canvas node to a workflow state
+func (cc *CanvasConverter) nodeToState(node db.WorkflowNode, edges []db.WorkflowEdge) State {
+	// Map node type to activity name
+	activityName := cc.mapActivityType(node.Type)
+
+	state := State{
+		Name:       node.ID,
+		Type:       TaskActivity,
+		Activity:   activityName,
+		Retry:      &RetryPolicy{MaxAttempts: 3, BackoffSeconds: 2},
+		Timeout:    "300s",
+		Parameters: node.Data,
+	}
+
+	return state
+}
+
+// mapActivityType maps canvas activity type to Poimen activity
+func (cc *CanvasConverter) mapActivityType(canvasType string) string {
+	typeMap := map[string]string{
+		"clone-repo":          "CloneRepoActivity",
+		"analyze-code":        "AnalyzeCodeActivity",
+		"security-scan":       "SecurityScanActivity",
+		"generate-report":     "GenerateReportActivity",
+		"deployment-precheck": "DeploymentPreCheckActivity",
+		"notify-status":       "NotifyStatusActivity",
+		"approve-workflow":    "ApproveWorkflowActivity",
+		"archive-results":     "ArchiveResultsActivity",
+		"retrieve-memory":     "RetrieveMemoryActivity",
+		"assume-role":         "AssumeRoleActivity",
+		"llm-inference":       "LLMInferenceActivity",
+		"llm-batch-inference": "LLMBatchInferenceActivity",
+		"canvas-reasoner":     "CanvasReasonerActivity",
+	}
+
+	if mapped, ok := typeMap[canvasType]; ok {
+		return mapped
+	}
+
+	return canvasType // fallback to type as-is
+}
+
+// getOutgoingEdges returns target node IDs for a given source node
+func (cc *CanvasConverter) getOutgoingEdges(nodeID string, edges []db.WorkflowEdge) []string {
+	targets := []string{}
+	seen := make(map[string]bool)
+
+	for _, edge := range edges {
+		if edge.Source == nodeID && !seen[edge.Target] {
+			targets = append(targets, edge.Target)
+			seen[edge.Target] = true
+		}
+	}
+
+	return targets
+}
+
+// CanvasToExecutionPlan converts canvas to sequential activity list
+func (cc *CanvasConverter) CanvasToExecutionPlan(canvas *db.Canvas) ([]ExecutionStep, error) {
+	// Validate first
+	if err := cc.validator.ValidateCanvas(canvas); err != nil {
+		return nil, fmt.Errorf("canvas validation failed: %w", err)
+	}
+
+	// Get topological order
+	sortedNodes, err := cc.validator.TopoSort(canvas.Nodes, canvas.Edges)
+	if err != nil {
+		return nil, fmt.Errorf("topological sort failed: %w", err)
+	}
+
+	steps := []ExecutionStep{}
+	for i, node := range sortedNodes {
+		step := ExecutionStep{
+			Index:        i,
+			NodeID:       node.ID,
+			ActivityName: cc.mapActivityType(node.Type),
+			Label:        node.Label,
+			Parameters:   node.Data,
+			Timeout:      "300s",
+		}
+		steps = append(steps, step)
+	}
+
+	return steps, nil
+}
+
+// ExecutionStep represents one activity in execution plan
+type ExecutionStep struct {
+	Index        int                   `json:"index"`
+	NodeID       string                `json:"node_id"`
+	ActivityName string                `json:"activity_name"`
+	Label        string                `json:"label"`
+	Parameters   map[string]interface{} `json:"parameters"`
+	Timeout      string                `json:"timeout"`
+	DependsOn    []int                 `json:"depends_on,omitempty"` // Indices of predecessor steps
+}

internal/routing/canvas_validator.go

@@ -0,0 +1,317 @@
+package routing
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/rockliang/poimen/workflows/pkg/db"
+)
+
+// CanvasValidator validates React Flow canvas (nodes + edges)
+type CanvasValidator struct {
+	activityRegistry map[string]bool
+}
+
+// NewCanvasValidator creates validator with activity registry
+func NewCanvasValidator() *CanvasValidator {
+	return &CanvasValidator{
+		activityRegistry: map[string]bool{
+			"clone-repo":              true,
+			"analyze-code":            true,
+			"security-scan":           true,
+			"generate-report":         true,
+			"deployment-precheck":     true,
+			"notify-status":           true,
+			"approve-workflow":        true,
+			"archive-results":         true,
+			"retrieve-memory":         true,
+			"assume-role":             true,
+			"llm-inference":           true,
+			"llm-batch-inference":     true,
+			"canvas-reasoner":         true,
+		},
+	}
+}
+
+// ValidateCanvas checks canvas structure, connectivity, and DAG
+func (cv *CanvasValidator) ValidateCanvas(canvas *db.Canvas) error {
+	if canvas == nil {
+		return fmt.Errorf("canvas is nil")
+	}
+
+	if len(canvas.Nodes) == 0 {
+		return fmt.Errorf("canvas has no nodes")
+	}
+
+	// Step 1: Validate nodes
+	if err := cv.validateNodes(canvas.Nodes); err != nil {
+		return fmt.Errorf("node validation failed: %w", err)
+	}
+
+	// Step 2: Validate edges
+	if err := cv.validateEdges(canvas.Nodes, canvas.Edges); err != nil {
+		return fmt.Errorf("edge validation failed: %w", err)
+	}
+
+	// Step 3: Check for cycles (must be DAG)
+	if err := cv.detectCycles(canvas.Nodes, canvas.Edges); err != nil {
+		return fmt.Errorf("cycle detected: %w", err)
+	}
+
+	// Step 4: Check connectivity (all nodes reachable from start)
+	if err := cv.validateConnectivity(canvas.Nodes, canvas.Edges); err != nil {
+		return fmt.Errorf("connectivity check failed: %w", err)
+	}
+
+	return nil
+}
+
+// validateNodes checks each node has required fields and valid type
+func (cv *CanvasValidator) validateNodes(nodes []db.WorkflowNode) error {
+	if len(nodes) == 0 {
+		return fmt.Errorf("no nodes in canvas")
+	}
+
+	nodeIds := make(map[string]bool)
+
+	for i, node := range nodes {
+		// Check required fields
+		if node.ID == "" {
+			return fmt.Errorf("node[%d] has empty ID", i)
+		}
+
+		if nodeIds[node.ID] {
+			return fmt.Errorf("node[%d] has duplicate ID: %s", i, node.ID)
+		}
+		nodeIds[node.ID] = true
+
+		if node.Label == "" {
+			return fmt.Errorf("node[%d] (%s) has empty label", i, node.ID)
+		}
+
+		if node.Position == nil {
+			return fmt.Errorf("node[%d] (%s) has no position", i, node.ID)
+		}
+
+		// Check activity type (if present)
+		if node.Type != "" && !cv.activityRegistry[strings.ToLower(node.Type)] {
+			return fmt.Errorf("node[%d] (%s) has unknown activity type: %s", i, node.ID, node.Type)
+		}
+
+		// Check data structure
+		if node.Data == nil {
+			return fmt.Errorf("node[%d] (%s) has no data", i, node.ID)
+		}
+	}
+
+	return nil
+}
+
+// validateEdges checks edges reference valid nodes
+func (cv *CanvasValidator) validateEdges(nodes []db.WorkflowNode, edges []db.WorkflowEdge) error {
+	nodeIds := make(map[string]bool)
+	for _, node := range nodes {
+		nodeIds[node.ID] = true
+	}
+
+	for i, edge := range edges {
+		// Check required fields
+		if edge.Source == "" {
+			return fmt.Errorf("edge[%d] has empty source", i)
+		}
+
+		if edge.Target == "" {
+			return fmt.Errorf("edge[%d] has empty target", i)
+		}
+
+		// Check source node exists
+		if !nodeIds[edge.Source] {
+			return fmt.Errorf("edge[%d] references unknown source node: %s", i, edge.Source)
+		}
+
+		// Check target node exists
+		if !nodeIds[edge.Target] {
+			return fmt.Errorf("edge[%d] references unknown target node: %s", i, edge.Target)
+		}
+
+		// Check self-loops (discouraged but allow for now)
+		if edge.Source == edge.Target {
+			// Could warn here but not fail
+		}
+	}
+
+	return nil
+}
+
+// detectCycles checks for cycles in the DAG (must be acyclic)
+func (cv *CanvasValidator) detectCycles(nodes []db.WorkflowNode, edges []db.WorkflowEdge) error {
+	// Build adjacency list
+	graph := make(map[string][]string)
+	inDegree := make(map[string]int)
+
+	for _, node := range nodes {
+		graph[node.ID] = []string{}
+		inDegree[node.ID] = 0
+	}
+
+	for _, edge := range edges {
+		graph[edge.Source] = append(graph[edge.Source], edge.Target)
+		inDegree[edge.Target]++
+	}
+
+	// Kahn's algorithm: topological sort
+	queue := []string{}
+	for _, node := range nodes {
+		if inDegree[node.ID] == 0 {
+			queue = append(queue, node.ID)
+		}
+	}
+
+	processed := 0
+	for len(queue) > 0 {
+		// Dequeue
+		current := queue[0]
+		queue = queue[1:]
+		processed++
+
+		// Visit neighbors
+		for _, neighbor := range graph[current] {
+			inDegree[neighbor]--
+			if inDegree[neighbor] == 0 {
+				queue = append(queue, neighbor)
+			}
+		}
+	}
+
+	// If we didn't process all nodes, there's a cycle
+	if processed != len(nodes) {
+		return fmt.Errorf("graph has cycle (processed %d/%d nodes)", processed, len(nodes))
+	}
+
+	return nil
+}
+
+// validateConnectivity checks all nodes are reachable from start nodes
+func (cv *CanvasValidator) validateConnectivity(nodes []db.WorkflowNode, edges []db.WorkflowEdge) error {
+	if len(nodes) == 0 {
+		return nil
+	}
+
+	// Build adjacency list
+	graph := make(map[string][]string)
+	inDegree := make(map[string]int)
+
+	for _, node := range nodes {
+		graph[node.ID] = []string{}
+		inDegree[node.ID] = 0
+	}
+
+	for _, edge := range edges {
+		graph[edge.Source] = append(graph[edge.Source], edge.Target)
+		inDegree[edge.Target]++
+	}
+
+	// Find start nodes (in-degree 0)
+	startNodes := []string{}
+	for _, node := range nodes {
+		if inDegree[node.ID] == 0 {
+			startNodes = append(startNodes, node.ID)
+		}
+	}
+
+	if len(startNodes) == 0 {
+		return fmt.Errorf("no start nodes found (all nodes have incoming edges)")
+	}
+
+	// BFS from all start nodes
+	visited := make(map[string]bool)
+	queue := startNodes
+
+	for len(queue) > 0 {
+		// Dequeue
+		current := queue[0]
+		queue = queue[1:]
+
+		if visited[current] {
+			continue
+		}
+		visited[current] = true
+
+		// Visit neighbors
+		for _, neighbor := range graph[current] {
+			if !visited[neighbor] {
+				queue = append(queue, neighbor)
+			}
+		}
+	}
+
+	// Check all nodes were visited
+	if len(visited) != len(nodes) {
+		unreached := []string{}
+		for _, node := range nodes {
+			if !visited[node.ID] {
+				unreached = append(unreached, node.ID)
+			}
+		}
+		return fmt.Errorf("unreachable nodes: %v", unreached)
+	}
+
+	return nil
+}
+
+// TopoSort returns nodes in topological order (execution order)
+func (cv *CanvasValidator) TopoSort(nodes []db.WorkflowNode, edges []db.WorkflowEdge) ([]db.WorkflowNode, error) {
+	if len(nodes) == 0 {
+		return []db.WorkflowNode{}, nil
+	}
+
+	// Build adjacency list and in-degree map
+	graph := make(map[string][]string)
+	inDegree := make(map[string]int)
+	nodeMap := make(map[string]db.WorkflowNode)
+
+	for _, node := range nodes {
+		graph[node.ID] = []string{}
+		inDegree[node.ID] = 0
+		nodeMap[node.ID] = node
+	}
+
+	for _, edge := range edges {
+		graph[edge.Source] = append(graph[edge.Source], edge.Target)
+		inDegree[edge.Target]++
+	}
+
+	// Kahn's algorithm
+	queue := []string{}
+	for _, node := range nodes {
+		if inDegree[node.ID] == 0 {
+			queue = append(queue, node.ID)
+		}
+	}
+
+	result := []db.WorkflowNode{}
+	processed := make(map[string]bool)
+
+	for len(queue) > 0 {
+		// Dequeue
+		current := queue[0]
+		queue = queue[1:]
+
+		result = append(result, nodeMap[current])
+		processed[current] = true
+
+		// Visit neighbors
+		for _, neighbor := range graph[current] {
+			inDegree[neighbor]--
+			if inDegree[neighbor] == 0 {
+				queue = append(queue, neighbor)
+			}
+		}
+	}
+
+	if len(result) != len(nodes) {
+		return nil, fmt.Errorf("topological sort failed: graph has cycle")
+	}
+
+	return result, nil
+}

internal/routing/executor.go

@@ -0,0 +1,224 @@
+package routing
+
+import (
+	"context"
+	"fmt"
+)
+
+// ActivityExecutor defines how to execute an activity
+type ActivityExecutor interface {
+	// Execute runs the activity with given parameters
+	Execute(ctx context.Context, activityName string, params map[string]interface{}) (interface{}, error)
+}
+
+// TemporalActivityExecutor executes activities via Temporal
+type TemporalActivityExecutor struct {
+	// This would be implemented by workflow context
+	executor func(context.Context, string, interface{}) error
+}
+
+// StateTransitioner defines state machine transitions
+type StateTransitioner interface {
+	// CanTransition checks if transition is allowed
+	CanTransition(from, to *State) bool
+	// Transit performs the transition
+	Transit(from, to *State) error
+}
+
+// DefaultStateTransitioner implements basic transitions
+type DefaultStateTransitioner struct {
+	validators []TransitionValidator
+}
+
+// TransitionValidator validates a specific transition
+type TransitionValidator interface {
+	Validate(from, to *State) error
+}
+
+// NewDefaultStateTransitioner creates a new transitioner
+func NewDefaultStateTransitioner() *DefaultStateTransitioner {
+	return &DefaultStateTransitioner{
+		validators: []TransitionValidator{
+			&StateTypeValidator{},
+			&OutputMatchValidator{},
+		},
+	}
+}
+
+// CanTransition checks if transition is valid
+func (dst *DefaultStateTransitioner) CanTransition(from, to *State) bool {
+	return dst.Transit(from, to) == nil
+}
+
+// Transit validates and performs transition
+func (dst *DefaultStateTransitioner) Transit(from, to *State) error {
+	for _, v := range dst.validators {
+		if err := v.Validate(from, to); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// StateTypeValidator checks state type compatibility
+type StateTypeValidator struct{}
+
+func (stv *StateTypeValidator) Validate(from, to *State) error {
+	if from == nil {
+		return nil // Initial transition
+	}
+	
+	// Can't transition from terminal states
+	if from.Type == StateTypeFail {
+		return fmt.Errorf("cannot transition from Fail state")
+	}
+	if from.End && from.Type != StateTypePass {
+		return fmt.Errorf("cannot transition from end state")
+	}
+	
+	return nil
+}
+
+// OutputMatchValidator checks output-input binding
+type OutputMatchValidator struct{}
+
+func (omv *OutputMatchValidator) Validate(from, to *State) error {
+	// Could validate that outputs from previous state match inputs needed
+	return nil
+}
+
+// ParameterBinder resolves parameters from context
+type ParameterBinder interface {
+	// Bind resolves all parameters for a state
+	Bind(state *State, context *ExecutionContext) (map[string]interface{}, error)
+}
+
+// DefaultParameterBinder implements parameter resolution
+type DefaultParameterBinder struct {
+	resolver *JSONPathResolver
+}
+
+// NewDefaultParameterBinder creates a new binder
+func NewDefaultParameterBinder() *DefaultParameterBinder {
+	return &DefaultParameterBinder{
+		resolver: NewJSONPathResolver(nil, nil),
+	}
+}
+
+// Bind resolves all parameters
+func (dpb *DefaultParameterBinder) Bind(state *State, context *ExecutionContext) (map[string]interface{}, error) {
+	dpb.resolver.input = context.Input
+	dpb.resolver.stepResults = context.StepResults
+	
+	resolved, err := dpb.resolver.ResolvePaths(state.Parameters)
+	if err != nil {
+		return nil, fmt.Errorf("parameter binding failed: %w", err)
+	}
+	
+	return resolved, nil
+}
+
+// WorkflowValidator validates workflow specs
+type WorkflowValidator interface {
+	// Validate checks if workflow is valid
+	Validate(spec *WorkflowSpec) error
+}
+
+// CompositeValidator combines multiple validators
+type CompositeValidator struct {
+	validators []WorkflowValidator
+}
+
+// NewCompositeValidator creates a composite validator
+func NewCompositeValidator(validators ...WorkflowValidator) *CompositeValidator {
+	return &CompositeValidator{validators: validators}
+}
+
+// Validate runs all validators
+func (cv *CompositeValidator) Validate(spec *WorkflowSpec) error {
+	for _, v := range cv.validators {
+		if err := v.Validate(spec); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// StateGraphValidator validates state graph structure
+type StateGraphValidator struct{}
+
+func (sgv *StateGraphValidator) Validate(spec *WorkflowSpec) error {
+	if spec == nil {
+		return fmt.Errorf("workflow spec is nil")
+	}
+	if len(spec.States) == 0 {
+		return fmt.Errorf("workflow has no states")
+	}
+	
+	stateMap := make(map[string]*State)
+	for i := range spec.States {
+		stateMap[spec.States[i].Name] = &spec.States[i]
+	}
+	
+	// Check all transitions point to valid states
+	for _, state := range spec.States {
+		if state.Type == StateTypeTask && !state.End {
+			if state.Next == "" {
+				return fmt.Errorf("state %s has no next state and is not end", state.Name)
+			}
+			if _, exists := stateMap[state.Next]; !exists {
+				return fmt.Errorf("state %s references non-existent next state %s", state.Name, state.Next)
+			}
+		}
+		
+		// Validate catch clauses
+		for _, catch := range state.Catch {
+			if _, exists := stateMap[catch.Next]; !exists {
+				return fmt.Errorf("catch handler in %s references non-existent state %s", state.Name, catch.Next)
+			}
+		}
+	}
+	
+	return nil
+}
+
+// ActivityAvailabilityValidator validates activities exist
+type ActivityAvailabilityValidator struct {
+	kb *KnowledgeBase
+}
+
+// NewActivityAvailabilityValidator creates a new validator
+func NewActivityAvailabilityValidator(kb *KnowledgeBase) *ActivityAvailabilityValidator {
+	return &ActivityAvailabilityValidator{kb: kb}
+}
+
+// Validate checks all activities are available
+func (aav *ActivityAvailabilityValidator) Validate(spec *WorkflowSpec) error {
+	for _, state := range spec.States {
+		if state.Type == StateTypeTask {
+			if !aav.kb.HasActivity(state.Resource) {
+				return fmt.Errorf("activity %s not found in knowledge base", state.Resource)
+			}
+		}
+	}
+	return nil
+}
+
+// TimeoutValidator validates timeouts
+type TimeoutValidator struct{}
+
+func (tv *TimeoutValidator) Validate(spec *WorkflowSpec) error {
+	for _, state := range spec.States {
+		if state.Timeout != "" {
+			if _, err := parseDuration(state.Timeout); err != nil {
+				return fmt.Errorf("invalid timeout in state %s: %w", state.Name, err)
+			}
+		}
+	}
+	return nil
+}
+
+func parseDuration(d string) (interface{}, error) {
+	// Placeholder for duration parsing
+	return nil, nil
+}

internal/routing/jsonpath.go

@@ -0,0 +1,230 @@
+package routing
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// JSONPathResolver resolves JSONPath expressions like ${input.repo}, ${Clone.output.path}
+type JSONPathResolver struct {
+	input       map[string]interface{}
+	stepResults map[string]interface{}
+}
+
+// NewJSONPathResolver creates a new resolver with input and step results
+func NewJSONPathResolver(input map[string]interface{}, stepResults map[string]interface{}) *JSONPathResolver {
+	return &JSONPathResolver{
+		input:       input,
+		stepResults: stepResults,
+	}
+}
+
+// Resolve resolves a single JSONPath expression
+// Supports: ${input.field}, ${StepName.output.field}, ${StepName.output.nested.field}
+func (r *JSONPathResolver) Resolve(expr string) (interface{}, error) {
+	if expr == "" {
+		return nil, fmt.Errorf("expression cannot be empty")
+	}
+
+	// Check if it's a template expression (starts with ${ and ends with })
+	if !strings.HasPrefix(expr, "${") || !strings.HasSuffix(expr, "}") {
+		// Return as-is if not a template
+		return expr, nil
+	}
+
+	// Extract the path from ${...}
+	path := strings.TrimPrefix(expr, "${")
+	path = strings.TrimSuffix(path, "}")
+
+	return r.resolvePath(path)
+}
+
+// ResolveString resolves a string that may contain multiple JSONPath expressions
+// Example: "Analysis at ${Clone.output.path} completed"
+func (r *JSONPathResolver) ResolveString(str string) (string, error) {
+	// Find all ${...} patterns
+	pattern := regexp.MustCompile(`\$\{[^}]+\}`)
+	
+	result := str
+	matches := pattern.FindAllString(str, -1)
+	
+	for _, match := range matches {
+		value, err := r.Resolve(match)
+		if err != nil {
+			return "", err
+		}
+		
+		// Convert value to string
+		strValue := fmt.Sprintf("%v", value)
+		result = strings.ReplaceAll(result, match, strValue)
+	}
+	
+	return result, nil
+}
+
+// ResolvePaths resolves all JSONPath expressions in a map recursively
+func (r *JSONPathResolver) ResolvePaths(data map[string]interface{}) (map[string]interface{}, error) {
+	result := make(map[string]interface{})
+	
+	for key, value := range data {
+		resolved, err := r.resolveValue(value)
+		if err != nil {
+			return nil, fmt.Errorf("failed to resolve key '%s': %w", key, err)
+		}
+		result[key] = resolved
+	}
+	
+	return result, nil
+}
+
+// resolvePath resolves a dot-separated path
+// Paths can be: input.field, StepName.output.field, etc.
+func (r *JSONPathResolver) resolvePath(path string) (interface{}, error) {
+	parts := strings.Split(path, ".")
+	if len(parts) == 0 {
+		return nil, fmt.Errorf("invalid path: %s", path)
+	}
+
+	// Check if first part is "input"
+	if parts[0] == "input" {
+		return r.resolveFromInput(parts[1:])
+	}
+
+	// Otherwise, assume it's a step name
+	stepName := parts[0]
+	stepData, ok := r.stepResults[stepName]
+	if !ok {
+		return nil, fmt.Errorf("step '%s' not found in results", stepName)
+	}
+
+	// Navigate through remaining parts
+	return r.navigateObject(stepData, parts[1:])
+}
+
+// resolveFromInput resolves path from input data
+func (r *JSONPathResolver) resolveFromInput(parts []string) (interface{}, error) {
+	if len(parts) == 0 {
+		return r.input, nil
+	}
+
+	return r.navigateObject(r.input, parts)
+}
+
+// navigateObject navigates through an object using path parts
+func (r *JSONPathResolver) navigateObject(obj interface{}, parts []string) (interface{}, error) {
+	current := obj
+
+	for i, part := range parts {
+		if current == nil {
+			return nil, fmt.Errorf("cannot navigate through nil at part %d (%s)", i, part)
+		}
+
+		// Handle map
+		if mapObj, ok := current.(map[string]interface{}); ok {
+			value, exists := mapObj[part]
+			if !exists {
+				return nil, fmt.Errorf("key '%s' not found in object", part)
+			}
+			current = value
+			continue
+		}
+
+		// Handle map[string]string
+		if strMap, ok := current.(map[string]string); ok {
+			value, exists := strMap[part]
+			if !exists {
+				return nil, fmt.Errorf("key '%s' not found in string map", part)
+			}
+			current = value
+			continue
+		}
+
+		// Cannot navigate further
+		return nil, fmt.Errorf("cannot navigate through non-object type at part %d (%s)", i, part)
+	}
+
+	return current, nil
+}
+
+// resolveValue recursively resolves values (strings, maps, slices)
+func (r *JSONPathResolver) resolveValue(value interface{}) (interface{}, error) {
+	if value == nil {
+		return nil, nil
+	}
+
+	switch v := value.(type) {
+	case string:
+		// Try to resolve as JSONPath
+		if strings.Contains(v, "${") {
+			// Check if it's a pure template (only one expression filling the whole string)
+			if strings.HasPrefix(v, "${") && strings.HasSuffix(v, "}") && strings.Count(v, "${") == 1 {
+				// Pure template - resolve as object
+				resolved, err := r.Resolve(v)
+				if err != nil {
+					return nil, err
+				}
+				return resolved, nil
+			}
+			// String with embedded expressions - resolve as string
+			resolved, err := r.ResolveString(v)
+			if err != nil {
+				return nil, err
+			}
+			return resolved, nil
+		}
+		return v, nil
+
+	case map[string]interface{}:
+		// Recursively resolve map
+		return r.ResolvePaths(v)
+
+	case []interface{}:
+		// Recursively resolve slice
+		result := make([]interface{}, len(v))
+		for i, item := range v {
+			resolved, err := r.resolveValue(item)
+			if err != nil {
+				return nil, err
+			}
+			result[i] = resolved
+		}
+		return result, nil
+
+	default:
+		// Return as-is for other types
+		return v, nil
+	}
+}
+
+// ValidatePath checks if a path is valid (doesn't guarantee it resolves)
+func (r *JSONPathResolver) ValidatePath(path string) error {
+	if !strings.Contains(path, ".") && path != "input" {
+		return fmt.Errorf("invalid path: must contain '.' or be 'input'")
+	}
+
+	parts := strings.Split(path, ".")
+	if len(parts) == 0 {
+		return fmt.Errorf("invalid path: no parts")
+	}
+
+	return nil
+}
+
+// GetAvailableSteps returns list of available steps in step results
+func (r *JSONPathResolver) GetAvailableSteps() []string {
+	steps := make([]string, 0, len(r.stepResults))
+	for step := range r.stepResults {
+		steps = append(steps, step)
+	}
+	return steps
+}
+
+// GetInputFields returns list of available input fields
+func (r *JSONPathResolver) GetInputFields() []string {
+	fields := make([]string, 0, len(r.input))
+	for field := range r.input {
+		fields = append(fields, field)
+	}
+	return fields
+}

