From 30a1a6deb052c7ac302715dd72b6e9c5df3d12d7 Mon Sep 17 00:00:00 2001
From: Hoang Snowy <nguyenminhhoang.dit12@gmail.com>
Date: Sat, 24 Oct 2026 01:08:32 +0700
Subject: [PATCH 1/2] feat(agents): every Board agent is configured from Agent
 profiles and Prompts

One agent registry (AgentRoles): every agent has one stable role key used for
its profile (Agents:<Key>:*), its prompt (Settings -> Prompts), the AgentRole
of its LLM calls (Insights "by agent") and its run label.

- Reviewer, Testing (tickets) = Acceptance, Autopilot lead =
  AutopilotOrchestrator and Retrospective no longer hard-code
  factory.Create("RemoteAgent") + "claude-sonnet-4-6": they resolve their
  profile per call (seeds keep RemoteAgent + claude-sonnet-4-6).
- Agent profiles shows the Board agents and the Workflow pipeline in two
  tables; pipeline labels say "(Workflow pipeline)". Discovery replaces the
  Decomposer profile/prompt and also drives New idea's requirement step
  (AgentRunScope).
- Settings -> Prompts lists every Board agent; Board prompts are templates
  with {placeholders} filled per run (PromptTemplate); the untrusted-text rule
  stays code-appended.
- Budget gate on every Board agent, decided from the EFFECTIVE provider
  (client.Provider after force-provider); only real member's-computer runs
  are exempt. IssueWork now derives CLI mode from it too.
- Testing (tickets) and the Autopilot lead read the project practices
  (ProjectPractices, IBoardRepos from Workspaces).
- The paired runner passes the profile model to the CLI: claude --model,
  codex -m (CliModel), only when that CLI can serve it.
- Insights groups by AgentRoles.Canonical and shows the Agent profiles label.
- Guard: AgentRegistryGuardTests parses Agents/ and Decomposition/ with Roslyn
  and fails on a literal provider to ILlmClientFactory.Create or a literal
  LlmRequest Model.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018WAdQ7Rm24xss5QDSvXtJB
---
 Directory.Packages.props                      |   3 +
 README.md                                     |  25 +-
 docs/CONFIG.md                                |  53 ++-
 src/AgentOs.Domain/Workspaces/IBoardRepos.cs  |  17 +
 .../Agents/AcceptanceAgent.cs                 |  69 ++-
 .../Agents/AgentBudgetGate.cs                 |  71 +++
 .../Agents/AgentRoles.cs                      | 123 ++++++
 .../Agents/AgentRunScope.cs                   |  56 +++
 .../Agents/AgentSettings.cs                   |  27 +-
 .../Agents/AgentsOptions.cs                   |  66 ++-
 .../Agents/AutopilotOrchestratorAgent.cs      |  45 +-
 .../Agents/BoardAgent.cs                      |  44 ++
 .../Agents/IssueWorkAgent.cs                  | 103 ++---
 .../Agents/LlmAgentBase.cs                    |  23 +-
 .../Agents/ProjectPractices.cs                |  46 ++
 .../Agents/RetrospectiveAgent.cs              |  27 +-
 .../Agents/ReviewAgent.cs                     |  67 +--
 .../Decomposition/IdeaBootstrapService.cs     |  15 +-
 .../Decomposition/TicketDecomposerAgent.cs    |  30 +-
 .../Prompts/IssueWorkPrompt.cs                |  96 +++--
 .../Prompts/PromptCatalog.cs                  |  64 ++-
 .../Prompts/PromptTemplate.cs                 |  26 ++
 .../WorkspaceBoardRepos.cs                    |  22 +
 .../WorkspacesModule.cs                       |   2 +
 src/AgentOs.RemoteAgent/CliModel.cs           |  52 +++
 src/AgentOs.RemoteAgent/Program.cs            |   5 +-
 .../Components/Pages/AgentProfilesApp.razor   |  51 ++-
 .../Components/Pages/BoardApp.razor           |   4 +-
 .../Components/Pages/InsightsApp.razor        |  12 +-
 .../Components/Pages/KnowledgeTab.razor       |   2 +-
 .../Components/Pages/PromptsApp.razor         |  39 +-
 .../Components/UI/AgentMascot.razor           |   9 +-
 .../Services/BoardTasks/BoardTaskService.cs   |   9 +-
 .../Orchestration/RetrospectiveService.cs     |   3 +-
 src/AgentOs.Web/wwwroot/app.css               |   4 +
 .../AgentOsUi/AgentProfilesTests.cs           |  18 +-
 tests/AgentOs.Tests/AgentOs.Tests.csproj      |   2 +
 .../Agents/AgentRegistryGuardTests.cs         | 121 ++++++
 .../Agents/BoardAgentRegistryTests.cs         | 404 ++++++++++++++++++
 .../AgentOs.Tests/Pipeline/PromptsV2Tests.cs  |   5 +-
 tests/AgentOs.Tests/Sessions/CliModelTests.cs |  56 +++
 41 files changed, 1634 insertions(+), 282 deletions(-)
 create mode 100644 src/AgentOs.Domain/Workspaces/IBoardRepos.cs
 create mode 100644 src/AgentOs.Modules.Pipeline/Agents/AgentBudgetGate.cs
 create mode 100644 src/AgentOs.Modules.Pipeline/Agents/AgentRoles.cs
 create mode 100644 src/AgentOs.Modules.Pipeline/Agents/AgentRunScope.cs
 create mode 100644 src/AgentOs.Modules.Pipeline/Agents/BoardAgent.cs
 create mode 100644 src/AgentOs.Modules.Pipeline/Agents/ProjectPractices.cs
 create mode 100644 src/AgentOs.Modules.Pipeline/Prompts/PromptTemplate.cs
 create mode 100644 src/AgentOs.Modules.Workspaces/WorkspaceBoardRepos.cs
 create mode 100644 src/AgentOs.RemoteAgent/CliModel.cs
 create mode 100644 tests/AgentOs.Tests/Agents/AgentRegistryGuardTests.cs
 create mode 100644 tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs
 create mode 100644 tests/AgentOs.Tests/Sessions/CliModelTests.cs

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 6d962492..2a613c1f 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -126,6 +126,9 @@
     <PackageVersion Include="Shouldly" Version="4.3.0" />
     <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.12.0" />
     <PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="2.5.1" />
+    <!-- Source guards: the tests parse agent sources with Roslyn (syntax only) — e.g. no agent may hard-code the
+         provider or model of its LLM call (AgentRegistryGuardTests). -->
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
 
     <!-- Aspire orchestration + service defaults (.NET 10). HELD at 13.5.3: Aspire 13.6.x builds but the
          AppHost fails at startup on this stack (DCP object creation times out after 60s in
diff --git a/README.md b/README.md
index 97144301..3c6f7e3c 100644
--- a/README.md
+++ b/README.md
@@ -191,7 +191,7 @@ Light and dark are first-class (top bar → appearance toggle, or System → App
 | Concept | Lives in | Notes |
 |---|---|---|
 | **Module** | `IModule` (SharedKernel) | One assembly = one module. Optional `IEndpointModule` (HTTP), `IInitializableModule` (startup hook), `ISettingsContributor` (settings it owns). |
-| **Agent** | `Modules.Pipeline.Agents` | A specialist — Requirement, Coding, Testing, QA, Orchestrator (+ IssueWork, Decomposer). Talks to models only through `ILlmClientFactory`. |
+| **Agent** | `Modules.Pipeline.Agents` | One registry (`AgentRoles`): the Board agents (Discovery, Coding (tickets), Reviewer, Testing (tickets), Autopilot lead, Retrospective) and the 5-agent Workflow pipeline (Orchestrator, Requirement, Coding, Testing, QA). Each role key names its profile, prompt and Insights row. Talks to models only through `ILlmClientFactory`. |
 | **LLM client** | `Domain.Llm.ILlmClient` | `SendAsync(LlmRequest, ct) → LlmResponse`, registered as a keyed service under its provider name. |
 | **Setting** | `Domain.Configuration.SettingDescriptor` | Key, kind, scope, default, validation, UI label. Resolved lock → tenant → platform → seed → default ([ADR-0011](docs/adr/0011-ui-first-configuration.md)). |
 | **Tool** | `Domain.Tools.ITool` | Invoked by models via the gateway, always through `IToolGateway` (policy → invoke → evidence). |
@@ -295,12 +295,17 @@ so a key saved in Settings is used by the next call.
 
 | Agent | Provider | Model |
 |---|---|---|
-| Orchestrator | Claude | `claude-haiku-4-5` |
-| Requirement | Claude | `claude-sonnet-4-6` |
-| Coding | AzureOpenAI | `gpt-4.1` |
-| Testing | AzureOpenAI | `gpt-4o-mini` |
-| QA | Claude | `claude-haiku-4-5` |
-| IssueWork / Decomposer | Claude | `claude-sonnet-4-6` |
+| Board: Discovery, Coding (tickets) | Claude | `claude-sonnet-4-6` |
+| Board: Reviewer, Testing (tickets), Autopilot lead, Retrospective | RemoteAgent (a paired computer, 0 server tokens) | `claude-sonnet-4-6` |
+| Workflow pipeline: Orchestrator | Claude | `claude-haiku-4-5` |
+| Workflow pipeline: Requirement | Claude | `claude-sonnet-4-6` |
+| Workflow pipeline: Coding | AzureOpenAI | `gpt-4.1` |
+| Workflow pipeline: Testing | AzureOpenAI | `gpt-4o-mini` |
+| Workflow pipeline: QA | Claude | `claude-haiku-4-5` |
+
+Every agent — Board and pipeline — reads its profile and its prompt (Settings → Prompts) per call, passes the budget
+gate unless it really runs on a member's computer, and appears in Insights under the same name. On a paired computer
+the runner passes the profile's model to the CLI (`claude --model`, `codex -m`). See [CONFIG.md](docs/CONFIG.md#settings--agent-profiles).
 
 The model picker lists every priced model for the chosen provider with its list price (e.g.
 `claude-haiku-5-5 · $0.1 / $0.5` per 1M tokens), plus *Custom…* for Azure deployment aliases.
@@ -393,8 +398,10 @@ The most used routes:
 ### Add a pipeline agent
 
 Use the bundled `agent-scaffold` skill (`/agent-scaffold {Name}`) — it generates the contract,
-implementation, DI registration and xUnit stubs. Give it an agent profile in `AgentsOptions` so it
-appears in Settings → Agent profiles.
+implementation, DI registration and xUnit stubs. Register its role in `AgentRoles` (key, label, Board or
+Workflow pipeline) and give it a seed in `AgentsOptions` (property named after the key) so it appears in Settings →
+Agent profiles; resolve its profile per call (`BoardAgent.ProfileAsync` / `IAgentProfiles`) — `AgentRegistryGuardTests`
+fails the build on a hard-coded provider or model.
 
 ### Add a setting
 
diff --git a/docs/CONFIG.md b/docs/CONFIG.md
index 6fd56ea5..b6d046cf 100644
--- a/docs/CONFIG.md
+++ b/docs/CONFIG.md
@@ -98,20 +98,45 @@ exists on the options type but is not honoured yet.
 
 ### Settings → Agent profiles
 
-Per role — `Orchestrator`, `Requirement`, `Coding`, `Testing`, `Qa`, `IssueWork`, `Decomposer` — keys
-`Agents:<Role>:Provider` / `Model` / `Temperature` / `MaxTokens`, tenant scope. The model field lists
-priced models for the chosen provider (plus *Custom…* for deployment aliases); `Temperature` is hidden
-for models that reject sampling params; `MaxTokens` ≤ 128 000.
-
-| Role | Provider | Model | Temp | Max output |
-|---|---|---|---|---|
-| Orchestrator | Anthropic | `claude-haiku-4-5` | 0.3 | 2000 |
-| Requirement | Anthropic | `claude-sonnet-4-6` | 0.1 | 2000 |
-| Coding | AzureOpenAI | `gpt-4.1` | 0.2 | 4000 |
-| Testing | AzureOpenAI | `gpt-4o-mini` | 0.2 | 3000 |
-| Qa | Anthropic | `claude-haiku-4-5` | 0.1 | 1500 |
-| IssueWork | Anthropic | `claude-sonnet-4-6` | 0.2 | 32768 |
-| Decomposer | Anthropic | `claude-sonnet-4-6` | 0.2 | 4000 |
+One agent registry (`AgentRoles`): every agent AgentOS.NET runs has one stable **role key**, used for its
+profile (`Agents:<Key>:Provider` / `Model` / `Temperature` / `MaxTokens`, tenant scope), its prompt in
+**Settings → Prompts** (`prompt/<Key>/system`), the `AgentRole` of its LLM calls (what **Insights → By agent**
+groups and names by) and the label of its stored runs. The page shows two tables — the **Board agents** and the
+legacy 5-agent **Workflow pipeline** — so a change to one never silently touches the other. Every profile is read
+per call (no restart). The model field lists priced models for the chosen provider (plus *Custom…* for deployment
+aliases); `Temperature` is hidden for models that reject sampling params; `MaxTokens` ≤ 128 000.
+
+| Shown as | Key | Provider | Model | Temp | Max output |
+|---|---|---|---|---|---|
+| Discovery (New idea: requirement + ticket split) | `Discovery` | Anthropic | `claude-sonnet-4-6` | 0.2 | 4000 |
+| Coding (tickets) | `IssueWork` | Anthropic | `claude-sonnet-4-6` | 0.2 | 32768 |
+| Reviewer | `Reviewer` | RemoteAgent | `claude-sonnet-4-6` | 0 | 32768 |
+| Testing (tickets) | `Acceptance` | RemoteAgent | `claude-sonnet-4-6` | 0 | 32768 |
+| Autopilot lead | `AutopilotOrchestrator` | RemoteAgent | `claude-sonnet-4-6` | 0 | 4096 |
+| Retrospective | `Retrospective` | RemoteAgent | `claude-sonnet-4-6` | 0 | 4096 |
+| Orchestrator (Workflow pipeline) | `Orchestrator` | Anthropic | `claude-haiku-4-5` | 0.3 | 2000 |
+| Requirement (Workflow pipeline) | `Requirement` | Anthropic | `claude-sonnet-4-6` | 0.1 | 2000 |
+| Coding (Workflow pipeline) | `Coding` | AzureOpenAI | `gpt-4.1` | 0.2 | 4000 |
+| Testing (Workflow pipeline) | `Testing` | AzureOpenAI | `gpt-4o-mini` | 0.2 | 3000 |
+| QA (Workflow pipeline) | `Qa` | Anthropic | `claude-haiku-4-5` | 0.1 | 1500 |
+
+- **The provider is honoured, the model reaches the CLI.** A Board agent on `RemoteAgent` runs on a member's paired
+  computer; the runner passes the profile's model to the CLI (`claude --model <id>`, `codex -m <id>`) when that CLI
+  can serve it, otherwise the CLI's own default applies. Reviewer and Testing (tickets) need a checkout, so keep them
+  on a paired computer unless the chosen provider can reach one.
+- **Budget gate.** Every Board agent passes the tenant's enforced monthly cap before its call, decided from the
+  *effective* provider (after `Llm:ForceProvider`); only a call that really runs on a member's computer (0 server
+  tokens) is exempt.
+- **Discovery** covers both calls of New idea: the requirement step uses the Discovery profile (and is filed under
+  Discovery in Insights) with the Requirement agent's prompt and spec contract; the ticket split uses the Discovery
+  prompt. It replaces the former `Decomposer` profile and prompt keys — re-apply a customised `Agents:Decomposer:*`
+  or Decomposer prompt under `Discovery`.
+- **Prompts.** Board prompts are templates: `{owner}`, `{repo}`, `{branch}`, `{defaultBranch}` (Reviewer, Testing
+  (tickets)) and `{issue}`, `{branchStep}`, `{commitType}`… (Coding (tickets), which has one prompt for a member's
+  computer and one — `IssueWork.Server` — for the server runner) are filled on every run. The untrusted-text rule is
+  appended by code and cannot be overridden; workspace rules follow it.
+- **Practices.** Coding, Reviewer, Testing (tickets) and the Autopilot lead read the project's practices (Board →
+  Knowledge) before they work.
 
 `Pipeline:MaxIterations` (QA-loop cap when a story sets no `NMax`) — default 3, range 1–10.
 An unpriced model is charged at the fail-closed $15/$75 per 1M rate until added to `CostCalculator`.
diff --git a/src/AgentOs.Domain/Workspaces/IBoardRepos.cs b/src/AgentOs.Domain/Workspaces/IBoardRepos.cs
new file mode 100644
index 00000000..497824a7
--- /dev/null
+++ b/src/AgentOs.Domain/Workspaces/IBoardRepos.cs
@@ -0,0 +1,17 @@
+// The repositories a board works on, as "owner/repo" keys — what project memory (lessons, practices) is keyed by. Lets
+// an agent that sees a whole board (the Autopilot lead) read the practices of its projects without depending on the
+// Workspaces module. Tenant-explicit: background runs have no request context.
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace AgentOs.Domain.Workspaces;
+
+/// <summary>Lists a board's repositories.</summary>
+public interface IBoardRepos
+{
+    /// <summary>The <c>owner/repo</c> keys of board <paramref name="boardId"/> in <paramref name="tenantId"/> (empty when unknown).</summary>
+    Task<IReadOnlyList<string>> RepoKeysAsync(string tenantId, Guid boardId, CancellationToken ct = default);
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AcceptanceAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/AcceptanceAgent.cs
index 18a3a49a..44660e1f 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AcceptanceAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AcceptanceAgent.cs
@@ -2,6 +2,8 @@
 // build it, run its tests, check each acceptance criterion the way the criterion says (bringing the app up for an
 // end-to-end check), and report evidence. It runs on the member's paired computer (it needs a real machine: a
 // browser, containers, the repo's own toolchain) under scoped autonomy, and never edits, commits or pushes.
+// Its profile (Settings → Agent profiles, role "Acceptance" — "Testing (tickets)"), its prompt (Settings → Prompts) and
+// the budget gate apply like every other agent's; the seed keeps it on the member's computer (0 server tokens).
 
 using System;
 using System.Collections.Generic;
@@ -10,14 +12,20 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
 using AgentOs.Domain.Llm;
+using AgentOs.Domain.Memory;
 using AgentOs.Domain.Sessions;
+using AgentOs.Modules.Pipeline.Prompts;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <inheritdoc cref="IAcceptanceAgent"/>
-public sealed class AcceptanceAgent(ILlmClientFactory factory, ILogger<AcceptanceAgent> logger, ISessionRunFeed? feed = null) : IAcceptanceAgent
+public sealed class AcceptanceAgent(ILlmClientFactory factory, ILogger<AcceptanceAgent> logger, ISessionRunFeed? feed = null,
+    IOptions<AgentsOptions>? options = null, IAgentProfiles? profiles = null, IPromptOverrides? prompts = null,
+    IBudgetGuard? budgetGuard = null, IMemoryStore? memory = null) : IAcceptanceAgent
 {
     // Building, starting a stack and running end-to-end specs takes longer than writing the change.
     private static readonly TimeSpan RunTimeout = TimeSpan.FromMinutes(30);
@@ -31,23 +39,36 @@ public async Task<AcceptanceVerdict> RunAsync(AcceptanceRequest request, Cancell
             return NotRun("There is no proposed change (branch) to test.");
         }
         var repoLabel = $"{request.Repo.Owner}/{request.Repo.Repo}";
-        Emit(request, SessionRunEventKind.Running, $"Testing #{request.IssueNumber} on your computer.", repoLabel);
 
+        // Live profile (Settings → Agent profiles), resolved per call.
+        var profile = await BoardAgent.ProfileAsync(profiles, options, AgentRoles.Acceptance, ct).ConfigureAwait(false);
         ILlmClient llm;
-        try { llm = factory.Create("RemoteAgent"); }
+        try { llm = factory.Create(profile.Provider); }
         catch (Exception ex) when (ex is LlmException or ArgumentException or NotSupportedException or InvalidOperationException)
         {
             return NotRun($"No computer to test on: {ex.Message}");
         }
+        var provider = AgentBudgetGate.EffectiveProvider(llm, profile.Provider);
+        if (await AgentBudgetGate.BlockedAsync(budgetGuard, request.TenantId, provider, logger, nameof(AcceptanceAgent), ct).ConfigureAwait(false) is not null)
+        {
+            return NotRun(AgentBudgetGate.BlockedMessage);
+        }
+        Emit(request, SessionRunEventKind.Running, AgentBudgetGate.RunsOnMembersComputer(provider)
+            ? $"Testing #{request.IssueNumber} on your computer."
+            : $"Testing #{request.IssueNumber} ({provider}).", repoLabel);
 
         var llmRequest = new LlmRequest(
-            SystemPrompt: Instructions(request) + "\n\n" + UntrustedText.SystemRule,
-            UserPrompt: User(request),
-            Model: "claude-sonnet-4-6",
-            MaxTokens: 32768,
+            SystemPrompt: await BoardAgent.SystemPromptAsync(prompts, AgentRoles.Acceptance, InstructionsTemplate, Values(request),
+                UntrustedText.SystemRule, ct).ConfigureAwait(false),
+            UserPrompt: User(request)
+                + await ProjectPractices.BlockAsync(memory, request.TenantId, [repoLabel], logger, ct).ConfigureAwait(false),
+            Model: profile.Model,
+            Temperature: profile.Temperature,
+            MaxTokens: profile.MaxTokens,
             Timeout: RunTimeout,
             Cli: request.CliProfile)
         {
+            AgentRole = AgentRoles.Acceptance,
             Autonomy = WorkspaceAutonomy.Scoped,
             Progress = new InlineProgress<string>(step =>
             {
@@ -71,18 +92,33 @@ public async Task<AcceptanceVerdict> RunAsync(AcceptanceRequest request, Cancell
     private void Emit(AcceptanceRequest r, SessionRunEventKind kind, string message, string repo) =>
         feed?.Publish(new SessionRunEvent(r.TenantId, r.SessionId, kind, message, DateTimeOffset.UtcNow, repo));
 
-    internal static string Instructions(AcceptanceRequest r) => string.Format(
-        CultureInfo.InvariantCulture,
+    /// <summary>The placeholders <see cref="InstructionsTemplate"/> (and an override of it) may use.</summary>
+    public static readonly IReadOnlyList<string> Placeholders = ["owner", "repo", "branch", "defaultBranch"];
+
+    /// <summary>The per-run values of <see cref="Placeholders"/>.</summary>
+    internal static Dictionary<string, string> Values(AcceptanceRequest r) => new(StringComparer.Ordinal)
+    {
+        ["owner"] = r.Repo.Owner,
+        ["repo"] = r.Repo.Repo,
+        ["branch"] = r.Repo.ExistingBranch ?? string.Empty,
+        ["defaultBranch"] = r.Repo.DefaultBranch,
+    };
+
+    /// <summary>The system prompt for one run (the built-in template, filled).</summary>
+    internal static string Instructions(AcceptanceRequest r) => PromptTemplate.Fill(InstructionsTemplate, Values(r));
+
+    /// <summary>The built-in system prompt template (its first line is the agent's routing key).</summary>
+    public const string InstructionsTemplate =
         """
         You are the Testing Agent of AgentOS.NET. You ACCEPT or REJECT a proposed change against its ticket's
         acceptance criteria, on the developer's own machine, with your native shell and file tools. You NEVER change
         the code: do not edit tracked files, do not commit, do not push, do not open or comment on pull requests.
 
         1. Get the change. The runner starts you in a fresh, empty directory made for this run:
-           git clone https://github.com/{0}/{1}.git .
-           git fetch origin {2}
-           git checkout {2}
-           (default branch: {3})
+           git clone https://github.com/{owner}/{repo}.git .
+           git fetch origin {branch}
+           git checkout {branch}
+           (default branch: {defaultBranch})
         2. Read the ticket (user message), the repository's agent instructions (AGENTS.md, CLAUDE.md, README) and
            docs/ACCEPTANCE.md if present — criterion IDs such as F-4 or LIB-1 refer to it.
         3. Build and run the unit tests the way the repository does (e.g. `dotnet build` + `dotnet test`,
@@ -95,17 +131,16 @@ then stop the stack gracefully (Ctrl+C) so it removes its own containers. Never
            images or any data outside this directory.
         5. A criterion you cannot check here — a data set or secret that is not available, an external service —
            is "not-checked" with the reason. Never report "pass" for something you did not run.
-        6. When a test fails, check whether it already fails on the default branch: `git worktree add ../base origin/{3}`,
+        6. When a test fails, check whether it already fails on the default branch: `git worktree add ../base origin/{defaultBranch}`,
            run the same test there. If it fails the same way, it is a pre-existing failure, not this change's:
            list it under "baseFailures" and do not let it fail the verdict.
 
         Reply ONLY with this JSON (no other text):
-        {{"verdict":"pass","criteria":[{{"criterion":"<ID or the criterion's words>","result":"pass","evidence":"<command and the key output line, or why it was not checked>"}}],"baseFailures":[{{"test":"<fully qualified test name>","evidence":"<the failure, and that it fails the same on {3}>"}}],"summary":"<one or two sentences>"}}
+        {"verdict":"pass","criteria":[{"criterion":"<ID or the criterion's words>","result":"pass","evidence":"<command and the key output line, or why it was not checked>"}],"baseFailures":[{"test":"<fully qualified test name>","evidence":"<the failure, and that it fails the same on {defaultBranch}>"}],"summary":"<one or two sentences>"}
         "verdict" is "pass" only when the build passed, every failing test is a pre-existing failure, and no criterion
         failed; otherwise "fail".
         "result" is one of "pass", "fail", "not-checked".
-        """,
-        r.Repo.Owner, r.Repo.Repo, r.Repo.ExistingBranch, r.Repo.DefaultBranch);
+        """;
 
