diff --git a/Directory.Packages.props b/Directory.Packages.props
index 6d962492..2a613c1f 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -126,6 +126,9 @@
     <PackageVersion Include="Shouldly" Version="4.3.0" />
     <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.12.0" />
     <PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="2.5.1" />
+    <!-- Source guards: the tests parse agent sources with Roslyn (syntax only) — e.g. no agent may hard-code the
+         provider or model of its LLM call (AgentRegistryGuardTests). -->
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
 
     <!-- Aspire orchestration + service defaults (.NET 10). HELD at 13.5.3: Aspire 13.6.x builds but the
          AppHost fails at startup on this stack (DCP object creation times out after 60s in
diff --git a/README.md b/README.md
index 6871f777..fea222a7 100644
--- a/README.md
+++ b/README.md
@@ -191,7 +191,7 @@ Light and dark are first-class (top bar → appearance toggle, or System → App
 | Concept | Lives in | Notes |
 |---|---|---|
 | **Module** | `IModule` (SharedKernel) | One assembly = one module. Optional `IEndpointModule` (HTTP), `IInitializableModule` (startup hook), `ISettingsContributor` (settings it owns). |
-| **Agent** | `Modules.Pipeline.Agents` | A specialist — Requirement, Coding, Testing, QA, Orchestrator (+ IssueWork, Decomposer). Talks to models only through `ILlmClientFactory`. |
+| **Agent** | `Modules.Pipeline.Agents` | One registry (`AgentRoles`): the Board agents (Discovery, Coding (tickets), Reviewer, Testing (tickets), Autopilot lead, Retrospective) and the 5-agent Workflow pipeline (Orchestrator, Requirement, Coding, Testing, QA). Each role key names its profile, prompt and Insights row. Talks to models only through `ILlmClientFactory`. |
 | **LLM client** | `Domain.Llm.ILlmClient` | `SendAsync(LlmRequest, ct) → LlmResponse`, registered as a keyed service under its provider name. |
 | **Setting** | `Domain.Configuration.SettingDescriptor` | Key, kind, scope, default, validation, UI label. Resolved lock → tenant → platform → seed → default ([ADR-0011](docs/adr/0011-ui-first-configuration.md)). |
 | **Tool** | `Domain.Tools.ITool` | Invoked by models via the gateway, always through `IToolGateway` (policy → invoke → evidence). |
@@ -295,12 +295,18 @@ so a key saved in Settings is used by the next call.
 
 | Agent | Provider | Model |
 |---|---|---|
-| Orchestrator | Claude | `claude-haiku-4-5` |
-| Requirement | Claude | `claude-sonnet-4-6` |
-| Coding | AzureOpenAI | `gpt-4.1` |
-| Testing | AzureOpenAI | `gpt-4o-mini` |
-| QA | Claude | `claude-haiku-4-5` |
-| IssueWork / Decomposer | Claude | `claude-sonnet-4-6` |
+| Board: Discovery, Coding (tickets) | Claude | *Computer's default* (on our servers: Claude's configured model) |
+| Board: Reviewer, Testing (tickets), Autopilot lead, Retrospective | RemoteAgent (a paired computer, 0 server tokens) | *Computer's default* (the member's CLI model) |
+| Workflow pipeline: Orchestrator | Claude | `claude-haiku-4-5` |
+| Workflow pipeline: Requirement | Claude | `claude-sonnet-4-6` |
+| Workflow pipeline: Coding | AzureOpenAI | `gpt-4.1` |
+| Workflow pipeline: Testing | AzureOpenAI | `gpt-4o-mini` |
+| Workflow pipeline: QA | Claude | `claude-haiku-4-5` |
+
+Every agent — Board and pipeline — reads its profile and its prompt (Settings → Prompts) per call, passes the budget
+gate unless it really runs on a member's computer, and appears in Insights under the same name. A Board agent chooses
+no model until someone picks one: a paired computer's CLI then runs its own default, our servers the provider's
+configured model; a picked model reaches the CLI as `claude --model` / `codex -m`. See [CONFIG.md](docs/CONFIG.md#settings--agent-profiles).
 
 The model picker lists every priced model for the chosen provider with its list price (e.g.
 `claude-haiku-5-5 · $0.1 / $0.5` per 1M tokens), plus *Custom…* for Azure deployment aliases.
@@ -397,8 +403,10 @@ The most used routes:
 ### Add a pipeline agent
 
 Use the bundled `agent-scaffold` skill (`/agent-scaffold {Name}`) — it generates the contract,
-implementation, DI registration and xUnit stubs. Give it an agent profile in `AgentsOptions` so it
-appears in Settings → Agent profiles.
+implementation, DI registration and xUnit stubs. Register its role in `AgentRoles` (key, label, Board or
+Workflow pipeline) and give it a seed in `AgentsOptions` (property named after the key) so it appears in Settings →
+Agent profiles; resolve its profile per call (`BoardAgent.ProfileAsync` / `IAgentProfiles`) — `AgentRegistryGuardTests`
+fails the build on a hard-coded provider or model.
 
 ### Add a setting
 
diff --git a/docs/CONFIG.md b/docs/CONFIG.md
index ae38ab27..e8bba1ba 100644
--- a/docs/CONFIG.md
+++ b/docs/CONFIG.md
@@ -98,20 +98,52 @@ exists on the options type but is not honoured yet.
 
 ### Settings → Agent profiles
 
-Per role — `Orchestrator`, `Requirement`, `Coding`, `Testing`, `Qa`, `IssueWork`, `Decomposer` — keys
-`Agents:<Role>:Provider` / `Model` / `Temperature` / `MaxTokens`, tenant scope. The model field lists
-priced models for the chosen provider (plus *Custom…* for deployment aliases); `Temperature` is hidden
-for models that reject sampling params; `MaxTokens` ≤ 128 000.
-
-| Role | Provider | Model | Temp | Max output |
-|---|---|---|---|---|
-| Orchestrator | Anthropic | `claude-haiku-4-5` | 0.3 | 2000 |
-| Requirement | Anthropic | `claude-sonnet-4-6` | 0.1 | 2000 |
-| Coding | AzureOpenAI | `gpt-4.1` | 0.2 | 4000 |
-| Testing | AzureOpenAI | `gpt-4o-mini` | 0.2 | 3000 |
-| Qa | Anthropic | `claude-haiku-4-5` | 0.1 | 1500 |
-| IssueWork | Anthropic | `claude-sonnet-4-6` | 0.2 | 32768 |
-| Decomposer | Anthropic | `claude-sonnet-4-6` | 0.2 | 4000 |
+One agent registry (`AgentRoles`): every agent AgentOS.NET runs has one stable **role key**, used for its
+profile (`Agents:<Key>:Provider` / `Model` / `Temperature` / `MaxTokens`, tenant scope), its prompt in
+**Settings → Prompts** (`prompt/<Key>/system`), the `AgentRole` of its LLM calls (what **Insights → By agent**
+groups and names by) and the label of its stored runs. The page shows two tables — the **Board agents** and the
+legacy 5-agent **Workflow pipeline** — so a change to one never silently touches the other. Every profile is read
+per call (no restart). The model field lists priced models for the chosen provider (plus *Custom…* for deployment
+aliases); `Temperature` is hidden for models that reject sampling params; `MaxTokens` ≤ 128 000.
+
+| Shown as | Key | Provider | Model | Temp | Max output |
+|---|---|---|---|---|---|
+| Discovery (New idea: requirement + ticket split) | `Discovery` | Anthropic | *Computer's default* | 0.2 | 4000 |
+| Coding (tickets) | `IssueWork` | Anthropic | *Computer's default* | 0.2 | 32768 |
+| Reviewer | `Reviewer` | RemoteAgent | *Computer's default* | 0 | 32768 |
+| Testing (tickets) | `Acceptance` | RemoteAgent | *Computer's default* | 0 | 32768 |
+| Autopilot lead | `AutopilotOrchestrator` | RemoteAgent | *Computer's default* | 0 | 4096 |
+| Retrospective | `Retrospective` | RemoteAgent | *Computer's default* | 0 | 4096 |
+| Orchestrator (Workflow pipeline) | `Orchestrator` | Anthropic | `claude-haiku-4-5` | 0.3 | 2000 |
+| Requirement (Workflow pipeline) | `Requirement` | Anthropic | `claude-sonnet-4-6` | 0.1 | 2000 |
+| Coding (Workflow pipeline) | `Coding` | AzureOpenAI | `gpt-4.1` | 0.2 | 4000 |
+| Testing (Workflow pipeline) | `Testing` | AzureOpenAI | `gpt-4o-mini` | 0.2 | 3000 |
+| QA (Workflow pipeline) | `Qa` | Anthropic | `claude-haiku-4-5` | 0.1 | 1500 |
+
+- **Computer's default (Board agents).** A Board agent chooses **no model** unless someone picks one. On a member's
+  paired computer (`RemoteAgent`) the request carries no model and the runner passes no flag, so the CLI runs its
+  own default — the member's choice, usually newer than any id AgentOS.NET would pin. On our servers the LLM gateway
+  fills in the provider's configured model (`Llm:Claude:Model`, the Azure default deployment, the vendor's / the
+  OpenAI-compatible server's model from **Settings → Model keys**) before the request is validated. A model picked
+  in the profile is always passed: `claude --model <id>`, `codex -m <id>` (only when that CLI can serve it). The
+  Workflow-pipeline agents always name a model. Reviewer and Testing (tickets) need a checkout, so keep them on a
+  paired computer unless the chosen provider can reach one.
+- **Budget gate.** Every Board agent passes the tenant's enforced monthly cap before its call, decided from the
+  *effective* provider (after `Llm:ForceProvider`); only a call that really runs on a member's computer (0 server
+  tokens) is exempt.
+- **Discovery** covers both calls of New idea: the requirement step uses the Discovery profile (and is filed under
+  Discovery in Insights) with the Requirement agent's prompt and spec contract; the ticket split uses the Discovery
+  prompt. It replaces the former `Decomposer` keys, which **keep working**: while a Discovery field has no stored
+  value, the tenant's (then the platform's, then the appsettings) `Agents:Decomposer:<Field>` applies, and the
+  Decomposer prompt override applies while no Discovery override is saved. Agent profiles marks the row *Saved as
+  "Decomposer" — still applies*; saving a field stores it under Discovery, and **Reset** (profile or prompt) clears
+  the tenant's Decomposer values too.
+- **Prompts.** Board prompts are templates: `{owner}`, `{repo}`, `{branch}`, `{defaultBranch}` (Reviewer, Testing
+  (tickets)) and `{issue}`, `{branchStep}`, `{commitType}`… (Coding (tickets), which has one prompt for a member's
+  computer and one — `IssueWork.Server` — for the server runner) are filled on every run. The untrusted-text rule is
+  appended by code and cannot be overridden; workspace rules follow it.
+- **Practices.** Coding, Reviewer, Testing (tickets) and the Autopilot lead read the project's practices (Board →
+  Knowledge) before they work.
 
 `Pipeline:MaxIterations` (QA-loop cap when a story sets no `NMax`) — default 3, range 1–10.
 An unpriced model is charged at the fail-closed $15/$75 per 1M rate until added to `CostCalculator`.
diff --git a/src/AgentOs.Domain/Llm/LlmRequest.cs b/src/AgentOs.Domain/Llm/LlmRequest.cs
index 49efc94b..302e1ed3 100644
--- a/src/AgentOs.Domain/Llm/LlmRequest.cs
+++ b/src/AgentOs.Domain/Llm/LlmRequest.cs
@@ -77,6 +77,20 @@ public sealed record LlmRequest(
     /// Validates required values. Throws <see cref="System.ArgumentException"/> if invalid.
     /// </summary>
     public void Validate()
+    {
+        ValidateAllowingNoModel();
+        if (string.IsNullOrWhiteSpace(Model))
+        {
+            throw new System.ArgumentException("Model must not be null or whitespace.", nameof(Model));
+        }
+    }
+
+    /// <summary>
+    /// Validates required values but accepts an empty <see cref="Model"/>: a provider that chooses the model itself (a
+    /// member's paired CLI runs its own default) accepts "no model chosen". Server providers resolve an empty model to
+    /// their configured one and then call <see cref="Validate"/>.
+    /// </summary>
+    public void ValidateAllowingNoModel()
     {
         if (SystemPrompt is null)
         {
@@ -88,11 +102,6 @@ public void Validate()
             throw new System.ArgumentException("UserPrompt must not be null or whitespace.", nameof(UserPrompt));
         }
 
-        if (string.IsNullOrWhiteSpace(Model))
-        {
-            throw new System.ArgumentException("Model must not be null or whitespace.", nameof(Model));
-        }
-
         if (Temperature is < 0.0 or > 2.0)
         {
             throw new System.ArgumentException("Temperature must be in [0, 2].", nameof(Temperature));
diff --git a/src/AgentOs.Domain/Workspaces/IBoardRepos.cs b/src/AgentOs.Domain/Workspaces/IBoardRepos.cs
new file mode 100644
index 00000000..497824a7
--- /dev/null
+++ b/src/AgentOs.Domain/Workspaces/IBoardRepos.cs
@@ -0,0 +1,17 @@
+// The repositories a board works on, as "owner/repo" keys — what project memory (lessons, practices) is keyed by. Lets
+// an agent that sees a whole board (the Autopilot lead) read the practices of its projects without depending on the
+// Workspaces module. Tenant-explicit: background runs have no request context.
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace AgentOs.Domain.Workspaces;
+
+/// <summary>Lists a board's repositories.</summary>
+public interface IBoardRepos
+{
+    /// <summary>The <c>owner/repo</c> keys of board <paramref name="boardId"/> in <paramref name="tenantId"/> (empty when unknown).</summary>
+    Task<IReadOnlyList<string>> RepoKeysAsync(string tenantId, Guid boardId, CancellationToken ct = default);
+}
diff --git a/src/AgentOs.Modules.Llm/ChatClientLlmClient.cs b/src/AgentOs.Modules.Llm/ChatClientLlmClient.cs
index c70144dc..5fe837bc 100644
--- a/src/AgentOs.Modules.Llm/ChatClientLlmClient.cs
+++ b/src/AgentOs.Modules.Llm/ChatClientLlmClient.cs
@@ -18,20 +18,24 @@ namespace AgentOs.Modules.Llm;
 public sealed class ChatClientLlmClient : ILlmClient
 {
     private readonly IChatClient _chat;
+    private readonly string? _defaultModel;
 
     /// <inheritdoc />
     public string Provider { get; }
 
-    public ChatClientLlmClient(IChatClient chat, string provider)
+    /// <summary>Create. <paramref name="defaultModel"/> is used when a request chose no model.</summary>
+    public ChatClientLlmClient(IChatClient chat, string provider, string? defaultModel = null)
     {
         _chat = chat ?? throw new ArgumentNullException(nameof(chat));
         Provider = string.IsNullOrWhiteSpace(provider) ? "ChatClient" : provider;
+        _defaultModel = defaultModel;
     }
 
     /// <inheritdoc />
     public async Task<LlmResponse> SendAsync(LlmRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
+        request = ProviderDefaultModel.Apply(request, _defaultModel);
         request.Validate();
 
         var messages = new List<ChatMessage>(2);
diff --git a/src/AgentOs.Modules.Llm/LlmModule.cs b/src/AgentOs.Modules.Llm/LlmModule.cs
index cfe6890b..7336d393 100644
--- a/src/AgentOs.Modules.Llm/LlmModule.cs
+++ b/src/AgentOs.Modules.Llm/LlmModule.cs
@@ -71,7 +71,9 @@ public void AddServices(IServiceCollection services, IConfiguration configuratio
                 tenantProvider: sp,
                 // Classify SDK errors so the key pool fails over on transient (5xx/timeout) + auth errors,
                 // not only 429.
-                classifyError: SdkChatClients.Classify);
+                classifyError: SdkChatClients.Classify,
+                // An agent profile left on "no model chosen" runs Claude's configured model.
+                defaultModel: () => opts.Value.Claude.Model);
         });
         services.AddKeyedSingleton<ILlmClient>("AzureOpenAI", (sp, _) =>
         {
@@ -107,7 +109,9 @@ string DefaultDeployment() => settings is null
                 // Fold the tenant's resolved endpoint into the client cache key (read per call from the same
                 // override source the factory uses) so two tenants sharing a key but not an endpoint never
                 // share a client bound to the wrong Azure resource.
-                cacheKeyDiscriminator: () => !string.IsNullOrWhiteSpace(ov.AzureEndpoint) ? ov.AzureEndpoint! : opts.Value.AzureOpenAi.Endpoint);
+                cacheKeyDiscriminator: () => !string.IsNullOrWhiteSpace(ov.AzureEndpoint) ? ov.AzureEndpoint! : opts.Value.AzureOpenAi.Endpoint,
+                // An agent profile left on "no model chosen" runs the tenant's default deployment.
+                defaultModel: DefaultDeployment);
         });
 
         // BYOK vendors (OpenAI, Gemini, xAI): fixed endpoints, tenant-scoped keys read live per call, the profile's
@@ -132,7 +136,8 @@ string DefaultDeployment() => settings is null
                     toolInvocationLog: sp.GetService<AgentOs.Domain.Tools.IToolInvocationLog>(),
                     tenantProvider: sp,
                     classifyError: SdkChatClients.Classify,
-                    modelResolver: requested => vendor.ResolveModel(requested, Read(vendor.ModelSetting)));
+                    modelResolver: requested => vendor.ResolveModel(requested, Read(vendor.ModelSetting)),
+                    defaultModel: () => vendor.ResolveModel(null, Read(vendor.ModelSetting)));
             });
         }
 
@@ -160,7 +165,8 @@ string Endpoint() => Read(LlmSettings.CompatEndpoint)
                 classifyError: SdkChatClients.Classify,
                 cacheKeyDiscriminator: () => Read(LlmSettings.CompatEndpoint) ?? string.Empty,
                 modelResolver: requested => OpenAiCompatibleModels.Resolve(requested, Read(LlmSettings.CompatModel)),
-                costOverride: (_, usage) => OpenAiCompatibleModels.Cost(usage, Read(LlmSettings.CompatInputPrice), Read(LlmSettings.CompatOutputPrice)));
+                costOverride: (_, usage) => OpenAiCompatibleModels.Cost(usage, Read(LlmSettings.CompatInputPrice), Read(LlmSettings.CompatOutputPrice)),
+                defaultModel: () => Read(LlmSettings.CompatModel));
         });
 
         services.AddSingleton<ILlmClientFactory, LlmClientFactory>();
diff --git a/src/AgentOs.Modules.Llm/MafChatClient.cs b/src/AgentOs.Modules.Llm/MafChatClient.cs
index c6ff28d7..6d106065 100644
--- a/src/AgentOs.Modules.Llm/MafChatClient.cs
+++ b/src/AgentOs.Modules.Llm/MafChatClient.cs
@@ -56,6 +56,12 @@ _settings is null
     public async Task<LlmResponse> SendAsync(LlmRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
+        // No model chosen in the agent's profile → the configured Azure deployment (live setting, else the option).
+        if (string.IsNullOrWhiteSpace(request.Model))
+        {
+            request = ProviderDefaultModel.Apply(request,
+                (_settings is null ? null : LiveSettings.Read(_settings, LlmSettings.AzureModel, AmbientIdentity.Current?.TenantId)) ?? _options.Model);
+        }
         request.Validate();
 
         // Resolve credentials with the SAME tenant-override-first precedence as the AzureOpenAI pool — a tenant
diff --git a/src/AgentOs.Modules.Llm/PooledChatLlmClient.cs b/src/AgentOs.Modules.Llm/PooledChatLlmClient.cs
index 1977bb5a..e0d08fb0 100644
--- a/src/AgentOs.Modules.Llm/PooledChatLlmClient.cs
+++ b/src/AgentOs.Modules.Llm/PooledChatLlmClient.cs
@@ -68,8 +68,10 @@ public PooledChatLlmClient(
         Func<Exception, LlmErrorKind>? classifyError = null,
         Func<string>? cacheKeyDiscriminator = null,
         Func<string, string>? modelResolver = null,
-        Func<string, TokenUsage, decimal?>? costOverride = null)
+        Func<string, TokenUsage, decimal?>? costOverride = null,
+        Func<string?>? defaultModel = null)
     {
+        _defaultModel = defaultModel;
         Provider = string.IsNullOrWhiteSpace(provider) ? throw new ArgumentException("provider required", nameof(provider)) : provider;
         _clientFactory = clientFactory ?? throw new ArgumentNullException(nameof(clientFactory));
         _keyProvider = keyProvider ?? throw new ArgumentNullException(nameof(keyProvider));
@@ -97,6 +99,9 @@ public PooledChatLlmClient(
     private readonly Func<string, string>? _modelResolver;
     private readonly Func<string, TokenUsage, decimal?>? _costOverride;
 
+    // The provider's configured model (read live per call), used when the agent's profile chose none.
+    private readonly Func<string?>? _defaultModel;
+
     // The tenant for tool tagging / telemetry when there is no AmbientIdentity on the call. Prefer a
     // directly-supplied ITenantContext (tests); otherwise resolve the request-scoped one inside a fresh
     // scope off the root provider (safe from a singleton — IHttpContextAccessor is itself a singleton, so
@@ -113,6 +118,8 @@ public PooledChatLlmClient(
     public async Task<LlmResponse> SendAsync(LlmRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
+        // No model chosen in the agent's profile → this provider's configured model (before validation).
+        request = ProviderDefaultModel.Apply(request, string.IsNullOrWhiteSpace(request.Model) ? _defaultModel?.Invoke() : null);
         request.Validate();
 
         var keys = await _keyProvider(cancellationToken).ConfigureAwait(false);
diff --git a/src/AgentOs.Modules.Llm/ProviderDefaultModel.cs b/src/AgentOs.Modules.Llm/ProviderDefaultModel.cs
new file mode 100644
index 00000000..cdc96115
--- /dev/null
+++ b/src/AgentOs.Modules.Llm/ProviderDefaultModel.cs
@@ -0,0 +1,22 @@
+// "No model chosen" in an agent profile (the Board agents' default) means: let whoever serves the call pick. A member's
+// paired CLI runs its own default model; a server provider runs the model configured for it (Settings → Model keys /
+// Llm:<Provider>:Model). Each server client resolves the empty model here, BEFORE LlmRequest.Validate, so a profile
+// left on its default never throws on our servers.
+
+using AgentOs.Domain.Llm;
+
+namespace AgentOs.Modules.Llm;
+
+/// <summary>Fills an empty request model with the serving provider's configured model.</summary>
+public static class ProviderDefaultModel
+{
+    /// <summary><paramref name="request"/> unchanged when it names a model (or no default is known); otherwise the same
+    /// request with <see cref="LlmRequest.Model"/> = <paramref name="providerDefault"/>.</summary>
+    public static LlmRequest Apply(LlmRequest request, string? providerDefault)
+    {
+        System.ArgumentNullException.ThrowIfNull(request);
+        return string.IsNullOrWhiteSpace(request.Model) && !string.IsNullOrWhiteSpace(providerDefault)
+            ? request with { Model = providerDefault.Trim() }
+            : request;
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AcceptanceAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/AcceptanceAgent.cs
index 18a3a49a..44660e1f 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AcceptanceAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AcceptanceAgent.cs
@@ -2,6 +2,8 @@
 // build it, run its tests, check each acceptance criterion the way the criterion says (bringing the app up for an
 // end-to-end check), and report evidence. It runs on the member's paired computer (it needs a real machine: a
 // browser, containers, the repo's own toolchain) under scoped autonomy, and never edits, commits or pushes.
+// Its profile (Settings → Agent profiles, role "Acceptance" — "Testing (tickets)"), its prompt (Settings → Prompts) and
+// the budget gate apply like every other agent's; the seed keeps it on the member's computer (0 server tokens).
 
 using System;
 using System.Collections.Generic;
@@ -10,14 +12,20 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
 using AgentOs.Domain.Llm;
+using AgentOs.Domain.Memory;
 using AgentOs.Domain.Sessions;
+using AgentOs.Modules.Pipeline.Prompts;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <inheritdoc cref="IAcceptanceAgent"/>
-public sealed class AcceptanceAgent(ILlmClientFactory factory, ILogger<AcceptanceAgent> logger, ISessionRunFeed? feed = null) : IAcceptanceAgent
+public sealed class AcceptanceAgent(ILlmClientFactory factory, ILogger<AcceptanceAgent> logger, ISessionRunFeed? feed = null,
+    IOptions<AgentsOptions>? options = null, IAgentProfiles? profiles = null, IPromptOverrides? prompts = null,
+    IBudgetGuard? budgetGuard = null, IMemoryStore? memory = null) : IAcceptanceAgent
 {
     // Building, starting a stack and running end-to-end specs takes longer than writing the change.
     private static readonly TimeSpan RunTimeout = TimeSpan.FromMinutes(30);
@@ -31,23 +39,36 @@ public async Task<AcceptanceVerdict> RunAsync(AcceptanceRequest request, Cancell
             return NotRun("There is no proposed change (branch) to test.");
         }
         var repoLabel = $"{request.Repo.Owner}/{request.Repo.Repo}";
-        Emit(request, SessionRunEventKind.Running, $"Testing #{request.IssueNumber} on your computer.", repoLabel);
 
+        // Live profile (Settings → Agent profiles), resolved per call.
+        var profile = await BoardAgent.ProfileAsync(profiles, options, AgentRoles.Acceptance, ct).ConfigureAwait(false);
         ILlmClient llm;
-        try { llm = factory.Create("RemoteAgent"); }
+        try { llm = factory.Create(profile.Provider); }
         catch (Exception ex) when (ex is LlmException or ArgumentException or NotSupportedException or InvalidOperationException)
         {
             return NotRun($"No computer to test on: {ex.Message}");
         }
+        var provider = AgentBudgetGate.EffectiveProvider(llm, profile.Provider);
+        if (await AgentBudgetGate.BlockedAsync(budgetGuard, request.TenantId, provider, logger, nameof(AcceptanceAgent), ct).ConfigureAwait(false) is not null)
+        {
+            return NotRun(AgentBudgetGate.BlockedMessage);
+        }
+        Emit(request, SessionRunEventKind.Running, AgentBudgetGate.RunsOnMembersComputer(provider)
+            ? $"Testing #{request.IssueNumber} on your computer."
+            : $"Testing #{request.IssueNumber} ({provider}).", repoLabel);
 
         var llmRequest = new LlmRequest(
-            SystemPrompt: Instructions(request) + "\n\n" + UntrustedText.SystemRule,
-            UserPrompt: User(request),
-            Model: "claude-sonnet-4-6",
-            MaxTokens: 32768,
+            SystemPrompt: await BoardAgent.SystemPromptAsync(prompts, AgentRoles.Acceptance, InstructionsTemplate, Values(request),
+                UntrustedText.SystemRule, ct).ConfigureAwait(false),
+            UserPrompt: User(request)
+                + await ProjectPractices.BlockAsync(memory, request.TenantId, [repoLabel], logger, ct).ConfigureAwait(false),
+            Model: profile.Model,
+            Temperature: profile.Temperature,
+            MaxTokens: profile.MaxTokens,
             Timeout: RunTimeout,
             Cli: request.CliProfile)
         {
+            AgentRole = AgentRoles.Acceptance,
             Autonomy = WorkspaceAutonomy.Scoped,
             Progress = new InlineProgress<string>(step =>
             {
@@ -71,18 +92,33 @@ public async Task<AcceptanceVerdict> RunAsync(AcceptanceRequest request, Cancell
     private void Emit(AcceptanceRequest r, SessionRunEventKind kind, string message, string repo) =>
         feed?.Publish(new SessionRunEvent(r.TenantId, r.SessionId, kind, message, DateTimeOffset.UtcNow, repo));
 
-    internal static string Instructions(AcceptanceRequest r) => string.Format(
-        CultureInfo.InvariantCulture,
+    /// <summary>The placeholders <see cref="InstructionsTemplate"/> (and an override of it) may use.</summary>
+    public static readonly IReadOnlyList<string> Placeholders = ["owner", "repo", "branch", "defaultBranch"];
+
+    /// <summary>The per-run values of <see cref="Placeholders"/>.</summary>
+    internal static Dictionary<string, string> Values(AcceptanceRequest r) => new(StringComparer.Ordinal)
+    {
+        ["owner"] = r.Repo.Owner,
+        ["repo"] = r.Repo.Repo,
+        ["branch"] = r.Repo.ExistingBranch ?? string.Empty,
+        ["defaultBranch"] = r.Repo.DefaultBranch,
+    };
+
+    /// <summary>The system prompt for one run (the built-in template, filled).</summary>
+    internal static string Instructions(AcceptanceRequest r) => PromptTemplate.Fill(InstructionsTemplate, Values(r));
+
+    /// <summary>The built-in system prompt template (its first line is the agent's routing key).</summary>
+    public const string InstructionsTemplate =
         """
         You are the Testing Agent of AgentOS.NET. You ACCEPT or REJECT a proposed change against its ticket's
         acceptance criteria, on the developer's own machine, with your native shell and file tools. You NEVER change
         the code: do not edit tracked files, do not commit, do not push, do not open or comment on pull requests.
 