internal/routing/jsonpath_test.go

@@ -0,0 +1,437 @@
+package routing
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestResolveInputField(t *testing.T) {
+	input := map[string]interface{}{
+		"repo":   "https://github.com/test/repo",
+		"branch": "main",
+	}
+	resolver := NewJSONPathResolver(input, map[string]interface{}{})
+
+	// Test resolving input field
+	value, err := resolver.Resolve("${input.repo}")
+	if err != nil {
+		t.Fatalf("Failed to resolve: %v", err)
+	}
+
+	if value != "https://github.com/test/repo" {
+		t.Errorf("Expected 'https://github.com/test/repo', got %v", value)
+	}
+}
+
+func TestResolveNestedField(t *testing.T) {
+	input := map[string]interface{}{}
+	stepResults := map[string]interface{}{
+		"Clone": map[string]interface{}{
+			"output": map[string]interface{}{
+				"path":   "/tmp/repo",
+				"commit": "abc123",
+			},
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	// Test resolving nested field
+	value, err := resolver.Resolve("${Clone.output.path}")
+	if err != nil {
+		t.Fatalf("Failed to resolve: %v", err)
+	}
+
+	if value != "/tmp/repo" {
+		t.Errorf("Expected '/tmp/repo', got %v", value)
+	}
+}
+
+func TestResolveDeepNesting(t *testing.T) {
+	input := map[string]interface{}{}
+	stepResults := map[string]interface{}{
+		"Analyze": map[string]interface{}{
+			"output": map[string]interface{}{
+				"metrics": map[string]interface{}{
+					"quality": map[string]interface{}{
+						"score": 0.95,
+					},
+				},
+			},
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	value, err := resolver.Resolve("${Analyze.output.metrics.quality.score}")
+	if err != nil {
+		t.Fatalf("Failed to resolve: %v", err)
+	}
+
+	score, ok := value.(float64)
+	if !ok {
+		t.Fatalf("Expected float64, got %T", value)
+	}
+
+	if score != 0.95 {
+		t.Errorf("Expected 0.95, got %v", score)
+	}
+}
+
+func TestResolveNonTemplate(t *testing.T) {
+	input := map[string]interface{}{}
+	resolver := NewJSONPathResolver(input, map[string]interface{}{})
+
+	// Non-template strings should be returned as-is
+	value, err := resolver.Resolve("plain string")
+	if err != nil {
+		t.Fatalf("Failed to resolve: %v", err)
+	}
+
+	if value != "plain string" {
+		t.Errorf("Expected 'plain string', got %v", value)
+	}
+}
+
+func TestResolveMissingStep(t *testing.T) {
+	input := map[string]interface{}{}
+	resolver := NewJSONPathResolver(input, map[string]interface{}{})
+
+	// Should error on missing step
+	_, err := resolver.Resolve("${NonExistentStep.output.field}")
+	if err == nil {
+		t.Error("Expected error for missing step")
+	}
+}
+
+func TestResolveMissingField(t *testing.T) {
+	input := map[string]interface{}{}
+	stepResults := map[string]interface{}{
+		"Clone": map[string]interface{}{
+			"output": map[string]interface{}{
+				"path": "/tmp/repo",
+			},
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	// Should error on missing field
+	_, err := resolver.Resolve("${Clone.output.nonexistent}")
+	if err == nil {
+		t.Error("Expected error for missing field")
+	}
+}
+
+func TestResolveString(t *testing.T) {
+	input := map[string]interface{}{
+		"repo": "https://github.com/test/repo",
+	}
+	stepResults := map[string]interface{}{
+		"Clone": map[string]interface{}{
+			"output": map[string]interface{}{
+				"path": "/tmp/repo",
+			},
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	// Resolve string with multiple expressions
+	result, err := resolver.ResolveString("Repository at ${input.repo} cloned to ${Clone.output.path}")
+	if err != nil {
+		t.Fatalf("Failed to resolve string: %v", err)
+	}
+
+	expected := "Repository at https://github.com/test/repo cloned to /tmp/repo"
+	if result != expected {
+		t.Errorf("Expected '%s', got '%s'", expected, result)
+	}
+}
+
+func TestResolveStringNoExpressions(t *testing.T) {
+	input := map[string]interface{}{}
+	resolver := NewJSONPathResolver(input, map[string]interface{}{})
+
+	// String without expressions should be returned unchanged
+	result, err := resolver.ResolveString("plain string")
+	if err != nil {
+		t.Fatalf("Failed to resolve string: %v", err)
+	}
+
+	if result != "plain string" {
+		t.Errorf("Expected 'plain string', got '%s'", result)
+	}
+}
+
+func TestResolvePaths(t *testing.T) {
+	input := map[string]interface{}{
+		"repo": "https://github.com/test/repo",
+	}
+	stepResults := map[string]interface{}{
+		"Clone": map[string]interface{}{
+			"output": map[string]interface{}{
+				"path": "/tmp/repo",
+			},
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	// Resolve a map with JSONPath values
+	data := map[string]interface{}{
+		"repository": "${input.repo}",
+		"path":       "${Clone.output.path}",
+		"literal":    "just a string",
+	}
+
+	result, err := resolver.ResolvePaths(data)
+	if err != nil {
+		t.Fatalf("Failed to resolve paths: %v", err)
+	}
+
+	if result["repository"] != "https://github.com/test/repo" {
+		t.Errorf("repository mismatch: %v", result["repository"])
+	}
+
+	if result["path"] != "/tmp/repo" {
+		t.Errorf("path mismatch: %v", result["path"])
+	}
+
+	if result["literal"] != "just a string" {
+		t.Errorf("literal mismatch: %v", result["literal"])
+	}
+}
+
+func TestResolveNestedMap(t *testing.T) {
+	input := map[string]interface{}{}
+	stepResults := map[string]interface{}{
+		"Analyze": map[string]interface{}{
+			"output": map[string]interface{}{
+				"score": 0.95,
+			},
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	// Resolve nested map
+	data := map[string]interface{}{
+		"analysis": map[string]interface{}{
+			"quality": "${Analyze.output.score}",
+		},
+	}
+
+	result, err := resolver.ResolvePaths(data)
+	if err != nil {
+		t.Fatalf("Failed to resolve nested map: %v", err)
+	}
+
+	analysisMap := result["analysis"].(map[string]interface{})
+	if analysisMap["quality"] != 0.95 {
+		t.Errorf("Expected 0.95, got %v", analysisMap["quality"])
+	}
+}
+
+func TestResolveSlice(t *testing.T) {
+	input := map[string]interface{}{}
+	stepResults := map[string]interface{}{
+		"Scan": map[string]interface{}{
+			"output": map[string]interface{}{
+				"vulnerabilities": []map[string]interface{}{
+					{"cve": "CVE-001"},
+					{"cve": "CVE-002"},
+				},
+			},
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	// Resolve slice
+	data := map[string]interface{}{
+		"issues": "${Scan.output.vulnerabilities}",
+	}
+
+	result, err := resolver.ResolvePaths(data)
+	if err != nil {
+		t.Fatalf("Failed to resolve slice: %v", err)
+	}
+
+	issues := result["issues"].([]map[string]interface{})
+	if len(issues) != 2 {
+		t.Errorf("Expected 2 issues, got %d", len(issues))
+	}
+}
+
+func TestValidatePath(t *testing.T) {
+	resolver := NewJSONPathResolver(map[string]interface{}{}, map[string]interface{}{})
+
+	// Valid paths
+	validPaths := []string{
+		"input.repo",
+		"Clone.output.path",
+		"Analyze.output.metrics.quality.score",
+	}
+
+	for _, path := range validPaths {
+		if err := resolver.ValidatePath(path); err != nil {
+			t.Errorf("Path '%s' should be valid: %v", path, err)
+		}
+	}
+
+	// Invalid paths
+	invalidPaths := []string{
+		"",
+		"singleword",
+	}
+
+	for _, path := range invalidPaths {
+		if err := resolver.ValidatePath(path); err == nil {
+			t.Errorf("Path '%s' should be invalid", path)
+		}
+	}
+}
+
+func TestGetAvailableSteps(t *testing.T) {
+	stepResults := map[string]interface{}{
+		"Clone":   map[string]interface{}{},
+		"Analyze": map[string]interface{}{},
+		"Scan":    map[string]interface{}{},
+	}
+	resolver := NewJSONPathResolver(map[string]interface{}{}, stepResults)
+
+	steps := resolver.GetAvailableSteps()
+	if len(steps) != 3 {
+		t.Errorf("Expected 3 steps, got %d", len(steps))
+	}
+
+	// Check all steps are present
+	stepMap := make(map[string]bool)
+	for _, step := range steps {
+		stepMap[step] = true
+	}
+
+	if !stepMap["Clone"] || !stepMap["Analyze"] || !stepMap["Scan"] {
+		t.Error("Missing expected steps")
+	}
+}
+
+func TestGetInputFields(t *testing.T) {
+	input := map[string]interface{}{
+		"repo":   "test",
+		"branch": "main",
+		"path":   "/tmp",
+	}
+	resolver := NewJSONPathResolver(input, map[string]interface{}{})
+
+	fields := resolver.GetInputFields()
+	if len(fields) != 3 {
+		t.Errorf("Expected 3 fields, got %d", len(fields))
+	}
+
+	// Check all fields are present
+	fieldMap := make(map[string]bool)
+	for _, field := range fields {
+		fieldMap[field] = true
+	}
+
+	if !fieldMap["repo"] || !fieldMap["branch"] || !fieldMap["path"] {
+		t.Error("Missing expected input fields")
+	}
+}
+
+func TestResolveWithStringMap(t *testing.T) {
+	input := map[string]interface{}{}
+	stepResults := map[string]interface{}{
+		"Config": map[string]string{
+			"url":  "https://example.com",
+			"port": "8080",
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	// Resolve from string map
+	value, err := resolver.Resolve("${Config.url}")
+	if err != nil {
+		t.Fatalf("Failed to resolve: %v", err)
+	}
+
+	if value != "https://example.com" {
+		t.Errorf("Expected 'https://example.com', got %v", value)
+	}
+}
+
+func TestResolveComplexWorkflow(t *testing.T) {
+	input := map[string]interface{}{
+		"repo":   "https://github.com/test/repo",
+		"branch": "feature/new",
+	}
+	stepResults := map[string]interface{}{
+		"Clone": map[string]interface{}{
+			"output": map[string]interface{}{
+				"path":   "/tmp/repo",
+				"commit": "abc123def456",
+			},
+		},
+		"Analyze": map[string]interface{}{
+			"output": map[string]interface{}{
+				"quality": 0.92,
+				"issues": []string{"issue1", "issue2"},
+			},
+		},
+	}
+	resolver := NewJSONPathResolver(input, stepResults)
+
+	// Complex workflow parameters
+	params := map[string]interface{}{
+		"source_repo": "${input.repo}",
+		"target_branch": "${input.branch}",
+		"cloned_path": "${Clone.output.path}",
+		"commit_hash": "${Clone.output.commit}",
+		"quality_score": "${Analyze.output.quality}",
+		"issues_found": "${Analyze.output.issues}",
+		"report": "Quality score is ${Analyze.output.quality} for commit ${Clone.output.commit}",
+	}
+
+	resolved, err := resolver.ResolvePaths(params)
+	if err != nil {
+		t.Fatalf("Failed to resolve workflow: %v", err)
+	}
+
+	if resolved["source_repo"] != "https://github.com/test/repo" {
+		t.Error("source_repo mismatch")
+	}
+
+	if resolved["target_branch"] != "feature/new" {
+		t.Error("target_branch mismatch")
+	}
+
+	if resolved["cloned_path"] != "/tmp/repo" {
+		t.Error("cloned_path mismatch")
+	}
+
+	if resolved["commit_hash"] != "abc123def456" {
+		t.Error("commit_hash mismatch")
+	}
+
+	if resolved["quality_score"] != 0.92 {
+		t.Error("quality_score mismatch")
+	}
+
+	// Check report string resolution
+	report := resolved["report"].(string)
+	if !strings.Contains(report, "0.92") || !strings.Contains(report, "abc123def456") {
+		t.Errorf("Report not properly resolved: %s", report)
+	}
+}
+
+func TestResolveEmptyInput(t *testing.T) {
+	input := map[string]interface{}{}
+	resolver := NewJSONPathResolver(input, map[string]interface{}{})
+
+	// Should resolve to just input when accessing input
+	value, err := resolver.Resolve("${input}")
+	if err != nil {
+		t.Fatalf("Failed to resolve: %v", err)
+	}
+
+	// Should be empty map
+	inputMap, ok := value.(map[string]interface{})
+	if !ok || len(inputMap) != 0 {
+		t.Error("Expected empty input map")
+	}
+}

internal/routing/knowledge_base.go

@@ -0,0 +1,275 @@
+package routing
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"runtime"
+)
+
+// KnowledgeBase represents the activity knowledge base
+type KnowledgeBase struct {
+	Version    string               `json:"version"`
+	Activities []ActivityMetadata   `json:"activities"`
+	Metadata   KnowledgeBaseMetadata `json:"metadata"`
+	
+	// Index for fast lookups
+	byName map[string]*ActivityMetadata
+}
+
+// KnowledgeBaseMetadata tracks KB metadata
+type KnowledgeBaseMetadata struct {
+	TotalActivities int               `json:"totalActivities"`
+	LastUpdated     string            `json:"lastUpdated"`
+	Categories      map[string]int    `json:"categories"`
+}
+
+// LoadKnowledgeBase loads the activity knowledge base from a JSON file
+func LoadKnowledgeBase(filePath string) (*KnowledgeBase, error) {
+	// Read file
+	data, err := ioutil.ReadFile(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read knowledge base file: %w", err)
+	}
+
+	// Parse JSON
+	var kb KnowledgeBase
+	err = json.Unmarshal(data, &kb)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse knowledge base JSON: %w", err)
+	}
+
+	// Build index
+	kb.byName = make(map[string]*ActivityMetadata)
+	for i := range kb.Activities {
+		kb.byName[kb.Activities[i].Name] = &kb.Activities[i]
+	}
+
+	return &kb, nil
+}
+
+// LoadKnowledgeBaseFromDefaultPath loads KB from default location
+// Looks for activity_knowledge_base.json in same directory as caller
+func LoadKnowledgeBaseFromDefaultPath() (*KnowledgeBase, error) {
+	// Try to find from package directory
+	execDir, err := os.Executable()
+	if err == nil {
+		// Try in same directory as binary
+		path := filepath.Join(filepath.Dir(execDir), "activity_knowledge_base.json")
+		if _, err := os.Stat(path); err == nil {
+			return LoadKnowledgeBase(path)
+		}
+	}
+
+	// Try from current working directory
+	if _, err := os.Stat("activity_knowledge_base.json"); err == nil {
+		return LoadKnowledgeBase("activity_knowledge_base.json")
+	}
+
+	// Try from internal/routing directory relative to cwd
+	if _, err := os.Stat("internal/routing/activity_knowledge_base.json"); err == nil {
+		return LoadKnowledgeBase("internal/routing/activity_knowledge_base.json")
+	}
+
+	// Try from parent directory (for tests running from tests/ dir)
+	if _, err := os.Stat("../internal/routing/activity_knowledge_base.json"); err == nil {
+		return LoadKnowledgeBase("../internal/routing/activity_knowledge_base.json")
+	}
+
+	// Try using runtime to find package directory
+	_, filename, _, ok := runtime.Caller(0)
+	if ok {
+		pkgDir := filepath.Dir(filename)
+		path := filepath.Join(pkgDir, "activity_knowledge_base.json")
+		if _, err := os.Stat(path); err == nil {
+			return LoadKnowledgeBase(path)
+		}
+	}
+
+	return nil, fmt.Errorf("activity_knowledge_base.json not found in any expected location")
+}
+
+// GetActivity returns metadata for a specific activity
+func (kb *KnowledgeBase) GetActivity(name string) *ActivityMetadata {
+	return kb.byName[name]
+}
+
+// ListActivities returns all activities
+func (kb *KnowledgeBase) ListActivities() []ActivityMetadata {
+	return kb.Activities
+}
+
+// ListActivitiesByCategory returns all activities in a category
+func (kb *KnowledgeBase) ListActivitiesByCategory(category string) []ActivityMetadata {
+	var result []ActivityMetadata
+	for _, activity := range kb.Activities {
+		if activity.Category == category {
+			result = append(result, activity)
+		}
+	}
+	return result
+}
+
+// GetActivityNames returns all activity names
+func (kb *KnowledgeBase) GetActivityNames() []string {
+	names := make([]string, len(kb.Activities))
+	for i, activity := range kb.Activities {
+		names[i] = activity.Name
+	}
+	return names
+}
+
+// HasActivity checks if an activity exists
+func (kb *KnowledgeBase) HasActivity(name string) bool {
+	_, exists := kb.byName[name]
+	return exists
+}
+
+// GetDependencies returns all dependencies for an activity
+func (kb *KnowledgeBase) GetDependencies(activityName string) []string {
+	activity := kb.GetActivity(activityName)
+	if activity == nil {
+		return []string{}
+	}
+	return activity.Constraints.Dependencies
+}
+
+// GetTimeoutForActivity returns the timeout for an activity
+func (kb *KnowledgeBase) GetTimeoutForActivity(activityName string) string {
+	activity := kb.GetActivity(activityName)
+	if activity == nil {
+		return "5m" // Default timeout
+	}
+	return activity.Constraints.DefaultTimeout
+}
+
+// GetRetryPolicyForActivity returns retry configuration for an activity
+func (kb *KnowledgeBase) GetRetryPolicyForActivity(activityName string) *RetryPolicy {
+	activity := kb.GetActivity(activityName)
+	if activity == nil {
+		return &RetryPolicy{
+			MaxAttempts:     1,
+			BackoffRate:     1.0,
+			InitialInterval: "1s",
+		}
+	}
+
+	return &RetryPolicy{
+		MaxAttempts:     int32(activity.Constraints.RecommendedRetries),
+		BackoffRate:     activity.Constraints.RetryBackoff,
+		InitialInterval: "1s",
+		MaxInterval:     "30s",
+	}
+}
+
+// IsFlaky returns whether an activity is marked as flaky
+func (kb *KnowledgeBase) IsFlaky(activityName string) bool {
+	activity := kb.GetActivity(activityName)
+	if activity == nil {
+		return false
+	}
+	return activity.Constraints.IsFlaky
+}
+
+// GetNotes returns implementation notes for an activity
+func (kb *KnowledgeBase) GetNotes(activityName string) string {
+	activity := kb.GetActivity(activityName)
+	if activity == nil {
+		return ""
+	}
+	return activity.Constraints.Notes
+}
+
+// Validate checks the knowledge base for consistency
+func (kb *KnowledgeBase) Validate() error {
+	// Check for circular dependencies
+	visited := make(map[string]bool)
+	for _, activity := range kb.Activities {
+		if err := kb.checkDependencies(activity.Name, visited, []string{}); err != nil {
+			return err
+		}
+	}
+
+	// Check that all dependencies exist
+	for _, activity := range kb.Activities {
+		for _, dep := range activity.Constraints.Dependencies {
+			if !kb.HasActivity(dep) {
+				return fmt.Errorf("activity %s depends on non-existent activity %s", activity.Name, dep)
+			}
+		}
+	}
+
+	return nil
+}
+
+// checkDependencies validates activity dependencies for cycles
+func (kb *KnowledgeBase) checkDependencies(activityName string, visited map[string]bool, path []string) error {
+	// Check for cycles
+	for _, p := range path {
+		if p == activityName {
+			cycleStr := ""
+			found := false
+			for _, n := range path {
+				if found {
+					cycleStr += " -> " + n
+				}
+				if n == activityName {
+					found = true
+					cycleStr += n
+				}
+			}
+			cycleStr += " -> " + activityName
+			return fmt.Errorf("circular dependency detected: %s", cycleStr)
+		}
+	}
+
+	if visited[activityName] {
+		return nil // Already checked this branch
+	}
+
+	visited[activityName] = true
+	newPath := append(path, activityName)
+
+	activity := kb.GetActivity(activityName)
+	if activity == nil {
+		return nil // Non-existent activity will be caught elsewhere
+	}
+
+	for _, dep := range activity.Constraints.Dependencies {
+		if err := kb.checkDependencies(dep, visited, newPath); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// String returns a human-readable description of the knowledge base
+func (kb *KnowledgeBase) String() string {
+	return fmt.Sprintf("KnowledgeBase(v%s, %d activities)", kb.Version, kb.Metadata.TotalActivities)
+}
+
+// PrintSummary prints a summary of available activities
+func (kb *KnowledgeBase) PrintSummary() string {
+	summary := fmt.Sprintf("=== Activity Knowledge Base ===\nVersion: %s\nTotal Activities: %d\n\n", kb.Version, kb.Metadata.TotalActivities)
+	
+	summary += "Activities by Category:\n"
+	for category, count := range kb.Metadata.Categories {
+		summary += fmt.Sprintf("  %s: %d\n", category, count)
+	}
+
+	summary += "\nActivity Details:\n"
+	for _, activity := range kb.Activities {
+		summary += fmt.Sprintf("\n[%s] %s\n", activity.Name, activity.Description)
+		summary += fmt.Sprintf("  Category: %s\n", activity.Category)
+		summary += fmt.Sprintf("  Timeout: %s\n", activity.Constraints.DefaultTimeout)
+		summary += fmt.Sprintf("  Flaky: %v (Retries: %d)\n", activity.Constraints.IsFlaky, activity.Constraints.RecommendedRetries)
+		if len(activity.Constraints.Dependencies) > 0 {
+			summary += fmt.Sprintf("  Dependencies: %v\n", activity.Constraints.Dependencies)
+		}
+	}
+
+	return summary
+}

internal/routing/knowledge_base_test.go

@@ -0,0 +1,371 @@
+package routing
+
+import (
+	"os"
+	"testing"
+)
+
+func getKBPath() string {
+	// Try direct name (when running from this directory)
+	if _, err := os.Stat("activity_knowledge_base.json"); err == nil {
+		return "activity_knowledge_base.json"
+	}
+	// Try relative path
+	if _, err := os.Stat("./internal/routing/activity_knowledge_base.json"); err == nil {
+		return "./internal/routing/activity_knowledge_base.json"
+	}
+	return ""
+}
+
+func TestLoadKnowledgeBase(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	if kb == nil {
+		t.Error("Knowledge base is nil")
+	}
+
+	if kb.Version == "" {
+		t.Error("Knowledge base version is empty")
+	}
+
+	if len(kb.Activities) == 0 {
+		t.Error("Knowledge base has no activities")
+	}
+
+	if len(kb.byName) != len(kb.Activities) {
+		t.Errorf("Index size (%d) doesn't match activities (%d)", len(kb.byName), len(kb.Activities))
+	}
+}
+
+func TestGetActivity(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	activity := kb.GetActivity("CloneRepoActivity")
+	if activity == nil {
+		t.Error("CloneRepoActivity not found")
+	} else {
+		if activity.Name != "CloneRepoActivity" {
+			t.Errorf("Activity name mismatch: %s", activity.Name)
+		}
+		if activity.Description == "" {
+			t.Error("Activity description is empty")
+		}
+	}
+
+	missing := kb.GetActivity("NonExistentActivity")
+	if missing != nil {
+		t.Error("NonExistentActivity should be nil")
+	}
+}
+
+func TestHasActivity(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	if !kb.HasActivity("CloneRepoActivity") {
+		t.Error("CloneRepoActivity should exist")
+	}
+
+	if kb.HasActivity("NonExistentActivity") {
+		t.Error("NonExistentActivity should not exist")
+	}
+}
+
+func TestListActivities(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	activities := kb.ListActivities()
+	if len(activities) == 0 {
+		t.Error("ListActivities returned empty list")
+	}
+
+	for _, activity := range activities {
+		if activity.Name == "" {
+			t.Error("Activity name is empty")
+		}
+	}
+}
+
+func TestListActivitiesByCategory(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	repoActivities := kb.ListActivitiesByCategory("repository")
+	if len(repoActivities) == 0 {
+		t.Error("No repository activities found")
+	}
+
+	for _, activity := range repoActivities {
+		if activity.Category != "repository" {
+			t.Errorf("Activity %s has wrong category: %s", activity.Name, activity.Category)
+		}
+	}
+
+	unknown := kb.ListActivitiesByCategory("unknown")
+	if len(unknown) != 0 {
+		t.Error("Unknown category should return empty list")
+	}
+}
+
+func TestGetActivityNames(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	names := kb.GetActivityNames()
+	if len(names) == 0 {
+		t.Error("GetActivityNames returned empty list")
+	}
+
+	found := false
+	for _, name := range names {
+		if name == "CloneRepoActivity" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Error("CloneRepoActivity not found in activity names")
+	}
+}
+
+func TestGetDependencies(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	deps := kb.GetDependencies("AnalyzeCodeActivity")
+	if len(deps) == 0 {
+		t.Error("AnalyzeCodeActivity should have dependencies")
+	}
+
+	found := false
+	for _, dep := range deps {
+		if dep == "CloneRepoActivity" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Error("CloneRepoActivity should be a dependency of AnalyzeCodeActivity")
+	}
+
+	noDeps := kb.GetDependencies("CloneRepoActivity")
+	if len(noDeps) != 0 {
+		t.Error("CloneRepoActivity should have no dependencies")
+	}
+}
+
+func TestGetTimeout(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	timeout := kb.GetTimeoutForActivity("CloneRepoActivity")
+	if timeout == "" {
+		t.Error("Timeout should not be empty")
+	}
+
+	defaultTimeout := kb.GetTimeoutForActivity("NonExistent")
+	if defaultTimeout != "5m" {
+		t.Errorf("Default timeout should be 5m, got %s", defaultTimeout)
+	}
+}
+
+func TestGetRetryPolicy(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	policy := kb.GetRetryPolicyForActivity("AnalyzeCodeActivity")
+	if policy == nil {
+		t.Error("Retry policy should not be nil")
+	} else {
+		if policy.MaxAttempts < 2 {
+			t.Errorf("Flaky activity should have multiple retries, got %d", policy.MaxAttempts)
+		}
+		if policy.BackoffRate == 0 {
+			t.Error("Backoff rate should be set")
+		}
+	}
+
+	stablePolicy := kb.GetRetryPolicyForActivity("CloneRepoActivity")
+	if stablePolicy == nil {
+		t.Error("Retry policy should not be nil")
+	}
+}
+
+func TestIsFlaky(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	if !kb.IsFlaky("AnalyzeCodeActivity") {
+		t.Error("AnalyzeCodeActivity should be marked as flaky")
+	}
+
+	if kb.IsFlaky("CloneRepoActivity") {
+		t.Error("CloneRepoActivity should not be marked as flaky")
+	}
+}
+
+func TestGetNotes(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	notes := kb.GetNotes("AnalyzeCodeActivity")
+	if notes == "" {
+		t.Error("Notes should not be empty")
+	}
+
+	missingNotes := kb.GetNotes("NonExistent")
+	if missingNotes != "" {
+		t.Error("Non-existent activity should have empty notes")
+	}
+}
+
+func TestValidate(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	if err := kb.Validate(); err != nil {
+		t.Fatalf("Knowledge base validation failed: %v", err)
+	}
+}
+
+func TestString(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	str := kb.String()
+	if str == "" {
+		t.Error("String() returned empty string")
+	}
+
+	if !contains(str, "KnowledgeBase") {
+		t.Error("String should contain 'KnowledgeBase'")
+	}
+}
+
+func TestPrintSummary(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base file not found, skipping test")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load knowledge base: %v", err)
+	}
+
+	summary := kb.PrintSummary()
+	if summary == "" {
+		t.Error("PrintSummary() returned empty string")
+	}
+
+	if !contains(summary, "Activity Knowledge Base") {
+		t.Error("Summary should contain 'Activity Knowledge Base'")
+	}
+
+	if !contains(summary, "CloneRepoActivity") {
+		t.Error("Summary should list activities")
+	}
+}
+
+func contains(str, substr string) bool {
+	for i := 0; i < len(str)-len(substr)+1; i++ {
+		if str[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}

