From 4ee1bccff94e4bcd5f8e6798762b0aafb6ec3466 Mon Sep 17 00:00:00 2001
From: Akshaya Shanbhogue <akshaya.shanbhogue@uipath.com>
Date: Mon, 21 Sep 2026 16:04:22 -0700
Subject: [PATCH 1/3] feat(agents): port the Delegate agent from
 coder_eval_uipath as a built-in
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds `delegate` as a built-in agent (AgentKind.DELEGATE / DelegateAgentConfig),
registered unconditionally like codex/antigravity, wrapping the now-public
@uipath/delegate-sdk via a first-party Node stdio host
(src/coder_eval/agents/delegate/delegate_host.mjs) since the internal-only
@uipath/delegate-stdio host isn't public. Full turn lifecycle, transcript/
token accounting, pricing table, docs (docs/agents/DELEGATE.md), example
tasks (tasks/delegate/*.yaml), and unit/registration/live test suites — SDK
event field shapes are marked `# UNVERIFIED` pending a real backend run
(excluded from golden-master coverage, covered by
tests/test_delegate_agent_live.py under -m live).

Also adds a Delegate live-integration CI job (pr-checks.yml) that mints a
fresh access token via the OAuth2 Resource Owner Password Credentials
(ROPC) grant (mirroring coder_eval_uipath's refresh-auth.sh) and runs
tasks/delegate/fizzbuzz_delegate.yaml end to end against a real backend on
every PR, with a presence-check gate so a missing secret skips cleanly
instead of failing a required check. The mint destination is resolved from
a fixed choice-input allowlist rather than a free-form URL, closing a
credential-exfiltration path a free-form workflow_dispatch string would
otherwise open.

Bumps anyio 4.13.0 -> 4.15.1 for two newly-disclosed CVEs
(CVE-2026-63374, CVE-2026-64847), both fixed in 4.14.2+.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .claude/harness-candidates.md                 |  13 +
 .claude/notes/agents.md                       | 108 ++
 .env.example                                  |  24 +
 .github/pages-stub/index.html                 |   4 +-
 .../scripts/diagnose_delegate_token_claims.py |  46 +
 .github/workflows/pr-checks.yml               | 211 ++++
 .pre-commit-config.yaml                       |   2 +-
 README.md                                     |   1 +
 docs/agents/DELEGATE.md                       | 188 ++++
 docs/agents/HARNESS_PARITY.md                 |  55 +-
 docs/comparison.md                            |   4 +-
 docs/index.md                                 |   1 +
 docs/llms.txt                                 |   1 +
 evalboard/lib/pricing.generated.ts            |  12 +
 mkdocs.yml                                    |   6 +-
 pyproject.toml                                |  10 +-
 src/coder_eval/agents/__init__.py             |  13 +-
 src/coder_eval/agents/delegate/.gitignore     |   2 +
 .../agents/delegate/delegate_host.mjs         | 153 +++
 src/coder_eval/agents/delegate/package.json   |   9 +
 src/coder_eval/agents/delegate_agent.py       | 952 ++++++++++++++++++
 src/coder_eval/models/__init__.py             |   2 +
 src/coder_eval/models/agent_config.py         |  57 ++
 src/coder_eval/models/enums.py                |   1 +
 src/coder_eval/pricing.py                     |  25 +
 tasks/delegate/fizzbuzz_delegate.yaml         |  24 +
 tasks/delegate/hello_date_delegate.yaml       |  32 +
 tests/lint/agent_roster_parity.py             |   1 +
 tests/test_agent_golden_master.py             |   4 +
 tests/test_custom_lint.py                     |   4 +-
 tests/test_delegate_agent.py                  | 451 +++++++++
 tests/test_delegate_agent_config.py           |  68 ++
 tests/test_delegate_agent_live.py             | 141 +++
 tests/test_delegate_agent_registration.py     |  65 ++
 tests/test_timing_identity_contract.py        |  40 +
 uv.lock                                       |  15 +-
 36 files changed, 2700 insertions(+), 45 deletions(-)
 create mode 100644 .github/scripts/diagnose_delegate_token_claims.py
 create mode 100644 docs/agents/DELEGATE.md
 create mode 100644 src/coder_eval/agents/delegate/.gitignore
 create mode 100644 src/coder_eval/agents/delegate/delegate_host.mjs
 create mode 100644 src/coder_eval/agents/delegate/package.json
 create mode 100644 src/coder_eval/agents/delegate_agent.py
 create mode 100644 tasks/delegate/fizzbuzz_delegate.yaml
 create mode 100644 tasks/delegate/hello_date_delegate.yaml
 create mode 100644 tests/test_delegate_agent.py
 create mode 100644 tests/test_delegate_agent_config.py
 create mode 100644 tests/test_delegate_agent_live.py
 create mode 100644 tests/test_delegate_agent_registration.py

diff --git a/.claude/harness-candidates.md b/.claude/harness-candidates.md
index abd49ea15..4880e2642 100644
--- a/.claude/harness-candidates.md
+++ b/.claude/harness-candidates.md
@@ -1009,3 +1009,16 @@ re-derive from scratch.
   f-string placeholders are `Path`s) that an AST-only rule does not have, and the existing
   CLI has many pre-existing unescaped lines a literal rule would flag at once. Caught in:
   Phase 5 quality review.
+- [ ] **A subprocess-driven agent must force-kill before dropping its process handle on
+  EVERY dead-or-dying exit path, not just the obvious ones.** `DelegateAgent`'s
+  `_drain_stdout` signals EOF (posts `None`) on a genuine pipe close AND on a buffer-limit
+  overrun AND on its own unexpected exception — only the first guarantees the host already
+  exited. Two review passes (independently) caught `communicate()`'s EOF/`fatal` branches
+  and `_read_until`'s EOF branch clearing `self._process = None` without confirming the host
+  was dead first, which orphans a still-alive Node host (and its interop child) rather than
+  respawning cleanly. Fixed in all three sites; `kill_sync()` also now clears the handle.
+  Deferred as a lint rule because the pattern ("this branch sets `self._X = None`; was a kill
+  awaited on this path first?") needs control-flow reasoning an AST-only CE0xx rule doesn't
+  have, and it is a recurring class ONLY within one file so far — worth promoting to a rule
+  if a second subprocess-driven agent repeats it. Caught in: final cross-phase review,
+  delegate agent port.
diff --git a/.claude/notes/agents.md b/.claude/notes/agents.md
index 8344a33c4..6e6a08ab8 100644
--- a/.claude/notes/agents.md
+++ b/.claude/notes/agents.md
@@ -742,3 +742,111 @@ drop per-message accounting.
 The classification is kept from failing open as the SDK grows: a test asserts EVERY field on
 the SDK's options type is classified, either typed-mirrored or framework-owned, so a new SDK
 release adding an unclassified field fails loudly instead of silently passing through.