     internal static string User(AcceptanceRequest r) => string.Format(
         CultureInfo.InvariantCulture,
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentBudgetGate.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentBudgetGate.cs
new file mode 100644
index 00000000..c1d61465
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentBudgetGate.cs
@@ -0,0 +1,71 @@
+// S1 — the per-tenant budget gate, shared by every Board agent. A call that runs on the server spends AgentOS.NET's own
+// LLM tokens, so it passes the tenant's ENFORCED monthly cap first. A call that really runs on a member's paired
+// computer (the RemoteAgent provider — the member's own CLI subscription) costs 0 server tokens and is exempt. The
+// decision reads the EFFECTIVE provider — the client the factory returned, after Settings' force-provider — never the
+// name the agent asked for: a forced server provider must not slip past the gate because the profile says RemoteAgent.
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
+using AgentOs.Domain.Llm;
+using AgentOs.SharedKernel.Identity;
+using Microsoft.Extensions.Logging;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>The budget gate for agent calls, decided from the effective provider.</summary>
+public static class AgentBudgetGate
+{
+    /// <summary>What a person reads when a call was blocked.</summary>
+    public const string BlockedMessage =
+        "Monthly LLM budget exceeded — raise the cap in Settings, or run this agent on a member's computer (0 server tokens).";
+
+    /// <summary>True when <paramref name="provider"/> runs the call on a member's paired computer (0 server tokens).</summary>
+    public static bool RunsOnMembersComputer(string? provider) =>
+        (provider ?? string.Empty).Trim().ToUpperInvariant() is "REMOTEAGENT" or "REMOTE" or "IDE";
+
+    /// <summary>The provider that will really serve calls on <paramref name="client"/> (after force-provider); the
+    /// requested name only when the client does not say.</summary>
+    public static string EffectiveProvider(ILlmClient client, string requested)
+    {
+        ArgumentNullException.ThrowIfNull(client);
+        return string.IsNullOrWhiteSpace(client.Provider) ? requested : client.Provider;
+    }
+
+    /// <summary>
+    /// The tenant's budget status when a call on <paramref name="effectiveProvider"/> must be blocked, else null (the call
+    /// proceeds). No guard, a call on a member's computer, or an unknown tenant → null. Fail-open on a transient store
+    /// error: a budget-store hiccup never blocks an agent; the cap applies again on the next call.
+    /// </summary>
+    public static async Task<BudgetStatus?> BlockedAsync(IBudgetGuard? guard, string? tenantId, string effectiveProvider,
+        ILogger logger, string agent, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(logger);
+        if (guard is null || RunsOnMembersComputer(effectiveProvider)) { return null; }
+        var tenant = string.IsNullOrWhiteSpace(tenantId) ? AmbientIdentity.Current?.TenantId : tenantId;
+        if (string.IsNullOrWhiteSpace(tenant)) { return null; }
+
+        BudgetStatus budget;
+        try
+        {
+            budget = await guard.EvaluateAsync(tenant, ct).ConfigureAwait(false);
+        }
+        catch (Microsoft.EntityFrameworkCore.DbUpdateException ex) { return Failed(ex); }
+        catch (System.Data.Common.DbException ex) { return Failed(ex); }
+        catch (TimeoutException ex) { return Failed(ex); }
+        catch (IOException ex) { return Failed(ex); }
+        catch (InvalidOperationException ex) { return Failed(ex); }
+
+        if (budget is not { State: BudgetState.Exceeded, EnforceOn: true }) { return null; }
+        logger.LogWarning("{Agent}: blocked — tenant {Tenant} is over its monthly LLM budget (${Spent} of ${Cap}) and the call would run on {Provider}.",
+            agent, tenant, budget.SpentUsd, budget.CapUsd, effectiveProvider);
+        return budget;
+
+        BudgetStatus? Failed(Exception ex)
+        {
+            logger.LogWarning(ex, "{Agent}: budget evaluation failed for tenant {Tenant}; proceeding.", agent, tenant);
+            return null;
+        }
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentRoles.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentRoles.cs
new file mode 100644
index 00000000..350aaba4
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentRoles.cs
@@ -0,0 +1,123 @@
+// One agent registry. Every agent AgentOS.NET runs has ONE stable role key, used everywhere the agent is named:
+// its profile (Settings → Agent profiles, Agents:<Key>:*), its prompt (Settings → Prompts, prompt/<Key>/system), the
+// AgentRole on its LLM requests (what Insights groups by) and the label of its stored runs. The Board agents (tickets,
+// reviews, testing, Autopilot, retrospectives, New idea) are listed apart from the legacy 5-agent Workflow pipeline so
+// a person never edits "Coding" expecting the ticket agent to change.
+
+using System;
+using System.Collections.Frozen;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Which surface an agent serves.</summary>
+public enum AgentRoleGroup
+{
+    /// <summary>The Board: tickets, reviews, testing, Autopilot, retrospectives, New idea.</summary>
+    Board,
+
+    /// <summary>The 5-agent Workflow pipeline (Run / Workflow app, the Thorough engine).</summary>
+    WorkflowPipeline,
+}
+
+/// <summary>One agent role: its stable key, the name people see, its surface and what it does.</summary>
+/// <param name="Key">Stable key: profile key, prompt key, Insights AgentRole and run label.</param>
+/// <param name="Label">The name shown in Agent profiles, Prompts and Insights.</param>
+/// <param name="Group">Board agent or Workflow pipeline agent.</param>
+/// <param name="Description">One sentence: what the agent does.</param>
+public sealed record AgentRoleInfo(string Key, string Label, AgentRoleGroup Group, string Description);
+
+/// <summary>The registry of agent roles (keys are stable; never rename one — stored settings and metrics use it).</summary>
+public static class AgentRoles
+{
+    /// <summary>Workflow pipeline — the orchestrator.</summary>
+    public const string Orchestrator = "Orchestrator";
+
+    /// <summary>Workflow pipeline — requirement analysis.</summary>
+    public const string Requirement = "Requirement";
+
+    /// <summary>Workflow pipeline — code generation.</summary>
+    public const string Coding = "Coding";
+
+    /// <summary>Workflow pipeline — test generation.</summary>
+    public const string Testing = "Testing";
+
+    /// <summary>Workflow pipeline — QA scoring.</summary>
+    public const string Qa = "Qa";
+
+    /// <summary>Board — New idea: requirement + ticket split.</summary>
+    public const string Discovery = "Discovery";
+
+    /// <summary>Board — implements a ticket (Coding agent of the Board).</summary>
+    public const string IssueWork = "IssueWork";
+
+    /// <summary>Board — reviews a proposed change.</summary>
+    public const string Reviewer = "Reviewer";
+
+    /// <summary>Board — tests a proposed change against its acceptance criteria (Testing agent of the Board).</summary>
+    public const string Acceptance = "Acceptance";
+
+    /// <summary>Board — Autopilot's lead: decides what happens next on a board.</summary>
+    public const string AutopilotOrchestrator = "AutopilotOrchestrator";
+
+    /// <summary>Board — turns lessons into the project's practices.</summary>
+    public const string Retrospective = "Retrospective";
+
+    /// <summary>Every role: Board agents first (in the order a ticket meets them), then the Workflow pipeline.</summary>
+    public static IReadOnlyList<AgentRoleInfo> All { get; } =
+    [
+        new(Discovery, "Discovery", AgentRoleGroup.Board, "New idea: turns an idea into a requirement and right-sized tickets."),
+        new(IssueWork, "Coding (tickets)", AgentRoleGroup.Board, "Implements a ticket: clone, change, build, test, push a branch."),
+        new(Reviewer, "Reviewer", AgentRoleGroup.Board, "Reviews a proposed change before it is tested; must-fix findings go back to Coding."),
+        new(Acceptance, "Testing (tickets)", AgentRoleGroup.Board, "Tests a proposed change against its ticket's acceptance criteria."),
+        new(AutopilotOrchestrator, "Autopilot lead", AgentRoleGroup.Board, "Decides what Autopilot does next on a board: starts, retries, questions, closes."),
+        new(Retrospective, "Retrospective", AgentRoleGroup.Board, "After a merge, turns lessons into the project's practices."),
+        new(Orchestrator, "Orchestrator (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Coordinates the 5-agent Workflow pipeline."),
+        new(Requirement, "Requirement (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Turns a user story into a requirement spec."),
+        new(Coding, "Coding (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Writes code for a requirement spec."),
+        new(Testing, "Testing (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Writes tests for the generated code."),
+        new(Qa, "QA (Workflow pipeline)", AgentRoleGroup.WorkflowPipeline, "Scores requirement, code and test consistency."),
+    ];
+
+    private static readonly FrozenDictionary<string, AgentRoleInfo> ByKey =
+        All.ToFrozenDictionary(r => r.Key, StringComparer.OrdinalIgnoreCase);
+
+    // Names stored before the registry existed, mapped to today's key: the pipeline agents file metrics under their type
+    // name ("CodingAgent"), the decomposer used its own name, and the Board's Testing runs were labelled "Testing".
+    private static readonly FrozenDictionary<string, string> Aliases = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+    {
+        ["Decomposer"] = Discovery,
+        ["TicketDecomposer"] = Discovery,
+        ["TicketDecomposerAgent"] = Discovery,
+        ["IssueWorkAgent"] = IssueWork,
+        ["ReviewAgent"] = Reviewer,
+        ["AcceptanceAgent"] = Acceptance,
+        ["AutopilotOrchestratorAgent"] = AutopilotOrchestrator,
+        ["RetrospectiveAgent"] = Retrospective,
+        ["PipelineOrchestrator"] = Orchestrator,
+    }.ToFrozenDictionary(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>The role for <paramref name="key"/>, or null when it is not a registered role.</summary>
+    public static AgentRoleInfo? Find(string? key) =>
+        key is not null && ByKey.TryGetValue(key, out var info) ? info : null;
+
+    /// <summary>The registered key for a stored agent name ("CodingAgent" → "Coding", "Decomposer" → "Discovery"); an
+    /// unknown name comes back trimmed, without a trailing "Agent".</summary>
+    public static string Canonical(string? agentName)
+    {
+        var name = (agentName ?? string.Empty).Trim();
+        if (name.Length == 0) { return name; }
+        if (Aliases.TryGetValue(name, out var alias)) { return alias; }
+        if (ByKey.TryGetValue(name, out var exact)) { return exact.Key; }
+        var stripped = name.EndsWith("Agent", StringComparison.Ordinal) && name.Length > "Agent".Length ? name[..^"Agent".Length].Trim() : name;
+        return ByKey.TryGetValue(stripped, out var info) ? info.Key : stripped;
+    }
+
+    /// <summary>The name people see for a stored agent name (the registry label, or the name itself).</summary>
+    public static string Label(string? agentName)
+    {
+        var key = Canonical(agentName);
+        return ByKey.TryGetValue(key, out var info) ? info.Label : key;
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentRunScope.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentRunScope.cs
new file mode 100644
index 00000000..7863f012
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentRunScope.cs
@@ -0,0 +1,56 @@
+// A Board agent that reuses a Workflow-pipeline specialist (New idea's Discovery runs the Requirement agent) opens a
+// scope around that call: the specialist then resolves the Board role's profile instead of its own, files its call
+// under the Board role (Insights groups by it), and passes the budget gate the Board agents pass. Its prompt and output
+// contract stay the specialist's own. AsyncLocal: the scope covers exactly the awaited call chain that opened it.
+
+using System;
+using System.Threading;
+using AgentOs.Domain.Cost;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Runs the specialist agents of this async flow as <see cref="Role"/>.</summary>
+public sealed class AgentRunScope : IDisposable
+{
+    private static readonly AsyncLocal<AgentRunScope?> CurrentScope = new();
+
+    private readonly AgentRunScope? _previous;
+    private bool _disposed;
+
+    private AgentRunScope(string role, AgentOptions? fallback, IBudgetGuard? budget, AgentRunScope? previous)
+    {
+        Role = role;
+        Fallback = fallback;
+        Budget = budget;
+        _previous = previous;
+    }
+
+    /// <summary>The open scope of this flow, or null.</summary>
+    public static AgentRunScope? Current => CurrentScope.Value;
+
+    /// <summary>The role key (an <see cref="AgentRoles"/> key) whose profile and metrics name apply.</summary>
+    public string Role { get; }
+
+    /// <summary>The role's seed profile when no settings registry is wired; null = the specialist's own.</summary>
+    public AgentOptions? Fallback { get; }
+
+    /// <summary>The budget gate the calls pass (null = none).</summary>
+    public IBudgetGuard? Budget { get; }
+
+    /// <summary>Open a scope for this async flow; dispose to close it.</summary>
+    public static AgentRunScope Begin(string role, AgentOptions? fallback = null, IBudgetGuard? budget = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(role);
+        var scope = new AgentRunScope(role, fallback, budget, CurrentScope.Value);
+        CurrentScope.Value = scope;
+        return scope;
+    }
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        if (_disposed) { return; }
+        _disposed = true;
+        CurrentScope.Value = _previous;
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
index 5e3498ed..87a8b561 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
@@ -3,8 +3,10 @@
 // AgentsOptions / PipelineOptions so the registry and the code defaults cannot drift. Keys match the
 // existing appsettings paths, so current deployments seed straight in.
 
+using System;
 using System.Collections.Generic;
 using System.Globalization;
+using System.Linq;
 using AgentOs.Domain.Configuration;
 using AgentOs.Domain.Llm;
 using AgentOs.Modules.Pipeline.Pipeline;
@@ -27,7 +29,8 @@ public sealed class AgentSettings : ISettingsContributor
     /// limit is enforced against the model catalog; this is the absolute ceiling.</summary>
     public const int MaxOutputTokensCeiling = 128_000;
 
-    /// <summary>Agent roles in pipeline order, paired with their code defaults.</summary>
+    /// <summary>Every agent role (Board agents first, then the Workflow pipeline — see <see cref="AgentRoles"/>), paired
+    /// with its code defaults.</summary>
     public static IReadOnlyList<(string Role, AgentOptions Defaults)> Roles { get; } = BuildRoles();
 
     /// <summary>Setting key for <paramref name="role"/>'s <paramref name="field"/> (Provider/Model/Temperature/MaxTokens).</summary>
@@ -38,23 +41,24 @@ public IEnumerable<SettingDescriptor> Describe()
     {
         foreach (var (role, d) in Roles)
         {
-            yield return new(Key(role, nameof(AgentOptions.Provider)), SettingKind.Choice, Category, $"{role} · provider")
+            var label = AgentRoles.Label(role);
+            yield return new(Key(role, nameof(AgentOptions.Provider)), SettingKind.Choice, Category, $"{label} · provider")
             {
                 DefaultValue = d.Provider,
                 Choices = LlmProviders.Selectable,
             };
-            yield return new(Key(role, nameof(AgentOptions.Model)), SettingKind.Model, Category, $"{role} · model")
+            yield return new(Key(role, nameof(AgentOptions.Model)), SettingKind.Model, Category, $"{label} · model")
             {
                 DefaultValue = d.Model,
             };
-            yield return new(Key(role, nameof(AgentOptions.Temperature)), SettingKind.Number, Category, $"{role} · temperature")
+            yield return new(Key(role, nameof(AgentOptions.Temperature)), SettingKind.Number, Category, $"{label} · temperature")
             {
                 DefaultValue = d.Temperature.ToString(CultureInfo.InvariantCulture),
                 Min = 0m,
                 Max = 2m,
                 Help = "Ignored by models that reject sampling parameters (Claude 4.7+/5.x, GPT-5+).",
             };
-            yield return new(Key(role, nameof(AgentOptions.MaxTokens)), SettingKind.WholeNumber, Category, $"{role} · max output tokens")
+            yield return new(Key(role, nameof(AgentOptions.MaxTokens)), SettingKind.WholeNumber, Category, $"{label} · max output tokens")
             {
                 DefaultValue = d.MaxTokens.ToString(CultureInfo.InvariantCulture),
                 Min = 1m,
@@ -72,18 +76,11 @@ public IEnumerable<SettingDescriptor> Describe()
         };
     }
 
+    // One row per registered role, each seeded from AgentsOptions (a role without a seed is a startup bug).
     private static List<(string, AgentOptions)> BuildRoles()
     {
         var o = new AgentsOptions();
-        return
-        [
-            (nameof(AgentsOptions.Orchestrator), o.Orchestrator),
-            (nameof(AgentsOptions.Requirement), o.Requirement),
-            (nameof(AgentsOptions.Coding), o.Coding),
-            (nameof(AgentsOptions.Testing), o.Testing),
-            (nameof(AgentsOptions.Qa), o.Qa),
-            (nameof(AgentsOptions.IssueWork), o.IssueWork),
-            (nameof(AgentsOptions.Decomposer), o.Decomposer),
-        ];
+        return [.. AgentRoles.All.Select(r =>
+            (r.Key, o.For(r.Key) ?? throw new InvalidOperationException($"AgentsOptions has no seed for agent role '{r.Key}'.")))];
     }
 }
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
index 63c7d712..95f4de3a 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
@@ -1,47 +1,79 @@
 // AgentOs.Application/Agents/AgentsOptions.cs
-// Phase 3 — Options binding for per-agent configuration (the "Agents" section in appsettings).
+// Seed defaults for every agent profile (the "Agents" section; appsettings is bootstrap-only — ADR-0011). Property
+// names ARE the role keys of AgentRoles, so Agents:<Key>:* binds here and seeds Settings → Agent profiles.
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <summary>
-/// Configuration for the set of 5 agents — bound from the <c>"Agents"</c> section.
+/// Per-agent configuration — bound from the <c>"Agents"</c> section. One property per <see cref="AgentRoles"/> key.
 /// </summary>
 public sealed class AgentsOptions
 {
     /// <summary>Section name for <c>Configuration.GetSection</c>.</summary>
     public const string SectionName = "Agents";
 
-    /// <summary>Orchestrator configuration.</summary>
+    // The Board agents that need a real machine (a checkout, a browser, the repo's toolchain) or answer from one run
+    // on the member's paired computer by default — 0 server tokens.
+    private const string MembersComputer = "RemoteAgent";
+    private const string BoardModel = "claude-sonnet-4-6";
+
+    /// <summary>Workflow pipeline — Orchestrator configuration.</summary>
     public AgentOptions Orchestrator { get; set; } = new() { Model = "claude-haiku-4-5", Temperature = 0.3, MaxTokens = 2000 };
 
-    /// <summary>RequirementAgent configuration.</summary>
+    /// <summary>Workflow pipeline — RequirementAgent configuration.</summary>
     public AgentOptions Requirement { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.1, MaxTokens = 2000 };
 
-    /// <summary>CodingAgent configuration.</summary>
+    /// <summary>Workflow pipeline — CodingAgent configuration.</summary>
     public AgentOptions Coding { get; set; } = new() { Provider = "AzureOpenAI", Model = "gpt-4.1", Temperature = 0.2, MaxTokens = 4000 };
 
-    /// <summary>TestingAgent configuration.</summary>
+    /// <summary>Workflow pipeline — TestingAgent configuration.</summary>
     public AgentOptions Testing { get; set; } = new() { Provider = "AzureOpenAI", Model = "gpt-4o-mini", Temperature = 0.2, MaxTokens = 3000 };
 
-    /// <summary>QaAgent configuration.</summary>
+    /// <summary>Workflow pipeline — QaAgent configuration.</summary>
     public AgentOptions Qa { get; set; } = new() { Model = "claude-haiku-4-5", Temperature = 0.1, MaxTokens = 1500 };
 
-    /// <summary>IssueWorkAgent configuration (M5 — agentic issue→PR pipeline).</summary>
+    /// <summary>Board — Coding (tickets): IssueWorkAgent, the agentic issue→branch run.</summary>
     public AgentOptions IssueWork { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.2, MaxTokens = 32768 };
 
-    /// <summary>TicketDecomposerAgent configuration (bootstrap — RequirementSpec → board tickets).</summary>
-    public AgentOptions Decomposer { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.2, MaxTokens = 4000 };
+    /// <summary>Board — Discovery (New idea): the requirement step and the ticket split (TicketDecomposerAgent).</summary>
+    public AgentOptions Discovery { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.2, MaxTokens = 4000 };
+
+    /// <summary>Board — Reviewer (ReviewAgent). Reads the change in a checkout on the member's computer.</summary>
+    public AgentOptions Reviewer { get; set; } = new() { Provider = MembersComputer, Model = BoardModel, Temperature = 0, MaxTokens = 32768 };
+
+    /// <summary>Board — Testing (tickets): AcceptanceAgent. Builds and tests the change on the member's computer.</summary>
+    public AgentOptions Acceptance { get; set; } = new() { Provider = MembersComputer, Model = BoardModel, Temperature = 0, MaxTokens = 32768 };
+
+    /// <summary>Board — Autopilot lead (AutopilotOrchestratorAgent). Answer-only.</summary>
+    public AgentOptions AutopilotOrchestrator { get; set; } = new() { Provider = MembersComputer, Model = BoardModel, Temperature = 0, MaxTokens = 4096 };
+
+    /// <summary>Board — Retrospective (RetrospectiveAgent). Answer-only.</summary>
+    public AgentOptions Retrospective { get; set; } = new() { Provider = MembersComputer, Model = BoardModel, Temperature = 0, MaxTokens = 4096 };
+
+    /// <summary>The seed profile for <paramref name="role"/> (an <see cref="AgentRoles"/> key), or null when unknown.</summary>
+    public AgentOptions? For(string role) => role switch
+    {
+        AgentRoles.Orchestrator => Orchestrator,
+        AgentRoles.Requirement => Requirement,
+        AgentRoles.Coding => Coding,
+        AgentRoles.Testing => Testing,
+        AgentRoles.Qa => Qa,
+        AgentRoles.IssueWork => IssueWork,
+        AgentRoles.Discovery => Discovery,
+        AgentRoles.Reviewer => Reviewer,
+        AgentRoles.Acceptance => Acceptance,
+        AgentRoles.AutopilotOrchestrator => AutopilotOrchestrator,
+        AgentRoles.Retrospective => Retrospective,
+        _ => null,
+    };
 
     /// <summary>Every configured agent, for cross-cutting checks (startup validation).</summary>
     public IEnumerable<AgentOptions> All()
     {
-        yield return Orchestrator;
-        yield return Requirement;
-        yield return Coding;
-        yield return Testing;
-        yield return Qa;
-        yield return IssueWork;
-        yield return Decomposer;
+        foreach (var role in AgentRoles.All)
+        {
+            if (For(role.Key) is { } options) { yield return options; }
+        }
     }
 }
 
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AutopilotOrchestratorAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/AutopilotOrchestratorAgent.cs
index 7389bd8f..c3782a57 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AutopilotOrchestratorAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AutopilotOrchestratorAgent.cs
@@ -1,6 +1,8 @@
 // The Orchestrator agent — Autopilot's decision maker (see IAutopilotOrchestrator). It answers on the member's paired
 // computer in answer-only mode (no tools: it reasons over the brief and replies with JSON), so it costs no API tokens.
-// Every move it picks is re-checked by the caller against the rules before anything runs.
+// Every move it picks is re-checked by the caller against the rules before anything runs. Its profile (Settings →
+// Agent profiles, role "AutopilotOrchestrator" — "Autopilot lead"), its prompt (Settings → Prompts) and the budget gate
+// apply like every other agent's, and it reads the board's project practices.
 
 using System;
 using System.Collections.Generic;
@@ -10,14 +12,21 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
 using AgentOs.Domain.Llm;
+using AgentOs.Domain.Memory;
 using AgentOs.Domain.Sessions;
+using AgentOs.Domain.Workspaces;
+using AgentOs.Modules.Pipeline.Prompts;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <inheritdoc cref="IAutopilotOrchestrator"/>
-public sealed class AutopilotOrchestratorAgent(ILlmClientFactory factory, ILogger<AutopilotOrchestratorAgent> logger) : IAutopilotOrchestrator
+public sealed class AutopilotOrchestratorAgent(ILlmClientFactory factory, ILogger<AutopilotOrchestratorAgent> logger,
+    IOptions<AgentsOptions>? options = null, IAgentProfiles? profiles = null, IPromptOverrides? prompts = null,
+    IBudgetGuard? budgetGuard = null, IMemoryStore? memory = null, IBoardRepos? boardRepos = null) : IAutopilotOrchestrator
 {
     private const int MaxGuidanceChars = 2_000;
     private const int MaxQuestionChars = 600;
@@ -56,16 +65,25 @@ Reply ONLY with this JSON (no other text):
     public async Task<OrchestratorDecision> DecideAsync(OrchestratorBrief brief, CancellationToken ct = default)
     {
         ArgumentNullException.ThrowIfNull(brief);
+        // Live profile (Settings → Agent profiles), resolved per call.
+        var profile = await BoardAgent.ProfileAsync(profiles, options, AgentRoles.AutopilotOrchestrator, ct).ConfigureAwait(false);
         ILlmClient llm;
-        try { llm = factory.Create("RemoteAgent"); }
+        try { llm = factory.Create(profile.Provider); }
         catch (Exception ex) when (ex is LlmException or ArgumentException or NotSupportedException or InvalidOperationException)
         {
             return OrchestratorDecision.NotRun($"No computer for the Orchestrator agent: {ex.Message}");
         }
-        var request = new LlmRequest(Instructions + "\n\n" + UntrustedText.SystemRule, User(brief), "claude-sonnet-4-6",
-            MaxTokens: 4096, Timeout: LlmRequest.AgentAnswerTimeout)
+        var provider = AgentBudgetGate.EffectiveProvider(llm, profile.Provider);
+        if (await AgentBudgetGate.BlockedAsync(budgetGuard, brief.TenantId, provider, logger, nameof(AutopilotOrchestratorAgent), ct).ConfigureAwait(false) is not null)
         {
-            AgentRole = "AutopilotOrchestrator",
+            return OrchestratorDecision.NotRun(AgentBudgetGate.BlockedMessage);
+        }
+        var request = new LlmRequest(
+            await BoardAgent.SystemPromptAsync(prompts, AgentRoles.AutopilotOrchestrator, Instructions, null, UntrustedText.SystemRule, ct).ConfigureAwait(false),
+            User(brief) + await PracticesAsync(brief, ct).ConfigureAwait(false),
+            profile.Model, profile.Temperature, profile.MaxTokens, Timeout: LlmRequest.AgentAnswerTimeout)
+        {
+            AgentRole = AgentRoles.AutopilotOrchestrator,
         };
         try
         {
@@ -79,6 +97,21 @@ public async Task<OrchestratorDecision> DecideAsync(OrchestratorBrief brief, Can
         }
     }
 
+    // The practices of the board's repositories: the lead's retry guidance and choices follow them like the agents it runs.
+    private async Task<string> PracticesAsync(OrchestratorBrief brief, CancellationToken ct)
+    {
+        if (memory is null || boardRepos is null) { return string.Empty; }
+        IReadOnlyList<string> repos;
+        try { repos = await boardRepos.RepoKeysAsync(brief.TenantId, brief.BoardId, ct).ConfigureAwait(false); }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning(ex, "Orchestrator agent: listing the board's repositories failed; deciding without the practices.");
+            return string.Empty;
+        }
+        var block = await ProjectPractices.BlockAsync(memory, brief.TenantId, repos, logger, ct).ConfigureAwait(false);
+        return block.Length == 0 ? string.Empty : block + "\nWrite retry guidance that follows these practices.";
+    }
+
     /// <summary>The brief as the agent reads it.</summary>
     internal static string User(OrchestratorBrief b)
     {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/BoardAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/BoardAgent.cs
new file mode 100644
index 00000000..3cf75120
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/BoardAgent.cs
@@ -0,0 +1,44 @@
+// What every Board agent does before its LLM call, in one place: resolve its live profile (Settings → Agent profiles —
+// provider, model, temperature, max output tokens; seeds in AgentsOptions) and its system prompt (Settings → Prompts —
+// the tenant's override of the template or the built-in one, filled per run, then the fixed security rule, then the
+// tenant's workspace rules). Both are read per call, so an edit applies to the next run without a restart.
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Modules.Pipeline.Prompts;
+using Microsoft.Extensions.Options;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Profile and prompt resolution shared by the Board agents.</summary>
+public static class BoardAgent
+{
+    private static readonly AgentsOptions Seeds = new();
+
+    /// <summary>The live profile for <paramref name="role"/>: the settings registry when wired, else the seed.</summary>
+    public static async ValueTask<AgentOptions> ProfileAsync(IAgentProfiles? profiles, IOptions<AgentsOptions>? options, string role,
+        CancellationToken ct)
+    {
+        var seed = (options?.Value ?? Seeds).For(role) ?? Seeds.For(role)
+            ?? throw new ArgumentException($"'{role}' is not a registered agent role.", nameof(role));
+        return profiles is null ? seed : await profiles.ResolveAsync(role, seed, ct).ConfigureAwait(false);
+    }
+
+    /// <summary>
+    /// The system prompt for <paramref name="role"/>: the tenant's override of <paramref name="defaultTemplate"/> (or the
+    /// template itself), its placeholders filled from <paramref name="values"/>, then <paramref name="fixedRules"/> (never
+    /// overridable — e.g. the untrusted-text rule), then the tenant's workspace rules.
+    /// </summary>
+    public static async Task<string> SystemPromptAsync(IPromptOverrides? prompts, string role, string defaultTemplate,
+        IReadOnlyDictionary<string, string>? values, string? fixedRules, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(defaultTemplate);
+        var template = prompts is null ? defaultTemplate : await prompts.ResolveAsync(role, defaultTemplate, ct).ConfigureAwait(false);
+        var text = values is null ? template : PromptTemplate.Fill(template, values);
+        if (!string.IsNullOrEmpty(fixedRules)) { text += "\n\n" + fixedRules; }
+        if (prompts is not null) { text += WorkspaceRules.ToPromptBlock(await prompts.ResolveRulesAsync(ct).ConfigureAwait(false)); }
+        return text;
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/IssueWorkAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/IssueWorkAgent.cs
index 6b3c356e..510acb3d 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/IssueWorkAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/IssueWorkAgent.cs
@@ -75,36 +75,16 @@ private void Emit(IssueWorkRequest req, SessionRunEventKind kind, string message
         _feed?.Publish(new SessionRunEvent(req.TenantId, req.SessionId, kind, message, DateTimeOffset.UtcNow, repo));
 
     // S1 — returns a fully-failed IssueWorkResult when the tenant is over its ENFORCED monthly LLM
-    // budget, else null (the run proceeds). Fail-open on a transient store error: a budget-store hiccup
-    // must never block a run — the cap re-applies on the next run once the store recovers.
-    private async Task<IssueWorkResult?> BudgetBlockedAsync(IssueWorkRequest request, CancellationToken ct)
+    // budget and the run would spend server tokens on effectiveProvider, else null (the run proceeds).
+    // Fail-open on a transient store error (see AgentBudgetGate).
+    private async Task<IssueWorkResult?> BudgetBlockedAsync(IssueWorkRequest request, string effectiveProvider, CancellationToken ct)
     {
-        BudgetStatus budget;
-        try
-        {
-            budget = await _budgetGuard!.EvaluateAsync(request.TenantId, ct).ConfigureAwait(false);
-        }
-        catch (Microsoft.EntityFrameworkCore.DbUpdateException ex) { return BudgetEvalFailed(ex); }
-        catch (System.Data.Common.DbException ex) { return BudgetEvalFailed(ex); }
-        catch (TimeoutException ex) { return BudgetEvalFailed(ex); }
-        catch (IOException ex) { return BudgetEvalFailed(ex); }
-        catch (InvalidOperationException ex) { return BudgetEvalFailed(ex); }
-
-        // fail-open: a transient budget-store error must not block a run — log and proceed.
-        IssueWorkResult? BudgetEvalFailed(Exception ex)
-        {
-            _logger.LogWarning(ex, "IssueWorkAgent: budget evaluation failed for tenant {Tenant}; proceeding.", request.TenantId);
-            return null;
-        }
-
-        if (budget is not { State: BudgetState.Exceeded, EnforceOn: true })
+        if (await AgentBudgetGate.BlockedAsync(_budgetGuard, request.TenantId, effectiveProvider, _logger, nameof(IssueWorkAgent), ct)
+                .ConfigureAwait(false) is not { } budget)
         {
             return null;
         }
 
-        _logger.LogWarning(
-            "IssueWorkAgent: blocking session {SessionId} — tenant {Tenant} over monthly LLM budget (${Spent} of ${Cap}).",
-            request.SessionId, request.TenantId, budget.SpentUsd, budget.CapUsd);
         Emit(request, SessionRunEventKind.Step,
             $"Blocked — monthly LLM budget exceeded (${budget.SpentUsd:0.##} of ${budget.CapUsd:0.##}). " +
             "Raise the cap in Settings, or use Run-on-machine (0 server tokens).");
@@ -134,36 +114,8 @@ public async Task<IssueWorkResult> RunAsync(IssueWorkRequest request, Cancellati
         // the CLI-mode prompt + a long dispatch timeout, and the run costs zero server tokens.
         var opts = _profiles is null
             ? _agentOpts
-            : await _profiles.ResolveAsync(nameof(AgentsOptions.IssueWork), _agentOpts, ct).ConfigureAwait(false);
+            : await _profiles.ResolveAsync(AgentRoles.IssueWork, _agentOpts, ct).ConfigureAwait(false);
         var providerName = request.ProviderOverride ?? opts.Provider;
-        var cliMode = providerName.Trim().ToUpperInvariant() is "REMOTEAGENT" or "REMOTE" or "IDE";
-
-        // S1 — server-token budget gate. Server-side runs spend AgentOS.NET's OWN LLM tokens, so they pass
-        // the per-tenant budget gate before the expensive agentic loop (the gap the run-level pipeline
-        // gate in PersistingOrchestratorAgent never covered for this path). CLI/RemoteAgent runs execute
-        // on the member's paired machine and cost ZERO server tokens, so they are exempt.
-        if (!cliMode && _budgetGuard is not null)
-        {
-            var blocked = await BudgetBlockedAsync(request, ct).ConfigureAwait(false);
-            if (blocked is not null)
-            {
-                return blocked;
-            }
-        }
-
-        // E0.6: per-tenant admission (concurrency + burst) — applies to CLI runs too (they hold a runner + a session).
-        using var lease = _admission is null ? null : await _admission.AdmitAsync(request.TenantId, ct).ConfigureAwait(false);
-        if (lease is { Admitted: false })
-        {
-            Emit(request, SessionRunEventKind.Step, "Blocked — " + lease.Reason);
-            return new IssueWorkResult(false,
-                request.Repos.Select(r => new RepoWorkOutcome(r.SessionRepoId, false, r.Owner, r.Repo, "", "", lease.Reason)).ToList(),
-                lease.Reason);
-        }
-
-        Emit(request, SessionRunEventKind.Running, cliMode
-            ? $"Running on your machine's CLI — {request.Repos.Count} repo(s), 0 server tokens."
-            : $"Dispatched to runner — {request.Repos.Count} repo(s).");
 
         ILlmClient llm;
         try
@@ -186,6 +138,33 @@ IssueWorkResult LlmInitFailed(Exception ex)
             return new IssueWorkResult(false, failed, $"LLM client init failed: {ex.Message}");
         }
 