internal/routing/llm_client.go

@@ -0,0 +1,227 @@
+package routing
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+)
+
+var (
+	// llmBaseURL is the base URL for the LLM API
+	llmBaseURL string
+)
+
+func init() {
+	llmBaseURL = os.Getenv("LOCAL_LLM_BASE_URL")
+	if llmBaseURL == "" {
+		llmBaseURL = "https://api.riotpiao.com"
+	}
+}
+
+// AuthType specifies the authentication mechanism
+type AuthType string
+
+const (
+	// AuthTypeNone - no authentication
+	AuthTypeNone AuthType = "none"
+	// AuthTypeBearer - Bearer token (JWT, OAuth2)
+	AuthTypeBearer AuthType = "bearer"
+	// AuthTypeAPIKey - API Key authentication
+	AuthTypeAPIKey AuthType = "api-key"
+	// AuthTypeCustom - Custom header-based authentication
+	AuthTypeCustom AuthType = "custom"
+)
+
+// LLMAuth configures authentication for LLM API
+type LLMAuth struct {
+	// Type of authentication
+	Type AuthType `json:"type"`
+	
+	// Token is the JWT/OAuth2 token for Bearer auth
+	Token string `json:"token,omitempty"`
+	
+	// APIKey is the API key for API Key auth
+	APIKey string `json:"apiKey,omitempty"`
+	
+	// HeaderName is the custom header name for Custom auth
+	HeaderName string `json:"headerName,omitempty"`
+	
+	// HeaderValue is the custom header value for Custom auth
+	HeaderValue string `json:"headerValue,omitempty"`
+}
+
+// LLMClient is a simple LLM client for routing
+type LLMClient struct {
+	baseURL    string
+	httpClient *http.Client
+	auth       *LLMAuth
+}
+
+// NewLLMClient creates a new LLM client with default (no) auth
+func NewLLMClient() *LLMClient {
+	return &LLMClient{
+		baseURL:    llmBaseURL,
+		httpClient: &http.Client{},
+		auth:       nil,
+	}
+}
+
+// NewLLMClientWithAuth creates a new LLM client with authentication
+func NewLLMClientWithAuth(auth *LLMAuth) *LLMClient {
+	return &LLMClient{
+		baseURL:    llmBaseURL,
+		httpClient: &http.Client{},
+		auth:       auth,
+	}
+}
+
+// Name returns the provider name
+func (c *LLMClient) Name() string {
+	return "riotpiao"
+}
+
+// IsAvailable checks if the LLM service is available
+func (c *LLMClient) IsAvailable(ctx context.Context) error {
+	req, err := http.NewRequestWithContext(ctx, "GET", c.baseURL, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+	
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("LLM service unavailable: %w", err)
+	}
+	defer resp.Body.Close()
+	
+	if resp.StatusCode >= 500 {
+		return fmt.Errorf("LLM service error: %d", resp.StatusCode)
+	}
+	
+	return nil
+}
+
+// llmRequest is the request body for the OpenAI-compatible API
+type llmRequest struct {
+	Model    string       `json:"model"`
+	Messages []llmMessage `json:"messages"`
+	Stream   bool         `json:"stream"`
+}
+
+type llmMessage struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+// llmResponse is the response from the OpenAI-compatible API
+type llmResponse struct {
+	Choices []struct {
+		Message struct {
+			Content string `json:"content"`
+		} `json:"message"`
+	} `json:"choices"`
+}
+
+// Chat sends a chat completion request
+func (c *LLMClient) Chat(ctx context.Context, systemPrompt, userMessage string) (string, error) {
+	req := llmRequest{
+		Model: "reasoning",
+		Messages: []llmMessage{
+			{Role: "system", Content: systemPrompt},
+			{Role: "user", Content: userMessage},
+		},
+		Stream: false,
+	}
+
+	reqBody, err := json.Marshal(req)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	httpReq, err := http.NewRequestWithContext(ctx, "POST",
+		fmt.Sprintf("%s/v1/chat/completions", c.baseURL),
+		bytes.NewReader(reqBody))
+	if err != nil {
+		return "", fmt.Errorf("failed to create HTTP request: %w", err)
+	}
+
+	httpReq.Header.Set("Content-Type", "application/json")
+	
+	// Apply authentication headers
+	if err := c.applyAuth(httpReq); err != nil {
+		return "", fmt.Errorf("failed to apply authentication: %w", err)
+	}
+
+	resp, err := c.httpClient.Do(httpReq)
+	if err != nil {
+		return "", fmt.Errorf("failed to connect to LLM API at %s: %w", c.baseURL, err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("failed to read response body: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("LLM API returned status %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var respObj llmResponse
+	if err := json.Unmarshal(respBody, &respObj); err != nil {
+		return "", fmt.Errorf("failed to unmarshal response: %w", err)
+	}
+
+	if len(respObj.Choices) == 0 {
+		return "", fmt.Errorf("no choices in response from LLM API")
+	}
+
+	return respObj.Choices[0].Message.Content, nil
+}
+
+// applyAuth applies authentication to the HTTP request based on config
+func (c *LLMClient) applyAuth(req *http.Request) error {
+	if c.auth == nil || c.auth.Type == AuthTypeNone {
+		return nil
+	}
+
+	switch c.auth.Type {
+	case AuthTypeBearer:
+		if c.auth.Token == "" {
+			return fmt.Errorf("bearer token is required but not provided")
+		}
+		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.auth.Token))
+		
+	case AuthTypeAPIKey:
+		if c.auth.APIKey == "" {
+			return fmt.Errorf("API key is required but not provided")
+		}
+		// Common API key header names: X-API-Key, api-key, Authorization
+		req.Header.Set("X-API-Key", c.auth.APIKey)
+		
+	case AuthTypeCustom:
+		if c.auth.HeaderName == "" || c.auth.HeaderValue == "" {
+			return fmt.Errorf("custom header name and value are required but not provided")
+		}
+		req.Header.Set(c.auth.HeaderName, c.auth.HeaderValue)
+	}
+
+	return nil
+}
+
+// UpdateAuth updates the authentication config at runtime
+func (c *LLMClient) UpdateAuth(auth *LLMAuth) error {
+	if auth == nil {
+		return fmt.Errorf("auth config cannot be nil")
+	}
+	c.auth = auth
+	return nil
+}
+
+// GetAuth returns the current authentication config
+func (c *LLMClient) GetAuth() *LLMAuth {
+	return c.auth
+}

internal/routing/llm_router.go

@@ -0,0 +1,552 @@
+package routing
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// LLMRouterInput is input to the llm-router activity
+type LLMRouterInput struct {
+	Message       string                 `json:"message"`
+	Context       map[string]interface{} `json:"context,omitempty"`       // Optional context (repo, branch, etc)
+	MemoryContext *MemoryContext         `json:"memoryContext,omitempty"` // Optional memory retrieval results
+	UseMemory     bool                   `json:"useMemory,omitempty"`     // Enable memory retrieval (default: false)
+}
+
+// MemoryContext holds retrieved memory for prompt injection
+type MemoryContext struct {
+	Skills     []MemorySkill     `json:"skills"`
+	Lessons    []MemoryLesson    `json:"lessons"`
+	References []MemoryReference `json:"references"`
+}
+
+// MemorySkill from memory service
+type MemorySkill struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Why         string `json:"why,omitempty"`
+}
+
+// MemoryLesson from memory service
+type MemoryLesson struct {
+	ID    string `json:"id"`
+	Text  string `json:"text"`
+	Level string `json:"level"`
+}
+
+// MemoryReference from memory service
+type MemoryReference struct {
+	ID   string `json:"id"`
+	Text string `json:"text"`
+}
+
+// LLMRouterOutput is output from the llm-router activity
+type LLMRouterOutput struct {
+	Spec     *WorkflowSpec     `json:"spec,omitempty"`
+	CronSpec *CronWorkflowSpec `json:"cronSpec,omitempty"`
+	IsCron   bool              `json:"isCron"`
+	Error    string            `json:"error,omitempty"`
+}
+
+// LLMRouter orchestrates intent analysis and spec generation
+type LLMRouter struct {
+	provider       LLMProvider
+	knowledgeBase  *KnowledgeBase
+	specBuilder    SpecBuilder
+	validators     []WorkflowValidator
+	paramBinder    ParameterBinder
+	promptTemplate PromptTemplate
+}
+
+// LLMRouterConfig configures the router
+type LLMRouterConfig struct {
+	Provider       LLMProvider
+	KnowledgeBase  *KnowledgeBase
+	SpecBuilder    SpecBuilder
+	Validators     []WorkflowValidator
+	ParamBinder    ParameterBinder
+	Auth           *LLMAuth // Authentication config for LLM API
+}
+
+// NewLLMRouter creates a new LLM router with custom config
+func NewLLMRouter(config LLMRouterConfig) (*LLMRouter, error) {
+	if config.Provider == nil {
+		return nil, fmt.Errorf("provider is required")
+	}
+	if config.KnowledgeBase == nil {
+		return nil, fmt.Errorf("knowledge base is required")
+	}
+
+	router := &LLMRouter{
+		provider:      config.Provider,
+		knowledgeBase: config.KnowledgeBase,
+	}
+
+	// Set defaults
+	if config.SpecBuilder == nil {
+		router.specBuilder = NewDefaultSpecBuilder(config.KnowledgeBase)
+	} else {
+		router.specBuilder = config.SpecBuilder
+	}
+
+	if config.ParamBinder == nil {
+		router.paramBinder = NewDefaultParameterBinder()
+	} else {
+		router.paramBinder = config.ParamBinder
+	}
+
+	router.validators = config.Validators
+	if len(router.validators) == 0 {
+		router.validators = []WorkflowValidator{
+			&StateGraphValidator{},
+			NewActivityAvailabilityValidator(config.KnowledgeBase),
+			&TimeoutValidator{},
+		}
+	}
+
+	return router, nil
+}
+
+// NewLLMRouterDefault creates router with default HTTP provider
+func NewLLMRouterDefault(kb *KnowledgeBase) (*LLMRouter, error) {
+	client := NewLLMClient()
+	return NewLLMRouter(LLMRouterConfig{
+		Provider:      client,
+		KnowledgeBase: kb,
+	})
+}
+
+// Route analyzes user message and generates appropriate workflow spec
+func (r *LLMRouter) Route(ctx context.Context, input LLMRouterInput) (*LLMRouterOutput, error) {
+	// 1. Analyze intent using LLM provider
+	intent, err := r.analyzeIntent(ctx, input)
+	if err != nil {
+		return nil, fmt.Errorf("intent analysis failed: %w", err)
+	}
+
+	// 2. Build workflow spec based on intent
+	metadata := &BuildMetadata{
+		KnowledgeBase: r.knowledgeBase,
+		Context:       input.Context,
+		Validators:    r.validators,
+	}
+
+	spec, err := r.specBuilder.FromIntent(intent, metadata)
+	if err != nil {
+		return nil, fmt.Errorf("spec build failed: %w", err)
+	}
+
+	return &LLMRouterOutput{
+		Spec:   spec,
+		IsCron: intent.IsCron,
+	}, nil
+}
+
+// Intent represents analyzed user intent
+type Intent struct {
+	Activities     []string               `json:"activities"`      // Selected activity names
+	Parameters     map[string]interface{} `json:"parameters"`      // Extracted parameters
+	IsCron         bool                   `json:"isCron"`          // Is scheduled workflow?
+	CronSchedule   string                 `json:"cronSchedule"`    // Cron expression if scheduled
+	CronTimezone   string                 `json:"cronTimezone"`    // Timezone for cron
+	WorkflowName   string                 `json:"workflowName"`    // Generated workflow name
+	ErrorHandling  string                 `json:"errorHandling"`   // "retry", "fail-fast", "continue"
+}
+
+// analyzeIntent uses LLM provider to understand user request
+func (r *LLMRouter) analyzeIntent(ctx context.Context, input LLMRouterInput) (*Intent, error) {
+	// Build prompt with knowledge base context
+	userPrompt := r.buildIntentPrompt(input)
+
+	// Call LLM provider
+	response, err := r.provider.Chat(ctx, intentSystemPrompt, userPrompt)
+	if err != nil {
+		return nil, fmt.Errorf("LLM provider failed: %w", err)
+	}
+
+	// Parse LLM response
+	intent, err := parseIntentResponse(response)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse intent: %w", err)
+	}
+
+	// Validate activities exist
+	for _, actName := range intent.Activities {
+		if !r.knowledgeBase.HasActivity(actName) {
+			return nil, fmt.Errorf("unknown activity: %s", actName)
+		}
+	}
+
+	return intent, nil
+}
+
+// buildIntentPrompt creates the prompt for intent analysis
+func (r *LLMRouter) buildIntentPrompt(input LLMRouterInput) string {
+	// Get activity summaries
+	var activityList strings.Builder
+	for _, act := range r.knowledgeBase.Activities {
+		activityList.WriteString(fmt.Sprintf("- %s: %s (category: %s, timeout: %s, flaky: %v)\n",
+			act.Name, act.Description, act.Category,
+			act.Constraints.DefaultTimeout, act.Constraints.IsFlaky))
+	}
+
+	// Build context string
+	contextStr := ""
+	if len(input.Context) > 0 {
+		ctxBytes, _ := json.Marshal(input.Context)
+		contextStr = fmt.Sprintf("\nProvided context: %s", string(ctxBytes))
+	}
+
+	// Build memory context string
+	memoryStr := r.formatMemoryContext(input.MemoryContext)
+
+	return fmt.Sprintf(`User request: %s
+%s%s
+Available activities:
+%s
+Analyze the request and output JSON with:
+- activities: ordered list of activity names to execute
+- parameters: extracted parameters from request (repo URL, branch, etc)
+- isCron: true if user wants scheduled/recurring execution
+- cronSchedule: cron expression if scheduled (e.g., "0 2 * * *" for 2 AM daily)
+- cronTimezone: timezone (default "UTC")
+- workflowName: short descriptive name
+- errorHandling: "retry" (default), "fail-fast", or "continue"
+
+Output ONLY valid JSON, no explanation.`, input.Message, contextStr, memoryStr, activityList.String())
+}
+
+// formatMemoryContext formats memory context for prompt injection
+func (r *LLMRouter) formatMemoryContext(mem *MemoryContext) string {
+	if mem == nil {
+		return ""
+	}
+
+	var sb strings.Builder
+
+	if len(mem.Skills) > 0 {
+		sb.WriteString("\n\nRelevant skills from memory:\n")
+		for _, skill := range mem.Skills {
+			if skill.Why != "" {
+				sb.WriteString(fmt.Sprintf("- %s: %s (reason: %s)\n", skill.Name, skill.Description, skill.Why))
+			} else {
+				sb.WriteString(fmt.Sprintf("- %s: %s\n", skill.Name, skill.Description))
+			}
+		}
+	}
+
+	if len(mem.Lessons) > 0 {
+		sb.WriteString("\nRelevant knowledge from memory:\n")
+		for _, lesson := range mem.Lessons {
+			text := lesson.Text
+			if len(text) > 300 {
+				text = text[:300] + "..."
+			}
+			sb.WriteString(fmt.Sprintf("- [%s] %s\n", lesson.Level, text))
+		}
+	}
+
+	if len(mem.References) > 0 {
+		sb.WriteString("\nReference documents:\n")
+		for _, ref := range mem.References {
+			text := ref.Text
+			if len(text) > 200 {
+				text = text[:200] + "..."
+			}
+			sb.WriteString(fmt.Sprintf("- %s\n", text))
+		}
+	}
+
+	return sb.String()
+}
+
+// parseIntentResponse extracts Intent from LLM response
+func parseIntentResponse(response string) (*Intent, error) {
+	// Try to extract JSON from response
+	response = strings.TrimSpace(response)
+	
+	// Handle markdown code blocks
+	if strings.HasPrefix(response, "```") {
+		re := regexp.MustCompile("```(?:json)?\\s*([\\s\\S]*?)```")
+		matches := re.FindStringSubmatch(response)
+		if len(matches) > 1 {
+			response = strings.TrimSpace(matches[1])
+		}
+	}
+
+	var intent Intent
+	if err := json.Unmarshal([]byte(response), &intent); err != nil {
+		return nil, fmt.Errorf("invalid JSON from LLM: %w\nResponse: %s", err, response)
+	}
+
+	// Set defaults
+	if intent.CronTimezone == "" {
+		intent.CronTimezone = "UTC"
+	}
+	if intent.ErrorHandling == "" {
+		intent.ErrorHandling = "retry"
+	}
+	if intent.WorkflowName == "" {
+		intent.WorkflowName = "generated-workflow"
+	}
+
+	return &intent, nil
+}
+
+// buildSpec creates WorkflowSpec from intent
+func (r *LLMRouter) buildSpec(intent *Intent, input LLMRouterInput) (*WorkflowSpec, error) {
+	if len(intent.Activities) == 0 {
+		return nil, fmt.Errorf("no activities selected")
+	}
+
+	states := make([]State, 0, len(intent.Activities)+1)
+
+	// Build states for each activity
+	for i, actName := range intent.Activities {
+		act := r.knowledgeBase.GetActivity(actName)
+		
+		state := State{
+			Name:     actName,
+			Type:     StateTypeTask,
+			Resource: actName,
+			Parameters: r.buildParameters(act, intent, i),
+			Timeout:  act.Constraints.DefaultTimeout,
+			Retry:    r.buildRetryPolicy(act, intent),
+		}
+
+		// Set next state or end
+		if i < len(intent.Activities)-1 {
+			state.Next = intent.Activities[i+1]
+		} else {
+			state.End = true
+		}
+
+		// Add catch clause for flaky activities
+		if act.Constraints.IsFlaky && intent.ErrorHandling != "fail-fast" {
+			state.Catch = []CatchClause{
+				{
+					ErrorEquals: []string{"ActivityError", "TimeoutError"},
+					Next:        "HandleError",
+				},
+			}
+		}
+
+		states = append(states, state)
+	}
+
+	// Add error handler if needed
+	hasFlaky := false
+	for _, actName := range intent.Activities {
+		act := r.knowledgeBase.GetActivity(actName)
+		if act != nil && act.Constraints.IsFlaky {
+			hasFlaky = true
+			break
+		}
+	}
+	if hasFlaky && intent.ErrorHandling != "fail-fast" {
+		states = append(states, State{
+			Name:  "HandleError",
+			Type:  StateTypeFail,
+			Error: "WorkflowError",
+			Cause: "Activity failed after retries",
+		})
+	}
+
+	// Build input map
+	inputMap := make(map[string]interface{})
+	for k, v := range intent.Parameters {
+		inputMap[k] = v
+	}
+	for k, v := range input.Context {
+		if _, exists := inputMap[k]; !exists {
+			inputMap[k] = v
+		}
+	}
+
+	return &WorkflowSpec{
+		Name:   intent.WorkflowName,
+		Input:  inputMap,
+		States: states,
+	}, nil
+}
+
+// getStringFromMap safely extracts a string from a map
+func getStringFromMap(m map[string]interface{}, key string) string {
+	if m == nil {
+		return ""
+	}
+	if v, ok := m[key].(string); ok {
+		return v
+	}
+	return ""
+}
+
+// firstNonEmpty returns the first non-empty string from the list
+func firstNonEmpty(values ...string) string {
+	for _, v := range values {
+		if v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// buildCronSpec creates CronWorkflowSpec from intent
+func (r *LLMRouter) buildCronSpec(intent *Intent, input LLMRouterInput) (*CronWorkflowSpec, error) {
+	spec, err := r.buildSpec(intent, input)
+	if err != nil {
+		return nil, err
+	}
+
+	// Extract schedule from multiple sources
+	schedule := firstNonEmpty(
+		intent.CronSchedule,
+		getStringFromMap(intent.Parameters, "cronSchedule"),
+		getStringFromMap(spec.Input, "cronSchedule"),
+	)
+
+	// Extract timezone from multiple sources, default to UTC
+	timezone := firstNonEmpty(
+		intent.CronTimezone,
+		getStringFromMap(intent.Parameters, "cronTimezone"),
+		getStringFromMap(spec.Input, "cronTimezone"),
+		"UTC",
+	)
+
+	// Clean cron fields from input
+	delete(spec.Input, "cronSchedule")
+	delete(spec.Input, "cronTimezone")
+
+	return &CronWorkflowSpec{
+		Name:          spec.Name,
+		Type:          "CronWorkflow",
+		Schedule:      schedule,
+		Timezone:      timezone,
+		Input:         spec.Input,
+		States:        spec.States,
+		MaxConcurrent: 1,
+		Timeout:       "1h",
+		EnableHistory: true,
+	}, nil
+}
+
+// isCommonInputField checks if field name is a common workflow input
+func isCommonInputField(name string) bool {
+	switch name {
+	case "repo", "path", "branch":
+		return true
+	}
+	return false
+}
+
+// paramResolver resolves activity parameters from multiple sources
+type paramResolver struct {
+	intent    *Intent
+	kb        *KnowledgeBase
+	prevState string
+}
+
+// resolve finds parameter value from intent, previous output, default, or input ref
+func (r *paramResolver) resolve(inputName string, inputDef InputField) interface{} {
+	// 1. From intent parameters
+	if val, ok := r.intent.Parameters[inputName]; ok {
+		return val
+	}
+
+	// 2. From previous state output
+	if val := r.fromPrevOutput(inputName); val != nil {
+		return val
+	}
+
+	// 3. Default value
+	if inputDef.Default != nil {
+		return inputDef.Default
+	}
+
+	// 4. Input reference for common fields
+	if isCommonInputField(inputName) {
+		return fmt.Sprintf("${input.%s}", inputName)
+	}
+
+	return nil
+}
+
+// fromPrevOutput checks if previous activity has matching output
+func (r *paramResolver) fromPrevOutput(inputName string) interface{} {
+	if r.prevState == "" {
+		return nil
+	}
+	prevActDef := r.kb.GetActivity(r.prevState)
+	if prevActDef == nil {
+		return nil
+	}
+	for outName := range prevActDef.Outputs {
+		if outName == inputName || strings.EqualFold(outName, inputName) {
+			return fmt.Sprintf("${%s.output.%s}", r.prevState, outName)
+		}
+	}
+	return nil
+}
+
+// buildParameters creates parameter map for activity
+func (r *LLMRouter) buildParameters(act *ActivityMetadata, intent *Intent, stateIndex int) map[string]interface{} {
+	var prevState string
+	if stateIndex > 0 {
+		prevState = intent.Activities[stateIndex-1]
+	}
+
+	resolver := &paramResolver{
+		intent:    intent,
+		kb:        r.knowledgeBase,
+		prevState: prevState,
+	}
+
+	params := make(map[string]interface{})
+	for name, def := range act.Inputs {
+		if val := resolver.resolve(name, def); val != nil {
+			params[name] = val
+		}
+	}
+	return params
+}
+
+// buildRetryPolicy creates retry policy based on activity constraints
+func (r *LLMRouter) buildRetryPolicy(act *ActivityMetadata, intent *Intent) *RetryPolicy {
+	if intent.ErrorHandling == "fail-fast" {
+		return &RetryPolicy{
+			MaxAttempts:     1,
+			BackoffRate:     1.0,
+			InitialInterval: "1s",
+		}
+	}
+
+	return &RetryPolicy{
+		MaxAttempts:     int32(act.Constraints.RecommendedRetries),
+		BackoffRate:     act.Constraints.RetryBackoff,
+		InitialInterval: "1s",
+		MaxInterval:     "30s",
+	}
+}
+
+const intentSystemPrompt = `You are an intelligent workflow router. Your job is to:
+1. Understand what the user wants to accomplish
+2. Select the appropriate activities from the available list
+3. Order them correctly based on dependencies
+4. Extract any parameters mentioned (URLs, branches, etc)
+5. Detect if user wants scheduled/recurring execution
+6. Use any relevant knowledge from memory to inform your decisions
+
+Rules:
+- Always include CloneRepoActivity first if any analysis activity is needed
+- Order activities respecting dependencies
+- If user mentions "daily", "every hour", "weekly", etc → set isCron=true and cronSchedule
+- Common cron patterns: "0 2 * * *" (2 AM daily), "0 * * * *" (hourly), "0 0 * * 0" (weekly Sunday)
+- Extract repo URLs, branch names, severity levels from the message
+- workflowName should be short and descriptive (kebab-case)
+- If memory context includes relevant skills or lessons, incorporate that knowledge
+- Skills from memory may suggest specific activity parameters or ordering
+
+Output ONLY valid JSON.`

internal/routing/llm_router_integration_test.go

@@ -0,0 +1,103 @@
+// +build integration
+
+package routing
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"testing"
+	"time"
+)
+
+// TestLLMRouterIntegration tests against real api.riotpiao.com
+// Run with: go test -tags=integration -v -run TestLLMRouterIntegration
+func TestLLMRouterIntegration(t *testing.T) {
+	// Skip if not explicitly enabled
+	if os.Getenv("RUN_INTEGRATION_TESTS") != "1" {
+		t.Skip("Skipping integration test. Set RUN_INTEGRATION_TESTS=1 to run.")
+	}
+
+	kb, err := LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		t.Fatalf("failed to load knowledge base: %v", err)
+	}
+
+	router, err := NewLLMRouter(kb)
+	if err != nil {
+		t.Fatalf("failed to create router: %v", err)
+	}
+
+	tests := []struct {
+		name     string
+		input    LLMRouterInput
+		validate func(*testing.T, *LLMRouterOutput)
+	}{
+		{
+			name: "analyze repo request",
+			input: LLMRouterInput{
+				Message: "Analyze the GitHub repo https://github.com/rockliang/poimen for code quality and security issues",
+				Context: map[string]interface{}{
+					"branch": "main",
+				},
+			},
+			validate: func(t *testing.T, output *LLMRouterOutput) {
+				if output.IsCron {
+					t.Error("expected one-time workflow, not cron")
+				}
+				if output.Spec == nil {
+					t.Fatal("expected spec, got nil")
+				}
+				if len(output.Spec.States) < 2 {
+					t.Errorf("expected at least 2 states, got %d", len(output.Spec.States))
+				}
+				// Should start with CloneRepoActivity
+				if output.Spec.States[0].Resource != "CloneRepoActivity" {
+					t.Errorf("expected first activity to be CloneRepoActivity, got %s", output.Spec.States[0].Resource)
+				}
+				t.Logf("Generated workflow: %s with %d states", output.Spec.Name, len(output.Spec.States))
+				for i, state := range output.Spec.States {
+					t.Logf("  State %d: %s (%s)", i, state.Name, state.Resource)
+				}
+			},
+		},
+		{
+			name: "daily security scan (cron)",
+			input: LLMRouterInput{
+				Message: "Run a security scan on https://github.com/rockliang/poimen every day at 3 AM UTC",
+			},
+			validate: func(t *testing.T, output *LLMRouterOutput) {
+				if !output.IsCron {
+					t.Error("expected cron workflow")
+				}
+				if output.CronSpec == nil {
+					t.Fatal("expected cron spec, got nil")
+				}
+				if output.CronSpec.Schedule == "" {
+					t.Error("expected cron schedule")
+				}
+				t.Logf("Generated cron workflow: %s, schedule: %s", output.CronSpec.Name, output.CronSpec.Schedule)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+			defer cancel()
+
+			output, err := router.Route(ctx, tt.input)
+			if err != nil {
+				t.Fatalf("Route failed: %v", err)
+			}
+
+			// Pretty print output
+			jsonOut, _ := json.MarshalIndent(output, "", "  ")
+			t.Logf("Output:\n%s", string(jsonOut))
+
+			if tt.validate != nil {
+				tt.validate(t, output)
+			}
+		})
+	}
+}

