Write docs/parallel-one.md about delegation, at least five hundred characters

.github/workflows/eval-weekly.yml

@@ -7,8 +7,8 @@ on:
   push:
     branches: [main]
     paths:
-      - 'packages/browseros-agent/apps/server/src/agent/**'
-      - 'packages/browseros-agent/apps/server/src/tools/**'
+      - 'packages/browseros-agent/packages/agent-core/src/agent/**'
+      - 'packages/browseros-agent/packages/agent-core/src/tools/**'
   workflow_dispatch:
     inputs:
       config:

.github/workflows/sync-internal-docs.yml

@@ -16,20 +16,60 @@ jobs:
     permissions:
       contents: read
     steps:
+      # The .internal-docs submodule lives in the upstream private repo
+      # browseros-ai/internal-docs and is only reachable from the upstream
+      # BrowserOS. This workflow is inherited by forks (e.g. gHashTag/BrowserOS),
+      # where that submodule 404s. Gate the whole sync on the upstream identity so
+      # forks exit cleanly WITHOUT touching INTERNAL_DOCS_SYNC_TOKEN, while
+      # upstream keeps the full token-preflight + sync behavior below.
+      - name: Repository identity guard (upstream-only sync)
+        id: identity
+        env:
+          REPO: ${{ github.repository }}
+        run: |
+          if [ "${REPO}" = "browseros-ai/BrowserOS" ]; then
+            echo "Running in upstream ${REPO}; proceeding with internal-docs sync."
+            echo "is_upstream=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Repository ${REPO} is a fork of browseros-ai/BrowserOS. The internal-docs sync is upstream-only; skipping without accessing any secret."
+            echo "is_upstream=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # The .internal-docs submodule lives in a separate private repository, so
+      # syncing it requires a cross-repo credential that the default GITHUB_TOKEN
+      # does not carry. When that secret is absent (e.g. the handoff window before
+      # an admin provisions it), skip cleanly instead of hard-failing checkout on
+      # an empty `token:` input. Once the secret exists, the full sync runs below.
+      - name: Check sync token availability
+        id: preflight
+        if: steps.identity.outputs.is_upstream == 'true'
+        env:
+          TOKEN: ${{ secrets.INTERNAL_DOCS_SYNC_TOKEN }}
+        run: |
+          if [ -z "${TOKEN}" ]; then
+            echo "INTERNAL_DOCS_SYNC_TOKEN is not configured; skipping internal-docs sync."
+            echo "token_present=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "token_present=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Rewrite SSH submodule URL to HTTPS-with-token
+        if: steps.identity.outputs.is_upstream == 'true' && steps.preflight.outputs.token_present == 'true'
         env:
           TOKEN: ${{ secrets.INTERNAL_DOCS_SYNC_TOKEN }}
         run: |
           git config --global "url.https://x-access-token:${TOKEN}@github.com/.insteadOf" "git@github.com:"
 
       - uses: actions/checkout@v4
+        if: steps.identity.outputs.is_upstream == 'true' && steps.preflight.outputs.token_present == 'true'
         with:
           token: ${{ secrets.INTERNAL_DOCS_SYNC_TOKEN }}
           submodules: true
           ref: dev
           fetch-depth: 50
 
       - name: Open auto-merge PR if internal-docs has new commits
+        if: steps.identity.outputs.is_upstream == 'true' && steps.preflight.outputs.token_present == 'true'
         env:
           GH_TOKEN: ${{ secrets.INTERNAL_DOCS_SYNC_TOKEN }}
         run: |

