What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

id	13707
title	Fan-out config coherence: single-subagent ask-gate + §swarm_topology_anchor (follow-up to #13699)
state	Closed
labels	aiarchitecture
assignees	neo-opus-ada
createdAt	Jun 21, 2026, 6:07 AM
updatedAt	Jun 21, 2026, 6:28 AM
githubUrl	https://github.com/neomjs/neo/issues/13707
author	neo-opus-ada
commentsCount	0
parentIssue	null
subIssues	[]
subIssuesCompleted	0
subIssuesTotal	0
contentTrust
projected
quarantined	0
signals	[]
blockedBy	[]
blocking	[]
closedAt	Jun 21, 2026, 6:28 AM

Fan-out config coherence: single-subagent ask-gate + §swarm_topology_anchor (follow-up to #13699)

Closed v13.1.0/archive-v13-1-0-chunk-4 aiarchitecture

neo-opus-ada commented on Jun 21, 2026, 6:07 AM

Context

#13698 / PR #13699 (merged, 77bfadc34) forbade Agent/Task/Workflow fan-out in .claude/settings.template.json via permissions.deny. After that merge, @tobiu's a-vs-b ruling (2026-06-21) refined the policy:

Official Workflows + fan-out (multiple parallel subagents) = absolute forbid (only exception: a manual, temporary settings change <10h before a weekly reset with budget to spare).
A SINGLE subagent = allowed ONLY on the operator's explicit in-session permission (rarely granted; the hybrid-GraphRAG V-B-A tools obviate fan-out).

The merged #13699 has Agent + Task in permissions.deny (absolute), which blocks the single-subagent-on-permission the operator approved. This is a coherence follow-up: relax Agent/Task to an ask-gate, plus the §swarm_topology_anchor update @neo-opus-grace flagged on the #13699 review (the config↔anchor contradiction — the anchor still said "tactical subagents when operator requests = fine").

The Fix

.claude/settings.template.json: permissions.deny = ["Bash(gh pr merge *)", "Workflow"]; add permissions.ask = ["Agent", "Task"]; refine the autoMode.hard_deny NL rule (Workflow/fan-out forbid; single subagent on explicit permission).
AGENTS.md §swarm_topology_anchor boundary: rewrite to fan-out/Workflow absolute-forbid + single tactical subagent only on explicit operator permission.

Acceptance Criteria

settings.template.json: Workflow hard-denied; Agent/Task ask-gated; hard_deny NL refined.
AGENTS.md §swarm_topology_anchor boundary matches the config.
JSON valid; AGENTS.md byte-budget respected.

Surfaced by @neo-opus-ada; operator-directed (the a-vs-b ruling). Sibling: #13698 / #13699.