+
+## Delegate agent
+
+`DelegateAgent` drives UiPath Autopilot's Delegate agent — reasoning in the UiPath backend,
+tools executing locally through the SDK's bundled interop process. Unlike every other CLI-driven
+agent in this file, there is no vendor-provided stdio protocol host to spawn: `@uipath/delegate-stdio`,
+the internal package a UiPath-only sibling plugin (`coder_eval_uipath`) drives, is not public. Only
+`@uipath/delegate-sdk` (a programmatic library exposing a `DelegateAgent` class with
+`initialize()`/`onEvent()`/`sendMessage()`/`destroy()`) and `@uipath/delegate-cli` (a terminal wrapper
+around it) are. So this agent ships its own first-party Node host, `agents/delegate/delegate_host.mjs`,
+which wraps the SDK class in a newline-JSON stdio protocol this framework designed, not one it had to
+reverse-engineer — verified live against a real `@uipath/delegate-sdk@0.1.12` install with no token,
+confirming both the plain-public-install story and that the SDK's own event vocabulary
+(`session_start`/`thinking`/`message`/`tool_call`/`tool_result`/`error`/`done`/`step`) substantially
+matches the internal sibling's protocol.
+
+**No multi-generation transcript splitting.** The internal sibling reconstructs one `AssistantMessage`
+per backend round-trip from an `isStepStart` flag and a `turnUsages` array on the host's terminal
+message. Neither is present on `DelegateAgent.onEvent`'s payloads (confirmed absent by grepping the
+installed SDK bundle's string literals), so there is no reliable per-round-trip boundary signal at this
+API layer. `DelegateAgent` builds exactly ONE `AssistantMessage` per `communicate()` call instead — a
+deliberate simplification, not an oversight; richer segmentation can be added once a real boundary
+signal is confirmed against a live backend. `timing.close_window` still opens that one window from the
+turn's own start (there is nothing to tile from), so the head and tail both measure ~0.
+
+**Deferred, not ported speculatively.** The internal sibling's module docstring documents several
+hard-won failure-signature-specific recoveries: a Cloudflare WAF-block-page rewrite, an SSE-connect-
+timeout rewrite, session-conflict fresh-host recovery, and first-response stall-timeout+resend. None
+are ported here — porting a marker tuned to the internal sibling's own observed failures risks matching
+nothing (or the wrong thing) against the public SDK/backend's actual error surface. A crash still ends
+the turn correctly as a retryable `AgentCrashError`; it is just not specially diagnosed. Port these once
+the same failures are actually observed running this agent for real.
+
+**The process handle must be cleared on every path that leaves the host dead or dying** — EOF, a host
+`fatal` message, a timeout (both the top-of-loop pre-check AND a timeout elapsing while blocked inside
+`asyncio.wait_for`), cooperative stop, and `max_turns` exhaustion. A real bug shipped once during this
+agent's own development: a timeout elapsing mid-read fell through to the generic crash path instead of
+`TurnTimeoutError`, and left the process handle set, so the NEXT `communicate()` call reused a host with
+a `"send"` still nominally in flight instead of respawning — risking a stale response being consumed as
+the new turn's. `tests/test_delegate_agent.py`'s `test_timeout_elapsing_mid_read_still_raises_turn_timeout_error`
+pins the fix.
+
+**Skills mapping is deliberately NOT the shared `agents/_skills.py` resolver.** That resolver enumerates
+individual skill directories for a repeated `--skill <dir>`-style CLI argument (OpenCode/Pi's shape).
+The Delegate SDK's `bundledSkillsPath` wants exactly ONE parent directory whose children are skill
+folders — a genuinely different shape — so `_resolve_bundled_skills_path` mirrors the internal sibling's
+own mapping (`<plugin.path>/skills`, first plugin wins) instead of force-fitting the shared helper.
+
+**Registered unconditionally**, exactly like `codex`/`antigravity` — there is no conditional-registration
+gate keyed on an optional-dependency extra anywhere in this codebase; `opencode`/`pi` declare an EMPTY
+extra purely as packaging-metadata documentation, and `delegate` follows that same shape (no new pip
+package — Node/`@uipath/delegate-sdk` is the real prerequisite, resolved lazily in `start()`).
+
+**`environment` resolution needs org/tenant SLUGS, not just IDs — confirmed by reading the installed
+SDK's own bundle, not by guessing from its error message.** When `DELEGATE_BACKEND_URL` is absent and
+`DELEGATE_ENV` (-> `environment` init option) is used instead, the SDK resolves the backend URL from
+`organizationName`/`orgLogicalName` and `tenantName` fields on the `auth` object passed to
+`initialize()` — NOT from `ORG_SLUG`/`TENANT_SLUG` read off `process.env` directly, despite that being
+exactly what the SDK's own thrown error suggests ("set ORG_SLUG and TENANT_SLUG env vars alongside
+ORG_ID/TENANT_ID"). That advice describes the separate `@uipath/delegate-cli`/`delegate-stdio` wrapper's
+own env-var-driven bootstrapping, not the `DelegateAgent` class itself, which we drive directly. So
+`_build_init_options` forwards `ORG_SLUG`/`TENANT_SLUG` (when set) into `auth.organizationName`/
+`auth.tenantName` itself — confirmed against `node_modules/@uipath/delegate-sdk/dist/index.mjs`'s own
+`yie()` resolver function live in CI (`pyright`/tests can't catch this class of bug; it only surfaces
+against a real backend). `tests/test_delegate_agent.py::TestStart::test_org_and_tenant_slug_forwarded_into_auth`
+pins it. Passing `DELEGATE_BACKEND_URL` directly instead of `DELEGATE_ENV` skips this whole path.
+
+### Delegate agent pricing
+
+Delegate-served models are keyed under the SDK's own hyphenated ids (e.g. `gpt-5-6-terra`) in
+`pricing.py`'s `_PRICING` — DISTINCT keys from the dotted ids (`gpt-5.6-terra`) the claude-code/codex
+harnesses use for the same physical models, because the Delegate backend echoes underscored ids
+(`_` -> `-` only, never `.` -> `-`) and nothing normalizes one id family to the other. A model reachable
+only through Delegate needs its own row here or `total_cost_usd` silently reports `None`. Several of
+these models implicitly cache prefixes (no separate cache-write fee), so their `cache_write_per_mtok` is
+`0.0` rather than mirroring input like most rows above them. Rates copied from the UiPath-only sibling
+plugin's own `pricing.py`, whose own module docstring documents the same rationale.
+
+Two things in `_DELEGATE_PRICING` look like copy errors on a skim and are not — a code review flagged
+both before this line existed to point at.
+
+`gpt-5-4` / `gpt-5-5` set `cache_write_per_mtok` equal to their OUTPUT rate (15.0 / 30.0), not a fraction
+of input like every other row in the block. That is a real, documented OpenAI billing fact for these two
+generations — cache writes billed at the full output rate — and their dotted twins in the main `_PRICING`
+table (`gpt-5.4`, `gpt-5.5`) use the identical convention, so this is internally consistent; the numbers
+are simply large. Only `gpt-5-6` introduced the cheaper 1.25x-input write convention this file's other
+`gpt-5-6-*` rows use.
