chore(release): prepare 0.28.0

.github/CODEOWNERS

@@ -8,23 +8,23 @@
 # breaking-change regressions (e.g. pydantic 2.13 alias serialization).
 
 # Default fallback: project owner reviews everything not matched below.
-*                                @Pythoughts-labs
+*                                @elkaix
 
 # Dependency surfaces: explicit owner.
-pyproject.toml                   @Pythoughts-labs
-uv.lock                          @Pythoughts-labs
-**/pyproject.toml                @Pythoughts-labs
-**/uv.lock                       @Pythoughts-labs
-package.json                     @Pythoughts-labs
-package-lock.json                @Pythoughts-labs
-**/package.json                  @Pythoughts-labs
-**/package-lock.json             @Pythoughts-labs
+pyproject.toml                   @elkaix
+uv.lock                          @elkaix
+**/pyproject.toml                @elkaix
+**/uv.lock                       @elkaix
+package.json                     @elkaix
+package-lock.json                @elkaix
+**/package.json                  @elkaix
+**/package-lock.json             @elkaix
 
 # Telemetry & monitoring config — contractual changes need a closer look.
-src/pythinker_code/telemetry/    @Pythoughts-labs
-docs/en/reference/telemetry.md   @Pythoughts-labs
+src/pythinker_code/telemetry/    @elkaix
+docs/en/reference/telemetry.md   @elkaix
 
 # CI workflows — branch protection / required-status-check changes shouldn't
 # slip in unnoticed.
-.github/workflows/               @Pythoughts-labs
-.github/CODEOWNERS               @Pythoughts-labs
+.github/workflows/               @elkaix
+.github/CODEOWNERS               @elkaix

AGENTS.md

@@ -284,9 +284,10 @@ everything sequentially.
   - `implementer`: tightly scoped edits from a concrete brief; no drive-by refactors.
   - `review`: severity-scored read-only critique with suggested fixes.
   - `verifier`: run tests/lint/build gates and report PASS / FAIL / FLAKY without fixing.
+  - `judge`: independent final quality gate for non-trivial code changes, reports, and findings.
 - **Steer with complete prompts**: new subagents do not inherit the full parent transcript by
   default. Include goal, scope, paths, constraints, success criteria, and expected output.
-- **Use map-reduce workflows**: scout -> plan -> implement -> review -> fix -> verify.
+- **Use map-reduce workflows**: scout -> plan -> implement -> review -> fix -> verify -> judge.
 - **Verify evidence**: after reads, confirm exact paths/line ranges; after grep, confirm relevance;
   after shell, inspect stdout/stderr; after subagent reports, cross-check at least one load-bearing
   finding directly.

CHANGELOG.md

@@ -15,6 +15,14 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 ## Unreleased
 
+### Changed
+
+- **`.pythinker/AGENTS.md` is no longer loaded as project instructions.** Only `AGENTS.md`/`agents.md` from the project root down to the working directory are merged. Move any instructions kept solely in `.pythinker/AGENTS.md` to a root or directory-level `AGENTS.md`.
+
+### Security
+
+- **Read-only subagent profiles now block network shell commands.** The `read_only`/`plan`/`review`/`verify` permission profiles deny `curl`/`wget`/`ssh`/`git fetch` and similar network clients, so a read-only agent's no-web-tools intent cannot be bypassed through the Shell tool.
+
 ## 0.28.0 (2026-05-31)
 
 ### What changed in this release

docs/en/customization/agents.md

@@ -107,7 +107,7 @@ The system prompt file is a Markdown template that can use `${VAR}` syntax to re
 | `${PYTHINKER_NOW}` | Current time (ISO format) |
 | `${PYTHINKER_WORK_DIR}` | Working directory path |
 | `${PYTHINKER_WORK_DIR_LS}` | Working directory file list |
-| `${PYTHINKER_AGENTS_MD}` | Merged `AGENTS.md` content from project root to working directory (including `.pythinker/AGENTS.md`) |
+| `${PYTHINKER_AGENTS_MD}` | Merged `AGENTS.md` content from project root to working directory |
 | `${PYTHINKER_SKILLS}` | Loaded skills list |
 | `${PYTHINKER_ADDITIONAL_DIRS_INFO}` | Information about additional directories added via `--add-dir` or `/add-dir` |
 
@@ -164,13 +164,20 @@ agent:
 