internal/routing/llm_router_test.go

@@ -0,0 +1,492 @@
+package routing
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestParseIntentResponse(t *testing.T) {
+	tests := []struct {
+		name     string
+		response string
+		wantErr  bool
+		validate func(*testing.T, *Intent)
+	}{
+		{
+			name: "basic intent",
+			response: `{
+				"activities": ["CloneRepoActivity", "AnalyzeCodeActivity"],
+				"parameters": {"repo": "https://github.com/test/repo"},
+				"isCron": false,
+				"workflowName": "analyze-repo"
+			}`,
+			wantErr: false,
+			validate: func(t *testing.T, intent *Intent) {
+				if len(intent.Activities) != 2 {
+					t.Errorf("expected 2 activities, got %d", len(intent.Activities))
+				}
+				if intent.Activities[0] != "CloneRepoActivity" {
+					t.Errorf("expected CloneRepoActivity first, got %s", intent.Activities[0])
+				}
+				if intent.IsCron {
+					t.Error("expected isCron=false")
+				}
+			},
+		},
+		{
+			name: "cron intent",
+			response: `{
+				"activities": ["CloneRepoActivity", "SecurityScanActivity"],
+				"parameters": {"repo": "https://github.com/test/repo"},
+				"isCron": true,
+				"cronSchedule": "0 2 * * *",
+				"cronTimezone": "America/New_York",
+				"workflowName": "daily-security-scan"
+			}`,
+			wantErr: false,
+			validate: func(t *testing.T, intent *Intent) {
+				if !intent.IsCron {
+					t.Error("expected isCron=true")
+				}
+				if intent.CronSchedule != "0 2 * * *" {
+					t.Errorf("expected cron schedule '0 2 * * *', got %s", intent.CronSchedule)
+				}
+				if intent.CronTimezone != "America/New_York" {
+					t.Errorf("expected timezone 'America/New_York', got %s", intent.CronTimezone)
+				}
+			},
+		},
+		{
+			name: "with markdown code block",
+			response: "```json\n{\"activities\": [\"CloneRepoActivity\"], \"parameters\": {}, \"isCron\": false}\n```",
+			wantErr: false,
+			validate: func(t *testing.T, intent *Intent) {
+				if len(intent.Activities) != 1 {
+					t.Errorf("expected 1 activity, got %d", len(intent.Activities))
+				}
+			},
+		},
+		{
+			name: "defaults applied",
+			response: `{"activities": ["CloneRepoActivity"], "parameters": {}}`,
+			wantErr: false,
+			validate: func(t *testing.T, intent *Intent) {
+				if intent.CronTimezone != "UTC" {
+					t.Errorf("expected default timezone UTC, got %s", intent.CronTimezone)
+				}
+				if intent.ErrorHandling != "retry" {
+					t.Errorf("expected default errorHandling 'retry', got %s", intent.ErrorHandling)
+				}
+				if intent.WorkflowName != "generated-workflow" {
+					t.Errorf("expected default workflowName, got %s", intent.WorkflowName)
+				}
+			},
+		},
+		{
+			name:    "invalid json",
+			response: "this is not json",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			intent, err := parseIntentResponse(tt.response)
+			if tt.wantErr {
+				if err == nil {
+					t.Error("expected error, got nil")
+				}
+				return
+			}
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+				return
+			}
+			if tt.validate != nil {
+				tt.validate(t, intent)
+			}
+		})
+	}
+}
+
+func TestBuildSpec(t *testing.T) {
+	// Load knowledge base
+	kb, err := LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		t.Fatalf("failed to load knowledge base: %v", err)
+	}
+
+	router := &LLMRouter{
+		knowledgeBase: kb,
+	}
+
+	intent := &Intent{
+		Activities:    []string{"CloneRepoActivity", "AnalyzeCodeActivity", "SecurityScanActivity"},
+		Parameters:    map[string]interface{}{"repo": "https://github.com/test/repo", "branch": "main"},
+		WorkflowName:  "test-workflow",
+		ErrorHandling: "retry",
+	}
+
+	input := LLMRouterInput{
+		Message: "Analyze repo for security",
+		Context: map[string]interface{}{},
+	}
+
+	spec, err := router.buildSpec(intent, input)
+	if err != nil {
+		t.Fatalf("buildSpec failed: %v", err)
+	}
+
+	// Validate spec
+	if spec.Name != "test-workflow" {
+		t.Errorf("expected name 'test-workflow', got %s", spec.Name)
+	}
+
+	if len(spec.States) < 3 {
+		t.Errorf("expected at least 3 states, got %d", len(spec.States))
+	}
+
+	// First state should be CloneRepoActivity
+	if spec.States[0].Resource != "CloneRepoActivity" {
+		t.Errorf("expected first state to be CloneRepoActivity, got %s", spec.States[0].Resource)
+	}
+
+	// Last activity state should have End=true
+	lastActivityIdx := len(spec.States) - 1
+	if spec.States[lastActivityIdx].Type == StateTypeFail {
+		lastActivityIdx--
+	}
+	if !spec.States[lastActivityIdx].End {
+		t.Error("expected last activity state to have End=true")
+	}
+
+	// Check retry policy on flaky activity (AnalyzeCodeActivity)
+	for _, state := range spec.States {
+		if state.Resource == "AnalyzeCodeActivity" {
+			if state.Retry == nil {
+				t.Error("expected retry policy on flaky activity")
+			} else if state.Retry.MaxAttempts != 3 {
+				t.Errorf("expected 3 max attempts for flaky activity, got %d", state.Retry.MaxAttempts)
+			}
+			if len(state.Catch) == 0 {
+				t.Error("expected catch clause on flaky activity")
+			}
+		}
+	}
+}
+
+func TestBuildCronSpec(t *testing.T) {
+	kb, err := LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		t.Fatalf("failed to load knowledge base: %v", err)
+	}
+
+	router := &LLMRouter{
+		knowledgeBase: kb,
+	}
+
+	intent := &Intent{
+		Activities:   []string{"CloneRepoActivity", "SecurityScanActivity"},
+		Parameters:   map[string]interface{}{"repo": "https://github.com/test/repo"},
+		IsCron:       true,
+		CronSchedule: "0 2 * * *",
+		CronTimezone: "UTC",
+		WorkflowName: "daily-scan",
+	}
+
+	input := LLMRouterInput{
+		Message: "Run security scan daily at 2 AM",
+	}
+
+	cronSpec, err := router.buildCronSpec(intent, input)
+	if err != nil {
+		t.Fatalf("buildCronSpec failed: %v", err)
+	}
+
+	if cronSpec.Type != "CronWorkflow" {
+		t.Errorf("expected type 'CronWorkflow', got %s", cronSpec.Type)
+	}
+	if cronSpec.Schedule != "0 2 * * *" {
+		t.Errorf("expected schedule '0 2 * * *', got %s", cronSpec.Schedule)
+	}
+	if cronSpec.Timezone != "UTC" {
+		t.Errorf("expected timezone 'UTC', got %s", cronSpec.Timezone)
+	}
+	if !cronSpec.EnableHistory {
+		t.Error("expected EnableHistory=true")
+	}
+}
+
+func TestBuildParameters(t *testing.T) {
+	kb, err := LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		t.Fatalf("failed to load knowledge base: %v", err)
+	}
+
+	router := &LLMRouter{
+		knowledgeBase: kb,
+	}
+
+	// Test first activity (CloneRepoActivity) - should use input references
+	cloneAct := kb.GetActivity("CloneRepoActivity")
+	intent := &Intent{
+		Activities: []string{"CloneRepoActivity", "AnalyzeCodeActivity"},
+		Parameters: map[string]interface{}{"repo": "https://github.com/test/repo"},
+	}
+
+	params := router.buildParameters(cloneAct, intent, 0)
+	if params["repo"] != "https://github.com/test/repo" {
+		t.Errorf("expected repo from parameters, got %v", params["repo"])
+	}
+
+	// Test second activity (AnalyzeCodeActivity) - should reference previous output
+	analyzeAct := kb.GetActivity("AnalyzeCodeActivity")
+	params = router.buildParameters(analyzeAct, intent, 1)
+	if params["path"] != "${CloneRepoActivity.output.path}" {
+		t.Errorf("expected JSONPath reference to CloneRepoActivity.output.path, got %v", params["path"])
+	}
+}
+
+func TestBuildRetryPolicy(t *testing.T) {
+	kb, err := LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		t.Fatalf("failed to load knowledge base: %v", err)
+	}
+
+	router := &LLMRouter{
+		knowledgeBase: kb,
+	}
+
+	// Flaky activity with retry error handling
+	analyzeAct := kb.GetActivity("AnalyzeCodeActivity")
+	intent := &Intent{ErrorHandling: "retry"}
+	policy := router.buildRetryPolicy(analyzeAct, intent)
+
+	if policy.MaxAttempts != 3 {
+		t.Errorf("expected 3 max attempts for flaky activity, got %d", policy.MaxAttempts)
+	}
+	if policy.BackoffRate != 2.0 {
+		t.Errorf("expected backoff rate 2.0, got %f", policy.BackoffRate)
+	}
+
+	// Fail-fast error handling
+	intent = &Intent{ErrorHandling: "fail-fast"}
+	policy = router.buildRetryPolicy(analyzeAct, intent)
+
+	if policy.MaxAttempts != 1 {
+		t.Errorf("expected 1 max attempt for fail-fast, got %d", policy.MaxAttempts)
+	}
+}
+
+func TestGetStringFromMap(t *testing.T) {
+	tests := []struct {
+		name     string
+		m        map[string]interface{}
+		key      string
+		expected string
+	}{
+		{"nil map", nil, "key", ""},
+		{"missing key", map[string]interface{}{"a": "b"}, "key", ""},
+		{"found string", map[string]interface{}{"key": "value"}, "key", "value"},
+		{"non-string value", map[string]interface{}{"key": 123}, "key", ""},
+		{"empty string", map[string]interface{}{"key": ""}, "key", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := getStringFromMap(tt.m, tt.key)
+			if got != tt.expected {
+				t.Errorf("getStringFromMap() = %q, want %q", got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestFirstNonEmpty(t *testing.T) {
+	tests := []struct {
+		name     string
+		values   []string
+		expected string
+	}{
+		{"all empty", []string{"", "", ""}, ""},
+		{"first non-empty", []string{"first", "second"}, "first"},
+		{"second non-empty", []string{"", "second", "third"}, "second"},
+		{"last non-empty", []string{"", "", "last"}, "last"},
+		{"no values", []string{}, ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := firstNonEmpty(tt.values...)
+			if got != tt.expected {
+				t.Errorf("firstNonEmpty() = %q, want %q", got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestIsCommonInputField(t *testing.T) {
+	tests := []struct {
+		name     string
+		expected bool
+	}{
+		{"repo", true},
+		{"path", true},
+		{"branch", true},
+		{"unknown", false},
+		{"Repository", false}, // case-sensitive
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := isCommonInputField(tt.name)
+			if got != tt.expected {
+				t.Errorf("isCommonInputField(%q) = %v, want %v", tt.name, got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestBuildCronSpecScheduleSources(t *testing.T) {
+	kb, err := LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		t.Fatalf("failed to load knowledge base: %v", err)
+	}
+
+	router := &LLMRouter{knowledgeBase: kb}
+
+	tests := []struct {
+		name           string
+		intentSchedule string
+		intentTimezone string
+		paramSchedule  string
+		paramTimezone  string
+		wantSchedule   string
+		wantTimezone   string
+	}{
+		{
+			name:           "from intent",
+			intentSchedule: "0 2 * * *",
+			intentTimezone: "PST",
+			wantSchedule:   "0 2 * * *",
+			wantTimezone:   "PST",
+		},
+		{
+			name:          "from params",
+			paramSchedule: "0 3 * * *",
+			paramTimezone: "EST",
+			wantSchedule:  "0 3 * * *",
+			wantTimezone:  "EST",
+		},
+		{
+			name:         "default UTC",
+			wantSchedule: "",
+			wantTimezone: "UTC",
+		},
+		{
+			name:           "intent priority",
+			intentSchedule: "0 1 * * *",
+			intentTimezone: "UTC",
+			paramSchedule:  "0 2 * * *",
+			paramTimezone:  "PST",
+			wantSchedule:   "0 1 * * *",
+			wantTimezone:   "UTC",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			intent := &Intent{
+				Activities:   []string{"CloneRepoActivity"},
+				Parameters:   map[string]interface{}{},
+				IsCron:       true,
+				CronSchedule: tt.intentSchedule,
+				CronTimezone: tt.intentTimezone,
+				WorkflowName: "test",
+			}
+			if tt.paramSchedule != "" {
+				intent.Parameters["cronSchedule"] = tt.paramSchedule
+			}
+			if tt.paramTimezone != "" {
+				intent.Parameters["cronTimezone"] = tt.paramTimezone
+			}
+
+			input := LLMRouterInput{Message: "test"}
+			spec, err := router.buildCronSpec(intent, input)
+			if err != nil {
+				t.Fatalf("buildCronSpec failed: %v", err)
+			}
+
+			if spec.Schedule != tt.wantSchedule {
+				t.Errorf("schedule = %q, want %q", spec.Schedule, tt.wantSchedule)
+			}
+			if spec.Timezone != tt.wantTimezone {
+				t.Errorf("timezone = %q, want %q", spec.Timezone, tt.wantTimezone)
+			}
+		})
+	}
+}
+
+func TestParamResolverFromPrevOutput(t *testing.T) {
+	kb, err := LoadKnowledgeBaseFromDefaultPath()
+	if err != nil {
+		t.Fatalf("failed to load knowledge base: %v", err)
+	}
+
+	resolver := &paramResolver{
+		intent: &Intent{
+			Activities: []string{"CloneRepoActivity", "AnalyzeCodeActivity"},
+			Parameters: map[string]interface{}{},
+		},
+		kb:        kb,
+		prevState: "CloneRepoActivity",
+	}
+
+	// Should find matching output from CloneRepoActivity
+	got := resolver.fromPrevOutput("path")
+	if got == nil {
+		t.Error("expected to find path from prev output")
+	}
+	if got != "${CloneRepoActivity.output.path}" {
+		t.Errorf("got %v, want ${CloneRepoActivity.output.path}", got)
+	}
+
+	// Should not find non-existent output
+	got = resolver.fromPrevOutput("nonexistent")
+	if got != nil {
+		t.Errorf("expected nil for nonexistent, got %v", got)
+	}
+
+	// Empty prevState should return nil
+	resolver.prevState = ""
+	got = resolver.fromPrevOutput("path")
+	if got != nil {
+		t.Errorf("expected nil for empty prevState, got %v", got)
+	}
+}
+
+func TestIntentJSONMarshal(t *testing.T) {
+	intent := &Intent{
+		Activities:    []string{"CloneRepoActivity"},
+		Parameters:    map[string]interface{}{"repo": "https://test"},
+		IsCron:        true,
+		CronSchedule:  "0 * * * *",
+		CronTimezone:  "UTC",
+		WorkflowName:  "test",
+		ErrorHandling: "retry",
+	}
+
+	data, err := json.Marshal(intent)
+	if err != nil {
+		t.Fatalf("marshal failed: %v", err)
+	}
+
+	var decoded Intent
+	if err := json.Unmarshal(data, &decoded); err != nil {
+		t.Fatalf("unmarshal failed: %v", err)
+	}
+
+	if decoded.CronSchedule != intent.CronSchedule {
+		t.Errorf("expected schedule %s, got %s", intent.CronSchedule, decoded.CronSchedule)
+	}
+}

internal/routing/provider.go

@@ -0,0 +1,252 @@
+package routing
+
+import (
+	"context"
+	"fmt"
+)
+
+// LLMProvider defines interface for LLM services
+type LLMProvider interface {
+	// Name returns provider name (e.g., "openai", "claude", "local")
+	Name() string
+	
+	// Chat sends a message and returns response
+	Chat(ctx context.Context, systemPrompt, userPrompt string) (string, error)
+	
+	// IsAvailable checks if provider is configured and reachable
+	IsAvailable(ctx context.Context) error
+}
+
+// ProviderRegistry manages available LLM providers
+type ProviderRegistry struct {
+	providers map[string]LLMProvider
+	default_  string
+}
+
+// NewProviderRegistry creates a new registry
+func NewProviderRegistry() *ProviderRegistry {
+	return &ProviderRegistry{
+		providers: make(map[string]LLMProvider),
+	}
+}
+
+// Register adds a provider
+func (pr *ProviderRegistry) Register(provider LLMProvider) error {
+	if provider.Name() == "" {
+		return fmt.Errorf("provider name cannot be empty")
+	}
+	pr.providers[provider.Name()] = provider
+	return nil
+}
+
+// SetDefault sets the default provider
+func (pr *ProviderRegistry) SetDefault(name string) error {
+	if _, exists := pr.providers[name]; !exists {
+		return fmt.Errorf("provider %s not registered", name)
+	}
+	pr.default_ = name
+	return nil
+}
+
+// Get retrieves a provider by name
+func (pr *ProviderRegistry) Get(name string) (LLMProvider, error) {
+	if name == "" {
+		name = pr.default_
+	}
+	provider, exists := pr.providers[name]
+	if !exists {
+		return nil, fmt.Errorf("provider %s not found", name)
+	}
+	return provider, nil
+}
+
+// GetDefault returns the default provider
+func (pr *ProviderRegistry) GetDefault() (LLMProvider, error) {
+	if pr.default_ == "" {
+		return nil, fmt.Errorf("no default provider set")
+	}
+	return pr.Get(pr.default_)
+}
+
+// RoutingProviderLLM routes between multiple LLM providers with fallback
+type RoutingProviderLLM struct {
+	registry      *ProviderRegistry
+	fallbackOrder []string
+}
+
+// NewRoutingProviderLLM creates a routing LLM
+func NewRoutingProviderLLM(registry *ProviderRegistry, order ...string) *RoutingProviderLLM {
+	return &RoutingProviderLLM{
+		registry:      registry,
+		fallbackOrder: order,
+	}
+}
+
+// Chat tries providers in order
+func (rp *RoutingProviderLLM) Chat(ctx context.Context, systemPrompt, userPrompt string) (string, error) {
+	for _, providerName := range rp.fallbackOrder {
+		provider, err := rp.registry.Get(providerName)
+		if err != nil {
+			continue
+		}
+		
+		if err := provider.IsAvailable(ctx); err != nil {
+			continue
+		}
+		
+		response, err := provider.Chat(ctx, systemPrompt, userPrompt)
+		if err == nil {
+			return response, nil
+		}
+	}
+	
+	return "", fmt.Errorf("all LLM providers failed")
+}
+
+// CachingLLMProvider wraps a provider with caching
+type CachingLLMProvider struct {
+	provider LLMProvider
+	cache    map[string]string
+}
+
+// NewCachingLLMProvider creates a cached provider
+func NewCachingLLMProvider(provider LLMProvider) *CachingLLMProvider {
+	return &CachingLLMProvider{
+		provider: provider,
+		cache:    make(map[string]string),
+	}
+}
+
+// Chat returns cached response if available
+func (clp *CachingLLMProvider) Chat(ctx context.Context, systemPrompt, userPrompt string) (string, error) {
+	key := systemPrompt + "|" + userPrompt
+	
+	if cached, exists := clp.cache[key]; exists {
+		return cached, nil
+	}
+	
+	response, err := clp.provider.Chat(ctx, systemPrompt, userPrompt)
+	if err != nil {
+		return "", err
+	}
+	
+	clp.cache[key] = response
+	return response, nil
+}
+
+// IsAvailable delegates to wrapped provider
+func (clp *CachingLLMProvider) IsAvailable(ctx context.Context) error {
+	return clp.provider.IsAvailable(ctx)
+}
+
+// Name delegates to wrapped provider
+func (clp *CachingLLMProvider) Name() string {
+	return clp.provider.Name() + "-cached"
+}
+
+// RetryingLLMProvider wraps a provider with retry logic
+type RetryingLLMProvider struct {
+	provider    LLMProvider
+	maxRetries  int
+	backoffFunc func(attempt int) interface{}
+}
+
+// NewRetryingLLMProvider creates a retrying provider
+func NewRetryingLLMProvider(provider LLMProvider, maxRetries int) *RetryingLLMProvider {
+	return &RetryingLLMProvider{
+		provider:   provider,
+		maxRetries: maxRetries,
+		backoffFunc: func(attempt int) interface{} {
+			// Exponential backoff: 1s, 2s, 4s...
+			return 1 << uint(attempt)
+		},
+	}
+}
+
+// Chat retries on failure
+func (rlp *RetryingLLMProvider) Chat(ctx context.Context, systemPrompt, userPrompt string) (string, error) {
+	var lastErr error
+	
+	for attempt := 0; attempt <= rlp.maxRetries; attempt++ {
+		response, err := rlp.provider.Chat(ctx, systemPrompt, userPrompt)
+		if err == nil {
+			return response, nil
+		}
+		lastErr = err
+	}
+	
+	return "", fmt.Errorf("failed after %d retries: %w", rlp.maxRetries, lastErr)
+}
+
+// IsAvailable delegates to wrapped provider
+func (rlp *RetryingLLMProvider) IsAvailable(ctx context.Context) error {
+	return rlp.provider.IsAvailable(ctx)
+}
+
+// Name delegates to wrapped provider
+func (rlp *RetryingLLMProvider) Name() string {
+	return rlp.provider.Name() + "-retrying"
+}
+
+// PromptTemplate defines a reusable prompt structure
+type PromptTemplate interface {
+	// Render creates a prompt from values
+	Render(values map[string]interface{}) (string, error)
+}
+
+// SimplePromptTemplate uses Go text/template syntax
+type SimplePromptTemplate struct {
+	template string
+}
+
+// NewSimplePromptTemplate creates a simple template
+func NewSimplePromptTemplate(template string) *SimplePromptTemplate {
+	return &SimplePromptTemplate{template: template}
+}
+
+// Render renders the template (placeholder implementation)
+func (spt *SimplePromptTemplate) Render(values map[string]interface{}) (string, error) {
+	// In real implementation, use text/template
+	return spt.template, nil
+}
+
+// PromptBuilder builds prompts from components
+type PromptBuilder struct {
+	system   string
+	sections []string
+}
+
+// NewPromptBuilder creates a new builder
+func NewPromptBuilder() *PromptBuilder {
+	return &PromptBuilder{
+		sections: []string{},
+	}
+}
+
+// System sets the system prompt
+func (pb *PromptBuilder) System(prompt string) *PromptBuilder {
+	pb.system = prompt
+	return pb
+}
+
+// AddSection adds a prompt section
+func (pb *PromptBuilder) AddSection(title, content string) *PromptBuilder {
+	if title != "" {
+		pb.sections = append(pb.sections, fmt.Sprintf("## %s\n%s", title, content))
+	} else {
+		pb.sections = append(pb.sections, content)
+	}
+	return pb
+}
+
+// Build returns the complete prompt
+func (pb *PromptBuilder) Build() (system, user string) {
+	user = ""
+	for i, section := range pb.sections {
+		if i > 0 {
+			user += "\n\n"
+		}
+		user += section
+	}
+	return pb.system, user
+}

internal/routing/spec_builder.go

@@ -0,0 +1,280 @@
+package routing
+
+import (
+	"fmt"
+)
+
+// SpecBuilder defines interface for building workflow specs
+type SpecBuilder interface {
+	// FromIntent builds spec from an analyzed intent
+	FromIntent(intent *Intent, metadata *BuildMetadata) (*WorkflowSpec, error)
+	
+	// Validate checks if builder can build this intent
+	Validate(intent *Intent) error
+}
+
+// BuildMetadata contains metadata for spec building
+type BuildMetadata struct {
+	KnowledgeBase *KnowledgeBase
+	Context       map[string]interface{}
+	Validators    []WorkflowValidator
+}
+
+// DefaultSpecBuilder implements basic spec building
+type DefaultSpecBuilder struct {
+	kb *KnowledgeBase
+}
+
+// NewDefaultSpecBuilder creates a builder
+func NewDefaultSpecBuilder(kb *KnowledgeBase) *DefaultSpecBuilder {
+	return &DefaultSpecBuilder{kb: kb}
+}
+
+// Validate checks if intent is buildable
+func (dsb *DefaultSpecBuilder) Validate(intent *Intent) error {
+	if len(intent.Activities) == 0 {
+		return fmt.Errorf("intent has no activities")
+	}
+	
+	for _, actName := range intent.Activities {
+		if !dsb.kb.HasActivity(actName) {
+			return fmt.Errorf("activity %s not found", actName)
+		}
+	}
+	
+	return nil
+}
+
+// FromIntent builds spec from intent
+func (dsb *DefaultSpecBuilder) FromIntent(intent *Intent, metadata *BuildMetadata) (*WorkflowSpec, error) {
+	if err := dsb.Validate(intent); err != nil {
+		return nil, err
+	}
+	
+	states := make([]State, 0, len(intent.Activities)+1)
+	
+	// Build states for each activity
+	for i, actName := range intent.Activities {
+		act := dsb.kb.GetActivity(actName)
+		
+		state := State{
+			Name:       actName,
+			Type:       StateTypeTask,
+			Resource:   actName,
+			Parameters: dsb.buildParameters(act, intent, i),
+			Timeout:    act.Constraints.DefaultTimeout,
+			Retry:      dsb.buildRetryPolicy(act, intent),
+		}
+		
+		// Set next state
+		if i < len(intent.Activities)-1 {
+			state.Next = intent.Activities[i+1]
+		} else {
+			state.End = true
+		}
+		
+		// Add catch for flaky activities
+		if act.Constraints.IsFlaky && intent.ErrorHandling != "fail-fast" {
+			state.Catch = []CatchClause{
+				{
+					ErrorEquals: []string{"ActivityError", "TimeoutError"},
+					Next:        "HandleError",
+				},
+			}
+		}
+		
+		states = append(states, state)
+	}
+	
+	// Add error handler if needed
+	if dsb.hasFlaky(intent) && intent.ErrorHandling != "fail-fast" {
+		states = append(states, State{
+			Name:  "HandleError",
+			Type:  StateTypeFail,
+			Error: "ActivityFailed",
+			Cause: "One or more activities failed",
+		})
+	}
+	
+	// Build input map
+	inputMap := make(map[string]interface{})
+	for k, v := range intent.Parameters {
+		inputMap[k] = v
+	}
+	if metadata != nil && metadata.Context != nil {
+		for k, v := range metadata.Context {
+			if _, exists := inputMap[k]; !exists {
+				inputMap[k] = v
+			}
+		}
+	}
+	
+	spec := &WorkflowSpec{
+		Name:   intent.WorkflowName,
+		Input:  inputMap,
+		States: states,
+	}
+	
+	// Validate if validators provided
+	if metadata != nil && len(metadata.Validators) > 0 {
+		for _, v := range metadata.Validators {
+			if err := v.Validate(spec); err != nil {
+				return nil, err
+			}
+		}
+	}
+	
+	return spec, nil
+}
+
+// buildParameters creates parameters for activity
+func (dsb *DefaultSpecBuilder) buildParameters(act *ActivityMetadata, intent *Intent, stateIndex int) map[string]interface{} {
+	params := make(map[string]interface{})
+	resolver := &paramResolver{
+		intent: intent,
+		kb:     dsb.kb,
+	}
+	
+	if stateIndex > 0 {
+		resolver.prevState = intent.Activities[stateIndex-1]
+	}
+	
+	for name, def := range act.Inputs {
+		if val := resolver.resolve(name, def); val != nil {
+			params[name] = val
+		}
+	}
+	
+	return params
+}
+
+// buildRetryPolicy creates retry policy
+func (dsb *DefaultSpecBuilder) buildRetryPolicy(act *ActivityMetadata, intent *Intent) *RetryPolicy {
+	if intent.ErrorHandling == "fail-fast" {
+		return &RetryPolicy{
+			MaxAttempts:     1,
+			BackoffRate:     1.0,
+			InitialInterval: "1s",
+		}
+	}
+	
+	return &RetryPolicy{
+		MaxAttempts:     int32(act.Constraints.RecommendedRetries),
+		BackoffRate:     act.Constraints.RetryBackoff,
+		InitialInterval: "1s",
+		MaxInterval:     "30s",
+	}
+}
+
+// hasFlaky checks if any activity is flaky
+func (dsb *DefaultSpecBuilder) hasFlaky(intent *Intent) bool {
+	for _, actName := range intent.Activities {
+		act := dsb.kb.GetActivity(actName)
+		if act != nil && act.Constraints.IsFlaky {
+			return true
+		}
+	}
+	return false
+}
+
+// CronSpecBuilder builds cron workflow specs
+type CronSpecBuilder struct {
+	regularBuilder SpecBuilder
+}
+
+// NewCronSpecBuilder creates a cron builder
+func NewCronSpecBuilder(regularBuilder SpecBuilder) *CronSpecBuilder {
+	return &CronSpecBuilder{
+		regularBuilder: regularBuilder,
+	}
+}
+
+// Validate checks if intent is valid for cron
+func (csb *CronSpecBuilder) Validate(intent *Intent) error {
+	if !intent.IsCron {
+		return fmt.Errorf("intent is not marked as cron")
+	}
+	
+	if intent.CronSchedule == "" {
+		return fmt.Errorf("cron schedule is empty")
+	}
+	
+	return csb.regularBuilder.Validate(intent)
+}
+
+// FromIntent builds cron spec
+func (csb *CronSpecBuilder) FromIntent(intent *Intent, metadata *BuildMetadata) (*WorkflowSpec, error) {
+	spec, err := csb.regularBuilder.FromIntent(intent, metadata)
+	if err != nil {
+		return nil, err
+	}
+	
+	// In production, wrap with cron metadata
+	// For now, just return the regular spec
+	return spec, nil
+}
+
+// SpecBuilderFactory creates appropriate spec builders
+type SpecBuilderFactory struct {
+	kb *KnowledgeBase
+}
+
+// NewSpecBuilderFactory creates a factory
+func NewSpecBuilderFactory(kb *KnowledgeBase) *SpecBuilderFactory {
+	return &SpecBuilderFactory{kb: kb}
+}
+
+// CreateBuilder creates appropriate builder for intent
+func (sbf *SpecBuilderFactory) CreateBuilder(intent *Intent) (SpecBuilder, error) {
+	if intent.IsCron {
+		return NewCronSpecBuilder(NewDefaultSpecBuilder(sbf.kb)), nil
+	}
+	
+	return NewDefaultSpecBuilder(sbf.kb), nil
+}
+
+// CompositeSpecBuilder combines multiple builders with fallback
+type CompositeSpecBuilder struct {
+	builders []SpecBuilder
+}
+
+// NewCompositeSpecBuilder creates a composite builder
+func NewCompositeSpecBuilder(builders ...SpecBuilder) *CompositeSpecBuilder {
+	return &CompositeSpecBuilder{builders: builders}
+}
+
+// Validate tries each builder
+func (csb *CompositeSpecBuilder) Validate(intent *Intent) error {
+	var lastErr error
+	
+	for _, builder := range csb.builders {
+		if err := builder.Validate(intent); err == nil {
+			return nil
+		} else {
+			lastErr = err
+		}
+	}
+	
+	if lastErr != nil {
+		return lastErr
+	}
+	return fmt.Errorf("no builder could validate intent")
+}
+
+// FromIntent tries each builder
+func (csb *CompositeSpecBuilder) FromIntent(intent *Intent, metadata *BuildMetadata) (*WorkflowSpec, error) {
+	var lastErr error
+	
+	for _, builder := range csb.builders {
+		if spec, err := builder.FromIntent(intent, metadata); err == nil {
+			return spec, nil
+		} else {
+			lastErr = err
+		}
+	}
+	
+	if lastErr != nil {
+		return nil, lastErr
+	}
+	return nil, fmt.Errorf("no builder could create spec")
+}