+
+`gpt-5-6-sol` (5.0/30.0 here) genuinely differs from its dotted twin `gpt-5.6-sol` (4.0/20.0 in the main
+table): a 2026-07-30 price cut was applied to the framework's dotted table for `terra`/`luna` and never
+mirrored back into this hyphenated one (the UiPath-only sibling's own `pricing.py` carries the identical
+un-mirrored gap, with the same caveat comment). The two tables can price the SAME physical model
+differently until someone reconciles them — a known, pre-existing state, not something this port
+introduced or should silently "fix" by picking one number over the other.
+
+### Delegate agent golden-master and timing-identity coverage
+
+`AgentKind.DELEGATE` is excluded from `tests/test_agent_golden_master.py`'s `_NO_GOLDEN_COVERAGE`
+allowlist rather than given fixture scenarios: a golden snapshot pins a byte-identical `TurnRecord`
+for a scripted event stream, and every event field name below the confirmed `type`/`content`/
+`toolName`/`sessionId`/`model`/`usage` set is a guess (see this file's own "Delegate agent" section
+above and `delegate_agent.py`'s module docstring). Snapshotting a guess would make it look verified.
+Add real scenarios once the fields are confirmed against a live backend.
+
+This does NOT extend to `tests/test_timing_identity_contract.py::test_delegate_buckets_tile_the_turn`,
+which IS a real, unexempted case: the ms-exact four-bucket identity depends only on this agent's own
+`close_window`/`_finalize_turn` code (a single window per turn, opened at `_TurnState.__init__` and
+closed at finalize), never on the SDK's field names, so there is nothing unverified for it to guess at.
diff --git a/.env.example b/.env.example
index 136c4b343..50cfa31c6 100644
--- a/.env.example
+++ b/.env.example
@@ -80,6 +80,30 @@ LOG_TO_FILE=false  # Set to true to enable file logging
 # Off by default. Do NOT enable on developer workstations.
 # CODER_EVAL_REMEDIATE_HOME_PLUGINS=0
 
+# Delegate agent settings (UiPath Autopilot's Delegate agent, requires Node.js
+# on PATH plus `npm install @uipath/delegate-sdk` — a genuinely public package,
+# no token needed). See docs/agents/DELEGATE.md.
+#
+# DELEGATE_SDK_NODE_MODULES / DELEGATE_SDK_PATH — override the auto-located
+# install (ancestor-walk from cwd, plus home); set at most one.
+# DELEGATE_SDK_NODE_MODULES="/path/to/install/root"
+# DELEGATE_SDK_PATH="/path/to/node_modules/@uipath/delegate-sdk/dist/index.mjs"
+#
+# DELEGATE_ENV — cloud environment slug (alpha/staging/production/localhost),
+# used to derive the backend URL from the auth record's org/tenant slugs.
+# DELEGATE_ENV="alpha"
+#
+# DELEGATE_BACKEND_URL — pin the full agent-service URL directly instead
+# (wins over DELEGATE_ENV when both are set).
+# DELEGATE_BACKEND_URL="https://cloud.uipath.com/<org>/<tenant>/delegate_"
+#
+# Auth: either the token triple below, or a prior `delegate-sdk`/`delegate-cli`
+# login that wrote ~/.aria/sdk-auth.json (read by the Node host itself, not
+# by coder_eval).
+# AUTH_TOKEN="..."
+# TENANT_ID="..."
+# ORG_ID="..."
+
 # Usage Telemetry (anonymous; on by default).
 # Disable entirely:
 # TELEMETRY_ENABLED=false
diff --git a/.github/pages-stub/index.html b/.github/pages-stub/index.html
index 39deba000..bbc411a8e 100644
--- a/.github/pages-stub/index.html
+++ b/.github/pages-stub/index.html
@@ -12,7 +12,7 @@
     -->
     <meta
       name="description"
-      content="Coder Eval is Playwright for coding agents: an open-source, agent-agnostic framework for evaluating and benchmarking AI coding agents and their skills — sandboxed runs of Claude Code, Codex, Antigravity (Gemini), OpenCode, or Pi against declarative YAML tasks, with weighted scoring and CI gates. Documentation: coder-eval.com/docs"
+      content="Coder Eval is Playwright for coding agents: an open-source, agent-agnostic framework for evaluating and benchmarking AI coding agents and their skills — sandboxed runs of Claude Code, Codex, Antigravity (Gemini), OpenCode, Pi, or Delegate against declarative YAML tasks, with weighted scoring and CI gates. Documentation: coder-eval.com/docs"
     />
 
     <!--
@@ -227,7 +227,7 @@ <h1 class="sr-only">Coder Eval</h1>
       <p class="lead">
         <strong>Playwright for coding agents.</strong> An open-source, agent-agnostic framework for
         evaluating and benchmarking AI coding agents and their skills: it runs a real agent — Claude
-        Code, Codex, Antigravity (Gemini), OpenCode, or Pi — in a sandbox against declarative YAML
+        Code, Codex, Antigravity (Gemini), OpenCode, Pi, or Delegate — in a sandbox against declarative YAML
         tasks, then scores the files and commands the agent actually produced.
       </p>
       <p class="notice">
diff --git a/.github/scripts/diagnose_delegate_token_claims.py b/.github/scripts/diagnose_delegate_token_claims.py
new file mode 100644
index 000000000..db0cb607d
--- /dev/null
+++ b/.github/scripts/diagnose_delegate_token_claims.py
@@ -0,0 +1,46 @@
+"""Print MATCH/NO MATCH verdicts for a ROPC-minted Delegate token's org/tenant claims.
+
+Used by the `delegate-live-tests` job in ../workflows/pr-checks.yml. Takes the
+token's base64url-encoded JWT payload (argv[1]; never the full token) and
+compares its account/org and tenant claims against the DELEGATE_ORG_ID /
+DELEGATE_TENANT_ID secrets (read from the environment, never printed
+directly -- GitHub Actions auto-masks any exact secret value in log output,
+so a raw side-by-side print would be unreliable for a human to eyeball).
