* Deterministic Markdown prompt trees (dataclass input/output, tool contracts)
* On‑disk overrides with hash checks; Git‑root discovery
* Event bus (ToolInvoked/PromptExecuted), reducers, rollbackable session state
* Built‑ins: planning, sandboxed VFS, Python‑eval (via asteval)
* Optional adapters: OpenAI/LiteLLM conversation loop + JSON‑Schema outputs