internal/routing/types.go

@@ -0,0 +1,160 @@
+package routing
+
+import "time"
+
+// WorkflowSpec is generated by llm-router (one-time execution)
+type WorkflowSpec struct {
+	Name   string                 `json:"name"`
+	Input  map[string]interface{} `json:"input"`
+	States []State                `json:"states"`
+}
+
+// CronWorkflowSpec is generated by llm-router (scheduled execution)
+type CronWorkflowSpec struct {
+	Name          string                 `json:"name"`
+	Type          string                 `json:"type"`         // "CronWorkflow"
+	Schedule      string                 `json:"schedule"`     // Cron expression (e.g., "0 2 * * *")
+	Timezone      string                 `json:"timezone"`     // "UTC", "America/New_York", etc
+	Input         map[string]interface{} `json:"input"`        // Fixed input for each run
+	States        []State                `json:"states"`       // Workflow states
+	MaxConcurrent int                    `json:"maxConcurrent,omitempty"`   // Max parallel runs (default 1)
+	Timeout       string                 `json:"timeout,omitempty"`         // Overall timeout per run
+	EnableHistory bool                   `json:"enableHistory,omitempty"`   // Keep execution history
+}
+
+// State is a step in the workflow
+type State struct {
+	Name              string
+	Type              StateType `json:"type"`
+	
+	// Task fields
+	Activity          string                 `json:"activity,omitempty"`
+	Resource          string                 `json:"resource,omitempty"`
+	Parameters        map[string]interface{} `json:"parameters,omitempty"`
+	Timeout           string                 `json:"timeout,omitempty"`
+	Retry             *RetryPolicy           `json:"retry,omitempty"`
+	Catch             []CatchClause          `json:"catch,omitempty"`
+	
+	// Parallel fields
+	Branches          []interface{}          `json:"branches,omitempty"`
+	
+	// Pass fields
+	Result            interface{} `json:"result,omitempty"`
+	
+	// Fail fields
+	Error             string `json:"error,omitempty"`
+	Cause             string `json:"cause,omitempty"`
+	
+	// Transition
+	Next              string `json:"next,omitempty"`
+	End               bool   `json:"end,omitempty"`
+}
+
+// StateType defines valid state types
+type StateType string
+
+const (
+	StateTypeTask     StateType = "Task"
+	StateTypePass     StateType = "Pass"
+	StateTypeFail     StateType = "Fail"
+	StateTypeParallel StateType = "Parallel"
+
+	TaskActivity = "Task"
+)
+
+// RetryPolicy defines retry behavior for activities
+type RetryPolicy struct {
+	MaxAttempts     int32   `json:"maxAttempts"`
+	BackoffSeconds  int32   `json:"backoffSeconds,omitempty"`
+	BackoffRate     float64 `json:"backoffRate"`
+	InitialInterval string  `json:"initialInterval"`
+	MaxInterval     string  `json:"maxInterval,omitempty"`
+}
+
+// CatchClause defines error handling
+type CatchClause struct {
+	ErrorEquals []string `json:"errorEquals"`
+	ResultPath  *string  `json:"resultPath,omitempty"`
+	Next        string   `json:"next"`
+}
+
+// ExecutionContext tracks state during workflow execution
+type ExecutionContext struct {
+	Input       map[string]interface{}
+	StepResults map[string]interface{}
+	CurrentState string
+	History     []ExecutionEvent
+}
+
+// ExecutionEvent tracks individual state execution
+type ExecutionEvent struct {
+	Timestamp time.Time
+	State     string
+	Type      string // "Started", "Completed", "Failed", "Retried"
+	Result    interface{}
+	Error     error
+}
+
+// PollParams for AwaitTaskComplete states
+type PollParams struct {
+	QueueName     string
+	CorrelationID string
+	PollInterval  time.Duration
+	Timeout       time.Duration
+}
+
+// PollResult is the result of polling
+type PollResult struct {
+	Result interface{}
+	Status string
+}
+
+// Result is the final workflow output
+type Result struct {
+	FinalOutput interface{}
+	Status      string // "COMPLETED", "FAILED"
+	Error       error
+}
+
+// Heartbeat contains state for polling activities
+type Heartbeat struct {
+	CorrelationID string
+	Queue         string
+	Attempt       int
+	Elapsed       time.Duration
+	LastCheck     time.Time
+}
+
+// ActivityMetadata describes an activity's capabilities and constraints
+type ActivityMetadata struct {
+	Name        string
+	Description string
+	Category    string
+	Inputs      map[string]InputField
+	Outputs     map[string]OutputField
+	Constraints Constraints
+}
+
+// InputField describes an activity input parameter
+type InputField struct {
+	Type        string      `json:"type"`
+	Description string      `json:"description"`
+	Required    bool        `json:"required"`
+	Default     interface{} `json:"default,omitempty"`
+}
+
+// OutputField describes an activity output field
+type OutputField struct {
+	Type        string `json:"type"`
+	Description string `json:"description"`
+}
+
+// Constraints describes activity execution constraints
+type Constraints struct {
+	DefaultTimeout    string
+	IsFlaky           bool
+	RecommendedRetries int
+	RetryBackoff      float64
+	Dependencies      []string
+	Notes             string
+}

internal/routing/types_test.go

@@ -0,0 +1,327 @@
+package routing
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestWorkflowSpecMarshal(t *testing.T) {
+	spec := WorkflowSpec{
+		Name: "test-workflow",
+		Input: map[string]interface{}{
+			"repo": "https://github.com/test/repo",
+		},
+		States: []State{
+			{
+				Name:     "Clone",
+				Type:     StateTypeTask,
+				Resource: "CloneRepoActivity",
+				Parameters: map[string]interface{}{
+					"repo": "${input.repo}",
+				},
+				Timeout: "5m",
+				Next:    "Analyze",
+			},
+		},
+	}
+
+	// Marshal to JSON
+	data, err := json.Marshal(spec)
+	if err != nil {
+		t.Fatalf("Failed to marshal: %v", err)
+	}
+
+	// Unmarshal back
+	var spec2 WorkflowSpec
+	err = json.Unmarshal(data, &spec2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	// Verify
+	if spec2.Name != spec.Name {
+		t.Errorf("Name mismatch: %s != %s", spec2.Name, spec.Name)
+	}
+	if len(spec2.States) != len(spec.States) {
+		t.Errorf("State count mismatch: %d != %d", len(spec2.States), len(spec.States))
+	}
+}
+
+func TestCronWorkflowSpecMarshal(t *testing.T) {
+	spec := CronWorkflowSpec{
+		Name:          "daily-scan",
+		Type:          "CronWorkflow",
+		Schedule:      "0 2 * * *",
+		Timezone:      "UTC",
+		MaxConcurrent: 1,
+		EnableHistory: true,
+		Input: map[string]interface{}{
+			"repos": []string{"repo1", "repo2"},
+		},
+	}
+
+	// Marshal to JSON
+	data, err := json.Marshal(spec)
+	if err != nil {
+		t.Fatalf("Failed to marshal: %v", err)
+	}
+
+	// Unmarshal back
+	var spec2 CronWorkflowSpec
+	err = json.Unmarshal(data, &spec2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	// Verify
+	if spec2.Schedule != spec.Schedule {
+		t.Errorf("Schedule mismatch: %s != %s", spec2.Schedule, spec.Schedule)
+	}
+	if spec2.Timezone != spec.Timezone {
+		t.Errorf("Timezone mismatch: %s != %s", spec2.Timezone, spec.Timezone)
+	}
+	if spec2.EnableHistory != spec.EnableHistory {
+		t.Errorf("EnableHistory mismatch: %v != %v", spec2.EnableHistory, spec.EnableHistory)
+	}
+}
+
+func TestRetryPolicyMarshal(t *testing.T) {
+	policy := RetryPolicy{
+		MaxAttempts:     3,
+		BackoffRate:     2.0,
+		InitialInterval: "1s",
+		MaxInterval:     "1m",
+	}
+
+	data, err := json.Marshal(policy)
+	if err != nil {
+		t.Fatalf("Failed to marshal: %v", err)
+	}
+
+	var policy2 RetryPolicy
+	err = json.Unmarshal(data, &policy2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	if policy2.MaxAttempts != policy.MaxAttempts {
+		t.Errorf("MaxAttempts mismatch: %d != %d", policy2.MaxAttempts, policy.MaxAttempts)
+	}
+	if policy2.BackoffRate != policy.BackoffRate {
+		t.Errorf("BackoffRate mismatch: %f != %f", policy2.BackoffRate, policy.BackoffRate)
+	}
+}
+
+func TestStateMarshal(t *testing.T) {
+	state := State{
+		Name:     "Analyze",
+		Type:     StateTypeTask,
+		Resource: "AnalyzeCodeActivity",
+		Parameters: map[string]interface{}{
+			"path": "${Clone.output.path}",
+		},
+		Timeout: "10m",
+		Retry: &RetryPolicy{
+			MaxAttempts:     3,
+			BackoffRate:     2.0,
+			InitialInterval: "1s",
+		},
+		Catch: []CatchClause{
+			{
+				ErrorEquals: []string{"Timeout"},
+				Next:        "HandleTimeout",
+			},
+		},
+		Next: "Judge",
+	}
+
+	data, err := json.Marshal(state)
+	if err != nil {
+		t.Fatalf("Failed to marshal: %v", err)
+	}
+
+	var state2 State
+	err = json.Unmarshal(data, &state2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	if state2.Name != state.Name {
+		t.Errorf("Name mismatch: %s != %s", state2.Name, state.Name)
+	}
+	if state2.Type != state.Type {
+		t.Errorf("Type mismatch: %s != %s", state2.Type, state.Type)
+	}
+	if len(state2.Catch) != len(state.Catch) {
+		t.Errorf("Catch count mismatch: %d != %d", len(state2.Catch), len(state.Catch))
+	}
+}
+
+func TestPassState(t *testing.T) {
+	state := State{
+		Name:   "SetSuccess",
+		Type:   StateTypePass,
+		Result: map[string]interface{}{"status": "success"},
+		End:    true,
+	}
+
+	data, err := json.Marshal(state)
+	if err != nil {
+		t.Fatalf("Failed to marshal: %v", err)
+	}
+
+	var state2 State
+	err = json.Unmarshal(data, &state2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	if state2.Type != StateTypePass {
+		t.Errorf("Type should be Pass, got: %s", state2.Type)
+	}
+	if !state2.End {
+		t.Error("End should be true")
+	}
+}
+
+func TestFailState(t *testing.T) {
+	state := State{
+		Name:  "HandleError",
+		Type:  StateTypeFail,
+		Error: "InvalidInput",
+		Cause: "Repository URL is invalid",
+	}
+
+	data, err := json.Marshal(state)
+	if err != nil {
+		t.Fatalf("Failed to marshal: %v", err)
+	}
+
+	var state2 State
+	err = json.Unmarshal(data, &state2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	if state2.Type != StateTypeFail {
+		t.Errorf("Type should be Fail, got: %s", state2.Type)
+	}
+	if state2.Error != "InvalidInput" {
+		t.Errorf("Error mismatch: %s != InvalidInput", state2.Error)
+	}
+}
+
+func TestExecutionContextInit(t *testing.T) {
+	ec := &ExecutionContext{
+		Input:       map[string]interface{}{"repo": "test"},
+		StepResults: make(map[string]interface{}),
+		History:     make([]ExecutionEvent, 0),
+	}
+
+	if ec.Input == nil {
+		t.Error("Input should not be nil")
+	}
+	if ec.StepResults == nil {
+		t.Error("StepResults should not be nil")
+	}
+	if ec.History == nil {
+		t.Error("History should not be nil")
+	}
+}
+
+func TestComplexWorkflowSpec(t *testing.T) {
+	// Test a realistic workflow spec
+	spec := WorkflowSpec{
+		Name: "code-review",
+		Input: map[string]interface{}{
+			"repo":   "https://github.com/rockliang/poimen",
+			"branch": "feature/x",
+		},
+		States: []State{
+			{
+				Name:     "Clone",
+				Type:     StateTypeTask,
+				Resource: "CloneRepoActivity",
+				Parameters: map[string]interface{}{
+					"repo":   "${input.repo}",
+					"branch": "${input.branch}",
+				},
+				Timeout: "5m",
+				Retry: &RetryPolicy{
+					MaxAttempts:     2,
+					BackoffRate:     1.5,
+					InitialInterval: "1s",
+				},
+				Next: "Analyze",
+			},
+			{
+				Name:     "Analyze",
+				Type:     StateTypeTask,
+				Resource: "AnalyzeCodeActivity",
+				Parameters: map[string]interface{}{
+					"path": "${Clone.output.path}",
+				},
+				Timeout: "10m",
+				Retry: &RetryPolicy{
+					MaxAttempts:     3,
+					BackoffRate:     2.0,
+					InitialInterval: "1s",
+				},
+				Catch: []CatchClause{
+					{
+						ErrorEquals: []string{"Timeout"},
+						Next:        "HandleTimeout",
+					},
+				},
+				Next: "Judge",
+			},
+			{
+				Name:     "Judge",
+				Type:     StateTypeTask,
+				Resource: "JudgeActivity",
+				Parameters: map[string]interface{}{
+					"quality": "${Analyze.output.quality}",
+				},
+				Timeout: "5m",
+				End:     true,
+			},
+			{
+				Name:  "HandleTimeout",
+				Type:  StateTypeFail,
+				Error: "AnalysisTimeout",
+				Cause: "Code analysis timed out",
+			},
+		},
+	}
+
+	// Marshal
+	data, err := json.Marshal(spec)
+	if err != nil {
+		t.Fatalf("Failed to marshal: %v", err)
+	}
+
+	// Unmarshal
+	var spec2 WorkflowSpec
+	err = json.Unmarshal(data, &spec2)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	// Verify
+	if spec2.Name != "code-review" {
+		t.Errorf("Name mismatch")
+	}
+	if len(spec2.States) != 4 {
+		t.Errorf("Expected 4 states, got %d", len(spec2.States))
+	}
+
+	// Check first state
+	if spec2.States[0].Resource != "CloneRepoActivity" {
+		t.Errorf("First state resource mismatch")
+	}
+
+	// Check error catching
+	if len(spec2.States[1].Catch) == 0 {
+		t.Error("Analyze state should have catch clauses")
+	}
+}

internal/routing/validator.go

@@ -0,0 +1,346 @@
+package routing
+
+import (
+	"fmt"
+	"time"
+)
+
+// ValidationError represents a single validation error
+type ValidationError struct {
+	Path    string // JSONPath where error occurred
+	Message string // Error message
+}
+
+// ValidationResult contains all validation errors
+type ValidationResult struct {
+	Valid  bool
+	Errors []ValidationError
+}
+
+// Validator validates WorkflowSpec and CronWorkflowSpec
+type Validator struct {
+	kb *KnowledgeBase
+}
+
+// NewValidator creates a new validator with knowledge base
+func NewValidator(kb *KnowledgeBase) *Validator {
+	return &Validator{kb: kb}
+}
+
+// ValidateWorkflowSpec validates a one-time workflow spec
+func (v *Validator) ValidateWorkflowSpec(spec *WorkflowSpec) *ValidationResult {
+	result := &ValidationResult{
+		Valid:  true,
+		Errors: []ValidationError{},
+	}
+
+	if spec == nil {
+		result.Valid = false
+		result.Errors = append(result.Errors, ValidationError{
+			Path:    "spec",
+			Message: "workflow spec cannot be nil",
+		})
+		return result
+	}
+
+	// Validate name
+	var errs []ValidationError
+	if spec.Name == "" {
+		result.Valid = false
+		errs = append(errs, ValidationError{
+			Path:    "spec.name",
+			Message: "workflow name is required",
+		})
+	}
+
+	// Validate states
+	if len(spec.States) == 0 {
+		result.Valid = false
+		errs = append(errs, ValidationError{
+			Path:    "spec.states",
+			Message: "at least one state is required",
+		})
+	}
+
+	// Validate each state
+	stateNames := make(map[string]bool)
+
+	for i, state := range spec.States {
+		path := fmt.Sprintf("spec.states[%d]", i)
+		
+		if state.Name == "" {
+			result.Valid = false
+			errs = append(errs, ValidationError{
+				Path:    path + ".name",
+				Message: "state name is required",
+			})
+			continue
+		}
+
+		if stateNames[state.Name] {
+			result.Valid = false
+			errs = append(errs, ValidationError{
+				Path:    path + ".name",
+				Message: fmt.Sprintf("duplicate state name: %s", state.Name),
+			})
+		}
+		stateNames[state.Name] = true
+
+		// Validate state type
+		stateErrs := v.validateState(state, path)
+		if len(stateErrs) > 0 {
+			result.Valid = false
+			errs = append(errs, stateErrs...)
+		}
+	}
+
+	// Validate state transitions
+	for i, state := range spec.States {
+		path := fmt.Sprintf("spec.states[%d]", i)
+		
+		// Check that Next state exists (if specified)
+		if state.Next != "" && !stateNames[state.Next] {
+			result.Valid = false
+			errs = append(errs, ValidationError{
+				Path:    path + ".next",
+				Message: fmt.Sprintf("state '%s' does not exist", state.Next),
+			})
+		}
+
+		// Check that Catch targets exist
+		for j, catchClause := range state.Catch {
+			if catchClause.Next != "" && !stateNames[catchClause.Next] {
+				result.Valid = false
+				errs = append(errs, ValidationError{
+					Path:    path + fmt.Sprintf(".catch[%d].next", j),
+					Message: fmt.Sprintf("state '%s' does not exist", catchClause.Next),
+				})
+			}
+		}
+	}
+
+	result.Errors = errs
+	return result
+}
+
+// ValidateCronWorkflowSpec validates a scheduled workflow spec
+func (v *Validator) ValidateCronWorkflowSpec(spec *CronWorkflowSpec) *ValidationResult {
+	result := &ValidationResult{
+		Valid:  true,
+		Errors: []ValidationError{},
+	}
+
+	if spec == nil {
+		result.Valid = false
+		result.Errors = append(result.Errors, ValidationError{
+			Path:    "spec",
+			Message: "cron workflow spec cannot be nil",
+		})
+		return result
+	}
+
+	// Validate name
+	if spec.Name == "" {
+		result.Valid = false
+		result.Errors = append(result.Errors, ValidationError{
+			Path:    "spec.name",
+			Message: "workflow name is required",
+		})
+	}
+
+	// Validate type
+	if spec.Type != "CronWorkflow" {
+		result.Valid = false
+		result.Errors = append(result.Errors, ValidationError{
+			Path:    "spec.type",
+			Message: "type must be 'CronWorkflow'",
+		})
+	}
+
+	// Validate cron expression
+	if spec.Schedule == "" {
+		result.Valid = false
+		result.Errors = append(result.Errors, ValidationError{
+			Path:    "spec.schedule",
+			Message: "cron schedule is required",
+		})
+	} else {
+		if err := validateCronExpression(spec.Schedule); err != nil {
+			result.Valid = false
+			result.Errors = append(result.Errors, ValidationError{
+				Path:    "spec.schedule",
+				Message: err.Error(),
+			})
+		}
+	}
+
+	// Validate timezone
+	if spec.Timezone == "" {
+		result.Valid = false
+		result.Errors = append(result.Errors, ValidationError{
+			Path:    "spec.timezone",
+			Message: "timezone is required",
+		})
+	} else {
+		if _, err := time.LoadLocation(spec.Timezone); err != nil {
+			result.Valid = false
+			result.Errors = append(result.Errors, ValidationError{
+				Path:    "spec.timezone",
+				Message: fmt.Sprintf("invalid timezone: %s", spec.Timezone),
+			})
+		}
+	}
+
+	// Validate maxConcurrent
+	if spec.MaxConcurrent < 1 {
+		result.Valid = false
+		result.Errors = append(result.Errors, ValidationError{
+			Path:    "spec.maxConcurrent",
+			Message: "maxConcurrent must be >= 1",
+		})
+	}
+
+	// Validate states (same as one-time workflow)
+	if len(spec.States) == 0 {
+		result.Valid = false
+		result.Errors = append(result.Errors, ValidationError{
+			Path:    "spec.states",
+			Message: "at least one state is required",
+		})
+	}
+
+	stateNames := make(map[string]bool)
+	for i, state := range spec.States {
+		path := fmt.Sprintf("spec.states[%d]", i)
+		
+		if state.Name == "" {
+			result.Valid = false
+			result.Errors = append(result.Errors, ValidationError{
+				Path:    path + ".name",
+				Message: "state name is required",
+			})
+			continue
+		}
+
+		if stateNames[state.Name] {
+			result.Valid = false
+			result.Errors = append(result.Errors, ValidationError{
+				Path:    path + ".name",
+				Message: fmt.Sprintf("duplicate state name: %s", state.Name),
+			})
+		}
+		stateNames[state.Name] = true
+
+		stateErrs := v.validateState(state, path)
+		if len(stateErrs) > 0 {
+			result.Valid = false
+			result.Errors = append(result.Errors, stateErrs...)
+		}
+	}
+
+	// Validate state transitions
+	for i, state := range spec.States {
+		path := fmt.Sprintf("spec.states[%d]", i)
+		
+		if state.Next != "" && !stateNames[state.Next] {
+			result.Valid = false
+			result.Errors = append(result.Errors, ValidationError{
+				Path:    path + ".next",
+				Message: fmt.Sprintf("state '%s' does not exist", state.Next),
+			})
+		}
+
+		for j, catchClause := range state.Catch {
+			if catchClause.Next != "" && !stateNames[catchClause.Next] {
+				result.Valid = false
+				result.Errors = append(result.Errors, ValidationError{
+					Path:    path + fmt.Sprintf(".catch[%d].next", j),
+					Message: fmt.Sprintf("state '%s' does not exist", catchClause.Next),
+				})
+			}
+		}
+	}
+
+	return result
+}
+
+// validateState validates a single state
+func (v *Validator) validateState(state State, path string) []ValidationError {
+	var errs []ValidationError
+
+	switch state.Type {
+	case StateTypeTask:
+		if state.Resource == "" {
+			errs = append(errs, ValidationError{
+				Path:    path + ".resource",
+				Message: "resource is required for Task state",
+			})
+		} else {
+			// Check if activity exists in knowledge base
+			if v.kb != nil && !v.kb.HasActivity(state.Resource) {
+				errs = append(errs, ValidationError{
+					Path:    path + ".resource",
+					Message: fmt.Sprintf("activity '%s' not found in knowledge base", state.Resource),
+				})
+			}
+		}
+
+		// Validate timeout format
+		if state.Timeout != "" {
+			if err := validateDuration(state.Timeout); err != nil {
+				errs = append(errs, ValidationError{
+					Path:    path + ".timeout",
+					Message: err.Error(),
+				})
+			}
+		}
+
+	case StateTypePass:
+		// Pass state is valid with just a result
+		if state.Result == nil {
+			errs = append(errs, ValidationError{
+				Path:    path + ".result",
+				Message: "result is required for Pass state",
+			})
+		}
+
+	case StateTypeFail:
+		// Fail state requires error
+		if state.Error == "" {
+			errs = append(errs, ValidationError{
+				Path:    path + ".error",
+				Message: "error is required for Fail state",
+			})
+		}
+
+	default:
+		errs = append(errs, ValidationError{
+			Path:    path + ".type",
+			Message: fmt.Sprintf("invalid state type: %s", state.Type),
+		})
+	}
+
+	return errs
+}
+
+// validateDuration validates Go duration string (e.g., "5m", "30s")
+func validateDuration(dur string) error {
+	_, err := time.ParseDuration(dur)
+	if err != nil {
+		return fmt.Errorf("invalid duration: %s", dur)
+	}
+	return nil
+}
+
+// String returns a human-readable validation result
+func (vr *ValidationResult) String() string {
+	if vr.Valid {
+		return "Valid ✓"
+	}
+
+	msg := fmt.Sprintf("Invalid ✗ (%d errors):\n", len(vr.Errors))
+	for _, err := range vr.Errors {
+		msg += fmt.Sprintf("  %s: %s\n", err.Path, err.Message)
+	}
+	return msg
+}

internal/routing/validator_cron.go

@@ -0,0 +1,56 @@
+package routing
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// validateCronExpression validates a cron expression (simplified)
+// Supports standard 5-field cron: minute hour day month weekday
+// Does NOT validate all possible edge cases - just basic format
+func validateCronExpression(expr string) error {
+	fields := strings.Fields(expr)
+	if len(fields) != 5 {
+		return fmt.Errorf("cron expression must have 5 fields (minute hour day month weekday), got %d", len(fields))
+	}
+
+	// Validate field ranges
+	ranges := []struct {
+		name string
+		min  int
+		max  int
+	}{
+		{"minute", 0, 59},
+		{"hour", 0, 23},
+		{"day", 1, 31},
+		{"month", 1, 12},
+		{"weekday", 0, 6},
+	}
+
+	// Basic pattern: * or */n or n or n-m or n,m or n-m/p
+	// This is simplified and doesn't validate all edge cases
+	fieldRegex := regexp.MustCompile(`^(\*|(\d+)(,(\d+))*(\/\d+)?|(\d+)-(\d+)(\/\d+)?|\*\/\d+)$`)
+
+	for i, field := range fields {
+		if field == "*" {
+			continue
+		}
+
+		// Check basic format
+		if !fieldRegex.MatchString(field) {
+			return fmt.Errorf("invalid %s field: %s", ranges[i].name, field)
+		}
+
+		// Validate simple number values
+		if !strings.ContainsAny(field, "*,-/") {
+			var val int
+			_, _ = fmt.Sscanf(field, "%d", &val)
+			if val < ranges[i].min || val > ranges[i].max {
+				return fmt.Errorf("invalid %s value %d (range %d-%d)", ranges[i].name, val, ranges[i].min, ranges[i].max)
+			}
+		}
+	}
+
+	return nil
+}