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import os
+import sys
+
+
+ORG_CANDIDATES = ["account_id", "accountId", "organizationId", "organization_id"]
+TENANT_CANDIDATES = ["prt_id", "tenant_id", "tenantId"]
+
+
+def _decode_claims(payload: str) -> dict[str, object]:
+    padded = payload + "=" * (-len(payload) % 4)
+    return json.loads(base64.urlsafe_b64decode(padded))
+
+
+def _print_verdict(claims: dict[str, object], candidates: list[str], expected: str, label: str) -> None:
+    found = {k: claims[k] for k in candidates if k in claims}
+    if not found:
+        print(f"{label}: token carries none of {candidates} -- cannot verify")
+        return
+    for key, value in found.items():
+        verdict = "MATCH" if value == expected else "NO MATCH"
+        print(f"{label} claim {key}: {verdict} against DELEGATE_{label}_ID")
+
+
+def main() -> None:
+    claims = _decode_claims(sys.argv[1])
+    _print_verdict(claims, ORG_CANDIDATES, os.environ["EXPECTED_ORG_ID"], "ORG")
+    _print_verdict(claims, TENANT_CANDIDATES, os.environ["EXPECTED_TENANT_ID"], "TENANT")
+    print(f"All claim keys present on token (names only, no values): {sorted(claims.keys())}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 8eec69a15..3082dc67a 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -7,6 +7,16 @@ on:
   push:
     branches: [main, develop]
   workflow_dispatch:
+    inputs:
+      delegate_uipath_env:
+        description: "UiPath cloud environment to ROPC-login the Delegate live job against"
+        required: false
+        type: choice
+        default: "alpha"
+        options:
+          - "alpha"
+          - "staging"
+          - "production"
 
 # Cancel outdated runs when new commits are pushed
 concurrency:
@@ -1128,3 +1138,204 @@ jobs:
           name: action-dogfood-runs
           path: tasks/runs/ci-action-dogfood/
           retention-days: 7
+
+  delegate-live-tests:
+    # Live Delegate e2e: spawns the real Node host (agents/delegate/delegate_host.mjs)
+    # wrapping the public @uipath/delegate-sdk against a real UiPath backend. Runs on
+    # every PR/push like the other live-test jobs (codex-live-tests, byoa-live-tests)
+    # now that the DELEGATE_ROPC_* secrets are provisioned; the presence-check gate
+    # below stays as a safety net so an accidental secret removal skips cleanly
+    # instead of failing a required check. Auth is minted fresh each run via the
+    # OAuth2 Resource Owner Password Credentials (ROPC) grant — the same
+    # `grant_type=password` flow documented in coder_eval_uipath/eval_runner/CI_DESIGN.md
+    # and implemented in coder_eval_uipath/eval_runner/scripts/ci/refresh-auth.sh —
+    # rather than a long-lived AUTH_TOKEN secret, since a minted token's ~1h TTL
+    # would make a static secret stale between runs. A dedicated bot user's
+    # username/password is the durable credential; the Delegate SDK reads the
+    # minted token straight from AUTH_TOKEN/TENANT_ID/ORG_ID (see
+    # docs/agents/DELEGATE.md), so no sdk-auth.json or client-secret refresh chain
+    # is needed here.
+    name: Delegate Live E2E (ROPC)
+    runs-on: uipath-ubuntu-24.04
+    timeout-minutes: 15
+    # Skip on fork PRs where secrets aren't available (matches e2e-smoke).
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - name: Check Delegate ROPC secrets present
+        id: gate
+        env:
+          DELEGATE_ROPC_CLIENT_ID: ${{ secrets.DELEGATE_ROPC_CLIENT_ID }}
+          DELEGATE_ROPC_CLIENT_SECRET: ${{ secrets.DELEGATE_ROPC_CLIENT_SECRET }}
+          DELEGATE_ROPC_USERNAME: ${{ secrets.DELEGATE_ROPC_USERNAME }}
+          DELEGATE_ROPC_PASSWORD: ${{ secrets.DELEGATE_ROPC_PASSWORD }}
+          DELEGATE_ORG_ID: ${{ secrets.DELEGATE_ORG_ID }}
+          DELEGATE_TENANT_ID: ${{ secrets.DELEGATE_TENANT_ID }}
+          DELEGATE_ORG_SLUG: ${{ secrets.DELEGATE_ORG_SLUG }}
+          DELEGATE_TENANT_SLUG: ${{ secrets.DELEGATE_TENANT_SLUG }}
+        run: |
+          if [ -z "$DELEGATE_ROPC_CLIENT_ID" ] || [ -z "$DELEGATE_ROPC_CLIENT_SECRET" ] || \
+             [ -z "$DELEGATE_ROPC_USERNAME" ] || [ -z "$DELEGATE_ROPC_PASSWORD" ] || \
+             [ -z "$DELEGATE_ORG_ID" ] || [ -z "$DELEGATE_TENANT_ID" ] || \
+             [ -z "$DELEGATE_ORG_SLUG" ] || [ -z "$DELEGATE_TENANT_SLUG" ]; then
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "Delegate ROPC secrets not configured — skipping the live run."
+          else
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Python 3.13
+        if: steps.gate.outputs.present == 'true'
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: "3.13"
+
+      - name: Set up Node.js 20
+        if: steps.gate.outputs.present == 'true'
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
+        with:
+          node-version: "20"
+
+      - name: Install uv
+        if: steps.gate.outputs.present == 'true'
+        run: |
+          python -m pip install --upgrade "pip>=26.2"  # PYSEC-2026-3721 fix floor
+          pip install uv
+
+      - name: Install project dependencies (hash-verified from uv.lock)
+        if: steps.gate.outputs.present == 'true'
+        run: uv sync --frozen --extra dev
+
+      - name: Install @uipath/delegate-sdk (public npm, no token needed)
+        if: steps.gate.outputs.present == 'true'
+        working-directory: src/coder_eval/agents/delegate
+        # --safe-chain-skip-minimum-package-age (not a growing exclusion-list entry
+        # per platform-specific optionalDependency name): the SDK's per-platform
+        # native runtime packages (@uipath/delegate-runtime-*) publish at the same
+        # instant as the SDK itself, so a name-list exclusion just needing another
+        # entry for each new one is the wrong shape for a first-party UiPath package
+        # already trusted at the SDK-name level.
+        run: npm install --safe-chain-skip-minimum-package-age
+
+      - name: ROPC login — mint a fresh Delegate access token
+        if: steps.gate.outputs.present == 'true'
+        id: ropc
+        env:
+          DELEGATE_UIPATH_ENV: ${{ github.event.inputs.delegate_uipath_env || 'alpha' }}
+          CLIENT_ID: ${{ secrets.DELEGATE_ROPC_CLIENT_ID }}
+          CLIENT_SECRET: ${{ secrets.DELEGATE_ROPC_CLIENT_SECRET }}
+          CE_USERNAME: ${{ secrets.DELEGATE_ROPC_USERNAME }}
+          CE_PASSWORD: ${{ secrets.DELEGATE_ROPC_PASSWORD }}
+          ORG_ID: ${{ secrets.DELEGATE_ORG_ID }}
+        run: |
+          set -euo pipefail
+          # The mint destination is resolved from a fixed allowlist, never from
+          # the raw workflow_dispatch input string directly — CLIENT_SECRET and
+          # CE_PASSWORD travel in this request's body, so accepting an arbitrary
+          # attacker-supplied URL here would be a credential-exfiltration path
+          # open to anyone who can trigger workflow_dispatch, not just admins.
+          case "${DELEGATE_UIPATH_ENV}" in
+            alpha) UIPATH_URL="https://alpha.uipath.com" ;;
+            staging) UIPATH_URL="https://staging.uipath.com" ;;
+            production) UIPATH_URL="https://cloud.uipath.com" ;;
+            *) echo "Unknown delegate_uipath_env: ${DELEGATE_UIPATH_ENV}" >&2; exit 1 ;;
+          esac
+
+          # Same grant as coder_eval_uipath/eval_runner/scripts/ci/refresh-auth.sh:
+          # a bot user's username/password against the identity server, scoped
+          # to the org via acr_values (the ROPC client carries no scope of its
+          # own narrower than the org). ConversationalAgents is the scope the
+          # Delegate backend itself checks; the rest matches refresh-auth.sh's
+          # alpha scope list so this mint is provably not narrower than the one
+          # already validated there.