+        // CLI mode and the budget gate follow the EFFECTIVE provider (after Settings' force-provider), not the name asked for.
+        var effective = AgentBudgetGate.EffectiveProvider(llm, providerName);
+        var cliMode = AgentBudgetGate.RunsOnMembersComputer(effective);
+
+        // S1 — server-token budget gate. Server-side runs spend AgentOS.NET's OWN LLM tokens, so they pass
+        // the per-tenant budget gate before the expensive agentic loop (the gap the run-level pipeline
+        // gate in PersistingOrchestratorAgent never covered for this path). CLI/RemoteAgent runs execute
+        // on the member's paired machine and cost ZERO server tokens, so they are exempt.
+        if (await BudgetBlockedAsync(request, effective, ct).ConfigureAwait(false) is { } blocked)
+        {
+            return blocked;
+        }
+
+        // E0.6: per-tenant admission (concurrency + burst) — applies to CLI runs too (they hold a runner + a session).
+        using var lease = _admission is null ? null : await _admission.AdmitAsync(request.TenantId, ct).ConfigureAwait(false);
+        if (lease is { Admitted: false })
+        {
+            Emit(request, SessionRunEventKind.Step, "Blocked — " + lease.Reason);
+            return new IssueWorkResult(false,
+                request.Repos.Select(r => new RepoWorkOutcome(r.SessionRepoId, false, r.Owner, r.Repo, "", "", lease.Reason)).ToList(),
+                lease.Reason);
+        }
+
+        Emit(request, SessionRunEventKind.Running, cliMode
+            ? $"Running on your machine's CLI — {request.Repos.Count} repo(s), 0 server tokens."
+            : $"Dispatched to runner — {request.Repos.Count} repo(s).");
+
         // Run repos with bounded concurrency. Each repo is an independent LLM run with its own
         // working_dir on the runner, so they don't collide; the broker dispatches per-call (GUID
         // ToolCallId) so concurrent runner_shell calls are safe. A semaphore caps fan-out to keep the
@@ -253,11 +232,17 @@ private async Task<RepoWorkOutcome> RunOneAsync(ILlmClient llm, AgentOptions opt
         // expose no server tools, and grant a long timeout for the full clone→build→test→push run.
         // E1.6: the tenant's workspace rules apply to the Quick engine too (server and CLI mode).
         var rules = _prompts is null ? string.Empty : WorkspaceRules.ToPromptBlock(await _prompts.ResolveRulesAsync(ct).ConfigureAwait(false));
+        // Settings → Prompts: the tenant's override of this mode's template (or the built-in one), filled per repo.
+        var template = _prompts is null
+            ? null
+            : cliMode
+                ? await _prompts.ResolveAsync(AgentRoles.IssueWork, IssueWorkPrompt.CliTemplate, ct).ConfigureAwait(false)
+                : await _prompts.ResolveAsync(IssueWorkPrompt.ServerPromptKey, IssueWorkPrompt.ServerTemplate, ct).ConfigureAwait(false);
         // Knowledge graph: the lessons earlier work on this repo left behind (reviews, failing checks, acceptance tests).
         var lessons = await RecallLessonsAsync(request, repo, ct).ConfigureAwait(false);
         var req = cliMode
             ? new LlmRequest(
-                SystemPrompt: IssueWorkPrompt.SystemCli(request, repo) + rules,
+                SystemPrompt: IssueWorkPrompt.SystemCli(request, repo, template) + rules,
                 UserPrompt: IssueWorkPrompt.User(request, repo) + lessons,
                 Model: opts.Model,
                 Temperature: opts.Temperature,
@@ -266,6 +251,7 @@ private async Task<RepoWorkOutcome> RunOneAsync(ILlmClient llm, AgentOptions opt
                 Timeout: CliRunTimeout,
                 Cli: request.CliProfile)
             {
+                AgentRole = AgentRoles.IssueWork,
                 // The only request that asks the runner for hands: clone → edit → build → test → push in its own
                 // per-run directory. Every other remote call stays answer-only.
                 Autonomy = WorkspaceAutonomy.Scoped,
@@ -279,12 +265,15 @@ private async Task<RepoWorkOutcome> RunOneAsync(ILlmClient llm, AgentOptions opt
                 }),
             }
             : new LlmRequest(
-                SystemPrompt: IssueWorkPrompt.System(request, repo) + rules,
+                SystemPrompt: IssueWorkPrompt.System(request, repo, template) + rules,
                 UserPrompt: IssueWorkPrompt.User(request, repo) + lessons,
                 Model: opts.Model,
                 Temperature: opts.Temperature,
                 MaxTokens: opts.MaxTokens,
-                Tools: ["runner_shell"]);
+                Tools: ["runner_shell"])
+            {
+                AgentRole = AgentRoles.IssueWork,
+            };
 
         try
         {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/LlmAgentBase.cs b/src/AgentOs.Modules.Pipeline/Agents/LlmAgentBase.cs
index c0478032..5509c12c 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/LlmAgentBase.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/LlmAgentBase.cs
@@ -101,17 +101,28 @@ protected async Task<TResult> ExecuteAsync<TDto, TResult>(
         }
 
         // Resolve the live profile per call (an edit in Settings applies to the next call) and pick the client
-        // for its provider — never frozen at construction.
+        // for its provider — never frozen at construction. A Board agent that reuses this specialist (Discovery runs
+        // the Requirement agent) opens an AgentRunScope: its role's profile, metrics name and budget gate apply.
+        var run = AgentRunScope.Current;
+        var role = run?.Role ?? PromptKey;
+        var fallback = run?.Fallback ?? _options;
         var profile = _profiles is null
-            ? _options
-            : await _profiles.ResolveAsync(PromptKey, _options, ct).ConfigureAwait(false);
+            ? fallback
+            : await _profiles.ResolveAsync(role, fallback, ct).ConfigureAwait(false);
         var llm = _factory.Create(profile.Provider);
+        if (run?.Budget is { } budget
+            && await AgentBudgetGate.BlockedAsync(budget, null, AgentBudgetGate.EffectiveProvider(llm, profile.Provider), Logger, AgentName, ct)
+                .ConfigureAwait(false) is not null)
+        {
+            throw new LlmException(AgentBudgetGate.BlockedMessage, AgentName);
+        }
 
         var request = new LlmRequest(systemPrompt, userPrompt, profile.Model, profile.Temperature, profile.MaxTokens)
         {
-            // Carry the fixed agent role out-of-band so providers (notably the offline one) can identify the
-            // agent without parsing the system prompt — robust against per-tenant prompt overrides.
-            AgentRole = PromptKey,
+            // Carry the agent role out-of-band so providers (notably the offline one) can identify the agent without
+            // parsing the system prompt — robust against per-tenant prompt overrides — and Insights files the call
+            // under it.
+            AgentRole = role,
             Timeout = LlmRequest.AgentAnswerTimeout,
         };
         var response = await llm.SendAsync(request, ct).ConfigureAwait(false);
diff --git a/src/AgentOs.Modules.Pipeline/Agents/ProjectPractices.cs b/src/AgentOs.Modules.Pipeline/Agents/ProjectPractices.cs
new file mode 100644
index 00000000..a2c013d2
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/ProjectPractices.cs
@@ -0,0 +1,46 @@
+// The project's practices (what the Retrospective agent distilled from reviews, failing checks and acceptance tests),
+// read by every agent that works on a project: Coding (tickets), Reviewer, Testing (tickets) and the Autopilot lead.
+// One helper so they all read the same list the same way — bounded, fenced as data, best-effort.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Memory;
+using Microsoft.Extensions.Logging;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Reads a project's practices as a prompt block.</summary>
+public static class ProjectPractices
+{
+    /// <summary>Most repositories whose practices one prompt carries (a board's agent reads at most this many).</summary>
+    public const int MaxRepos = 5;
+
+    /// <summary>
+    /// The practices of <paramref name="repoKeys"/> (<c>owner/repo</c>) as one <see cref="ProjectMemory.PracticesBlock"/>,
+    /// or empty when there are none. Never throws (a memory failure is no practices); strictly per tenant.
+    /// </summary>
+    public static async Task<string> BlockAsync(IMemoryStore? memory, string tenantId, IEnumerable<string> repoKeys,
+        ILogger logger, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(repoKeys);
+        ArgumentNullException.ThrowIfNull(logger);
+        if (memory is null || string.IsNullOrWhiteSpace(tenantId)) { return string.Empty; }
+        try
+        {
+            var all = new List<MemoryNode>();
+            foreach (var repo in repoKeys.Where(r => !string.IsNullOrWhiteSpace(r)).Distinct(StringComparer.OrdinalIgnoreCase).Take(MaxRepos))
+            {
+                all.AddRange(await memory.ListAsync(tenantId, repo, MemoryKinds.Practice, RetrospectiveAgent.MaxPractices, ct).ConfigureAwait(false));
+            }
+            return ProjectMemory.PracticesBlock(all);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning(ex, "Reading the project's practices failed; the agent works without them.");
+            return string.Empty;
+        }
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/RetrospectiveAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/RetrospectiveAgent.cs
index 47c8b112..6ddc1e9b 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/RetrospectiveAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/RetrospectiveAgent.cs
@@ -1,6 +1,8 @@
 // The Retrospective agent (see IRetrospectiveAgent). Answer-only on the member's paired computer — it reasons over the
 // lessons it is given and replies with JSON — so it costs no API tokens. The caller keeps the guardrails: pinned
-// practices stay, absorbed ids must be lessons it was shown, and an empty answer never wipes the practices.
+// practices stay, absorbed ids must be lessons it was shown, and an empty answer never wipes the practices. Its profile
+// (Settings → Agent profiles, role "Retrospective"), its prompt (Settings → Prompts) and the budget gate apply like every
+// other agent's.
 
 using System;
 using System.Collections.Generic;
@@ -10,14 +12,19 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
 using AgentOs.Domain.Llm;
 using AgentOs.Domain.Memory;
+using AgentOs.Modules.Pipeline.Prompts;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <inheritdoc cref="IRetrospectiveAgent"/>
-public sealed class RetrospectiveAgent(ILlmClientFactory factory, ILogger<RetrospectiveAgent> logger) : IRetrospectiveAgent
+public sealed class RetrospectiveAgent(ILlmClientFactory factory, ILogger<RetrospectiveAgent> logger,
+    IOptions<AgentsOptions>? options = null, IAgentProfiles? profiles = null, IPromptOverrides? prompts = null,
+    IBudgetGuard? budgetGuard = null) : IRetrospectiveAgent
 {
     /// <summary>Practices a project keeps at most — few enough that every agent reads all of them.</summary>
     public const int MaxPractices = 15;
@@ -49,16 +56,24 @@ public async Task<RetrospectiveResult> RunAsync(RetrospectiveInput input, Cancel
     {
         ArgumentNullException.ThrowIfNull(input);
         if (input.Lessons.Count == 0) { return RetrospectiveResult.NotRun("No new lessons to distil."); }
+        // Live profile (Settings → Agent profiles), resolved per call.
+        var profile = await BoardAgent.ProfileAsync(profiles, options, AgentRoles.Retrospective, ct).ConfigureAwait(false);
         ILlmClient llm;
-        try { llm = factory.Create("RemoteAgent"); }
+        try { llm = factory.Create(profile.Provider); }
         catch (Exception ex) when (ex is LlmException or ArgumentException or NotSupportedException or InvalidOperationException)
         {
             return RetrospectiveResult.NotRun($"No computer for the Retrospective agent: {ex.Message}");
         }
-        var request = new LlmRequest(Instructions + "\n\n" + UntrustedText.SystemRule, User(input), "claude-sonnet-4-6",
-            MaxTokens: 4096, Timeout: LlmRequest.AgentAnswerTimeout)
+        var provider = AgentBudgetGate.EffectiveProvider(llm, profile.Provider);
+        if (await AgentBudgetGate.BlockedAsync(budgetGuard, input.TenantId, provider, logger, nameof(RetrospectiveAgent), ct).ConfigureAwait(false) is not null)
         {
-            AgentRole = "Retrospective",
+            return RetrospectiveResult.NotRun(AgentBudgetGate.BlockedMessage);
+        }
+        var request = new LlmRequest(
+            await BoardAgent.SystemPromptAsync(prompts, AgentRoles.Retrospective, Instructions, null, UntrustedText.SystemRule, ct).ConfigureAwait(false),
+            User(input), profile.Model, profile.Temperature, profile.MaxTokens, Timeout: LlmRequest.AgentAnswerTimeout)
+        {
+            AgentRole = AgentRoles.Retrospective,
         };
         try
         {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/ReviewAgent.cs b/src/AgentOs.Modules.Pipeline/Agents/ReviewAgent.cs
index e6e44152..7f6c2e1e 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/ReviewAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/ReviewAgent.cs
@@ -2,6 +2,8 @@
 // diff against its ticket and the repository's own rules, the way a careful reviewer would, and either approves it or
 // returns must-fix findings that go back to the Coding agent. It runs on the member's paired computer under scoped
 // autonomy (it needs the checkout to read code in context and may build) and never edits, commits or pushes.
+// Its profile (Settings → Agent profiles, role "Reviewer"), its prompt (Settings → Prompts) and the budget gate apply
+// like every other agent's; the seed keeps it on the member's computer (0 server tokens).
 
 using System;
 using System.Collections.Generic;
@@ -10,15 +12,19 @@
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
+using AgentOs.Domain.Cost;
 using AgentOs.Domain.Llm;
 using AgentOs.Domain.Sessions;
+using AgentOs.Modules.Pipeline.Prompts;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace AgentOs.Modules.Pipeline.Agents;
 
 /// <inheritdoc cref="IReviewAgent"/>
 public sealed class ReviewAgent(ILlmClientFactory factory, ILogger<ReviewAgent> logger, ISessionRunFeed? feed = null,
-    AgentOs.Domain.Memory.IMemoryStore? memory = null) : IReviewAgent
+    AgentOs.Domain.Memory.IMemoryStore? memory = null, IOptions<AgentsOptions>? options = null, IAgentProfiles? profiles = null,
+    IPromptOverrides? prompts = null, IBudgetGuard? budgetGuard = null) : IReviewAgent
 {
     // Reading a diff in context is quicker than testing it; a build fits too.
     private static readonly TimeSpan RunTimeout = TimeSpan.FromMinutes(20);
@@ -32,25 +38,37 @@ public async Task<ReviewVerdict> RunAsync(AcceptanceRequest request, Cancellatio
             return NotRun("There is no proposed change (branch) to review.");
         }
         var repoLabel = $"{request.Repo.Owner}/{request.Repo.Repo}";
-        Emit(request, SessionRunEventKind.Running, $"Reviewing #{request.IssueNumber} on your computer.", repoLabel);
 
+        // Live profile (Settings → Agent profiles), resolved per call.
+        var profile = await BoardAgent.ProfileAsync(profiles, options, AgentRoles.Reviewer, ct).ConfigureAwait(false);
         ILlmClient llm;
-        try { llm = factory.Create("RemoteAgent"); }
+        try { llm = factory.Create(profile.Provider); }
         catch (Exception ex) when (ex is LlmException or ArgumentException or NotSupportedException or InvalidOperationException)
         {
             return NotRun($"No computer to review on: {ex.Message}");
         }
+        var provider = AgentBudgetGate.EffectiveProvider(llm, profile.Provider);
+        if (await AgentBudgetGate.BlockedAsync(budgetGuard, request.TenantId, provider, logger, nameof(ReviewAgent), ct).ConfigureAwait(false) is not null)
+        {
+            return NotRun(AgentBudgetGate.BlockedMessage);
+        }
+        Emit(request, SessionRunEventKind.Running, AgentBudgetGate.RunsOnMembersComputer(provider)
+            ? $"Reviewing #{request.IssueNumber} on your computer."
+            : $"Reviewing #{request.IssueNumber} ({provider}).", repoLabel);
 
         var llmRequest = new LlmRequest(
-            SystemPrompt: Instructions(request) + "\n\n" + UntrustedText.SystemRule,
+            SystemPrompt: await BoardAgent.SystemPromptAsync(prompts, AgentRoles.Reviewer, InstructionsTemplate, AcceptanceAgent.Values(request),
+                UntrustedText.SystemRule, ct).ConfigureAwait(false),
             UserPrompt: AcceptanceAgent.User(request).Replace("Test the change against these criteria and reply with the JSON verdict.",
                 "Review the change against this ticket and reply with the JSON verdict.", StringComparison.Ordinal)
                 + await PracticesAsync(request, ct).ConfigureAwait(false),
-            Model: "claude-sonnet-4-6",
-            MaxTokens: 32768,
+            Model: profile.Model,
+            Temperature: profile.Temperature,
+            MaxTokens: profile.MaxTokens,
             Timeout: RunTimeout,
             Cli: request.CliProfile)
         {
+            AgentRole = AgentRoles.Reviewer,
             Autonomy = WorkspaceAutonomy.Scoped,
             Progress = new InlineProgress<string>(step =>
             {
@@ -72,19 +90,9 @@ public async Task<ReviewVerdict> RunAsync(AcceptanceRequest request, Cancellatio
     // The project's practices: a change that breaks one is a must-fix finding. Best-effort — none on a memory failure.
     private async Task<string> PracticesAsync(AcceptanceRequest request, CancellationToken ct)
     {
-        if (memory is null) { return string.Empty; }
-        try
-        {
-            var practices = await memory.ListAsync(request.TenantId, $"{request.Repo.Owner}/{request.Repo.Repo}",
-                AgentOs.Domain.Memory.MemoryKinds.Practice, RetrospectiveAgent.MaxPractices, ct).ConfigureAwait(false);
-            return practices.Count == 0 ? string.Empty
-                : AgentOs.Domain.Memory.ProjectMemory.PracticesBlock(practices) + "\nA change that breaks one of these practices is a must-fix finding.";
-        }
-        catch (Exception ex) when (ex is not OperationCanceledException)
-        {
-            logger.LogWarning(ex, "Reviewer: reading the practices failed");
-            return string.Empty;
-        }
+        var block = await ProjectPractices.BlockAsync(memory, request.TenantId, [$"{request.Repo.Owner}/{request.Repo.Repo}"], logger, ct)
+            .ConfigureAwait(false);
+        return block.Length == 0 ? string.Empty : block + "\nA change that breaks one of these practices is a must-fix finding.";
     }
 
     private static ReviewVerdict NotRun(string why) => new(false, false, [], why, why);
@@ -92,8 +100,12 @@ private async Task<string> PracticesAsync(AcceptanceRequest request, Cancellatio
     private void Emit(AcceptanceRequest r, SessionRunEventKind kind, string message, string repo) =>
         feed?.Publish(new SessionRunEvent(r.TenantId, r.SessionId, kind, message, DateTimeOffset.UtcNow, repo));
 
-    internal static string Instructions(AcceptanceRequest r) => string.Format(
-        CultureInfo.InvariantCulture,
+    /// <summary>The system prompt for one run (the built-in template, filled).</summary>
+    internal static string Instructions(AcceptanceRequest r) => PromptTemplate.Fill(InstructionsTemplate, AcceptanceAgent.Values(r));
+
+    /// <summary>The built-in system prompt template — placeholders as <see cref="AcceptanceAgent.Placeholders"/> (its first
+    /// line is the agent's routing key).</summary>
+    public const string InstructionsTemplate =
         """
         You are the Reviewer Agent of AgentOS.NET. You review a proposed change before it is tested, the way a careful
         senior reviewer would on its pull request, on the developer's own machine with your native shell and file tools.
@@ -101,10 +113,10 @@ internal static string Instructions(AcceptanceRequest r) => string.Format(
         requests.
 
         1. Get the change. The runner starts you in a fresh, empty directory made for this run:
-           git clone https://github.com/{0}/{1}.git .
-           git fetch origin {2}
-           git checkout {2}
-           git diff origin/{3}...HEAD
+           git clone https://github.com/{owner}/{repo}.git .
+           git fetch origin {branch}
+           git checkout {branch}
+           git diff origin/{defaultBranch}...HEAD
         2. Read the ticket (user message) and the repository's rules (AGENTS.md, CLAUDE.md, README, docs it points to).
         3. Review the diff in context — open the files around each change. Look for, in this order:
            - correctness: does it do what the ticket asks; broken edge cases; wrong logic; regressions;
@@ -120,10 +132,9 @@ repository rule. Only these block the change.
            Do not invent problems; an approval with no findings is a good outcome.
 
         Reply ONLY with this JSON (no other text):
-        {{"verdict":"approve","findings":[{{"severity":"must-fix","file":"<path>","line":42,"comment":"<what is wrong and what to do>"}}],"summary":"<one or two sentences>"}}
+        {"verdict":"approve","findings":[{"severity":"must-fix","file":"<path>","line":42,"comment":"<what is wrong and what to do>"}],"summary":"<one or two sentences>"}
         "verdict" is "approve" when there is no must-fix finding, otherwise "changes".
-        """,
-        r.Repo.Owner, r.Repo.Repo, r.Repo.ExistingBranch, r.Repo.DefaultBranch);
+        """;
 
     /// <summary>Reads the agent's JSON verdict. An approval is only trusted when no finding is must-fix.</summary>
     internal static ReviewVerdict Parse(string content)
diff --git a/src/AgentOs.Modules.Pipeline/Decomposition/IdeaBootstrapService.cs b/src/AgentOs.Modules.Pipeline/Decomposition/IdeaBootstrapService.cs
index d13ae84c..2a973e49 100644
--- a/src/AgentOs.Modules.Pipeline/Decomposition/IdeaBootstrapService.cs
+++ b/src/AgentOs.Modules.Pipeline/Decomposition/IdeaBootstrapService.cs
@@ -35,11 +35,16 @@ internal sealed class IdeaBootstrapService : IIdeaBootstrapService
 {
     private readonly IRequirementAgent _requirement;
     private readonly ITicketDecomposerAgent _decomposer;
+    private readonly AgentOptions? _discovery;
+    private readonly AgentOs.Domain.Cost.IBudgetGuard? _budgetGuard;
 
-    public IdeaBootstrapService(IRequirementAgent requirement, ITicketDecomposerAgent decomposer)
+    public IdeaBootstrapService(IRequirementAgent requirement, ITicketDecomposerAgent decomposer,
+        Microsoft.Extensions.Options.IOptions<AgentsOptions>? options = null, AgentOs.Domain.Cost.IBudgetGuard? budgetGuard = null)
     {
         _requirement = requirement ?? throw new ArgumentNullException(nameof(requirement));
         _decomposer = decomposer ?? throw new ArgumentNullException(nameof(decomposer));
+        _discovery = options?.Value.Discovery;
+        _budgetGuard = budgetGuard;
     }
 
     /// <inheritdoc />
@@ -48,7 +53,13 @@ public async Task<BootstrapPreview> GenerateAsync(string idea, string locale = "
         ArgumentException.ThrowIfNullOrWhiteSpace(idea);
 
         var story = new UserStory(idea, NMax: 1, Locale: string.IsNullOrWhiteSpace(locale) ? "en-US" : locale);
-        var spec = await _requirement.RunAsync(story, cancellationToken).ConfigureAwait(false);
+        // The requirement step is the Discovery agent's: its profile (Settings → Agent profiles, "Discovery"), its name in
+        // Insights and the budget gate — with the Requirement agent's prompt and spec contract.
+        RequirementSpec spec;
+        using (AgentRunScope.Begin(AgentRoles.Discovery, _discovery, _budgetGuard))
+        {
+            spec = await _requirement.RunAsync(story, cancellationToken).ConfigureAwait(false);
+        }
 
         var seed = TicketMapper.Map(spec);
         var tickets = await _decomposer.RunAsync(spec, seed, idea, cancellationToken).ConfigureAwait(false);
diff --git a/src/AgentOs.Modules.Pipeline/Decomposition/TicketDecomposerAgent.cs b/src/AgentOs.Modules.Pipeline/Decomposition/TicketDecomposerAgent.cs
index 6756416a..3ada01cf 100644
--- a/src/AgentOs.Modules.Pipeline/Decomposition/TicketDecomposerAgent.cs
+++ b/src/AgentOs.Modules.Pipeline/Decomposition/TicketDecomposerAgent.cs
@@ -41,20 +41,23 @@ public sealed partial class TicketDecomposerAgent : ITicketDecomposerAgent
     private readonly ILogger<TicketDecomposerAgent> _logger;
     private readonly IAgentProfiles? _profiles;
     private readonly AgentOs.Modules.Pipeline.Prompts.IPromptOverrides? _prompts;
+    private readonly AgentOs.Domain.Cost.IBudgetGuard? _budgetGuard;
 
     public TicketDecomposerAgent(
         ILlmClientFactory factory,
         IOptions<AgentsOptions> options,
         ILogger<TicketDecomposerAgent> logger,
         IAgentProfiles? profiles = null,
-        AgentOs.Modules.Pipeline.Prompts.IPromptOverrides? prompts = null)
+        AgentOs.Modules.Pipeline.Prompts.IPromptOverrides? prompts = null,
+        AgentOs.Domain.Cost.IBudgetGuard? budgetGuard = null)
     {
         _prompts = prompts;
         _factory = factory ?? throw new ArgumentNullException(nameof(factory));
         ArgumentNullException.ThrowIfNull(options);
-        _options = options.Value.Decomposer;
+        _options = options.Value.Discovery;
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
         _profiles = profiles;
+        _budgetGuard = budgetGuard;
     }
 
     /// <inheritdoc />
@@ -63,23 +66,30 @@ public async Task<IReadOnlyList<TicketDraft>> RunAsync(RequirementSpec spec, IRe
         ArgumentNullException.ThrowIfNull(spec);
         ArgumentNullException.ThrowIfNull(seed);
 
-        // Live profile (Settings → Agent profiles), resolved per call.
+        // Live profile (Settings → Agent profiles, the "Discovery" row), resolved per call.
         var profile = _profiles is null
             ? _options
-            : await _profiles.ResolveAsync(nameof(AgentsOptions.Decomposer), _options, cancellationToken).ConfigureAwait(false);
+            : await _profiles.ResolveAsync(AgentRoles.Discovery, _options, cancellationToken).ConfigureAwait(false);
         var llm = _factory.Create(profile.Provider);
-        // E1.6: the tenant may override this prompt and its workspace rules apply here too.
-        var system = _prompts is null
-            ? DecomposerPrompt.System
-            : await _prompts.ResolveAsync("Decomposer", DecomposerPrompt.System, cancellationToken).ConfigureAwait(false)
-              + AgentOs.Modules.Pipeline.Prompts.WorkspaceRules.ToPromptBlock(await _prompts.ResolveRulesAsync(cancellationToken).ConfigureAwait(false));
+        // S1 — a split that would spend server tokens passes the tenant's budget gate; blocked → the deterministic seed.
+        if (await AgentBudgetGate.BlockedAsync(_budgetGuard, null, AgentBudgetGate.EffectiveProvider(llm, profile.Provider), _logger, AgentName,
+                cancellationToken).ConfigureAwait(false) is not null)
+        {
+            return seed;
+        }
+        // E1.6: the tenant may override this prompt (Settings → Prompts, "Discovery") and its workspace rules apply here too.
+        var system = await BoardAgent.SystemPromptAsync(_prompts, AgentRoles.Discovery, DecomposerPrompt.System, null, null, cancellationToken)
+            .ConfigureAwait(false);
         var request = new LlmRequest(
             SystemPrompt: system,
             UserPrompt: DecomposerPrompt.RenderUser(spec, seed, idea),
             Model: profile.Model,
             Temperature: profile.Temperature,
             MaxTokens: profile.MaxTokens,
-            Timeout: LlmRequest.AgentAnswerTimeout);
+            Timeout: LlmRequest.AgentAnswerTimeout)
+        {
+            AgentRole = AgentRoles.Discovery,
+        };
 
         try
         {
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/IssueWorkPrompt.cs b/src/AgentOs.Modules.Pipeline/Prompts/IssueWorkPrompt.cs
index 52a69112..165a381c 100644
--- a/src/AgentOs.Modules.Pipeline/Prompts/IssueWorkPrompt.cs
+++ b/src/AgentOs.Modules.Pipeline/Prompts/IssueWorkPrompt.cs
@@ -4,7 +4,11 @@
 // On failure it replies with: {"branch":"","summary":"","error":"...reason..."}.
 // For a cross-service ticket (more than one repo) each repo gets its own run, with a note naming the
 // sibling repos so the agent can cross-link the PRs.
+// Both system prompts are templates (named placeholders, PromptTemplate) so a tenant can override them in Settings →
+// Prompts: "IssueWork" (the run on a member's computer — the Board default) and "IssueWork.Server" (the server-side
+// runner_shell loop). The untrusted-text rule is appended by code, never part of the overridable text.
 
+using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.Linq;
@@ -15,24 +19,51 @@ namespace AgentOs.Modules.Pipeline.Prompts;
 
 internal static class IssueWorkPrompt
 {
-    internal static string System(IssueWorkRequest req, WorkRepo repo) => string.Format(
-        CultureInfo.InvariantCulture,
+    /// <summary>Prompt key of the server-side (runner_shell) variant; the member's-computer variant uses the role key.</summary>
+    internal const string ServerPromptKey = "IssueWork.Server";
+
+    /// <summary>The placeholders both templates (and an override of them) may use.</summary>
+    internal static readonly IReadOnlyList<string> Placeholders =
+        ["owner", "repo", "defaultBranch", "issue", "branch", "branchStep", "commitType", "crossServiceNote", "crossLinkCommitNote"];
+
+    /// <summary>The per-run values of <see cref="Placeholders"/>.</summary>
+    internal static Dictionary<string, string> Values(IssueWorkRequest req, WorkRepo repo) => new(StringComparer.Ordinal)
+    {
+        ["owner"] = repo.Owner,
+        ["repo"] = repo.Repo,
+        ["defaultBranch"] = repo.DefaultBranch,
+        ["issue"] = req.IssueNumber.ToString(CultureInfo.InvariantCulture),
+        ["crossServiceNote"] = CrossServiceNote(req, repo),
+        ["crossLinkCommitNote"] = CrossLinkCommitNote(req, repo),
+        ["branchStep"] = BranchStep(req, repo),
+        ["branch"] = BranchName(req, repo),
+        ["commitType"] = CommitType(req),
+    };
+
+    internal static string System(IssueWorkRequest req, WorkRepo repo, string? template = null) =>
+        PromptTemplate.Fill(template ?? ServerTemplate, Values(req, repo)) + SecurityFooter;
+
+    internal static string SystemCli(IssueWorkRequest req, WorkRepo repo, string? template = null) =>
+        PromptTemplate.Fill(template ?? CliTemplate, Values(req, repo)) + SecurityFooter;
+
+    /// <summary>The server-side system prompt template (the LLM drives the paired runner through <c>runner_shell</c>).</summary>
+    internal const string ServerTemplate =
         """
         You are an AI software engineer with shell access to a developer machine where the
-        {0}/{1} repository (default branch: {2}) is checked out.
-        {4}
+        {owner}/{repo} repository (default branch: {defaultBranch}) is checked out.
+        {crossServiceNote}
         Use the `runner_shell` tool to execute shell commands on that machine. Workflow:
 
         1. Discover the repository path: run `pwd`, then `ls`. If the repo is not in the
            current directory, find it with:
-           find ~ -maxdepth 5 -type d -name "{1}" 2>/dev/null | head -1
+           find ~ -maxdepth 5 -type d -name "{repo}" 2>/dev/null | head -1
            Then `cd` into it for all subsequent commands.
 