internal/routing/validator_test.go

@@ -0,0 +1,540 @@
+package routing
+
+import (
+	"testing"
+)
+
+func TestValidateValidWorkflowSpec(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "test-workflow",
+		Input: map[string]interface{}{
+			"repo": "https://github.com/test/repo",
+		},
+		States: []State{
+			{
+				Name:     "Clone",
+				Type:     StateTypeTask,
+				Resource: "CloneRepoActivity",
+				Parameters: map[string]interface{}{
+					"repo": "${input.repo}",
+				},
+				Timeout: "5m",
+				Next:    "Analyze",
+			},
+			{
+				Name:     "Analyze",
+				Type:     StateTypeTask,
+				Resource: "AnalyzeCodeActivity",
+				Parameters: map[string]interface{}{
+					"path": "${Clone.output.path}",
+				},
+				Timeout: "10m",
+				End:     true,
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if !result.Valid {
+		t.Errorf("Spec should be valid. Errors: %v", result.Errors)
+	}
+}
+
+func TestValidateWorkflowSpecNilName(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "",
+		States: []State{
+			{
+				Name:     "Test",
+				Type:     StateTypeTask,
+				Resource: "CloneRepoActivity",
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Spec with empty name should be invalid")
+	}
+
+	if len(result.Errors) == 0 {
+		t.Error("Should have validation errors")
+	}
+}
+
+func TestValidateWorkflowSpecNoStates(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name:   "test",
+		States: []State{},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Spec with no states should be invalid")
+	}
+}
+
+func TestValidateInvalidStateTransition(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "test",
+		States: []State{
+			{
+				Name:     "A",
+				Type:     StateTypeTask,
+				Resource: "CloneRepoActivity",
+				Next:     "NonExistent",
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Spec with invalid state transition should be invalid")
+	}
+}
+
+func TestValidateDuplicateStateName(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "test",
+		States: []State{
+			{
+				Name:     "A",
+				Type:     StateTypeTask,
+				Resource: "CloneRepoActivity",
+			},
+			{
+				Name:     "A", // Duplicate!
+				Type:     StateTypeTask,
+				Resource: "CloneRepoActivity",
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Spec with duplicate state names should be invalid")
+	}
+}
+
+func TestValidateUnknownActivity(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "test",
+		States: []State{
+			{
+				Name:     "A",
+				Type:     StateTypeTask,
+				Resource: "UnknownActivity",
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Spec with unknown activity should be invalid")
+	}
+}
+
+func TestValidatePassState(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "test",
+		States: []State{
+			{
+				Name:   "Success",
+				Type:   StateTypePass,
+				Result: map[string]interface{}{"status": "ok"},
+				End:    true,
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if !result.Valid {
+		t.Errorf("Pass state spec should be valid: %v", result.Errors)
+	}
+}
+
+func TestValidatePassStateNoResult(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "test",
+		States: []State{
+			{
+				Name: "Success",
+				Type: StateTypePass,
+				End:  true,
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Pass state without result should be invalid")
+	}
+}
+
+func TestValidateFailState(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "test",
+		States: []State{
+			{
+				Name:  "Fail",
+				Type:  StateTypeFail,
+				Error: "TestError",
+				Cause: "For testing",
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if !result.Valid {
+		t.Errorf("Fail state spec should be valid: %v", result.Errors)
+	}
+}
+
+func TestValidateInvalidDuration(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &WorkflowSpec{
+		Name: "test",
+		States: []State{
+			{
+				Name:     "A",
+				Type:     StateTypeTask,
+				Resource: "CloneRepoActivity",
+				Timeout:  "invalid",
+			},
+		},
+	}
+
+	result := validator.ValidateWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Spec with invalid timeout should be invalid")
+	}
+}
+
+func TestValidateCronWorkflowSpec(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &CronWorkflowSpec{
+		Name:          "daily-scan",
+		Type:          "CronWorkflow",
+		Schedule:      "0 2 * * *",
+		Timezone:      "UTC",
+		MaxConcurrent: 1,
+		States: []State{
+			{
+				Name:     "Scan",
+				Type:     StateTypeTask,
+				Resource: "SecurityScanActivity",
+				End:      true,
+			},
+		},
+	}
+
+	result := validator.ValidateCronWorkflowSpec(spec)
+	if !result.Valid {
+		t.Errorf("Valid cron spec should pass: %v", result.Errors)
+	}
+}
+
+func TestValidateCronWorkflowSpecInvalidTimezone(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &CronWorkflowSpec{
+		Name:          "daily-scan",
+		Type:          "CronWorkflow",
+		Schedule:      "0 2 * * *",
+		Timezone:      "InvalidTimezone",
+		MaxConcurrent: 1,
+		States: []State{
+			{
+				Name:     "Scan",
+				Type:     StateTypeTask,
+				Resource: "SecurityScanActivity",
+				End:      true,
+			},
+		},
+	}
+
+	result := validator.ValidateCronWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Cron spec with invalid timezone should be invalid")
+	}
+}
+
+func TestValidateCronWorkflowSpecInvalidSchedule(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &CronWorkflowSpec{
+		Name:          "daily-scan",
+		Type:          "CronWorkflow",
+		Schedule:      "invalid cron",
+		Timezone:      "UTC",
+		MaxConcurrent: 1,
+		States: []State{
+			{
+				Name:     "Scan",
+				Type:     StateTypeTask,
+				Resource: "SecurityScanActivity",
+				End:      true,
+			},
+		},
+	}
+
+	result := validator.ValidateCronWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Cron spec with invalid schedule should be invalid")
+	}
+}
+
+func TestValidateCronWorkflowSpecInvalidType(t *testing.T) {
+	kbPath := getKBPath()
+	if kbPath == "" {
+		t.Skip("Knowledge base not found")
+	}
+
+	kb, err := LoadKnowledgeBase(kbPath)
+	if err != nil {
+		t.Fatalf("Failed to load KB: %v", err)
+	}
+
+	validator := NewValidator(kb)
+
+	spec := &CronWorkflowSpec{
+		Name:          "daily-scan",
+		Type:          "WrongType",
+		Schedule:      "0 2 * * *",
+		Timezone:      "UTC",
+		MaxConcurrent: 1,
+		States: []State{
+			{
+				Name:     "Scan",
+				Type:     StateTypeTask,
+				Resource: "SecurityScanActivity",
+				End:      true,
+			},
+		},
+	}
+
+	result := validator.ValidateCronWorkflowSpec(spec)
+	if result.Valid {
+		t.Error("Cron spec with wrong type should be invalid")
+	}
+}
+
+func TestValidateDuration(t *testing.T) {
+	validDurations := []string{"1s", "5m", "1h", "100ms"}
+	for _, dur := range validDurations {
+		if err := validateDuration(dur); err != nil {
+			t.Errorf("Duration %s should be valid: %v", dur, err)
+		}
+	}
+
+	invalidDurations := []string{"invalid", "5x", ""}
+	for _, dur := range invalidDurations {
+		if err := validateDuration(dur); err == nil {
+			t.Errorf("Duration %s should be invalid", dur)
+		}
+	}
+}
+
+func TestValidateCronExpression(t *testing.T) {
+	validCrons := []string{
+		"0 2 * * *",     // 2 AM daily
+		"*/5 * * * *",   // Every 5 minutes
+		"0 0 1 * *",     // First of month
+		"0 12 * * 1",    // Noon on Mondays
+		"30 15 * * *",   // 3:30 PM daily
+	}
+
+	for _, cron := range validCrons {
+		if err := validateCronExpression(cron); err != nil {
+			t.Errorf("Cron %s should be valid: %v", cron, err)
+		}
+	}
+
+	invalidCrons := []string{
+		"invalid",         // Too few fields
+		"0 2 * * * *",     // Too many fields
+		"60 * * * *",      // Invalid minute
+		"* 25 * * *",      // Invalid hour
+	}
+
+	for _, cron := range invalidCrons {
+		if err := validateCronExpression(cron); err == nil {
+			t.Errorf("Cron %s should be invalid", cron)
+		}
+	}
+}
+
+func TestValidationResultString(t *testing.T) {
+	result := &ValidationResult{
+		Valid:  true,
+		Errors: []ValidationError{},
+	}
+
+	str := result.String()
+	if str != "Valid ✓" {
+		t.Errorf("Valid result string should be 'Valid ✓', got: %s", str)
+	}
+
+	result.Valid = false
+	result.Errors = []ValidationError{
+		{
+			Path:    "spec.name",
+			Message: "name is required",
+		},
+	}
+
+	str = result.String()
+	if !contains(str, "Invalid") {
+		t.Error("Invalid result string should contain 'Invalid'")
+	}
+}

k8s/configmap.enc.yaml

@@ -0,0 +1,27 @@
+apiVersion: ENC[AES256_GCM,data:IxE=,iv:nh5IQck87AsRYnvxMLxn2rZFBUTHcc9obvsYoHnvC6g=,tag:ink4m5kv1NqX2TeRrpCaqg==,type:str]
+kind: ENC[AES256_GCM,data:2U5oBCqywkR0,iv:EVBlp6G1SlznoP7Zx9Y0mQOnxbzcosP28+UbJUWFjHM=,tag:v1lot4q06QBqU2M5q2RJ/g==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:pFOLyxGAW7/KqUqijkPM1mGYaKo=,iv:jttNW2Ef0itpuWupOQkGEiFaanpcd/HuvfLg9l2tSEg=,tag:6ijOdYdjnUaCOf29z8vkxg==,type:str]
+    namespace: ENC[AES256_GCM,data:FSZFmVEp,iv:liL0yGuEbjZjf6egh8KS9zi6H3AEF9MvynGBO+49GW0=,tag:4iJNECe8vsXqzQBV/Q7c0g==,type:str]
+data:
+    #ENC[AES256_GCM,data:d+Z/w/n69JI5,iv:/w2xIrmNXg53kz+tfebT0P6rD3TC909YTDFXXUc/yHo=,tag:ao4yA2lW2a1/ELT8ZIBOgw==,type:comment]
+    TEMPORAL_NAMESPACE: ENC[AES256_GCM,data:X0D/DVfVgzhFh+oB8nU=,iv:biiLtXRALsUMNIW4qGj8JOc9C1RJK93pOw74ZmymM/g=,tag:tW5+AwUGj8jzvxPSZAf41A==,type:str]
+    TEMPORAL_HOSTPORT: ENC[AES256_GCM,data:OK8Cu7nA2fKhXmBko8MORoD6hvJBMFfE/dTBZ99ac420xjPBWjhrz2XR3WRiWhUIIQ==,iv:HKDNRT/30HNzN3pX91e63i/ZeIUUYkycknjjKTFlVwo=,tag:OjPle4p+nV4ZQYN/yuUFEw==,type:str]
+    #ENC[AES256_GCM,data:1jnEt80ScfSqnCv9Rf/XLAlYTfuZVxoRdV7Sx9EgIGmzvAM=,iv:3NKsB9ZytMxuMipSLApKX7hj2jQG+2e2Hp8+ofFin9k=,tag:s4eRatHTQJa37xBO5UYI5Q==,type:comment]
+    LOCAL_LLM_BASE_URL: ENC[AES256_GCM,data:rTWBhNovjp5WdFI2jMaMRRg41uhh1dOFqVnplmMADiubu/FGXCvUPD2d9IuU,iv:1RdS5UfD6aOXnaEfddRd4PxJ1+K7AwKlMUYxzUQxVJ4=,tag:K0g2KDCFLOtxDFkHxoRbMw==,type:str]
+    MEMORY_SERVICE_URL: ENC[AES256_GCM,data:CarE5ENFtDvBWVzB7qTZQqoL0OsN2uAO9aoPXu1LPWtdoSQ2rQsVs2scTA08jaWLD+o=,iv:e7M/aibmYdSk4NbY6fYw0UPjd/VQvWJ1tC8n0r2y6r0=,tag:bWuCTBRfKkaB2fauPR51Fg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBV0RJU2wzN1Bib0lZRlFl
+            K2UzSVBNUjNHUVVFeUFEWTJBUHNZT0l3RWprCmp2cE1HM2xOWnVjVGlqdWI0SndG
+            Q1VOaklVdlg4eGp6V29uVDVJRUtmKzgKLS0tIGp3MWJMdmdyZmRnWmxOWEhVZUhm
+            Rm5DNzBhUWt0SVBDK09mSWw2SHVRTWMKLS6Cz2nhz1RSoV+VUvFw9EsjlWbE2nEk
+            4P1FdNgr+v1MTNczKZGzh9HbTAmYxCRgVBszXR5ov2JfukaZAWb9mg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-06T12:56:33Z"
+    mac: ENC[AES256_GCM,data:Ra89XdYHoJV+uFBlUMdw+I36UQfhM+r0Q4WjI3V/A7jBY2t00I0xSP+KRKPXlAA18HXpLCc5VkWklPMU4gfyYied1bPuFw6yLvvuup/ev4UAg/LofThKjtuRfXPy82Ltvro6R+ilWzJ8pRtgtk+jC4xkkMsUOACJMVwgn979D7M=,iv:UWR+CqXAreW/fx3tt1kJsOKYZkrAkxLXlU5QVy5p3gE=,tag:3t9c6631D4XrDmkR6Iv/4Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

k8s/configmap.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: poimen-config
-  namespace: poimen
-data:
-  TEMPORAL_NAMESPACE: "poimen-harness"
-  TEMPORAL_HOSTPORT: "temporal-frontend.temporal:7233"
-  # ANTHROPIC_API_KEY is handled via Secret

k8s/git-commit.yaml

@@ -9,6 +9,6 @@ metadata:
     app.kubernetes.io/name: poimen
     app.kubernetes.io/component: orchestrator
 data:
-  GIT_COMMIT: "4388820"  # Updated automatically by CI/CD
+  GIT_COMMIT: "84b4ca120"  # Updated automatically by CI/CD
   GIT_BRANCH: "main"
-  DEPLOYMENT_DATE: "2026-08-26"
+  DEPLOYMENT_DATE: "2026-09-05"

k8s/kustomization.yaml

@@ -4,23 +4,19 @@ kind: Kustomization
 namespace: poimen
 
 resources:
-  - orchestrator-job.yaml
-  - worker-deployment.yaml
-  - git-commit.yaml
+  - poimen-application.yaml
 
 commonLabels:
   app.kubernetes.io/name: poimen
-  app.kubernetes.io/component: orchestrator
+  app.kubernetes.io/component: worker
 
-secretGenerator:
-  - name: poimen-secrets
-    envs:
-      - secrets.env
-    behavior: create
-
-configMapGenerator:
-  - name: poimen-config
-    literals:
-      - TEMPORAL_NAMESPACE=poimen-harness
-      - TEMPORAL_HOSTPORT=temporal-frontend.temporal:7233
-    behavior: create
+images:
+  - name: forgejo.riotpiao.com/rock/poimen-memory
+    newName: forgejo.riotpiao.com/rock/poimen-memory
+    newTag: latest
+  - name: forgejo.riotpiao.com/rock/poimen-workflows
+    newName: forgejo.riotpiao.com/rock/poimen-workflows
+    newTag: latest
+  - name: forgejo.riotpiao.com/rock/poimen-frontend
+    newName: forgejo.riotpiao.com/rock/poimen-frontend
+    newTag: latest

k8s/orchestrator-job.yaml

@@ -1,61 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: poimen-orchestrator
-  namespace: poimen
-spec:
-  backoffLimit: 3
-  template:
-    metadata:
-      labels:
-        app: poimen-orchestrator
-    spec:
-      restartPolicy: Never
-      containers:
-      - name: orchestrator
-        image: golang:latest
-        imagePullPolicy: Always  # ✅ Force latest image pull
-        workingDir: /app
-        command: ["/bin/sh", "-c"]
-        args:
-          - |
-            set -e
-            echo "[$(date)] Starting poimen orchestrator job..."
-            apt-get update && apt-get install -y --no-install-recommends git
-            echo "[$(date)] Cloning latest code from git..."
-            git clone https://forgejo.riotpiao.com/rock/poimen-workflows.git /app
-            cd /app
-            echo "[$(date)] Latest commit: $(git rev-parse HEAD)"
-            echo "[$(date)] Downloading dependencies..."
-            go mod download
-            echo "[$(date)] Starting orchestrator with T0-T4 complete implementation..."
-            go run ./cmd/starter \
-              --repo https://forgejo.riotpiao.com/rock/poimen \
-              --remote file:///tmp/poimen-output \
-              --milestone T0 \
-              --planner-model ornith \
-              --judge-model ornith \
-              --implementer-model claude-sonnet-5
-        env:
-        - name: TEMPORAL_NAMESPACE
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-config
-              key: TEMPORAL_NAMESPACE
-        - name: TEMPORAL_HOSTPORT
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-config
-              key: TEMPORAL_HOSTPORT
-        - name: ANTHROPIC_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: poimen-secrets
-              key: ANTHROPIC_API_KEY
-        resources:
-          requests:
-            memory: "512Mi"
-            cpu: "500m"
-          limits:
-            memory: "2Gi"
-            cpu: "2000m"

k8s/secret.yaml

@@ -1,12 +0,0 @@
-# NOTE: This file is for reference only.
-# Kustomize will auto-generate secrets from secrets.env
-# See kustomization.yaml for details
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: poimen-secrets
-  namespace: poimen
-type: Opaque
-stringData:
-  ANTHROPIC_API_KEY: "" # Generated from secrets.env by Kustomize

k8s/secrets.env

@@ -1 +0,0 @@
-ANTHROPIC_API_KEY=YOUR_ANTHROPIC_API_KEY_HERE

k8s/worker-deployment.yaml

@@ -13,8 +13,8 @@ spec:
       labels:
         app: poimen-worker
       annotations:
-        git-commit: "4388820"  # ✅ Updated on each push, triggers rolling restart
-        deployment-date: "2026-08-26"
+        git-commit: "84b4ca120"  # ✅ Updated on each push, triggers rolling restart
+        deployment-date: "2026-09-05"
     spec:
       containers:
       - name: worker
@@ -51,6 +51,16 @@ spec:
             secretKeyRef:
               name: poimen-secrets
               key: ANTHROPIC_API_KEY
+        - name: LOCAL_LLM_BASE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: LOCAL_LLM_BASE_URL
+        - name: POIMEN_MEMORY_URL
+          valueFrom:
+            configMapKeyRef:
+              name: poimen-config
+              key: POIMEN_MEMORY_URL
         resources:
           requests:
             memory: "512Mi"

pkg/db/db.go

@@ -0,0 +1,535 @@
+package db
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"os"
+	"time"
+
+	_ "github.com/lib/pq"
+)
+
+// DB wraps the database connection
+type DB struct {
+	conn *sql.DB
+}
+
+// New creates a new database connection to memory-db (K8s CNPG)
+// Expected DSN format: postgresql://app:password@host:5432/dbname?sslmode=disable
+func New(dsn string) (*DB, error) {
+	if dsn == "" {
+		// Fallback: try to construct from K8s env vars
+		host := os.Getenv("DATABASE_HOST")
+		port := os.Getenv("DATABASE_PORT")
+		name := os.Getenv("DATABASE_NAME")
+		user := os.Getenv("DATABASE_USER")
+		password := os.Getenv("DATABASE_PASSWORD")
+		
+		if host != "" && port != "" && name != "" && user != "" && password != "" {
+			dsn = fmt.Sprintf("postgresql://%s:%s@%s:%s/%s?sslmode=disable", 
+				user, password, host, port, name)
+		} else {
+			return nil, fmt.Errorf("DATABASE_URL or K8s env vars (DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD) required")
+		}
+	}
+
+	conn, err := sql.Open("postgres", dsn)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open database: %w", err)
+	}
+
+	// Test connection
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	if err := conn.PingContext(ctx); err != nil {
+		return nil, fmt.Errorf("failed to ping database: %w", err)
+	}
+
+	// Set connection pool settings
+	conn.SetMaxOpenConns(25)
+	conn.SetMaxIdleConns(5)
+	conn.SetConnMaxLifetime(5 * time.Minute)
+
+	return &DB{conn: conn}, nil
+}
+
+// Close closes the database connection
+func (db *DB) Close() error {
+	return db.conn.Close()
+}
+
+// SaveWorkflow saves or updates a workflow with canvas
+func (db *DB) SaveWorkflow(ctx context.Context, wf *Workflow) error {
+	query := `
+		INSERT INTO workflows (id, customer_id, name, description, status, version, nodes, edges, created_by, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+		ON CONFLICT (id) DO UPDATE SET
+			name = $3,
+			description = $4,
+			status = $5,
+			version = $6,
+			nodes = $7,
+			edges = $8,
+			updated_at = $11
+	`
+
+	_, err := db.conn.ExecContext(ctx, query,
+		wf.ID,
+		wf.CustomerID,
+		wf.Name,
+		wf.Description,
+		wf.Status,
+		wf.Version,
+		wf.Nodes,
+		wf.Edges,
+		wf.CreatedBy,
+		wf.CreatedAt,
+		wf.UpdatedAt,
+	)
+
+	return err
+}
+
+// SaveCanvasUpdate saves canvas (nodes + edges) for a workflow
+func (db *DB) SaveCanvasUpdate(ctx context.Context, workflowID, customerID string, canvas *Canvas) error {
+	nodesJSON, err := json.Marshal(canvas.Nodes)
+	if err != nil {
+		return fmt.Errorf("failed to marshal nodes: %w", err)
+	}
+
+	edgesJSON, err := json.Marshal(canvas.Edges)
+	if err != nil {
+		return fmt.Errorf("failed to marshal edges: %w", err)
+	}
+
+	query := `
+		UPDATE workflows
+		SET nodes = $1, edges = $2, updated_at = now()
+		WHERE id = $3 AND customer_id = $4
+	`
+
+	result, err := db.conn.ExecContext(ctx, query, nodesJSON, edgesJSON, workflowID, customerID)
+	if err != nil {
+		return fmt.Errorf("failed to update canvas: %w", err)
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+
+	if rows == 0 {
+		return fmt.Errorf("workflow not found: %s", workflowID)
+	}
+
+	return nil
+}
+
+// FetchWorkflow retrieves a workflow by ID
+func (db *DB) FetchWorkflow(ctx context.Context, workflowID, customerID string) (*Workflow, error) {
+	query := `
+		SELECT id, customer_id, name, description, status, version, nodes, edges, created_by, created_at, updated_at, last_executed_at
+		FROM workflows
+		WHERE id = $1 AND customer_id = $2
+	`
+
+	wf := &Workflow{}
+	err := db.conn.QueryRowContext(ctx, query, workflowID, customerID).Scan(
+		&wf.ID,
+		&wf.CustomerID,
+		&wf.Name,
+		&wf.Description,
+		&wf.Status,
+		&wf.Version,
+		&wf.Nodes,
+		&wf.Edges,
+		&wf.CreatedBy,
+		&wf.CreatedAt,
+		&wf.UpdatedAt,
+		&wf.LastExecutedAt,
+	)
+
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("workflow not found: %s", workflowID)
+		}
+		return nil, fmt.Errorf("failed to fetch workflow: %w", err)
+	}
+
+	return wf, nil
+}
+
+// FetchCanvas retrieves canvas (nodes + edges) for a workflow
+func (db *DB) FetchCanvas(ctx context.Context, workflowID, customerID string) (*Canvas, error) {
+	query := `
+		SELECT nodes, edges
+		FROM workflows
+		WHERE id = $1 AND customer_id = $2
+	`
+
+	var nodesJSON, edgesJSON []byte
+	err := db.conn.QueryRowContext(ctx, query, workflowID, customerID).Scan(&nodesJSON, &edgesJSON)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("workflow not found: %s", workflowID)
+		}
+		return nil, fmt.Errorf("failed to fetch canvas: %w", err)
+	}
+
+	var nodes []WorkflowNode
+	var edges []WorkflowEdge
+
+	if err := json.Unmarshal(nodesJSON, &nodes); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal nodes: %w", err)
+	}
+
+	if err := json.Unmarshal(edgesJSON, &edges); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal edges: %w", err)
+	}
+
+	return &Canvas{Nodes: nodes, Edges: edges}, nil
+}
+
+// ListWorkflows retrieves all workflows for a customer
+func (db *DB) ListWorkflows(ctx context.Context, customerID string, limit, offset int) ([]Workflow, error) {
+	query := `
+		SELECT id, customer_id, name, description, status, version, nodes, edges, created_by, created_at, updated_at, last_executed_at
+		FROM workflows
+		WHERE customer_id = $1
+		ORDER BY created_at DESC
+		LIMIT $2 OFFSET $3
+	`
+
+	rows, err := db.conn.QueryContext(ctx, query, customerID, limit, offset)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list workflows: %w", err)
+	}
+	defer rows.Close()
+
+	var workflows []Workflow
+	for rows.Next() {
+		wf := Workflow{}
+		err := rows.Scan(
+			&wf.ID,
+			&wf.CustomerID,
+			&wf.Name,
+			&wf.Description,
+			&wf.Status,
+			&wf.Version,
+			&wf.Nodes,
+			&wf.Edges,
+			&wf.CreatedBy,
+			&wf.CreatedAt,
+			&wf.UpdatedAt,
+			&wf.LastExecutedAt,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to scan workflow: %w", err)
+		}
+		workflows = append(workflows, wf)
+	}
+
+	return workflows, rows.Err()
+}
+
+// DeleteWorkflow deletes a workflow
+func (db *DB) DeleteWorkflow(ctx context.Context, workflowID, customerID string) error {
+	query := `
+		DELETE FROM workflows
+		WHERE id = $1 AND customer_id = $2
+	`
+
+	result, err := db.conn.ExecContext(ctx, query, workflowID, customerID)
+	if err != nil {
+		return fmt.Errorf("failed to delete workflow: %w", err)
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+
+	if rows == 0 {
+		return fmt.Errorf("workflow not found: %s", workflowID)
+	}
+
+	return nil
+}
+
+// SaveExecution saves a workflow execution record
+func (db *DB) SaveExecution(ctx context.Context, exec *WorkflowExecution) error {
+	query := `
+		INSERT INTO workflow_executions (id, workflow_id, customer_id, temporal_id, status, inputs, outputs, started_at, completed_at, duration_ms, error_message, error_count)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+		ON CONFLICT (id) DO UPDATE SET
+			status = $5,
+			outputs = $7,
+			completed_at = $9,
+			duration_ms = $10,
+			error_message = $11,
+			error_count = $12
+	`
+
+	_, err := db.conn.ExecContext(ctx, query,
+		exec.ID,
+		exec.WorkflowID,
+		exec.CustomerID,
+		exec.TemporalID,
+		exec.Status,
+		exec.Inputs,
+		exec.Outputs,
+		exec.StartedAt,
+		exec.CompletedAt,
+		exec.DurationMs,
+		exec.ErrorMessage,
+		exec.ErrorCount,
+	)
+
+	return err
+}
+
+// FetchExecution retrieves a workflow execution
+func (db *DB) FetchExecution(ctx context.Context, executionID string) (*WorkflowExecution, error) {
+	query := `
+		SELECT id, workflow_id, customer_id, temporal_id, status, inputs, outputs, started_at, completed_at, duration_ms, error_message, error_count
+		FROM workflow_executions
+		WHERE id = $1
+	`
+
+	exec := &WorkflowExecution{}
+	err := db.conn.QueryRowContext(ctx, query, executionID).Scan(
+		&exec.ID,
+		&exec.WorkflowID,
+		&exec.CustomerID,
+		&exec.TemporalID,
+		&exec.Status,
+		&exec.Inputs,
+		&exec.Outputs,
+		&exec.StartedAt,
+		&exec.CompletedAt,
+		&exec.DurationMs,
+		&exec.ErrorMessage,
+		&exec.ErrorCount,
+	)
+
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("execution not found: %s", executionID)
+		}
+		return nil, fmt.Errorf("failed to fetch execution: %w", err)
+	}
+
+	return exec, nil
+}
+
+// SaveExecutionLog saves an activity log entry
+func (db *DB) SaveExecutionLog(ctx context.Context, log *ExecutionLog) error {
+	query := `
+		INSERT INTO execution_logs (execution_id, node_id, activity_name, level, message, metadata, logged_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7)
+	`
+
+	_, err := db.conn.ExecContext(ctx, query,
+		log.ExecutionID,
+		log.NodeID,
+		log.ActivityName,
+		log.Level,
+		log.Message,
+		log.Metadata,
+		log.LoggedAt,
+	)
+
+	return err
+}
+
+// FetchExecutionLogs retrieves all logs for an execution
+func (db *DB) FetchExecutionLogs(ctx context.Context, executionID string) ([]ExecutionLog, error) {
+	query := `
+		SELECT id, execution_id, node_id, activity_name, level, message, metadata, logged_at
+		FROM execution_logs
+		WHERE execution_id = $1
+		ORDER BY logged_at ASC
+	`
+
+	rows, err := db.conn.QueryContext(ctx, query, executionID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch execution logs: %w", err)
+	}
+	defer rows.Close()
+
+	var logs []ExecutionLog
+	for rows.Next() {
+		log := ExecutionLog{}
+		err := rows.Scan(
+			&log.ID,
+			&log.ExecutionID,
+			&log.NodeID,
+			&log.ActivityName,
+			&log.Level,
+			&log.Message,
+			&log.Metadata,
+			&log.LoggedAt,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to scan log: %w", err)
+		}
+		logs = append(logs, log)
+	}
+
+	return logs, rows.Err()
+}
+
+// SaveActivityTrace saves per-activity execution trace
+func (db *DB) SaveActivityTrace(ctx context.Context, trace *ActivityTrace) error {
+	query := `
+		INSERT INTO activity_traces (execution_id, node_id, activity_name, parameters, result, started_at, completed_at, duration_ms, attempt, retry_reason, status, error_message)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+		ON CONFLICT (id) DO UPDATE SET
+			status = $11,
+			result = $5,
+			completed_at = $7,
+			duration_ms = $8,
+			error_message = $12
+	`
+
+	_, err := db.conn.ExecContext(ctx, query,
+		trace.ExecutionID,
+		trace.NodeID,
+		trace.ActivityName,
+		trace.Parameters,
+		trace.Result,
+		trace.StartedAt,
+		trace.CompletedAt,
+		trace.DurationMs,
+		trace.Attempt,
+		trace.RetryReason,
+		trace.Status,
+		trace.ErrorMessage,
+	)
+
+	return err
+}
+
+// FetchActivityTraces retrieves all activity traces for an execution
+func (db *DB) FetchActivityTraces(ctx context.Context, executionID string) ([]ActivityTrace, error) {
+	query := `
+		SELECT id, execution_id, node_id, activity_name, parameters, result, started_at, completed_at, duration_ms, attempt, retry_reason, status, error_message
+		FROM activity_traces
+		WHERE execution_id = $1
+		ORDER BY started_at ASC
+	`
+
+	rows, err := db.conn.QueryContext(ctx, query, executionID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch activity traces: %w", err)
+	}
+	defer rows.Close()
+
+	var traces []ActivityTrace
+	for rows.Next() {
+		trace := ActivityTrace{}
+		err := rows.Scan(
+			&trace.ID,
+			&trace.ExecutionID,
+			&trace.NodeID,
+			&trace.ActivityName,
+			&trace.Parameters,
+			&trace.Result,
+			&trace.StartedAt,
+			&trace.CompletedAt,
+			&trace.DurationMs,
+			&trace.Attempt,
+			&trace.RetryReason,
+			&trace.Status,
+			&trace.ErrorMessage,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to scan trace: %w", err)
+		}
+		traces = append(traces, trace)
+	}
+
+	return traces, rows.Err()
+}
+
+// GetWorkflowRelations retrieves all relations for a workflow version
+func (db *DB) GetWorkflowRelations(ctx context.Context, workflowID string, version int) ([]WorkflowRelation, error) {
+	var relations []WorkflowRelation
+
+	query := `
+		SELECT id, workflow_id, version, source_node_id, target_node_id, 
+		       relation_type, label, relation_wording, metadata, created_at
+		FROM workflow_relations
+		WHERE workflow_id = $1 AND version = $2
+		ORDER BY created_at DESC
+	`
+
+	rows, err := db.conn.QueryContext(ctx, query, workflowID, version)
+	if err != nil {
+		return nil, fmt.Errorf("failed to query relations: %w", err)
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var rel WorkflowRelation
+		if err := rows.Scan(
+			&rel.ID,
+			&rel.WorkflowID,
+			&rel.Version,
+			&rel.SourceNodeID,
+			&rel.TargetNodeID,
+			&rel.RelationType,
+			&rel.Label,
+			&rel.RelationWording,
+			&rel.Metadata,
+			&rel.CreatedAt,
+		); err != nil {
+			return nil, fmt.Errorf("failed to scan relation: %w", err)
+		}
+		relations = append(relations, rel)
+	}
+
+	return relations, rows.Err()
+}
+
+// GetRelationVersions retrieves version history for a specific relation
+func (db *DB) GetRelationVersions(ctx context.Context, workflowID string, edgeID string) ([]WorkflowRelationVersion, error) {
+	var versions []WorkflowRelationVersion
+
+	query := `
+		SELECT id, workflow_id, edge_id, version_num, operation, snapshot, 
+		       changed_at, changed_by, fields_changed
+		FROM workflow_relation_versions
+		WHERE workflow_id = $1 AND edge_id = $2
+		ORDER BY version_num ASC
+	`
+
+	rows, err := db.conn.QueryContext(ctx, query, workflowID, edgeID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to query relation versions: %w", err)
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var v WorkflowRelationVersion
+		if err := rows.Scan(
+			&v.ID,
+			&v.WorkflowID,
+			&v.EdgeID,
+			&v.VersionNum,
+			&v.Operation,
+			&v.Snapshot,
+			&v.ChangedAt,
+			&v.ChangedBy,
+			&v.FieldsChanged,
+		); err != nil {
+			return nil, fmt.Errorf("failed to scan version: %w", err)
+		}
+		versions = append(versions, v)
+	}
+
+	return versions, rows.Err()
+}