         1. Get the change. The runner starts you in a fresh, empty directory made for this run:
-           git clone https://github.com/{0}/{1}.git .
-           git fetch origin {2}
-           git checkout {2}
-           (default branch: {3})
+           git clone https://github.com/{owner}/{repo}.git .
+           git fetch origin {branch}
+           git checkout {branch}
+           (default branch: {defaultBranch})
         2. Read the ticket (user message), the repository's agent instructions (AGENTS.md, CLAUDE.md, README) and
            docs/ACCEPTANCE.md if present — criterion IDs such as F-4 or LIB-1 refer to it.
         3. Build and run the unit tests the way the repository does (e.g. `dotnet build` + `dotnet test`,
@@ -95,17 +131,16 @@ then stop the stack gracefully (Ctrl+C) so it removes its own containers. Never
            images or any data outside this directory.
         5. A criterion you cannot check here — a data set or secret that is not available, an external service —
            is "not-checked" with the reason. Never report "pass" for something you did not run.
-        6. When a test fails, check whether it already fails on the default branch: `git worktree add ../base origin/{3}`,
+        6. When a test fails, check whether it already fails on the default branch: `git worktree add ../base origin/{defaultBranch}`,
            run the same test there. If it fails the same way, it is a pre-existing failure, not this change's:
            list it under "baseFailures" and do not let it fail the verdict.
 
         Reply ONLY with this JSON (no other text):
-        {{"verdict":"pass","criteria":[{{"criterion":"<ID or the criterion's words>","result":"pass","evidence":"<command and the key output line, or why it was not checked>"}}],"baseFailures":[{{"test":"<fully qualified test name>","evidence":"<the failure, and that it fails the same on {3}>"}}],"summary":"<one or two sentences>"}}
+        {"verdict":"pass","criteria":[{"criterion":"<ID or the criterion's words>","result":"pass","evidence":"<command and the key output line, or why it was not checked>"}],"baseFailures":[{"test":"<fully qualified test name>","evidence":"<the failure, and that it fails the same on {defaultBranch}>"}],"summary":"<one or two sentences>"}
         "verdict" is "pass" only when the build passed, every failing test is a pre-existing failure, and no criterion
         failed; otherwise "fail".
         "result" is one of "pass", "fail", "not-checked".
-        """,
-        r.Repo.Owner, r.Repo.Repo, r.Repo.ExistingBranch, r.Repo.DefaultBranch);
+        """;
 
     internal static string User(AcceptanceRequest r) => string.Format(
         CultureInfo.InvariantCulture,
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentBudgetGate.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentBudgetGate.cs
new file mode 100644
index 00000000..c1d61465
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentBudgetGate.cs
@@ -0,0 +1,71 @@
+// S1 — the per-tenant budget gate, shared by every Board agent. A call that runs on the server spends AgentOS.NET's own
+// LLM tokens, so it passes the tenant's ENFORCED monthly cap first. A call that really runs on a member's paired
+// computer (the RemoteAgent provider — the member's own CLI subscription) costs 0 server tokens and is exempt. The
+// decision reads the EFFECTIVE provider — the client the factory returned, after Settings' force-provider — never the
+// name the agent asked for: a forced server provider must not slip past the gate because the profile says RemoteAgent.
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
+using AgentOs.Domain.Llm;
+using AgentOs.SharedKernel.Identity;
+using Microsoft.Extensions.Logging;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>The budget gate for agent calls, decided from the effective provider.</summary>
+public static class AgentBudgetGate
+{
+    /// <summary>What a person reads when a call was blocked.</summary>
+    public const string BlockedMessage =
+        "Monthly LLM budget exceeded — raise the cap in Settings, or run this agent on a member's computer (0 server tokens).";
+
+    /// <summary>True when <paramref name="provider"/> runs the call on a member's paired computer (0 server tokens).</summary>
+    public static bool RunsOnMembersComputer(string? provider) =>
+        (provider ?? string.Empty).Trim().ToUpperInvariant() is "REMOTEAGENT" or "REMOTE" or "IDE";
+
+    /// <summary>The provider that will really serve calls on <paramref name="client"/> (after force-provider); the
+    /// requested name only when the client does not say.</summary>
+    public static string EffectiveProvider(ILlmClient client, string requested)
+    {
+        ArgumentNullException.ThrowIfNull(client);
+        return string.IsNullOrWhiteSpace(client.Provider) ? requested : client.Provider;
+    }
+
+    /// <summary>
+    /// The tenant's budget status when a call on <paramref name="effectiveProvider"/> must be blocked, else null (the call
+    /// proceeds). No guard, a call on a member's computer, or an unknown tenant → null. Fail-open on a transient store
+    /// error: a budget-store hiccup never blocks an agent; the cap applies again on the next call.
+    /// </summary>
+    public static async Task<BudgetStatus?> BlockedAsync(IBudgetGuard? guard, string? tenantId, string effectiveProvider,
+        ILogger logger, string agent, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(logger);
+        if (guard is null || RunsOnMembersComputer(effectiveProvider)) { return null; }
+        var tenant = string.IsNullOrWhiteSpace(tenantId) ? AmbientIdentity.Current?.TenantId : tenantId;
+        if (string.IsNullOrWhiteSpace(tenant)) { return null; }
+
+        BudgetStatus budget;
+        try
+        {
+            budget = await guard.EvaluateAsync(tenant, ct).ConfigureAwait(false);
+        }
+        catch (Microsoft.EntityFrameworkCore.DbUpdateException ex) { return Failed(ex); }
+        catch (System.Data.Common.DbException ex) { return Failed(ex); }
+        catch (TimeoutException ex) { return Failed(ex); }
+        catch (IOException ex) { return Failed(ex); }
+        catch (InvalidOperationException ex) { return Failed(ex); }
+
+        if (budget is not { State: BudgetState.Exceeded, EnforceOn: true }) { return null; }
+        logger.LogWarning("{Agent}: blocked — tenant {Tenant} is over its monthly LLM budget (${Spent} of ${Cap}) and the call would run on {Provider}.",
+            agent, tenant, budget.SpentUsd, budget.CapUsd, effectiveProvider);
+        return budget;
+
+        BudgetStatus? Failed(Exception ex)
+        {
+            logger.LogWarning(ex, "{Agent}: budget evaluation failed for tenant {Tenant}; proceeding.", agent, tenant);
+            return null;
+        }
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentProfiles.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentProfiles.cs
index e74d037d..9f25fb82 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AgentProfiles.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentProfiles.cs
@@ -28,12 +28,15 @@ public sealed class SettingsAgentProfiles : IAgentProfiles
 {
     private readonly ISettings _settings;
     private readonly IServiceScopeFactory? _scopes;
+    private readonly LegacyAgentSettings? _legacy;
 
-    /// <summary>Create. <paramref name="scopes"/> resolves the request tenant when no ambient identity is pushed.</summary>
-    public SettingsAgentProfiles(ISettings settings, IServiceScopeFactory? scopes = null)
+    /// <summary>Create. <paramref name="scopes"/> resolves the request tenant when no ambient identity is pushed;
+    /// <paramref name="legacy"/> reads values a renamed role saved under its former key.</summary>
+    public SettingsAgentProfiles(ISettings settings, IServiceScopeFactory? scopes = null, LegacyAgentSettings? legacy = null)
     {
         _settings = settings ?? throw new ArgumentNullException(nameof(settings));
         _scopes = scopes;
+        _legacy = legacy;
     }
 
     /// <inheritdoc />
@@ -43,10 +46,10 @@ public async ValueTask<AgentOptions> ResolveAsync(string role, AgentOptions fall
         ArgumentNullException.ThrowIfNull(fallback);
         var tenant = CurrentTenant();
 
-        var provider = await _settings.GetStringAsync(AgentSettings.Key(role, nameof(AgentOptions.Provider)), tenant, null, cancellationToken).ConfigureAwait(false);
-        var model = await _settings.GetStringAsync(AgentSettings.Key(role, nameof(AgentOptions.Model)), tenant, null, cancellationToken).ConfigureAwait(false);
-        var temperature = await _settings.GetStringAsync(AgentSettings.Key(role, nameof(AgentOptions.Temperature)), tenant, null, cancellationToken).ConfigureAwait(false);
-        var maxTokens = await _settings.GetStringAsync(AgentSettings.Key(role, nameof(AgentOptions.MaxTokens)), tenant, null, cancellationToken).ConfigureAwait(false);
+        var provider = await FieldAsync(role, nameof(AgentOptions.Provider), tenant, cancellationToken).ConfigureAwait(false);
+        var model = await FieldAsync(role, nameof(AgentOptions.Model), tenant, cancellationToken).ConfigureAwait(false);
+        var temperature = await FieldAsync(role, nameof(AgentOptions.Temperature), tenant, cancellationToken).ConfigureAwait(false);
+        var maxTokens = await FieldAsync(role, nameof(AgentOptions.MaxTokens), tenant, cancellationToken).ConfigureAwait(false);
 
         return new AgentOptions
         {
@@ -58,6 +61,19 @@ public async ValueTask<AgentOptions> ResolveAsync(string role, AgentOptions fall
         };
     }
 
+    // The field's effective value. Only when nothing is stored for it (it would be the built-in default) does a value
+    // the role saved under its former key apply (Decomposer → Discovery).
+    private async ValueTask<string?> FieldAsync(string role, string field, string? tenant, CancellationToken ct)
+    {
+        var value = await _settings.GetAsync(AgentSettings.Key(role, field), tenant, ct).ConfigureAwait(false);
+        if (value.Source == SettingSource.Default && _legacy is not null
+            && await _legacy.ReadAsync(role, field, tenant, ct).ConfigureAwait(false) is { } legacy)
+        {
+            return legacy;
+        }
+        return value.HasValue ? value.Value : null;
+    }
+
     /// <inheritdoc />
     public async ValueTask<int> MaxIterationsAsync(int fallback, CancellationToken cancellationToken = default)
     {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentRoles.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentRoles.cs
new file mode 100644
index 00000000..350aaba4
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentRoles.cs
@@ -0,0 +1,123 @@
+// One agent registry. Every agent AgentOS.NET runs has ONE stable role key, used everywhere the agent is named:
+// its profile (Settings → Agent profiles, Agents:<Key>:*), its prompt (Settings → Prompts, prompt/<Key>/system), the
+// AgentRole on its LLM requests (what Insights groups by) and the label of its stored runs. The Board agents (tickets,
+// reviews, testing, Autopilot, retrospectives, New idea) are listed apart from the legacy 5-agent Workflow pipeline so
+// a person never edits "Coding" expecting the ticket agent to change.
+
+using System;
+using System.Collections.Frozen;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Which surface an agent serves.</summary>
+public enum AgentRoleGroup
+{
+    /// <summary>The Board: tickets, reviews, testing, Autopilot, retrospectives, New idea.</summary>
+    Board,
+
+    /// <summary>The 5-agent Workflow pipeline (Run / Workflow app, the Thorough engine).</summary>
+    WorkflowPipeline,
+}
+
+/// <summary>One agent role: its stable key, the name people see, its surface and what it does.</summary>
+/// <param name="Key">Stable key: profile key, prompt key, Insights AgentRole and run label.</param>
+/// <param name="Label">The name shown in Agent profiles, Prompts and Insights.</param>
+/// <param name="Group">Board agent or Workflow pipeline agent.</param>
+/// <param name="Description">One sentence: what the agent does.</param>
+public sealed record AgentRoleInfo(string Key, string Label, AgentRoleGroup Group, string Description);
+
+/// <summary>The registry of agent roles (keys are stable; never rename one — stored settings and metrics use it).</summary>
+public static class AgentRoles
+{
+    /// <summary>Workflow pipeline — the orchestrator.</summary>
+    public const string Orchestrator = "Orchestrator";
+
+    /// <summary>Workflow pipeline — requirement analysis.</summary>
+    public const string Requirement = "Requirement";
+
+    /// <summary>Workflow pipeline — code generation.</summary>
+    public const string Coding = "Coding";
+
+    /// <summary>Workflow pipeline — test generation.</summary>
+    public const string Testing = "Testing";
+
+    /// <summary>Workflow pipeline — QA scoring.</summary>
+    public const string Qa = "Qa";
+
+    /// <summary>Board — New idea: requirement + ticket split.</summary>
+    public const string Discovery = "Discovery";
+
+    /// <summary>Board — implements a ticket (Coding agent of the Board).</summary>
+    public const string IssueWork = "IssueWork";
+
+    /// <summary>Board — reviews a proposed change.</summary>
+    public const string Reviewer = "Reviewer";
+
+    /// <summary>Board — tests a proposed change against its acceptance criteria (Testing agent of the Board).</summary>
+    public const string Acceptance = "Acceptance";
+
+    /// <summary>Board — Autopilot's lead: decides what happens next on a board.</summary>
+    public const string AutopilotOrchestrator = "AutopilotOrchestrator";
+
+    /// <summary>Board — turns lessons into the project's practices.</summary>
+    public const string Retrospective = "Retrospective";
+
+    /// <summary>Every role: Board agents first (in the order a ticket meets them), then the Workflow pipeline.</summary>
+    public static IReadOnlyList<AgentRoleInfo> All { get; } =
+    [
+        new(Discovery, "Discovery", AgentRoleGroup.Board, "New idea: turns an idea into a requirement and right-sized tickets."),
+        new(IssueWork, "Coding (tickets)", AgentRoleGroup.Board, "Implements a ticket: clone, change, build, test, push a branch."),
+        new(Reviewer, "Reviewer", AgentRoleGroup.Board, "Reviews a proposed change before it is tested; must-fix findings go back to Coding."),
+        new(Acceptance, "Testing (tickets)", AgentRoleGroup.Board, "Tests a proposed change against its ticket's acceptance criteria."),
+        new(AutopilotOrchestrator, "Autopilot lead", AgentRoleGroup.Board, "Decides what Autopilot does next on a board: starts, retries, questions, closes."),
+        new(Retrospective, "Retrospective", AgentRoleGroup.Board, "After a merge, turns lessons into the project's practices."),
+        new(Orchestrator, "Orchestrator (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Coordinates the 5-agent Workflow pipeline."),
+        new(Requirement, "Requirement (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Turns a user story into a requirement spec."),
+        new(Coding, "Coding (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Writes code for a requirement spec."),
+        new(Testing, "Testing (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Writes tests for the generated code."),
+        new(Qa, "QA (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Scores requirement, code and test consistency."),
+    ];
+
+    private static readonly FrozenDictionary<string, AgentRoleInfo> ByKey =
+        All.ToFrozenDictionary(r => r.Key, StringComparer.OrdinalIgnoreCase);
+
+    // Names stored before the registry existed, mapped to today's key: the pipeline agents file metrics under their type
+    // name ("CodingAgent"), the decomposer used its own name, and the Board's Testing runs were labelled "Testing".
+    private static readonly FrozenDictionary<string, string> Aliases = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+    {
+        ["Decomposer"] = Discovery,
+        ["TicketDecomposer"] = Discovery,
+        ["TicketDecomposerAgent"] = Discovery,
+        ["IssueWorkAgent"] = IssueWork,
+        ["ReviewAgent"] = Reviewer,
+        ["AcceptanceAgent"] = Acceptance,
+        ["AutopilotOrchestratorAgent"] = AutopilotOrchestrator,
+        ["RetrospectiveAgent"] = Retrospective,
+        ["PipelineOrchestrator"] = Orchestrator,
+    }.ToFrozenDictionary(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>The role for <paramref name="key"/>, or null when it is not a registered role.</summary>
+    public static AgentRoleInfo? Find(string? key) =>
+        key is not null && ByKey.TryGetValue(key, out var info) ? info : null;
+
+    /// <summary>The registered key for a stored agent name ("CodingAgent" → "Coding", "Decomposer" → "Discovery"); an
+    /// unknown name comes back trimmed, without a trailing "Agent".</summary>
+    public static string Canonical(string? agentName)
+    {
+        var name = (agentName ?? string.Empty).Trim();
+        if (name.Length == 0) { return name; }
+        if (Aliases.TryGetValue(name, out var alias)) { return alias; }
+        if (ByKey.TryGetValue(name, out var exact)) { return exact.Key; }
+        var stripped = name.EndsWith("Agent", StringComparison.Ordinal) && name.Length > "Agent".Length ? name[..^"Agent".Length].Trim() : name;
+        return ByKey.TryGetValue(stripped, out var info) ? info.Key : stripped;
+    }
+
+    /// <summary>The name people see for a stored agent name (the registry label, or the name itself).</summary>
+    public static string Label(string? agentName)
+    {
+        var key = Canonical(agentName);
+        return ByKey.TryGetValue(key, out var info) ? info.Label : key;
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentRunScope.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentRunScope.cs
new file mode 100644
index 00000000..7863f012
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentRunScope.cs
@@ -0,0 +1,56 @@
+// A Board agent that reuses a Workflow-pipeline specialist (New idea's Discovery runs the Requirement agent) opens a
+// scope around that call: the specialist then resolves the Board role's profile instead of its own, files its call
+// under the Board role (Insights groups by it), and passes the budget gate the Board agents pass. Its prompt and output
+// contract stay the specialist's own. AsyncLocal: the scope covers exactly the awaited call chain that opened it.
+
+using System;
+using System.Threading;
+using AgentOs.Domain.Cost;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Runs the specialist agents of this async flow as <see cref="Role"/>.</summary>
+public sealed class AgentRunScope : IDisposable
+{
+    private static readonly AsyncLocal<AgentRunScope?> CurrentScope = new();
+
+    private readonly AgentRunScope? _previous;
+    private bool _disposed;
+
+    private AgentRunScope(string role, AgentOptions? fallback, IBudgetGuard? budget, AgentRunScope? previous)
+    {
+        Role = role;
+        Fallback = fallback;
+        Budget = budget;
+        _previous = previous;
+    }
+
+    /// <summary>The open scope of this flow, or null.</summary>
+    public static AgentRunScope? Current => CurrentScope.Value;
+
+    /// <summary>The role key (an <see cref="AgentRoles"/> key) whose profile and metrics name apply.</summary>
+    public string Role { get; }
+
+    /// <summary>The role's seed profile when no settings registry is wired; null = the specialist's own.</summary>
+    public AgentOptions? Fallback { get; }
+
+    /// <summary>The budget gate the calls pass (null = none).</summary>
+    public IBudgetGuard? Budget { get; }
+
+    /// <summary>Open a scope for this async flow; dispose to close it.</summary>
+    public static AgentRunScope Begin(string role, AgentOptions? fallback = null, IBudgetGuard? budget = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(role);
+        var scope = new AgentRunScope(role, fallback, budget, CurrentScope.Value);
+        CurrentScope.Value = scope;
+        return scope;
+    }
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        if (_disposed) { return; }
+        _disposed = true;
+        CurrentScope.Value = _previous;
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
index 5e3498ed..b6ab7b2b 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
@@ -3,8 +3,10 @@
 // AgentsOptions / PipelineOptions so the registry and the code defaults cannot drift. Keys match the
 // existing appsettings paths, so current deployments seed straight in.
 
+using System;
 using System.Collections.Generic;
 using System.Globalization;
+using System.Linq;
 using AgentOs.Domain.Configuration;
 using AgentOs.Domain.Llm;
 using AgentOs.Modules.Pipeline.Pipeline;
@@ -27,7 +29,12 @@ public sealed class AgentSettings : ISettingsContributor
     /// limit is enforced against the model catalog; this is the absolute ceiling.</summary>
     public const int MaxOutputTokensCeiling = 128_000;
 
-    /// <summary>Agent roles in pipeline order, paired with their code defaults.</summary>
+    /// <summary>What an empty Board-agent model means ("Computer's default" in Agent profiles).</summary>
+    public const string ComputersDefaultHelp =
+        "Empty = the computer's own model (the member's CLI default). On our servers: the provider's model from Settings → Model keys.";
+
+    /// <summary>Every agent role (Board agents first, then the Workflow pipeline — see <see cref="AgentRoles"/>), paired
+    /// with its code defaults.</summary>
     public static IReadOnlyList<(string Role, AgentOptions Defaults)> Roles { get; } = BuildRoles();
 
     /// <summary>Setting key for <paramref name="role"/>'s <paramref name="field"/> (Provider/Model/Temperature/MaxTokens).</summary>
@@ -38,23 +45,26 @@ public IEnumerable<SettingDescriptor> Describe()
     {
         foreach (var (role, d) in Roles)
         {
-            yield return new(Key(role, nameof(AgentOptions.Provider)), SettingKind.Choice, Category, $"{role} · provider")
+            var label = AgentRoles.Label(role);
+            yield return new(Key(role, nameof(AgentOptions.Provider)), SettingKind.Choice, Category, $"{label} · provider")
             {
                 DefaultValue = d.Provider,
                 Choices = LlmProviders.Selectable,
             };
-            yield return new(Key(role, nameof(AgentOptions.Model)), SettingKind.Model, Category, $"{role} · model")
+            yield return new(Key(role, nameof(AgentOptions.Model)), SettingKind.Model, Category, $"{label} · model")
             {
-                DefaultValue = d.Model,
+                // No default model (a Board agent) = "Computer's default" — not an empty-string value.
+                DefaultValue = string.IsNullOrWhiteSpace(d.Model) ? null : d.Model,
+                Help = AgentsOptions.ModelIsOptional(role) ? ComputersDefaultHelp : null,
             };
-            yield return new(Key(role, nameof(AgentOptions.Temperature)), SettingKind.Number, Category, $"{role} · temperature")
+            yield return new(Key(role, nameof(AgentOptions.Temperature)), SettingKind.Number, Category, $"{label} · temperature")
             {
                 DefaultValue = d.Temperature.ToString(CultureInfo.InvariantCulture),
                 Min = 0m,
                 Max = 2m,
                 Help = "Ignored by models that reject sampling parameters (Claude 4.7+/5.x, GPT-5+).",
             };
-            yield return new(Key(role, nameof(AgentOptions.MaxTokens)), SettingKind.WholeNumber, Category, $"{role} · max output tokens")
+            yield return new(Key(role, nameof(AgentOptions.MaxTokens)), SettingKind.WholeNumber, Category, $"{label} · max output tokens")
             {
                 DefaultValue = d.MaxTokens.ToString(CultureInfo.InvariantCulture),
                 Min = 1m,
@@ -72,18 +82,11 @@ public IEnumerable<SettingDescriptor> Describe()
         };
     }
 
+    // One row per registered role, each seeded from AgentsOptions (a role without a seed is a startup bug).
     private static List<(string, AgentOptions)> BuildRoles()
     {
         var o = new AgentsOptions();
-        return
-        [
-            (nameof(AgentsOptions.Orchestrator), o.Orchestrator),
-            (nameof(AgentsOptions.Requirement), o.Requirement),
-            (nameof(AgentsOptions.Coding), o.Coding),
-            (nameof(AgentsOptions.Testing), o.Testing),
-            (nameof(AgentsOptions.Qa), o.Qa),
-            (nameof(AgentsOptions.IssueWork), o.IssueWork),
-            (nameof(AgentsOptions.Decomposer), o.Decomposer),
-        ];
+        return [.. AgentRoles.All.Select(r =>
+            (r.Key, o.For(r.Key) ?? throw new InvalidOperationException($"AgentsOptions has no seed for agent role '{r.Key}'.")))];
     }
 }
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
index 63c7d712..bbd977f0 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
@@ -1,47 +1,95 @@
 // AgentOs.Application/Agents/AgentsOptions.cs
-// Phase 3 — Options binding for per-agent configuration (the "Agents" section in appsettings).
+// Seed defaults for every agent profile (the "Agents" section; appsettings is bootstrap-only — ADR-0011). Property
+// names ARE the role keys of AgentRoles, so Agents:<Key>:* binds here and seeds Settings → Agent profiles.
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <summary>
-/// Configuration for the set of 5 agents — bound from the <c>"Agents"</c> section.
+/// Per-agent configuration — bound from the <c>"Agents"</c> section. One property per <see cref="AgentRoles"/> key.
 /// </summary>
 public sealed class AgentsOptions
 {
     /// <summary>Section name for <c>Configuration.GetSection</c>.</summary>
     public const string SectionName = "Agents";
 
-    /// <summary>Orchestrator configuration.</summary>
+    // The Board agents that need a real machine (a checkout, a browser, the repo's toolchain) or answer from one run
+    // on the member's paired computer by default — 0 server tokens.
+    private const string MembersComputer = "RemoteAgent";
+
+    // Board agents choose NO model by default (ComputersDefault): on a member's computer the CLI runs its own model (the
+    // member's choice, usually newer than any id we would pin); on our servers the provider's configured model applies
+    // (Settings → Model keys / Llm:<Provider>:Model, resolved in the LLM gateway). Picking a model in Agent profiles
+    // passes it explicitly (claude --model / codex -m on a computer).
+    private const string ComputersDefault = "";
+
+    /// <summary>Workflow pipeline — Orchestrator configuration.</summary>
     public AgentOptions Orchestrator { get; set; } = new() { Model = "claude-haiku-4-5", Temperature = 0.3, MaxTokens = 2000 };
 
-    /// <summary>RequirementAgent configuration.</summary>
+    /// <summary>Workflow pipeline — RequirementAgent configuration.</summary>
     public AgentOptions Requirement { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.1, MaxTokens = 2000 };
 
-    /// <summary>CodingAgent configuration.</summary>
+    /// <summary>Workflow pipeline — CodingAgent configuration.</summary>
     public AgentOptions Coding { get; set; } = new() { Provider = "AzureOpenAI", Model = "gpt-4.1", Temperature = 0.2, MaxTokens = 4000 };
 
-    /// <summary>TestingAgent configuration.</summary>
+    /// <summary>Workflow pipeline — TestingAgent configuration.</summary>
     public AgentOptions Testing { get; set; } = new() { Provider = "AzureOpenAI", Model = "gpt-4o-mini", Temperature = 0.2, MaxTokens = 3000 };
 
-    /// <summary>QaAgent configuration.</summary>
+    /// <summary>Workflow pipeline — QaAgent configuration.</summary>
     public AgentOptions Qa { get; set; } = new() { Model = "claude-haiku-4-5", Temperature = 0.1, MaxTokens = 1500 };
 