         2. Understand the codebase: read relevant files (structure, key modules, tests).
            Read only what is needed — do not dump entire file trees.
 
-        {6}
-        4. Implement the fix for ticket #{3}. Edit files directly:
+        {branchStep}
+        4. Implement the fix for ticket #{issue}. Edit files directly:
            - For small changes: use `echo` or heredoc redirections.
            - For larger changes: write a Python/PowerShell one-liner or use `tee`.
            - Prefer minimal, focused changes over large rewrites.
@@ -50,43 +81,33 @@ You are an AI software engineer with shell access to a developer machine where t
 
         7. Commit:
            git add -A
-           git commit -m "{8}: <short description> (#{3})"{5}
+           git commit -m "{commitType}: <short description> (#{issue})"{crossLinkCommitNote}
 
         8. Push:
-           git push origin {7}
+           git push origin {branch}
 
         When the branch is pushed, reply ONLY with this JSON (no other text):
-        {{"branch":"{7}","summary":"<one sentence describing the change>"}}
+        {"branch":"{branch}","summary":"<one sentence describing the change>"}
 
         If you cannot complete the task, reply with:
-        {{"branch":"","summary":"","error":"<brief reason>"}}
-        """,
-        repo.Owner,
-        repo.Repo,
-        repo.DefaultBranch,
-        req.IssueNumber,
-        CrossServiceNote(req, repo),
-        CrossLinkCommitNote(req, repo),
-        BranchStep(req, repo),
-        BranchName(req, repo),
-        CommitType(req)) + SecurityFooter;
+        {"branch":"","summary":"","error":"<brief reason>"}
+        """;
 
     // CLI-mode system prompt — used when the run is routed to the member's paired dev-machine CLI
     // (claude-code / codex) via the RemoteAgent provider. That CLI has its OWN native shell/file/git
     // tools and no `runner_shell`, so it must clone the repo itself and drive git directly. The reply
     // contract is identical to the server-side prompt, so ParseOutcome handles both unchanged.
-    internal static string SystemCli(IssueWorkRequest req, WorkRepo repo) => string.Format(
-        CultureInfo.InvariantCulture,
+    internal const string CliTemplate =
         """
         You are an autonomous coding agent (for example claude-code) running directly on the
         developer's own machine, with native shell, file-editing, and git tools. Do NOT expect any
         server-provided tools — drive the shell, file edits, and git with your own built-in tools.
-        {4}
+        {crossServiceNote}
         Workflow:
 
-        1. Clone the {0}/{1} repository (default branch: {2}). The runner starts you in a fresh, empty directory made for
+        1. Clone the {owner}/{repo} repository (default branch: {defaultBranch}). The runner starts you in a fresh, empty directory made for
            this run — clone INTO it, so every later command runs there without a `cd`:
-           git clone https://github.com/{0}/{1}.git .
+           git clone https://github.com/{owner}/{repo}.git .
            (Only if the current directory is not empty: clone into a new subdirectory and work there.)
            Use the machine's existing git/gh credentials — do NOT embed any token in the URL.
            Stay inside this directory: files outside it and other repositories are off limits.
@@ -94,8 +115,8 @@ You are an autonomous coding agent (for example claude-code) running directly on
         2. Understand the codebase: read the relevant files (structure, key modules, tests).
            Read only what is needed — do not dump entire file trees.
 
-        {6}
-        4. Implement the fix for ticket #{3}. Make minimal, focused edits.
+        {branchStep}
+        4. Implement the fix for ticket #{issue}. Make minimal, focused edits.
 
         5. Build to verify compilation:
            - .NET: `dotnet build`
@@ -108,26 +129,17 @@ You are an autonomous coding agent (for example claude-code) running directly on
 
         7. Commit:
            git add -A
-           git commit -m "{8}: <short description> (#{3})"{5}
+           git commit -m "{commitType}: <short description> (#{issue})"{crossLinkCommitNote}
 
         8. Push the branch to origin:
-           git push -u origin {7}
+           git push -u origin {branch}
 
         When the branch is pushed, reply ONLY with this JSON (no other text):
-        {{"branch":"{7}","summary":"<one sentence describing the change>"}}
+        {"branch":"{branch}","summary":"<one sentence describing the change>"}
 
         If you cannot complete the task, reply with:
-        {{"branch":"","summary":"","error":"<brief reason>"}}
-        """,
-        repo.Owner,
-        repo.Repo,
-        repo.DefaultBranch,
-        req.IssueNumber,
-        CrossServiceNote(req, repo),
-        CrossLinkCommitNote(req, repo),
-        BranchStep(req, repo),
-        BranchName(req, repo),
-        CommitType(req)) + SecurityFooter;
+        {"branch":"","summary":"","error":"<brief reason>"}
+        """;
 
     // The ticket title/body are written by whoever can open an issue — fence them as data. The branch name,
     // repo, and workflow come only from these system prompts, never from the ticket.
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/PromptCatalog.cs b/src/AgentOs.Modules.Pipeline/Prompts/PromptCatalog.cs
index f67ad4cb..e0df15b8 100644
--- a/src/AgentOs.Modules.Pipeline/Prompts/PromptCatalog.cs
+++ b/src/AgentOs.Modules.Pipeline/Prompts/PromptCatalog.cs
@@ -1,23 +1,71 @@
 // The tunable agent prompts the Prompts admin app exposes. Key must match what each agent passes to
-// IPromptOverrides.ResolveAsync; DefaultPrompt is the compiled-in baseline shown for reset/diff.
+// IPromptOverrides.ResolveAsync — the agent's role key (AgentRoles), so a prompt, a profile and an Insights row of the
+// same agent share one name; DefaultPrompt is the compiled-in baseline shown for reset/diff. Board agent prompts are
+// per-run templates: their placeholders ({owner}, {branch}…) are filled on every run (PromptTemplate).
 
 using System.Collections.Generic;
+using AgentOs.Modules.Pipeline.Agents;
 
 namespace AgentOs.Modules.Pipeline.Prompts;
 
 /// <summary>One tunable agent prompt.</summary>
-public sealed record PromptEntry(string Key, string DisplayName, string DefaultPrompt);
+public sealed record PromptEntry(string Key, string DisplayName, string DefaultPrompt)
+{
+    /// <summary>Board agent or Workflow pipeline agent.</summary>
+    public AgentRoleGroup Group { get; init; } = AgentRoleGroup.WorkflowPipeline;
+
+    /// <summary>Placeholders the template fills per run (empty = a plain prompt).</summary>
+    public IReadOnlyList<string> Placeholders { get; init; } = [];
+
+    /// <summary>One sentence shown under the prompt (where it applies), or null.</summary>
+    public string? Note { get; init; }
+}
 
 /// <summary>The agent system prompts a tenant can override at runtime.</summary>
 public static class PromptCatalog
 {
-    /// <summary>Tunable prompts, in display order. Keys match the agents' ResolveAsync calls.</summary>
+    /// <summary>Tunable prompts, in display order (Board agents, then the Workflow pipeline). Keys match the agents'
+    /// ResolveAsync calls.</summary>
     public static IReadOnlyList<PromptEntry> All { get; } =
     [
-        new("Requirement", "Requirement Agent", RequirementPrompt.System),
-        new("Coding", "Coding Agent", CodingPrompt.System),
-        new("Testing", "Testing Agent", TestingPrompt.System),
-        new("Qa", "QA Agent", QaPrompt.System),
-        new("Decomposer", "Decomposer (idea → tickets)", DecomposerPrompt.System),
+        new(AgentRoles.Discovery, AgentRoles.Label(AgentRoles.Discovery) + " — New idea → tickets", DecomposerPrompt.System)
+        {
+            Group = AgentRoleGroup.Board,
+            Note = "Splits the idea's requirement into tickets. The requirement step itself uses the Requirement (Workflow pipeline) prompt.",
+        },
+        new(AgentRoles.IssueWork, AgentRoles.Label(AgentRoles.IssueWork) + " — on a member's computer", IssueWorkPrompt.CliTemplate)
+        {
+            Group = AgentRoleGroup.Board,
+            Placeholders = IssueWorkPrompt.Placeholders,
+            Note = "Used when the ticket runs on a paired computer (the Board default).",
+        },
+        new(IssueWorkPrompt.ServerPromptKey, AgentRoles.Label(AgentRoles.IssueWork) + " — on the server", IssueWorkPrompt.ServerTemplate)
+        {
+            Group = AgentRoleGroup.Board,
+            Placeholders = IssueWorkPrompt.Placeholders,
+            Note = "Used when the ticket's provider runs on the server and drives the runner through runner_shell.",
+        },
+        new(AgentRoles.Reviewer, AgentRoles.Label(AgentRoles.Reviewer), ReviewAgent.InstructionsTemplate)
+        {
+            Group = AgentRoleGroup.Board,
+            Placeholders = AcceptanceAgent.Placeholders,
+        },
+        new(AgentRoles.Acceptance, AgentRoles.Label(AgentRoles.Acceptance), AcceptanceAgent.InstructionsTemplate)
+        {
+            Group = AgentRoleGroup.Board,
+            Placeholders = AcceptanceAgent.Placeholders,
+        },
+        new(AgentRoles.AutopilotOrchestrator, AgentRoles.Label(AgentRoles.AutopilotOrchestrator), AutopilotOrchestratorAgent.Instructions)
+        {
+            Group = AgentRoleGroup.Board,
+        },
+        new(AgentRoles.Retrospective, AgentRoles.Label(AgentRoles.Retrospective), RetrospectiveAgent.Instructions)
+        {
+            Group = AgentRoleGroup.Board,
+        },
+        new(AgentRoles.Requirement, AgentRoles.Label(AgentRoles.Requirement), RequirementPrompt.System),
+        new(AgentRoles.Coding, AgentRoles.Label(AgentRoles.Coding), CodingPrompt.System),
+        new(AgentRoles.Testing, AgentRoles.Label(AgentRoles.Testing), TestingPrompt.System),
+        new(AgentRoles.Qa, AgentRoles.Label(AgentRoles.Qa), QaPrompt.System),
     ];
 }
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/PromptTemplate.cs b/src/AgentOs.Modules.Pipeline/Prompts/PromptTemplate.cs
new file mode 100644
index 00000000..f956fd1d
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Prompts/PromptTemplate.cs
@@ -0,0 +1,26 @@
+// Board agent prompts are per-run templates: the Reviewer's prompt names the repository and branch it checks out, the
+// ticket Coding agent's names the branch it pushes. So a tenant can override them in Settings → Prompts like any other
+// prompt, the template carries named placeholders ({owner}, {repo}, {branch}…) that are filled per run. One pass over
+// the template: a value that itself contains "{branch}" (a repository name, a ticket title) is never expanded again,
+// and an unknown {word} — or a JSON brace in the reply contract — is left exactly as written.
+
+using System;
+using System.Collections.Generic;
+using System.Text.RegularExpressions;
+
+namespace AgentOs.Modules.Pipeline.Prompts;
+
+/// <summary>Fills a prompt template's named placeholders.</summary>
+public static partial class PromptTemplate
+{
+    /// <summary><paramref name="template"/> with every known <c>{name}</c> replaced by its value (single pass).</summary>
+    public static string Fill(string template, IReadOnlyDictionary<string, string> values)
+    {
+        ArgumentNullException.ThrowIfNull(template);
+        ArgumentNullException.ThrowIfNull(values);
+        return Placeholder().Replace(template, m => values.TryGetValue(m.Groups[1].Value, out var v) ? v : m.Value);
+    }
+
+    [GeneratedRegex(@"\{([A-Za-z][A-Za-z0-9]*)\}")]
+    private static partial Regex Placeholder();
+}
diff --git a/src/AgentOs.Modules.Workspaces/WorkspaceBoardRepos.cs b/src/AgentOs.Modules.Workspaces/WorkspaceBoardRepos.cs
new file mode 100644
index 00000000..834eef27
--- /dev/null
+++ b/src/AgentOs.Modules.Workspaces/WorkspaceBoardRepos.cs
@@ -0,0 +1,22 @@
+// IBoardRepos over the workspace registry: a board's repositories as "owner/repo" keys (the key project memory uses).
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Workspaces;
+using AgentOs.Modules.Workspaces.Persistence;
+
+namespace AgentOs.Modules.Workspaces;
+
+internal sealed class WorkspaceBoardRepos(IWorkspaceRepository workspaces) : IBoardRepos
+{
+    public async Task<IReadOnlyList<string>> RepoKeysAsync(string tenantId, Guid boardId, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(tenantId)) { return []; }
+        var repos = await workspaces.ListReposForTenantAsync(tenantId, boardId, ct).ConfigureAwait(false);
+        return repos.Where(r => r.Owner.Length > 0 && r.Repo.Length > 0).Select(r => $"{r.Owner}/{r.Repo}")
+            .Distinct(StringComparer.OrdinalIgnoreCase).ToList();
+    }
+}
diff --git a/src/AgentOs.Modules.Workspaces/WorkspacesModule.cs b/src/AgentOs.Modules.Workspaces/WorkspacesModule.cs
index c43c360c..9d991aad 100644
--- a/src/AgentOs.Modules.Workspaces/WorkspacesModule.cs
+++ b/src/AgentOs.Modules.Workspaces/WorkspacesModule.cs
@@ -36,6 +36,8 @@ public void AddServices(IServiceCollection services, IConfiguration configuratio
 
         // The connect flow is shared by the HTTP endpoint and the desktop Board app (tenant-explicit).
         services.AddScoped<IWorkspaceConnector, WorkspaceConnector>();
+        // A board's repositories for agents that see the whole board (the Autopilot lead reads their practices).
+        services.AddScoped<AgentOs.Domain.Workspaces.IBoardRepos, WorkspaceBoardRepos>();
 
         var connectionString = configuration.GetConnectionString("DefaultConnection");
         if (!string.IsNullOrWhiteSpace(connectionString))
diff --git a/src/AgentOs.RemoteAgent/CliModel.cs b/src/AgentOs.RemoteAgent/CliModel.cs
new file mode 100644
index 00000000..793971e8
--- /dev/null
+++ b/src/AgentOs.RemoteAgent/CliModel.cs
@@ -0,0 +1,52 @@
+// The model an agent's profile picked (Settings → Agent profiles) reaches the CLI. The server sends it on every request;
+// the runner used to log it and run the CLI's own default model anyway. Claude Code takes `--model <id>`, Codex takes
+// `-m <id>`. No model, a model that CLI cannot serve (a GPT model for claude, a Claude model for codex), an unknown CLI,
+// or an operator's REMOTE_AGENT_ARGS that already names a model → no flag, the CLI's default applies.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+
+namespace AgentOs.RemoteAgent;
+
+/// <summary>Builds the model flag for a CLI agent.</summary>
+internal static partial class CliModel
+{
+    // Claude Code's model aliases (besides full claude-* ids).
+    private static readonly HashSet<string> ClaudeAliases = new(StringComparer.OrdinalIgnoreCase) { "opus", "sonnet", "haiku", "fable", "opusplan" };
+
+    /// <summary>The arguments that select <paramref name="model"/> on <paramref name="command"/> (empty = none).</summary>
+    /// <param name="command">The CLI command or path (<c>claude</c>, <c>C:\…\codex.cmd</c>).</param>
+    /// <param name="model">The model id the request carries (may be empty).</param>
+    /// <param name="existingArgs">The arguments already chosen; one that names a model wins.</param>
+    internal static string[] Flags(string command, string? model, IReadOnlyCollection<string> existingArgs)
+    {
+        ArgumentNullException.ThrowIfNull(existingArgs);
+        var id = (model ?? string.Empty).Trim();
+        if (id.Length == 0 || !SafeId().IsMatch(id)) { return []; }
+        if (existingArgs.Any(a => a is "--model" or "-m" || a.StartsWith("--model=", StringComparison.Ordinal))) { return []; }
+
+        var isClaudeModel = id.StartsWith("claude", StringComparison.OrdinalIgnoreCase) || ClaudeAliases.Contains(id);
+        return CommandName(command) switch
+        {
+            "claude" when isClaudeModel => ["--model", id],
+            "codex" when !isClaudeModel => ["-m", id],
+            _ => [],
+        };
+    }
+
+    /// <summary>The CLI's bare name: <c>C:\npm\claude.cmd</c> → <c>claude</c>.</summary>
+    internal static string CommandName(string command)
+    {
+        // Both separators on every OS: REMOTE_AGENT_CMD may hold a Windows path while the tests run on Linux.
+        var name = (command ?? string.Empty).Trim();
+        name = name[(name.LastIndexOfAny(['/', '\\']) + 1)..];
+        var dot = name.LastIndexOf('.');
+        return (dot > 0 ? name[..dot] : name).ToLowerInvariant();
+    }
+
+    // A model id, never something that could read as another flag or carry a separator.
+    [GeneratedRegex(@"^[A-Za-z0-9][A-Za-z0-9._:/\[\]-]{0,127}$")]
+    private static partial Regex SafeId();
+}
diff --git a/src/AgentOs.RemoteAgent/Program.cs b/src/AgentOs.RemoteAgent/Program.cs
index fc348e9e..8fe9c0dd 100644
--- a/src/AgentOs.RemoteAgent/Program.cs
+++ b/src/AgentOs.RemoteAgent/Program.cs
@@ -235,6 +235,9 @@ static async Task<RemoteExecResult> RunLlmAsync(RemoteExecRequest request, Func<
         : yolo ? [.. profile.DefaultArgs, .. profile.AutoArgs]
         : scoped ? [.. profile.DefaultArgs, .. AgentOs.RemoteAgent.ScopedAutonomy.ArgsFor(cmd)]
         : profile.DefaultArgs;
+    // The model the agent's profile picked (Settings → Agent profiles) — `--model` for claude, `-m` for codex (CliModel.cs).
+    var modelFlags = AgentOs.RemoteAgent.CliModel.Flags(cmd, request.Model, args);
+    args = [.. args, .. modelFlags];
     // Claude with the runner's own flags streams its events, so the Board can show what it is doing (CliProgress.cs).
     // A custom REMOTE_AGENT_ARGS keeps exactly what the operator asked for.
     var streaming = argsEnv is null && string.Equals(profile.Command, "claude", StringComparison.OrdinalIgnoreCase);
@@ -282,7 +285,7 @@ static async Task<RemoteExecResult> RunLlmAsync(RemoteExecRequest request, Func<
             psi.ArgumentList.Add(prompt);
         }
 
-        Console.WriteLine($"[agent] cli={cli} cmd={cmd} prompt={(profile.PromptViaStdin ? "stdin" : "arg")} autonomy={(argsEnv is not null ? "custom" : yolo ? "yolo" : scoped ? "scoped" : "prompt")} dir={runDir}");
+        Console.WriteLine($"[agent] cli={cli} cmd={cmd} prompt={(profile.PromptViaStdin ? "stdin" : "arg")} autonomy={(argsEnv is not null ? "custom" : yolo ? "yolo" : scoped ? "scoped" : "prompt")} model={(modelFlags.Length > 0 ? modelFlags[^1] : "cli default")} dir={runDir}");
 
         using var process = Process.Start(psi)
             ?? throw new InvalidOperationException($"Failed to start '{cmd}'. Is the {cli} CLI installed and on PATH?");
diff --git a/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor b/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
index 46ad87cc..b52b5784 100644
--- a/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
+++ b/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
@@ -33,9 +33,12 @@ else
         </Btn>
     </header>
 
-    <Panel Title="Agents">
+    @foreach (var group in Groups)
+    {
+    <Panel Title="@GroupTitle(group)">
+        <p class="muted agent-profiles-intro">@GroupIntro(group)</p>
         <div class="agent-profiles-scroll">
-        <table class="data-table agent-profiles">
+        <table class="data-table agent-profiles" aria-label="@GroupTitle(group)">
             <thead>
                 <tr>
                     <th>Agent</th>
@@ -50,20 +53,24 @@ else
                 </tr>
             </thead>
             <tbody>
-                @foreach (var row in _rows)
+                @foreach (var row in _rows.Where(r => r.Group == group))
                 {
                     var locked = row.IsLocked;
-                    <tr @key="row.Role">
+                    <tr @key="row.Role" data-role="@row.Role">
                         <td>
                             <span class="agent-profiles-who">
                                 <AgentMascot Role="@row.Role" Size="30" />
-                                <span class="agent-profiles-name"><strong>@row.Role</strong><Badge Variant="@SourceVariant(row.Source)">@SourceLabel(row.Source)</Badge></span>
+                                <span class="agent-profiles-name">
+                                    <strong title="@($"Role key: {row.Role}")">@row.Label</strong>
+                                    <span class="agent-profiles-desc">@row.Description</span>
+                                    <Badge Variant="@SourceVariant(row.Source)">@SourceLabel(row.Source)</Badge>
+                                </span>
                             </span>
                         </td>
                         @if (_advanced)
                         {
                         <td>
-                            <select class="prefs-select" disabled="@locked" aria-label="@($"{row.Role} provider")"
+                            <select class="prefs-select" disabled="@locked" aria-label="@($"{row.Label} provider")"
                                     value="@row.Provider" @onchange="e => row.Provider = e.Value?.ToString() ?? string.Empty">
                                 @foreach (var p in LlmProviders.Selectable)
                                 {
@@ -77,7 +84,7 @@ else
                         <td>
                             @* Simple view: every priced model, the provider inferred from the choice (ModelRouting). *@
                             <ModelPicker Value="@row.Model" ValueChanged="v => PickModel(row, v)" Provider="@(_advanced ? row.Provider : null)"
-                                         AriaLabel="@($"{row.Role} model")" Disabled="@locked" />
+                                         AriaLabel="@($"{row.Label} model")" Disabled="@locked" />
                             <div class="prefs-hint">@PriceHint(row.Model)@(_advanced ? "" : $" · via {(row.Provider == "Anthropic" ? "Claude" : row.Provider)}")</div>
                         </td>
                         @if (_advanced)
@@ -86,7 +93,7 @@ else
                             @if (ModelCapabilities.AcceptsSamplingParameters(row.Model))
                             {
                                 <input class="prefs-input agent-profiles-num" type="number" min="0" max="2" step="0.1"
-                                       disabled="@locked" aria-label="@($"{row.Role} temperature")"
+                                       disabled="@locked" aria-label="@($"{row.Label} temperature")"
                                        value="@row.Temperature" @onchange="e => row.Temperature = e.Value?.ToString() ?? string.Empty" />
                             }
                             else
@@ -96,7 +103,7 @@ else
                         </td>
                         <td>
                             <input class="prefs-input agent-profiles-num" type="number" min="1" max="@AgentSettings.MaxOutputTokensCeiling" step="256"
-                                   disabled="@locked" aria-label="@($"{row.Role} max output tokens")"
+                                   disabled="@locked" aria-label="@($"{row.Label} max output tokens")"
                                    value="@row.MaxTokens" @onchange="e => row.MaxTokens = e.Value?.ToString() ?? string.Empty" />
                         </td>
                         }
@@ -112,8 +119,9 @@ else
         </table>
         </div>
     </Panel>
+    }
 
-    <Panel Title="Pipeline">
+    <Panel Title="Workflow pipeline · QA loop">
         <Field Label="QA loop · max iterations" Hint="How many Coding → Testing → QA rounds before a run stops (1–10).">
             <input class="prefs-input agent-profiles-num" type="number" min="1" max="10" step="1"
                    disabled="@(_iterationsSource == SettingSource.Locked)" aria-label="QA loop max iterations"
@@ -152,9 +160,24 @@ else
     private string _iterations = string.Empty;
     private SettingSource _iterationsSource;
 
-    private sealed class RoleRow(string role)
+    // One agent registry: the Board agents first, then the legacy 5-agent Workflow pipeline — separate tables, so
+    // nobody edits "Coding (Workflow pipeline)" expecting the ticket agent to change.
+    private static readonly AgentRoleGroup[] Groups = [AgentRoleGroup.Board, AgentRoleGroup.WorkflowPipeline];
+
+    private static string GroupTitle(AgentRoleGroup group) => group == AgentRoleGroup.Board
+        ? "Board agents"
+        : "Workflow pipeline agents";
+
+    private static string GroupIntro(AgentRoleGroup group) => group == AgentRoleGroup.Board
+        ? "The agents behind tickets, reviews, testing, Autopilot and New idea. Coding, Reviewer and Testing (tickets) need a paired computer for the checkout; on RemoteAgent they cost 0 server tokens, any other provider passes your budget cap."
+        : "The 5-agent pipeline of the Run and Workflow apps (and the Board's Thorough engine). These rows do not change the Board agents above.";
+
+    private sealed class RoleRow(AgentRoleInfo info)
     {
-        public string Role { get; } = role;
+        public string Role { get; } = info.Key;
+        public string Label { get; } = info.Label;
+        public string Description { get; } = info.Description;
+        public AgentRoleGroup Group { get; } = info.Group;
         public string Provider { get; set; } = string.Empty;
         public string Model { get; set; } = string.Empty;
         public string Temperature { get; set; } = string.Empty;
@@ -184,7 +207,7 @@ else
         var rows = new List<RoleRow>(AgentSettings.Roles.Count);
         foreach (var (role, _) in AgentSettings.Roles)
         {
-            var row = new RoleRow(role);
+            var row = new RoleRow(AgentRoles.Find(role) ?? new AgentRoleInfo(role, role, AgentRoleGroup.WorkflowPipeline, string.Empty));
             var present = RoleFields
                 .Select(field => (Field: field, View: byKey.GetValueOrDefault(AgentSettings.Key(role, field))))
                 .Where(p => p.View is not null);
@@ -236,7 +259,7 @@ else
                 }
                 count++;
             }
-            Toasts.Show("Agent profiles", count == 0 ? $"{role}: nothing changed." : $"{role} saved — applies to the next call.", AgentOs.Web.Shell.Services.ToastKind.Ok);
+            Toasts.Show("Agent profiles", count == 0 ? $"{AgentRoles.Label(role)}: nothing changed." : $"{AgentRoles.Label(role)} saved — applies to the next call.", AgentOs.Web.Shell.Services.ToastKind.Ok);
         }
         finally
         {
diff --git a/src/AgentOs.Web/Components/Pages/BoardApp.razor b/src/AgentOs.Web/Components/Pages/BoardApp.razor
index 0aa3acc3..722deaa9 100644
--- a/src/AgentOs.Web/Components/Pages/BoardApp.razor
+++ b/src/AgentOs.Web/Components/Pages/BoardApp.razor
@@ -1577,8 +1577,8 @@ else if (_tab == Tab.Sessions)
                     finally
                     {
                         var idea = _ideaText.Trim().ReplaceLineEndings(" ");
-                        await TaskService.SaveAgentRunAsync(_tenantId, _userId, "Discovery",
-                            "Discovery · " + (idea.Length > 120 ? idea[..120] + "…" : idea), started, calls.Calls);
+                        await TaskService.SaveAgentRunAsync(_tenantId, _userId, AgentOs.Modules.Pipeline.Agents.AgentRoles.Discovery,
+                            AgentOs.Modules.Pipeline.Agents.AgentRoles.Label(AgentOs.Modules.Pipeline.Agents.AgentRoles.Discovery) + " · " +(idea.Length > 120 ? idea[..120] + "…" : idea), started, calls.Calls);
                     }
                 }
 
diff --git a/src/AgentOs.Web/Components/Pages/InsightsApp.razor b/src/AgentOs.Web/Components/Pages/InsightsApp.razor
index d7fe5e2f..142f41b0 100644
--- a/src/AgentOs.Web/Components/Pages/InsightsApp.razor
+++ b/src/AgentOs.Web/Components/Pages/InsightsApp.razor
@@ -189,7 +189,7 @@ else
                     @foreach (var a in agents)
                     {
                         <div class="ins-bar-row">
-                            <div class="ins-bar-label ins-bar-agent"><AgentMascot Role="@AgentShort(a.Key)" Size="22" /><span>@AgentShort(a.Key)</span></div>
+                            <div class="ins-bar-label ins-bar-agent" title="@a.Key"><AgentMascot Role="@a.Key" Size="22" /><span>@AgentOs.Modules.Pipeline.Agents.AgentRoles.Label(a.Key)</span></div>
                             <div class="ins-bar-track" title="@($"{Num(a.TokensIn)} in · {Num(a.TokensOut)} out")"><div class="ins-bar-fill" style="width:@(Pct(a.TokensIn + a.TokensOut, maxAgent))%"></div></div>
                             <div class="ins-bar-val" title="@($"{Num(a.TokensIn)} input (of which {Num((int)a.CacheReadTokens)} cache read, {Num((int)a.CacheWriteTokens)} cache write) · {Num(a.TokensOut)} output")">@Num(a.TokensIn + a.TokensOut) tok · @Num(a.Calls) calls · @Money(a.CostUsd)</div>
                         </div>
@@ -246,7 +246,7 @@ else
                     @foreach (var l in lat)
                     {
                         <div class="ins-bar-row">
-                            <div class="ins-bar-label ins-bar-agent"><AgentMascot Role="@AgentShort(l.Agent)" Size="22" /><span>@AgentShort(l.Agent)</span></div>
+                            <div class="ins-bar-label ins-bar-agent" title="@l.Agent"><AgentMascot Role="@l.Agent" Size="22" /><span>@AgentOs.Modules.Pipeline.Agents.AgentRoles.Label(l.Agent)</span></div>
                             <div class="ins-bar-track"><div class="ins-bar-fill alt" style="width:@(Pct((decimal)l.AvgLatencyMs, (decimal)maxLat))%"></div></div>
                             <div class="ins-bar-val">@Ms(l.AvgLatencyMs)</div>
                         </div>
@@ -446,8 +446,10 @@ else
         : hours < 48 ? $"{hours.ToString("0.0", CultureInfo.InvariantCulture)} h"
         : $"{(hours / 24).ToString("0.0", CultureInfo.InvariantCulture)} days";
 
-    private static string AgentShort(string agent) => agent
-        .Replace("Agent", "", StringComparison.Ordinal).Trim() is { Length: > 0 } s ? s : agent;
+    // One agent registry (AgentRoles): every stored name maps to its role key — the pipeline files calls as "CodingAgent",
+    // older Board rows as "Decomposer" — and the key's label is the name Agent profiles shows. Board agents keep their own
+    // keys ("IssueWork", "Acceptance"…), so they are never merged into the Workflow pipeline's roles.
+    private static string AgentShort(string agent) => AgentOs.Modules.Pipeline.Agents.AgentRoles.Canonical(agent) is { Length: > 0 } s ? s : agent;
 