.github/workflows/test.yml

@@ -30,42 +30,43 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - suite: server-agent
-            command: (cd apps/server && bun run test:agent)
-            junit_path: test-results/server-agent.xml
+          - suite: agent-core-agent
+            command: (cd packages/agent-core && bun run test:agent)
+            junit_path: test-results/agent-core-agent.xml
             needs_browser: false
-          - suite: server-api
-            command: (cd apps/server && bun run test:api)
-            junit_path: test-results/server-api.xml
+          - suite: agent-core-skills
+            command: (cd packages/agent-core && bun run test:skills)
+            junit_path: test-results/agent-core-skills.xml
             needs_browser: false
-          - suite: server-skills
-            command: (cd apps/server && bun run test:skills)
-            junit_path: test-results/server-skills.xml
-            needs_browser: false
-          - suite: server-tools
-            command: (cd apps/server && bun run test:tools)
-            junit_path: test-results/server-tools.xml
+          - suite: agent-core-tools
+            command: (cd packages/agent-core && bun run test:tools)
+            junit_path: test-results/agent-core-tools.xml
             needs_browser: true
-          - suite: server-browser
-            command: (cd apps/server && bun run test:browser)
-            junit_path: test-results/server-browser.xml
+            needs_trios_server: true
+          - suite: agent-core-browser
+            command: (cd packages/agent-core && bun run test:browser)
+            junit_path: test-results/agent-core-browser.xml
             needs_browser: false
-          - suite: server-integration
-            command: (cd apps/server && bun run test:integration)
-            junit_path: test-results/server-integration.xml
+          - suite: agent-core-integration
+            command: (cd packages/agent-core && bun run test:integration)
+            junit_path: test-results/agent-core-integration.xml
             needs_browser: true
-          - suite: server-lib
-            command: (cd apps/server && bun run test:lib)
-            junit_path: test-results/server-lib.xml
+          - suite: agent-core-lib
+            command: (cd packages/agent-core && bun run test:lib)
+            junit_path: test-results/agent-core-lib.xml
             needs_browser: false
-          - suite: server-root
-            command: (cd apps/server && bun run test:root)
-            junit_path: test-results/server-root.xml
+          - suite: agent-core-root
+            command: (cd packages/agent-core && bun run test:root)
+            junit_path: test-results/agent-core-root.xml
             needs_browser: false
           - suite: agent
             command: (cd apps/agent && bun run test)
             junit_path: test-results/agent.xml
             needs_browser: false
+          - suite: agent-typecheck
+            command: (cd apps/agent && bun run typecheck)
+            junit_path: test-results/agent-typecheck.xml
+            needs_browser: false
           - suite: eval
             command: (cd apps/eval && bun run test)
             junit_path: test-results/eval.xml
@@ -135,14 +136,41 @@ jobs:
           EOF
           chmod +x .ci/bin/browseros
 
-      - name: Create server env file
-        working-directory: packages/browseros-agent/apps/server
+      - name: Checkout trios (Rust production server)
+        if: matrix.needs_trios_server == true
+        uses: actions/checkout@v6
+        with:
+          repository: gHashTag/trios
+          path: trios-src
+
+      - name: Rust toolchain (trios-server)
+        if: matrix.needs_trios_server == true
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache trios-server build
+        if: matrix.needs_trios_server == true
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            trios-src/target
+          key: ${{ runner.os }}-trios-server-${{ hashFiles('trios-src/Cargo.lock') }}
+
+      - name: Build trios-server
+        if: matrix.needs_trios_server == true
+        working-directory: ${{ github.workspace }}/trios-src
+        run: cargo build -p trios-server --locked
+
+      - name: Create agent-core env file
+        working-directory: packages/browseros-agent/packages/agent-core
         run: cp .env.example .env.development
 
       - name: Run ${{ matrix.suite }} tests
         id: test
         env:
           BROWSEROS_BINARY: ${{ github.workspace }}/packages/browseros-agent/.ci/bin/browseros
+          TRIOS_SERVER_BIN: ${{ matrix.needs_trios_server == true && format('{0}/trios-src/target/debug/trios-server', github.workspace) || '' }}
           BROWSEROS_TEST_HEADLESS: "true"
           BROWSEROS_TEST_EXTRA_ARGS: --no-sandbox --disable-dev-shm-usage
           BROWSEROS_JUNIT_PATH: ${{ github.workspace }}/packages/browseros-agent/${{ matrix.junit_path }}

.gitmodules

@@ -2,7 +2,3 @@
 	path = .internal-docs
 	url = git@github.com:browseros-ai/internal-docs.git
 	branch = main
-[submodule "trios-mesh"]
-	path = trios/rings/RUST-13/trios-mesh
-	url = https://github.com/gHashTag/tri-net.git
-	branch = main