-    /// <summary>IssueWorkAgent configuration (M5 — agentic issue→PR pipeline).</summary>
-    public AgentOptions IssueWork { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.2, MaxTokens = 32768 };
+    /// <summary>Board — Coding (tickets): IssueWorkAgent, the agentic issue→branch run.</summary>
+    public AgentOptions IssueWork { get; set; } = new() { Model = ComputersDefault, Temperature = 0.2, MaxTokens = 32768 };
+
+    /// <summary>Board — Discovery (New idea): the requirement step and the ticket split (TicketDecomposerAgent).</summary>
+    public AgentOptions Discovery { get; set; } = new() { Model = ComputersDefault, Temperature = 0.2, MaxTokens = 4000 };
+
+    /// <summary>Board — Reviewer (ReviewAgent). Reads the change in a checkout on the member's computer.</summary>
+    public AgentOptions Reviewer { get; set; } = new() { Provider = MembersComputer, Model = ComputersDefault, Temperature = 0, MaxTokens = 32768 };
+
+    /// <summary>Board — Testing (tickets): AcceptanceAgent. Builds and tests the change on the member's computer.</summary>
+    public AgentOptions Acceptance { get; set; } = new() { Provider = MembersComputer, Model = ComputersDefault, Temperature = 0, MaxTokens = 32768 };
+
+    /// <summary>Board — Autopilot lead (AutopilotOrchestratorAgent). Answer-only.</summary>
+    public AgentOptions AutopilotOrchestrator { get; set; } = new() { Provider = MembersComputer, Model = ComputersDefault, Temperature = 0, MaxTokens = 4096 };
+
+    /// <summary>Board — Retrospective (RetrospectiveAgent). Answer-only.</summary>
+    public AgentOptions Retrospective { get; set; } = new() { Provider = MembersComputer, Model = ComputersDefault, Temperature = 0, MaxTokens = 4096 };
+
+    /// <summary>True when <paramref name="role"/> may leave its model empty ("the computer's default"): the Board agents.</summary>
+    public static bool ModelIsOptional(string role) => AgentRoles.Find(role)?.Group == AgentRoleGroup.Board;
+
+    /// <summary>The seed profile for <paramref name="role"/> (an <see cref="AgentRoles"/> key), or null when unknown.</summary>
+    public AgentOptions? For(string role) => role switch
+    {
+        AgentRoles.Orchestrator => Orchestrator,
+        AgentRoles.Requirement => Requirement,
+        AgentRoles.Coding => Coding,
+        AgentRoles.Testing => Testing,
+        AgentRoles.Qa => Qa,
+        AgentRoles.IssueWork => IssueWork,
+        AgentRoles.Discovery => Discovery,
+        AgentRoles.Reviewer => Reviewer,
+        AgentRoles.Acceptance => Acceptance,
+        AgentRoles.AutopilotOrchestrator => AutopilotOrchestrator,
+        AgentRoles.Retrospective => Retrospective,
+        _ => null,
+    };
 
-    /// <summary>TicketDecomposerAgent configuration (bootstrap — RequirementSpec → board tickets).</summary>
-    public AgentOptions Decomposer { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.2, MaxTokens = 4000 };
+    /// <summary>Startup validation: every agent has a provider, Temperature in [0, 2] and MaxTokens &gt; 0; every
+    /// Workflow-pipeline agent has a model (a Board agent may leave it empty — see <see cref="ModelIsOptional"/>).</summary>
+    public bool IsValid() => AgentRoles.All.All(r => For(r.Key) is { } a
+        && !string.IsNullOrWhiteSpace(a.Provider)
+        && (ModelIsOptional(r.Key) || !string.IsNullOrWhiteSpace(a.Model))
+        && a.Temperature is >= 0 and <= 2
+        && a.MaxTokens > 0);
 
     /// <summary>Every configured agent, for cross-cutting checks (startup validation).</summary>
     public IEnumerable<AgentOptions> All()
     {
-        yield return Orchestrator;
-        yield return Requirement;
-        yield return Coding;
-        yield return Testing;
-        yield return Qa;
-        yield return IssueWork;
-        yield return Decomposer;
+        foreach (var role in AgentRoles.All)
+        {
+            if (For(role.Key) is { } options) { yield return options; }
+        }
     }
 }
 
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AutopilotOrchestratorAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/AutopilotOrchestratorAgent.cs
index 7389bd8f..c3782a57 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AutopilotOrchestratorAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AutopilotOrchestratorAgent.cs
@@ -1,6 +1,8 @@
 // The Orchestrator agent — Autopilot's decision maker (see IAutopilotOrchestrator). It answers on the member's paired
 // computer in answer-only mode (no tools: it reasons over the brief and replies with JSON), so it costs no API tokens.
-// Every move it picks is re-checked by the caller against the rules before anything runs.
+// Every move it picks is re-checked by the caller against the rules before anything runs. Its profile (Settings →
+// Agent profiles, role "AutopilotOrchestrator" — "Autopilot lead"), its prompt (Settings → Prompts) and the budget gate
+// apply like every other agent's, and it reads the board's project practices.
 
 using System;
 using System.Collections.Generic;
@@ -10,14 +12,21 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
 using AgentOs.Domain.Llm;
+using AgentOs.Domain.Memory;
 using AgentOs.Domain.Sessions;
+using AgentOs.Domain.Workspaces;
+using AgentOs.Modules.Pipeline.Prompts;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <inheritdoc cref="IAutopilotOrchestrator"/>
-public sealed class AutopilotOrchestratorAgent(ILlmClientFactory factory, ILogger<AutopilotOrchestratorAgent> logger) : IAutopilotOrchestrator
+public sealed class AutopilotOrchestratorAgent(ILlmClientFactory factory, ILogger<AutopilotOrchestratorAgent> logger,
+    IOptions<AgentsOptions>? options = null, IAgentProfiles? profiles = null, IPromptOverrides? prompts = null,
+    IBudgetGuard? budgetGuard = null, IMemoryStore? memory = null, IBoardRepos? boardRepos = null) : IAutopilotOrchestrator
 {
     private const int MaxGuidanceChars = 2_000;
     private const int MaxQuestionChars = 600;
@@ -56,16 +65,25 @@ Reply ONLY with this JSON (no other text):
     public async Task<OrchestratorDecision> DecideAsync(OrchestratorBrief brief, CancellationToken ct = default)
     {
         ArgumentNullException.ThrowIfNull(brief);
+        // Live profile (Settings → Agent profiles), resolved per call.
+        var profile = await BoardAgent.ProfileAsync(profiles, options, AgentRoles.AutopilotOrchestrator, ct).ConfigureAwait(false);
         ILlmClient llm;
-        try { llm = factory.Create("RemoteAgent"); }
+        try { llm = factory.Create(profile.Provider); }
         catch (Exception ex) when (ex is LlmException or ArgumentException or NotSupportedException or InvalidOperationException)
         {
             return OrchestratorDecision.NotRun($"No computer for the Orchestrator agent: {ex.Message}");
         }
-        var request = new LlmRequest(Instructions + "\n\n" + UntrustedText.SystemRule, User(brief), "claude-sonnet-4-6",
-            MaxTokens: 4096, Timeout: LlmRequest.AgentAnswerTimeout)
+        var provider = AgentBudgetGate.EffectiveProvider(llm, profile.Provider);
+        if (await AgentBudgetGate.BlockedAsync(budgetGuard, brief.TenantId, provider, logger, nameof(AutopilotOrchestratorAgent), ct).ConfigureAwait(false) is not null)
         {
-            AgentRole = "AutopilotOrchestrator",
+            return OrchestratorDecision.NotRun(AgentBudgetGate.BlockedMessage);
+        }
+        var request = new LlmRequest(
+            await BoardAgent.SystemPromptAsync(prompts, AgentRoles.AutopilotOrchestrator, Instructions, null, UntrustedText.SystemRule, ct).ConfigureAwait(false),
+            User(brief) + await PracticesAsync(brief, ct).ConfigureAwait(false),
+            profile.Model, profile.Temperature, profile.MaxTokens, Timeout: LlmRequest.AgentAnswerTimeout)
+        {
+            AgentRole = AgentRoles.AutopilotOrchestrator,
         };
         try
         {
@@ -79,6 +97,21 @@ public async Task<OrchestratorDecision> DecideAsync(OrchestratorBrief brief, Can
         }
     }
 
+    // The practices of the board's repositories: the lead's retry guidance and choices follow them like the agents it runs.
+    private async Task<string> PracticesAsync(OrchestratorBrief brief, CancellationToken ct)
+    {
+        if (memory is null || boardRepos is null) { return string.Empty; }
+        IReadOnlyList<string> repos;
+        try { repos = await boardRepos.RepoKeysAsync(brief.TenantId, brief.BoardId, ct).ConfigureAwait(false); }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning(ex, "Orchestrator agent: listing the board's repositories failed; deciding without the practices.");
+            return string.Empty;
+        }
+        var block = await ProjectPractices.BlockAsync(memory, brief.TenantId, repos, logger, ct).ConfigureAwait(false);
+        return block.Length == 0 ? string.Empty : block + "\nWrite retry guidance that follows these practices.";
+    }
+
     /// <summary>The brief as the agent reads it.</summary>
     internal static string User(OrchestratorBrief b)
     {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/BoardAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/BoardAgent.cs
new file mode 100644
index 00000000..3cf75120
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/BoardAgent.cs
@@ -0,0 +1,44 @@
+// What every Board agent does before its LLM call, in one place: resolve its live profile (Settings → Agent profiles —
+// provider, model, temperature, max output tokens; seeds in AgentsOptions) and its system prompt (Settings → Prompts —
+// the tenant's override of the template or the built-in one, filled per run, then the fixed security rule, then the
+// tenant's workspace rules). Both are read per call, so an edit applies to the next run without a restart.
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Modules.Pipeline.Prompts;
+using Microsoft.Extensions.Options;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Profile and prompt resolution shared by the Board agents.</summary>
+public static class BoardAgent
+{
+    private static readonly AgentsOptions Seeds = new();
+
+    /// <summary>The live profile for <paramref name="role"/>: the settings registry when wired, else the seed.</summary>
+    public static async ValueTask<AgentOptions> ProfileAsync(IAgentProfiles? profiles, IOptions<AgentsOptions>? options, string role,
+        CancellationToken ct)
+    {
+        var seed = (options?.Value ?? Seeds).For(role) ?? Seeds.For(role)
+            ?? throw new ArgumentException($"'{role}' is not a registered agent role.", nameof(role));
+        return profiles is null ? seed : await profiles.ResolveAsync(role, seed, ct).ConfigureAwait(false);
+    }
+
+    /// <summary>
+    /// The system prompt for <paramref name="role"/>: the tenant's override of <paramref name="defaultTemplate"/> (or the
+    /// template itself), its placeholders filled from <paramref name="values"/>, then <paramref name="fixedRules"/> (never
+    /// overridable — e.g. the untrusted-text rule), then the tenant's workspace rules.
+    /// </summary>
+    public static async Task<string> SystemPromptAsync(IPromptOverrides? prompts, string role, string defaultTemplate,
+        IReadOnlyDictionary<string, string>? values, string? fixedRules, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(defaultTemplate);
+        var template = prompts is null ? defaultTemplate : await prompts.ResolveAsync(role, defaultTemplate, ct).ConfigureAwait(false);
+        var text = values is null ? template : PromptTemplate.Fill(template, values);
+        if (!string.IsNullOrEmpty(fixedRules)) { text += "\n\n" + fixedRules; }
+        if (prompts is not null) { text += WorkspaceRules.ToPromptBlock(await prompts.ResolveRulesAsync(ct).ConfigureAwait(false)); }
+        return text;
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/DependencyInjection.cs b/src/AgentOs.Modules.Pipeline/Agents/DependencyInjection.cs
index acadf06d..afa4388c 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/DependencyInjection.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/DependencyInjection.cs
@@ -34,12 +34,8 @@ public static IServiceCollection AddAgents(this IServiceCollection services, ICo
         services.AddOptions<AgentsOptions>()
             .Bind(configuration.GetSection(AgentsOptions.SectionName))
             .Validate(
-                o => o.All().All(a =>
-                    !string.IsNullOrWhiteSpace(a.Provider)
-                    && !string.IsNullOrWhiteSpace(a.Model)
-                    && a.Temperature is >= 0 and <= 2
-                    && a.MaxTokens > 0),
-                "Agents:* — every agent needs a Provider and Model, Temperature in [0, 2], and MaxTokens > 0.")
+                o => o.IsValid(),
+                "Agents:* — every agent needs a Provider, Temperature in [0, 2] and MaxTokens > 0; every Workflow-pipeline agent needs a Model (a Board agent's empty Model = the computer's / provider's default).")
             .ValidateOnStart();
         // UI-first settings (ADR-0011): agent profiles + pipeline knobs, editable in the desktop.
         services.AddSingleton<AgentOs.Domain.Configuration.ISettingsContributor, AgentSettings>();
@@ -47,9 +43,12 @@ public static IServiceCollection AddAgents(this IServiceCollection services, ICo
         services.AddSingleton<AgentOs.Domain.Configuration.ISettingsContributor, Limits.RunLimitSettings>();
         services.TryAddSingleton<AgentOs.Domain.Pipeline.IRunAdmission>(sp =>
             new Limits.RunAdmission(sp.GetService<AgentOs.Domain.Configuration.ISettings>(), sp.GetService<TimeProvider>()));
+        // Values a renamed role saved under its former key (Decomposer → Discovery) keep applying until re-saved.
+        services.TryAddSingleton(sp => new LegacyAgentSettings(
+            sp.GetService<AgentOs.Modules.AppConfig.IAppConfigStore>(), sp.GetService<IConfiguration>()));
         services.AddSingleton<IAgentProfiles>(sp =>
             sp.GetService<AgentOs.Domain.Configuration.ISettings>() is { } settings
-                ? new SettingsAgentProfiles(settings, sp.GetService<IServiceScopeFactory>())
+                ? new SettingsAgentProfiles(settings, sp.GetService<IServiceScopeFactory>(), sp.GetService<LegacyAgentSettings>())
                 : StaticAgentProfiles.Instance);
 
         services.AddOptions<PipelineOptions>()
diff --git a/src/AgentOs.Modules.Pipeline/Agents/IssueWorkAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/IssueWorkAgent.cs
index 6b3c356e..510acb3d 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/IssueWorkAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/IssueWorkAgent.cs
@@ -75,36 +75,16 @@ private void Emit(IssueWorkRequest req, SessionRunEventKind kind, string message
         _feed?.Publish(new SessionRunEvent(req.TenantId, req.SessionId, kind, message, DateTimeOffset.UtcNow, repo));
 
     // S1 — returns a fully-failed IssueWorkResult when the tenant is over its ENFORCED monthly LLM
-    // budget, else null (the run proceeds). Fail-open on a transient store error: a budget-store hiccup
-    // must never block a run — the cap re-applies on the next run once the store recovers.
-    private async Task<IssueWorkResult?> BudgetBlockedAsync(IssueWorkRequest request, CancellationToken ct)
+    // budget and the run would spend server tokens on effectiveProvider, else null (the run proceeds).
+    // Fail-open on a transient store error (see AgentBudgetGate).
+    private async Task<IssueWorkResult?> BudgetBlockedAsync(IssueWorkRequest request, string effectiveProvider, CancellationToken ct)
     {
-        BudgetStatus budget;
-        try
-        {
-            budget = await _budgetGuard!.EvaluateAsync(request.TenantId, ct).ConfigureAwait(false);
-        }
-        catch (Microsoft.EntityFrameworkCore.DbUpdateException ex) { return BudgetEvalFailed(ex); }
-        catch (System.Data.Common.DbException ex) { return BudgetEvalFailed(ex); }
-        catch (TimeoutException ex) { return BudgetEvalFailed(ex); }
-        catch (IOException ex) { return BudgetEvalFailed(ex); }
-        catch (InvalidOperationException ex) { return BudgetEvalFailed(ex); }
-
-        // fail-open: a transient budget-store error must not block a run — log and proceed.
-        IssueWorkResult? BudgetEvalFailed(Exception ex)
-        {
-            _logger.LogWarning(ex, "IssueWorkAgent: budget evaluation failed for tenant {Tenant}; proceeding.", request.TenantId);
-            return null;
-        }
-
-        if (budget is not { State: BudgetState.Exceeded, EnforceOn: true })
+        if (await AgentBudgetGate.BlockedAsync(_budgetGuard, request.TenantId, effectiveProvider, _logger, nameof(IssueWorkAgent), ct)
+                .ConfigureAwait(false) is not { } budget)
         {
             return null;
         }
 
-        _logger.LogWarning(
-            "IssueWorkAgent: blocking session {SessionId} — tenant {Tenant} over monthly LLM budget (${Spent} of ${Cap}).",
-            request.SessionId, request.TenantId, budget.SpentUsd, budget.CapUsd);
         Emit(request, SessionRunEventKind.Step,
             $"Blocked — monthly LLM budget exceeded (${budget.SpentUsd:0.##} of ${budget.CapUsd:0.##}). " +
             "Raise the cap in Settings, or use Run-on-machine (0 server tokens).");
@@ -134,36 +114,8 @@ public async Task<IssueWorkResult> RunAsync(IssueWorkRequest request, Cancellati
         // the CLI-mode prompt + a long dispatch timeout, and the run costs zero server tokens.
         var opts = _profiles is null
             ? _agentOpts
-            : await _profiles.ResolveAsync(nameof(AgentsOptions.IssueWork), _agentOpts, ct).ConfigureAwait(false);
+            : await _profiles.ResolveAsync(AgentRoles.IssueWork, _agentOpts, ct).ConfigureAwait(false);
         var providerName = request.ProviderOverride ?? opts.Provider;
-        var cliMode = providerName.Trim().ToUpperInvariant() is "REMOTEAGENT" or "REMOTE" or "IDE";
-
-        // S1 — server-token budget gate. Server-side runs spend AgentOS.NET's OWN LLM tokens, so they pass
-        // the per-tenant budget gate before the expensive agentic loop (the gap the run-level pipeline
-        // gate in PersistingOrchestratorAgent never covered for this path). CLI/RemoteAgent runs execute
-        // on the member's paired machine and cost ZERO server tokens, so they are exempt.
-        if (!cliMode && _budgetGuard is not null)
-        {
-            var blocked = await BudgetBlockedAsync(request, ct).ConfigureAwait(false);
-            if (blocked is not null)
-            {
-                return blocked;
-            }
-        }
-
-        // E0.6: per-tenant admission (concurrency + burst) — applies to CLI runs too (they hold a runner + a session).
-        using var lease = _admission is null ? null : await _admission.AdmitAsync(request.TenantId, ct).ConfigureAwait(false);
-        if (lease is { Admitted: false })
-        {
-            Emit(request, SessionRunEventKind.Step, "Blocked — " + lease.Reason);
-            return new IssueWorkResult(false,
-                request.Repos.Select(r => new RepoWorkOutcome(r.SessionRepoId, false, r.Owner, r.Repo, "", "", lease.Reason)).ToList(),
-                lease.Reason);
-        }
-
-        Emit(request, SessionRunEventKind.Running, cliMode
-            ? $"Running on your machine's CLI — {request.Repos.Count} repo(s), 0 server tokens."
-            : $"Dispatched to runner — {request.Repos.Count} repo(s).");
 
         ILlmClient llm;
         try
@@ -186,6 +138,33 @@ IssueWorkResult LlmInitFailed(Exception ex)
             return new IssueWorkResult(false, failed, $"LLM client init failed: {ex.Message}");
         }
 
+        // CLI mode and the budget gate follow the EFFECTIVE provider (after Settings' force-provider), not the name asked for.
+        var effective = AgentBudgetGate.EffectiveProvider(llm, providerName);
+        var cliMode = AgentBudgetGate.RunsOnMembersComputer(effective);
+
+        // S1 — server-token budget gate. Server-side runs spend AgentOS.NET's OWN LLM tokens, so they pass
+        // the per-tenant budget gate before the expensive agentic loop (the gap the run-level pipeline
+        // gate in PersistingOrchestratorAgent never covered for this path). CLI/RemoteAgent runs execute
+        // on the member's paired machine and cost ZERO server tokens, so they are exempt.
+        if (await BudgetBlockedAsync(request, effective, ct).ConfigureAwait(false) is { } blocked)
+        {
+            return blocked;
+        }
+
+        // E0.6: per-tenant admission (concurrency + burst) — applies to CLI runs too (they hold a runner + a session).
+        using var lease = _admission is null ? null : await _admission.AdmitAsync(request.TenantId, ct).ConfigureAwait(false);
+        if (lease is { Admitted: false })
+        {
+            Emit(request, SessionRunEventKind.Step, "Blocked — " + lease.Reason);
+            return new IssueWorkResult(false,
+                request.Repos.Select(r => new RepoWorkOutcome(r.SessionRepoId, false, r.Owner, r.Repo, "", "", lease.Reason)).ToList(),
+                lease.Reason);
+        }
+
+        Emit(request, SessionRunEventKind.Running, cliMode
+            ? $"Running on your machine's CLI — {request.Repos.Count} repo(s), 0 server tokens."
+            : $"Dispatched to runner — {request.Repos.Count} repo(s).");
+
         // Run repos with bounded concurrency. Each repo is an independent LLM run with its own
         // working_dir on the runner, so they don't collide; the broker dispatches per-call (GUID
         // ToolCallId) so concurrent runner_shell calls are safe. A semaphore caps fan-out to keep the
@@ -253,11 +232,17 @@ private async Task<RepoWorkOutcome> RunOneAsync(ILlmClient llm, AgentOptions opt
         // expose no server tools, and grant a long timeout for the full clone→build→test→push run.
         // E1.6: the tenant's workspace rules apply to the Quick engine too (server and CLI mode).
         var rules = _prompts is null ? string.Empty : WorkspaceRules.ToPromptBlock(await _prompts.ResolveRulesAsync(ct).ConfigureAwait(false));
+        // Settings → Prompts: the tenant's override of this mode's template (or the built-in one), filled per repo.
+        var template = _prompts is null
+            ? null
+            : cliMode
+                ? await _prompts.ResolveAsync(AgentRoles.IssueWork, IssueWorkPrompt.CliTemplate, ct).ConfigureAwait(false)
+                : await _prompts.ResolveAsync(IssueWorkPrompt.ServerPromptKey, IssueWorkPrompt.ServerTemplate, ct).ConfigureAwait(false);
         // Knowledge graph: the lessons earlier work on this repo left behind (reviews, failing checks, acceptance tests).
         var lessons = await RecallLessonsAsync(request, repo, ct).ConfigureAwait(false);
         var req = cliMode
             ? new LlmRequest(
-                SystemPrompt: IssueWorkPrompt.SystemCli(request, repo) + rules,
+                SystemPrompt: IssueWorkPrompt.SystemCli(request, repo, template) + rules,
                 UserPrompt: IssueWorkPrompt.User(request, repo) + lessons,
                 Model: opts.Model,
                 Temperature: opts.Temperature,
@@ -266,6 +251,7 @@ private async Task<RepoWorkOutcome> RunOneAsync(ILlmClient llm, AgentOptions opt
                 Timeout: CliRunTimeout,
                 Cli: request.CliProfile)
             {
+                AgentRole = AgentRoles.IssueWork,
                 // The only request that asks the runner for hands: clone → edit → build → test → push in its own
                 // per-run directory. Every other remote call stays answer-only.
                 Autonomy = WorkspaceAutonomy.Scoped,
@@ -279,12 +265,15 @@ private async Task<RepoWorkOutcome> RunOneAsync(ILlmClient llm, AgentOptions opt
                 }),
             }
             : new LlmRequest(
-                SystemPrompt: IssueWorkPrompt.System(request, repo) + rules,
+                SystemPrompt: IssueWorkPrompt.System(request, repo, template) + rules,
                 UserPrompt: IssueWorkPrompt.User(request, repo) + lessons,
                 Model: opts.Model,
                 Temperature: opts.Temperature,
                 MaxTokens: opts.MaxTokens,
-                Tools: ["runner_shell"]);
+                Tools: ["runner_shell"])
+            {
+                AgentRole = AgentRoles.IssueWork,
+            };
 
         try
         {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/LegacyAgentSettings.cs b/src/AgentOs.Modules.Pipeline/Agents/LegacyAgentSettings.cs
new file mode 100644
index 00000000..e80b0329
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/LegacyAgentSettings.cs
@@ -0,0 +1,89 @@
+// Keys an agent role had before the one-agent registry. "Decomposer" became "Discovery" (2026-10): a tenant's saved
+// Agents:Decomposer:* profile values (and the platform's, and an appsettings seed) keep working — read only while the
+// Discovery key itself has no stored value. Legacy keys are no longer declared in the settings registry (they would
+// show up as extra rows in Settings search), so they are read straight from the same rows SettingsService writes:
+// the tenant row, then the platform row, then the bootstrap configuration. Read-only, except a Reset in Agent profiles
+// also clears the tenant's legacy rows so the inherited value really comes back.
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Modules.AppConfig;
+using AgentOs.Modules.AppConfig.Settings;
+using Microsoft.Extensions.Configuration;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Reads (and resets) the values a role stored under its former key.</summary>
+public sealed class LegacyAgentSettings
+{
+    /// <summary>The former key of the Discovery role (profile key and prompt key).</summary>
+    public const string Decomposer = "Decomposer";
+
+    private static readonly string[] Fields =
+        [nameof(AgentOptions.Provider), nameof(AgentOptions.Model), nameof(AgentOptions.Temperature), nameof(AgentOptions.MaxTokens)];
+
+    private readonly IAppConfigStore? _store;
+    private readonly IConfiguration? _config;
+
+    /// <summary>Create. Without a store or configuration there is nothing legacy to read.</summary>
+    public LegacyAgentSettings(IAppConfigStore? store = null, IConfiguration? config = null)
+    {
+        _store = store;
+        _config = config;
+    }
+
+    /// <summary>The former key of <paramref name="role"/>, or null when it was never renamed.</summary>
+    public static string? LegacyRoleOf(string role) =>
+        string.Equals(role, AgentRoles.Discovery, StringComparison.Ordinal) ? Decomposer : null;
+
+    /// <summary><paramref name="role"/>'s <paramref name="field"/> saved under its former key (tenant → platform →
+    /// configuration), or null. Never throws: a store failure is "nothing legacy".</summary>
+    public async ValueTask<string?> ReadAsync(string role, string field, string? tenantId, CancellationToken ct = default)
+    {
+        if (LegacyRoleOf(role) is not { } legacy) { return null; }
+        var key = AgentSettings.Key(legacy, field);
+        if (_store is not null)
+        {
+            try
+            {
+                if (!string.IsNullOrWhiteSpace(tenantId)
+                    && await _store.GetForTenantAsync(tenantId, key, ct).ConfigureAwait(false) is { } t && !string.IsNullOrWhiteSpace(t))
+                {
+                    return t.Trim();
+                }
+                if (await _store.GetForTenantAsync(SettingsService.PlatformTenant, SettingsService.PlatformPrefix + key, ct).ConfigureAwait(false) is { } p
+                    && !string.IsNullOrWhiteSpace(p))
+                {
+                    return p.Trim();
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                _ = ex; // a legacy value is a courtesy: a failing store never breaks the current key's resolution
+            }
+        }
+        return _config?[key] is { } seed && !string.IsNullOrWhiteSpace(seed) ? seed.Trim() : null;
+    }
+
+    /// <summary>True when <paramref name="tenantId"/> (or the platform/configuration) still holds any legacy value of
+    /// <paramref name="role"/> — Agent profiles says so on the row.</summary>
+    public async ValueTask<bool> AnyAsync(string role, string? tenantId, CancellationToken ct = default)
+    {
+        foreach (var field in Fields)
+        {
+            if (await ReadAsync(role, field, tenantId, ct).ConfigureAwait(false) is not null) { return true; }
+        }
+        return false;
+    }
+
+    /// <summary>Delete the tenant's own legacy rows of <paramref name="role"/> (Agent profiles → Reset).</summary>
+    public async ValueTask ClearTenantAsync(string role, string tenantId, CancellationToken ct = default)
+    {
+        if (_store is null || LegacyRoleOf(role) is not { } legacy || string.IsNullOrWhiteSpace(tenantId)) { return; }
+        foreach (var field in Fields)
+        {
+            await _store.DeleteForTenantAsync(tenantId, AgentSettings.Key(legacy, field), ct).ConfigureAwait(false);
+        }
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/LlmAgentBase.cs b/src/AgentOs.Modules.Pipeline/Agents/LlmAgentBase.cs
index c0478032..5509c12c 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/LlmAgentBase.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/LlmAgentBase.cs
@@ -101,17 +101,28 @@ protected async Task<TResult> ExecuteAsync<TDto, TResult>(
         }
 
