feat: the orchestrating agent

Entry point for the estate: understands a request, consults the specialists
that can settle it, composes one answer. LangGraph 1.2.11, a2a-sdk 1.1.2, both
current as of August 2026.

It holds no data, and the realm is what enforces that rather than the prompt.
classic-models-agent-assistant is granted two optional scopes — one per
specialist, plus the inference endpoint — and every domain audience it could
request comes back Invalid scopes. An injection that succeeds here finds no
path to a domain because there is none. "No scopes at all" was too absolute:
the agent has to reason, and inference is not a domain.

The two-hop token chain was the heaviest unproven thing in the design and it
holds: sub stays the end user through all four hops, so their own roles apply
at the far end and the MCP server filters tool discovery for the right human.
azp names the last agent, not the first — Keycloak accepts actor_token and
emits no act claim, so an orchestrator's identity survives only in the traces.

Verified end to end: a routed question answered from the specialist's data; a
question outside every remit refused rather than answered from memory; and a
write proposed through the orchestrator, held by the specialist in
input-required, relayed here unchanged, approved by the user through the same
conversation, and written. The orchestrator never owns that decision.

The graph is plan → delegate → plan, tools described by what a specialist
decides rather than what it holds, delegations in one step run concurrently and
capped at eight counted in calls. Rebuilt per turn, because its tools carry the
user's token.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -33,6 +33,16 @@ rebuilding it loses in-memory checkpoints (langchain-mcp-adapters #172, #194,
 #235). This agent has no MCP servers, so it is not affected — but do not copy an
 MCP pattern from here into a specialist.
 
+**"No scopes at all" was too absolute.** The agent has to reason, so it holds
+`llm-proxy-audience` as well as one audience per specialist. Inference is not a
+domain. What the rule means, and what the realm enforces, is that no *domain*
+audience is reachable from here.
+
+`Answer.needs_the_user` is the other thing not to lose: a specialist that parks
+a decision must have its message relayed unchanged. Paraphrasing a proposed
+write hides what is about to happen, and approving it here would move the
+decision to the component with the weakest standing to make it.
+
 ## Before writing code
 
 Read `classic-models-agent-platform/CLAUDE.md` first. It holds the identity
@@ -41,10 +51,13 @@ blockers. This file only covers what is specific to this agent.
 
 ## Non-negotiables
 
-- **Inference goes through the Kong AI gateway**, `https://llm-dev.sttlab.local/llm/v1/chat/completions`.
-  Calling a provider directly bypasses the rate limits and prompt guards.
-- **One MCP client per conversation turn**, built with freshly exchanged tokens.
-  Do not hold a long-lived MCP connection with a fixed token.
+- **Inference goes through the estate's LLM endpoint**, `https://llm-dev.sttlab.local/llm/v1/chat/completions`.
+  Calling a model provider directly bypasses the rate limits and prompt guards.
+- **One client per conversation turn**, built with freshly exchanged tokens.
+  Here that is the A2A client and the graph itself: both carry the user's token.
+- **Never name the middleware.** The agent talks to URLs that honour a contract.
+  Write "the MCP server", "the LLM endpoint", "the gateway" — never a product
+  name, in code, comments, commits or docs.
 - **A2A calls return answers, not data.** Expose narrow decision-shaped skills,
   never a generic `query`.
 - Deliverables in English.