+          SCOPES="openid profile email offline_access ConversationalAgents AutopilotForEveryone Orchestrator OrchestratorApiUserAccess StudioWebBackend"
+          response=$(curl -sS -L --connect-timeout 15 --max-time 60 -X POST "${UIPATH_URL}/identity_/connect/token" \
+              -H "Content-Type: application/x-www-form-urlencoded" \
+              -H "x-uipath-internal-accountid: ${ORG_ID}" \
+              --data-urlencode "grant_type=password" \
+              --data-urlencode "client_id=${CLIENT_ID}" \
+              --data-urlencode "client_secret=${CLIENT_SECRET}" \
+              --data-urlencode "username=${CE_USERNAME}" \
+              --data-urlencode "password=${CE_PASSWORD}" \
+              --data-urlencode "acr_values=tenant:${ORG_ID}" \
+              --data-urlencode "scope=${SCOPES}")
+
+          if err=$(echo "$response" | jq -e -r '.error // empty') && [ -n "$err" ]; then
+              echo "ROPC token request failed: $(echo "$response" | jq -r '.error_description // .error')" >&2
+              exit 1
+          fi
+
+          access_token=$(echo "$response" | jq -r '.access_token')
+          if [ -z "$access_token" ] || [ "$access_token" = "null" ]; then
+              echo "ROPC token response did not contain an access_token" >&2
+              exit 1
+          fi
+
+          echo "::add-mask::$access_token"
+          echo "access_token=$access_token" >> "$GITHUB_OUTPUT"
+
+      - name: Diagnose minted token's org/account claims
+        # Prints ONLY non-secret JWT claims (never the token itself) to check
+        # whether the ROPC-minted token's own account/org actually matches the
+        # DELEGATE_ORG_ID/DELEGATE_ORG_SLUG secrets used to build the backend
+        # URL -- a mismatch here (not a coder_eval bug) is what a live run's
+        # "Account id does not match" 401 from the connections_ API points at.
+        if: steps.gate.outputs.present == 'true'
+        env:
+          ACCESS_TOKEN: ${{ steps.ropc.outputs.access_token }}
+          EXPECTED_ORG_ID: ${{ secrets.DELEGATE_ORG_ID }}
+          EXPECTED_TENANT_ID: ${{ secrets.DELEGATE_TENANT_ID }}
+        run: |
+          set -euo pipefail
+          payload="$(echo "$ACCESS_TOKEN" | cut -d. -f2)"
+          # Explicit MATCH/NO MATCH verdicts, not a side-by-side print: a secret's
+          # exact value is auto-masked to *** everywhere in logs, including inside
+          # an unrelated claims dump, so printing both for a human to eyeball is
+          # unreliable -- the comparison has to happen here, not in the reader's head.
+          python3 .github/scripts/diagnose_delegate_token_claims.py "$payload"
+          echo "A 'NO MATCH' above means the secret points at a different org/tenant than"
+          echo "the one this bot user's token actually belongs to -- that mismatch, not this"
+          echo "agent's code, is the root cause of a downstream 'Account id does not match' 401."
+
+      - name: Run fizzbuzz delegate task (assert PASS)
+        if: steps.gate.outputs.present == 'true'
+        env:
+          DELEGATE_SDK_NODE_MODULES: ${{ github.workspace }}/src/coder_eval/agents/delegate
+          DELEGATE_ENV: alpha
+          AUTH_TOKEN: ${{ steps.ropc.outputs.access_token }}
+          TENANT_ID: ${{ secrets.DELEGATE_TENANT_ID }}
+          ORG_ID: ${{ secrets.DELEGATE_ORG_ID }}
+          # The SDK's --env resolution needs human-readable slugs alongside the
+          # GUIDs above (a bare AUTH_TOKEN/TENANT_ID/ORG_ID triple isn't enough
+          # for `environment: "alpha"` to resolve a backend URL) — these are
+          # read straight from process.env by the SDK itself, not plumbed
+          # through DelegateAgent's init options.
+          ORG_SLUG: ${{ secrets.DELEGATE_ORG_SLUG }}
+          TENANT_SLUG: ${{ secrets.DELEGATE_TENANT_SLUG }}
+        run: .venv/bin/coder-eval run tasks/delegate/fizzbuzz_delegate.yaml --run-dir runs/delegate-live
+
+      - name: Verify Delegate live run PASSED
+        if: steps.gate.outputs.present == 'true'
+        run: |
+          python3 - <<'PY'
+          import json
+          from pathlib import Path
+
+          results = list(Path("runs/delegate-live").rglob("task.json"))
+          assert results, "no task.json written"
+          data = json.loads(results[0].read_text())
+          status = str(data.get("final_status", "")).lower()
+          assert "success" in status or "pass" in status, f"expected PASS, got final_status={data.get('final_status')}"
+          print("Live Delegate run PASSED:", data.get("final_status"))
+          PY
+
+      - name: Upload Delegate live-test artifacts on failure
+        if: failure() && steps.gate.outputs.present == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: delegate-live-output
+          path: runs/delegate-live/
+          retention-days: 7
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 42d2d582b..fe00eadd7 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -25,7 +25,7 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
-        exclude: ^tasks/  # Allow YAML templates with variables
+        exclude: ^tasks/|^mkdocs\.yml$  # tasks/: YAML templates with variables; mkdocs.yml: Material's !ENV tag
       - id: check-added-large-files
         args: ['--maxkb=500']
         exclude: ^docs/assets/hero\.gif$  # README hero media
diff --git a/README.md b/README.md
index e0b78755a..0022530c4 100644
--- a/README.md
+++ b/README.md
@@ -253,6 +253,7 @@ The step's exit code is coder-eval's own: non-zero on any failed task.
 | [Antigravity (Gemini)](docs/agents/ANTIGRAVITY.md) | Running the Google Antigravity / Gemini agent |
 | [OpenCode](docs/agents/OPENCODE.md) | Running the OpenCode agent on open-weight models |
 | [Pi](docs/agents/PI.md) | Running the Pi agent on open-weight models |
+| [Delegate](docs/agents/DELEGATE.md) | Running UiPath Autopilot's Delegate agent |
 | [Run-Limit Parity](docs/agents/HARNESS_PARITY.md) | What each run_limits field means on every harness |
 | [A/B Experiments](docs/AB_EXPERIMENTS.md) | Compare models / tools / prompts across the same tasks |
 | [Bring Your Own Dataset](docs/DATASETS.md) | Fan a single task out over a dataset |
diff --git a/docs/agents/DELEGATE.md b/docs/agents/DELEGATE.md
new file mode 100644
index 000000000..40050643c
--- /dev/null
+++ b/docs/agents/DELEGATE.md
@@ -0,0 +1,188 @@
+---
+description: >-
+  Run UiPath Autopilot's Delegate agent as the agent under evaluation in Coder
+  Eval — installing the public @uipath/delegate-sdk, authentication, task
+  configuration, and how Delegate telemetry maps to sandboxed, weighted scoring.