         // Resolve the live profile per call (an edit in Settings applies to the next call) and pick the client
-        // for its provider — never frozen at construction.
+        // for its provider — never frozen at construction. A Board agent that reuses this specialist (Discovery runs
+        // the Requirement agent) opens an AgentRunScope: its role's profile, metrics name and budget gate apply.
+        var run = AgentRunScope.Current;
+        var role = run?.Role ?? PromptKey;
+        var fallback = run?.Fallback ?? _options;
         var profile = _profiles is null
-            ? _options
-            : await _profiles.ResolveAsync(PromptKey, _options, ct).ConfigureAwait(false);
+            ? fallback
+            : await _profiles.ResolveAsync(role, fallback, ct).ConfigureAwait(false);
         var llm = _factory.Create(profile.Provider);
+        if (run?.Budget is { } budget
+            && await AgentBudgetGate.BlockedAsync(budget, null, AgentBudgetGate.EffectiveProvider(llm, profile.Provider), Logger, AgentName, ct)
+                .ConfigureAwait(false) is not null)
+        {
+            throw new LlmException(AgentBudgetGate.BlockedMessage, AgentName);
+        }
 
         var request = new LlmRequest(systemPrompt, userPrompt, profile.Model, profile.Temperature, profile.MaxTokens)
         {
-            // Carry the fixed agent role out-of-band so providers (notably the offline one) can identify the
-            // agent without parsing the system prompt — robust against per-tenant prompt overrides.
-            AgentRole = PromptKey,
+            // Carry the agent role out-of-band so providers (notably the offline one) can identify the agent without
+            // parsing the system prompt — robust against per-tenant prompt overrides — and Insights files the call
+            // under it.
+            AgentRole = role,
             Timeout = LlmRequest.AgentAnswerTimeout,
         };
         var response = await llm.SendAsync(request, ct).ConfigureAwait(false);
diff --git a/src/AgentOs.Modules.Pipeline/Agents/ProjectPractices.cs b/src/AgentOs.Modules.Pipeline/Agents/ProjectPractices.cs
new file mode 100644
index 00000000..a2c013d2
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/ProjectPractices.cs
@@ -0,0 +1,46 @@
+// The project's practices (what the Retrospective agent distilled from reviews, failing checks and acceptance tests),
+// read by every agent that works on a project: Coding (tickets), Reviewer, Testing (tickets) and the Autopilot lead.
+// One helper so they all read the same list the same way — bounded, fenced as data, best-effort.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Memory;
+using Microsoft.Extensions.Logging;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Reads a project's practices as a prompt block.</summary>
+public static class ProjectPractices
+{
+    /// <summary>Most repositories whose practices one prompt carries (a board's agent reads at most this many).</summary>
+    public const int MaxRepos = 5;
+
+    /// <summary>
+    /// The practices of <paramref name="repoKeys"/> (<c>owner/repo</c>) as one <see cref="ProjectMemory.PracticesBlock"/>,
+    /// or empty when there are none. Never throws (a memory failure is no practices); strictly per tenant.
+    /// </summary>
+    public static async Task<string> BlockAsync(IMemoryStore? memory, string tenantId, IEnumerable<string> repoKeys,
+        ILogger logger, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(repoKeys);
+        ArgumentNullException.ThrowIfNull(logger);
+        if (memory is null || string.IsNullOrWhiteSpace(tenantId)) { return string.Empty; }
+        try
+        {
+            var all = new List<MemoryNode>();
+            foreach (var repo in repoKeys.Where(r => !string.IsNullOrWhiteSpace(r)).Distinct(StringComparer.OrdinalIgnoreCase).Take(MaxRepos))
+            {
+                all.AddRange(await memory.ListAsync(tenantId, repo, MemoryKinds.Practice, RetrospectiveAgent.MaxPractices, ct).ConfigureAwait(false));
+            }
+            return ProjectMemory.PracticesBlock(all);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning(ex, "Reading the project's practices failed; the agent works without them.");
+            return string.Empty;
+        }
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/RetrospectiveAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/RetrospectiveAgent.cs
index 47c8b112..6ddc1e9b 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/RetrospectiveAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/RetrospectiveAgent.cs
@@ -1,6 +1,8 @@
 // The Retrospective agent (see IRetrospectiveAgent). Answer-only on the member's paired computer — it reasons over the
 // lessons it is given and replies with JSON — so it costs no API tokens. The caller keeps the guardrails: pinned
-// practices stay, absorbed ids must be lessons it was shown, and an empty answer never wipes the practices.
+// practices stay, absorbed ids must be lessons it was shown, and an empty answer never wipes the practices. Its profile
+// (Settings → Agent profiles, role "Retrospective"), its prompt (Settings → Prompts) and the budget gate apply like every
+// other agent's.
 
 using System;
 using System.Collections.Generic;
@@ -10,14 +12,19 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
 using AgentOs.Domain.Llm;
 using AgentOs.Domain.Memory;
+using AgentOs.Modules.Pipeline.Prompts;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <inheritdoc cref="IRetrospectiveAgent"/>
-public sealed class RetrospectiveAgent(ILlmClientFactory factory, ILogger<RetrospectiveAgent> logger) : IRetrospectiveAgent
+public sealed class RetrospectiveAgent(ILlmClientFactory factory, ILogger<RetrospectiveAgent> logger,
+    IOptions<AgentsOptions>? options = null, IAgentProfiles? profiles = null, IPromptOverrides? prompts = null,
+    IBudgetGuard? budgetGuard = null) : IRetrospectiveAgent
 {
     /// <summary>Practices a project keeps at most — few enough that every agent reads all of them.</summary>
     public const int MaxPractices = 15;
@@ -49,16 +56,24 @@ public async Task<RetrospectiveResult> RunAsync(RetrospectiveInput input, Cancel
     {
         ArgumentNullException.ThrowIfNull(input);
         if (input.Lessons.Count == 0) { return RetrospectiveResult.NotRun("No new lessons to distil."); }
+        // Live profile (Settings → Agent profiles), resolved per call.
+        var profile = await BoardAgent.ProfileAsync(profiles, options, AgentRoles.Retrospective, ct).ConfigureAwait(false);
         ILlmClient llm;
-        try { llm = factory.Create("RemoteAgent"); }
+        try { llm = factory.Create(profile.Provider); }
         catch (Exception ex) when (ex is LlmException or ArgumentException or NotSupportedException or InvalidOperationException)
         {
             return RetrospectiveResult.NotRun($"No computer for the Retrospective agent: {ex.Message}");
         }
-        var request = new LlmRequest(Instructions + "\n\n" + UntrustedText.SystemRule, User(input), "claude-sonnet-4-6",
-            MaxTokens: 4096, Timeout: LlmRequest.AgentAnswerTimeout)
+        var provider = AgentBudgetGate.EffectiveProvider(llm, profile.Provider);
+        if (await AgentBudgetGate.BlockedAsync(budgetGuard, input.TenantId, provider, logger, nameof(RetrospectiveAgent), ct).ConfigureAwait(false) is not null)
         {
-            AgentRole = "Retrospective",
+            return RetrospectiveResult.NotRun(AgentBudgetGate.BlockedMessage);
+        }
+        var request = new LlmRequest(
+            await BoardAgent.SystemPromptAsync(prompts, AgentRoles.Retrospective, Instructions, null, UntrustedText.SystemRule, ct).ConfigureAwait(false),
+            User(input), profile.Model, profile.Temperature, profile.MaxTokens, Timeout: LlmRequest.AgentAnswerTimeout)
+        {
+            AgentRole = AgentRoles.Retrospective,
         };
         try
         {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/ReviewAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/ReviewAgent.cs
index e6e44152..7f6c2e1e 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/ReviewAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/ReviewAgent.cs
@@ -2,6 +2,8 @@
 // diff against its ticket and the repository's own rules, the way a careful reviewer would, and either approves it or
 // returns must-fix findings that go back to the Coding agent. It runs on the member's paired computer under scoped
 // autonomy (it needs the checkout to read code in context and may build) and never edits, commits or pushes.
+// Its profile (Settings → Agent profiles, role "Reviewer"), its prompt (Settings → Prompts) and the budget gate apply
+// like every other agent's; the seed keeps it on the member's computer (0 server tokens).
 
 using System;
 using System.Collections.Generic;
@@ -10,15 +12,19 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
 using AgentOs.Domain.Llm;
 using AgentOs.Domain.Sessions;
+using AgentOs.Modules.Pipeline.Prompts;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <inheritdoc cref="IReviewAgent"/>
 public sealed class ReviewAgent(ILlmClientFactory factory, ILogger<ReviewAgent> logger, ISessionRunFeed? feed = null,
-    AgentOs.Domain.Memory.IMemoryStore? memory = null) : IReviewAgent
+    AgentOs.Domain.Memory.IMemoryStore? memory = null, IOptions<AgentsOptions>? options = null, IAgentProfiles? profiles = null,
+    IPromptOverrides? prompts = null, IBudgetGuard? budgetGuard = null) : IReviewAgent
 {
     // Reading a diff in context is quicker than testing it; a build fits too.
     private static readonly TimeSpan RunTimeout = TimeSpan.FromMinutes(20);
@@ -32,25 +38,37 @@ public async Task<ReviewVerdict> RunAsync(AcceptanceRequest request, Cancellatio
             return NotRun("There is no proposed change (branch) to review.");
         }
         var repoLabel = $"{request.Repo.Owner}/{request.Repo.Repo}";
-        Emit(request, SessionRunEventKind.Running, $"Reviewing #{request.IssueNumber} on your computer.", repoLabel);
 
+        // Live profile (Settings → Agent profiles), resolved per call.
+        var profile = await BoardAgent.ProfileAsync(profiles, options, AgentRoles.Reviewer, ct).ConfigureAwait(false);
         ILlmClient llm;
-        try { llm = factory.Create("RemoteAgent"); }
+        try { llm = factory.Create(profile.Provider); }
         catch (Exception ex) when (ex is LlmException or ArgumentException or NotSupportedException or InvalidOperationException)
         {
             return NotRun($"No computer to review on: {ex.Message}");
         }
+        var provider = AgentBudgetGate.EffectiveProvider(llm, profile.Provider);
+        if (await AgentBudgetGate.BlockedAsync(budgetGuard, request.TenantId, provider, logger, nameof(ReviewAgent), ct).ConfigureAwait(false) is not null)
+        {
+            return NotRun(AgentBudgetGate.BlockedMessage);
+        }
+        Emit(request, SessionRunEventKind.Running, AgentBudgetGate.RunsOnMembersComputer(provider)
+            ? $"Reviewing #{request.IssueNumber} on your computer."
+            : $"Reviewing #{request.IssueNumber} ({provider}).", repoLabel);
 
         var llmRequest = new LlmRequest(
-            SystemPrompt: Instructions(request) + "\n\n" + UntrustedText.SystemRule,
+            SystemPrompt: await BoardAgent.SystemPromptAsync(prompts, AgentRoles.Reviewer, InstructionsTemplate, AcceptanceAgent.Values(request),
+                UntrustedText.SystemRule, ct).ConfigureAwait(false),
             UserPrompt: AcceptanceAgent.User(request).Replace("Test the change against these criteria and reply with the JSON verdict.",
                 "Review the change against this ticket and reply with the JSON verdict.", StringComparison.Ordinal)
                 + await PracticesAsync(request, ct).ConfigureAwait(false),
-            Model: "claude-sonnet-4-6",
-            MaxTokens: 32768,
+            Model: profile.Model,
+            Temperature: profile.Temperature,
+            MaxTokens: profile.MaxTokens,
             Timeout: RunTimeout,
             Cli: request.CliProfile)
         {
+            AgentRole = AgentRoles.Reviewer,
             Autonomy = WorkspaceAutonomy.Scoped,
             Progress = new InlineProgress<string>(step =>
             {
@@ -72,19 +90,9 @@ public async Task<ReviewVerdict> RunAsync(AcceptanceRequest request, Cancellatio
     // The project's practices: a change that breaks one is a must-fix finding. Best-effort — none on a memory failure.
     private async Task<string> PracticesAsync(AcceptanceRequest request, CancellationToken ct)
     {
-        if (memory is null) { return string.Empty; }
-        try
-        {
-            var practices = await memory.ListAsync(request.TenantId, $"{request.Repo.Owner}/{request.Repo.Repo}",
-                AgentOs.Domain.Memory.MemoryKinds.Practice, RetrospectiveAgent.MaxPractices, ct).ConfigureAwait(false);
-            return practices.Count == 0 ? string.Empty
-                : AgentOs.Domain.Memory.ProjectMemory.PracticesBlock(practices) + "\nA change that breaks one of these practices is a must-fix finding.";
-        }
-        catch (Exception ex) when (ex is not OperationCanceledException)
-        {
-            logger.LogWarning(ex, "Reviewer: reading the practices failed");
-            return string.Empty;
-        }
+        var block = await ProjectPractices.BlockAsync(memory, request.TenantId, [$"{request.Repo.Owner}/{request.Repo.Repo}"], logger, ct)
+            .ConfigureAwait(false);
+        return block.Length == 0 ? string.Empty : block + "\nA change that breaks one of these practices is a must-fix finding.";
     }
 
     private static ReviewVerdict NotRun(string why) => new(false, false, [], why, why);
@@ -92,8 +100,12 @@ private async Task<string> PracticesAsync(AcceptanceRequest request, Cancellatio
     private void Emit(AcceptanceRequest r, SessionRunEventKind kind, string message, string repo) =>
         feed?.Publish(new SessionRunEvent(r.TenantId, r.SessionId, kind, message, DateTimeOffset.UtcNow, repo));
 
-    internal static string Instructions(AcceptanceRequest r) => string.Format(
-        CultureInfo.InvariantCulture,
+    /// <summary>The system prompt for one run (the built-in template, filled).</summary>
+    internal static string Instructions(AcceptanceRequest r) => PromptTemplate.Fill(InstructionsTemplate, AcceptanceAgent.Values(r));
+
+    /// <summary>The built-in system prompt template — placeholders as <see cref="AcceptanceAgent.Placeholders"/> (its first
+    /// line is the agent's routing key).</summary>
+    public const string InstructionsTemplate =
         """
         You are the Reviewer Agent of AgentOS.NET. You review a proposed change before it is tested, the way a careful
         senior reviewer would on its pull request, on the developer's own machine with your native shell and file tools.
@@ -101,10 +113,10 @@ internal static string Instructions(AcceptanceRequest r) => string.Format(
         requests.
 
         1. Get the change. The runner starts you in a fresh, empty directory made for this run:
-           git clone https://github.com/{0}/{1}.git .
-           git fetch origin {2}
-           git checkout {2}
-           git diff origin/{3}...HEAD
+           git clone https://github.com/{owner}/{repo}.git .
+           git fetch origin {branch}
+           git checkout {branch}
+           git diff origin/{defaultBranch}...HEAD
         2. Read the ticket (user message) and the repository's rules (AGENTS.md, CLAUDE.md, README, docs it points to).
         3. Review the diff in context — open the files around each change. Look for, in this order:
            - correctness: does it do what the ticket asks; broken edge cases; wrong logic; regressions;
@@ -120,10 +132,9 @@ repository rule. Only these block the change.
            Do not invent problems; an approval with no findings is a good outcome.
 
         Reply ONLY with this JSON (no other text):
-        {{"verdict":"approve","findings":[{{"severity":"must-fix","file":"<path>","line":42,"comment":"<what is wrong and what to do>"}}],"summary":"<one or two sentences>"}}
+        {"verdict":"approve","findings":[{"severity":"must-fix","file":"<path>","line":42,"comment":"<what is wrong and what to do>"}],"summary":"<one or two sentences>"}
         "verdict" is "approve" when there is no must-fix finding, otherwise "changes".
-        """,
-        r.Repo.Owner, r.Repo.Repo, r.Repo.ExistingBranch, r.Repo.DefaultBranch);
+        """;
 
     /// <summary>Reads the agent's JSON verdict. An approval is only trusted when no finding is must-fix.</summary>
     internal static ReviewVerdict Parse(string content)
diff --git a/src/AgentOs.Modules.Pipeline/Decomposition/IdeaBootstrapService.cs b/src/AgentOs.Modules.Pipeline/Decomposition/IdeaBootstrapService.cs
index d13ae84c..2a973e49 100644
--- a/src/AgentOs.Modules.Pipeline/Decomposition/IdeaBootstrapService.cs
+++ b/src/AgentOs.Modules.Pipeline/Decomposition/IdeaBootstrapService.cs
@@ -35,11 +35,16 @@ internal sealed class IdeaBootstrapService : IIdeaBootstrapService
 {
     private readonly IRequirementAgent _requirement;
     private readonly ITicketDecomposerAgent _decomposer;
+    private readonly AgentOptions? _discovery;
+    private readonly AgentOs.Domain.Cost.IBudgetGuard? _budgetGuard;
 
-    public IdeaBootstrapService(IRequirementAgent requirement, ITicketDecomposerAgent decomposer)
+    public IdeaBootstrapService(IRequirementAgent requirement, ITicketDecomposerAgent decomposer,
+        Microsoft.Extensions.Options.IOptions<AgentsOptions>? options = null, AgentOs.Domain.Cost.IBudgetGuard? budgetGuard = null)
     {
         _requirement = requirement ?? throw new ArgumentNullException(nameof(requirement));
         _decomposer = decomposer ?? throw new ArgumentNullException(nameof(decomposer));
+        _discovery = options?.Value.Discovery;
+        _budgetGuard = budgetGuard;
     }
 
     /// <inheritdoc />
@@ -48,7 +53,13 @@ public async Task<BootstrapPreview> GenerateAsync(string idea, string locale = "
         ArgumentException.ThrowIfNullOrWhiteSpace(idea);
 
         var story = new UserStory(idea, NMax: 1, Locale: string.IsNullOrWhiteSpace(locale) ? "en-US" : locale);
-        var spec = await _requirement.RunAsync(story, cancellationToken).ConfigureAwait(false);
+        // The requirement step is the Discovery agent's: its profile (Settings → Agent profiles, "Discovery"), its name in
+        // Insights and the budget gate — with the Requirement agent's prompt and spec contract.
+        RequirementSpec spec;
+        using (AgentRunScope.Begin(AgentRoles.Discovery, _discovery, _budgetGuard))
+        {
+            spec = await _requirement.RunAsync(story, cancellationToken).ConfigureAwait(false);
+        }
 
         var seed = TicketMapper.Map(spec);
         var tickets = await _decomposer.RunAsync(spec, seed, idea, cancellationToken).ConfigureAwait(false);
diff --git a/src/AgentOs.Modules.Pipeline/Decomposition/TicketDecomposerAgent.cs b/src/AgentOs.Modules.Pipeline/Decomposition/TicketDecomposerAgent.cs
index 6756416a..3ada01cf 100644
--- a/src/AgentOs.Modules.Pipeline/Decomposition/TicketDecomposerAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Decomposition/TicketDecomposerAgent.cs
@@ -41,20 +41,23 @@ public sealed partial class TicketDecomposerAgent : ITicketDecomposerAgent
     private readonly ILogger<TicketDecomposerAgent> _logger;
     private readonly IAgentProfiles? _profiles;
     private readonly AgentOs.Modules.Pipeline.Prompts.IPromptOverrides? _prompts;
+    private readonly AgentOs.Domain.Cost.IBudgetGuard? _budgetGuard;
 
     public TicketDecomposerAgent(
         ILlmClientFactory factory,
         IOptions<AgentsOptions> options,
         ILogger<TicketDecomposerAgent> logger,
         IAgentProfiles? profiles = null,
-        AgentOs.Modules.Pipeline.Prompts.IPromptOverrides? prompts = null)
+        AgentOs.Modules.Pipeline.Prompts.IPromptOverrides? prompts = null,
+        AgentOs.Domain.Cost.IBudgetGuard? budgetGuard = null)
     {
         _prompts = prompts;
         _factory = factory ?? throw new ArgumentNullException(nameof(factory));
         ArgumentNullException.ThrowIfNull(options);
-        _options = options.Value.Decomposer;
+        _options = options.Value.Discovery;
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
         _profiles = profiles;
+        _budgetGuard = budgetGuard;
     }
 
     /// <inheritdoc />
@@ -63,23 +66,30 @@ public async Task<IReadOnlyList<TicketDraft>> RunAsync(RequirementSpec spec, IRe
         ArgumentNullException.ThrowIfNull(spec);
         ArgumentNullException.ThrowIfNull(seed);
 
-        // Live profile (Settings → Agent profiles), resolved per call.
+        // Live profile (Settings → Agent profiles, the "Discovery" row), resolved per call.
         var profile = _profiles is null
             ? _options
-            : await _profiles.ResolveAsync(nameof(AgentsOptions.Decomposer), _options, cancellationToken).ConfigureAwait(false);
+            : await _profiles.ResolveAsync(AgentRoles.Discovery, _options, cancellationToken).ConfigureAwait(false);
         var llm = _factory.Create(profile.Provider);
-        // E1.6: the tenant may override this prompt and its workspace rules apply here too.
-        var system = _prompts is null
-            ? DecomposerPrompt.System
-            : await _prompts.ResolveAsync("Decomposer", DecomposerPrompt.System, cancellationToken).ConfigureAwait(false)
-              + AgentOs.Modules.Pipeline.Prompts.WorkspaceRules.ToPromptBlock(await _prompts.ResolveRulesAsync(cancellationToken).ConfigureAwait(false));
+        // S1 — a split that would spend server tokens passes the tenant's budget gate; blocked → the deterministic seed.
+        if (await AgentBudgetGate.BlockedAsync(_budgetGuard, null, AgentBudgetGate.EffectiveProvider(llm, profile.Provider), _logger, AgentName,
+                cancellationToken).ConfigureAwait(false) is not null)
+        {
+            return seed;
+        }
+        // E1.6: the tenant may override this prompt (Settings → Prompts, "Discovery") and its workspace rules apply here too.
+        var system = await BoardAgent.SystemPromptAsync(_prompts, AgentRoles.Discovery, DecomposerPrompt.System, null, null, cancellationToken)
+            .ConfigureAwait(false);
         var request = new LlmRequest(
             SystemPrompt: system,
             UserPrompt: DecomposerPrompt.RenderUser(spec, seed, idea),
             Model: profile.Model,
             Temperature: profile.Temperature,
             MaxTokens: profile.MaxTokens,
-            Timeout: LlmRequest.AgentAnswerTimeout);
+            Timeout: LlmRequest.AgentAnswerTimeout)
+        {
+            AgentRole = AgentRoles.Discovery,
+        };
 
         try
         {
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/AppConfigPromptOverrides.cs b/src/AgentOs.Modules.Pipeline/Prompts/AppConfigPromptOverrides.cs
index 19067247..48aa622b 100644
--- a/src/AgentOs.Modules.Pipeline/Prompts/AppConfigPromptOverrides.cs
+++ b/src/AgentOs.Modules.Pipeline/Prompts/AppConfigPromptOverrides.cs
@@ -42,6 +42,12 @@ public async Task<string> ResolveAsync(string agentKey, string defaultPrompt, Ca
         {
             var tenant = AmbientIdentity.Current?.TenantId ?? ITenantContext.DefaultTenantId;
             var overridden = await _config.GetForTenantAsync(tenant, Key(agentKey), cancellationToken).ConfigureAwait(false);
+            // A role renamed by the agent registry (Decomposer → Discovery): the override saved under its former key
+            // applies until one is saved under the new key.
+            if (string.IsNullOrWhiteSpace(overridden) && AgentOs.Modules.Pipeline.Agents.LegacyAgentSettings.LegacyRoleOf(agentKey) is { } legacy)
+            {
+                overridden = await _config.GetForTenantAsync(tenant, Key(legacy), cancellationToken).ConfigureAwait(false);
+            }
             return string.IsNullOrWhiteSpace(overridden) ? defaultPrompt : overridden;
         }
         catch (Microsoft.EntityFrameworkCore.DbUpdateException ex) { return OnLookupFailed(ex); }
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/IPromptOverrideService.cs b/src/AgentOs.Modules.Pipeline/Prompts/IPromptOverrideService.cs
index 5d34485d..43171c53 100644
--- a/src/AgentOs.Modules.Pipeline/Prompts/IPromptOverrideService.cs
+++ b/src/AgentOs.Modules.Pipeline/Prompts/IPromptOverrideService.cs
@@ -32,8 +32,15 @@ internal sealed class PromptOverrideService(IAppConfigStore config, TimeProvider
     private readonly IAppConfigStore _config = config ?? throw new ArgumentNullException(nameof(config));
     private readonly TimeProvider _clock = clock ?? TimeProvider.System;
 
+    // A role renamed by the agent registry (Decomposer → Discovery) shows — and applies — the override saved under its
+    // former key until one is saved under the new key; Reset clears both.
     public async Task<string?> GetAsync(string tenantId, string agentKey, CancellationToken cancellationToken = default)
-        => await _config.GetForTenantAsync(tenantId, AppConfigPromptOverrides.Key(agentKey), cancellationToken).ConfigureAwait(false);
+    {
+        var value = await _config.GetForTenantAsync(tenantId, AppConfigPromptOverrides.Key(agentKey), cancellationToken).ConfigureAwait(false);
+        return string.IsNullOrWhiteSpace(value) && Agents.LegacyAgentSettings.LegacyRoleOf(agentKey) is { } legacy
+            ? await _config.GetForTenantAsync(tenantId, AppConfigPromptOverrides.Key(legacy), cancellationToken).ConfigureAwait(false)
+            : value;
+    }
 
     public async Task SetAsync(string tenantId, string agentKey, string prompt, string actor = "admin", CancellationToken cancellationToken = default)
     {
@@ -49,11 +56,20 @@ public async Task SetAsync(string tenantId, string agentKey, string prompt, stri
     public async Task ClearAsync(string tenantId, string agentKey, string actor = "admin", CancellationToken cancellationToken = default)
     {
         await _config.DeleteForTenantAsync(tenantId, AppConfigPromptOverrides.Key(agentKey), cancellationToken).ConfigureAwait(false);
+        if (Agents.LegacyAgentSettings.LegacyRoleOf(agentKey) is { } legacy)
+        {
+            await _config.DeleteForTenantAsync(tenantId, AppConfigPromptOverrides.Key(legacy), cancellationToken).ConfigureAwait(false);
+        }
         await RecordAsync(tenantId, agentKey, actor, string.Empty, cancellationToken).ConfigureAwait(false);
     }
 
     public async Task<IReadOnlyList<PromptVersion>> GetHistoryAsync(string tenantId, string agentKey, CancellationToken cancellationToken = default)
-        => WorkspaceRules.Parse(await _config.GetForTenantAsync(tenantId, WorkspaceRules.HistoryKey(agentKey), cancellationToken).ConfigureAwait(false));
+    {
+        var history = WorkspaceRules.Parse(await _config.GetForTenantAsync(tenantId, WorkspaceRules.HistoryKey(agentKey), cancellationToken).ConfigureAwait(false));
+        return history.Count == 0 && Agents.LegacyAgentSettings.LegacyRoleOf(agentKey) is { } legacy
+            ? WorkspaceRules.Parse(await _config.GetForTenantAsync(tenantId, WorkspaceRules.HistoryKey(legacy), cancellationToken).ConfigureAwait(false))
+            : history;
+    }
 
     private async Task RecordAsync(string tenantId, string agentKey, string actor, string text, CancellationToken ct)
     {
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/IssueWorkPrompt.cs b/src/AgentOs.Modules.Pipeline/Prompts/IssueWorkPrompt.cs
index 52a69112..165a381c 100644
--- a/src/AgentOs.Modules.Pipeline/Prompts/IssueWorkPrompt.cs
+++ b/src/AgentOs.Modules.Pipeline/Prompts/IssueWorkPrompt.cs
@@ -4,7 +4,11 @@
 // On failure it replies with: {"branch":"","summary":"","error":"...reason..."}.
 // For a cross-service ticket (more than one repo) each repo gets its own run, with a note naming the
 // sibling repos so the agent can cross-link the PRs.
+// Both system prompts are templates (named placeholders, PromptTemplate) so a tenant can override them in Settings →
+// Prompts: "IssueWork" (the run on a member's computer — the Board default) and "IssueWork.Server" (the server-side
+// runner_shell loop). The untrusted-text rule is appended by code, never part of the overridable text.
 