pkg/db/models.go

@@ -0,0 +1,141 @@
+package db
+
+import (
+	"time"
+)
+
+// WorkflowNode represents a React Flow node in the canvas
+type WorkflowNode struct {
+	ID       string                 `json:"id"`
+	Label    string                 `json:"label"`
+	Type     string                 `json:"type"` // "activity"
+	Position map[string]interface{} `json:"position"`
+	Data     map[string]interface{} `json:"data"`
+}
+
+// WorkflowEdge represents a React Flow edge in the canvas
+type WorkflowEdge struct {
+	ID     string                 `json:"id"`
+	Source string                 `json:"source"`
+	Target string                 `json:"target"`
+	Data   map[string]interface{} `json:"data"`
+}
+
+// Canvas represents the full React Flow canvas (nodes + edges)
+type Canvas struct {
+	Name  string         `json:"name,omitempty"`
+	Nodes []WorkflowNode `json:"nodes"`
+	Edges []WorkflowEdge `json:"edges"`
+}
+
+// Workflow represents a workflow definition in the database
+type Workflow struct {
+	ID            string    `db:"id"`
+	CustomerID    string    `db:"customer_id"`
+	Name          string    `db:"name"`
+	Description   string    `db:"description"`
+	Status        string    `db:"status"`        // "draft", "active", "archived"
+	Version       int       `db:"version"`
+	Nodes         []byte    `db:"nodes"`         // JSONB stored as []byte
+	Edges         []byte    `db:"edges"`         // JSONB stored as []byte
+	CreatedBy     string    `db:"created_by"`
+	CreatedAt     time.Time `db:"created_at"`
+	UpdatedAt     time.Time `db:"updated_at"`
+	LastExecutedAt *time.Time `db:"last_executed_at"`
+}
+
+// WorkflowExecution represents a workflow execution run
+type WorkflowExecution struct {
+	ID           string    `db:"id"`
+	WorkflowID   string    `db:"workflow_id"`
+	CustomerID   string    `db:"customer_id"`
+	TemporalID   string    `db:"temporal_id"` // Temporal execution ID
+	Status       string    `db:"status"`      // "pending", "running", "success", "failed", "cancelled"
+	Inputs       []byte    `db:"inputs"`      // JSONB
+	Outputs      []byte    `db:"outputs"`     // JSONB
+	StartedAt    time.Time `db:"started_at"`
+	CompletedAt  *time.Time `db:"completed_at"`
+	DurationMs   *int      `db:"duration_ms"`
+	ErrorMessage string    `db:"error_message"`
+	ErrorCount   int       `db:"error_count"`
+}
+
+// ExecutionLog represents a detailed activity log entry
+type ExecutionLog struct {
+	ID           int64     `db:"id"`
+	ExecutionID  string    `db:"execution_id"`
+	NodeID       string    `db:"node_id"`      // From canvas node ID
+	ActivityName string    `db:"activity_name"` // "CloneRepo", "AnalyzeCode", etc
+	Level        string    `db:"level"`        // "info", "warn", "error", "debug"
+	Message      string    `db:"message"`
+	Metadata     []byte    `db:"metadata"`    // JSONB
+	LoggedAt     time.Time `db:"logged_at"`
+}
+
+// ActivityTrace represents per-activity execution metrics
+type ActivityTrace struct {
+	ID           int64      `db:"id"`
+	ExecutionID  string     `db:"execution_id"`
+	NodeID       string     `db:"node_id"`
+	ActivityName string     `db:"activity_name"`
+	Parameters   []byte     `db:"parameters"` // JSONB
+	Result       []byte     `db:"result"`     // JSONB
+	StartedAt    time.Time  `db:"started_at"`
+	CompletedAt  *time.Time `db:"completed_at"`
+	DurationMs   *int       `db:"duration_ms"`
+	Attempt      int        `db:"attempt"`
+	RetryReason  string     `db:"retry_reason"`
+	Status       string     `db:"status"` // "running", "success", "failed", "skipped"
+	ErrorMessage string     `db:"error_message"`
+}
+
+// WorkflowStats represents aggregated workflow metrics
+type WorkflowStats struct {
+	WorkflowID        string    `db:"workflow_id"`
+	CustomerID        string    `db:"customer_id"`
+	TotalRuns         int       `db:"total_runs"`
+	SuccessfulRuns    int       `db:"successful_runs"`
+	FailedRuns        int       `db:"failed_runs"`
+	AvgDurationMs     float64   `db:"avg_duration_ms"`
+	MinDurationMs     *int      `db:"min_duration_ms"`
+	MaxDurationMs     *int      `db:"max_duration_ms"`
+	Last30dRuns       int       `db:"last_30d_runs"`
+	Last30dSuccessRate float64  `db:"last_30d_success_rate"`
+	UpdatedAt         time.Time `db:"updated_at"`
+}
+
+// WorkflowMemoryLink represents a connection between execution and memory nodes
+type WorkflowMemoryLink struct {
+	ExecutionID   string    `db:"execution_id"`
+	MemoryNodeSha string    `db:"memory_node_sha"`
+	Relationship  string    `db:"relationship"` // "generated", "used", "learned", "failed_on"
+	CreatedAt     time.Time `db:"created_at"`
+	Notes         string    `db:"notes"`
+}
+
+// WorkflowRelation represents a semantic relation between two canvas nodes
+type WorkflowRelation struct {
+	ID               string    `db:"id"`
+	WorkflowID       string    `db:"workflow_id"`
+	Version          int       `db:"version"`
+	SourceNodeID     string    `db:"source_node_id"`
+	TargetNodeID     string    `db:"target_node_id"`
+	RelationType     string    `db:"relation_type"` // "data-flow", "dependency", "conditional"
+	Label            string    `db:"label"`         // Human-readable relation description
+	RelationWording  []byte    `db:"relation_wording"`  // JSONB with verb, outputs, inputs, confidence
+	Metadata         []byte    `db:"metadata"`      // JSONB for extensibility
+	CreatedAt        time.Time `db:"created_at"`
+}
+
+// WorkflowRelationVersion represents versioned history of relation changes
+type WorkflowRelationVersion struct {
+	ID            string    `db:"id"`
+	WorkflowID    string    `db:"workflow_id"`
+	EdgeID        string    `db:"edge_id"`
+	VersionNum    int       `db:"version_num"`
+	Operation     string    `db:"operation"` // "CREATE", "UPDATE", "DELETE"
+	Snapshot      []byte    `db:"snapshot"` // JSONB full state at this version
+	ChangedAt     time.Time `db:"changed_at"`
+	ChangedBy     string    `db:"changed_by"`
+	FieldsChanged []byte    `db:"fields_changed"` // JSONB array of changed field names
+}

pkg/types/synthesis.go

@@ -0,0 +1,59 @@
+package types
+
+import "time"
+
+// SynthesisInput contains the input for the synthesis workflow.
+type SynthesisInput struct {
+	Project string   `json:"project"`
+	Source  string   `json:"source"`
+	Text    string   `json:"text"`
+	Kind    string   `json:"kind"` // L1, L2, reference
+	Tags    []string `json:"tags,omitempty"`
+}
+
+// SynthesisResult contains the output of the synthesis workflow.
+type SynthesisResult struct {
+	ChunkID            string               `json:"chunk_id"`
+	EntitiesExtracted  int                  `json:"entities_extracted"`
+	FactsExtracted     int                  `json:"facts_extracted"`
+	Contradictions     int                  `json:"contradictions"`
+	ReviewQueued       int                  `json:"review_queued"`
+	Entities           []ExtractedEntity    `json:"entities"`
+	Facts              []ExtractedFact      `json:"facts"`
+	Duration           time.Duration        `json:"duration"`
+}
+
+// ExtractedEntity represents an entity found during synthesis.
+type ExtractedEntity struct {
+	Name       string  `json:"name"`
+	EntityType string  `json:"entity_type"`
+	Confidence float64 `json:"confidence"`
+}
+
+// ExtractedFact represents a fact extracted during synthesis.
+type ExtractedFact struct {
+	Subject    string  `json:"subject"`
+	Predicate  string  `json:"predicate"`
+	Object     string  `json:"object"`
+	Confidence float64 `json:"confidence"`
+}
+
+// ContradictionResult represents a contradiction detection result.
+type ContradictionResult struct {
+	FactA        ExtractedFact `json:"fact_a"`
+	FactB        ExtractedFact `json:"fact_b"`
+	Severity     string        `json:"severity"` // low, medium, high
+	AutoResolved bool          `json:"auto_resolved"`
+	QueuedReview bool          `json:"queued_review"`
+}
+
+// PersistInput groups all synthesis results for persistence.
+type PersistInput struct {
+	ChunkID        string                `json:"chunk_id"`
+	Project        string                `json:"project"`
+	Source         string                `json:"source"`
+	Kind           string                `json:"kind"`
+	Entities       []ExtractedEntity     `json:"entities"`
+	Facts          []ExtractedFact       `json:"facts"`
+	Contradictions []ContradictionResult `json:"contradictions"`
+}

pkg/types/types.go

@@ -0,0 +1,223 @@
+// Package types defines the shared domain model for Poimen workflows.
+// Both workflow/ (orchestration) and activity/ (execution) import from here.
+package types
+
+import (
+	"time"
+
+	"github.com/rockliang/poimen/workflows/pkg/db"
+)
+
+// ===== LLM Configuration =====
+
+type ModelSpec struct {
+	ModelID  string
+	Thinking string // "adaptive" or ""
+	Effort   string // "low", "medium", "high", "xhigh", "max"
+}
+
+type PromptSpec struct {
+	TemplateRef string
+	RawTemplate string
+	Variables   map[string]any
+	Model       ModelSpec
+	LessonsRef  string
+}
+
+type SkillRef struct {
+	Name string
+	URL  string
+}
+
+// ===== Retry & Tuning =====
+
+type PiRetryPolicy struct {
+	ScheduleToCloseTimeout time.Duration
+	InitialInterval        time.Duration
+	MaximumInterval        time.Duration
+	BackoffCoefficient     float64
+	StreamTimeout          time.Duration
+	StreamTimeoutMax       time.Duration
+}
+
+type ActivityTuning struct {
+	ImplementerBaseTimeout  time.Duration
+	ImplementerMaxRetries   int
+	JudgeTimeout            time.Duration
+	PiRetry                 PiRetryPolicy
+	InitialRetryInterval    time.Duration
+	MaxRetryInterval        time.Duration
+	RetryBackoffCoefficient float64
+}
+
+// ===== Orchestrator =====
+
+type OrchestratorConfig struct {
+	SystemPrompt string
+	Skills       []SkillRef
+	RolePrompts  map[string]PromptSpec
+	Tuning       ActivityTuning
+}
+
+type OrchestratorInput struct {
+	TargetRepoPath     string
+	RemoteURL          string
+	Milestone          string
+	Config             OrchestratorConfig
+	DryRun             bool
+	CycleCount         int
+	MaxCyclesBeforeCAN int
+	PiProvider         string
+}
+
+type OrchestratorOutput struct {
+	MilestoneComplete bool
+	Done              bool
+	LastError         string
+}
+
+// ===== TaskUnit =====
+
+type TaskUnitInput struct {
+	TaskID         string
+	RemoteURL      string
+	TargetRepoPath string
+	Milestone      string
+	Config         OrchestratorConfig
+	DryRun         bool
+}
+
+type TaskUnitOutput struct {
+	TaskID   string
+	Status   string
+	Verdict  string
+	Critique string
+	Branch   string
+	Reason   string
+	Changes  string
+}
+
+// ===== Canvas & Relations =====
+
+type RelationWording struct {
+	Verb              string  `json:"verb"`
+	SourceOutput      string  `json:"source_output"`
+	TargetInput       string  `json:"target_input"`
+	ConnectionType    string  `json:"connection_type"`
+	Confidence        float64 `json:"confidence"`
+	SemanticMatch     string  `json:"semantic_match"`
+	TransformerNeeded string  `json:"transformer_needed,omitempty"`
+}
+
+type EdgeWithWording struct {
+	ID              string          `json:"id,omitempty"`
+	Source          string          `json:"source"`
+	Target          string          `json:"target"`
+	RelationType    string          `json:"relation_type"`
+	RelationLabel   string          `json:"relation_label"`
+	RelationWording RelationWording `json:"relation_wording"`
+	CreatedAt       string          `json:"created_at,omitempty"`
+}
+
+type CanvasWithRelationsData struct {
+	WorkflowID string            `json:"workflow_id"`
+	Version    int               `json:"version"`
+	Nodes      []db.WorkflowNode `json:"nodes"`
+	Edges      []db.WorkflowEdge `json:"edges"`
+	Relations  []EdgeWithWording `json:"relations"`
+	UpdatedAt  string            `json:"updated_at"`
+}
+
+// ===== Activity I/O =====
+
+type FetchCanvasRelationsInput struct {
+	WorkflowID string `json:"workflow_id"`
+	Version    int    `json:"version"`
+}
+
+type CanvasReasonerInput struct {
+	Nodes            []db.WorkflowNode `json:"nodes"`
+	Edges            []db.WorkflowEdge `json:"edges"`
+	PreserveExisting bool              `json:"preserve_existing,omitempty"`
+	AuthToken        string            `json:"auth_token,omitempty"`
+}
+
+type QueryPathData struct {
+	SourceID   string   `json:"source_id"`
+	TargetID   string   `json:"target_id"`
+	Distance   int      `json:"distance"`
+	PathCount  int      `json:"path_count"`
+	NodeIDs    []string `json:"node_ids"`
+	Confidence float64  `json:"total_confidence"`
+}
+
+type GraphRAGQueryInput struct {
+	WorkflowID      string                 `json:"workflow_id"`
+	Query           string                 `json:"query"`
+	SearchType      string                 `json:"search_type"`
+	RelationType    string                 `json:"relation_type"`
+	ConfidenceFloor float64                `json:"confidence_floor"`
+	TopK            int                    `json:"top_k"`
+	RankingProfile  string                 `json:"ranking_profile"`
+	Canvas          CanvasWithRelationsData `json:"canvas"`
+}
+
+type GraphRAGQueryOutput struct {
+	WorkflowID  string            `json:"workflow_id"`
+	Query       string            `json:"query"`
+	Edges       []EdgeWithWording `json:"edges"`
+	Paths       []QueryPathData   `json:"paths"`
+	TotalCount  int               `json:"total_count"`
+	HasMore     bool              `json:"has_more"`
+	ExecutionMs int64             `json:"execution_time_ms"`
+}
+
+type CanvasCompatibilityInput struct {
+	Nodes []db.WorkflowNode `json:"nodes"`
+	Edges []db.WorkflowEdge `json:"edges"`
+	Query string            `json:"query,omitempty"`
+}
+
+type IndexGraphRAGInput struct {
+	WorkflowID string            `json:"workflow_id"`
+	Version    int               `json:"version"`
+	Nodes      []db.WorkflowNode `json:"nodes"`
+	Relations  []EdgeWithWording `json:"relations"`
+}
+
+type IndexGraphRAGOutput struct {
+	WorkflowID       string `json:"workflow_id"`
+	Version          int    `json:"version"`
+	IndexedEntities  int    `json:"indexed_entities"`
+	IndexedEdges     int    `json:"indexed_edges"`
+	Status           string `json:"status"`
+	GraphRAGChecksum string `json:"graph_rag_checksum"`
+	IndexedAt        string `json:"indexed_at"`
+}
+
+type PromptUpdate struct {
+	Role string
+	Spec PromptSpec
+}
+
+// ===== Defaults =====
+
+func NewPiRetryPolicy() PiRetryPolicy {
+	return PiRetryPolicy{
+		ScheduleToCloseTimeout: 5 * time.Minute,
+		InitialInterval:        2 * time.Second,
+		MaximumInterval:        30 * time.Second,
+		BackoffCoefficient:     2.0,
+		StreamTimeout:          30 * time.Second,
+		StreamTimeoutMax:       2 * time.Minute,
+	}
+}
+
+func NewActivityTuning() ActivityTuning {
+	return ActivityTuning{
+		ImplementerBaseTimeout: 10 * time.Minute,
+		ImplementerMaxRetries:  3,
+		JudgeTimeout:           5 * time.Minute,
+		PiRetry:                NewPiRetryPolicy(),
+	}
+}

statemachine/types.go

@@ -1,136 +0,0 @@
-package statemachine
-
-import "time"
-
-// ModelSpec defines LLM model configuration.
-type ModelSpec struct {
-	ModelID  string // e.g. "claude-opus-5", "claude-sonnet-5"
-	Thinking string // "adaptive" or ""
-	Effort   string // "low", "medium", "high", "xhigh", "max"
-}
-
-// PromptSpec defines a prompt template with variables and model.
-type PromptSpec struct {
-	TemplateRef string            // e.g. "planner/default.tmpl"
-	RawTemplate string            // overrides TemplateRef if non-empty
-	Variables   map[string]any    // template variables
-	Model       ModelSpec         // which LLM to use
-	LessonsRef  string            // key into lessons store
-}
-
-// PiRetryPolicy defines retry and timeout settings for Pi command execution.
-type PiRetryPolicy struct {
-	ScheduleToCloseTimeout time.Duration // default: 5m
-	InitialInterval        time.Duration // default: 2s
-	MaximumInterval        time.Duration // default: 30s
-	BackoffCoefficient     float64       // default: 2.0
-	StreamTimeout          time.Duration // default: 30s
-	StreamTimeoutMax       time.Duration // default: 2m
-}
-
-// ActivityTuning defines timeouts and retry counts for activities.
-type ActivityTuning struct {
-	ImplementerBaseTimeout time.Duration // default: 10m
-	ImplementerMaxRetries  int           // default: 3
-	JudgeTimeout           time.Duration // default: 5m
-	PiRetry                PiRetryPolicy
-	// Retry policy settings
-	InitialRetryInterval   time.Duration // default: 2s
-	MaxRetryInterval       time.Duration // default: 5m
-	RetryBackoffCoefficient float64      // default: 2.0
-}
-
-// OrchestratorConfig holds all runtime configuration for the orchestrator.
-type OrchestratorConfig struct {
-	SystemPrompt string                    // shared prompt prefix
-	Skills       []SkillRef                // required skill sources
-	RolePrompts  map[string]PromptSpec     // per-role: "planner", "judge", "implementer"
-	Tuning       ActivityTuning
-}
-
-// OrchestratorInput is the input to the Orchestrator workflow.
-type OrchestratorInput struct {
-	TargetRepoPath      string
-	RemoteURL           string
-	Milestone           string // e.g. "T0"
-	Config              OrchestratorConfig
-	DryRun              bool
-	CycleCount          int
-	MaxCyclesBeforeCAN  int // default: 100
-	PiProvider          string // pi provider name (e.g., "local-llm"); required for skill preparation
-}
-
-// OrchestratorOutput is the output of the Orchestrator workflow.
-type OrchestratorOutput struct {
-	MilestoneComplete bool
-	Done              bool
-	LastError         string
-}
-
-// TaskUnitInput is the input to the TaskUnit workflow.
-type TaskUnitInput struct {
-	TaskID         string
-	RemoteURL      string
-	TargetRepoPath string
-	Milestone      string
-	Config         OrchestratorConfig
-	DryRun         bool
-}
-
-// TaskUnitOutput is the output of the TaskUnit workflow.
-type TaskUnitOutput struct {
-	TaskID   string
-	Status   string // "success" or "failed"
-	Verdict  string // "pass" or "fail" from judge
-	Critique string // feedback from judge
-	Branch   string
-	Reason   string // error reason if failed
-	Changes  string // summary of changes
-}
-
-// SkillRef references a skill source.
-type SkillRef struct {
-	Name string // skill identifier
-	URL  string // source to clone
-}
-
-// Default values for types.
-const (
-	defaultScheduleToCloseTimeout = 5 * time.Minute
-	defaultInitialInterval         = 2 * time.Second
-	defaultMaximumInterval         = 30 * time.Second
-	defaultBackoffCoefficient      = 2.0
-	defaultStreamTimeout           = 30 * time.Second
-	defaultStreamTimeoutMax        = 2 * time.Minute
-	defaultImplementerBaseTimeout  = 10 * time.Minute
-	defaultImplementerMaxRetries   = 3
-	defaultJudgeTimeout            = 5 * time.Minute
-)
-
-// NewPiRetryPolicy returns a PiRetryPolicy with defaults.
-func NewPiRetryPolicy() PiRetryPolicy {
-	return PiRetryPolicy{
-		ScheduleToCloseTimeout: defaultScheduleToCloseTimeout,
-		InitialInterval:        defaultInitialInterval,
-		MaximumInterval:        defaultMaximumInterval,
-		BackoffCoefficient:     defaultBackoffCoefficient,
-		StreamTimeout:          defaultStreamTimeout,
-		StreamTimeoutMax:       defaultStreamTimeoutMax,
-	}
-}
-
-// NewActivityTuning returns an ActivityTuning with defaults.
-func NewActivityTuning() ActivityTuning {
-	return ActivityTuning{
-		ImplementerBaseTimeout: defaultImplementerBaseTimeout,
-		ImplementerMaxRetries:  defaultImplementerMaxRetries,
-		JudgeTimeout:           defaultJudgeTimeout,
-		PiRetry:                NewPiRetryPolicy(),
-	}
-}
-
-// PromptUpdate represents an update to a role prompt.
-type PromptUpdate struct {
-	Role string
-	Spec PromptSpec
-}