     // Weighted average across the role's names (calls × average latency).
     internal static IEnumerable<AgentOs.Modules.Pipeline.Persistence.AgentLatencyBucket> LatencyByRole(IEnumerable<AgentOs.Modules.Pipeline.Persistence.AgentLatencyBucket> buckets) =>
@@ -456,7 +458,7 @@ else
                 g.Sum(b => b.Calls) == 0 ? 0 : g.Sum(b => b.AvgLatencyMs * b.Calls) / g.Sum(b => b.Calls), g.Sum(b => b.Calls)))
             .OrderByDescending(b => b.AvgLatencyMs);
 
-    // One row per role: the 5-agent pipeline files calls as "CodingAgent", the Board's agents as "Coding" — the same role.
+    // One row per role key (see AgentShort).
     internal static IEnumerable<AgentOs.Modules.Pipeline.Persistence.CostBucket> ByRole(IEnumerable<AgentOs.Modules.Pipeline.Persistence.CostBucket> buckets) =>
         buckets.GroupBy(b => AgentShort(b.Key), StringComparer.OrdinalIgnoreCase)
             .Select(g => new AgentOs.Modules.Pipeline.Persistence.CostBucket(g.Key, g.Sum(b => b.CostUsd), g.Sum(b => b.TokensIn),
diff --git a/src/AgentOs.Web/Components/Pages/KnowledgeTab.razor b/src/AgentOs.Web/Components/Pages/KnowledgeTab.razor
index 577a7597..f7276e77 100644
--- a/src/AgentOs.Web/Components/Pages/KnowledgeTab.razor
+++ b/src/AgentOs.Web/Components/Pages/KnowledgeTab.razor
@@ -69,7 +69,7 @@ else
         }
         else
         {
-            <p class="muted">Every agent reads these before it works on this project — distilled from the lessons by the Retrospective agent. Pin one to keep it word for word.</p>
+            <p class="muted">Every agent that works on this project reads these first — Coding, Reviewer and Testing (tickets) and the Autopilot lead. The Retrospective agent distils them from the lessons. Pin one to keep it word for word.</p>
             <table class="data-table">
                 <thead><tr><th>Practice</th><th>Since</th><th class="actions">Actions</th></tr></thead>
                 <tbody>
diff --git a/src/AgentOs.Web/Components/Pages/PromptsApp.razor b/src/AgentOs.Web/Components/Pages/PromptsApp.razor
index 164a988f..59a8960f 100644
--- a/src/AgentOs.Web/Components/Pages/PromptsApp.razor
+++ b/src/AgentOs.Web/Components/Pages/PromptsApp.razor
@@ -1,12 +1,14 @@
 @* PromptsApp — admin: shape how this tenant's agents work.
-   • Workspace rules — one block of engineering rules applied to EVERY agent of every run (pipeline agents,
-     Quick engine, Decomposer), after the agent's own prompt and before the repo's AGENTS.md / CLAUDE.md.
-   • Per-agent system prompts — override the built-in prompt; Reset reverts to it.
+   • Workspace rules — one block of engineering rules applied to EVERY agent of every run (the Board agents and the
+     Workflow pipeline), after the agent's own prompt and before the repo's AGENTS.md / CLAUDE.md.
+   • Per-agent system prompts — override the built-in prompt; Reset reverts to it. Grouped like Agent profiles (Board
+     agents, then the Workflow pipeline); Board prompts are templates whose {placeholders} are filled per run.
    Every save is versioned (who, when, what — last 20) with one-click Restore, and lands in the audit trail.
    Tenant read from AuthenticationState (a circuit has no HttpContext) → tenant-explicit IPromptOverrideService. *@
 
 @using Microsoft.AspNetCore.Components.Authorization
 @using AgentOs.Modules.Pipeline.Prompts
+@using AgentOs.Modules.Pipeline.Agents
 @inject IPromptOverrideService Prompts
 @inject AgentOs.Web.Shell.Services.ToastService Toasts
 
@@ -30,7 +32,7 @@ else
     <Panel Title="Workspace rules — every agent follows these">
         <p class="muted prompt-hint">
             Your engineering rules: libraries, style, structure, what never to touch. Added to every agent's prompt
-            (pipeline, Quick engine, Decomposer), before the target repo's own <code>AGENTS.md</code> / <code>CLAUDE.md</code>.
+            (the Board agents and the Workflow pipeline), before the target repo's own <code>AGENTS.md</code> / <code>CLAUDE.md</code>.
             They shape choices — they never change an agent's role or output format.
         </p>
         <textarea class="prefs-input prompt-text" rows="6" aria-label="Workspace rules"
@@ -43,7 +45,15 @@ else
         <PromptHistoryList Versions="@HistoryFor(WorkspaceRules.Key)" OnRestore="v => RestoreRules(v)" />
     </Panel>
 
-    @foreach (var entry in PromptCatalog.All)
+    @foreach (var group in Groups)
+    {
+        <div class="prefs-section">
+            <h2 class="prefs-h">@(group == AgentRoleGroup.Board ? "Board agents" : "Workflow pipeline agents")</h2>
+            <p class="prefs-sub">@(group == AgentRoleGroup.Board
+                ? "Tickets, reviews, testing, Autopilot, retrospectives and New idea — the same agents as in Agent profiles and Insights."
+                : "The 5-agent pipeline of the Run and Workflow apps. These prompts do not change the Board agents.")</p>
+        </div>
+    @foreach (var entry in PromptCatalog.All.Where(e => e.Group == group))
     {
         <Panel Title="@entry.DisplayName">
             <div class="prompt-status">
@@ -51,6 +61,21 @@ else
                     @(_overridden.Contains(entry.Key) ? "Overridden" : "Default")
                 </Badge>
             </div>
+            @if (entry.Note is { } note)
+            {
+                <p class="muted prompt-hint">@note</p>
+            }
+            @if (entry.Placeholders.Count > 0)
+            {
+                <p class="muted prompt-hint">
+                    Filled in on every run:
+                    @foreach (var p in entry.Placeholders)
+                    {
+                        <code>@("{" + p + "}")</code>@(" ")
+                    }
+                    — keep the ones the agent needs (the branch it checks out, the reply format).
+                </p>
+            }
             <textarea class="prefs-input prompt-text" rows="8" aria-label="@($"{entry.DisplayName} system prompt")"
                       value="@CurrentText(entry)"
                       @onchange="e => _text[entry.Key] = e.Value?.ToString() ?? string.Empty"></textarea>
@@ -61,11 +86,15 @@ else
             <PromptHistoryList Versions="@HistoryFor(entry.Key)" OnRestore="v => Restore(entry, v)" />
         </Panel>
     }
+    }
 }
 
 @code {
     [CascadingParameter] private Task<AuthenticationState>? AuthState { get; set; }
 
+    // Board agents first, then the legacy Workflow pipeline (the same split as Agent profiles).
+    private static readonly AgentRoleGroup[] Groups = [AgentRoleGroup.Board, AgentRoleGroup.WorkflowPipeline];
+
     private bool _resolved;
     private bool _isAdmin;
     private bool _saving;
diff --git a/src/AgentOs.Web/Components/UI/AgentMascot.razor b/src/AgentOs.Web/Components/UI/AgentMascot.razor
index d50e44e7..2f133c6b 100644
--- a/src/AgentOs.Web/Components/UI/AgentMascot.razor
+++ b/src/AgentOs.Web/Components/UI/AgentMascot.razor
@@ -151,13 +151,14 @@
     /// <summary>Rendered size in CSS pixels.</summary>
     [Parameter] public int Size { get; set; } = 40;
 
+    // The Board agents (AgentRoles keys) wear the character of the pipeline role they mirror.
     private string RoleClass => Role?.Trim().ToUpperInvariant() switch
     {
-        "ORCHESTRATOR" or "DECOMPOSER" => "orchestrator",
-        "REQUIREMENT" => "requirement",
+        "ORCHESTRATOR" or "DECOMPOSER" or "AUTOPILOTORCHESTRATOR" => "orchestrator",
+        "REQUIREMENT" or "DISCOVERY" => "requirement",
         "CODING" or "ISSUEWORK" => "coding",
-        "TESTING" => "testing",
-        "QA" => "qa",
+        "TESTING" or "ACCEPTANCE" => "testing",
+        "QA" or "REVIEWER" => "qa",
         _ => "generic",
     };
 
diff --git a/src/AgentOs.Web/Services/BoardTasks/BoardTaskService.cs b/src/AgentOs.Web/Services/BoardTasks/BoardTaskService.cs
index 63a44d7e..83bf2bf8 100644
--- a/src/AgentOs.Web/Services/BoardTasks/BoardTaskService.cs
+++ b/src/AgentOs.Web/Services/BoardTasks/BoardTaskService.cs
@@ -163,7 +163,7 @@ public async Task<TaskRun> BeginStartAsync(string tenantId, Guid sessionId, stri
         // The Thorough engine stores its own pipeline run + metrics; every other run is recorded here for Insights.
         var completion = Task.Run(() => EngineSelection.IsQuality(session.Brain)
             ? RunAsync(tenantId, session, board, pat, children, cliProfile, change, stopLease)
-            : RecordedAsync(tenantId, session, "Coding", () => RunAsync(tenantId, session, board, pat, children, cliProfile, change, stopLease)),
+            : RecordedAsync(tenantId, session, AgentOs.Modules.Pipeline.Agents.AgentRoles.IssueWork, () => RunAsync(tenantId, session, board, pat, children, cliProfile, change, stopLease)),
             CancellationToken.None);
         return new TaskRun(TaskStart.Started, completion);
     }
@@ -200,7 +200,7 @@ public async Task<TaskRun> BeginTestAsync(string tenantId, Guid sessionId, strin
             await sessions.UpdateRepoRunResultAsync(tenantId, c.Id, "Testing", c.BranchName, c.PrUrl, null, ct).ConfigureAwait(false);
         }
         var stopLease = stops.Begin(tenantId, session.Id);
-        var completion = Task.Run(() => RecordedAsync(tenantId, session, "Testing", () => TestChangesAsync(tenantId, session, board, pat, changes, cliProfile, stopLease)),
+        var completion = Task.Run(() => RecordedAsync(tenantId, session, AgentOs.Modules.Pipeline.Agents.AgentRoles.Acceptance, () => TestChangesAsync(tenantId, session, board, pat, changes, cliProfile, stopLease)),
             CancellationToken.None);
         return new TaskRun(TaskStart.Started, completion);
     }
@@ -238,7 +238,7 @@ public async Task<TaskRun> BeginReviewAsync(string tenantId, Guid sessionId, str
             await sessions.UpdateRepoRunResultAsync(tenantId, c.Id, "Reviewing", c.BranchName, c.PrUrl, null, ct).ConfigureAwait(false);
         }
         var stopLease = stops.Begin(tenantId, session.Id);
-        var completion = Task.Run(() => RecordedAsync(tenantId, session, "Reviewer", () => ReviewChangesAsync(tenantId, session, board, pat, changes, cliProfile, stopLease)),
+        var completion = Task.Run(() => RecordedAsync(tenantId, session, AgentOs.Modules.Pipeline.Agents.AgentRoles.Reviewer, () => ReviewChangesAsync(tenantId, session, board, pat, changes, cliProfile, stopLease)),
             CancellationToken.None);
         return new TaskRun(TaskStart.Started, completion);
     }
@@ -427,7 +427,8 @@ internal async Task RecordedAsync(string tenantId, RemoteSessionEntity session,
         }
         finally
         {
-            await SaveAgentRunAsync(tenantId, session.MemberUserId, agent, $"{agent} · #{session.IssueNumber} {session.Title}", started, calls.Calls)
+            await SaveAgentRunAsync(tenantId, session.MemberUserId, agent,
+                    $"{AgentOs.Modules.Pipeline.Agents.AgentRoles.Label(agent)} · #{session.IssueNumber} {session.Title}", started, calls.Calls)
                 .ConfigureAwait(false);
         }
     }
diff --git a/src/AgentOs.Web/Services/Orchestration/RetrospectiveService.cs b/src/AgentOs.Web/Services/Orchestration/RetrospectiveService.cs
index 18cbdc6d..3a1a8da6 100644
--- a/src/AgentOs.Web/Services/Orchestration/RetrospectiveService.cs
+++ b/src/AgentOs.Web/Services/Orchestration/RetrospectiveService.cs
@@ -59,7 +59,8 @@ public async Task<RetrospectiveOutcome> RunAsync(string tenantId, string memberI
             using (var calls = AgentOs.Domain.Llm.LlmCallScope.Begin())
             {
                 result = await scope.ServiceProvider.GetRequiredService<IRetrospectiveAgent>().RunAsync(input, ct).ConfigureAwait(false);
-                await tasks.SaveAgentRunAsync(tenantId, memberId, "Retrospective", $"Retrospective · {repoKey}", started, calls.Calls).ConfigureAwait(false);
+                await tasks.SaveAgentRunAsync(tenantId, memberId, AgentRoles.Retrospective, $"{AgentRoles.Label(AgentRoles.Retrospective)} · {repoKey}",
+                    started, calls.Calls).ConfigureAwait(false);
             }
             if (!result.Ran) { return RetrospectiveOutcome.None; }
 
diff --git a/src/AgentOs.Web/wwwroot/app.css b/src/AgentOs.Web/wwwroot/app.css
index ac07113e..7e364d5a 100644
--- a/src/AgentOs.Web/wwwroot/app.css
+++ b/src/AgentOs.Web/wwwroot/app.css
@@ -2309,6 +2309,10 @@ input[type=range] { accent-color: var(--accent); }
 .settings-field-control .prefs-input[type="number"] { width: 8rem; }
 .model-picker { display: inline-flex; align-items: center; gap: var(--space-2); min-width: 0; }
 .agent-profiles-who { display: inline-flex; align-items: center; gap: var(--space-2); white-space: nowrap; }
+/* What the agent does, under its name: wraps so a long sentence never widens the column. */
+.agent-profiles-desc { white-space: normal; max-width: 20rem; color: var(--text-tertiary); font-size: var(--fs-xs); }
+/* The group intro above each table (Board agents / Workflow pipeline). */
+.agent-profiles-intro { margin: 0 0 var(--space-3); }
 .agent-profiles-actions { display: flex; gap: var(--space-2); justify-content: flex-end; white-space: nowrap; }
 
 .prefs-list { padding-left: 18px; margin: 4px 0; font-size: 12.5px; color: var(--txt-soft); }
diff --git a/tests/AgentOs.E2E.Tests/AgentOsUi/AgentProfilesTests.cs b/tests/AgentOs.E2E.Tests/AgentOsUi/AgentProfilesTests.cs
index 8bfa949a..400df804 100644
--- a/tests/AgentOs.E2E.Tests/AgentOsUi/AgentProfilesTests.cs
+++ b/tests/AgentOs.E2E.Tests/AgentOsUi/AgentProfilesTests.cs
@@ -22,15 +22,21 @@ public static async Task<ILocator> OpenAsync(IPage page)
         var win = page.Locator(".appwin.focused");
         await Assertions.Expect(win.Locator(".appwin-title")).ToHaveTextAsync("Settings");
         await win.Locator(".prefs-cat", new() { HasTextString = "Agent profiles" }).ClickAsync();
-        await Assertions.Expect(win.Locator(".agent-profiles")).ToBeVisibleAsync();
+        // Two tables: the Board agents, then the Workflow pipeline agents.
+        await Assertions.Expect(win.Locator("table.agent-profiles")).ToHaveCountAsync(2);
+        await Assertions.Expect(win.Locator("table.agent-profiles[aria-label=\"Board agents\"] tbody tr[data-role=\"Reviewer\"]")).ToBeVisibleAsync();
         return win;
     }
 
+    // The QA agent of the Workflow pipeline, found by its stable role key.
+    private const string QaRow = ".agent-profiles tbody tr[data-role=\"Qa\"]";
+    private const string QaModel = "select[aria-label=\"QA (Workflow pipeline) model\"]";
+
     public static async Task RunAsync(IPage page, System.Func<Task> reopenDesktop)
     {
         var win = await OpenAsync(page);
-        var qaRow = win.Locator(".agent-profiles tbody tr", new() { HasTextString = "Qa" }).First;
-        var model = qaRow.Locator("select[aria-label=\"Qa model\"]");
+        var qaRow = win.Locator(QaRow);
+        var model = qaRow.Locator(QaModel);
 
         await model.SelectOptionAsync(NewModel);   // a real dropdown (ModelPicker), not a filtered datalist
         await qaRow.GetByRole(AriaRole.Button, new() { Name = "Save" }).ClickAsync();
@@ -48,12 +54,12 @@ public static async Task RunAsync(IPage page, System.Func<Task> reopenDesktop)
         await page.ReloadAsync();
         await reopenDesktop();
         win = await OpenAsync(page);
-        qaRow = win.Locator(".agent-profiles tbody tr", new() { HasTextString = "Qa" }).First;
-        await Assertions.Expect(qaRow.Locator("select[aria-label=\"Qa model\"]")).ToHaveValueAsync(NewModel);
+        qaRow = win.Locator(QaRow);
+        await Assertions.Expect(qaRow.Locator(QaModel)).ToHaveValueAsync(NewModel);
 
         // Reset returns to the inherited value and clears the tenant badge (also leaves the env clean).
         await qaRow.GetByRole(AriaRole.Button, new() { Name = "Reset" }).ClickAsync();
-        await Assertions.Expect(qaRow.Locator("select[aria-label=\"Qa model\"]")).Not.ToHaveValueAsync(NewModel);
+        await Assertions.Expect(qaRow.Locator(QaModel)).Not.ToHaveValueAsync(NewModel);
         await Assertions.Expect(qaRow).Not.ToContainTextAsync("This tenant");
     }
 }
diff --git a/tests/AgentOs.Tests/AgentOs.Tests.csproj b/tests/AgentOs.Tests/AgentOs.Tests.csproj
index 010ee0ee..440e8891 100644
--- a/tests/AgentOs.Tests/AgentOs.Tests.csproj
+++ b/tests/AgentOs.Tests/AgentOs.Tests.csproj
@@ -39,6 +39,7 @@
     <PackageReference Include="xunit.runner.visualstudio" />
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="Shouldly" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
     <!-- MTP reporting/coverage extensions (xunit.v3 4.0.0 runs on Microsoft.Testing.Platform).
          Every test project in a solution-wide run must understand the coverage / trx-report args,
@@ -57,6 +58,7 @@
     <Compile Include="..\..\src\AgentOs.RemoteAgent\PreviewHost.cs" Link="Linked\PreviewHost.cs" />
     <Compile Include="..\..\src\AgentOs.RemoteAgent\ProcessJob.cs" Link="Linked\ProcessJob.cs" />
     <Compile Include="..\..\src\AgentOs.RemoteAgent\KeepAwake.cs" Link="Linked\KeepAwake.cs" />
+    <Compile Include="..\..\src\AgentOs.RemoteAgent\CliModel.cs" Link="Linked\CliModel.cs" />
   </ItemGroup>
 