+using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.Linq;
@@ -15,24 +19,51 @@ namespace AgentOs.Modules.Pipeline.Prompts;
 
 internal static class IssueWorkPrompt
 {
-    internal static string System(IssueWorkRequest req, WorkRepo repo) => string.Format(
-        CultureInfo.InvariantCulture,
+    /// <summary>Prompt key of the server-side (runner_shell) variant; the member's-computer variant uses the role key.</summary>
+    internal const string ServerPromptKey = "IssueWork.Server";
+
+    /// <summary>The placeholders both templates (and an override of them) may use.</summary>
+    internal static readonly IReadOnlyList<string> Placeholders =
+        ["owner", "repo", "defaultBranch", "issue", "branch", "branchStep", "commitType", "crossServiceNote", "crossLinkCommitNote"];
+
+    /// <summary>The per-run values of <see cref="Placeholders"/>.</summary>
+    internal static Dictionary<string, string> Values(IssueWorkRequest req, WorkRepo repo) => new(StringComparer.Ordinal)
+    {
+        ["owner"] = repo.Owner,
+        ["repo"] = repo.Repo,
+        ["defaultBranch"] = repo.DefaultBranch,
+        ["issue"] = req.IssueNumber.ToString(CultureInfo.InvariantCulture),
+        ["crossServiceNote"] = CrossServiceNote(req, repo),
+        ["crossLinkCommitNote"] = CrossLinkCommitNote(req, repo),
+        ["branchStep"] = BranchStep(req, repo),
+        ["branch"] = BranchName(req, repo),
+        ["commitType"] = CommitType(req),
+    };
+
+    internal static string System(IssueWorkRequest req, WorkRepo repo, string? template = null) =>
+        PromptTemplate.Fill(template ?? ServerTemplate, Values(req, repo)) + SecurityFooter;
+
+    internal static string SystemCli(IssueWorkRequest req, WorkRepo repo, string? template = null) =>
+        PromptTemplate.Fill(template ?? CliTemplate, Values(req, repo)) + SecurityFooter;
+
+    /// <summary>The server-side system prompt template (the LLM drives the paired runner through <c>runner_shell</c>).</summary>
+    internal const string ServerTemplate =
         """
         You are an AI software engineer with shell access to a developer machine where the
-        {0}/{1} repository (default branch: {2}) is checked out.
-        {4}
+        {owner}/{repo} repository (default branch: {defaultBranch}) is checked out.
+        {crossServiceNote}
         Use the `runner_shell` tool to execute shell commands on that machine. Workflow:
 
         1. Discover the repository path: run `pwd`, then `ls`. If the repo is not in the
            current directory, find it with:
-           find ~ -maxdepth 5 -type d -name "{1}" 2>/dev/null | head -1
+           find ~ -maxdepth 5 -type d -name "{repo}" 2>/dev/null | head -1
            Then `cd` into it for all subsequent commands.
 
         2. Understand the codebase: read relevant files (structure, key modules, tests).
            Read only what is needed — do not dump entire file trees.
 
-        {6}
-        4. Implement the fix for ticket #{3}. Edit files directly:
+        {branchStep}
+        4. Implement the fix for ticket #{issue}. Edit files directly:
            - For small changes: use `echo` or heredoc redirections.
            - For larger changes: write a Python/PowerShell one-liner or use `tee`.
            - Prefer minimal, focused changes over large rewrites.
@@ -50,43 +81,33 @@ You are an AI software engineer with shell access to a developer machine where t
 
         7. Commit:
            git add -A
-           git commit -m "{8}: <short description> (#{3})"{5}
+           git commit -m "{commitType}: <short description> (#{issue})"{crossLinkCommitNote}
 
         8. Push:
-           git push origin {7}
+           git push origin {branch}
 
         When the branch is pushed, reply ONLY with this JSON (no other text):
-        {{"branch":"{7}","summary":"<one sentence describing the change>"}}
+        {"branch":"{branch}","summary":"<one sentence describing the change>"}
 
         If you cannot complete the task, reply with:
-        {{"branch":"","summary":"","error":"<brief reason>"}}
-        """,
-        repo.Owner,
-        repo.Repo,
-        repo.DefaultBranch,
-        req.IssueNumber,
-        CrossServiceNote(req, repo),
-        CrossLinkCommitNote(req, repo),
-        BranchStep(req, repo),
-        BranchName(req, repo),
-        CommitType(req)) + SecurityFooter;
+        {"branch":"","summary":"","error":"<brief reason>"}
+        """;
 
     // CLI-mode system prompt — used when the run is routed to the member's paired dev-machine CLI
     // (claude-code / codex) via the RemoteAgent provider. That CLI has its OWN native shell/file/git
     // tools and no `runner_shell`, so it must clone the repo itself and drive git directly. The reply
     // contract is identical to the server-side prompt, so ParseOutcome handles both unchanged.
-    internal static string SystemCli(IssueWorkRequest req, WorkRepo repo) => string.Format(
-        CultureInfo.InvariantCulture,
+    internal const string CliTemplate =
         """
         You are an autonomous coding agent (for example claude-code) running directly on the
         developer's own machine, with native shell, file-editing, and git tools. Do NOT expect any
         server-provided tools — drive the shell, file edits, and git with your own built-in tools.
-        {4}
+        {crossServiceNote}
         Workflow:
 
-        1. Clone the {0}/{1} repository (default branch: {2}). The runner starts you in a fresh, empty directory made for
+        1. Clone the {owner}/{repo} repository (default branch: {defaultBranch}). The runner starts you in a fresh, empty directory made for
            this run — clone INTO it, so every later command runs there without a `cd`:
-           git clone https://github.com/{0}/{1}.git .
+           git clone https://github.com/{owner}/{repo}.git .
            (Only if the current directory is not empty: clone into a new subdirectory and work there.)
            Use the machine's existing git/gh credentials — do NOT embed any token in the URL.
            Stay inside this directory: files outside it and other repositories are off limits.
@@ -94,8 +115,8 @@ You are an autonomous coding agent (for example claude-code) running directly on
         2. Understand the codebase: read the relevant files (structure, key modules, tests).
            Read only what is needed — do not dump entire file trees.
 
-        {6}
-        4. Implement the fix for ticket #{3}. Make minimal, focused edits.
+        {branchStep}
+        4. Implement the fix for ticket #{issue}. Make minimal, focused edits.
 
         5. Build to verify compilation:
            - .NET: `dotnet build`
@@ -108,26 +129,17 @@ You are an autonomous coding agent (for example claude-code) running directly on
 
         7. Commit:
            git add -A
-           git commit -m "{8}: <short description> (#{3})"{5}
+           git commit -m "{commitType}: <short description> (#{issue})"{crossLinkCommitNote}
 
         8. Push the branch to origin:
-           git push -u origin {7}
+           git push -u origin {branch}
 
         When the branch is pushed, reply ONLY with this JSON (no other text):
-        {{"branch":"{7}","summary":"<one sentence describing the change>"}}
+        {"branch":"{branch}","summary":"<one sentence describing the change>"}
 
         If you cannot complete the task, reply with:
-        {{"branch":"","summary":"","error":"<brief reason>"}}
-        """,
-        repo.Owner,
-        repo.Repo,
-        repo.DefaultBranch,
-        req.IssueNumber,
-        CrossServiceNote(req, repo),
-        CrossLinkCommitNote(req, repo),
-        BranchStep(req, repo),
-        BranchName(req, repo),
-        CommitType(req)) + SecurityFooter;
+        {"branch":"","summary":"","error":"<brief reason>"}
+        """;
 
     // The ticket title/body are written by whoever can open an issue — fence them as data. The branch name,
     // repo, and workflow come only from these system prompts, never from the ticket.
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/PromptCatalog.cs b/src/AgentOs.Modules.Pipeline/Prompts/PromptCatalog.cs
index f67ad4cb..e0df15b8 100644
--- a/src/AgentOs.Modules.Pipeline/Prompts/PromptCatalog.cs
+++ b/src/AgentOs.Modules.Pipeline/Prompts/PromptCatalog.cs
@@ -1,23 +1,71 @@
 // The tunable agent prompts the Prompts admin app exposes. Key must match what each agent passes to
-// IPromptOverrides.ResolveAsync; DefaultPrompt is the compiled-in baseline shown for reset/diff.
+// IPromptOverrides.ResolveAsync — the agent's role key (AgentRoles), so a prompt, a profile and an Insights row of the
+// same agent share one name; DefaultPrompt is the compiled-in baseline shown for reset/diff. Board agent prompts are
+// per-run templates: their placeholders ({owner}, {branch}…) are filled on every run (PromptTemplate).
 
 using System.Collections.Generic;
+using AgentOs.Modules.Pipeline.Agents;
 
 namespace AgentOs.Modules.Pipeline.Prompts;
 
 /// <summary>One tunable agent prompt.</summary>
-public sealed record PromptEntry(string Key, string DisplayName, string DefaultPrompt);
+public sealed record PromptEntry(string Key, string DisplayName, string DefaultPrompt)
+{
+    /// <summary>Board agent or Workflow pipeline agent.</summary>
+    public AgentRoleGroup Group { get; init; } = AgentRoleGroup.WorkflowPipeline;
+
+    /// <summary>Placeholders the template fills per run (empty = a plain prompt).</summary>
+    public IReadOnlyList<string> Placeholders { get; init; } = [];
+
+    /// <summary>One sentence shown under the prompt (where it applies), or null.</summary>
+    public string? Note { get; init; }
+}
 
 /// <summary>The agent system prompts a tenant can override at runtime.</summary>
 public static class PromptCatalog
 {
-    /// <summary>Tunable prompts, in display order. Keys match the agents' ResolveAsync calls.</summary>
+    /// <summary>Tunable prompts, in display order (Board agents, then the Workflow pipeline). Keys match the agents'
+    /// ResolveAsync calls.</summary>
     public static IReadOnlyList<PromptEntry> All { get; } =
     [
-        new("Requirement", "Requirement Agent", RequirementPrompt.System),
-        new("Coding", "Coding Agent", CodingPrompt.System),
-        new("Testing", "Testing Agent", TestingPrompt.System),
-        new("Qa", "QA Agent", QaPrompt.System),
-        new("Decomposer", "Decomposer (idea → tickets)", DecomposerPrompt.System),
+        new(AgentRoles.Discovery, AgentRoles.Label(AgentRoles.Discovery) + " — New idea → tickets", DecomposerPrompt.System)
+        {
+            Group = AgentRoleGroup.Board,
+            Note = "Splits the idea's requirement into tickets. The requirement step itself uses the Requirement (Workflow pipeline) prompt.",
+        },
+        new(AgentRoles.IssueWork, AgentRoles.Label(AgentRoles.IssueWork) + " — on a member's computer", IssueWorkPrompt.CliTemplate)
+        {
+            Group = AgentRoleGroup.Board,
+            Placeholders = IssueWorkPrompt.Placeholders,
+            Note = "Used when the ticket runs on a paired computer (the Board default).",
+        },
+        new(IssueWorkPrompt.ServerPromptKey, AgentRoles.Label(AgentRoles.IssueWork) + " — on the server", IssueWorkPrompt.ServerTemplate)
+        {
+            Group = AgentRoleGroup.Board,
+            Placeholders = IssueWorkPrompt.Placeholders,
+            Note = "Used when the ticket's provider runs on the server and drives the runner through runner_shell.",
+        },
+        new(AgentRoles.Reviewer, AgentRoles.Label(AgentRoles.Reviewer), ReviewAgent.InstructionsTemplate)
+        {
+            Group = AgentRoleGroup.Board,
+            Placeholders = AcceptanceAgent.Placeholders,
+        },
+        new(AgentRoles.Acceptance, AgentRoles.Label(AgentRoles.Acceptance), AcceptanceAgent.InstructionsTemplate)
+        {
+            Group = AgentRoleGroup.Board,
+            Placeholders = AcceptanceAgent.Placeholders,
+        },
+        new(AgentRoles.AutopilotOrchestrator, AgentRoles.Label(AgentRoles.AutopilotOrchestrator), AutopilotOrchestratorAgent.Instructions)
+        {
+            Group = AgentRoleGroup.Board,
+        },
+        new(AgentRoles.Retrospective, AgentRoles.Label(AgentRoles.Retrospective), RetrospectiveAgent.Instructions)
+        {
+            Group = AgentRoleGroup.Board,
+        },
+        new(AgentRoles.Requirement, AgentRoles.Label(AgentRoles.Requirement), RequirementPrompt.System),
+        new(AgentRoles.Coding, AgentRoles.Label(AgentRoles.Coding), CodingPrompt.System),
+        new(AgentRoles.Testing, AgentRoles.Label(AgentRoles.Testing), TestingPrompt.System),
+        new(AgentRoles.Qa, AgentRoles.Label(AgentRoles.Qa), QaPrompt.System),
     ];
 }
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/PromptTemplate.cs b/src/AgentOs.Modules.Pipeline/Prompts/PromptTemplate.cs
new file mode 100644
index 00000000..f956fd1d
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Prompts/PromptTemplate.cs
@@ -0,0 +1,26 @@
+// Board agent prompts are per-run templates: the Reviewer's prompt names the repository and branch it checks out, the
+// ticket Coding agent's names the branch it pushes. So a tenant can override them in Settings → Prompts like any other
+// prompt, the template carries named placeholders ({owner}, {repo}, {branch}…) that are filled per run. One pass over
+// the template: a value that itself contains "{branch}" (a repository name, a ticket title) is never expanded again,
+// and an unknown {word} — or a JSON brace in the reply contract — is left exactly as written.
+
+using System;
+using System.Collections.Generic;
+using System.Text.RegularExpressions;
+
+namespace AgentOs.Modules.Pipeline.Prompts;
+
+/// <summary>Fills a prompt template's named placeholders.</summary>
+public static partial class PromptTemplate
+{
+    /// <summary><paramref name="template"/> with every known <c>{name}</c> replaced by its value (single pass).</summary>
+    public static string Fill(string template, IReadOnlyDictionary<string, string> values)
+    {
+        ArgumentNullException.ThrowIfNull(template);
+        ArgumentNullException.ThrowIfNull(values);
+        return Placeholder().Replace(template, m => values.TryGetValue(m.Groups[1].Value, out var v) ? v : m.Value);
+    }
+
+    [GeneratedRegex(@"\{([A-Za-z][A-Za-z0-9]*)\}")]
+    private static partial Regex Placeholder();
+}
diff --git a/src/AgentOs.Modules.RemoteAgent/RemoteAgentLlmClient.cs b/src/AgentOs.Modules.RemoteAgent/RemoteAgentLlmClient.cs
index e912ccfc..00cf0da8 100644
--- a/src/AgentOs.Modules.RemoteAgent/RemoteAgentLlmClient.cs
+++ b/src/AgentOs.Modules.RemoteAgent/RemoteAgentLlmClient.cs
@@ -33,6 +33,10 @@ public sealed class RemoteAgentLlmClient : ILlmClient
     /// <inheritdoc />
     public string Provider => "RemoteAgent";
 
+    /// <summary>The model a response reports when the request chose none and the member's CLI ran its own default
+    /// (metrics then show this name rather than an empty model).</summary>
+    public const string ComputerDefaultModel = "computer-default";
+
     public RemoteAgentLlmClient(IRemoteAgentBroker broker, IServiceProvider services, ILogger<RemoteAgentLlmClient> logger)
     {
         _broker = broker ?? throw new ArgumentNullException(nameof(broker));
@@ -53,7 +57,8 @@ public RemoteAgentLlmClient(IRemoteAgentBroker broker, IServiceProvider services
     public async Task<LlmResponse> SendAsync(LlmRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
-        request.Validate();
+        // No model chosen is valid here: the member's CLI then runs its own default model (the runner adds no flag).
+        request.ValidateAllowingNoModel();
 
         // Background session work (a Blazor circuit's Task.Run) has no HttpContext, so ITenantContext is
         // blank there; the session seeds AmbientIdentity so the dispatch targets the member's own runner.
@@ -150,7 +155,7 @@ void OnProgress(RemoteProgress p)
             OutputTokens: outTok,
             CostUsd: 0m,
             Latency: stopwatch.Elapsed,
-            Model: request.Model,
+            Model: string.IsNullOrWhiteSpace(request.Model) ? ComputerDefaultModel : request.Model,
             Provider: Provider)
         {
             CacheReadTokens = real ? result.CacheReadTokens ?? 0 : 0,
diff --git a/src/AgentOs.Modules.Workspaces/WorkspaceBoardRepos.cs b/src/AgentOs.Modules.Workspaces/WorkspaceBoardRepos.cs
new file mode 100644
index 00000000..834eef27
--- /dev/null
+++ b/src/AgentOs.Modules.Workspaces/WorkspaceBoardRepos.cs
@@ -0,0 +1,22 @@
+// IBoardRepos over the workspace registry: a board's repositories as "owner/repo" keys (the key project memory uses).
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Workspaces;
+using AgentOs.Modules.Workspaces.Persistence;
+
+namespace AgentOs.Modules.Workspaces;
+
+internal sealed class WorkspaceBoardRepos(IWorkspaceRepository workspaces) : IBoardRepos
+{
+    public async Task<IReadOnlyList<string>> RepoKeysAsync(string tenantId, Guid boardId, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(tenantId)) { return []; }
+        var repos = await workspaces.ListReposForTenantAsync(tenantId, boardId, ct).ConfigureAwait(false);
+        return repos.Where(r => r.Owner.Length > 0 && r.Repo.Length > 0).Select(r => $"{r.Owner}/{r.Repo}")
+            .Distinct(StringComparer.OrdinalIgnoreCase).ToList();
+    }
+}
diff --git a/src/AgentOs.Modules.Workspaces/WorkspacesModule.cs b/src/AgentOs.Modules.Workspaces/WorkspacesModule.cs
index c43c360c..9d991aad 100644
--- a/src/AgentOs.Modules.Workspaces/WorkspacesModule.cs
+++ b/src/AgentOs.Modules.Workspaces/WorkspacesModule.cs
@@ -36,6 +36,8 @@ public void AddServices(IServiceCollection services, IConfiguration configuratio
 
         // The connect flow is shared by the HTTP endpoint and the desktop Board app (tenant-explicit).
         services.AddScoped<IWorkspaceConnector, WorkspaceConnector>();
+        // A board's repositories for agents that see the whole board (the Autopilot lead reads their practices).
+        services.AddScoped<AgentOs.Domain.Workspaces.IBoardRepos, WorkspaceBoardRepos>();
 
         var connectionString = configuration.GetConnectionString("DefaultConnection");
         if (!string.IsNullOrWhiteSpace(connectionString))
diff --git a/src/AgentOs.RemoteAgent/CliModel.cs b/src/AgentOs.RemoteAgent/CliModel.cs
new file mode 100644
index 00000000..793971e8
--- /dev/null
+++ b/src/AgentOs.RemoteAgent/CliModel.cs
@@ -0,0 +1,52 @@
+// The model an agent's profile picked (Settings → Agent profiles) reaches the CLI. The server sends it on every request;
+// the runner used to log it and run the CLI's own default model anyway. Claude Code takes `--model <id>`, Codex takes
+// `-m <id>`. No model, a model that CLI cannot serve (a GPT model for claude, a Claude model for codex), an unknown CLI,
+// or an operator's REMOTE_AGENT_ARGS that already names a model → no flag, the CLI's default applies.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+
+namespace AgentOs.RemoteAgent;
+
+/// <summary>Builds the model flag for a CLI agent.</summary>
+internal static partial class CliModel
+{
+    // Claude Code's model aliases (besides full claude-* ids).
+    private static readonly HashSet<string> ClaudeAliases = new(StringComparer.OrdinalIgnoreCase) { "opus", "sonnet", "haiku", "fable", "opusplan" };
+
+    /// <summary>The arguments that select <paramref name="model"/> on <paramref name="command"/> (empty = none).</summary>
+    /// <param name="command">The CLI command or path (<c>claude</c>, <c>C:\…\codex.cmd</c>).</param>
+    /// <param name="model">The model id the request carries (may be empty).</param>
+    /// <param name="existingArgs">The arguments already chosen; one that names a model wins.</param>
+    internal static string[] Flags(string command, string? model, IReadOnlyCollection<string> existingArgs)
+    {
+        ArgumentNullException.ThrowIfNull(existingArgs);
+        var id = (model ?? string.Empty).Trim();
+        if (id.Length == 0 || !SafeId().IsMatch(id)) { return []; }
+        if (existingArgs.Any(a => a is "--model" or "-m" || a.StartsWith("--model=", StringComparison.Ordinal))) { return []; }
+
+        var isClaudeModel = id.StartsWith("claude", StringComparison.OrdinalIgnoreCase) || ClaudeAliases.Contains(id);
+        return CommandName(command) switch
+        {
+            "claude" when isClaudeModel => ["--model", id],
+            "codex" when !isClaudeModel => ["-m", id],
+            _ => [],
+        };
+    }
+
+    /// <summary>The CLI's bare name: <c>C:\npm\claude.cmd</c> → <c>claude</c>.</summary>
+    internal static string CommandName(string command)
+    {
+        // Both separators on every OS: REMOTE_AGENT_CMD may hold a Windows path while the tests run on Linux.
+        var name = (command ?? string.Empty).Trim();
+        name = name[(name.LastIndexOfAny(['/', '\\']) + 1)..];
+        var dot = name.LastIndexOf('.');
+        return (dot > 0 ? name[..dot] : name).ToLowerInvariant();
+    }
+
+    // A model id, never something that could read as another flag or carry a separator.
+    [GeneratedRegex(@"^[A-Za-z0-9][A-Za-z0-9._:/\[\]-]{0,127}$")]
+    private static partial Regex SafeId();
+}
diff --git a/src/AgentOs.RemoteAgent/Program.cs b/src/AgentOs.RemoteAgent/Program.cs
index fc348e9e..8fe9c0dd 100644
--- a/src/AgentOs.RemoteAgent/Program.cs
+++ b/src/AgentOs.RemoteAgent/Program.cs
@@ -235,6 +235,9 @@ static async Task<RemoteExecResult> RunLlmAsync(RemoteExecRequest request, Func<
         : yolo ? [.. profile.DefaultArgs, .. profile.AutoArgs]
         : scoped ? [.. profile.DefaultArgs, .. AgentOs.RemoteAgent.ScopedAutonomy.ArgsFor(cmd)]
         : profile.DefaultArgs;
+    // The model the agent's profile picked (Settings → Agent profiles) — `--model` for claude, `-m` for codex (CliModel.cs).
+    var modelFlags = AgentOs.RemoteAgent.CliModel.Flags(cmd, request.Model, args);
+    args = [.. args, .. modelFlags];
     // Claude with the runner's own flags streams its events, so the Board can show what it is doing (CliProgress.cs).
     // A custom REMOTE_AGENT_ARGS keeps exactly what the operator asked for.
     var streaming = argsEnv is null && string.Equals(profile.Command, "claude", StringComparison.OrdinalIgnoreCase);
@@ -282,7 +285,7 @@ static async Task<RemoteExecResult> RunLlmAsync(RemoteExecRequest request, Func<
             psi.ArgumentList.Add(prompt);
         }
 
-        Console.WriteLine($"[agent] cli={cli} cmd={cmd} prompt={(profile.PromptViaStdin ? "stdin" : "arg")} autonomy={(argsEnv is not null ? "custom" : yolo ? "yolo" : scoped ? "scoped" : "prompt")} dir={runDir}");
+        Console.WriteLine($"[agent] cli={cli} cmd={cmd} prompt={(profile.PromptViaStdin ? "stdin" : "arg")} autonomy={(argsEnv is not null ? "custom" : yolo ? "yolo" : scoped ? "scoped" : "prompt")} model={(modelFlags.Length > 0 ? modelFlags[^1] : "cli default")} dir={runDir}");
 
         using var process = Process.Start(psi)
             ?? throw new InvalidOperationException($"Failed to start '{cmd}'. Is the {cli} CLI installed and on PATH?");
diff --git a/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor b/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
index 46ad87cc..afa7d624 100644
--- a/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
+++ b/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
@@ -11,6 +11,7 @@
 @using AgentOs.Modules.Llm
 @using AgentOs.Modules.Pipeline.Agents
 @inject ISettings Settings
+@inject LegacyAgentSettings Legacy
 @inject AgentOs.Web.Shell.Services.ToastService Toasts
 
