release: Code Nest v2.4.0 unified backend agent runtime

[xiaou61]

Summary

• Add the unified backend Agent runtime behind POST /admin/agent/chat.
• Keep the admin frontend as a thin chat and confirmation surface.
• Route natural language through LLM planning, the generic AgentToolRegistry, policy, preview, confirmation, execution, and audit.
• Prepare the repository and all package metadata for v2.4.0.

Scope

• Current production registry: 26/26 tools covered by the unified entry point.
• Write tools: chat.userBan.unban and system.operationLog.cleanExpired verified through PREVIEW -> CONFIRMED -> EXECUTED.
• This release does not claim that business APIs not registered as AgentTool are already callable through natural language.

Security

• Tool candidates are revalidated against registry, schema, permissions, role/tenant policy, and risk policy before execution.
• Write and destructive actions require an exact confirmation phrase and an operator-owned audit record.
• Session storage keys are namespaced by administrator ID; request sizes are validated before planner invocation.
• Real AI credentials were injected only through process environment variables and are not stored in the repository or reports.

Migration

Run the following for an existing database:

1. sql/v2.4.0/admin_agent_audit.sql
2. sql/v2.4.0/admin_agent_audit_idempotency.sql
3. sql/v2.4.0/admin_agent_session_context.sql
4. sql/v2.4.0/admin_agent_permissions.sql

Verification

• scripts/code-nest-eval.ps1 -Tier all: passed.
• scripts/agent-runtime-eval.ps1: 215 Agent tests, zero failures/errors, 3 opt-in live tests skipped; AI Prompt/Schema 19/19; frontend thin boundary 11/11.
• scripts/code-nest-eval.ps1 -Tier release: passed after final security hardening.
• Real gpt-5.5 acceptance: 26/26 registered production tools passed; real write scenarios verified against isolated MySQL with audit and business-state checks.
• Hygiene: whitespace, secret, and NUL scans passed.

Rollback

• Restore the previous backend Jar and both frontend bundles with the existing production release script.
• The new audit/session tables and permission seeds are additive and may remain in place during an application rollback.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.