 ## Built-in subagent types
 
-The default agent configuration includes three built-in subagent types, each with different tool policies and use cases:
+The default agent configuration includes focused built-in subagent types with different tool policies and use cases:
 
 | Type | Purpose | Available tools |
 |------|---------|----------------|
-| `coder` | General software engineering: read/write files, run commands, search code | `Shell`, `ReadFile`, `ReadMediaFile`, `Glob`, `Grep`, `WriteFile`, `StrReplaceFile`, `SearchWeb`, `FetchURL` |
-| `explore` | Fast read-only codebase exploration: search, read, summarize | `Shell`, `ReadFile`, `ReadMediaFile`, `Glob`, `Grep`, `SearchWeb`, `FetchURL` (no write tools) |
-| `plan` | Implementation planning and architecture design: analyze files, create plans | `ReadFile`, `ReadMediaFile`, `Glob`, `Grep`, `SearchWeb`, `FetchURL` (no Shell, no write tools) |
+| `coder` | General software engineering with judgment: read/write files, run commands, search code | Read/search tools, `Shell`, write tools, web tools |
+| `implementer` | Scoped implementation with minimal edits and quick verification | Read/search tools, `Shell`, write tools, web tools |
+| `explore` | Fast read-only codebase exploration: search, read, summarize | Read/search tools, `Shell`, web tools; no write tools |
+| `plan` | Implementation planning and architecture design | Read/search tools and web tools; no write tools |
+| `review` | Read-only severity-scored code review | Read/search tools, `Shell`, web tools; no write tools |
+| `code-reviewer` | Diff-focused code review for the current branch | Read/search tools, `Shell`, web tools; no write tools |
+| `security-reviewer` | Diff-focused security review with validated findings | Read/search tools, `Shell`, web tools; no write tools |
+| `debugger` | Root-cause analysis for failures, logs, and stack traces | Read/search tools and `Shell`; no write tools |
+| `verifier` | Read-only validation runner for tests, lint, type checks, and builds | Read/search tools and `Shell`; no write tools |
+| `judge` | Independent final quality gate for answers, reports, and code-change summaries | Read/search tools and `Shell`; no write tools |
 
 All subagent types are prohibited from nesting the `Agent` tool (subagents cannot create their own subagents). The `Agent` tool is only available to the root agent.
 
@@ -190,7 +197,7 @@ The following are all built-in tools in Pythinker Code.
 ### `Agent`
 
 - **Path**: `pythinker_code.tools.agent:Agent`
-- **Description**: Start or resume a subagent instance for a focused task. Three built-in subagent types are available: `coder` (general software engineering), `explore` (fast read-only codebase exploration), and `plan` (implementation planning and architecture design). Each instance maintains its own context history and supports foreground or background execution.
+- **Description**: Start or resume a subagent instance for a focused task. Multiple built-in subagent types are available — for example `coder`, `implementer`, `explore`, `plan`, `review`, `code-reviewer`, `security-reviewer`, `debugger`, `verifier`, and `judge`; see the built-in subagent types table above for each one's tool policy. Each instance maintains its own context history and supports foreground or background execution.
 
 | Parameter | Type | Description |
 |-----------|------|-------------|

packages/linux-installer/README.md

@@ -36,7 +36,7 @@ file at `/usr/share/doc/pythinker-code/LICENSE`.
 ## Build
 
 ```sh
-bash packages/linux-installer/build.sh 0.27.0
+bash packages/linux-installer/build.sh 0.28.0
 ```
 
 Outputs to `dist/`:

src/pythinker_code/agents/default/agent.yaml

@@ -56,6 +56,9 @@ agent:
     implementer:
       path: ./implementer.yaml
       description: "Scoped implementation with minimal edits and verification."
+    judge:
+      path: ./judge.yaml
+      description: "Independent final quality gate for answers, reports, and code-change summaries."
     verifier:
       path: ./verifier.yaml
       description: "Read-only validation runner for tests, lint, and builds."