+---
+
+# Running the Delegate agent in Coder Eval
+
+## Overview
+
+Coder Eval can run UiPath Autopilot's **Delegate agent** as the agent under evaluation. Its reasoning runs in the UiPath backend, but its tools (shell, file, Office, PDF) execute locally through the SDK's bundled interop process — so file-based success criteria work as usual. `DelegateAgent` plugs into the same sandbox, scoring, and telemetry pipeline as every other agent: set `agent.type: delegate` in a task and the rest of the framework works unchanged.
+
+Under the hood, this agent spawns a small first-party Node host, `agents/delegate/delegate_host.mjs`, that wraps the public `@uipath/delegate-sdk` package's `DelegateAgent` class in a newline-JSON stdio protocol. That host exists because `@uipath/delegate-stdio` — a ready-made protocol host UiPath's internal-only tooling drives — is not a public package; only `@uipath/delegate-sdk` (a programmatic library) and `@uipath/delegate-cli` (a terminal wrapper around it) are.
+
+## Setup
+
+### 1. Install Node and the Delegate SDK
+
+1. **Node.js** on your `PATH`.
+2. **`@uipath/delegate-sdk`**, a genuinely public npm package (verified: no token, no custom registry) — install it plain:
+
+```bash
+npm install @uipath/delegate-sdk
+```
+
+**You usually don't need to set anything about where.** When neither `DELEGATE_SDK_NODE_MODULES` nor `DELEGATE_SDK_PATH` is set, coder_eval auto-locates the install by walking up from the current directory through its ancestors (and home) — the same way Node resolves modules. Running the install inside `src/coder_eval/agents/delegate/` (this agent's own directory, which ships a `package.json` naming the dependency) is a convenient default location.
+
+To override the auto-search, set **one** of:
+
+| Variable | Purpose |
+|---|---|
+| `DELEGATE_SDK_NODE_MODULES` | Install root that holds `node_modules/@uipath/...`. |
+| `DELEGATE_SDK_PATH` | Absolute path straight to `dist/index.mjs`. |
+
+### 2. Choose a backend
+
+| Variable | Purpose |
+|---|---|
+| `DELEGATE_ENV` | Cloud environment slug (`alpha` / `staging` / `production` / `localhost`). Derives the backend URL from the auth record's org/tenant slugs. |
+| `DELEGATE_BACKEND_URL` | Pin the full agent-service URL directly (e.g. `https://cloud.uipath.com/<org>/<tenant>/delegate_`, or `http://localhost:5002` for a local backend). Wins over `DELEGATE_ENV` when both are set. |
+
+### 3. Authenticate
+
+Either:
+
+- **Environment token** — `AUTH_TOKEN`, `TENANT_ID`, `ORG_ID` env vars. Confirmed live: when `DELEGATE_ENV` (rather than `DELEGATE_BACKEND_URL`) resolves the backend, also set `ORG_SLUG` and `TENANT_SLUG` (the human-readable org/tenant names, not the GUIDs above) — the SDK's `environment` resolution reads `organizationName`/`tenantName` off the `auth` object passed to `initialize()`, not off `process.env` directly (its own error message's "set ORG_SLUG and TENANT_SLUG env vars" advice describes the separate `delegate-cli` wrapper's behavior, not this SDK class), so this agent forwards them into `auth.organizationName`/`auth.tenantName` itself. Without them, init fails with `--env alpha needs org/tenant slugs`. Skip both by setting `DELEGATE_BACKEND_URL` directly instead.
+- **Saved login** — a prior `delegate-sdk` `runLoginFlow` / `delegate-cli login` that wrote `~/.aria/sdk-auth.json`. The Node host reads this itself (via the SDK's own `loadAndRefreshAuth()`) when no `AUTH_TOKEN` is supplied — this agent does not parse that file in Python, so auth-freshness logic lives in exactly one place. This path already carries the slugs, so `ORG_SLUG`/`TENANT_SLUG` aren't needed.
+
+## Usage
+
+### Command Line
+
+```bash
+coder-eval run tasks/delegate/hello_date_delegate.yaml --type delegate --model virtuoso-1-5
+```
+
+### Task Definition (YAML)
+
+```yaml
+agent:
+  type: delegate
+  model: virtuoso-1-5
+  effort: high        # low | medium | high | xhigh
+  enable_computer_use: false   # default; screen tools off, file/shell/Office/PDF unaffected
+  plugins:
+    - type: local
+      path: "$SKILLS_PLUGIN_PATH"
+
+success_criteria:
+  - type: file_exists
+    path: "solution.py"
+    description: "Solution file must exist"
+```
+
+`enable_computer_use` defaults to `false` — this is a headless eval harness: `true` requires macOS Accessibility/Screen-Recording grants a CI runner does not have, and the SDK throws unconditionally on Linux when it's enabled. File, shell, Office and PDF tools are unaffected either way.
+
+### Skills
+
+A `plugins:` entry with `type: local` and a `path` is mounted as `<path>/skills` (the Delegate SDK's `bundledSkillsPath`, which expects one directory whose direct children are skill folders). If more than one plugin is configured, the first wins and a warning is logged.
+
+## Architecture
+
+### Class Hierarchy
+
+```
+Agent (ABC)
+└── DelegateAgent
+    ├── Node host subprocess (agents/delegate/delegate_host.mjs)
+    │   └── @uipath/delegate-sdk's DelegateAgent class
+    └── Streaming telemetry (commands, token usage, agent text)
+```
+
+### Key Methods
+
+- **`start(working_directory)`** — resolve the Node/SDK install, spawn the host, send the `init` command.
+- **`communicate(user_input, timeout, stream_callback)`** — send one `"send"` command and drain the host's forwarded events until `send_ok`/`send_error`/`fatal` or EOF.
+- **`stop()`** — send `destroy`, wait bounded, then SIGKILL.
+- **`kill()` / `kill_sync()`** — force-terminate the host subprocess (the latter safe to call from the orchestrator's watchdog thread).
+
+### TurnRecord Format
+
+Each turn returns a `TurnRecord` with:
+- `agent_output` — the SDK's final response, falling back to accumulated streamed text.
+- `commands` — one `CommandTelemetry` per `tool_call`/`tool_result` pair.
+- `messages` — exactly **one** `AssistantMessage` per turn (see Known Limitations).
+- `token_usage` — best-effort parse of the SDK's `usage` payload (see Known Limitations).
+- `model_used` — the SDK-reported model, falling back to the pinned `agent.model`.
+
+## Implementation Details
+
+### Timeout Handling
+
+A wall-clock deadline (`timeout`) is enforced both between reads (a top-of-loop check) and *during* a blocked read (an `asyncio.wait_for` around the queue read) — both arms raise `TurnTimeoutError` with a partial `TurnRecord` preserved in `pending_turn`, and both force-kill the host and drop the process handle so the next turn respawns a fresh one rather than reuse a host with a `"send"` still nominally in flight.