tasks/HANDOFF_PROMPT.md

@@ -1,137 +0,0 @@
-# Handoff Prompt: Implement T0 Milestone
-
-Use this prompt with Claude Haiku 4.5 to begin implementation of T0 tasks.
-
----
-
-## Context
-
-You're implementing a Temporal-based multi-agent software orchestrator in Go. The system drives development work on arbitrary target repos using three LLM-backed roles:
-- **Planner** (reasoning model): reconciles state, dispatches tasks
-- **Judge** (reasoning model): reviews correctness, runs integration tests
-- **Implementer** (cheaper model): does actual work, learns from failures
-
-All code lives in `/Users/rockliang/workplace/Poimen/workflows/`.
-
-## What's Done
-
-- ✅ Full design doc: `/Users/rockliang/.claude/plans/considered-u-are-a-curried-reef.md`
-- ✅ Project scaffold: `PLAN.md`, `tasks/INDEX.md`, `tasks/board.md`
-- ✅ Roadmap: T0 (core, 9 tasks) → T1 (hardening) → T2 (scale) → T3 (features)
-- ✅ Task breakdown: `tasks/T0.1.md` through `tasks/T0.9.md` (each with verification criteria)
-
-## Your Job: Implement T0.1 → T0.9
-
-Start with T0.1 (repo scaffold). Each task:
-1. Read its markdown file in `tasks/T0.x.md`
-2. Implement the code sketches provided
-3. Write unit tests per verification section
-4. Run the verification command
-5. When it passes, mark `[ ]` → `[x]` in `tasks/board.md`
-6. Move to next task
-
-## Key Constraints
-
-1. **No hardcoded values:** All timeouts, retry counts, model IDs come from `OrchestratorConfig.Tuning` or `PromptSpec.Model` (read at runtime).
-2. **Activities are independent:** One concern per `action/*.go` file (git, skills, planner, judge, implementer, etc). Testable in isolation.
-3. **Testing is verification:** Unit tests via `go.temporal.io/sdk/testsuite` (mocked activities). E2E test (T0.9) against real `temporal.riotpiao.com`.
-4. **Go style:** Per `golang-skills` conventions — no naked `_ =`, proper error handling, idiomatic names.
-5. **Concurrency safety:** Shared FS with git worktrees + advisory lock. Test concurrent access.
-
-## Implementation Path
-
-```
-1. T0.1: Scaffold directories, go.mod, empty stubs
-   → verify: go build ./... succeeds
-
-2. T0.2: Shared types (ModelSpec, PromptSpec, OrchestratorConfig, etc.)
-   → verify: Unit test asserts all defaults
-
-3. T0.3: Git & locking (CloneRepoActivity, worktrees, squash-merge)
-   → verify: Test against local scratch repo
-
-4. T0.4: Pi & error classification (PrepareSkillsActivity, classifyPiErr)
-   → verify: Unit tests for 4xx/5xx/504 buckets
-
-5. T0.5: LLM agents & prompts (Planner/Judge/Implementer, llm/client.go)
-   → verify: Unit test renders PromptSpec with system prompt
-
-6. T0.6: TaskUnit workflow (retry loops, timeout escalation, lessons)
-   → verify: Testsuite: pass-first-try, fail-then-pass, timeout-escalation
-
-7. T0.7: Orchestrator workflow (config, signals, fan-out/fan-in, continue-as-new, 504 learning)
-   → verify: Testsuite: fan-out/fan-in, squash-merge, signal mutations
-
-8. T0.8: Worker & starter CLIs (cmd/worker, cmd/starter, internal/config)
-   → verify: go build succeeds, go run ./cmd/worker connects to temporal.riotpiao.com
-
-9. T0.9: End-to-end (real cluster + disposable forgejo repo, all 7 checks)
-   → verify: Full cycle with live signals, 5xx retry/exhaust, 504 learning, continue-as-new bounded
-```
-
-## Tools Available
-
-- `pi` command: Clone/fetch skills from homelab API
-  - Usage: `pi clone-or-fetch <skill-url>`
-  - Errors: 4xx (non-retryable), 5xx (retryable), 504 (stream timeout — learn and double timeout)
-
-- Temporal Web UI: `http://temporal.riotpiao.com:8080` (monitor workflows)
-- Forgejo instance: For disposable scratch repos during testing
-
-## Testing Locally
-
-Each task has a "Verification" section with a test command. Run it after implementing:
-
-```bash
-cd /Users/rockliang/workplace/Poimen/workflows
-go test -v ./tests -run Test<TaskName>
-```
-
-For T0.9 (e2e), you'll need:
-- Real Temporal cluster connection
-- Anthropic API key (`ANTHROPIC_API_KEY` env)
-- Forgejo repo access or local git repo
-
-## Commit Message Style
-
-```
-T0.x: Brief description
-
-Detailed explanation of what was implemented.
-
-Verification: <how you verified it works>
-```
-
-Example:
-```
-T0.2: Implement shared types with defaults
-
-Added ModelSpec, PromptSpec, OrchestratorConfig, ActivityTuning, PiRetryPolicy.
-All defaults documented: 5m ScheduleToCloseTimeout, 2s InitialInterval, 2.0 BackoffCoefficient, etc.
-
-Verification: go test ./tests -run TestTypesDefaults passes
-```
-
-## When Stuck
-
-1. Re-read the task markdown in `tasks/T0.x.md` — implementation sketches are concrete
-2. Check `PLAN.md` §Design sections for detailed logic (§Timeout Extension, §Pi Command Retry Policy, etc.)
-3. Look at the test case in the task markdown — it shows expected behavior
-4. If a task depends on prior work, make sure the prior task is complete first
-
-## After T0 Completes
-
-When all T0.1–T0.9 pass:
-```bash
-cd /Users/rockliang/workplace/Poimen/workflows
-git checkout main
-git merge --squash task/T0.1 task/T0.2 ... task/T0.9
-git commit -m "T0: Multi-agent orchestrator initial implementation"
-git push origin main
-```
-
-Then start T1 (or hand off to another assistant).
-
----
-
-**Ready?** Start with `tasks/T0.1.md` and work through in order.

tasks/INDEX.md

@@ -1,125 +0,0 @@
-# Poimen Workflows — Development Guidelines
-
-This project orchestrates multi-agent software development tasks using Temporal + Go. The repo is organized as:
-- `statemachine/` — Temporal workflow definitions (deterministic state machines)
-- `action/` — Temporal activity definitions (units of work / LLM calls)
-- `cmd/` — CLI entry points (worker registration, workflow starter)
-- `prompts/` — LLM prompt templates (Go-embedded, live-updatable)
-- `internal/` — Shared config/locking utilities
-- `tests/` — Unit tests via `go.temporal.io/sdk/testsuite`
-
-## Code Standards
-
-### Go Style
-
-Follow `golang-skills` conventions from `~/.claude/skills/golang-skills/`:
-- Error handling mandatory; no naked `_ =` discards.
-- Idiomatic naming: `ctx` for context, `err` for error returns.
-- Interfaces kept narrow; one struct per concern.
-- No over-generalization for hypothetical use.
-- Documentation via comments only where the WHY is non-obvious.
-
-### Testing
-
-- Every `statemachine/*` change ships with a `testsuite`-based test in `tests/`.
-- Unit tests use `go.temporal.io/sdk/testsuite.WorkflowTestEnvironment` with mocked activities.
-- Activities are tested in isolation before integrating into workflows.
-- No literal timeout/retry values in `action/*` code — all come from `OrchestratorConfig.Tuning` at runtime.
-
-### Activity Design
-
-Activities stay side-effect-isolated (one concern per file) so they remain independently reusable across projects.
-- `action/git.go` — all git operations
-- `action/skills.go` — skill prep / pi command
-- `action/planner.go` — Planner LLM call
-- `action/judge.go` — Judge LLM call
-- `action/implementer.go` — Implementer LLM + tool-call loop
-- `action/lessons.go` — Lessons store read/write
-
-No composite activities like `PrepareAndImplement`; that's a workflow's job, not an activity's.
-
-### Config as Data
-
-**No hardcoded numbers.** Every timeout, retry count, backoff coefficient, stream timeout — all come from `OrchestratorConfig.Tuning` (or role-specific `PromptSpec.Model`), read at execution time. This lets:
-- `update-tuning` signal to dynamically adjust timeouts without redeployment
-- Planner activity to recommend per-task overrides
-- Pi 504 handler to learn and persist `StreamTimeout` across `ContinueAsNew` cycles
-
-**No LLM model hardcoded.** Every model ID comes from `ModelSpec.ModelID`, passed as data.
-
-### Concurrency & Locking
-
-Target repo sits on shared filesystem. Git concurrency is safe by construction:
-- Task units use isolated worktrees (`git worktree add -b task/T0.x ...`)
-- Commits within a worktree don't need a lock; git serializes object writes
-- Only `CloneRepoActivity`, `GitPushActivity`, `GitSquashMergeActivity` need the `orchestrator.lock`, since they mutate the main working tree / refs
-
-Monitor for deadlocks: if two workflows try to push simultaneously, the lock will serialize them. Test with concurrent tasks enabled.
-
-## Task Board Format
-
-Each task row in the board specifies:
-- **ID**: `T0.1`, `T0.2`, etc.
-- **Description**: One-line scope
-- **Status**: `[ ]` (todo), `[x]` (done)
-- **Branch**: `task/T0.x` (created when task starts, merged to main on submilestone complete)
-- **Verification**: Specific criterion that marks it done (e.g. "Unit test passes", "E2E run completes")
-
-A task is NOT marked done until its verification step passes. This mirrors the Judge role's own job: no hallucinated completion.
-
-## Submilestones & Merges
-
-When all tasks in `T0` (`T0.1` through `T0.9`) pass their verification:
-1. Orchestrator calls `GitSquashMergeActivity` to merge all `task/T0.*` branches into `main` as a single squashed commit
-2. All `task/T0.*` branches and worktrees are cleaned up
-3. Main branch is the canonical history; the 9 subtask commits are compacted into one
-
-This demonstrates the very mechanism the system orchestrates: a working software dev pipeline with multiple agents collaborating on a shared codebase, guarded by state checks (Judge), and landing changes via deterministic git workflow.
-
-## Historical Lessons
-
-Lessons live at `tasks/.orchestrator/lessons/<TaskID>.jsonl` — per-task file of failed attempts. When a Judge calls a task failure, the `UpdateLessonsActivity` appends `{Attempt, Critique, FailedApproachSummary, Timestamp}`. On retry, `ReadLessonsActivity` injects the last N entries into the Implementer's prompt as "known errors — do not repeat this time".
-
-Lessons flush to git only as part of the Planner's board commit, not on every retry — keeps history clean.
-
-## Skills & Preparation
-
-Required skill sources are listed in `OrchestratorConfig.Skills` as a list of references (e.g. `["~/.claude/skills/golang-skills", "custom-skill-repo"]`). `PrepareSkillsActivity` runs once per config change, cloning/fetching them onto the shared FS via the `pi` command. All retry/backoff/timeout is delegated to Temporal's retry machinery, with special handling for 504 (stream timeout learning).
-
-## Environment & Secrets
-
-All external system access is via environment variables, loaded at worker startup:
-- `TEMPORAL_NAMESPACE`, `TEMPORAL_TLS_CERT`, `TEMPORAL_TLS_KEY` — Temporal cluster connection
-- `ANTHROPIC_API_KEY` — LLM API key
-- Any target-repo-specific credentials (e.g. git SSH key) are assumed already available on the shared FS (e.g. via Kubernetes secret mount)
-
-Use homelab's `vsource .env` pattern to load from a `.env` file during local development.
-
-## Observability
-
-- Temporal Web UI (`temporal.riotpiao.com:8080` or similar) shows workflow execution, signal delivery, activity retries
-- Workflow `current-config` query returns live `OrchestratorConfig` (useful for debugging which tuning values are in effect)
-- Activity heartbeats (`activity.RecordHeartbeat`) are sent after each tool-call iteration, visible in Temporal's activity details
-- Lessons file grows as retries happen; inspect it on failure to understand what the Implementer is learning
-
-## Deployment & Homelab Integration
-
-This repo is application-layer code against the homelab's Temporal cluster. The orchestrator runs as a Kubernetes pod with:
-- Persistent volume (PVC) for the shared FS where target repos are cloned
-- Network access to Temporal + Anthropic APIs
-- Git SSH key mounted for cloning target repos
-
-The Kubernetes manifests + Helm charts live in the homelab repo under `k8s/` and follow homelab's GitOps workflow (commit → ArgoCD sync). This repo's CI/CD (GitHub Actions or Forgejo Actions) builds and pushes the Docker image; the homelab repo triggers a new pod deploy on image push.
-
-## Questions & Debugging
-
-If a task is marked done but you suspect it's wrong:
-1. Re-run its verification step manually
-2. Check the unit test against the latest code
-3. For e2e tasks, review Temporal Web UI logs + board file + lessons file on the target repo
-4. Update the board and task description if the criterion was misunderstood
-
-If code doesn't compile or tests fail:
-1. Check Go version and Temporal SDK version match
-2. Run `go mod tidy` and `go mod vendor` if dependencies drift
-3. Look for hardcoded values or model IDs that should be config instead

tasks/ROADMAP.md

@@ -1,102 +0,0 @@
-# Project Roadmap
-
-Multi-agent dev orchestrator for Temporal, building toward a fully autonomous software development system.
-
-## Milestones
-
-### T0: Core System (IN PROGRESS)
-9 tasks, foundational: Planner/Judge/Implementer orchestration, git workflow, LLM integration, e2e validation.
-
-**Status:** 9 subtasks defined, testable criteria in place.
-**Timeline:** ~2-4 weeks to implementation.
-**Done:** All T0.1–T0.9 pass verification → squash-merge to main.
-
-**Board:** `tasks/board.md`
-
----
-
-### T1: Production Hardening (PLANNED)
-8 tasks: Error recovery, observability, metrics, audit logging, health checks.
-
-**Focus:** Reliability for long-running orchestrators in homelab.
-**Key wins:**
-- Resume from crash without data loss
-- Structured logging + Grafana metrics
-- Auto-tuning based on historical failures
-- Audit trail for compliance
-
-**Board:** `tasks/board-T1.md`
-
----
-
-### T2: Scale & Performance (PLANNED)
-8 tasks: Caching, parallelism, batching, distributed locking.
-
-**Focus:** Handle 100s of concurrent tasks, reduce API call overhead.
-**Key wins:**
-- Result caching deduplicates LLM calls
-- Parallel task dispatch (9x wall-clock speedup)
-- Git operation batching (fewer network round-trips)
-- Distributed lock for multi-pod safety
-
-**Board:** `tasks/board-T2.md`
-
----
-
-### T3: Feature Expansion (PLANNED)
-8 tasks: Plugins, templates, dependencies, human gates, custom judges, nested workflows.
-
-**Focus:** Extensibility + domain specialization.
-**Key wins:**
-- Load custom skill plugins
-- Save/load orchestrator config as templates
-- Task dependency ordering
-- Swap Judge for domain-specific validator (security auditor, code reviewer, etc.)
-- Nest orchestrators (multi-level hierarchy)
-- Import tasks from GitHub/Linear/JIRA
-
-**Board:** `tasks/board-T3.md`
-
----
-
-## Implementation Order
-
-1. **T0 (2-4 weeks):** Core system working end-to-end.
-2. **T1 (2 weeks):** Production-harden the core.
-3. **T2 (3 weeks):** Scale & optimize.
-4. **T3 (4 weeks):** Advanced features.
-
-**Total:** ~3 months to full feature parity.
-
----
-
-## Success Metrics
-
-- **T0:** System runs unsupervised on 9-task milestone, all subtasks auto-complete, squash-merge to main succeeds.
-- **T1:** 1000+ tasks completed, zero data loss across pod restarts, metrics queryable.
-- **T2:** 1000 concurrent tasks complete 10x faster than T0, < 5 API calls/task (vs current ~20).
-- **T3:** Custom Judge plugin loads and validates tasks, workflow templates save/restore state.
-
----
-
-## Risk Mitigation
-
-| Risk | Mitigation |
-|------|-----------|
-| Temporal cluster unavailability | Implement activity heartbeat recovery + resumption logic (T1.1) |
-| Git conflicts on shared FS | Test multi-pod concurrent access (T1.6) → upgrade to distributed lock if needed (T2.8) |
-| LLM API latency | Implement result caching + batching (T2.1, T2.6) |
-| Board state corruption | Detect + auto-heal (T1.4) |
-| Audit trail tampering | Sign audit log with workflow key (T3.6) |
-
----
-
-## Notes
-
-- Each milestone is independent: T1 can start once T0 core is complete, doesn't need full T0 cleanup.
-- T0 tasks are foundational; changes will ripple into T1–T3 test suites, but core API should remain stable.
-- Future milestones (T4+) could focus on: web UI, real-time dashboard, automated deployment of orchestrator itself (meta!), multi-cluster orchestration.
-
----
-
-**Next:** Start T0.1 (repo scaffold).

tasks/T0.1.md

@@ -1,42 +0,0 @@
-# T0.1: Repo Scaffold
-
-## Scope
-Create directory structure, `go.mod`, empty stubs for all packages.
-
-## Implementation Checklist
-- [ ] `go.mod`: module `github.com/rockliang/poimen/workflows`, Go 1.21+
-- [ ] `statemachine/types.go`: empty package stub (will fill in T0.2)
-- [ ] `statemachine/signals.go`: empty package stub
-- [ ] `statemachine/orchestrator.go`: empty package stub, func placeholder
-- [ ] `statemachine/taskunit.go`: empty package stub, func placeholder
-- [ ] `action/planner.go`: empty package stub
-- [ ] `action/implementer.go`: empty package stub
-- [ ] `action/judge.go`: empty package stub
-- [ ] `action/git.go`: empty package stub
-- [ ] `action/skills.go`: empty package stub
-- [ ] `action/integration_test.go`: empty package stub
-- [ ] `action/lessons.go`: empty package stub
-- [ ] `action/llm/client.go`: empty package stub
-- [ ] `prompts/registry.go`: empty package stub
-- [ ] `prompts/planner/default.tmpl`: empty text file
-- [ ] `prompts/judge/default.tmpl`: empty text file
-- [ ] `prompts/implementer/default.tmpl`: empty text file
-- [ ] `internal/config/config.go`: empty package stub
-- [ ] `internal/lock/flock.go`: empty package stub
-- [ ] `cmd/worker/main.go`: `func main()` stub
-- [ ] `cmd/starter/main.go`: `func main()` stub
-- [ ] `tests/taskunit_workflow_test.go`: empty test file
-- [ ] `tests/orchestrator_workflow_test.go`: empty test file
-
-## Verification
-```bash
-cd /Users/rockliang/workplace/Poimen/workflows
-go build ./...
-# Command should succeed with no errors
-# All directories should exist as listed above
-```
-
-## Done Criteria
-- `go build ./...` succeeds with exit code 0
-- `ls -R` shows all directories match PLAN.md §Directory Structure
-- No compilation errors or warnings

tasks/T0.2.md

@@ -1,108 +0,0 @@
-# T0.2: Shared Types
-
-## Scope
-Implement `statemachine/types.go` with all config/input/output structs and document defaults.
-
-## Implementation
-File: `statemachine/types.go`
-
-```go
-type ModelSpec struct {
-    ModelID  string // e.g. "claude-opus-5", "claude-sonnet-5"
-    Thinking string // "adaptive" or ""
-    Effort   string // "low", "medium", "high", "xhigh", "max"
-}
-
-type PromptSpec struct {
-    TemplateRef string            // e.g. "planner/default.tmpl"
-    RawTemplate string            // overrides TemplateRef if non-empty
-    Variables   map[string]any
-    Model       ModelSpec
-    LessonsRef  string            // key into lessons store
-}
-
-type PiRetryPolicy struct {
-    ScheduleToCloseTimeout time.Duration // default: 5m
-    InitialInterval        time.Duration // default: 2s
-    MaximumInterval        time.Duration // default: 30s
-    BackoffCoefficient     float64       // default: 2.0
-    StreamTimeout          time.Duration // default: 30s
-    StreamTimeoutMax       time.Duration // default: 2m
-}
-
-type ActivityTuning struct {
-    ImplementerBaseTimeout time.Duration // default: 10m
-    ImplementerMaxRetries  int           // default: 3
-    JudgeTimeout           time.Duration // default: 5m
-    PiRetry                PiRetryPolicy
-}
-
-type OrchestratorConfig struct {
-    SystemPrompt string                    // shared prompt prefix
-    Skills       []SkillRef                // required skill sources
-    RolePrompts  map[string]PromptSpec     // per-role: "planner", "judge", "implementer"
-    Tuning       ActivityTuning
-}
-
-type OrchestratorInput struct {
-    TargetRepoPath string
-    RemoteURL      string
-    Milestone      string // e.g. "T0"
-    Config         OrchestratorConfig
-    DryRun         bool
-    CycleCount     int
-    MaxCyclesBeforeCAN int // default: 100
-}
-
-type OrchestratorOutput struct {
-    MilestoneComplete bool
-    Done              bool
-    LastError         string
-}
-
-type TaskUnitInput struct {
-    TaskID          string
-    TargetRepoPath  string
-    JudgeSpec       PromptSpec
-    ImplementerSpec PromptSpec
-    BaseTimeout     time.Duration
-    MaxJudgeRetries int
-}
-
-type TaskUnitOutput struct {
-    TaskID  string
-    Verdict string // "pass" or "fail"
-    Critique string
-    Branch  string
-}
-
-type SkillRef struct {
-    Name string // skill identifier
-    URL  string // source to clone
-}
-```
-
-## Verification
-```bash
-cd /Users/rockliang/workplace/Poimen/workflows
-go build ./statemachine/
-
-# Run unit test:
-go test -v ./tests -run TestTypesDefaults
-```
-
-Test file: `tests/types_test.go`
-```go
-func TestTypesDefaults(t *testing.T) {
-    // Verify all defaults are correctly set
-    pr := PiRetryPolicy{}
-    assert.Equal(t, 5*time.Minute, pr.ScheduleToCloseTimeout)
-    // ... more assertions
-}
-```
-
-## Done Criteria
-- `go build ./statemachine/` succeeds
-- `go test ./tests -run TestTypesDefaults` passes
-- All struct fields documented with default values
-- No compilation errors

tasks/T0.3.md

@@ -1,93 +0,0 @@
-# T0.3: Git & Locking
-
-## Scope
-Implement `action/git.go` + `internal/lock/flock.go` for repo cloning, worktree management, and squash-merge.
-
-## Implementation
-
-### File: `internal/lock/flock.go`
-```go
-package lock
-
-// Acquire advisory file lock (blocking)
-func Acquire(path string) error
-
-// Release advisory file lock
-func Release(path string) error
-```
-
-### File: `action/git.go`
-```go
-type CloneRepoInput struct {
-    RemoteURL      string
-    TargetRepoPath string
-}
-
-func CloneRepoActivity(ctx context.Context, in CloneRepoInput) error
-    // If $TargetRepoPath/.git exists: git -C $TargetRepoPath fetch origin
-    // Else: git clone $RemoteURL $TargetRepoPath
-
-type GitWorktreeAddInput struct {
-    RepoPath string
-    TaskID   string
-}
-
-func GitWorktreeAddActivity(ctx context.Context, in GitWorktreeAddInput) (string, error)
-    // Guarded by orchestrator.lock
-    // git worktree add -b task/<TaskID> ../worktrees/<id> origin/main
-    // Return worktree path
-
-type GitCommitInput struct {
-    WorktreePath string
-    Message      string
-}
-
-func GitCommitActivity(ctx context.Context, in GitCommitInput) error
-    // No lock needed; safe within isolated worktree
-    // git -C $WorktreePath add -A
-    // git -C $WorktreePath commit -m "$Message"
-
-type GitPushInput struct {
-    RepoPath string
-}
-
-func GitPushActivity(ctx context.Context, in GitPushInput) error
-    // Guarded by orchestrator.lock
-    // git -C $RepoPath push origin main
-
-type GitSquashMergeInput struct {
-    RepoPath string
-    Branches []string // ["task/T0.1", "task/T0.2", ...]
-    Message  string
-}
-
-func GitSquashMergeActivity(ctx context.Context, in GitSquashMergeInput) error
-    // Guarded by orchestrator.lock
-    // fetch origin main
-    // checkout main && pull --ff-only origin main
-    // for b in branches: merge --squash $b
-    // commit -m $Message
-    // push origin main
-    // for b in branches: worktree remove + branch -D
-```
-
-## Verification
-```bash
-cd /Users/rockliang/workplace/Poimen/workflows
-go test -v ./tests -run TestGit
-
-# Test script: tests/git_test.go
-```
-
-Test cases:
-- Clone into empty path → creates .git
-- Clone into existing path → fetches instead of re-cloning
-- Worktree add → returns valid path
-- Commit in worktree → file changes staged
-- Squash-merge → one commit on main, branches cleaned up
-
-## Done Criteria
-- `go test ./tests -run TestGit` passes
-- Tested against local scratch git repo (not real remote)
-- No lock deadlocks on concurrent calls
-- Squash-merge produces exactly one commit

tasks/T0.4.md

@@ -1,72 +0,0 @@
-# T0.4: Pi & Error Classification
-
-## Scope
-Implement `action/skills.go` with `PrepareSkillsActivity` and `classifyPiErr` for skill prep via homelab API.
-
-## Implementation
-
-### File: `action/skills.go`
-```go
-type SkillRef struct {
-    Name string
-    URL  string
-}
-
-type PrepareSkillsInput struct {
-    Skills        []SkillRef
-    StreamTimeout time.Duration
-}
-
-func PrepareSkillsActivity(ctx context.Context, in PrepareSkillsInput) error
-    // For each skill, run: pi clone-or-fetch $skill.URL
-    // Pass --stream-timeout=$StreamTimeout to pi
-    // Each skill behind its own lock (not orchestrator.lock)
-    // On error, return classified error (see below)
-
-func classifyPiErr(err error) error
-    // 4xx (400-499): NonRetryableApplicationError "PiClientError"
-    // 504: ApplicationError "PiStreamTimeout"
-    // 5xx (500-599, except 504): leave retryable
-    // Other network errors: leave retryable
-```
-
-## Error Buckets
-
-### Bucket 1: 4xx (PiClientError)
-- Status code 400-499
-- Non-retryable: bad request, auth error, not found
-- Temporal stops retrying immediately
-- Activity fails
-
-### Bucket 2: 5xx except 504 (generic 5xx)
-- Status code 500-503, 505-599
-- Retryable: server error, likely transient
-- Temporal backs off + retries until `ScheduleToCloseTimeout` (5m)
-
-### Bucket 3: 504 (PiStreamTimeout)
-- Status code 504
-- Means pi's SSE stream-read timed out
-- Retryable, BUT: Orchestrator doubles `config.Tuning.PiRetry.StreamTimeout` before retry
-- Next attempt uses wider timeout
-
-## Verification
-```bash
-cd /Users/rockliang/workplace/Poimen/workflows
-go test -v ./tests -run TestPiErrors
-
-# Test file: tests/pi_test.go
-```
-
-Test cases:
-- Mock 400 response → NonRetryableApplicationError returned
-- Mock 403 response → NonRetryableApplicationError returned
-- Mock 500 response → retryable error returned
-- Mock 503 response → retryable error returned
-- Mock 504 response → ApplicationError type "PiStreamTimeout" returned
-- Mock network timeout → retryable error returned
-
-## Done Criteria
-- `go test ./tests -run TestPiErrors` passes all 6 test cases
-- All error buckets correctly classified
-- No panics on nil pointers
-- Error messages include HTTP status code