 </Project>
diff --git a/tests/AgentOs.Tests/Agents/AgentRegistryGuardTests.cs b/tests/AgentOs.Tests/Agents/AgentRegistryGuardTests.cs
new file mode 100644
index 00000000..69cc0e96
--- /dev/null
+++ b/tests/AgentOs.Tests/Agents/AgentRegistryGuardTests.cs
@@ -0,0 +1,121 @@
+// One agent registry — the guard. Four Board agents once called factory.Create("RemoteAgent") with Model:
+// "claude-sonnet-4-6" while Settings → Agent profiles showed rows that did nothing. Every agent under
+// Modules.Pipeline/Agents and /Decomposition must take its provider and model from its profile, so this test parses
+// those sources with Roslyn (syntax only — robust to formatting, comments and named vs positional arguments) and fails
+// on a string literal, an interpolated string or a same-file string constant passed as the provider to
+// ILlmClientFactory.Create or as the Model of an LlmRequest.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Shouldly;
+using Xunit;
+
+namespace AgentOs.Tests.Agents;
+
+public sealed class AgentRegistryGuardTests
+{
+    private static readonly string[] AgentFolders =
+    [
+        Path.Join("src", "AgentOs.Modules.Pipeline", "Agents"),
+        Path.Join("src", "AgentOs.Modules.Pipeline", "Decomposition"),
+    ];
+
+    [Fact]
+    public void Agents_NeverHardCodeTheirProviderOrModel()
+    {
+        var files = AgentFolders.SelectMany(f => Directory.EnumerateFiles(Path.Join(RepoRoot(), f), "*.cs", SearchOption.AllDirectories)).ToList();
+        files.Count.ShouldBeGreaterThan(5);   // the scan really looked at the agents
+
+        var violations = files.SelectMany(f => Violations(File.ReadAllText(f)).Select(v => $"{Path.GetFileName(f)}: {v}")).ToList();
+
+        violations.ShouldBeEmpty(
+            "Resolve the provider and model from the agent's profile (BoardAgent.ProfileAsync / IAgentProfiles) instead:\n"
+            + string.Join("\n", violations));
+    }
+
+    [Theory]
+    [InlineData("""class A { void M(ILlmClientFactory f) { f.Create("RemoteAgent"); } }""")]
+    [InlineData("""class A { void M(ILlmClientFactory f) { var c = f.Create($"Remote{1}"); } }""")]
+    [InlineData("""class A { const string P = "Claude"; void M(ILlmClientFactory f) { _ = f.Create(P); } }""")]
+    [InlineData("""class A { void M() { var r = new LlmRequest("s", "u", "claude-sonnet-4-6"); } }""")]
+    [InlineData("""class A { void M() { var r = new LlmRequest(SystemPrompt: "s", UserPrompt: "u", Model: "gpt-5"); } }""")]
+    [InlineData("""class A { void M() { var r = new LlmRequest(UserPrompt: "u", Model: "gpt-5", SystemPrompt: "s"); } }""")]
+    [InlineData("""class A { const string M2 = "x"; void M() { LlmRequest r = new("s", "u", M2); } }""")]
+    public void Scanner_FlagsEveryHardCodedForm(string source) => Violations(source).ShouldNotBeEmpty();
+
+    [Theory]
+    [InlineData("""class A { void M(ILlmClientFactory f, AgentOptions p) { f.Create(p.Provider); } }""")]
+    [InlineData("""class A { void M(AgentOptions p) { var r = new LlmRequest("s", "u", p.Model, p.Temperature, p.MaxTokens); } }""")]
+    [InlineData("""class A { void M(AgentOptions p) { var r = new LlmRequest(SystemPrompt: "s", UserPrompt: "u", Model: p.Model); } }""")]
+    public void Scanner_AcceptsProfileValues(string source) => Violations(source).ShouldBeEmpty();
+
+    // Syntax-only scan of one file.
+    internal static IEnumerable<string> Violations(string source)
+    {
+        var root = CSharpSyntaxTree.ParseText(source).GetCompilationUnitRoot();
+        var constants = root.DescendantNodes().OfType<FieldDeclarationSyntax>()
+            .Where(f => f.Modifiers.Any(SyntaxKind.ConstKeyword))
+            .SelectMany(f => f.Declaration.Variables.Select(v => v.Identifier.ValueText))
+            .Concat(root.DescendantNodes().OfType<LocalDeclarationStatementSyntax>()
+                .Where(l => l.IsConst).SelectMany(l => l.Declaration.Variables.Select(v => v.Identifier.ValueText)))
+            .ToHashSet(StringComparer.Ordinal);
+
+        bool HardCoded(ExpressionSyntax e) => e switch
+        {
+            LiteralExpressionSyntax lit => lit.IsKind(SyntaxKind.StringLiteralExpression),
+            InterpolatedStringExpressionSyntax => true,
+            IdentifierNameSyntax id => constants.Contains(id.Identifier.ValueText),
+            ParenthesizedExpressionSyntax p => HardCoded(p.Expression),
+            BinaryExpressionSyntax b when b.IsKind(SyntaxKind.AddExpression) => HardCoded(b.Left) && HardCoded(b.Right),
+            _ => false,
+        };
+
+        foreach (var call in root.DescendantNodes().OfType<InvocationExpressionSyntax>())
+        {
+            if (call.Expression is MemberAccessExpressionSyntax { Name.Identifier.ValueText: "Create" }
+                && call.ArgumentList.Arguments is [var provider, ..]
+                && provider.NameColon is null or { Name.Identifier.ValueText: "providerName" }
+                && HardCoded(provider.Expression))
+            {
+                yield return $"line {Line(call)}: ILlmClientFactory.Create({provider.Expression})";
+            }
+        }
+
+        foreach (var creation in root.DescendantNodes().OfType<BaseObjectCreationExpressionSyntax>())
+        {
+            var isRequest = creation switch
+            {
+                ObjectCreationExpressionSyntax o => o.Type.ToString() is "LlmRequest" or "AgentOs.Domain.Llm.LlmRequest",
+                ImplicitObjectCreationExpressionSyntax i => i.Parent?.Parent?.Parent is VariableDeclarationSyntax { Type: var t }
+                    && t.ToString() is "LlmRequest" or "AgentOs.Domain.Llm.LlmRequest",
+                _ => false,
+            };
+            if (!isRequest || creation.ArgumentList is not { } args) { continue; }
+            var model = args.Arguments.FirstOrDefault(a => a.NameColon?.Name.Identifier.ValueText == "Model")
+                ?? (args.Arguments.Count > 2 && args.Arguments.Take(3).All(a => a.NameColon is null) ? args.Arguments[2] : null);
+            if (model is not null && HardCoded(model.Expression))
+            {
+                yield return $"line {Line(creation)}: LlmRequest Model = {model.Expression}";
+            }
+        }
+    }
+
+    private static int Line(SyntaxNode node) => node.GetLocation().GetLineSpan().StartLinePosition.Line + 1;
+
+    private static string RepoRoot()
+    {
+        for (var dir = new DirectoryInfo(AppContext.BaseDirectory); dir is not null; dir = dir.Parent)
+        {
+            if (File.Exists(Path.Join(dir.FullName, "AgentOs.slnx")))
+            {
+                return dir.FullName;
+            }
+        }
+        throw new DirectoryNotFoundException("AgentOs.slnx not found above the test output directory.");
+    }
+}
diff --git a/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs b/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs
new file mode 100644
index 00000000..7a86b1af
--- /dev/null
+++ b/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs
@@ -0,0 +1,404 @@
+// One agent registry: every Board agent (Coding / Reviewer / Testing (tickets), the Autopilot lead, Retrospective,
+// Discovery) is configured from Settings → Agent profiles and Settings → Prompts like the pipeline agents, files its
+// calls under its role key (what Insights groups by), reads the project's practices and passes the budget gate —
+// decided from the EFFECTIVE provider, so a forced server provider never slips past it.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Configuration;
+using AgentOs.Domain.Cost;
+using AgentOs.Domain.Llm;
+using AgentOs.Domain.Memory;
+using AgentOs.Domain.Pipeline;
+using AgentOs.Domain.Requirements;
+using AgentOs.Domain.Sessions;
+using AgentOs.Domain.Workspaces;
+using AgentOs.Modules.AppConfig;
+using AgentOs.Modules.AppConfig.Settings;
+using AgentOs.Modules.Llm;
+using AgentOs.Modules.Pipeline.Agents;
+using AgentOs.Modules.Pipeline.Decomposition;
+using AgentOs.Modules.Pipeline.Prompts;
+using AgentOs.SharedKernel.Identity;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace AgentOs.Tests.Agents;
+
+public sealed class BoardAgentRegistryTests
+{
+    private const string Tenant = "acme";
+    private static readonly string[] BoardRoles =
+        [AgentRoles.Discovery, AgentRoles.IssueWork, AgentRoles.Reviewer, AgentRoles.Acceptance, AgentRoles.AutopilotOrchestrator, AgentRoles.Retrospective];
+
+    private static readonly IReadOnlyList<string> ShopRepo = ["acme/shop"];
+
+    private sealed record Call(string Provider, LlmRequest Request);
+
+    // A factory whose clients report `effective` as their provider (what a force-provider would return) and record
+    // every request with the provider name the agent asked for.
+    private static (ILlmClientFactory Factory, List<Call> Calls) Recording(string reply, string? effective = null)
+    {
+        var calls = new List<Call>();
+        var factory = Substitute.For<ILlmClientFactory>();
+        factory.Create(Arg.Any<string>()).Returns(ci =>
+        {
+            var asked = ci.Arg<string>();
+            var client = Substitute.For<ILlmClient>();
+            client.Provider.Returns(effective ?? asked);
+            client.SendAsync(Arg.Any<LlmRequest>(), Arg.Any<CancellationToken>()).Returns(x =>
+            {
+                calls.Add(new Call(asked, x.Arg<LlmRequest>()));
+                return AgentTestHelpers.StubResponse(reply);
+            });
+            return client;
+        });
+        return (factory, calls);
+    }
+
+    private static SettingsService Settings() => new(
+        new SettingsCatalog([new LlmSettings(), new AgentSettings()]), new InMemoryAppConfigStore(),
+        new ConfigurationBuilder().Build(), new NullSettingsAuditSink(), NullLogger<SettingsService>.Instance);
+
+    private static IBudgetGuard OverBudget()
+    {
+        var guard = Substitute.For<IBudgetGuard>();
+        guard.EvaluateAsync(Arg.Any<string>(), Arg.Any<CancellationToken>())
+             .Returns(new BudgetStatus(10m, 25m, -15m, 2.5, BudgetState.Exceeded, true));
+        return guard;
+    }
+
+    private static AcceptanceRequest Change() => new(Guid.NewGuid(), Tenant, "u1",
+        new WorkRepo(Guid.NewGuid(), "acme", "shop", "main", "issue-7-ai-fix"), 7, "Checkout", "Pay by card.");
+
+    private static OrchestratorBrief Brief() => new(Guid.NewGuid(), Tenant, "u1", "Shop", "Build", "Tickets:\n#7 [open]",
+        [new OrchestratorMove("M1", "start", 7, "start #7")], [], 1, []);
+
+    private static RetrospectiveInput Lessons() => new(Tenant, "u1", "acme/shop", "#7 Checkout",
+        [new RetrospectiveItem("L1", "Run the E2E specs with the AppHost running.", false)], []);
+
+    private const string Verdict = """{"verdict":"pass","criteria":[],"summary":"ok"}""";
+    private const string Approve = """{"verdict":"approve","findings":[],"summary":"ok"}""";
+    private const string Decision = """{"reasoning":"go","moves":["M1"],"retries":[],"questions":[],"closes":[]}""";
+    private const string Practices = """{"practices":["Run the E2E specs with the AppHost running."],"absorbed":["L1"],"summary":"one"}""";
+
+    // ── The registry ────────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void Registry_EveryRoleHasAProfileRow_AndBoardRowsAreSeparateFromThePipeline()
+    {
+        AgentSettings.Roles.Select(r => r.Role).ShouldBe(AgentRoles.All.Select(r => r.Key));
+        AgentRoles.All.Where(r => r.Group == AgentRoleGroup.Board).Select(r => r.Key).ShouldBe(BoardRoles, ignoreOrder: true);
+        AgentRoles.All.Where(r => r.Group == AgentRoleGroup.WorkflowPipeline).ShouldAllBe(r => r.Label.EndsWith("(Workflow pipeline)", StringComparison.Ordinal));
+        AgentRoles.All.Select(r => r.Label).ShouldBeUnique();
+    }
+
+    [Theory]
+    [InlineData(AgentRoles.Reviewer, 32768)]
+    [InlineData(AgentRoles.Acceptance, 32768)]
+    [InlineData(AgentRoles.AutopilotOrchestrator, 4096)]
+    [InlineData(AgentRoles.Retrospective, 4096)]
+    public void Seeds_KeepTodaysBehaviour_OnTheMembersComputer(string role, int maxTokens)
+    {
+        var seed = new AgentsOptions().For(role).ShouldNotBeNull();
+        seed.Provider.ShouldBe("RemoteAgent");
+        seed.Model.ShouldBe("claude-sonnet-4-6");
+        seed.MaxTokens.ShouldBe(maxTokens);
+    }
+
+    [Theory]
+    [InlineData("CodingAgent", AgentRoles.Coding, "Coding (Workflow pipeline)")]
+    [InlineData("Coding", AgentRoles.Coding, "Coding (Workflow pipeline)")]
+    [InlineData("IssueWork", AgentRoles.IssueWork, "Coding (tickets)")]
+    [InlineData("Acceptance", AgentRoles.Acceptance, "Testing (tickets)")]
+    [InlineData("Decomposer", AgentRoles.Discovery, "Discovery")]
+    [InlineData("AutopilotOrchestrator", AgentRoles.AutopilotOrchestrator, "Autopilot lead")]
+    [InlineData("QaAgent", AgentRoles.Qa, "QA (Workflow pipeline)")]
+    [InlineData("SomethingNew", "SomethingNew", "SomethingNew")]
+    public void Insights_NamesMatchAgentProfiles(string stored, string key, string label)
+    {
+        AgentRoles.Canonical(stored).ShouldBe(key);
+        AgentRoles.Label(stored).ShouldBe(label);
+    }
+
+    [Fact]
+    public void Prompts_EveryBoardRoleIsTunable_AndKeysAreUnique()
+    {
+        var keys = PromptCatalog.All.Select(e => e.Key).ToList();
+        keys.ShouldBeUnique();
+        foreach (var role in BoardRoles) { keys.ShouldContain(role); }
+        PromptCatalog.All.Where(e => e.Group == AgentRoleGroup.Board && !e.Key.StartsWith(AgentRoles.IssueWork, StringComparison.Ordinal))
+            .ShouldAllBe(e => e.DefaultPrompt.StartsWith("You are the ", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void PromptTemplate_FillsInOnePass_AndLeavesJsonAndUnknownWordsAlone()
+    {
+        var filled = PromptTemplate.Fill("""clone {owner}/{repo} {unknown} {"verdict":"pass"}""",
+            new Dictionary<string, string> { ["owner"] = "{repo}", ["repo"] = "shop" });
+
+        filled.ShouldBe("""clone {repo}/shop {unknown} {"verdict":"pass"}""");
+    }
+
+    // ── Profiles: provider + model per call ─────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task BoardAgents_UseTheirProfile_AndFileCallsUnderTheirRole()
+    {
+        var settings = Settings();
+        foreach (var role in new[] { AgentRoles.Reviewer, AgentRoles.Acceptance, AgentRoles.AutopilotOrchestrator, AgentRoles.Retrospective })
+        {
+            (await settings.SetAsync(AgentSettings.Key(role, "Model"), "claude-opus-5-5", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+        }
+        var profiles = new SettingsAgentProfiles(settings);
+        var (review, reviewCalls) = Recording(Approve);
+        var (test, testCalls) = Recording(Verdict);
+        var (lead, leadCalls) = Recording(Decision);
+        var (retro, retroCalls) = Recording(Practices);
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            (await new ReviewAgent(review, NullLogger<ReviewAgent>.Instance, profiles: profiles).RunAsync(Change())).Ran.ShouldBeTrue();
+            (await new AcceptanceAgent(test, NullLogger<AcceptanceAgent>.Instance, profiles: profiles).RunAsync(Change())).Ran.ShouldBeTrue();
+            (await new AutopilotOrchestratorAgent(lead, NullLogger<AutopilotOrchestratorAgent>.Instance, profiles: profiles).DecideAsync(Brief())).Ran.ShouldBeTrue();
+            (await new RetrospectiveAgent(retro, NullLogger<RetrospectiveAgent>.Instance, profiles: profiles).RunAsync(Lessons())).Ran.ShouldBeTrue();
+        }
+
+        foreach (var (calls, role) in new[] { (reviewCalls, AgentRoles.Reviewer), (testCalls, AgentRoles.Acceptance), (leadCalls, AgentRoles.AutopilotOrchestrator), (retroCalls, AgentRoles.Retrospective) })
+        {
+            var call = calls.ShouldHaveSingleItem();
+            call.Provider.ShouldBe("RemoteAgent");                 // the seed provider, still on the member's computer
+            call.Request.Model.ShouldBe("claude-opus-5-5");        // the tenant's pick, not a hard-coded model
+            call.Request.AgentRole.ShouldBe(role);                 // Insights files it under the Agent profiles row
+        }
+    }
+
+    [Fact]
+    public async Task BoardAgent_ProviderChangedInSettings_IsTheOneAskedFor()
+    {
+        var settings = Settings();
+        (await settings.SetAsync(AgentSettings.Key(AgentRoles.Reviewer, "Provider"), "Claude", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+        var (factory, calls) = Recording(Approve);
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            await new ReviewAgent(factory, NullLogger<ReviewAgent>.Instance, profiles: new SettingsAgentProfiles(settings)).RunAsync(Change());
+        }
+
+        calls.ShouldHaveSingleItem().Provider.ShouldBe("Claude");
+    }
+
+    // ── Budget gate: decided from the effective provider ────────────────────────────────────────
+
+    [Fact]
+    public async Task BoardAgents_OnAForcedServerProvider_PassTheBudgetGate()
+    {
+        // The profiles say RemoteAgent, but Settings forces a server provider: the gate must apply.
+        var guard = OverBudget();
+        var (factory, calls) = Recording(Approve, effective: "Claude");
+
+        var review = await new ReviewAgent(factory, NullLogger<ReviewAgent>.Instance, budgetGuard: guard).RunAsync(Change());
+        var test = await new AcceptanceAgent(factory, NullLogger<AcceptanceAgent>.Instance, budgetGuard: guard).RunAsync(Change());
+        var lead = await new AutopilotOrchestratorAgent(factory, NullLogger<AutopilotOrchestratorAgent>.Instance, budgetGuard: guard).DecideAsync(Brief());
+        var retro = await new RetrospectiveAgent(factory, NullLogger<RetrospectiveAgent>.Instance, budgetGuard: guard).RunAsync(Lessons());
+
+        review.Ran.ShouldBeFalse();
+        review.Error.ShouldBe(AgentBudgetGate.BlockedMessage);
+        test.Ran.ShouldBeFalse();
+        lead.Ran.ShouldBeFalse();
+        retro.Ran.ShouldBeFalse();
+        calls.ShouldBeEmpty();   // blocked before any server token is spent
+    }
+
+    [Fact]
+    public async Task BoardAgents_OnTheMembersComputer_AreExempt_AndNeverAskTheBudget()
+    {
+        var guard = OverBudget();
+        var (factory, calls) = Recording(Verdict);
+
+        (await new AcceptanceAgent(factory, NullLogger<AcceptanceAgent>.Instance, budgetGuard: guard).RunAsync(Change())).Ran.ShouldBeTrue();
+
+        calls.ShouldHaveSingleItem();
+        await guard.DidNotReceive().EvaluateAsync(Arg.Any<string>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task IssueWork_ForcedServerProvider_IsGated_EvenWhenTheRunAskedForTheMembersComputer()
+    {
+        var guard = OverBudget();
+        var (factory, calls) = Recording("""{"branch":"issue-7-ai-fix","summary":"done"}""", effective: "Claude");
+        var agent = new IssueWorkAgent(factory, Options.Create(new AgentsOptions()), NullLogger<IssueWorkAgent>.Instance, budgetGuard: guard);
+
+        var result = await agent.RunAsync(new IssueWorkRequest(Guid.NewGuid(), Tenant, "u1",
+            [new WorkRepo(Guid.NewGuid(), "acme", "shop", "main")], 7, "Checkout", "Pay by card.") { ProviderOverride = "RemoteAgent" });
+
+        result.Ok.ShouldBeFalse();
+        result.Error!.ShouldContain("budget");
+        calls.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task IssueWork_FilesItsCallsUnderItsRole()
+    {
+        var (factory, calls) = Recording("""{"branch":"issue-7-ai-fix","summary":"done"}""");
+        var agent = new IssueWorkAgent(factory, Options.Create(new AgentsOptions()), NullLogger<IssueWorkAgent>.Instance);
+
+        await agent.RunAsync(new IssueWorkRequest(Guid.NewGuid(), Tenant, "u1",
+            [new WorkRepo(Guid.NewGuid(), "acme", "shop", "main")], 7, "Checkout", "Pay by card."));
+
+        calls.ShouldHaveSingleItem().Request.AgentRole.ShouldBe(AgentRoles.IssueWork);
+    }
+
+    // ── Prompts: Settings → Prompts overrides reach the Board agents ────────────────────────────
+
+    [Fact]
+    public async Task BoardAgents_UseTheTenantsPromptOverride_FilledPerRun_ThenTheFixedRules()
+    {
+        var prompts = Substitute.For<IPromptOverrides>();
+        prompts.ResolveAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<CancellationToken>()).Returns(ci => ci.ArgAt<string>(1));
+        prompts.ResolveAsync(AgentRoles.Reviewer, Arg.Any<string>(), Arg.Any<CancellationToken>())
+               .Returns("You are the Reviewer Agent of ACME. Check out {branch} of {owner}/{repo}.");
+        prompts.ResolveRulesAsync(Arg.Any<CancellationToken>()).Returns("Never touch /infra.");
+        var (factory, calls) = Recording(Approve);
+
+        await new ReviewAgent(factory, NullLogger<ReviewAgent>.Instance, prompts: prompts).RunAsync(Change());
+
+        var system = calls.ShouldHaveSingleItem().Request.SystemPrompt;
+        system.ShouldStartWith("You are the Reviewer Agent of ACME. Check out issue-7-ai-fix of acme/shop.");
+        system.ShouldContain(UntrustedText.SystemRule);            // the security rule is never overridable
+        system.ShouldContain("<workspace_rules>\nNever touch /infra.");
+    }
+
+    [Theory]
+    [InlineData(null, AgentRoles.IssueWork)]                     // the member's computer (Board default)
+    [InlineData("Claude", "IssueWork.Server")]                    // the server runner_shell loop
+    public async Task IssueWork_ResolvesThePromptOfItsMode(string? effective, string key)
+    {
+        var prompts = Substitute.For<IPromptOverrides>();
+        prompts.ResolveAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<CancellationToken>()).Returns("CUSTOM {owner}/{repo} -> {branch}");
+        var (factory, calls) = Recording("""{"branch":"issue-7-ai-fix","summary":"done"}""", effective ?? "RemoteAgent");
+        var agent = new IssueWorkAgent(factory, Options.Create(new AgentsOptions()), NullLogger<IssueWorkAgent>.Instance, prompts: prompts);
+
+        await agent.RunAsync(new IssueWorkRequest(Guid.NewGuid(), Tenant, "u1",
+            [new WorkRepo(Guid.NewGuid(), "acme", "shop", "main")], 7, "Checkout", "Pay by card."));
+
+        await prompts.Received().ResolveAsync(key, Arg.Any<string>(), Arg.Any<CancellationToken>());
+        calls.ShouldHaveSingleItem().Request.SystemPrompt.ShouldStartWith("CUSTOM acme/shop -> issue-7-ai-fix");
+    }
+
+    // ── Practices ───────────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Testing_And_AutopilotLead_ReadTheProjectsPractices()
+    {
+        var memory = new PracticesMemory(Tenant, "acme/shop", "Run the E2E specs with the AppHost running.");
+        var boardRepos = Substitute.For<IBoardRepos>();
+        boardRepos.RepoKeysAsync(Tenant, Arg.Any<Guid>(), Arg.Any<CancellationToken>()).Returns(ShopRepo);
+        var (test, testCalls) = Recording(Verdict);
+        var (lead, leadCalls) = Recording(Decision);
+
+        await new AcceptanceAgent(test, NullLogger<AcceptanceAgent>.Instance, memory: memory).RunAsync(Change());
+        await new AutopilotOrchestratorAgent(lead, NullLogger<AutopilotOrchestratorAgent>.Instance, memory: memory, boardRepos: boardRepos).DecideAsync(Brief());
+
+        testCalls.ShouldHaveSingleItem().Request.UserPrompt.ShouldContain("Run the E2E specs with the AppHost running.");
+        leadCalls.ShouldHaveSingleItem().Request.UserPrompt.ShouldContain("Run the E2E specs with the AppHost running.");
+    }
+
+    [Fact]
+    public async Task Practices_AreStrictlyPerTenant()
+    {
+        var memory = new PracticesMemory("other-tenant", "acme/shop", "A practice of someone else.");
+        var (test, calls) = Recording(Verdict);
+
+        await new AcceptanceAgent(test, NullLogger<AcceptanceAgent>.Instance, memory: memory).RunAsync(Change());
+
+        calls.ShouldHaveSingleItem().Request.UserPrompt.ShouldNotContain("someone else");
+    }
+
+    // ── Discovery ───────────────────────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Discovery_TheRequirementStepAndTheSplit_UseTheDiscoveryProfile_AndRole()
+    {
+        var settings = Settings();
+        (await settings.SetAsync(AgentSettings.Key(AgentRoles.Discovery, "Model"), "claude-haiku-5-5", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+        var profiles = new SettingsAgentProfiles(settings);
+        var offline = new OfflineLlmClient();
+        var calls = new List<LlmRequest>();
+        var factory = Substitute.For<ILlmClientFactory>();
+        factory.Create(Arg.Any<string>()).Returns(_ =>
+        {
+            var client = Substitute.For<ILlmClient>();
+            client.Provider.Returns("RemoteAgent");
+            client.SendAsync(Arg.Any<LlmRequest>(), Arg.Any<CancellationToken>()).Returns(x =>
+            {
+                calls.Add(x.Arg<LlmRequest>());
+                return offline.SendAsync(x.Arg<LlmRequest>(), x.Arg<CancellationToken>());
+            });
+            return client;
+        });
+        var options = Options.Create(new AgentsOptions());
+        var requirement = new RequirementAgent(factory, options, AgentTestHelpers.Validator, AgentTestHelpers.NewCollector(),
+            NullLogger<RequirementAgent>.Instance, profiles: profiles);
+        var decomposer = new TicketDecomposerAgent(factory, options, NullLogger<TicketDecomposerAgent>.Instance, profiles);
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            await new IdeaBootstrapService(requirement, decomposer, options).GenerateAsync("A shop with card payments");
+            // The same Requirement agent outside Discovery keeps its own (Workflow pipeline) profile.
+            await requirement.RunAsync(new UserStory("A shop with card payments"));
+        }
+
+        calls.Count.ShouldBe(3);
+        calls[0].AgentRole.ShouldBe(AgentRoles.Discovery);
+        calls[0].Model.ShouldBe("claude-haiku-5-5");
+        calls[0].SystemPrompt.ShouldStartWith("You are the Requirement Agent");   // the spec contract stays the Requirement agent's
+        calls[1].AgentRole.ShouldBe(AgentRoles.Discovery);
+        calls[1].Model.ShouldBe("claude-haiku-5-5");
+        calls[2].AgentRole.ShouldBe(AgentRoles.Requirement);
+        calls[2].Model.ShouldBe(new AgentsOptions().Requirement.Model);
+    }
+
+    [Fact]
+    public async Task Discovery_OverBudgetOnAServerProvider_IsBlocked()
+    {
+        var factory = Substitute.For<ILlmClientFactory>();
+        var client = Substitute.For<ILlmClient>();
+        client.Provider.Returns("Claude");
+        factory.Create(Arg.Any<string>()).Returns(client);
+        var options = Options.Create(new AgentsOptions());
+        var requirement = new RequirementAgent(factory, options, AgentTestHelpers.Validator, AgentTestHelpers.NewCollector(),
+            NullLogger<RequirementAgent>.Instance);
+        var decomposer = new TicketDecomposerAgent(factory, options, NullLogger<TicketDecomposerAgent>.Instance);
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            var ex = await Should.ThrowAsync<LlmException>(() =>
+                new IdeaBootstrapService(requirement, decomposer, options, OverBudget()).GenerateAsync("A shop"));
+            ex.Message.ShouldContain("budget");
+        }
+        await client.DidNotReceive().SendAsync(Arg.Any<LlmRequest>(), Arg.Any<CancellationToken>());
+    }
+
+    // Practices of one (tenant, repo); everything else is empty. ListAsync is the interface default over GraphAsync.
+    private sealed class PracticesMemory(string tenant, string repo, string practice) : IMemoryStore
+    {
+        public Task<Guid> RecordAsync(string tenantId, MemoryNodeInput node, CancellationToken ct = default) => Task.FromResult(Guid.Empty);
+        public Task LinkAsync(string tenantId, Guid fromId, Guid toId, string rel, CancellationToken ct = default) => Task.CompletedTask;
+        public Task<IReadOnlyList<MemoryNode>> RecallLessonsAsync(string tenantId, string repoKey, string query, int max, CancellationToken ct = default) =>
+            Task.FromResult<IReadOnlyList<MemoryNode>>([]);
+        public Task<MemoryGraph> GraphAsync(string tenantId, string? repoKey, int maxNodes, CancellationToken ct = default) =>
+            Task.FromResult(tenantId == tenant && repoKey == repo
+                ? new MemoryGraph([new MemoryNode(Guid.NewGuid(), MemoryKinds.Practice, "p1", practice, practice, repo, false, DateTimeOffset.UtcNow, null)], [])
+                : new MemoryGraph([], []));
+        public Task SetPinnedAsync(string tenantId, Guid nodeId, bool pinned, CancellationToken ct = default) => Task.CompletedTask;
+        public Task ForgetAsync(string tenantId, Guid nodeId, CancellationToken ct = default) => Task.CompletedTask;
+    }
+}
diff --git a/tests/AgentOs.Tests/Pipeline/PromptsV2Tests.cs b/tests/AgentOs.Tests/Pipeline/PromptsV2Tests.cs
index 683f45ed..7ce93d68 100644
--- a/tests/AgentOs.Tests/Pipeline/PromptsV2Tests.cs
+++ b/tests/AgentOs.Tests/Pipeline/PromptsV2Tests.cs
@@ -108,7 +108,8 @@ public async Task Agent_SystemPrompt_CarriesTheRules_AfterItsOwnPrompt()
         prompts[0].ShouldContain("<workspace_rules>\nNever use FluentAssertions.");
     }
 
+    // The ticket split is the Discovery agent's prompt (one key with its Agent profiles row and its Insights name).
     [Fact]
-    public void Catalog_NowIncludesTheDecomposer()
-        => PromptCatalog.All.Select(e => e.Key).ShouldContain("Decomposer");
+    public void Catalog_IncludesTheDiscoveryPrompt()
+        => PromptCatalog.All.Single(e => e.Key == AgentRoles.Discovery).DefaultPrompt.ShouldBe(DecomposerPrompt.System);
 }
diff --git a/tests/AgentOs.Tests/Sessions/CliModelTests.cs b/tests/AgentOs.Tests/Sessions/CliModelTests.cs
new file mode 100644
index 00000000..f9e8fcb0
--- /dev/null
+++ b/tests/AgentOs.Tests/Sessions/CliModelTests.cs
@@ -0,0 +1,56 @@
+// The model an agent's profile picked reaches the paired runner's CLI: `--model <id>` for Claude Code, `-m <id>` for
+// Codex; nothing when the request carries no model, the CLI cannot serve it, or the operator's own args name one.
+
+using AgentOs.RemoteAgent;
+using Shouldly;
+using Xunit;
+
+namespace AgentOs.Tests.Sessions;
+
+public sealed class CliModelTests
+{
+    private static readonly string[] ClaudeDefaults = ["-p"];
+    private static readonly string[] CodexDefaults = ["exec"];
+
+    [Theory]
+    [InlineData("claude", "claude-sonnet-4-6")]
+    [InlineData("claude", "claude-opus-5-5")]
+    [InlineData("claude", "sonnet")]
+    [InlineData(@"C:\Users\me\AppData\Roaming\npm\claude.cmd", "claude-haiku-5-5")]
+    [InlineData("/usr/local/bin/claude", "claude-fable-1")]
+    public void Claude_GetsDashDashModel(string command, string model) =>
+        CliModel.Flags(command, model, ClaudeDefaults).ShouldBe(["--model", model]);
+
+    [Theory]
+    [InlineData("codex", "gpt-5.1-codex")]
+    [InlineData(@"C:\npm\codex.cmd", "o4-mini")]
+    public void Codex_GetsDashM(string command, string model) =>
+        CliModel.Flags(command, model, CodexDefaults).ShouldBe(["-m", model]);
+
+    [Theory]
+    [InlineData("claude", "")]
+    [InlineData("claude", "   ")]
+    [InlineData("claude", null)]
+    [InlineData("claude", "gpt-5")]                  // a model claude cannot serve: its default applies
+    [InlineData("codex", "claude-sonnet-4-6")]        // a model codex cannot serve
+    [InlineData("my-agent", "claude-sonnet-4-6")]     // an unknown CLI: never guess its flags
+    [InlineData("claude", "--dangerously-skip-permissions")]   // never let a model id become a flag
+    [InlineData("claude", "claude sonnet")]
+    public void NoFlag_WhenThereIsNothingTheCliCanUse(string command, string? model) =>
+        CliModel.Flags(command, model, ClaudeDefaults).ShouldBeEmpty();
+
+    [Theory]
+    [InlineData("--model", "opus")]
+    [InlineData("-m", "x")]
+    [InlineData("--model=opus")]
+    public void OperatorArgs_ThatNameAModel_Win(params string[] existing) =>
+        CliModel.Flags("claude", "claude-sonnet-4-6", ["-p", .. existing]).ShouldBeEmpty();
+
+    [Theory]
+    [InlineData("claude", "claude")]
+    [InlineData(@"C:\npm\Claude.CMD", "claude")]
+    [InlineData("/opt/codex", "codex")]
+    [InlineData("", "")]
+    public void CommandName_IsTheBareCliName_OnEveryOs(string command, string expected) =>
+        CliModel.CommandName(command).ShouldBe(expected);
+}

From 3772ea1eaf4ef48c0481eaa84ef8f9984e54b465 Mon Sep 17 00:00:00 2001
From: Hoang Snowy <nguyenminhhoang.dit12@gmail.com>
Date: Sat, 24 Oct 2026 01:24:54 +0700
Subject: [PATCH 2/2] fix(agents): Board agents default to the computer's
 model; Decomposer values keep working

Review of #278:

1. No model downgrade. Board agents (Discovery, Coding/Reviewer/Testing
   (tickets), Autopilot lead, Retrospective) now choose NO model by default
   ("Computer's default" in Agent profiles). On a member's computer the
   request carries an empty model (RemoteAgentLlmClient accepts it via
   LlmRequest.ValidateAllowingNoModel) and CliModel adds no flag, so the CLI
   runs its own default. On our servers the provider client fills in its
   configured model before Validate (ProviderDefaultModel, wired into
   PooledChatLlmClient per provider, MafChatClient, ChatClientLlmClient). An
   explicitly chosen model is still passed (--model / -m). Startup
   validation still requires a model for the Workflow pipeline agents.

2. No silent loss on the Decomposer -> Discovery rename. LegacyAgentSettings
   reads Agents:Decomposer:* (tenant, platform, appsettings) for any Discovery
   field with nothing stored, and the Decomposer prompt override applies
   until a Discovery one is saved. Agent profiles marks the row and Reset
   clears the legacy values too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018WAdQ7Rm24xss5QDSvXtJB
---
 README.md                                     |   9 +-
 docs/CONFIG.md                                |  31 +-
 src/AgentOs.Domain/Llm/LlmRequest.cs          |  19 +-
 .../ChatClientLlmClient.cs                    |   6 +-
 src/AgentOs.Modules.Llm/LlmModule.cs          |  14 +-
 src/AgentOs.Modules.Llm/MafChatClient.cs      |   6 +
 .../PooledChatLlmClient.cs                    |   9 +-
 .../ProviderDefaultModel.cs                   |  22 ++
 .../Agents/AgentProfiles.cs                   |  28 +-
 .../Agents/AgentSettings.cs                   |   8 +-
 .../Agents/AgentsOptions.cs                   |  30 +-
 .../Agents/DependencyInjection.cs             |  13 +-
 .../Agents/LegacyAgentSettings.cs             |  89 ++++++
 .../Prompts/AppConfigPromptOverrides.cs       |   6 +
 .../Prompts/IPromptOverrideService.cs         |  20 +-
 .../RemoteAgentLlmClient.cs                   |   9 +-
 .../Components/Pages/AgentProfilesApp.razor   |  35 ++-
 .../Components/UI/ModelPicker.razor           |   5 +-
 .../Agents/BoardAgentRegistryTests.cs         |   2 +-
 .../Agents/ComputersDefaultModelTests.cs      | 289 ++++++++++++++++++
 .../Configuration/SettingsServiceTests.cs     |   3 +-
 21 files changed, 593 insertions(+), 60 deletions(-)
 create mode 100644 src/AgentOs.Modules.Llm/ProviderDefaultModel.cs
 create mode 100644 src/AgentOs.Modules.Pipeline/Agents/LegacyAgentSettings.cs
 create mode 100644 tests/AgentOs.Tests/Agents/ComputersDefaultModelTests.cs

diff --git a/README.md b/README.md
index 200b1c2c..db1ce356 100644
--- a/README.md
+++ b/README.md
@@ -295,8 +295,8 @@ so a key saved in Settings is used by the next call.
 
 | Agent | Provider | Model |
 |---|---|---|
-| Board: Discovery, Coding (tickets) | Claude | `claude-sonnet-4-6` |
-| Board: Reviewer, Testing (tickets), Autopilot lead, Retrospective | RemoteAgent (a paired computer, 0 server tokens) | `claude-sonnet-4-6` |
+| Board: Discovery, Coding (tickets) | Claude | *Computer's default* (on our servers: Claude's configured model) |
+| Board: Reviewer, Testing (tickets), Autopilot lead, Retrospective | RemoteAgent (a paired computer, 0 server tokens) | *Computer's default* (the member's CLI model) |
 | Workflow pipeline: Orchestrator | Claude | `claude-haiku-4-5` |
 | Workflow pipeline: Requirement | Claude | `claude-sonnet-4-6` |
 | Workflow pipeline: Coding | AzureOpenAI | `gpt-4.1` |
@@ -304,8 +304,9 @@ so a key saved in Settings is used by the next call.
 | Workflow pipeline: QA | Claude | `claude-haiku-4-5` |
 
 Every agent — Board and pipeline — reads its profile and its prompt (Settings → Prompts) per call, passes the budget
-gate unless it really runs on a member's computer, and appears in Insights under the same name. On a paired computer
-the runner passes the profile's model to the CLI (`claude --model`, `codex -m`). See [CONFIG.md](docs/CONFIG.md#settings--agent-profiles).
+gate unless it really runs on a member's computer, and appears in Insights under the same name. A Board agent chooses
+no model until someone picks one: a paired computer's CLI then runs its own default, our servers the provider's
+configured model; a picked model reaches the CLI as `claude --model` / `codex -m`. See [CONFIG.md](docs/CONFIG.md#settings--agent-profiles).
 