+
+### Error Recovery
+
+On any crash (host death, a `send_error`/`fatal` protocol message, or an unexpected exception), the agent:
+1. Sets `pending_turn` to a `crashed=True` TurnRecord with captured telemetry.
+2. Raises `AgentCrashError` (retryable) or `AgentConfigError` (non-retryable — missing Node/SDK install, or an SDK init rejection such as a missing `backendUrl`).
+3. The orchestrator reads `pending_turn` and calls `discard_pending_turn()` to roll back state.
+
+A dead host is always detected and its handle cleared, so a retried `communicate()` call always respawns a fresh host rather than hang or cross-wire a stale response.
+
+### Skills Discovery
+
+`_resolve_bundled_skills_path` maps the first `local` plugin's `path` to `<path>/skills` and forwards it as the SDK's `bundledSkillsPath` option. This is a different mapping from OpenCode/Pi's shared `agents/_skills.py` resolver: that resolver enumerates individual skill directories for a repeated `--skill <dir>`-style CLI argument, while the Delegate SDK wants exactly one parent directory whose children are skill folders.
+
+### Non-JSON stdout tolerance
+
+Importing `@uipath/delegate-sdk` can itself write a non-JSON diagnostic line to stdout (confirmed live) before this agent's own host script produces any output. The Python-side reader skips a line that fails to parse as JSON rather than treating it as a protocol violation, mirroring every other CLI-driven agent's tolerance for interleaved non-JSON notices.
+
+## Differences from Claude Code Agent
+
+| Feature | Claude Code | Delegate |
+|---------|------------|----------|
+| **SDK Type** | Subprocess (CLI via JSON generator) | Subprocess (a first-party Node host wrapping a programmatic SDK class) |
+| **Reasoning location** | Local process | UiPath backend |
+| **Tool execution** | Local | Local, through the SDK's bundled interop process |
+| **System prompt** | `system_prompt` appended to the default prompt | No SDK equivalent — warned about, not enforced |
+| **Session Resume** | `--resume {session_id}` | SDK `sessionId`, remembered across turns |
+| **Permissions** | `permission_mode` + `allowed_tools` | No permission-prompt concept; both silently unsupported (`allowed_tools`/`disallowed_tools` warned, `permission_mode` silently ignored) |
+| **Early stop** | Supported (cooperative `should_stop`, polled between messages) | Supported — polled after each forwarded event; the host is abandoned and a fresh one spawns for the next turn (no interrupt command exists) |
+| **Transcript granularity** | One `AssistantMessage` per model round-trip | One `AssistantMessage` per whole turn (see Known Limitations) |
+
+Run-limit semantics per harness: [Run-Limit Parity](HARNESS_PARITY.md).
+
+## Known Limitations
+
+1. **No multi-generation transcript splitting.** The SDK's event stream carries no round-trip boundary signal (no `isStepStart`/`turnUsages` equivalent), so this agent builds one `AssistantMessage` per `communicate()` call rather than one per backend round-trip.
+2. **Token-bucket field names are best-effort.** The SDK confirms an event-level `usage` field exists, but not its exact internal bucket names; several plausible spellings are tried and unrecognized shapes fall back to zero rather than raising.
+3. **No WAF-block-page rewrite, SSE-connect-timeout rewrite, session-conflict fresh-host recovery, or first-response stall-timeout+resend.** These are hard-won failure-signature-specific recoveries UiPath's internal tooling has needed against its own CI; they are not ported here until the same failures are observed against the public SDK/backend from this agent. A crash still ends the turn correctly as a retryable `AgentCrashError` — it is just not specially diagnosed.
+4. **No `sdk_options` passthrough.** Unlike Claude Code, there is no allowlisted escape hatch for arbitrary SDK fields — only `effort`, `project_id`, `session_id`, and `enable_computer_use` are exposed as typed config fields.
+5. **`enable_computer_use: true` requires local permissions and is unavailable on Linux.** macOS needs Accessibility + Screen Recording grants; the SDK throws unconditionally on Linux when this is enabled.
+
+## Testing
+
+Unit tests (no real Node process — a fake host replays the stdio protocol in memory):
+
+```bash
+uv run pytest tests/test_delegate_agent.py
+```
+
+Registration/pricing tests:
+
+```bash
+uv run pytest tests/test_delegate_agent_registration.py
+```
+
+Live integration tests (drive a real `@uipath/delegate-sdk` install against a real backend; skipped unless credentials are configured):
+
+```bash
+uv run pytest -m live tests/test_delegate_agent_live.py
+```
+
+CI runs the same kind of check as a manually-dispatched `delegate-live-tests` job in
+[`pr-checks.yml`](../../.github/workflows/pr-checks.yml): it mints a fresh access
+token via the OAuth2 Resource Owner Password Credentials (ROPC) grant against a
+dedicated bot user, then runs `tasks/delegate/fizzbuzz_delegate.yaml` end to end and
+asserts `final_status` is a PASS. It skips cleanly (never fails a required check)
+until the `DELEGATE_ROPC_*` / `DELEGATE_ORG_ID` / `DELEGATE_TENANT_ID` repo secrets
+are provisioned.
+
+## References
+
+- SDK package: [`@uipath/delegate-sdk`](https://www.npmjs.com/package/@uipath/delegate-sdk)
+- CLI package (not required by this agent, but shares the same auth file): [`@uipath/delegate-cli`](https://www.npmjs.com/package/@uipath/delegate-cli)
+- Task examples: `tasks/delegate/*.yaml`
diff --git a/docs/agents/HARNESS_PARITY.md b/docs/agents/HARNESS_PARITY.md
index ec0919ee5..a6874a4f8 100644
--- a/docs/agents/HARNESS_PARITY.md
+++ b/docs/agents/HARNESS_PARITY.md
@@ -10,33 +10,33 @@ This page is the contract for what each run limit means per harness, plus the sh
 
 ## The table
 
-| Limit | claude-code | codex | antigravity | opencode | pi |
-|---|---|---|---|---|---|
-| `run_limits.max_turns` | native SDK cap (agent-loop turns) | visible-turn cap (resolved tool calls) | visible-turn cap (resolved tool calls) | native step cap (the CLI's own agent-loop steps) | native turn cap (the CLI's own `turn_start` agent-loop steps) |
-| `run_limits.turn_timeout` | watchdog, SIGKILL on the CLI subprocess | watchdog + cooperative interrupt | watchdog, plus an earlier internal poll deadline at 80% of it (see below) | deadline enforced in-loop and on the final reap; SIGTERM→SIGKILL on the CLI's whole process group | deadline enforced in-loop and on the final reap; SIGTERM→SIGKILL on the CLI's whole process group |
-| `run_limits.task_timeout` | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic |
-| `run_limits.stop_early` | cooperative `should_stop` | cooperative `should_stop` | cooperative `should_stop` | cooperative `should_stop` (event granularity) | cooperative `should_stop` (event granularity — Pi streams incrementally) |
+| Limit | claude-code | codex | antigravity | opencode | pi | delegate |
+|---|---|---|---|---|---|---|
+| `run_limits.max_turns` | native SDK cap (agent-loop turns) | visible-turn cap (resolved tool calls) | visible-turn cap (resolved tool calls) | native step cap (the CLI's own agent-loop steps) | native turn cap (the CLI's own `turn_start` agent-loop steps) | message-event cap (forwarded `message`-type SDK events, NOT tool calls or backend round-trips — the host exposes no round-trip boundary) |
+| `run_limits.turn_timeout` | watchdog, SIGKILL on the CLI subprocess | watchdog + cooperative interrupt | watchdog, plus an earlier internal poll deadline at 80% of it (see below) | deadline enforced in-loop and on the final reap; SIGTERM→SIGKILL on the CLI's whole process group | deadline enforced in-loop and on the final reap; SIGTERM→SIGKILL on the CLI's whole process group | deadline checked both between reads and while blocked inside one (`asyncio.wait_for`); force-kills the host subprocess and drops the handle so the next turn respawns |
+| `run_limits.task_timeout` | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic | orchestrator-level, agent-agnostic |
+| `run_limits.stop_early` | cooperative `should_stop` | cooperative `should_stop` | cooperative `should_stop` | cooperative `should_stop` (event granularity) | cooperative `should_stop` (event granularity — Pi streams incrementally) | cooperative `should_stop`, polled per forwarded SDK event; the host is abandoned (no interrupt command exists) and a fresh one spawns for the next turn |
 
 ## Timing capture
 
 What each harness records about *when* things happened, and how much of a task's
 wall clock its numbers account for.
