LLM-as-judge grader with prompt-injection defense and structured tool-use output

Execute a single tool: validate → permission-check → invoke → format result

Document chunking — fixed / semantic (Intl.Segmenter) / markdown strategies

Federation peer lookup: DNS SRV + .well-known/crewhaus.json with TTL caching (Section 34)

Pillar-3 sink-side chokepoint — classify content leaving via external sinks (fetch / web / mcp / channel / federation / evm-tx) against the data-lineage carried in run-context

Per-run / per-tenant USD aggregation: subscribes to model_response events, emits cost_accrual TraceEvents

Built-in Bash tool: spawns shell commands via Bun.spawn with a default 30s timeout

Model-summarize-then-replace conversation compaction

Partition tool_use blocks into concurrent batches and serial calls based on catalog metadata

M4.2 — persistent cross-session memory store. File-backed JSONL with simple BM25-style text search. Per-spec scoped.

Pure middle-message removal with tool-use/result orphan defense

Codegen for the CRW target — emits a daemon + per-role agent files driven by crew-orchestrator (Section 22)

Split-aware dataset versioning: train/dev/test with hash-stable sample identifiers and split-leak prevention

Codegen for the MGD target — daemon.ts wiring gateway-server, policy-engine, tenancy, audit-log

Codegen for the VOICE target — emits a realtime daemon (Section 24 VOICE)

JSON-RPC wire protocol for the managed-daemon gateway — versioned envelope + Zod schemas

Codegen for the GRPH target shape — emits a graph-engine bundle with checkpoint-store wired in

Multi-dimensional token-bucket / leaky-bucket rate limiter (per-tenant, per-provider, per-tool)

Lazy-loaded SKILL.md catalog with frontmatter parsing and a Skill(name) tool

Pluggable secrets backend with rotation + audit-log integration: env-var, file, vault