 The model picker lists every priced model for the chosen provider with its list price (e.g.
 `claude-haiku-5-5 · $0.1 / $0.5` per 1M tokens), plus *Custom…* for Azure deployment aliases.
diff --git a/docs/CONFIG.md b/docs/CONFIG.md
index 2f9544ad..38d3d31c 100644
--- a/docs/CONFIG.md
+++ b/docs/CONFIG.md
@@ -108,29 +108,36 @@ aliases); `Temperature` is hidden for models that reject sampling params; `MaxTo
 
 | Shown as | Key | Provider | Model | Temp | Max output |
 |---|---|---|---|---|---|
-| Discovery (New idea: requirement + ticket split) | `Discovery` | Anthropic | `claude-sonnet-4-6` | 0.2 | 4000 |
-| Coding (tickets) | `IssueWork` | Anthropic | `claude-sonnet-4-6` | 0.2 | 32768 |
-| Reviewer | `Reviewer` | RemoteAgent | `claude-sonnet-4-6` | 0 | 32768 |
-| Testing (tickets) | `Acceptance` | RemoteAgent | `claude-sonnet-4-6` | 0 | 32768 |
-| Autopilot lead | `AutopilotOrchestrator` | RemoteAgent | `claude-sonnet-4-6` | 0 | 4096 |
-| Retrospective | `Retrospective` | RemoteAgent | `claude-sonnet-4-6` | 0 | 4096 |
+| Discovery (New idea: requirement + ticket split) | `Discovery` | Anthropic | *Computer's default* | 0.2 | 4000 |
+| Coding (tickets) | `IssueWork` | Anthropic | *Computer's default* | 0.2 | 32768 |
+| Reviewer | `Reviewer` | RemoteAgent | *Computer's default* | 0 | 32768 |
+| Testing (tickets) | `Acceptance` | RemoteAgent | *Computer's default* | 0 | 32768 |
+| Autopilot lead | `AutopilotOrchestrator` | RemoteAgent | *Computer's default* | 0 | 4096 |
+| Retrospective | `Retrospective` | RemoteAgent | *Computer's default* | 0 | 4096 |
 | Orchestrator (Workflow pipeline) | `Orchestrator` | Anthropic | `claude-haiku-4-5` | 0.3 | 2000 |
 | Requirement (Workflow pipeline) | `Requirement` | Anthropic | `claude-sonnet-4-6` | 0.1 | 2000 |
 | Coding (Workflow pipeline) | `Coding` | AzureOpenAI | `gpt-4.1` | 0.2 | 4000 |
 | Testing (Workflow pipeline) | `Testing` | AzureOpenAI | `gpt-4o-mini` | 0.2 | 3000 |
 | QA (Workflow pipeline) | `Qa` | Anthropic | `claude-haiku-4-5` | 0.1 | 1500 |
 
-- **The provider is honoured, the model reaches the CLI.** A Board agent on `RemoteAgent` runs on a member's paired
-  computer; the runner passes the profile's model to the CLI (`claude --model <id>`, `codex -m <id>`) when that CLI
-  can serve it, otherwise the CLI's own default applies. Reviewer and Testing (tickets) need a checkout, so keep them
-  on a paired computer unless the chosen provider can reach one.
+- **Computer's default (Board agents).** A Board agent chooses **no model** unless someone picks one. On a member's
+  paired computer (`RemoteAgent`) the request carries no model and the runner passes no flag, so the CLI runs its
+  own default — the member's choice, usually newer than any id AgentOS.NET would pin. On our servers the LLM gateway
+  fills in the provider's configured model (`Llm:Claude:Model`, the Azure default deployment, the vendor's / the
+  OpenAI-compatible server's model from **Settings → Model keys**) before the request is validated. A model picked
+  in the profile is always passed: `claude --model <id>`, `codex -m <id>` (only when that CLI can serve it). The
+  Workflow-pipeline agents always name a model. Reviewer and Testing (tickets) need a checkout, so keep them on a
+  paired computer unless the chosen provider can reach one.
 - **Budget gate.** Every Board agent passes the tenant's enforced monthly cap before its call, decided from the
   *effective* provider (after `Llm:ForceProvider`); only a call that really runs on a member's computer (0 server
   tokens) is exempt.
 - **Discovery** covers both calls of New idea: the requirement step uses the Discovery profile (and is filed under
   Discovery in Insights) with the Requirement agent's prompt and spec contract; the ticket split uses the Discovery
-  prompt. It replaces the former `Decomposer` profile and prompt keys — re-apply a customised `Agents:Decomposer:*`
-  or Decomposer prompt under `Discovery`.
+  prompt. It replaces the former `Decomposer` keys, which **keep working**: while a Discovery field has no stored
+  value, the tenant's (then the platform's, then the appsettings) `Agents:Decomposer:<Field>` applies, and the
+  Decomposer prompt override applies while no Discovery override is saved. Agent profiles marks the row *Saved as
+  "Decomposer" — still applies*; saving a field stores it under Discovery, and **Reset** (profile or prompt) clears
+  the tenant's Decomposer values too.
 - **Prompts.** Board prompts are templates: `{owner}`, `{repo}`, `{branch}`, `{defaultBranch}` (Reviewer, Testing
   (tickets)) and `{issue}`, `{branchStep}`, `{commitType}`… (Coding (tickets), which has one prompt for a member's
   computer and one — `IssueWork.Server` — for the server runner) are filled on every run. The untrusted-text rule is
diff --git a/src/AgentOs.Domain/Llm/LlmRequest.cs b/src/AgentOs.Domain/Llm/LlmRequest.cs
index 49efc94b..302e1ed3 100644
--- a/src/AgentOs.Domain/Llm/LlmRequest.cs
+++ b/src/AgentOs.Domain/Llm/LlmRequest.cs
@@ -77,6 +77,20 @@ public sealed record LlmRequest(
     /// Validates required values. Throws <see cref="System.ArgumentException"/> if invalid.
     /// </summary>
     public void Validate()
+    {
+        ValidateAllowingNoModel();
+        if (string.IsNullOrWhiteSpace(Model))
+        {
+            throw new System.ArgumentException("Model must not be null or whitespace.", nameof(Model));
+        }
+    }
+
+    /// <summary>
+    /// Validates required values but accepts an empty <see cref="Model"/>: a provider that chooses the model itself (a
+    /// member's paired CLI runs its own default) accepts "no model chosen". Server providers resolve an empty model to
+    /// their configured one and then call <see cref="Validate"/>.
+    /// </summary>
+    public void ValidateAllowingNoModel()
     {
         if (SystemPrompt is null)
         {
@@ -88,11 +102,6 @@ public void Validate()
             throw new System.ArgumentException("UserPrompt must not be null or whitespace.", nameof(UserPrompt));
         }
 
-        if (string.IsNullOrWhiteSpace(Model))
-        {
-            throw new System.ArgumentException("Model must not be null or whitespace.", nameof(Model));
-        }
-
         if (Temperature is < 0.0 or > 2.0)
         {
             throw new System.ArgumentException("Temperature must be in [0, 2].", nameof(Temperature));
diff --git a/src/AgentOs.Modules.Llm/ChatClientLlmClient.cs b/src/AgentOs.Modules.Llm/ChatClientLlmClient.cs
index c70144dc..5fe837bc 100644
--- a/src/AgentOs.Modules.Llm/ChatClientLlmClient.cs
+++ b/src/AgentOs.Modules.Llm/ChatClientLlmClient.cs
@@ -18,20 +18,24 @@ namespace AgentOs.Modules.Llm;
 public sealed class ChatClientLlmClient : ILlmClient
 {
     private readonly IChatClient _chat;
+    private readonly string? _defaultModel;
 
     /// <inheritdoc />
     public string Provider { get; }
 
-    public ChatClientLlmClient(IChatClient chat, string provider)
+    /// <summary>Create. <paramref name="defaultModel"/> is used when a request chose no model.</summary>
+    public ChatClientLlmClient(IChatClient chat, string provider, string? defaultModel = null)
     {
         _chat = chat ?? throw new ArgumentNullException(nameof(chat));
         Provider = string.IsNullOrWhiteSpace(provider) ? "ChatClient" : provider;
+        _defaultModel = defaultModel;
     }
 
     /// <inheritdoc />
     public async Task<LlmResponse> SendAsync(LlmRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
+        request = ProviderDefaultModel.Apply(request, _defaultModel);
         request.Validate();
 
         var messages = new List<ChatMessage>(2);
diff --git a/src/AgentOs.Modules.Llm/LlmModule.cs b/src/AgentOs.Modules.Llm/LlmModule.cs
index cfe6890b..7336d393 100644
--- a/src/AgentOs.Modules.Llm/LlmModule.cs
+++ b/src/AgentOs.Modules.Llm/LlmModule.cs
@@ -71,7 +71,9 @@ public void AddServices(IServiceCollection services, IConfiguration configuratio
                 tenantProvider: sp,
                 // Classify SDK errors so the key pool fails over on transient (5xx/timeout) + auth errors,
                 // not only 429.
-                classifyError: SdkChatClients.Classify);
+                classifyError: SdkChatClients.Classify,
+                // An agent profile left on "no model chosen" runs Claude's configured model.
+                defaultModel: () => opts.Value.Claude.Model);
         });
         services.AddKeyedSingleton<ILlmClient>("AzureOpenAI", (sp, _) =>
         {
@@ -107,7 +109,9 @@ string DefaultDeployment() => settings is null
                 // Fold the tenant's resolved endpoint into the client cache key (read per call from the same
                 // override source the factory uses) so two tenants sharing a key but not an endpoint never
                 // share a client bound to the wrong Azure resource.
-                cacheKeyDiscriminator: () => !string.IsNullOrWhiteSpace(ov.AzureEndpoint) ? ov.AzureEndpoint! : opts.Value.AzureOpenAi.Endpoint);
+                cacheKeyDiscriminator: () => !string.IsNullOrWhiteSpace(ov.AzureEndpoint) ? ov.AzureEndpoint! : opts.Value.AzureOpenAi.Endpoint,
+                // An agent profile left on "no model chosen" runs the tenant's default deployment.
+                defaultModel: DefaultDeployment);
         });
 
         // BYOK vendors (OpenAI, Gemini, xAI): fixed endpoints, tenant-scoped keys read live per call, the profile's
@@ -132,7 +136,8 @@ string DefaultDeployment() => settings is null
                     toolInvocationLog: sp.GetService<AgentOs.Domain.Tools.IToolInvocationLog>(),
                     tenantProvider: sp,
                     classifyError: SdkChatClients.Classify,
-                    modelResolver: requested => vendor.ResolveModel(requested, Read(vendor.ModelSetting)));
+                    modelResolver: requested => vendor.ResolveModel(requested, Read(vendor.ModelSetting)),
+                    defaultModel: () => vendor.ResolveModel(null, Read(vendor.ModelSetting)));
             });
         }
 
@@ -160,7 +165,8 @@ string Endpoint() => Read(LlmSettings.CompatEndpoint)
                 classifyError: SdkChatClients.Classify,
                 cacheKeyDiscriminator: () => Read(LlmSettings.CompatEndpoint) ?? string.Empty,
                 modelResolver: requested => OpenAiCompatibleModels.Resolve(requested, Read(LlmSettings.CompatModel)),
-                costOverride: (_, usage) => OpenAiCompatibleModels.Cost(usage, Read(LlmSettings.CompatInputPrice), Read(LlmSettings.CompatOutputPrice)));
+                costOverride: (_, usage) => OpenAiCompatibleModels.Cost(usage, Read(LlmSettings.CompatInputPrice), Read(LlmSettings.CompatOutputPrice)),
+                defaultModel: () => Read(LlmSettings.CompatModel));
         });
 
         services.AddSingleton<ILlmClientFactory, LlmClientFactory>();
diff --git a/src/AgentOs.Modules.Llm/MafChatClient.cs b/src/AgentOs.Modules.Llm/MafChatClient.cs
index c6ff28d7..6d106065 100644
--- a/src/AgentOs.Modules.Llm/MafChatClient.cs
+++ b/src/AgentOs.Modules.Llm/MafChatClient.cs
@@ -56,6 +56,12 @@ _settings is null
     public async Task<LlmResponse> SendAsync(LlmRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
+        // No model chosen in the agent's profile → the configured Azure deployment (live setting, else the option).
+        if (string.IsNullOrWhiteSpace(request.Model))
+        {
+            request = ProviderDefaultModel.Apply(request,
+                (_settings is null ? null : LiveSettings.Read(_settings, LlmSettings.AzureModel, AmbientIdentity.Current?.TenantId)) ?? _options.Model);
+        }
         request.Validate();
 
         // Resolve credentials with the SAME tenant-override-first precedence as the AzureOpenAI pool — a tenant
diff --git a/src/AgentOs.Modules.Llm/PooledChatLlmClient.cs b/src/AgentOs.Modules.Llm/PooledChatLlmClient.cs
index 1977bb5a..e0d08fb0 100644
--- a/src/AgentOs.Modules.Llm/PooledChatLlmClient.cs
+++ b/src/AgentOs.Modules.Llm/PooledChatLlmClient.cs
@@ -68,8 +68,10 @@ public PooledChatLlmClient(
         Func<Exception, LlmErrorKind>? classifyError = null,
         Func<string>? cacheKeyDiscriminator = null,
         Func<string, string>? modelResolver = null,
-        Func<string, TokenUsage, decimal?>? costOverride = null)
+        Func<string, TokenUsage, decimal?>? costOverride = null,
+        Func<string?>? defaultModel = null)
     {
+        _defaultModel = defaultModel;
         Provider = string.IsNullOrWhiteSpace(provider) ? throw new ArgumentException("provider required", nameof(provider)) : provider;
         _clientFactory = clientFactory ?? throw new ArgumentNullException(nameof(clientFactory));
         _keyProvider = keyProvider ?? throw new ArgumentNullException(nameof(keyProvider));
@@ -97,6 +99,9 @@ public PooledChatLlmClient(
     private readonly Func<string, string>? _modelResolver;
     private readonly Func<string, TokenUsage, decimal?>? _costOverride;
 
+    // The provider's configured model (read live per call), used when the agent's profile chose none.
+    private readonly Func<string?>? _defaultModel;
+
     // The tenant for tool tagging / telemetry when there is no AmbientIdentity on the call. Prefer a
     // directly-supplied ITenantContext (tests); otherwise resolve the request-scoped one inside a fresh
     // scope off the root provider (safe from a singleton — IHttpContextAccessor is itself a singleton, so
@@ -113,6 +118,8 @@ public PooledChatLlmClient(
     public async Task<LlmResponse> SendAsync(LlmRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
+        // No model chosen in the agent's profile → this provider's configured model (before validation).
+        request = ProviderDefaultModel.Apply(request, string.IsNullOrWhiteSpace(request.Model) ? _defaultModel?.Invoke() : null);
         request.Validate();
 
         var keys = await _keyProvider(cancellationToken).ConfigureAwait(false);
diff --git a/src/AgentOs.Modules.Llm/ProviderDefaultModel.cs b/src/AgentOs.Modules.Llm/ProviderDefaultModel.cs
new file mode 100644
index 00000000..cdc96115
--- /dev/null
+++ b/src/AgentOs.Modules.Llm/ProviderDefaultModel.cs
@@ -0,0 +1,22 @@
+// "No model chosen" in an agent profile (the Board agents' default) means: let whoever serves the call pick. A member's
+// paired CLI runs its own default model; a server provider runs the model configured for it (Settings → Model keys /
+// Llm:<Provider>:Model). Each server client resolves the empty model here, BEFORE LlmRequest.Validate, so a profile
+// left on its default never throws on our servers.
+
+using AgentOs.Domain.Llm;
+
+namespace AgentOs.Modules.Llm;
+
+/// <summary>Fills an empty request model with the serving provider's configured model.</summary>
+public static class ProviderDefaultModel
+{
+    /// <summary><paramref name="request"/> unchanged when it names a model (or no default is known); otherwise the same
+    /// request with <see cref="LlmRequest.Model"/> = <paramref name="providerDefault"/>.</summary>
+    public static LlmRequest Apply(LlmRequest request, string? providerDefault)
+    {
+        System.ArgumentNullException.ThrowIfNull(request);
+        return string.IsNullOrWhiteSpace(request.Model) && !string.IsNullOrWhiteSpace(providerDefault)
+            ? request with { Model = providerDefault.Trim() }
+            : request;
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentProfiles.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentProfiles.cs
index e74d037d..9f25fb82 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AgentProfiles.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentProfiles.cs
@@ -28,12 +28,15 @@ public sealed class SettingsAgentProfiles : IAgentProfiles
 {
     private readonly ISettings _settings;
     private readonly IServiceScopeFactory? _scopes;
+    private readonly LegacyAgentSettings? _legacy;
 
-    /// <summary>Create. <paramref name="scopes"/> resolves the request tenant when no ambient identity is pushed.</summary>
-    public SettingsAgentProfiles(ISettings settings, IServiceScopeFactory? scopes = null)
+    /// <summary>Create. <paramref name="scopes"/> resolves the request tenant when no ambient identity is pushed;
+    /// <paramref name="legacy"/> reads values a renamed role saved under its former key.</summary>
+    public SettingsAgentProfiles(ISettings settings, IServiceScopeFactory? scopes = null, LegacyAgentSettings? legacy = null)
     {
         _settings = settings ?? throw new ArgumentNullException(nameof(settings));
         _scopes = scopes;
+        _legacy = legacy;
     }
 
     /// <inheritdoc />
@@ -43,10 +46,10 @@ public async ValueTask<AgentOptions> ResolveAsync(string role, AgentOptions fall
         ArgumentNullException.ThrowIfNull(fallback);
         var tenant = CurrentTenant();
 
-        var provider = await _settings.GetStringAsync(AgentSettings.Key(role, nameof(AgentOptions.Provider)), tenant, null, cancellationToken).ConfigureAwait(false);
-        var model = await _settings.GetStringAsync(AgentSettings.Key(role, nameof(AgentOptions.Model)), tenant, null, cancellationToken).ConfigureAwait(false);
-        var temperature = await _settings.GetStringAsync(AgentSettings.Key(role, nameof(AgentOptions.Temperature)), tenant, null, cancellationToken).ConfigureAwait(false);
-        var maxTokens = await _settings.GetStringAsync(AgentSettings.Key(role, nameof(AgentOptions.MaxTokens)), tenant, null, cancellationToken).ConfigureAwait(false);
+        var provider = await FieldAsync(role, nameof(AgentOptions.Provider), tenant, cancellationToken).ConfigureAwait(false);
+        var model = await FieldAsync(role, nameof(AgentOptions.Model), tenant, cancellationToken).ConfigureAwait(false);
+        var temperature = await FieldAsync(role, nameof(AgentOptions.Temperature), tenant, cancellationToken).ConfigureAwait(false);
+        var maxTokens = await FieldAsync(role, nameof(AgentOptions.MaxTokens), tenant, cancellationToken).ConfigureAwait(false);
 
         return new AgentOptions
         {
@@ -58,6 +61,19 @@ public async ValueTask<AgentOptions> ResolveAsync(string role, AgentOptions fall
         };
     }
 
+    // The field's effective value. Only when nothing is stored for it (it would be the built-in default) does a value
+    // the role saved under its former key apply (Decomposer → Discovery).
+    private async ValueTask<string?> FieldAsync(string role, string field, string? tenant, CancellationToken ct)
+    {
+        var value = await _settings.GetAsync(AgentSettings.Key(role, field), tenant, ct).ConfigureAwait(false);
+        if (value.Source == SettingSource.Default && _legacy is not null
+            && await _legacy.ReadAsync(role, field, tenant, ct).ConfigureAwait(false) is { } legacy)
+        {
+            return legacy;
+        }
+        return value.HasValue ? value.Value : null;
+    }
+
     /// <inheritdoc />
     public async ValueTask<int> MaxIterationsAsync(int fallback, CancellationToken cancellationToken = default)
     {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
index 87a8b561..b6ab7b2b 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentSettings.cs
@@ -29,6 +29,10 @@ public sealed class AgentSettings : ISettingsContributor
     /// limit is enforced against the model catalog; this is the absolute ceiling.</summary>
     public const int MaxOutputTokensCeiling = 128_000;
 
+    /// <summary>What an empty Board-agent model means ("Computer's default" in Agent profiles).</summary>
+    public const string ComputersDefaultHelp =
+        "Empty = the computer's own model (the member's CLI default). On our servers: the provider's model from Settings → Model keys.";
+
     /// <summary>Every agent role (Board agents first, then the Workflow pipeline — see <see cref="AgentRoles"/>), paired
     /// with its code defaults.</summary>
     public static IReadOnlyList<(string Role, AgentOptions Defaults)> Roles { get; } = BuildRoles();
@@ -49,7 +53,9 @@ public IEnumerable<SettingDescriptor> Describe()
             };
             yield return new(Key(role, nameof(AgentOptions.Model)), SettingKind.Model, Category, $"{label} · model")
             {
-                DefaultValue = d.Model,
+                // No default model (a Board agent) = "Computer's default" — not an empty-string value.
+                DefaultValue = string.IsNullOrWhiteSpace(d.Model) ? null : d.Model,
+                Help = AgentsOptions.ModelIsOptional(role) ? ComputersDefaultHelp : null,
             };
             yield return new(Key(role, nameof(AgentOptions.Temperature)), SettingKind.Number, Category, $"{label} · temperature")
             {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs b/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
index 95f4de3a..bbd977f0 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/AgentsOptions.cs
@@ -15,7 +15,12 @@ public sealed class AgentsOptions
     // The Board agents that need a real machine (a checkout, a browser, the repo's toolchain) or answer from one run
     // on the member's paired computer by default — 0 server tokens.
     private const string MembersComputer = "RemoteAgent";
-    private const string BoardModel = "claude-sonnet-4-6";
+
+    // Board agents choose NO model by default (ComputersDefault): on a member's computer the CLI runs its own model (the
+    // member's choice, usually newer than any id we would pin); on our servers the provider's configured model applies
+    // (Settings → Model keys / Llm:<Provider>:Model, resolved in the LLM gateway). Picking a model in Agent profiles
+    // passes it explicitly (claude --model / codex -m on a computer).
+    private const string ComputersDefault = "";
 
     /// <summary>Workflow pipeline — Orchestrator configuration.</summary>
     public AgentOptions Orchestrator { get; set; } = new() { Model = "claude-haiku-4-5", Temperature = 0.3, MaxTokens = 2000 };
@@ -33,22 +38,25 @@ public sealed class AgentsOptions
     public AgentOptions Qa { get; set; } = new() { Model = "claude-haiku-4-5", Temperature = 0.1, MaxTokens = 1500 };
 
     /// <summary>Board — Coding (tickets): IssueWorkAgent, the agentic issue→branch run.</summary>
-    public AgentOptions IssueWork { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.2, MaxTokens = 32768 };
+    public AgentOptions IssueWork { get; set; } = new() { Model = ComputersDefault, Temperature = 0.2, MaxTokens = 32768 };
 
     /// <summary>Board — Discovery (New idea): the requirement step and the ticket split (TicketDecomposerAgent).</summary>
-    public AgentOptions Discovery { get; set; } = new() { Model = "claude-sonnet-4-6", Temperature = 0.2, MaxTokens = 4000 };
+    public AgentOptions Discovery { get; set; } = new() { Model = ComputersDefault, Temperature = 0.2, MaxTokens = 4000 };
 
     /// <summary>Board — Reviewer (ReviewAgent). Reads the change in a checkout on the member's computer.</summary>
-    public AgentOptions Reviewer { get; set; } = new() { Provider = MembersComputer, Model = BoardModel, Temperature = 0, MaxTokens = 32768 };
+    public AgentOptions Reviewer { get; set; } = new() { Provider = MembersComputer, Model = ComputersDefault, Temperature = 0, MaxTokens = 32768 };
 
     /// <summary>Board — Testing (tickets): AcceptanceAgent. Builds and tests the change on the member's computer.</summary>
-    public AgentOptions Acceptance { get; set; } = new() { Provider = MembersComputer, Model = BoardModel, Temperature = 0, MaxTokens = 32768 };
+    public AgentOptions Acceptance { get; set; } = new() { Provider = MembersComputer, Model = ComputersDefault, Temperature = 0, MaxTokens = 32768 };
 
     /// <summary>Board — Autopilot lead (AutopilotOrchestratorAgent). Answer-only.</summary>
-    public AgentOptions AutopilotOrchestrator { get; set; } = new() { Provider = MembersComputer, Model = BoardModel, Temperature = 0, MaxTokens = 4096 };
+    public AgentOptions AutopilotOrchestrator { get; set; } = new() { Provider = MembersComputer, Model = ComputersDefault, Temperature = 0, MaxTokens = 4096 };
 
     /// <summary>Board — Retrospective (RetrospectiveAgent). Answer-only.</summary>
-    public AgentOptions Retrospective { get; set; } = new() { Provider = MembersComputer, Model = BoardModel, Temperature = 0, MaxTokens = 4096 };
+    public AgentOptions Retrospective { get; set; } = new() { Provider = MembersComputer, Model = ComputersDefault, Temperature = 0, MaxTokens = 4096 };
+
+    /// <summary>True when <paramref name="role"/> may leave its model empty ("the computer's default"): the Board agents.</summary>
+    public static bool ModelIsOptional(string role) => AgentRoles.Find(role)?.Group == AgentRoleGroup.Board;
 
     /// <summary>The seed profile for <paramref name="role"/> (an <see cref="AgentRoles"/> key), or null when unknown.</summary>
     public AgentOptions? For(string role) => role switch
@@ -67,6 +75,14 @@ public sealed class AgentsOptions
         _ => null,
     };
 
+    /// <summary>Startup validation: every agent has a provider, Temperature in [0, 2] and MaxTokens &gt; 0; every
+    /// Workflow-pipeline agent has a model (a Board agent may leave it empty — see <see cref="ModelIsOptional"/>).</summary>
+    public bool IsValid() => AgentRoles.All.All(r => For(r.Key) is { } a
+        && !string.IsNullOrWhiteSpace(a.Provider)
+        && (ModelIsOptional(r.Key) || !string.IsNullOrWhiteSpace(a.Model))
+        && a.Temperature is >= 0 and <= 2
+        && a.MaxTokens > 0);
+
     /// <summary>Every configured agent, for cross-cutting checks (startup validation).</summary>
     public IEnumerable<AgentOptions> All()
     {
diff --git a/src/AgentOs.Modules.Pipeline/Agents/DependencyInjection.cs b/src/AgentOs.Modules.Pipeline/Agents/DependencyInjection.cs
index acadf06d..afa4388c 100644
--- a/src/AgentOs.Modules.Pipeline/Agents/DependencyInjection.cs
+++ b/src/AgentOs.Modules.Pipeline/Agents/DependencyInjection.cs
@@ -34,12 +34,8 @@ public static IServiceCollection AddAgents(this IServiceCollection services, ICo
         services.AddOptions<AgentsOptions>()
             .Bind(configuration.GetSection(AgentsOptions.SectionName))
             .Validate(
-                o => o.All().All(a =>
-                    !string.IsNullOrWhiteSpace(a.Provider)
-                    && !string.IsNullOrWhiteSpace(a.Model)
-                    && a.Temperature is >= 0 and <= 2
-                    && a.MaxTokens > 0),
-                "Agents:* — every agent needs a Provider and Model, Temperature in [0, 2], and MaxTokens > 0.")
+                o => o.IsValid(),
+                "Agents:* — every agent needs a Provider, Temperature in [0, 2] and MaxTokens > 0; every Workflow-pipeline agent needs a Model (a Board agent's empty Model = the computer's / provider's default).")
             .ValidateOnStart();
         // UI-first settings (ADR-0011): agent profiles + pipeline knobs, editable in the desktop.
         services.AddSingleton<AgentOs.Domain.Configuration.ISettingsContributor, AgentSettings>();
@@ -47,9 +43,12 @@ public static IServiceCollection AddAgents(this IServiceCollection services, ICo
         services.AddSingleton<AgentOs.Domain.Configuration.ISettingsContributor, Limits.RunLimitSettings>();
         services.TryAddSingleton<AgentOs.Domain.Pipeline.IRunAdmission>(sp =>
             new Limits.RunAdmission(sp.GetService<AgentOs.Domain.Configuration.ISettings>(), sp.GetService<TimeProvider>()));
+        // Values a renamed role saved under its former key (Decomposer → Discovery) keep applying until re-saved.
+        services.TryAddSingleton(sp => new LegacyAgentSettings(
+            sp.GetService<AgentOs.Modules.AppConfig.IAppConfigStore>(), sp.GetService<IConfiguration>()));
         services.AddSingleton<IAgentProfiles>(sp =>
             sp.GetService<AgentOs.Domain.Configuration.ISettings>() is { } settings
-                ? new SettingsAgentProfiles(settings, sp.GetService<IServiceScopeFactory>())
+                ? new SettingsAgentProfiles(settings, sp.GetService<IServiceScopeFactory>(), sp.GetService<LegacyAgentSettings>())
                 : StaticAgentProfiles.Instance);
 
         services.AddOptions<PipelineOptions>()
diff --git a/src/AgentOs.Modules.Pipeline/Agents/LegacyAgentSettings.cs b/src/AgentOs.Modules.Pipeline/Agents/LegacyAgentSettings.cs
new file mode 100644
index 00000000..e80b0329
--- /dev/null
+++ b/src/AgentOs.Modules.Pipeline/Agents/LegacyAgentSettings.cs
@@ -0,0 +1,89 @@
+// Keys an agent role had before the one-agent registry. "Decomposer" became "Discovery" (2026-10): a tenant's saved
+// Agents:Decomposer:* profile values (and the platform's, and an appsettings seed) keep working — read only while the
+// Discovery key itself has no stored value. Legacy keys are no longer declared in the settings registry (they would
+// show up as extra rows in Settings search), so they are read straight from the same rows SettingsService writes:
+// the tenant row, then the platform row, then the bootstrap configuration. Read-only, except a Reset in Agent profiles
+// also clears the tenant's legacy rows so the inherited value really comes back.
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Modules.AppConfig;
+using AgentOs.Modules.AppConfig.Settings;
+using Microsoft.Extensions.Configuration;
+
+namespace AgentOs.Modules.Pipeline.Agents;
+
+/// <summary>Reads (and resets) the values a role stored under its former key.</summary>
+public sealed class LegacyAgentSettings
+{
+    /// <summary>The former key of the Discovery role (profile key and prompt key).</summary>
+    public const string Decomposer = "Decomposer";
+
+    private static readonly string[] Fields =
+        [nameof(AgentOptions.Provider), nameof(AgentOptions.Model), nameof(AgentOptions.Temperature), nameof(AgentOptions.MaxTokens)];
+
+    private readonly IAppConfigStore? _store;
+    private readonly IConfiguration? _config;
+
+    /// <summary>Create. Without a store or configuration there is nothing legacy to read.</summary>
+    public LegacyAgentSettings(IAppConfigStore? store = null, IConfiguration? config = null)
+    {
+        _store = store;
+        _config = config;
+    }
+
+    /// <summary>The former key of <paramref name="role"/>, or null when it was never renamed.</summary>
+    public static string? LegacyRoleOf(string role) =>
+        string.Equals(role, AgentRoles.Discovery, StringComparison.Ordinal) ? Decomposer : null;
+
+    /// <summary><paramref name="role"/>'s <paramref name="field"/> saved under its former key (tenant → platform →
+    /// configuration), or null. Never throws: a store failure is "nothing legacy".</summary>
+    public async ValueTask<string?> ReadAsync(string role, string field, string? tenantId, CancellationToken ct = default)
+    {
+        if (LegacyRoleOf(role) is not { } legacy) { return null; }
+        var key = AgentSettings.Key(legacy, field);
+        if (_store is not null)
+        {
+            try
+            {
+                if (!string.IsNullOrWhiteSpace(tenantId)
+                    && await _store.GetForTenantAsync(tenantId, key, ct).ConfigureAwait(false) is { } t && !string.IsNullOrWhiteSpace(t))
+                {
+                    return t.Trim();
+                }
+                if (await _store.GetForTenantAsync(SettingsService.PlatformTenant, SettingsService.PlatformPrefix + key, ct).ConfigureAwait(false) is { } p
+                    && !string.IsNullOrWhiteSpace(p))
+                {
+                    return p.Trim();
+                }
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                _ = ex; // a legacy value is a courtesy: a failing store never breaks the current key's resolution
+            }
+        }
+        return _config?[key] is { } seed && !string.IsNullOrWhiteSpace(seed) ? seed.Trim() : null;
+    }
+
+    /// <summary>True when <paramref name="tenantId"/> (or the platform/configuration) still holds any legacy value of
+    /// <paramref name="role"/> — Agent profiles says so on the row.</summary>
+    public async ValueTask<bool> AnyAsync(string role, string? tenantId, CancellationToken ct = default)
+    {
+        foreach (var field in Fields)
+        {
+            if (await ReadAsync(role, field, tenantId, ct).ConfigureAwait(false) is not null) { return true; }
+        }
+        return false;
+    }
+
+    /// <summary>Delete the tenant's own legacy rows of <paramref name="role"/> (Agent profiles → Reset).</summary>
+    public async ValueTask ClearTenantAsync(string role, string tenantId, CancellationToken ct = default)
+    {
+        if (_store is null || LegacyRoleOf(role) is not { } legacy || string.IsNullOrWhiteSpace(tenantId)) { return; }
+        foreach (var field in Fields)
+        {
+            await _store.DeleteForTenantAsync(tenantId, AgentSettings.Key(legacy, field), ct).ConfigureAwait(false);
+        }
+    }
+}
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/AppConfigPromptOverrides.cs b/src/AgentOs.Modules.Pipeline/Prompts/AppConfigPromptOverrides.cs
index 19067247..48aa622b 100644
--- a/src/AgentOs.Modules.Pipeline/Prompts/AppConfigPromptOverrides.cs
+++ b/src/AgentOs.Modules.Pipeline/Prompts/AppConfigPromptOverrides.cs
@@ -42,6 +42,12 @@ public async Task<string> ResolveAsync(string agentKey, string defaultPrompt, Ca
         {
             var tenant = AmbientIdentity.Current?.TenantId ?? ITenantContext.DefaultTenantId;
             var overridden = await _config.GetForTenantAsync(tenant, Key(agentKey), cancellationToken).ConfigureAwait(false);
+            // A role renamed by the agent registry (Decomposer → Discovery): the override saved under its former key
+            // applies until one is saved under the new key.
+            if (string.IsNullOrWhiteSpace(overridden) && AgentOs.Modules.Pipeline.Agents.LegacyAgentSettings.LegacyRoleOf(agentKey) is { } legacy)
+            {
+                overridden = await _config.GetForTenantAsync(tenant, Key(legacy), cancellationToken).ConfigureAwait(false);
+            }
             return string.IsNullOrWhiteSpace(overridden) ? defaultPrompt : overridden;
         }
         catch (Microsoft.EntityFrameworkCore.DbUpdateException ex) { return OnLookupFailed(ex); }
diff --git a/src/AgentOs.Modules.Pipeline/Prompts/IPromptOverrideService.cs b/src/AgentOs.Modules.Pipeline/Prompts/IPromptOverrideService.cs
index 5d34485d..43171c53 100644
--- a/src/AgentOs.Modules.Pipeline/Prompts/IPromptOverrideService.cs
+++ b/src/AgentOs.Modules.Pipeline/Prompts/IPromptOverrideService.cs
@@ -32,8 +32,15 @@ internal sealed class PromptOverrideService(IAppConfigStore config, TimeProvider
     private readonly IAppConfigStore _config = config ?? throw new ArgumentNullException(nameof(config));
     private readonly TimeProvider _clock = clock ?? TimeProvider.System;
 