 @if (!_resolved)
@@ -33,9 +34,12 @@ else
         </Btn>
     </header>
 
-    <Panel Title="Agents">
+    @foreach (var group in Groups)
+    {
+    <Panel Title="@GroupTitle(group)">
+        <p class="muted agent-profiles-intro">@GroupIntro(group)</p>
         <div class="agent-profiles-scroll">
-        <table class="data-table agent-profiles">
+        <table class="data-table agent-profiles" aria-label="@GroupTitle(group)">
             <thead>
                 <tr>
                     <th>Agent</th>
@@ -50,20 +54,28 @@ else
                 </tr>
             </thead>
             <tbody>
-                @foreach (var row in _rows)
+                @foreach (var row in _rows.Where(r => r.Group == group))
                 {
                     var locked = row.IsLocked;
-                    <tr @key="row.Role">
+                    <tr @key="row.Role" data-role="@row.Role">
                         <td>
                             <span class="agent-profiles-who">
                                 <AgentMascot Role="@row.Role" Size="30" />
-                                <span class="agent-profiles-name"><strong>@row.Role</strong><Badge Variant="@SourceVariant(row.Source)">@SourceLabel(row.Source)</Badge></span>
+                                <span class="agent-profiles-name">
+                                    <strong title="@($"Role key: {row.Role}")">@row.Label</strong>
+                                    <span class="agent-profiles-desc">@row.Description</span>
+                                    <Badge Variant="@SourceVariant(row.Source)">@SourceLabel(row.Source)</Badge>
+                                    @if (row.Legacy)
+                                    {
+                                        <Badge Variant="Badge.BadgeVariant.Info">Saved as “@LegacyAgentSettings.Decomposer” — still applies</Badge>
+                                    }
+                                </span>
                             </span>
                         </td>
                         @if (_advanced)
                         {
                         <td>
-                            <select class="prefs-select" disabled="@locked" aria-label="@($"{row.Role} provider")"
+                            <select class="prefs-select" disabled="@locked" aria-label="@($"{row.Label} provider")"
                                     value="@row.Provider" @onchange="e => row.Provider = e.Value?.ToString() ?? string.Empty">
                                 @foreach (var p in LlmProviders.Selectable)
                                 {
@@ -77,8 +89,9 @@ else
                         <td>
                             @* Simple view: every priced model, the provider inferred from the choice (ModelRouting). *@
                             <ModelPicker Value="@row.Model" ValueChanged="v => PickModel(row, v)" Provider="@(_advanced ? row.Provider : null)"
-                                         AriaLabel="@($"{row.Role} model")" Disabled="@locked" />
-                            <div class="prefs-hint">@PriceHint(row.Model)@(_advanced ? "" : $" · via {(row.Provider == "Anthropic" ? "Claude" : row.Provider)}")</div>
+                                         AriaLabel="@($"{row.Label} model")" Disabled="@locked"
+                                         AllowInherit="@row.ModelOptional" InheritLabel="Computer's default" />
+                            <div class="prefs-hint">@(string.IsNullOrWhiteSpace(row.Model) && row.ModelOptional ? AgentSettings.ComputersDefaultHelp : PriceHint(row.Model))@(_advanced ? "" : $" · via {(row.Provider == "Anthropic" ? "Claude" : row.Provider)}")</div>
                         </td>
                         @if (_advanced)
                         {
@@ -86,7 +99,7 @@ else
                             @if (ModelCapabilities.AcceptsSamplingParameters(row.Model))
                             {
                                 <input class="prefs-input agent-profiles-num" type="number" min="0" max="2" step="0.1"
-                                       disabled="@locked" aria-label="@($"{row.Role} temperature")"
+                                       disabled="@locked" aria-label="@($"{row.Label} temperature")"
                                        value="@row.Temperature" @onchange="e => row.Temperature = e.Value?.ToString() ?? string.Empty" />
                             }
                             else
@@ -96,14 +109,14 @@ else
                         </td>
                         <td>
                             <input class="prefs-input agent-profiles-num" type="number" min="1" max="@AgentSettings.MaxOutputTokensCeiling" step="256"
-                                   disabled="@locked" aria-label="@($"{row.Role} max output tokens")"
+                                   disabled="@locked" aria-label="@($"{row.Label} max output tokens")"
                                    value="@row.MaxTokens" @onchange="e => row.MaxTokens = e.Value?.ToString() ?? string.Empty" />
                         </td>
                         }
                         <td>
                             <div class="agent-profiles-actions">
                                 <Btn Size="Btn.ButtonSize.Sm" Variant="Btn.ButtonVariant.Primary" Disabled="@(locked || _saving)" OnClick="() => SaveRow(row)">Save</Btn>
-                                <Btn Size="Btn.ButtonSize.Sm" Disabled="@(locked || _saving || row.Source != SettingSource.Tenant)" OnClick="() => ResetRow(row)">Reset</Btn>
+                                <Btn Size="Btn.ButtonSize.Sm" Disabled="@(locked || _saving || (row.Source != SettingSource.Tenant && !row.Legacy))" OnClick="() => ResetRow(row)">Reset</Btn>
                             </div>
                         </td>
                     </tr>
@@ -112,8 +125,9 @@ else
         </table>
         </div>
     </Panel>
+    }
 
-    <Panel Title="Pipeline">
+    <Panel Title="Workflow pipeline · QA loop">
         <Field Label="QA loop · max iterations" Hint="How many Coding → Testing → QA rounds before a run stops (1–10).">
             <input class="prefs-input agent-profiles-num" type="number" min="1" max="10" step="1"
                    disabled="@(_iterationsSource == SettingSource.Locked)" aria-label="QA loop max iterations"
@@ -152,9 +166,26 @@ else
     private string _iterations = string.Empty;
     private SettingSource _iterationsSource;
 
-    private sealed class RoleRow(string role)
+    // One agent registry: the Board agents first, then the legacy 5-agent Workflow pipeline — separate tables, so
+    // nobody edits "Coding (Workflow pipeline)" expecting the ticket agent to change.
+    private static readonly AgentRoleGroup[] Groups = [AgentRoleGroup.Board, AgentRoleGroup.WorkflowPipeline];
+
+    private static string GroupTitle(AgentRoleGroup group) => group == AgentRoleGroup.Board
+        ? "Board agents"
+        : "Workflow pipeline agents";
+
+    private static string GroupIntro(AgentRoleGroup group) => group == AgentRoleGroup.Board
+        ? "The agents behind tickets, reviews, testing, Autopilot and New idea. Coding, Reviewer and Testing (tickets) need a paired computer for the checkout; on RemoteAgent they cost 0 server tokens, any other provider passes your budget cap."
+        : "The 5-agent pipeline of the Run and Workflow apps (and the Board's Thorough engine). These rows do not change the Board agents above.";
+
+    private sealed class RoleRow(AgentRoleInfo info)
     {
-        public string Role { get; } = role;
+        public string Role { get; } = info.Key;
+        public string Label { get; } = info.Label;
+        public string Description { get; } = info.Description;
+        public AgentRoleGroup Group { get; } = info.Group;
+        public bool ModelOptional { get; } = AgentsOptions.ModelIsOptional(info.Key);
+        public bool Legacy { get; set; }
         public string Provider { get; set; } = string.Empty;
         public string Model { get; set; } = string.Empty;
         public string Temperature { get; set; } = string.Empty;
@@ -184,7 +215,7 @@ else
         var rows = new List<RoleRow>(AgentSettings.Roles.Count);
         foreach (var (role, _) in AgentSettings.Roles)
         {
-            var row = new RoleRow(role);
+            var row = new RoleRow(AgentRoles.Find(role) ?? new AgentRoleInfo(role, role, AgentRoleGroup.WorkflowPipeline, string.Empty));
             var present = RoleFields
                 .Select(field => (Field: field, View: byKey.GetValueOrDefault(AgentSettings.Key(role, field))))
                 .Where(p => p.View is not null);
@@ -194,6 +225,19 @@ else
                 row.Source = Max(row.Source, v.Source);
                 row.IsLocked |= v.Source == SettingSource.Locked;
             }
+            // A renamed role (Decomposer → Discovery): a field with nothing stored under the new key shows — and uses —
+            // what the tenant saved under the former one, exactly as the agents resolve it.
+            if (LegacyAgentSettings.LegacyRoleOf(role) is not null)
+            {
+                foreach (var field in RoleFields.Where(f => byKey.GetValueOrDefault(AgentSettings.Key(role, f))?.Source is null or SettingSource.Default))
+                {
+                    if (await Legacy.ReadAsync(role, field, _tenantId) is { } old)
+                    {
+                        row.Loaded[field] = old;
+                        row.Legacy = true;
+                    }
+                }
+            }
             row.Provider = row.Loaded.GetValueOrDefault(ProviderField, string.Empty);
             row.Model = row.Loaded.GetValueOrDefault(ModelField, string.Empty);
             row.Temperature = row.Loaded.GetValueOrDefault(TemperatureField, string.Empty);
@@ -217,8 +261,12 @@ else
         await SaveAsync(row.Role, changes.Where(c => !string.Equals(c.Value, row.Loaded.GetValueOrDefault(c.Field), StringComparison.Ordinal)));
     }
 
-    private Task ResetRow(RoleRow row) =>
-        SaveAsync(row.Role, [(ProviderField, ""), (ModelField, ""), (TemperatureField, ""), (MaxTokensField, "")]);
+    private async Task ResetRow(RoleRow row)
+    {
+        // Reset returns to the inherited value — including what the row still carried under its former key.
+        if (row.Legacy) { await Legacy.ClearTenantAsync(row.Role, _tenantId); }
+        await SaveAsync(row.Role, [(ProviderField, ""), (ModelField, ""), (TemperatureField, ""), (MaxTokensField, "")]);
+    }
 
     private async Task SaveAsync(string role, IEnumerable<(string Field, string Value)> changes)
     {
@@ -236,7 +284,7 @@ else
                 }
                 count++;
             }
-            Toasts.Show("Agent profiles", count == 0 ? $"{role}: nothing changed." : $"{role} saved — applies to the next call.", AgentOs.Web.Shell.Services.ToastKind.Ok);
+            Toasts.Show("Agent profiles", count == 0 ? $"{AgentRoles.Label(role)}: nothing changed." : $"{AgentRoles.Label(role)} saved — applies to the next call.", AgentOs.Web.Shell.Services.ToastKind.Ok);
         }
         finally
         {
diff --git a/src/AgentOs.Web/Components/Pages/BoardApp.razor b/src/AgentOs.Web/Components/Pages/BoardApp.razor
index 4072fb85..03d56d92 100644
--- a/src/AgentOs.Web/Components/Pages/BoardApp.razor
+++ b/src/AgentOs.Web/Components/Pages/BoardApp.razor
@@ -1602,8 +1602,8 @@ else if (_tab == Tab.Sessions)
                     finally
                     {
                         var idea = _ideaText.Trim().ReplaceLineEndings(" ");
-                        await TaskService.SaveAgentRunAsync(_tenantId, _userId, "Discovery",
-                            "Discovery · " + (idea.Length > 120 ? idea[..120] + "…" : idea), started, calls.Calls);
+                        await TaskService.SaveAgentRunAsync(_tenantId, _userId, AgentOs.Modules.Pipeline.Agents.AgentRoles.Discovery,
+                            AgentOs.Modules.Pipeline.Agents.AgentRoles.Label(AgentOs.Modules.Pipeline.Agents.AgentRoles.Discovery) + " · " +(idea.Length > 120 ? idea[..120] + "…" : idea), started, calls.Calls);
                     }
                 }
 
diff --git a/src/AgentOs.Web/Components/Pages/InsightsApp.razor b/src/AgentOs.Web/Components/Pages/InsightsApp.razor
index d7fe5e2f..142f41b0 100644
--- a/src/AgentOs.Web/Components/Pages/InsightsApp.razor
+++ b/src/AgentOs.Web/Components/Pages/InsightsApp.razor
@@ -189,7 +189,7 @@ else
                     @foreach (var a in agents)
                     {
                         <div class="ins-bar-row">
-                            <div class="ins-bar-label ins-bar-agent"><AgentMascot Role="@AgentShort(a.Key)" Size="22" /><span>@AgentShort(a.Key)</span></div>
+                            <div class="ins-bar-label ins-bar-agent" title="@a.Key"><AgentMascot Role="@a.Key" Size="22" /><span>@AgentOs.Modules.Pipeline.Agents.AgentRoles.Label(a.Key)</span></div>
                             <div class="ins-bar-track" title="@($"{Num(a.TokensIn)} in · {Num(a.TokensOut)} out")"><div class="ins-bar-fill" style="width:@(Pct(a.TokensIn + a.TokensOut, maxAgent))%"></div></div>
                             <div class="ins-bar-val" title="@($"{Num(a.TokensIn)} input (of which {Num((int)a.CacheReadTokens)} cache read, {Num((int)a.CacheWriteTokens)} cache write) · {Num(a.TokensOut)} output")">@Num(a.TokensIn + a.TokensOut) tok · @Num(a.Calls) calls · @Money(a.CostUsd)</div>
                         </div>
@@ -246,7 +246,7 @@ else
                     @foreach (var l in lat)
                     {
                         <div class="ins-bar-row">
-                            <div class="ins-bar-label ins-bar-agent"><AgentMascot Role="@AgentShort(l.Agent)" Size="22" /><span>@AgentShort(l.Agent)</span></div>
+                            <div class="ins-bar-label ins-bar-agent" title="@l.Agent"><AgentMascot Role="@l.Agent" Size="22" /><span>@AgentOs.Modules.Pipeline.Agents.AgentRoles.Label(l.Agent)</span></div>
                             <div class="ins-bar-track"><div class="ins-bar-fill alt" style="width:@(Pct((decimal)l.AvgLatencyMs, (decimal)maxLat))%"></div></div>
                             <div class="ins-bar-val">@Ms(l.AvgLatencyMs)</div>
                         </div>
@@ -446,8 +446,10 @@ else
         : hours < 48 ? $"{hours.ToString("0.0", CultureInfo.InvariantCulture)} h"
         : $"{(hours / 24).ToString("0.0", CultureInfo.InvariantCulture)} days";
 
-    private static string AgentShort(string agent) => agent
-        .Replace("Agent", "", StringComparison.Ordinal).Trim() is { Length: > 0 } s ? s : agent;
+    // One agent registry (AgentRoles): every stored name maps to its role key — the pipeline files calls as "CodingAgent",
+    // older Board rows as "Decomposer" — and the key's label is the name Agent profiles shows. Board agents keep their own
+    // keys ("IssueWork", "Acceptance"…), so they are never merged into the Workflow pipeline's roles.
+    private static string AgentShort(string agent) => AgentOs.Modules.Pipeline.Agents.AgentRoles.Canonical(agent) is { Length: > 0 } s ? s : agent;
 
     // Weighted average across the role's names (calls × average latency).
     internal static IEnumerable<AgentOs.Modules.Pipeline.Persistence.AgentLatencyBucket> LatencyByRole(IEnumerable<AgentOs.Modules.Pipeline.Persistence.AgentLatencyBucket> buckets) =>
@@ -456,7 +458,7 @@ else
                 g.Sum(b => b.Calls) == 0 ? 0 : g.Sum(b => b.AvgLatencyMs * b.Calls) / g.Sum(b => b.Calls), g.Sum(b => b.Calls)))
             .OrderByDescending(b => b.AvgLatencyMs);
 
-    // One row per role: the 5-agent pipeline files calls as "CodingAgent", the Board's agents as "Coding" — the same role.
+    // One row per role key (see AgentShort).
     internal static IEnumerable<AgentOs.Modules.Pipeline.Persistence.CostBucket> ByRole(IEnumerable<AgentOs.Modules.Pipeline.Persistence.CostBucket> buckets) =>
         buckets.GroupBy(b => AgentShort(b.Key), StringComparer.OrdinalIgnoreCase)
             .Select(g => new AgentOs.Modules.Pipeline.Persistence.CostBucket(g.Key, g.Sum(b => b.CostUsd), g.Sum(b => b.TokensIn),
diff --git a/src/AgentOs.Web/Components/Pages/KnowledgeTab.razor b/src/AgentOs.Web/Components/Pages/KnowledgeTab.razor
index 577a7597..f7276e77 100644
--- a/src/AgentOs.Web/Components/Pages/KnowledgeTab.razor
+++ b/src/AgentOs.Web/Components/Pages/KnowledgeTab.razor
@@ -69,7 +69,7 @@ else
         }
         else
         {
-            <p class="muted">Every agent reads these before it works on this project — distilled from the lessons by the Retrospective agent. Pin one to keep it word for word.</p>
+            <p class="muted">Every agent that works on this project reads these first — Coding, Reviewer and Testing (tickets) and the Autopilot lead. The Retrospective agent distils them from the lessons. Pin one to keep it word for word.</p>
             <table class="data-table">
                 <thead><tr><th>Practice</th><th>Since</th><th class="actions">Actions</th></tr></thead>
                 <tbody>
diff --git a/src/AgentOs.Web/Components/Pages/PromptsApp.razor b/src/AgentOs.Web/Components/Pages/PromptsApp.razor
index 164a988f..59a8960f 100644
--- a/src/AgentOs.Web/Components/Pages/PromptsApp.razor
+++ b/src/AgentOs.Web/Components/Pages/PromptsApp.razor
@@ -1,12 +1,14 @@
 @* PromptsApp — admin: shape how this tenant's agents work.
-   • Workspace rules — one block of engineering rules applied to EVERY agent of every run (pipeline agents,
-     Quick engine, Decomposer), after the agent's own prompt and before the repo's AGENTS.md / CLAUDE.md.
-   • Per-agent system prompts — override the built-in prompt; Reset reverts to it.
+   • Workspace rules — one block of engineering rules applied to EVERY agent of every run (the Board agents and the
+     Workflow pipeline), after the agent's own prompt and before the repo's AGENTS.md / CLAUDE.md.
+   • Per-agent system prompts — override the built-in prompt; Reset reverts to it. Grouped like Agent profiles (Board
+     agents, then the Workflow pipeline); Board prompts are templates whose {placeholders} are filled per run.
    Every save is versioned (who, when, what — last 20) with one-click Restore, and lands in the audit trail.
    Tenant read from AuthenticationState (a circuit has no HttpContext) → tenant-explicit IPromptOverrideService. *@
 
 @using Microsoft.AspNetCore.Components.Authorization
 @using AgentOs.Modules.Pipeline.Prompts
+@using AgentOs.Modules.Pipeline.Agents
 @inject IPromptOverrideService Prompts
 @inject AgentOs.Web.Shell.Services.ToastService Toasts
 
@@ -30,7 +32,7 @@ else
     <Panel Title="Workspace rules — every agent follows these">
         <p class="muted prompt-hint">
             Your engineering rules: libraries, style, structure, what never to touch. Added to every agent's prompt
-            (pipeline, Quick engine, Decomposer), before the target repo's own <code>AGENTS.md</code> / <code>CLAUDE.md</code>.
+            (the Board agents and the Workflow pipeline), before the target repo's own <code>AGENTS.md</code> / <code>CLAUDE.md</code>.
             They shape choices — they never change an agent's role or output format.
         </p>
         <textarea class="prefs-input prompt-text" rows="6" aria-label="Workspace rules"
@@ -43,7 +45,15 @@ else
         <PromptHistoryList Versions="@HistoryFor(WorkspaceRules.Key)" OnRestore="v => RestoreRules(v)" />
     </Panel>
 
-    @foreach (var entry in PromptCatalog.All)
+    @foreach (var group in Groups)
+    {
+        <div class="prefs-section">
+            <h2 class="prefs-h">@(group == AgentRoleGroup.Board ? "Board agents" : "Workflow pipeline agents")</h2>
+            <p class="prefs-sub">@(group == AgentRoleGroup.Board
+                ? "Tickets, reviews, testing, Autopilot, retrospectives and New idea — the same agents as in Agent profiles and Insights."
+                : "The 5-agent pipeline of the Run and Workflow apps. These prompts do not change the Board agents.")</p>
+        </div>
+    @foreach (var entry in PromptCatalog.All.Where(e => e.Group == group))
     {
         <Panel Title="@entry.DisplayName">
             <div class="prompt-status">
@@ -51,6 +61,21 @@ else
                     @(_overridden.Contains(entry.Key) ? "Overridden" : "Default")
                 </Badge>
             </div>
+            @if (entry.Note is { } note)
+            {
+                <p class="muted prompt-hint">@note</p>
+            }
+            @if (entry.Placeholders.Count > 0)
+            {
+                <p class="muted prompt-hint">
+                    Filled in on every run:
+                    @foreach (var p in entry.Placeholders)
+                    {
+                        <code>@("{" + p + "}")</code>@(" ")
+                    }
+                    — keep the ones the agent needs (the branch it checks out, the reply format).
+                </p>
+            }
             <textarea class="prefs-input prompt-text" rows="8" aria-label="@($"{entry.DisplayName} system prompt")"
                       value="@CurrentText(entry)"
                       @onchange="e => _text[entry.Key] = e.Value?.ToString() ?? string.Empty"></textarea>
@@ -61,11 +86,15 @@ else
             <PromptHistoryList Versions="@HistoryFor(entry.Key)" OnRestore="v => Restore(entry, v)" />
         </Panel>
     }
+    }
 }
 
 @code {
     [CascadingParameter] private Task<AuthenticationState>? AuthState { get; set; }
 
+    // Board agents first, then the legacy Workflow pipeline (the same split as Agent profiles).
+    private static readonly AgentRoleGroup[] Groups = [AgentRoleGroup.Board, AgentRoleGroup.WorkflowPipeline];
+
     private bool _resolved;
     private bool _isAdmin;
     private bool _saving;
diff --git a/src/AgentOs.Web/Components/UI/AgentMascot.razor b/src/AgentOs.Web/Components/UI/AgentMascot.razor
index d50e44e7..2f133c6b 100644
--- a/src/AgentOs.Web/Components/UI/AgentMascot.razor
+++ b/src/AgentOs.Web/Components/UI/AgentMascot.razor
@@ -151,13 +151,14 @@
     /// <summary>Rendered size in CSS pixels.</summary>
     [Parameter] public int Size { get; set; } = 40;
 
+    // The Board agents (AgentRoles keys) wear the character of the pipeline role they mirror.
     private string RoleClass => Role?.Trim().ToUpperInvariant() switch
     {
-        "ORCHESTRATOR" or "DECOMPOSER" => "orchestrator",
-        "REQUIREMENT" => "requirement",
+        "ORCHESTRATOR" or "DECOMPOSER" or "AUTOPILOTORCHESTRATOR" => "orchestrator",
+        "REQUIREMENT" or "DISCOVERY" => "requirement",
         "CODING" or "ISSUEWORK" => "coding",
-        "TESTING" => "testing",
-        "QA" => "qa",
+        "TESTING" or "ACCEPTANCE" => "testing",
+        "QA" or "REVIEWER" => "qa",
         _ => "generic",
     };
 
diff --git a/src/AgentOs.Web/Components/UI/ModelPicker.razor b/src/AgentOs.Web/Components/UI/ModelPicker.razor
index 484de4cc..98672e5c 100644
--- a/src/AgentOs.Web/Components/UI/ModelPicker.razor
+++ b/src/AgentOs.Web/Components/UI/ModelPicker.razor
@@ -20,7 +20,7 @@ else
     <select class="prefs-select" disabled="@Disabled" aria-label="@AriaLabel" value="@SelectValue" @onchange="OnSelect">
         @if (AllowInherit)
         {
-            <option value="">— inherit —</option>
+            <option value="">@InheritLabel</option>
         }
         @if (IsUnlisted)
         {
@@ -55,6 +55,9 @@ else
     /// <summary>Offer an empty "inherit" choice (settings that may be cleared).</summary>
     [Parameter] public bool AllowInherit { get; set; }
 
+    /// <summary>The empty choice's text (e.g. "Computer's default" for an agent that may leave its model unset).</summary>
+    [Parameter] public string InheritLabel { get; set; } = "— inherit —";
+
     private bool _custom;
 
     private IReadOnlyList<string> Models => CostCalculator.KnownModelsFor(Provider);
diff --git a/src/AgentOs.Web/Services/BoardTasks/BoardTaskService.cs b/src/AgentOs.Web/Services/BoardTasks/BoardTaskService.cs
index 154ed830..c62b2946 100644
--- a/src/AgentOs.Web/Services/BoardTasks/BoardTaskService.cs
+++ b/src/AgentOs.Web/Services/BoardTasks/BoardTaskService.cs
@@ -158,7 +158,7 @@ public async Task<TaskRun> BeginStartAsync(string tenantId, Guid sessionId, stri
         // The Thorough engine stores its own pipeline run + metrics; every other run is recorded here for Insights.
         var completion = Task.Run(() => EngineSelection.IsQuality(session.Brain)
             ? RunAsync(tenantId, session, board, pat, children, cliProfile, change, stopLease)
-            : RecordedAsync(tenantId, session, "Coding", () => RunAsync(tenantId, session, board, pat, children, cliProfile, change, stopLease)),
+            : RecordedAsync(tenantId, session, AgentOs.Modules.Pipeline.Agents.AgentRoles.IssueWork, () => RunAsync(tenantId, session, board, pat, children, cliProfile, change, stopLease)),
             CancellationToken.None);
         return new TaskRun(TaskStart.Started, completion);
     }
@@ -195,7 +195,7 @@ public async Task<TaskRun> BeginTestAsync(string tenantId, Guid sessionId, strin
             await sessions.UpdateRepoRunResultAsync(tenantId, c.Id, "Testing", c.BranchName, c.PrUrl, null, ct).ConfigureAwait(false);
         }
         var stopLease = stops.Begin(tenantId, session.Id);
-        var completion = Task.Run(() => RecordedAsync(tenantId, session, "Testing", () => TestChangesAsync(tenantId, session, board, pat, changes, cliProfile, stopLease)),
+        var completion = Task.Run(() => RecordedAsync(tenantId, session, AgentOs.Modules.Pipeline.Agents.AgentRoles.Acceptance, () => TestChangesAsync(tenantId, session, board, pat, changes, cliProfile, stopLease)),
             CancellationToken.None);
         return new TaskRun(TaskStart.Started, completion);
     }
@@ -233,7 +233,7 @@ public async Task<TaskRun> BeginReviewAsync(string tenantId, Guid sessionId, str
             await sessions.UpdateRepoRunResultAsync(tenantId, c.Id, "Reviewing", c.BranchName, c.PrUrl, null, ct).ConfigureAwait(false);
         }
         var stopLease = stops.Begin(tenantId, session.Id);
-        var completion = Task.Run(() => RecordedAsync(tenantId, session, "Reviewer", () => ReviewChangesAsync(tenantId, session, board, pat, changes, cliProfile, stopLease)),
+        var completion = Task.Run(() => RecordedAsync(tenantId, session, AgentOs.Modules.Pipeline.Agents.AgentRoles.Reviewer, () => ReviewChangesAsync(tenantId, session, board, pat, changes, cliProfile, stopLease)),
             CancellationToken.None);
         return new TaskRun(TaskStart.Started, completion);
     }
@@ -424,7 +424,8 @@ internal async Task RecordedAsync(string tenantId, RemoteSessionEntity session,
         }
         finally
         {
-            await SaveAgentRunAsync(tenantId, session.MemberUserId, agent, $"{agent} · #{session.IssueNumber} {session.Title}", started, calls.Calls)
+            await SaveAgentRunAsync(tenantId, session.MemberUserId, agent,
+                    $"{AgentOs.Modules.Pipeline.Agents.AgentRoles.Label(agent)} · #{session.IssueNumber} {session.Title}", started, calls.Calls)
                 .ConfigureAwait(false);
         }
     }
diff --git a/src/AgentOs.Web/Services/Orchestration/RetrospectiveService.cs b/src/AgentOs.Web/Services/Orchestration/RetrospectiveService.cs
index 18cbdc6d..3a1a8da6 100644
--- a/src/AgentOs.Web/Services/Orchestration/RetrospectiveService.cs
+++ b/src/AgentOs.Web/Services/Orchestration/RetrospectiveService.cs
@@ -59,7 +59,8 @@ public async Task<RetrospectiveOutcome> RunAsync(string tenantId, string memberI
             using (var calls = AgentOs.Domain.Llm.LlmCallScope.Begin())
             {
                 result = await scope.ServiceProvider.GetRequiredService<IRetrospectiveAgent>().RunAsync(input, ct).ConfigureAwait(false);
-                await tasks.SaveAgentRunAsync(tenantId, memberId, "Retrospective", $"Retrospective · {repoKey}", started, calls.Calls).ConfigureAwait(false);
+                await tasks.SaveAgentRunAsync(tenantId, memberId, AgentRoles.Retrospective, $"{AgentRoles.Label(AgentRoles.Retrospective)} · {repoKey}",
+                    started, calls.Calls).ConfigureAwait(false);
             }
             if (!result.Ran) { return RetrospectiveOutcome.None; }
 
diff --git a/src/AgentOs.Web/wwwroot/app.css b/src/AgentOs.Web/wwwroot/app.css
index 6189f534..05497c1a 100644
--- a/src/AgentOs.Web/wwwroot/app.css
+++ b/src/AgentOs.Web/wwwroot/app.css
@@ -2309,6 +2309,10 @@ input[type=range] { accent-color: var(--accent); }
 .settings-field-control .prefs-input[type="number"] { width: 8rem; }
 .model-picker { display: inline-flex; align-items: center; gap: var(--space-2); min-width: 0; }
 .agent-profiles-who { display: inline-flex; align-items: center; gap: var(--space-2); white-space: nowrap; }
+/* What the agent does, under its name: wraps so a long sentence never widens the column. */
+.agent-profiles-desc { white-space: normal; max-width: 20rem; color: var(--text-tertiary); font-size: var(--fs-xs); }
+/* The group intro above each table (Board agents / Workflow pipeline). */
+.agent-profiles-intro { margin: 0 0 var(--space-3); }
 .agent-profiles-actions { display: flex; gap: var(--space-2); justify-content: flex-end; white-space: nowrap; }
 