src/pythinker_code/agents/default/judge.yaml

@@ -0,0 +1,56 @@
+version: 1
+agent:
+  extend: ./agent.yaml
+  system_prompt_args:
+    ROLE_ADDITIONAL: |
+      You are now running as a subagent. All `user` messages are sent by the main agent, which sees only your final message when you finish. Treat the parent as your caller; do not ask the end user questions.
+
+      You are an independent LLM-as-judge quality gate — the parent's last check before it delivers a non-trivial answer, report, findings set, or code-change summary. You did not produce this work, so judge it cold. Read-only by convention: never patch code, update snapshots, or fix lint; if a fix is needed, describe it.
+
+      Be efficient: make one focused pass that gates the parent's evidence. Spot-check load-bearing claims against the diff, files, and tool output the parent provided; do not re-run full test suites or re-derive the analysis.
+
+      Rubric — judge against these criteria, and default to NEEDS_WORK when a load-bearing claim is unsupported:
+      - Evidence: every material claim is backed by a cited file, diff, command, or tool output. For external-API or "best practice" claims, require the parent's citation and flag its absence; as a cheap final gate you do not re-verify those claims yourself.
+      - Fidelity: the draft summary matches the actual diff and changes, with no overclaiming.
+      - Verification: the checks the parent ran are relevant to the change and actually ran, not assumed.
+      - Safety and scope: no unsafe or destructive action, no secret or PII exposure, no scope creep beyond the request.
+      - Findings quality: for reports, each finding is actionable, correctly severity-ranked, and anchored to evidence.
+      Do not rubber-stamp, and do not pad: prefer a few concrete blockers over broad style notes.
+
+      Verdicts:
+      - PASS: sound; at most minor wording nits remain.
+      - NEEDS_WORK: correctness, evidence, fidelity, verification, safety, or scope must be fixed first.
+      - BLOCKED: required evidence is missing or unavailable, so completion cannot be claimed.
+
+      Final response contract:
+      ### SUMMARY
+      Start with `PASS`, `NEEDS_WORK`, or `BLOCKED`, then one paragraph explaining the decision.
+      ### EVIDENCE
+      Bullet list of the files, diffs, commands, or parent-provided artifacts you actually checked.
+      ### REQUIRED FIXES
+      Concrete fixes required before delivery, or `None.`.
+      ### OPTIONAL IMPROVEMENTS
+      Non-blocking clarity or polish suggestions, or `None.`.
+      ### BLOCKERS
+      Missing evidence or capabilities that prevented a full judgment, or `None.`.
+  when_to_use: |
+    Use this agent as an independent final quality gate before delivering non-trivial code changes, reports, audits, or findings to the user. It judges the parent agent's evidence, actions, and proposed final answer without applying fixes.
+  allowed_tools:
+    - "pythinker_code.tools.shell:Shell"
+    - "pythinker_code.tools.todo:SetTodoList"
+    - "pythinker_code.tools.file:ReadFile"
+    - "pythinker_code.tools.file:ReadMediaFile"
+    - "pythinker_code.tools.file:Glob"
+    - "pythinker_code.tools.file:Grep"
+    - "pythinker_code.tools.file:SmartSearch"
+    - "pythinker_code.tools.skill:ReadSkill"
+  exclude_tools:
+    - "pythinker_code.tools.agent:Agent"
+    - "pythinker_code.tools.ask_user:AskUserQuestion"
+    - "pythinker_code.tools.plan:ExitPlanMode"
+    - "pythinker_code.tools.plan.enter:EnterPlanMode"
+    - "pythinker_code.tools.file:WriteFile"
+    - "pythinker_code.tools.file:StrReplaceFile"
+    - "pythinker_code.tools.web:SearchWeb"
+    - "pythinker_code.tools.web:FetchURL"
+  subagents:

src/pythinker_code/agents/default/plan.yaml

@@ -18,7 +18,7 @@ agent:
       - Identify likely files/modules and why they are in scope.
       - Provide a Task Dependency Graph: each task, what it depends on, and the reason.
       - Provide a Parallel Execution Graph: which tasks can run together, which must be sequential, and the critical path.
-      - For every task, include artifacts to change, acceptance criteria, suggested specialist (`explore`, `implementer`, `review`, `security-reviewer`, `debugger`, `verifier`), and the smallest verification command/check.
+      - For every task, include artifacts to change, acceptance criteria, suggested specialist (`explore`, `implementer`, `review`, `security-reviewer`, `debugger`, `verifier`, `judge`), and the smallest verification command/check.
       - Call out risks, blockers, migration/backward-compatibility concerns, and test gaps.
 
       Library/API freshness (run BEFORE recommending an external dependency or API surface):