+    // A role renamed by the agent registry (Decomposer → Discovery) shows — and applies — the override saved under its
+    // former key until one is saved under the new key; Reset clears both.
     public async Task<string?> GetAsync(string tenantId, string agentKey, CancellationToken cancellationToken = default)
-        => await _config.GetForTenantAsync(tenantId, AppConfigPromptOverrides.Key(agentKey), cancellationToken).ConfigureAwait(false);
+    {
+        var value = await _config.GetForTenantAsync(tenantId, AppConfigPromptOverrides.Key(agentKey), cancellationToken).ConfigureAwait(false);
+        return string.IsNullOrWhiteSpace(value) && Agents.LegacyAgentSettings.LegacyRoleOf(agentKey) is { } legacy
+            ? await _config.GetForTenantAsync(tenantId, AppConfigPromptOverrides.Key(legacy), cancellationToken).ConfigureAwait(false)
+            : value;
+    }
 
     public async Task SetAsync(string tenantId, string agentKey, string prompt, string actor = "admin", CancellationToken cancellationToken = default)
     {
@@ -49,11 +56,20 @@ public async Task SetAsync(string tenantId, string agentKey, string prompt, stri
     public async Task ClearAsync(string tenantId, string agentKey, string actor = "admin", CancellationToken cancellationToken = default)
     {
         await _config.DeleteForTenantAsync(tenantId, AppConfigPromptOverrides.Key(agentKey), cancellationToken).ConfigureAwait(false);
+        if (Agents.LegacyAgentSettings.LegacyRoleOf(agentKey) is { } legacy)
+        {
+            await _config.DeleteForTenantAsync(tenantId, AppConfigPromptOverrides.Key(legacy), cancellationToken).ConfigureAwait(false);
+        }
         await RecordAsync(tenantId, agentKey, actor, string.Empty, cancellationToken).ConfigureAwait(false);
     }
 
     public async Task<IReadOnlyList<PromptVersion>> GetHistoryAsync(string tenantId, string agentKey, CancellationToken cancellationToken = default)
-        => WorkspaceRules.Parse(await _config.GetForTenantAsync(tenantId, WorkspaceRules.HistoryKey(agentKey), cancellationToken).ConfigureAwait(false));
+    {
+        var history = WorkspaceRules.Parse(await _config.GetForTenantAsync(tenantId, WorkspaceRules.HistoryKey(agentKey), cancellationToken).ConfigureAwait(false));
+        return history.Count == 0 && Agents.LegacyAgentSettings.LegacyRoleOf(agentKey) is { } legacy
+            ? WorkspaceRules.Parse(await _config.GetForTenantAsync(tenantId, WorkspaceRules.HistoryKey(legacy), cancellationToken).ConfigureAwait(false))
+            : history;
+    }
 
     private async Task RecordAsync(string tenantId, string agentKey, string actor, string text, CancellationToken ct)
     {
diff --git a/src/AgentOs.Modules.RemoteAgent/RemoteAgentLlmClient.cs b/src/AgentOs.Modules.RemoteAgent/RemoteAgentLlmClient.cs
index b7bae8bc..974abeec 100644
--- a/src/AgentOs.Modules.RemoteAgent/RemoteAgentLlmClient.cs
+++ b/src/AgentOs.Modules.RemoteAgent/RemoteAgentLlmClient.cs
@@ -33,6 +33,10 @@ public sealed class RemoteAgentLlmClient : ILlmClient
     /// <inheritdoc />
     public string Provider => "RemoteAgent";
 
+    /// <summary>The model a response reports when the request chose none and the member's CLI ran its own default
+    /// (metrics then show this name rather than an empty model).</summary>
+    public const string ComputerDefaultModel = "computer-default";
+
     public RemoteAgentLlmClient(IRemoteAgentBroker broker, IServiceProvider services, ILogger<RemoteAgentLlmClient> logger)
     {
         _broker = broker ?? throw new ArgumentNullException(nameof(broker));
@@ -53,7 +57,8 @@ public RemoteAgentLlmClient(IRemoteAgentBroker broker, IServiceProvider services
     public async Task<LlmResponse> SendAsync(LlmRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
-        request.Validate();
+        // No model chosen is valid here: the member's CLI then runs its own default model (the runner adds no flag).
+        request.ValidateAllowingNoModel();
 
         // Background session work (a Blazor circuit's Task.Run) has no HttpContext, so ITenantContext is
         // blank there; the session seeds AmbientIdentity so the dispatch targets the member's own runner.
@@ -140,7 +145,7 @@ void OnProgress(RemoteProgress p)
             OutputTokens: outTok,
             CostUsd: 0m,
             Latency: stopwatch.Elapsed,
-            Model: request.Model,
+            Model: string.IsNullOrWhiteSpace(request.Model) ? ComputerDefaultModel : request.Model,
             Provider: Provider)
         {
             CacheReadTokens = real ? result.CacheReadTokens ?? 0 : 0,
diff --git a/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor b/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
index b52b5784..afa7d624 100644
--- a/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
+++ b/src/AgentOs.Web/Components/Pages/AgentProfilesApp.razor
@@ -11,6 +11,7 @@
 @using AgentOs.Modules.Llm
 @using AgentOs.Modules.Pipeline.Agents
 @inject ISettings Settings
+@inject LegacyAgentSettings Legacy
 @inject AgentOs.Web.Shell.Services.ToastService Toasts
 
 @if (!_resolved)
@@ -64,6 +65,10 @@ else
                                     <strong title="@($"Role key: {row.Role}")">@row.Label</strong>
                                     <span class="agent-profiles-desc">@row.Description</span>
                                     <Badge Variant="@SourceVariant(row.Source)">@SourceLabel(row.Source)</Badge>
+                                    @if (row.Legacy)
+                                    {
+                                        <Badge Variant="Badge.BadgeVariant.Info">Saved as “@LegacyAgentSettings.Decomposer” — still applies</Badge>
+                                    }
                                 </span>
                             </span>
                         </td>
@@ -84,8 +89,9 @@ else
                         <td>
                             @* Simple view: every priced model, the provider inferred from the choice (ModelRouting). *@
                             <ModelPicker Value="@row.Model" ValueChanged="v => PickModel(row, v)" Provider="@(_advanced ? row.Provider : null)"
-                                         AriaLabel="@($"{row.Label} model")" Disabled="@locked" />
-                            <div class="prefs-hint">@PriceHint(row.Model)@(_advanced ? "" : $" · via {(row.Provider == "Anthropic" ? "Claude" : row.Provider)}")</div>
+                                         AriaLabel="@($"{row.Label} model")" Disabled="@locked"
+                                         AllowInherit="@row.ModelOptional" InheritLabel="Computer's default" />
+                            <div class="prefs-hint">@(string.IsNullOrWhiteSpace(row.Model) && row.ModelOptional ? AgentSettings.ComputersDefaultHelp : PriceHint(row.Model))@(_advanced ? "" : $" · via {(row.Provider == "Anthropic" ? "Claude" : row.Provider)}")</div>
                         </td>
                         @if (_advanced)
                         {
@@ -110,7 +116,7 @@ else
                         <td>
                             <div class="agent-profiles-actions">
                                 <Btn Size="Btn.ButtonSize.Sm" Variant="Btn.ButtonVariant.Primary" Disabled="@(locked || _saving)" OnClick="() => SaveRow(row)">Save</Btn>
-                                <Btn Size="Btn.ButtonSize.Sm" Disabled="@(locked || _saving || row.Source != SettingSource.Tenant)" OnClick="() => ResetRow(row)">Reset</Btn>
+                                <Btn Size="Btn.ButtonSize.Sm" Disabled="@(locked || _saving || (row.Source != SettingSource.Tenant && !row.Legacy))" OnClick="() => ResetRow(row)">Reset</Btn>
                             </div>
                         </td>
                     </tr>
@@ -178,6 +184,8 @@ else
         public string Label { get; } = info.Label;
         public string Description { get; } = info.Description;
         public AgentRoleGroup Group { get; } = info.Group;
+        public bool ModelOptional { get; } = AgentsOptions.ModelIsOptional(info.Key);
+        public bool Legacy { get; set; }
         public string Provider { get; set; } = string.Empty;
         public string Model { get; set; } = string.Empty;
         public string Temperature { get; set; } = string.Empty;
@@ -217,6 +225,19 @@ else
                 row.Source = Max(row.Source, v.Source);
                 row.IsLocked |= v.Source == SettingSource.Locked;
             }
+            // A renamed role (Decomposer → Discovery): a field with nothing stored under the new key shows — and uses —
+            // what the tenant saved under the former one, exactly as the agents resolve it.
+            if (LegacyAgentSettings.LegacyRoleOf(role) is not null)
+            {
+                foreach (var field in RoleFields.Where(f => byKey.GetValueOrDefault(AgentSettings.Key(role, f))?.Source is null or SettingSource.Default))
+                {
+                    if (await Legacy.ReadAsync(role, field, _tenantId) is { } old)
+                    {
+                        row.Loaded[field] = old;
+                        row.Legacy = true;
+                    }
+                }
+            }
             row.Provider = row.Loaded.GetValueOrDefault(ProviderField, string.Empty);
             row.Model = row.Loaded.GetValueOrDefault(ModelField, string.Empty);
             row.Temperature = row.Loaded.GetValueOrDefault(TemperatureField, string.Empty);
@@ -240,8 +261,12 @@ else
         await SaveAsync(row.Role, changes.Where(c => !string.Equals(c.Value, row.Loaded.GetValueOrDefault(c.Field), StringComparison.Ordinal)));
     }
 
-    private Task ResetRow(RoleRow row) =>
-        SaveAsync(row.Role, [(ProviderField, ""), (ModelField, ""), (TemperatureField, ""), (MaxTokensField, "")]);
+    private async Task ResetRow(RoleRow row)
+    {
+        // Reset returns to the inherited value — including what the row still carried under its former key.
+        if (row.Legacy) { await Legacy.ClearTenantAsync(row.Role, _tenantId); }
+        await SaveAsync(row.Role, [(ProviderField, ""), (ModelField, ""), (TemperatureField, ""), (MaxTokensField, "")]);
+    }
 
     private async Task SaveAsync(string role, IEnumerable<(string Field, string Value)> changes)
     {
diff --git a/src/AgentOs.Web/Components/UI/ModelPicker.razor b/src/AgentOs.Web/Components/UI/ModelPicker.razor
index 484de4cc..98672e5c 100644
--- a/src/AgentOs.Web/Components/UI/ModelPicker.razor
+++ b/src/AgentOs.Web/Components/UI/ModelPicker.razor
@@ -20,7 +20,7 @@ else
     <select class="prefs-select" disabled="@Disabled" aria-label="@AriaLabel" value="@SelectValue" @onchange="OnSelect">
         @if (AllowInherit)
         {
-            <option value="">— inherit —</option>
+            <option value="">@InheritLabel</option>
         }
         @if (IsUnlisted)
         {
@@ -55,6 +55,9 @@ else
     /// <summary>Offer an empty "inherit" choice (settings that may be cleared).</summary>
     [Parameter] public bool AllowInherit { get; set; }
 
+    /// <summary>The empty choice's text (e.g. "Computer's default" for an agent that may leave its model unset).</summary>
+    [Parameter] public string InheritLabel { get; set; } = "— inherit —";
+
     private bool _custom;
 
     private IReadOnlyList<string> Models => CostCalculator.KnownModelsFor(Provider);
diff --git a/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs b/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs
index 7a86b1af..0009c78a 100644
--- a/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs
+++ b/tests/AgentOs.Tests/Agents/BoardAgentRegistryTests.cs
@@ -109,7 +109,7 @@ public void Seeds_KeepTodaysBehaviour_OnTheMembersComputer(string role, int maxT
     {
         var seed = new AgentsOptions().For(role).ShouldNotBeNull();
         seed.Provider.ShouldBe("RemoteAgent");
-        seed.Model.ShouldBe("claude-sonnet-4-6");
+        seed.Model.ShouldBeEmpty();   // the computer's own model — never a pinned, older id
         seed.MaxTokens.ShouldBe(maxTokens);
     }
 
diff --git a/tests/AgentOs.Tests/Agents/ComputersDefaultModelTests.cs b/tests/AgentOs.Tests/Agents/ComputersDefaultModelTests.cs
new file mode 100644
index 00000000..d305da09
--- /dev/null
+++ b/tests/AgentOs.Tests/Agents/ComputersDefaultModelTests.cs
@@ -0,0 +1,289 @@
+// "Computer's default": a Board agent chooses NO model unless someone picks one. On a member's computer the request
+// reaches the runner with an empty model, so the CLI runs its own (newer) default — no `--model` flag; on our servers
+// the LLM gateway fills the provider's configured model before validation; an explicitly chosen model is still passed.
+// And the Decomposer → Discovery rename keeps a tenant's saved Decomposer profile and prompt working.
+
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using AgentOs.Domain.Configuration;
+using AgentOs.Domain.Llm;
+using AgentOs.Domain.Sessions;
+using AgentOs.Modules.AppConfig;
+using AgentOs.Modules.AppConfig.Settings;
+using AgentOs.Modules.Llm;
+using AgentOs.Modules.Pipeline.Agents;
+using AgentOs.Modules.Pipeline.Prompts;
+using AgentOs.Modules.RemoteAgent;
+using AgentOs.RemoteAgent;
+using AgentOs.SharedKernel.Identity;
+using Microsoft.Extensions.AI;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+using Shouldly;
+using Xunit;
+
+namespace AgentOs.Tests.Agents;
+
+public sealed class ComputersDefaultModelTests
+{
+    private const string Tenant = "acme";
+    private static readonly string[] ClaudeArgs = ["-p"];
+
+    private static AcceptanceRequest Change() => new(Guid.NewGuid(), Tenant, "u1",
+        new WorkRepo(Guid.NewGuid(), "acme", "shop", "main", "issue-7-ai-fix"), 7, "Checkout", "Pay by card.");
+
+    private const string Approve = """{"verdict":"approve","findings":[],"summary":"ok"}""";
+
+    private static SettingsService Settings(InMemoryAppConfigStore? store = null, IConfiguration? config = null) => new(
+        new SettingsCatalog([new LlmSettings(), new AgentSettings()]), store ?? new InMemoryAppConfigStore(),
+        config ?? new ConfigurationBuilder().Build(), new NullSettingsAuditSink(), NullLogger<SettingsService>.Instance);
+
+    // A factory whose every client is `client`.
+    private static ILlmClientFactory FactoryOf(ILlmClient client)
+    {
+        var factory = Substitute.For<ILlmClientFactory>();
+        factory.Create(Arg.Any<string>()).Returns(client);
+        return factory;
+    }
+
+    [Theory]
+    [InlineData(AgentRoles.Discovery)]
+    [InlineData(AgentRoles.IssueWork)]
+    [InlineData(AgentRoles.Reviewer)]
+    [InlineData(AgentRoles.Acceptance)]
+    [InlineData(AgentRoles.AutopilotOrchestrator)]
+    [InlineData(AgentRoles.Retrospective)]
+    public void BoardSeeds_ChooseNoModel_AndStartupValidationAcceptsIt(string role)
+    {
+        new AgentsOptions().For(role).ShouldNotBeNull().Model.ShouldBeEmpty();
+        AgentsOptions.ModelIsOptional(role).ShouldBeTrue();
+        new AgentsOptions().IsValid().ShouldBeTrue();
+    }
+
+    [Fact]
+    public void PipelineAgents_StillNeedAModel()
+    {
+        AgentsOptions.ModelIsOptional(AgentRoles.Qa).ShouldBeFalse();
+        new AgentsOptions { Qa = new AgentOptions { Model = " ", MaxTokens = 10 } }.IsValid().ShouldBeFalse();
+    }
+
+    // (a) default profile on RemoteAgent → the runner gets an empty model → the CLI gets no model flag.
+    [Fact]
+    public async Task DefaultProfile_OnTheMembersComputer_SendsNoModel_AndTheCliGetsNoFlag()
+    {
+        var broker = new InProcessRemoteAgentBroker();
+        using var reg = broker.RegisterRunner("conn-1", new RunnerConnection(Guid.NewGuid(), Tenant, "u1"));
+        RemoteExecRequest? sent = null;
+        broker.Dispatched += d =>
+        {
+            sent = d.Request;
+            broker.Complete(new RemoteExecResult(d.Request.Id, true, Approve, null));
+        };
+        var remote = new RemoteAgentLlmClient(broker, new ServiceCollection().BuildServiceProvider(), NullLogger<RemoteAgentLlmClient>.Instance);
+
+        ReviewVerdict verdict;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            verdict = await new ReviewAgent(FactoryOf(remote), NullLogger<ReviewAgent>.Instance,
+                profiles: new SettingsAgentProfiles(Settings())).RunAsync(Change());
+        }
+
+        verdict.Ran.ShouldBeTrue();
+        sent.ShouldNotBeNull().Model.ShouldBeEmpty();
+        CliModel.Flags("claude", sent.Model, ClaudeArgs).ShouldBeEmpty();
+        CliModel.Flags("codex", sent.Model, ClaudeArgs).ShouldBeEmpty();
+    }
+
+    // (b) default profile on a server provider → the provider's configured model; validation passes.
+    [Fact]
+    public async Task DefaultProfile_OnAServerProvider_UsesTheProvidersConfiguredModel()
+    {
+        ChatOptions? seen = null;
+        var chat = Substitute.For<IChatClient>();
+        chat.GetResponseAsync(Arg.Any<IEnumerable<ChatMessage>>(), Arg.Any<ChatOptions>(), Arg.Any<CancellationToken>())
+            .Returns(ci =>
+            {
+                seen = ci.ArgAt<ChatOptions>(1);
+                return new ChatResponse(new ChatMessage(ChatRole.Assistant, Approve)) { Usage = new UsageDetails { InputTokenCount = 1, OutputTokenCount = 1 } };
+            });
+        var claude = new PooledChatLlmClient("Claude", (_, _) => chat,
+            _ => ValueTask.FromResult<IReadOnlyList<string>>(["k1"]), new ApiKeyRouter(TimeProvider.System),
+            _ => false, _ => null, NullLogger.Instance, defaultModel: () => "claude-sonnet-5");
+        var settings = Settings();
+        (await settings.SetAsync(AgentSettings.Key(AgentRoles.Reviewer, "Provider"), "Claude", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+
+        ReviewVerdict verdict;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            verdict = await new ReviewAgent(FactoryOf(claude), NullLogger<ReviewAgent>.Instance,
+                profiles: new SettingsAgentProfiles(settings)).RunAsync(Change());
+        }
+
+        verdict.Ran.ShouldBeTrue();                          // no ArgumentException from LlmRequest.Validate
+        seen.ShouldNotBeNull().ModelId.ShouldBe("claude-sonnet-5");
+    }
+
+    [Fact]
+    public async Task ChatClient_EmptyModel_UsesItsDefault_AndAnExplicitModelWins()
+    {
+        var models = new List<string?>();
+        var chat = Substitute.For<IChatClient>();
+        chat.GetResponseAsync(Arg.Any<IEnumerable<ChatMessage>>(), Arg.Any<ChatOptions>(), Arg.Any<CancellationToken>())
+            .Returns(ci =>
+            {
+                models.Add(ci.ArgAt<ChatOptions>(1).ModelId);
+                return new ChatResponse(new ChatMessage(ChatRole.Assistant, "ok"));
+            });
+        var client = new ChatClientLlmClient(chat, "P", defaultModel: "gpt-5.4");
+
+        await client.SendAsync(new LlmRequest("s", "u", ""));
+        await client.SendAsync(new LlmRequest("s", "u", "gpt-4.1"));
+
+        models.ShouldBe(["gpt-5.4", "gpt-4.1"]);
+    }
+
+    [Fact]
+    public async Task ServerProvider_WithNoModelAnywhere_StillFailsValidation()
+    {
+        var client = new ChatClientLlmClient(Substitute.For<IChatClient>(), "P");
+
+        await Should.ThrowAsync<ArgumentException>(() => client.SendAsync(new LlmRequest("s", "u", "")));
+    }
+
+    // (c) an explicitly chosen model is passed to the CLI.
+    [Fact]
+    public async Task ChosenModel_OnTheMembersComputer_IsPassedToTheCli()
+    {
+        var broker = new InProcessRemoteAgentBroker();
+        using var reg = broker.RegisterRunner("conn-1", new RunnerConnection(Guid.NewGuid(), Tenant, "u1"));
+        RemoteExecRequest? sent = null;
+        broker.Dispatched += d =>
+        {
+            sent = d.Request;
+            broker.Complete(new RemoteExecResult(d.Request.Id, true, Approve, null));
+        };
+        var remote = new RemoteAgentLlmClient(broker, new ServiceCollection().BuildServiceProvider(), NullLogger<RemoteAgentLlmClient>.Instance);
+        var settings = Settings();
+        (await settings.SetAsync(AgentSettings.Key(AgentRoles.Reviewer, "Model"), "claude-opus-5-5", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            await new ReviewAgent(FactoryOf(remote), NullLogger<ReviewAgent>.Instance, profiles: new SettingsAgentProfiles(settings)).RunAsync(Change());
+        }
+
+        sent.ShouldNotBeNull().Model.ShouldBe("claude-opus-5-5");
+        CliModel.Flags("claude", sent.Model, ClaudeArgs).ShouldBe(["--model", "claude-opus-5-5"]);
+    }
+
+    [Fact]
+    public async Task RemoteAgent_NoModel_ReportsTheComputersDefault_InMetrics()
+    {
+        var broker = new InProcessRemoteAgentBroker();
+        using var reg = broker.RegisterRunner("conn-1", new RunnerConnection(Guid.NewGuid(), Tenant, "u1"));
+        broker.Dispatched += d => broker.Complete(new RemoteExecResult(d.Request.Id, true, "ok", null));
+        var remote = new RemoteAgentLlmClient(broker, new ServiceCollection().BuildServiceProvider(), NullLogger<RemoteAgentLlmClient>.Instance);
+
+        LlmResponse response;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            response = await remote.SendAsync(new LlmRequest("s", "u", ""));
+        }
+
+        response.Model.ShouldBe(RemoteAgentLlmClient.ComputerDefaultModel);
+    }
+
+    // ── Decomposer → Discovery: saved values keep working ───────────────────────────────────────
+
+    [Fact]
+    public async Task LegacyDecomposerProfile_AppliesToDiscovery_UntilDiscoveryIsSaved()
+    {
+        var store = new InMemoryAppConfigStore();
+        await store.SetForTenantAsync(Tenant, "Agents:Decomposer:Model", "claude-haiku-5-5");
+        await store.SetForTenantAsync(Tenant, "Agents:Decomposer:MaxTokens", "1234");
+        var settings = Settings(store);
+        var profiles = new SettingsAgentProfiles(settings, legacy: new LegacyAgentSettings(store));
+        var seed = new AgentsOptions().Discovery;
+
+        AgentOptions before, after, other;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            before = await profiles.ResolveAsync(AgentRoles.Discovery, seed);
+            (await settings.SetAsync(AgentSettings.Key(AgentRoles.Discovery, "Model"), "claude-opus-5-5", SettingScope.Tenant, Tenant, "admin")).Ok.ShouldBeTrue();
+            after = await profiles.ResolveAsync(AgentRoles.Discovery, seed);
+        }
+        using (AmbientIdentity.Push("globex", "u2"))
+        {
+            other = await profiles.ResolveAsync(AgentRoles.Discovery, seed);
+        }
+
+        before.Model.ShouldBe("claude-haiku-5-5");
+        before.MaxTokens.ShouldBe(1234);
+        after.Model.ShouldBe("claude-opus-5-5");   // the new key, once saved, wins
+        after.MaxTokens.ShouldBe(1234);            // fields not re-saved keep the legacy value
+        other.Model.ShouldBeEmpty();               // strictly per tenant
+        other.MaxTokens.ShouldBe(seed.MaxTokens);
+    }
+
+    [Fact]
+    public async Task LegacyDecomposerSeed_InConfiguration_AppliesToDiscovery()
+    {
+        var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?> { ["Agents:Decomposer:Provider"] = "AzureOpenAI" }).Build();
+        var profiles = new SettingsAgentProfiles(Settings(config: config), legacy: new LegacyAgentSettings(null, config));
+
+        (await profiles.ResolveAsync(AgentRoles.Discovery, new AgentsOptions().Discovery)).Provider.ShouldBe("AzureOpenAI");
+    }
+
+    [Fact]
+    public async Task LegacyDecomposerProfile_ResetClearsIt()
+    {
+        var store = new InMemoryAppConfigStore();
+        await store.SetForTenantAsync(Tenant, "Agents:Decomposer:Model", "claude-haiku-5-5");
+        var legacy = new LegacyAgentSettings(store);
+
+        (await legacy.AnyAsync(AgentRoles.Discovery, Tenant)).ShouldBeTrue();
+        await legacy.ClearTenantAsync(AgentRoles.Discovery, Tenant);
+
+        (await legacy.AnyAsync(AgentRoles.Discovery, Tenant)).ShouldBeFalse();
+        (await legacy.ReadAsync(AgentRoles.Reviewer, "Model", Tenant)).ShouldBeNull();   // only renamed roles have a former key
+    }
+
+    [Fact]
+    public async Task LegacyDecomposerPrompt_AppliesToDiscovery_ShowsInPrompts_AndResetClearsIt()
+    {
+        var store = new InMemoryAppConfigStore();
+        await store.SetForTenantAsync(Tenant, "prompt/Decomposer/system", "You are the Decomposition Agent of ACME.");
+        var resolver = new AppConfigPromptOverrides(NullLogger<AppConfigPromptOverrides>.Instance, store);
+        var service = new PromptOverrideService(store);
+
+        string resolved;
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            resolved = await resolver.ResolveAsync(AgentRoles.Discovery, DecomposerPrompt.System);
+        }
+        resolved.ShouldBe("You are the Decomposition Agent of ACME.");
+        (await service.GetAsync(Tenant, AgentRoles.Discovery)).ShouldBe("You are the Decomposition Agent of ACME.");
+
+        await service.ClearAsync(Tenant, AgentRoles.Discovery);
+
+        (await service.GetAsync(Tenant, AgentRoles.Discovery)).ShouldBeNull();
+        using (AmbientIdentity.Push(Tenant, "u1"))
+        {
+            (await resolver.ResolveAsync(AgentRoles.Discovery, DecomposerPrompt.System)).ShouldBe(DecomposerPrompt.System);
+        }
+    }
+
+    [Fact]
+    public async Task DiscoveryPromptSaved_WinsOverTheLegacyOne()
+    {
+        var store = new InMemoryAppConfigStore();
+        await store.SetForTenantAsync(Tenant, "prompt/Decomposer/system", "old");
+        var service = new PromptOverrideService(store);
+        await service.SetAsync(Tenant, AgentRoles.Discovery, "new");
+
+        (await service.GetAsync(Tenant, AgentRoles.Discovery)).ShouldBe("new");
+    }
+}
diff --git a/tests/AgentOs.Tests/Configuration/SettingsServiceTests.cs b/tests/AgentOs.Tests/Configuration/SettingsServiceTests.cs
index a3c93734..1701ed95 100644
--- a/tests/AgentOs.Tests/Configuration/SettingsServiceTests.cs
+++ b/tests/AgentOs.Tests/Configuration/SettingsServiceTests.cs
@@ -189,7 +189,8 @@ public void Catalog_RealModules_BuildWithoutConflicts_AndCoverEveryAgentRole()
         foreach (var (role, defaults) in AgentSettings.Roles)
         {
             catalog.TryGet(AgentSettings.Key(role, "Model"), out var model).ShouldBeTrue();
-            model.DefaultValue.ShouldBe(defaults.Model);
+            // A Board agent's empty seed is "no default" (the computer's / provider's model), never an empty-string value.
+            model.DefaultValue.ShouldBe(string.IsNullOrEmpty(defaults.Model) ? null : defaults.Model);
             catalog.TryGet(AgentSettings.Key(role, "MaxTokens"), out var max).ShouldBeTrue();
             max.Max.ShouldBe(AgentSettings.MaxOutputTokensCeiling);
         }