 .prefs-list { padding-left: 18px; margin: 4px 0; font-size: 12.5px; color: var(--txt-soft); }
diff --git a/tests/AgentOs.E2E.Tests/AgentOsUi/AgentProfilesTests.cs b/tests/AgentOs.E2E.Tests/AgentOsUi/AgentProfilesTests.cs
index 8bfa949a..400df804 100644
--- a/tests/AgentOs.E2E.Tests/AgentOsUi/AgentProfilesTests.cs
+++ b/tests/AgentOs.E2E.Tests/AgentOsUi/AgentProfilesTests.cs
@@ -22,15 +22,21 @@ public static async Task<ILocator> OpenAsync(IPage page)
         var win = page.Locator(".appwin.focused");
         await Assertions.Expect(win.Locator(".appwin-title")).ToHaveTextAsync("Settings");
         await win.Locator(".prefs-cat", new() { HasTextString = "Agent profiles" }).ClickAsync();
-        await Assertions.Expect(win.Locator(".agent-profiles")).ToBeVisibleAsync();
+        // Two tables: the Board agents, then the Workflow pipeline agents.
+        await Assertions.Expect(win.Locator("table.agent-profiles")).ToHaveCountAsync(2);
+        await Assertions.Expect(win.Locator("table.agent-profiles[aria-label=\"Board agents\"] tbody tr[data-role=\"Reviewer\"]")).ToBeVisibleAsync();
         return win;
     }
 
+    // The QA agent of the Workflow pipeline, found by its stable role key.
+    private const string QaRow = ".agent-profiles tbody tr[data-role=\"Qa\"]";
+    private const string QaModel = "select[aria-label=\"QA (Workflow pipeline) model\"]";
+
     public static async Task RunAsync(IPage page, System.Func<Task> reopenDesktop)
     {
         var win = await OpenAsync(page);
-        var qaRow = win.Locator(".agent-profiles tbody tr", new() { HasTextString = "Qa" }).First;
-        var model = qaRow.Locator("select[aria-label=\"Qa model\"]");
+        var qaRow = win.Locator(QaRow);
+        var model = qaRow.Locator(QaModel);
 
         await model.SelectOptionAsync(NewModel);   // a real dropdown (ModelPicker), not a filtered datalist
         await qaRow.GetByRole(AriaRole.Button, new() { Name = "Save" }).ClickAsync();
@@ -48,12 +54,12 @@ public static async Task RunAsync(IPage page, System.Func<Task> reopenDesktop)
         await page.ReloadAsync();
         await reopenDesktop();
         win = await OpenAsync(page);
-        qaRow = win.Locator(".agent-profiles tbody tr", new() { HasTextString = "Qa" }).First;
-        await Assertions.Expect(qaRow.Locator("select[aria-label=\"Qa model\"]")).ToHaveValueAsync(NewModel);
+        qaRow = win.Locator(QaRow);
+        await Assertions.Expect(qaRow.Locator(QaModel)).ToHaveValueAsync(NewModel);
 
         // Reset returns to the inherited value and clears the tenant badge (also leaves the env clean).
         await qaRow.GetByRole(AriaRole.Button, new() { Name = "Reset" }).ClickAsync();
-        await Assertions.Expect(qaRow.Locator("select[aria-label=\"Qa model\"]")).Not.ToHaveValueAsync(NewModel);
+        await Assertions.Expect(qaRow.Locator(QaModel)).Not.ToHaveValueAsync(NewModel);
         await Assertions.Expect(qaRow).Not.ToContainTextAsync("This tenant");
     }
 }
diff --git a/tests/AgentOs.Tests/AgentOs.Tests.csproj b/tests/AgentOs.Tests/AgentOs.Tests.csproj
index 010ee0ee..440e8891 100644
--- a/tests/AgentOs.Tests/AgentOs.Tests.csproj
+++ b/tests/AgentOs.Tests/AgentOs.Tests.csproj
@@ -39,6 +39,7 @@
     <PackageReference Include="xunit.runner.visualstudio" />
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="Shouldly" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
     <!-- MTP reporting/coverage extensions (xunit.v3 4.0.0 runs on Microsoft.Testing.Platform).
          Every test project in a solution-wide run must understand the coverage / trx-report args,
@@ -57,6 +58,7 @@
     <Compile Include="..\..\src\AgentOs.RemoteAgent\PreviewHost.cs" Link="Linked\PreviewHost.cs" />
     <Compile Include="..\..\src\AgentOs.RemoteAgent\ProcessJob.cs" Link="Linked\ProcessJob.cs" />
     <Compile Include="..\..\src\AgentOs.RemoteAgent\KeepAwake.cs" Link="Linked\KeepAwake.cs" />
+    <Compile Include="..\..\src\AgentOs.RemoteAgent\CliModel.cs" Link="Linked\CliModel.cs" />
   </ItemGroup>
 
 </Project>
diff --git a/tests/AgentOs.Tests/Agents/AgentRegistryGuardTests.cs b/tests/AgentOs.Tests/Agents/AgentRegistryGuardTests.cs
new file mode 100644
index 00000000..69cc0e96
--- /dev/null
+++ b/tests/AgentOs.Tests/Agents/AgentRegistryGuardTests.cs
@@ -0,0 +1,121 @@
+// One agent registry — the guard. Four Board agents once called factory.Create("RemoteAgent") with Model:
+// "claude-sonnet-4-6" while Settings → Agent profiles showed rows that did nothing. Every agent under
+// Modules.Pipeline/Agents and /Decomposition must take its provider and model from its profile, so this test parses
+// those sources with Roslyn (syntax only — robust to formatting, comments and named vs positional arguments) and fails
+// on a string literal, an interpolated string or a same-file string constant passed as the provider to
+// ILlmClientFactory.Create or as the Model of an LlmRequest.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Shouldly;
+using Xunit;
+
+namespace AgentOs.Tests.Agents;
+
+public sealed class AgentRegistryGuardTests
+{
+    private static readonly string[] AgentFolders =
+    [
+        Path.Join("src", "AgentOs.Modules.Pipeline", "Agents"),
+        Path.Join("src", "AgentOs.Modules.Pipeline", "Decomposition"),
+    ];
+
+    [Fact]
+    public void Agents_NeverHardCodeTheirProviderOrModel()
+    {
+        var files = AgentFolders.SelectMany(f => Directory.EnumerateFiles(Path.Join(RepoRoot(), f), "*.cs", SearchOption.AllDirectories)).ToList();
+        files.Count.ShouldBeGreaterThan(5);   // the scan really looked at the agents
+
+        var violations = files.SelectMany(f => Violations(File.ReadAllText(f)).Select(v => $"{Path.GetFileName(f)}: {v}")).ToList();
+
+        violations.ShouldBeEmpty(
+            "Resolve the provider and model from the agent's profile (BoardAgent.ProfileAsync / IAgentProfiles) instead:\n"
+            + string.Join("\n", violations));
+    }
+
+    [Theory]
+    [InlineData("""class A { void M(ILlmClientFactory f) { f.Create("RemoteAgent"); } }""")]
+    [InlineData("""class A { void M(ILlmClientFactory f) { var c = f.Create($"Remote{1}"); } }""")]
+    [InlineData("""class A { const string P = "Claude"; void M(ILlmClientFactory f) { _ = f.Create(P); } }""")]
+    [InlineData("""class A { void M() { var r = new LlmRequest("s", "u", "claude-sonnet-4-6"); } }""")]
+    [InlineData("""class A { void M() { var r = new LlmRequest(SystemPrompt: "s", UserPrompt: "u", Model: "gpt-5"); } }""")]
+    [InlineData("""class A { void M() { var r = new LlmRequest(UserPrompt: "u", Model: "gpt-5", SystemPrompt: "s"); } }""")]
+    [InlineData("""class A { const string M2 = "x"; void M() { LlmRequest r = new("s", "u", M2); } }""")]
+    public void Scanner_FlagsEveryHardCodedForm(string source) => Violations(source).ShouldNotBeEmpty();
+
+    [Theory]
+    [InlineData("""class A { void M(ILlmClientFactory f, AgentOptions p) { f.Create(p.Provider); } }""")]
+    [InlineData("""class A { void M(AgentOptions p) { var r = new LlmRequest("s", "u", p.Model, p.Temperature, p.MaxTokens); } }""")]
+    [InlineData("""class A { void M(AgentOptions p) { var r = new LlmRequest(SystemPrompt: "s", UserPrompt: "u", Model: p.Model); } }""")]
+    public void Scanner_AcceptsProfileValues(string source) => Violations(source).ShouldBeEmpty();
+
+    // Syntax-only scan of one file.
+    internal static IEnumerable<string> Violations(string source)
+    {
+        var root = CSharpSyntaxTree.ParseText(source).GetCompilationUnitRoot();
+        var constants = root.DescendantNodes().OfType<FieldDeclarationSyntax>()
+            .Where(f => f.Modifiers.Any(SyntaxKind.ConstKeyword))
+            .SelectMany(f => f.Declaration.Variables.Select(v => v.Identifier.ValueText))
+            .Concat(root.DescendantNodes().OfType<LocalDeclarationStatementSyntax>()
+                .Where(l => l.IsConst).SelectMany(l => l.Declaration.Variables.Select(v => v.Identifier.ValueText)))
+            .ToHashSet(StringComparer.Ordinal);
+
+        bool HardCoded(ExpressionSyntax e) => e switch
+        {
+            LiteralExpressionSyntax lit => lit.IsKind(SyntaxKind.StringLiteralExpression),
+            InterpolatedStringExpressionSyntax => true,
+            IdentifierNameSyntax id => constants.Contains(id.Identifier.ValueText),
+            ParenthesizedExpressionSyntax p => HardCoded(p.Expression),
+            BinaryExpressionSyntax b when b.IsKind(SyntaxKind.AddExpression) => HardCoded(b.Left) && HardCoded(b.Right),
+            _ => false,
+        };
+
+        foreach (var call in root.DescendantNodes().OfType<InvocationExpressionSyntax>())
+        {
+            if (call.Expression is MemberAccessExpressionSyntax { Name.Identifier.ValueText: "Create" }
+                && call.ArgumentList.Arguments is [var provider, ..]
+                && provider.NameColon is null or { Name.Identifier.ValueText: "providerName" }
+                && HardCoded(provider.Expression))
+            {
+                yield return $"line {Line(call)}: ILlmClientFactory.Create({provider.Expression})";
+            }
+        }
+
+        foreach (var creation in root.DescendantNodes().OfType<BaseObjectCreationExpressionSyntax>())
+        {
+            var isRequest = creation switch
+            {
+                ObjectCreationExpressionSyntax o => o.Type.ToString() is "LlmRequest" or "AgentOs.Domain.Llm.LlmRequest",
+                ImplicitObjectCreationExpressionSyntax i => i.Parent?.Parent?.Parent is VariableDeclarationSyntax { Type: var t }
+                    && t.ToString() is "LlmRequest" or "AgentOs.Domain.Llm.LlmRequest",
+                _ => false,
+            };
+            if (!isRequest || creation.ArgumentList is not { } args) { continue; }
+            var model = args.Arguments.FirstOrDefault(a => a.NameColon?.Name.Identifier.ValueText == "Model")
+                ?? (args.Arguments.Count > 2 && args.Arguments.Take(3).All(a => a.NameColon is null) ? args.Arguments[2] : null);
+            if (model is not null && HardCoded(model.Expression))
+            {
+                yield return $"line {Line(creation)}: LlmRequest Model = {model.Expression}";
+            }
+        }
+    }
+
+    private static int Line(SyntaxNode node) => node.GetLocation().GetLineSpan().StartLinePosition.Line + 1;
+
+    private static string RepoRoot()
+    {
+        for (var dir = new DirectoryInfo(AppContext.BaseDirectory); dir is not null; dir = dir.Parent)
+        {
+            if (File.Exists(Path.Join(dir.FullName, "AgentOs.slnx")))
+            {
+                return dir.FullName;
+            }
+        }
+        throw new DirectoryNotFoundException("AgentOs.slnx not found above the test output directory.");
+    }
+}
diff --git a/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs b/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs
new file mode 100644
index 00000000..0009c78a
--- /dev/null
+++ b/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs
@@ -0,0 +1,404 @@
+// One agent registry: every Board agent (Coding / Reviewer / Testing (tickets), the Autopilot lead, Retrospective,
+// Discovery) is configured from Settings → Agent profiles and Settings → Prompts like the pipeline agents, files its
+// calls under its role key (what Insights groups by), reads the project's practices and passes the budget gate —
+// decided from the EFFECTIVE provider, so a forced server provider never slips past it.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Configuration;
+using AgentOs.Domain.Cost;
+using AgentOs.Domain.Llm;
+using AgentOs.Domain.Memory;
+using AgentOs.Domain.Pipeline;
+using AgentOs.Domain.Requirements;
+using AgentOs.Domain.Sessions;
+using AgentOs.Domain.Workspaces;
+using AgentOs.Modules.AppConfig;
+using AgentOs.Modules.AppConfig.Settings;
+using AgentOs.Modules.Llm;
+using AgentOs.Modules.Pipeline.Agents;
+using AgentOs.Modules.Pipeline.Decomposition;
+using AgentOs.Modules.Pipeline.Prompts;
+using AgentOs.SharedKernel.Identity;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace AgentOs.Tests.Agents;
+
+public sealed class BoardAgentRegistryTests
+{
+    private const string Tenant = "acme";
+    private static readonly string[] BoardRoles =
+        [AgentRoles.Discovery, AgentRoles.IssueWork, AgentRoles.Reviewer, AgentRoles.Acceptance, AgentRoles.AutopilotOrchestrator, AgentRoles.Retrospective];
+
+    private static readonly IReadOnlyList<string> ShopRepo = ["acme/shop"];
+
+    private sealed record Call(string Provider, LlmRequest Request);
+
+    // A factory whose clients report `effective` as their provider (what a force-provider would return) and record
+    // every request with the provider name the agent asked for.
+    private static (ILlmClientFactory Factory, List<Call> Calls) Recording(string reply, string? effective = null)
+    {
+        var calls = new List<Call>();
+        var factory = Substitute.For<ILlmClientFactory>();
+        factory.Create(Arg.Any<string>()).Returns(ci =>
+        {
+            var asked = ci.Arg<string>();
+            var client = Substitute.For<ILlmClient>();
+            client.Provider.Returns(effective ?? asked);
+            client.SendAsync(Arg.Any<LlmRequest>(), Arg.Any<CancellationToken>()).Returns(x =>
+            {
+                calls.Add(new Call(asked, x.Arg<LlmRequest>()));
+                return AgentTestHelpers.StubResponse(reply);
+            });
+            return client;
+        });
+        return (factory, calls);
+    }
+
+    private static SettingsService Settings() => new(
+        new SettingsCatalog([new LlmSettings(), new AgentSettings()]), new InMemoryAppConfigStore(),
+        new ConfigurationBuilder().Build(), new NullSettingsAuditSink(), NullLogger<SettingsService>.Instance);
+
+    private static IBudgetGuard OverBudget()
+    {
+        var guard = Substitute.For<IBudgetGuard>();
+        guard.EvaluateAsync(Arg.Any<string>(), Arg.Any<CancellationToken>())
+             .Returns(new BudgetStatus(10m, 25m, -15m, 2.5, BudgetState.Exceeded, true));
+        return guard;
+    }
+
+    private static AcceptanceRequest Change() => new(Guid.NewGuid(), Tenant, "u1",
+        new WorkRepo(Guid.NewGuid(), "acme", "shop", "main", "issue-7-ai-fix"), 7, "Checkout", "Pay by card.");
+
+    private static OrchestratorBrief Brief() => new(Guid.NewGuid(), Tenant, "u1", "Shop", "Build", "Tickets:\n#7 [open]",
+        [new OrchestratorMove("M1", "start", 7, "start #7")], [], 1, []);
+
+    private static RetrospectiveInput Lessons() => new(Tenant, "u1", "acme/shop", "#7 Checkout",
+        [new RetrospectiveItem("L1", "Run the E2E specs with the AppHost running.", false)], []);
+
+    private const string Verdict = """{"verdict":"pass","criteria":[],"summary":"ok"}""";
+    private const string Approve = """{"verdict":"approve","findings":[],"summary":"ok"}""";
+    private const string Decision = """{"reasoning":"go","moves":["M1"],"retries":[],"questions":[],"closes":[]}""";
+    private const string Practices = """{"practices":["Run the E2E specs with the AppHost running."],"absorbed":["L1"],"summary":"one"}""";
+
+    // ── The registry ────────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void Registry_EveryRoleHasAProfileRow_AndBoardRowsAreSeparateFromThePipeline()
+    {
+        AgentSettings.Roles.Select(r => r.Role).ShouldBe(AgentRoles.All.Select(r => r.Key));
+        AgentRoles.All.Where(r => r.Group == AgentRoleGroup.Board).Select(r => r.Key).ShouldBe(BoardRoles, ignoreOrder: true);
+        AgentRoles.All.Where(r => r.Group == AgentRoleGroup.WorkflowPipeline).ShouldAllBe(r => r.Label.EndsWith("(Workflow pipeline)", StringComparison.Ordinal));
+        AgentRoles.All.Select(r => r.Label).ShouldBeUnique();
+    }
+
+    [Theory]
+    [InlineData(AgentRoles.Reviewer, 32768)]
+    [InlineData(AgentRoles.Acceptance, 32768)]
+    [InlineData(AgentRoles.AutopilotOrchestrator, 4096)]
+    [InlineData(AgentRoles.Retrospective, 4096)]
+    public void Seeds_KeepTodaysBehaviour_OnTheMembersComputer(string role, int maxTokens)
+    {
+        var seed = new AgentsOptions().For(role).ShouldNotBeNull();
+        seed.Provider.ShouldBe("RemoteAgent");
+        seed.Model.ShouldBeEmpty();   // the computer's own model — never a pinned, older id
+        seed.MaxTokens.ShouldBe(maxTokens);
+    }
+
+    [Theory]
+    [InlineData("CodingAgent", AgentRoles.Coding, "Coding (Workflow pipeline)")]
+    [InlineData("Coding", AgentRoles.Coding, "Coding (Workflow pipeline)")]
+    [InlineData("IssueWork", AgentRoles.IssueWork, "Coding (tickets)")]
+    [InlineData("Acceptance", AgentRoles.Acceptance, "Testing (tickets)")]
+    [InlineData("Decomposer", AgentRoles.Discovery, "Discovery")]
+    [InlineData("AutopilotOrchestrator", AgentRoles.AutopilotOrchestrator, "Autopilot lead")]
+    [InlineData("QaAgent", AgentRoles.Qa, "QA (Workflow pipeline)")]
+    [InlineData("SomethingNew", "SomethingNew", "SomethingNew")]
+    public void Insights_NamesMatchAgentProfiles(string stored, string key, string label)
+    {
+        AgentRoles.Canonical(stored).ShouldBe(key);
+        AgentRoles.Label(stored).ShouldBe(label);
+    }
+
+    [Fact]
+    public void Prompts_EveryBoardRoleIsTunable_AndKeysAreUnique()
+    {
+        var keys = PromptCatalog.All.Select(e => e.Key).ToList();
+        keys.ShouldBeUnique();
+        foreach (var role in BoardRoles) { keys.ShouldContain(role); }
+        PromptCatalog.All.Where(e => e.Group == AgentRoleGroup.Board && !e.Key.StartsWith(AgentRoles.IssueWork, StringComparison.Ordinal))
+            .ShouldAllBe(e => e.DefaultPrompt.StartsWith("You are the ", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void PromptTemplate_FillsInOnePass_AndLeavesJsonAndUnknownWordsAlone()
+    {
+        var filled = PromptTemplate.Fill("""clone {owner}/{repo} {unknown} {"verdict":"pass"}""",
+            new Dictionary<string, string> { ["owner"] = "{repo}", ["repo"] = "shop" });
+
+        filled.ShouldBe("""clone {repo}/shop {unknown} {"verdict":"pass"}""");
+    }
+
+    // ── Profiles: provider + model per call ─────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task BoardAgents_UseTheirProfile_AndFileCallsUnderTheirRole()
+    {
+        var settings = Settings();
+        foreach (var role in new[] { AgentRoles.Reviewer, AgentRoles.Acceptance, AgentRoles.AutopilotOrchestrator, AgentRoles.Retrospective })
+        {
+            (await settings.SetAsync(AgentSettings.Key(role, "Model"), "claude-opus-5-5", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+        }
+        var profiles = new SettingsAgentProfiles(settings);
+        var (review, reviewCalls) = Recording(Approve);
+        var (test, testCalls) = Recording(Verdict);
+        var (lead, leadCalls) = Recording(Decision);
+        var (retro, retroCalls) = Recording(Practices);
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            (await new ReviewAgent(review, NullLogger<ReviewAgent>.Instance, profiles: profiles).RunAsync(Change())).Ran.ShouldBeTrue();
+            (await new AcceptanceAgent(test, NullLogger<AcceptanceAgent>.Instance, profiles: profiles).RunAsync(Change())).Ran.ShouldBeTrue();
+            (await new AutopilotOrchestratorAgent(lead, NullLogger<AutopilotOrchestratorAgent>.Instance, profiles: profiles).DecideAsync(Brief())).Ran.ShouldBeTrue();
+            (await new RetrospectiveAgent(retro, NullLogger<RetrospectiveAgent>.Instance, profiles: profiles).RunAsync(Lessons())).Ran.ShouldBeTrue();
+        }
+
+        foreach (var (calls, role) in new[] { (reviewCalls, AgentRoles.Reviewer), (testCalls, AgentRoles.Acceptance), (leadCalls, AgentRoles.AutopilotOrchestrator), (retroCalls, AgentRoles.Retrospective) })
+        {
+            var call = calls.ShouldHaveSingleItem();
+            call.Provider.ShouldBe("RemoteAgent");                 // the seed provider, still on the member's computer
+            call.Request.Model.ShouldBe("claude-opus-5-5");        // the tenant's pick, not a hard-coded model
+            call.Request.AgentRole.ShouldBe(role);                 // Insights files it under the Agent profiles row
+        }
+    }
+
+    [Fact]
+    public async Task BoardAgent_ProviderChangedInSettings_IsTheOneAskedFor()
+    {
+        var settings = Settings();
+        (await settings.SetAsync(AgentSettings.Key(AgentRoles.Reviewer, "Provider"), "Claude", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+        var (factory, calls) = Recording(Approve);
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            await new ReviewAgent(factory, NullLogger<ReviewAgent>.Instance, profiles: new SettingsAgentProfiles(settings)).RunAsync(Change());
+        }
+
+        calls.ShouldHaveSingleItem().Provider.ShouldBe("Claude");
+    }
+
+    // ── Budget gate: decided from the effective provider ────────────────────────────────────────
+
+    [Fact]
+    public async Task BoardAgents_OnAForcedServerProvider_PassTheBudgetGate()
+    {
+        // The profiles say RemoteAgent, but Settings forces a server provider: the gate must apply.
+        var guard = OverBudget();
+        var (factory, calls) = Recording(Approve, effective: "Claude");
+
+        var review = await new ReviewAgent(factory, NullLogger<ReviewAgent>.Instance, budgetGuard: guard).RunAsync(Change());
+        var test = await new AcceptanceAgent(factory, NullLogger<AcceptanceAgent>.Instance, budgetGuard: guard).RunAsync(Change());
+        var lead = await new AutopilotOrchestratorAgent(factory, NullLogger<AutopilotOrchestratorAgent>.Instance, budgetGuard: guard).DecideAsync(Brief());
+        var retro = await new RetrospectiveAgent(factory, NullLogger<RetrospectiveAgent>.Instance, budgetGuard: guard).RunAsync(Lessons());
+
+        review.Ran.ShouldBeFalse();
+        review.Error.ShouldBe(AgentBudgetGate.BlockedMessage);
+        test.Ran.ShouldBeFalse();
+        lead.Ran.ShouldBeFalse();
+        retro.Ran.ShouldBeFalse();
+        calls.ShouldBeEmpty();   // blocked before any server token is spent
+    }
+
+    [Fact]
+    public async Task BoardAgents_OnTheMembersComputer_AreExempt_AndNeverAskTheBudget()
+    {
+        var guard = OverBudget();
+        var (factory, calls) = Recording(Verdict);
+
+        (await new AcceptanceAgent(factory, NullLogger<AcceptanceAgent>.Instance, budgetGuard: guard).RunAsync(Change())).Ran.ShouldBeTrue();
+
+        calls.ShouldHaveSingleItem();
+        await guard.DidNotReceive().EvaluateAsync(Arg.Any<string>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task IssueWork_ForcedServerProvider_IsGated_EvenWhenTheRunAskedForTheMembersComputer()
+    {
+        var guard = OverBudget();
+        var (factory, calls) = Recording("""{"branch":"issue-7-ai-fix","summary":"done"}""", effective: "Claude");
+        var agent = new IssueWorkAgent(factory, Options.Create(new AgentsOptions()), NullLogger<IssueWorkAgent>.Instance, budgetGuard: guard);
+
+        var result = await agent.RunAsync(new IssueWorkRequest(Guid.NewGuid(), Tenant, "u1",
+            [new WorkRepo(Guid.NewGuid(), "acme", "shop", "main")], 7, "Checkout", "Pay by card.") { ProviderOverride = "RemoteAgent" });
+
+        result.Ok.ShouldBeFalse();
+        result.Error!.ShouldContain("budget");
+        calls.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task IssueWork_FilesItsCallsUnderItsRole()
+    {
+        var (factory, calls) = Recording("""{"branch":"issue-7-ai-fix","summary":"done"}""");
+        var agent = new IssueWorkAgent(factory, Options.Create(new AgentsOptions()), NullLogger<IssueWorkAgent>.Instance);
+
+        await agent.RunAsync(new IssueWorkRequest(Guid.NewGuid(), Tenant, "u1",
+            [new WorkRepo(Guid.NewGuid(), "acme", "shop", "main")], 7, "Checkout", "Pay by card."));
+
+        calls.ShouldHaveSingleItem().Request.AgentRole.ShouldBe(AgentRoles.IssueWork);
+    }
+
+    // ── Prompts: Settings → Prompts overrides reach the Board agents ────────────────────────────
+
+    [Fact]
+    public async Task BoardAgents_UseTheTenantsPromptOverride_FilledPerRun_ThenTheFixedRules()
+    {
+        var prompts = Substitute.For<IPromptOverrides>();
+        prompts.ResolveAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<CancellationToken>()).Returns(ci => ci.ArgAt<string>(1));
+        prompts.ResolveAsync(AgentRoles.Reviewer, Arg.Any<string>(), Arg.Any<CancellationToken>())
+               .Returns("You are the Reviewer Agent of ACME. Check out {branch} of {owner}/{repo}.");
+        prompts.ResolveRulesAsync(Arg.Any<CancellationToken>()).Returns("Never touch /infra.");
+        var (factory, calls) = Recording(Approve);
+
+        await new ReviewAgent(factory, NullLogger<ReviewAgent>.Instance, prompts: prompts).RunAsync(Change());
+
+        var system = calls.ShouldHaveSingleItem().Request.SystemPrompt;
+        system.ShouldStartWith("You are the Reviewer Agent of ACME. Check out issue-7-ai-fix of acme/shop.");
+        system.ShouldContain(UntrustedText.SystemRule);            // the security rule is never overridable
+        system.ShouldContain("<workspace_rules>\nNever touch /infra.");
+    }
+
+    [Theory]
+    [InlineData(null, AgentRoles.IssueWork)]                     // the member's computer (Board default)
+    [InlineData("Claude", "IssueWork.Server")]                    // the server runner_shell loop
+    public async Task IssueWork_ResolvesThePromptOfItsMode(string? effective, string key)
+    {
+        var prompts = Substitute.For<IPromptOverrides>();
+        prompts.ResolveAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<CancellationToken>()).Returns("CUSTOM {owner}/{repo} -> {branch}");
+        var (factory, calls) = Recording("""{"branch":"issue-7-ai-fix","summary":"done"}""", effective ?? "RemoteAgent");
+        var agent = new IssueWorkAgent(factory, Options.Create(new AgentsOptions()), NullLogger<IssueWorkAgent>.Instance, prompts: prompts);
+
+        await agent.RunAsync(new IssueWorkRequest(Guid.NewGuid(), Tenant, "u1",
+            [new WorkRepo(Guid.NewGuid(), "acme", "shop", "main")], 7, "Checkout", "Pay by card."));
+
+        await prompts.Received().ResolveAsync(key, Arg.Any<string>(), Arg.Any<CancellationToken>());
+        calls.ShouldHaveSingleItem().Request.SystemPrompt.ShouldStartWith("CUSTOM acme/shop -> issue-7-ai-fix");
+    }
+
+    // ── Practices ───────────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Testing_And_AutopilotLead_ReadTheProjectsPractices()
+    {
+        var memory = new PracticesMemory(Tenant, "acme/shop", "Run the E2E specs with the AppHost running.");
+        var boardRepos = Substitute.For<IBoardRepos>();
+        boardRepos.RepoKeysAsync(Tenant, Arg.Any<Guid>(), Arg.Any<CancellationToken>()).Returns(ShopRepo);
+        var (test, testCalls) = Recording(Verdict);
+        var (lead, leadCalls) = Recording(Decision);
+
+        await new AcceptanceAgent(test, NullLogger<AcceptanceAgent>.Instance, memory: memory).RunAsync(Change());
+        await new AutopilotOrchestratorAgent(lead, NullLogger<AutopilotOrchestratorAgent>.Instance, memory: memory, boardRepos: boardRepos).DecideAsync(Brief());
+
+        testCalls.ShouldHaveSingleItem().Request.UserPrompt.ShouldContain("Run the E2E specs with the AppHost running.");
+        leadCalls.ShouldHaveSingleItem().Request.UserPrompt.ShouldContain("Run the E2E specs with the AppHost running.");
+    }
+
+    [Fact]
+    public async Task Practices_AreStrictlyPerTenant()
+    {
+        var memory = new PracticesMemory("other-tenant", "acme/shop", "A practice of someone else.");
+        var (test, calls) = Recording(Verdict);
+
+        await new AcceptanceAgent(test, NullLogger<AcceptanceAgent>.Instance, memory: memory).RunAsync(Change());
+
+        calls.ShouldHaveSingleItem().Request.UserPrompt.ShouldNotContain("someone else");
+    }
+
+    // ── Discovery ───────────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Discovery_TheRequirementStepAndTheSplit_UseTheDiscoveryProfile_AndRole()
+    {
+        var settings = Settings();
+        (await settings.SetAsync(AgentSettings.Key(AgentRoles.Discovery, "Model"), "claude-haiku-5-5", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+        var profiles = new SettingsAgentProfiles(settings);
+        var offline = new OfflineLlmClient();
+        var calls = new List<LlmRequest>();
+        var factory = Substitute.For<ILlmClientFactory>();
+        factory.Create(Arg.Any<string>()).Returns(_ =>
+        {
+            var client = Substitute.For<ILlmClient>();
+            client.Provider.Returns("RemoteAgent");
+            client.SendAsync(Arg.Any<LlmRequest>(), Arg.Any<CancellationToken>()).Returns(x =>
+            {
+                calls.Add(x.Arg<LlmRequest>());
+                return offline.SendAsync(x.Arg<LlmRequest>(), x.Arg<CancellationToken>());
+            });
+            return client;
+        });
+        var options = Options.Create(new AgentsOptions());
+        var requirement = new RequirementAgent(factory, options, AgentTestHelpers.Validator, AgentTestHelpers.NewCollector(),
+            NullLogger<RequirementAgent>.Instance, profiles: profiles);
+        var decomposer = new TicketDecomposerAgent(factory, options, NullLogger<TicketDecomposerAgent>.Instance, profiles);
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            await new IdeaBootstrapService(requirement, decomposer, options).GenerateAsync("A shop with card payments");
+            // The same Requirement agent outside Discovery keeps its own (Workflow pipeline) profile.
+            await requirement.RunAsync(new UserStory("A shop with card payments"));
+        }
+
+        calls.Count.ShouldBe(3);
+        calls[0].AgentRole.ShouldBe(AgentRoles.Discovery);
+        calls[0].Model.ShouldBe("claude-haiku-5-5");
+        calls[0].SystemPrompt.ShouldStartWith("You are the Requirement Agent");   // the spec contract stays the Requirement agent's
+        calls[1].AgentRole.ShouldBe(AgentRoles.Discovery);
+        calls[1].Model.ShouldBe("claude-haiku-5-5");
+        calls[2].AgentRole.ShouldBe(AgentRoles.Requirement);
+        calls[2].Model.ShouldBe(new AgentsOptions().Requirement.Model);
+    }
+
+    [Fact]
+    public async Task Discovery_OverBudgetOnAServerProvider_IsBlocked()
+    {
+        var factory = Substitute.For<ILlmClientFactory>();
+        var client = Substitute.For<ILlmClient>();
+        client.Provider.Returns("Claude");
+        factory.Create(Arg.Any<string>()).Returns(client);
+        var options = Options.Create(new AgentsOptions());
+        var requirement = new RequirementAgent(factory, options, AgentTestHelpers.Validator, AgentTestHelpers.NewCollector(),
+            NullLogger<RequirementAgent>.Instance);
+        var decomposer = new TicketDecomposerAgent(factory, options, NullLogger<TicketDecomposerAgent>.Instance);
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            var ex = await Should.ThrowAsync<LlmException>(() =>
+                new IdeaBootstrapService(requirement, decomposer, options, OverBudget()).GenerateAsync("A shop"));
+            ex.Message.ShouldContain("budget");
+        }
+        await client.DidNotReceive().SendAsync(Arg.Any<LlmRequest>(), Arg.Any<CancellationToken>());
+    }
+
+    // Practices of one (tenant, repo); everything else is empty. ListAsync is the interface default over GraphAsync.
+    private sealed class PracticesMemory(string tenant, string repo, string practice) : IMemoryStore
+    {
+        public Task<Guid> RecordAsync(string tenantId, MemoryNodeInput node, CancellationToken ct = default) => Task.FromResult(Guid.Empty);
+        public Task LinkAsync(string tenantId, Guid fromId, Guid toId, string rel, CancellationToken ct = default) => Task.CompletedTask;
+        public Task<IReadOnlyList<MemoryNode>> RecallLessonsAsync(string tenantId, string repoKey, string query, int max, CancellationToken ct = default) =>
+            Task.FromResult<IReadOnlyList<MemoryNode>>([]);
+        public Task<MemoryGraph> GraphAsync(string tenantId, string? repoKey, int maxNodes, CancellationToken ct = default) =>
+            Task.FromResult(tenantId == tenant && repoKey == repo
+                ? new MemoryGraph([new MemoryNode(Guid.NewGuid(), MemoryKinds.Practice, "p1", practice, practice, repo, false, DateTimeOffset.UtcNow, null)], [])
+                : new MemoryGraph([], []));
+        public Task SetPinnedAsync(string tenantId, Guid nodeId, bool pinned, CancellationToken ct = default) => Task.CompletedTask;
+        public Task ForgetAsync(string tenantId, Guid nodeId, CancellationToken ct = default) => Task.CompletedTask;
+    }
+}
diff --git a/tests/AgentOs.Tests/Agents/ComputersDefaultModelTests.cs b/tests/AgentOs.Tests/Agents/ComputersDefaultModelTests.cs
new file mode 100644
index 00000000..d305da09
--- /dev/null
+++ b/tests/AgentOs.Tests/Agents/ComputersDefaultModelTests.cs
@@ -0,0 +1,289 @@
+// "Computer's default": a Board agent chooses NO model unless someone picks one. On a member's computer the request
+// reaches the runner with an empty model, so the CLI runs its own (newer) default — no `--model` flag; on our servers
+// the LLM gateway fills the provider's configured model before validation; an explicitly chosen model is still passed.
+// And the Decomposer → Discovery rename keeps a tenant's saved Decomposer profile and prompt working.
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Configuration;
+using AgentOs.Domain.Llm;
+using AgentOs.Domain.Sessions;
+using AgentOs.Modules.AppConfig;
+using AgentOs.Modules.AppConfig.Settings;
+using AgentOs.Modules.Llm;
+using AgentOs.Modules.Pipeline.Agents;
+using AgentOs.Modules.Pipeline.Prompts;
+using AgentOs.Modules.RemoteAgent;
+using AgentOs.RemoteAgent;
+using AgentOs.SharedKernel.Identity;
+using Microsoft.Extensions.AI;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace AgentOs.Tests.Agents;
+
+public sealed class ComputersDefaultModelTests
+{
+    private const string Tenant = "acme";
+    private static readonly string[] ClaudeArgs = ["-p"];
+
+    private static AcceptanceRequest Change() => new(Guid.NewGuid(), Tenant, "u1",
+        new WorkRepo(Guid.NewGuid(), "acme", "shop", "main", "issue-7-ai-fix"), 7, "Checkout", "Pay by card.");
+
+    private const string Approve = """{"verdict":"approve","findings":[],"summary":"ok"}""";
+
+    private static SettingsService Settings(InMemoryAppConfigStore? store = null, IConfiguration? config = null) => new(
+        new SettingsCatalog([new LlmSettings(), new AgentSettings()]), store ?? new InMemoryAppConfigStore(),
+        config ?? new ConfigurationBuilder().Build(), new NullSettingsAuditSink(), NullLogger<SettingsService>.Instance);
+
+    // A factory whose every client is `client`.
+    private static ILlmClientFactory FactoryOf(ILlmClient client)
+    {
+        var factory = Substitute.For<ILlmClientFactory>();
+        factory.Create(Arg.Any<string>()).Returns(client);
+        return factory;
+    }
+
+    [Theory]
+    [InlineData(AgentRoles.Discovery)]
+    [InlineData(AgentRoles.IssueWork)]
+    [InlineData(AgentRoles.Reviewer)]
+    [InlineData(AgentRoles.Acceptance)]
+    [InlineData(AgentRoles.AutopilotOrchestrator)]
+    [InlineData(AgentRoles.Retrospective)]
+    public void BoardSeeds_ChooseNoModel_AndStartupValidationAcceptsIt(string role)
+    {
+        new AgentsOptions().For(role).ShouldNotBeNull().Model.ShouldBeEmpty();
+        AgentsOptions.ModelIsOptional(role).ShouldBeTrue();
+        new AgentsOptions().IsValid().ShouldBeTrue();
+    }
+
+    [Fact]
+    public void PipelineAgents_StillNeedAModel()
+    {
+        AgentsOptions.ModelIsOptional(AgentRoles.Qa).ShouldBeFalse();
+        new AgentsOptions { Qa = new AgentOptions { Model = " ", MaxTokens = 10 } }.IsValid().ShouldBeFalse();
+    }
+
+    // (a) default profile on RemoteAgent → the runner gets an empty model → the CLI gets no model flag.
+    [Fact]
+    public async Task DefaultProfile_OnTheMembersComputer_SendsNoModel_AndTheCliGetsNoFlag()
+    {
+        var broker = new InProcessRemoteAgentBroker();
+        using var reg = broker.RegisterRunner("conn-1", new RunnerConnection(Guid.NewGuid(), Tenant, "u1"));
+        RemoteExecRequest? sent = null;
+        broker.Dispatched += d =>
+        {
+            sent = d.Request;
+            broker.Complete(new RemoteExecResult(d.Request.Id, true, Approve, null));
+        };
+        var remote = new RemoteAgentLlmClient(broker, new ServiceCollection().BuildServiceProvider(), NullLogger<RemoteAgentLlmClient>.Instance);
+
+        ReviewVerdict verdict;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            verdict = await new ReviewAgent(FactoryOf(remote), NullLogger<ReviewAgent>.Instance,
+                profiles: new SettingsAgentProfiles(Settings())).RunAsync(Change());
+        }
+
+        verdict.Ran.ShouldBeTrue();
+        sent.ShouldNotBeNull().Model.ShouldBeEmpty();
+        CliModel.Flags("claude", sent.Model, ClaudeArgs).ShouldBeEmpty();
+        CliModel.Flags("codex", sent.Model, ClaudeArgs).ShouldBeEmpty();
+    }
+
+    // (b) default profile on a server provider → the provider's configured model; validation passes.
+    [Fact]
+    public async Task DefaultProfile_OnAServerProvider_UsesTheProvidersConfiguredModel()
+    {
+        ChatOptions? seen = null;
+        var chat = Substitute.For<IChatClient>();
+        chat.GetResponseAsync(Arg.Any<IEnumerable<ChatMessage>>(), Arg.Any<ChatOptions>(), Arg.Any<CancellationToken>())
+            .Returns(ci =>
+            {
+                seen = ci.ArgAt<ChatOptions>(1);
+                return new ChatResponse(new ChatMessage(ChatRole.Assistant, Approve)) { Usage = new UsageDetails { InputTokenCount = 1, OutputTokenCount = 1 } };
+            });
+        var claude = new PooledChatLlmClient("Claude", (_, _) => chat,
+            _ => ValueTask.FromResult<IReadOnlyList<string>>(["k1"]), new ApiKeyRouter(TimeProvider.System),
+            _ => false, _ => null, NullLogger.Instance, defaultModel: () => "claude-sonnet-5");
+        var settings = Settings();
+        (await settings.SetAsync(AgentSettings.Key(AgentRoles.Reviewer, "Provider"), "Claude", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+
+        ReviewVerdict verdict;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            verdict = await new ReviewAgent(FactoryOf(claude), NullLogger<ReviewAgent>.Instance,
+                profiles: new SettingsAgentProfiles(settings)).RunAsync(Change());
+        }
+
+        verdict.Ran.ShouldBeTrue();                          // no ArgumentException from LlmRequest.Validate
+        seen.ShouldNotBeNull().ModelId.ShouldBe("claude-sonnet-5");
+    }
+
+    [Fact]
+    public async Task ChatClient_EmptyModel_UsesItsDefault_AndAnExplicitModelWins()
+    {
+        var models = new List<string?>();
+        var chat = Substitute.For<IChatClient>();
+        chat.GetResponseAsync(Arg.Any<IEnumerable<ChatMessage>>(), Arg.Any<ChatOptions>(), Arg.Any<CancellationToken>())
+            .Returns(ci =>
+            {
+                models.Add(ci.ArgAt<ChatOptions>(1).ModelId);
+                return new ChatResponse(new ChatMessage(ChatRole.Assistant, "ok"));
+            });
+        var client = new ChatClientLlmClient(chat, "P", defaultModel: "gpt-5.4");
+
+        await client.SendAsync(new LlmRequest("s", "u", ""));
+        await client.SendAsync(new LlmRequest("s", "u", "gpt-4.1"));
+
+        models.ShouldBe(["gpt-5.4", "gpt-4.1"]);
+    }
+
+    [Fact]
+    public async Task ServerProvider_WithNoModelAnywhere_StillFailsValidation()
+    {
+        var client = new ChatClientLlmClient(Substitute.For<IChatClient>(), "P");
+
+        await Should.ThrowAsync<ArgumentException>(() => client.SendAsync(new LlmRequest("s", "u", "")));
+    }
+
+    // (c) an explicitly chosen model is passed to the CLI.
+    [Fact]
+    public async Task ChosenModel_OnTheMembersComputer_IsPassedToTheCli()
+    {
+        var broker = new InProcessRemoteAgentBroker();
+        using var reg = broker.RegisterRunner("conn-1", new RunnerConnection(Guid.NewGuid(), Tenant, "u1"));
+        RemoteExecRequest? sent = null;
+        broker.Dispatched += d =>
+        {
+            sent = d.Request;
+            broker.Complete(new RemoteExecResult(d.Request.Id, true, Approve, null));
+        };
+        var remote = new RemoteAgentLlmClient(broker, new ServiceCollection().BuildServiceProvider(), NullLogger<RemoteAgentLlmClient>.Instance);
+        var settings = Settings();
+        (await settings.SetAsync(AgentSettings.Key(AgentRoles.Reviewer, "Model"), "claude-opus-5-5", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            await new ReviewAgent(FactoryOf(remote), NullLogger<ReviewAgent>.Instance, profiles: new SettingsAgentProfiles(settings)).RunAsync(Change());
+        }
+
+        sent.ShouldNotBeNull().Model.ShouldBe("claude-opus-5-5");
+        CliModel.Flags("claude", sent.Model, ClaudeArgs).ShouldBe(["--model", "claude-opus-5-5"]);
+    }
+
+    [Fact]
+    public async Task RemoteAgent_NoModel_ReportsTheComputersDefault_InMetrics()
+    {
+        var broker = new InProcessRemoteAgentBroker();
+        using var reg = broker.RegisterRunner("conn-1", new RunnerConnection(Guid.NewGuid(), Tenant, "u1"));
+        broker.Dispatched += d => broker.Complete(new RemoteExecResult(d.Request.Id, true, "ok", null));
+        var remote = new RemoteAgentLlmClient(broker, new ServiceCollection().BuildServiceProvider(), NullLogger<RemoteAgentLlmClient>.Instance);
+
+        LlmResponse response;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            response = await remote.SendAsync(new LlmRequest("s", "u", ""));
+        }
+
+        response.Model.ShouldBe(RemoteAgentLlmClient.ComputerDefaultModel);
+    }
+
+    // ── Decomposer → Discovery: saved values keep working ───────────────────────────────────────
+
+    [Fact]
+    public async Task LegacyDecomposerProfile_AppliesToDiscovery_UntilDiscoveryIsSaved()
+    {
+        var store = new InMemoryAppConfigStore();
+        await store.SetForTenantAsync(Tenant, "Agents:Decomposer:Model", "claude-haiku-5-5");
+        await store.SetForTenantAsync(Tenant, "Agents:Decomposer:MaxTokens", "1234");
+        var settings = Settings(store);
+        var profiles = new SettingsAgentProfiles(settings, legacy: new LegacyAgentSettings(store));
+        var seed = new AgentsOptions().Discovery;
+
+        AgentOptions before, after, other;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            before = await profiles.ResolveAsync(AgentRoles.Discovery, seed);
+            (await settings.SetAsync(AgentSettings.Key(AgentRoles.Discovery, "Model"), "claude-opus-5-5", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+            after = await profiles.ResolveAsync(AgentRoles.Discovery, seed);
+        }
+        using (AmbientIdentity.Push("globex", "u2"))
+        {
+            other = await profiles.ResolveAsync(AgentRoles.Discovery, seed);
+        }
+
+        before.Model.ShouldBe("claude-haiku-5-5");
+        before.MaxTokens.ShouldBe(1234);
+        after.Model.ShouldBe("claude-opus-5-5");   // the new key, once saved, wins
+        after.MaxTokens.ShouldBe(1234);            // fields not re-saved keep the legacy value
+        other.Model.ShouldBeEmpty();               // strictly per tenant
+        other.MaxTokens.ShouldBe(seed.MaxTokens);
+    }
+
+    [Fact]
+    public async Task LegacyDecomposerSeed_InConfiguration_AppliesToDiscovery()
+    {
+        var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?> { ["Agents:Decomposer:Provider"] = "AzureOpenAI" }).Build();
+        var profiles = new SettingsAgentProfiles(Settings(config: config), legacy: new LegacyAgentSettings(null, config));
+
+        (await profiles.ResolveAsync(AgentRoles.Discovery, new AgentsOptions().Discovery)).Provider.ShouldBe("AzureOpenAI");
+    }
+
+    [Fact]
+    public async Task LegacyDecomposerProfile_ResetClearsIt()
+    {
+        var store = new InMemoryAppConfigStore();
+        await store.SetForTenantAsync(Tenant, "Agents:Decomposer:Model", "claude-haiku-5-5");
+        var legacy = new LegacyAgentSettings(store);
+
+        (await legacy.AnyAsync(AgentRoles.Discovery, Tenant)).ShouldBeTrue();
+        await legacy.ClearTenantAsync(AgentRoles.Discovery, Tenant);
+
+        (await legacy.AnyAsync(AgentRoles.Discovery, Tenant)).ShouldBeFalse();
+        (await legacy.ReadAsync(AgentRoles.Reviewer, "Model", Tenant)).ShouldBeNull();   // only renamed roles have a former key
+    }
+
+    [Fact]
+    public async Task LegacyDecomposerPrompt_AppliesToDiscovery_ShowsInPrompts_AndResetClearsIt()
+    {
+        var store = new InMemoryAppConfigStore();
+        await store.SetForTenantAsync(Tenant, "prompt/Decomposer/system", "You are the Decomposition Agent of ACME.");
+        var resolver = new AppConfigPromptOverrides(NullLogger<AppConfigPromptOverrides>.Instance, store);
+        var service = new PromptOverrideService(store);
+
+        string resolved;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            resolved = await resolver.ResolveAsync(AgentRoles.Discovery, DecomposerPrompt.System);
+        }
+        resolved.ShouldBe("You are the Decomposition Agent of ACME.");
+        (await service.GetAsync(Tenant, AgentRoles.Discovery)).ShouldBe("You are the Decomposition Agent of ACME.");
+
+        await service.ClearAsync(Tenant, AgentRoles.Discovery);
+
+        (await service.GetAsync(Tenant, AgentRoles.Discovery)).ShouldBeNull();
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            (await resolver.ResolveAsync(AgentRoles.Discovery, DecomposerPrompt.System)).ShouldBe(DecomposerPrompt.System);
+        }
+    }
+
+    [Fact]
+    public async Task DiscoveryPromptSaved_WinsOverTheLegacyOne()
+    {
+        var store = new InMemoryAppConfigStore();
+        await store.SetForTenantAsync(Tenant, "prompt/Decomposer/system", "old");
+        var service = new PromptOverrideService(store);
+        await service.SetAsync(Tenant, AgentRoles.Discovery, "new");
+
+        (await service.GetAsync(Tenant, AgentRoles.Discovery)).ShouldBe("new");
+    }
+}
diff --git a/tests/AgentOs.Tests/Configuration/SettingsServiceTests.cs b/tests/AgentOs.Tests/Configuration/SettingsServiceTests.cs
index a3c93734..1701ed95 100644
--- a/tests/AgentOs.Tests/Configuration/SettingsServiceTests.cs
+++ b/tests/AgentOs.Tests/Configuration/SettingsServiceTests.cs
@@ -189,7 +189,8 @@ public void Catalog_RealModules_BuildWithoutConflicts_AndCoverEveryAgentRole()
         foreach (var (role, defaults) in AgentSettings.Roles)
         {
             catalog.TryGet(AgentSettings.Key(role, "Model"), out var model).ShouldBeTrue();
-            model.DefaultValue.ShouldBe(defaults.Model);
+            // A Board agent's empty seed is "no default" (the computer's / provider's model), never an empty-string value.
+            model.DefaultValue.ShouldBe(string.IsNullOrEmpty(defaults.Model) ? null : defaults.Model);
             catalog.TryGet(AgentSettings.Key(role, "MaxTokens"), out var max).ShouldBeTrue();
             max.Max.ShouldBe(AgentSettings.MaxOutputTokensCeiling);
         }
diff --git a/tests/AgentOs.Tests/Pipeline/PromptsV2Tests.cs b/tests/AgentOs.Tests/Pipeline/PromptsV2Tests.cs
index 683f45ed..7ce93d68 100644
--- a/tests/AgentOs.Tests/Pipeline/PromptsV2Tests.cs
+++ b/tests/AgentOs.Tests/Pipeline/PromptsV2Tests.cs
@@ -108,7 +108,8 @@ public async Task Agent_SystemPrompt_CarriesTheRules_AfterItsOwnPrompt()
         prompts[0].ShouldContain("<workspace_rules>\nNever use FluentAssertions.");
     }
 
+    // The ticket split is the Discovery agent's prompt (one key with its Agent profiles row and its Insights name).
     [Fact]
-    public void Catalog_NowIncludesTheDecomposer()
-        => PromptCatalog.All.Select(e => e.Key).ShouldContain("Decomposer");
+    public void Catalog_IncludesTheDiscoveryPrompt()
+        => PromptCatalog.All.Single(e => e.Key == AgentRoles.Discovery).DefaultPrompt.ShouldBe(DecomposerPrompt.System);
 }
diff --git a/tests/AgentOs.Tests/Sessions/CliModelTests.cs b/tests/AgentOs.Tests/Sessions/CliModelTests.cs
new file mode 100644
index 00000000..f9e8fcb0
--- /dev/null
+++ b/tests/AgentOs.Tests/Sessions/CliModelTests.cs
@@ -0,0 +1,56 @@
+// The model an agent's profile picked reaches the paired runner's CLI: `--model <id>` for Claude Code, `-m <id>` for
+// Codex; nothing when the request carries no model, the CLI cannot serve it, or the operator's own args name one.
+
+using AgentOs.RemoteAgent;
+using Shouldly;
+using Xunit;
+
+namespace AgentOs.Tests.Sessions;
+
+public sealed class CliModelTests
+{
+    private static readonly string[] ClaudeDefaults = ["-p"];
+    private static readonly string[] CodexDefaults = ["exec"];
+
+    [Theory]
+    [InlineData("claude", "claude-sonnet-4-6")]
+    [InlineData("claude", "claude-opus-5-5")]
+    [InlineData("claude", "sonnet")]
+    [InlineData(@"C:\Users\me\AppData\Roaming\npm\claude.cmd", "claude-haiku-5-5")]
+    [InlineData("/usr/local/bin/claude", "claude-fable-1")]
+    public void Claude_GetsDashDashModel(string command, string model) =>
+        CliModel.Flags(command, model, ClaudeDefaults).ShouldBe(["--model", model]);
+
+    [Theory]
+    [InlineData("codex", "gpt-5.1-codex")]
+    [InlineData(@"C:\npm\codex.cmd", "o4-mini")]
+    public void Codex_GetsDashM(string command, string model) =>
+        CliModel.Flags(command, model, CodexDefaults).ShouldBe(["-m", model]);
+
+    [Theory]
+    [InlineData("claude", "")]
+    [InlineData("claude", "   ")]
+    [InlineData("claude", null)]
+    [InlineData("claude", "gpt-5")]                  // a model claude cannot serve: its default applies
+    [InlineData("codex", "claude-sonnet-4-6")]        // a model codex cannot serve
+    [InlineData("my-agent", "claude-sonnet-4-6")]     // an unknown CLI: never guess its flags
+    [InlineData("claude", "--dangerously-skip-permissions")]   // never let a model id become a flag
+    [InlineData("claude", "claude sonnet")]
+    public void NoFlag_WhenThereIsNothingTheCliCanUse(string command, string? model) =>
+        CliModel.Flags(command, model, ClaudeDefaults).ShouldBeEmpty();
+
+    [Theory]
+    [InlineData("--model", "opus")]
+    [InlineData("-m", "x")]
+    [InlineData("--model=opus")]
+    public void OperatorArgs_ThatNameAModel_Win(params string[] existing) =>
+        CliModel.Flags("claude", "claude-sonnet-4-6", ["-p", .. existing]).ShouldBeEmpty();
+
+    [Theory]
+    [InlineData("claude", "claude")]
+    [InlineData(@"C:\npm\Claude.CMD", "claude")]
+    [InlineData("/opt/codex", "codex")]
+    [InlineData("", "")]
+    public void CommandName_IsTheBareCliName_OnEveryOs(string command, string expected) =>
+        CliModel.CommandName(command).ShouldBe(expected);
+}