 
-| Field | claude-code | codex | antigravity | opencode | pi |
-|---|---|---|---|---|---|
-| `generation_duration_ms` RAW window (the reducer's part) | harness clock: previous SDK event → this message | SDK item stamps | harness clock: previous flush → this flush | harness clock: previous `step_finish` → this one | harness clock: previous `turn_end` → this one |
-| tool time subtracted from it | centrally | centrally | centrally | centrally | centrally |
-| what the **first** window covers | the first `message_start`, so CLI boot + TTFT are OUTSIDE it | the first SDK item's own start, so CLI boot + TTFT are OUTSIDE it | the first MODEL-source `Step`, so dispatch + TTFT are OUTSIDE it | the first `step_start`, so CLI boot + TTFT are OUTSIDE it | the first `turn_start`, so CLI boot + TTFT are OUTSIDE it |
-| `harness_startup_ms` (turn head) | ~3.6 s — CLI boot fused with TTFT | ~3.1 s — CLI boot fused with TTFT | ~4.7 s — dispatch fused with TTFT (its harness process is spawned once at startup, not per turn) | ~2.5 s — CLI boot fused with TTFT | ~0.23 s — CLI boot fused with TTFT |
-| `harness_teardown_ms` (turn tail) | ~1.3 s | ~13 ms | ~7 ms | ~26 ms | ~19 ms |
-| tool `duration_ms` source | measured around the tool result | SDK `completed_at_ms − started_at_ms`; the item's own `duration_ms` only as a fallback | measured ACTIVE → DONE | measured around the tool event | measured around the tool event |
-| `execution_started_at` / `execution_completed_at` | derived from the measured duration | SDK stamps (both, or neither) | measured at ACTIVE / DONE | measured | measured |
-| `generation_completed_at` | set | `None` — see below | `None` | `None` | `None` |
-| `message_id` source | SDK `message_id`; `None` when the stream carries none; `subagent-<tool_use_id>` for a synthesized sub-agent terminal | synthetic `turn_id-msg-N`, shared across the sub-messages of one generation; `turn_id-subagent-N` for recovered sub-agent generations | synthetic `turn_id-msg-N`, one per generation | CLI `messageID`; `None` when absent | CLI `responseId`; `None` when absent |
-| `Σ generation + ∪ tool + head + tail ≈ turn duration` | yes [^identity] | yes [^identity] | yes [^identity] | yes [^identity] | yes [^identity] |
-| clock basis for recorded stamps | one `TurnClock` per turn | SDK epoch ms (`_ms_to_dt`) — the subprocess's own clock, unreachable from the host, for BOTH window bounds and tool spans | one `TurnClock` per turn | **MIXED**: window bounds on the host `datetime.now()` (`:362`, `:696`); tool spans on CLI epoch ms (`_epoch_ms_to_dt`, `:406`/`:462`) | one `TurnClock` per turn |
-| turn bracket (`AgentStartEvent` / `AgentEndEvent`) stamp | the same `TurnClock` (**CE064**) | raw `datetime.now()` — consistent with its epoch-ms bounds | the same `TurnClock` (**CE064**) | raw `datetime.now()` — consistent with its epoch-ms tool spans | the same `TurnClock` (**CE064**) |
-| window built by `timing.py::close_window` | yes | yes | yes | yes | yes |
+| Field | claude-code | codex | antigravity | opencode | pi | delegate |
+|---|---|---|---|---|---|---|
+| `generation_duration_ms` RAW window (the reducer's part) | harness clock: previous SDK event → this message | SDK item stamps | harness clock: previous flush → this flush | harness clock: previous `step_finish` → this one | harness clock: previous `turn_end` → this one | harness clock: turn start → the turn's single flush (see below) |
+| tool time subtracted from it | centrally | centrally | centrally | centrally | centrally | centrally |
+| what the **first** window covers | the first `message_start`, so CLI boot + TTFT are OUTSIDE it | the first SDK item's own start, so CLI boot + TTFT are OUTSIDE it | the first MODEL-source `Step`, so dispatch + TTFT are OUTSIDE it | the first `step_start`, so CLI boot + TTFT are OUTSIDE it | the first `turn_start`, so CLI boot + TTFT are OUTSIDE it | the WHOLE turn — there is only one window per turn (see below) |
+| `harness_startup_ms` (turn head) | ~3.6 s — CLI boot fused with TTFT | ~3.1 s — CLI boot fused with TTFT | ~4.7 s — dispatch fused with TTFT (its harness process is spawned once at startup, not per turn) | ~2.5 s — CLI boot fused with TTFT | ~0.23 s — CLI boot fused with TTFT | ~0 — the single window's mark IS the turn start, so there is no head left to measure |
+| `harness_teardown_ms` (turn tail) | ~1.3 s | ~13 ms | ~7 ms | ~26 ms | ~19 ms | ~0 — the window closes at the same flush the turn ends on |
+| tool `duration_ms` source | measured around the tool result | SDK `completed_at_ms − started_at_ms`; the item's own `duration_ms` only as a fallback | measured ACTIVE → DONE | measured around the tool event | measured around the tool event | measured around the `tool_result` event |
+| `execution_started_at` / `execution_completed_at` | derived from the measured duration | SDK stamps (both, or neither) | measured at ACTIVE / DONE | measured | measured | measured |
+| `generation_completed_at` | set | `None` — see below | `None` | `None` | `None` | set |
+| `message_id` source | SDK `message_id`; `None` when the stream carries none; `subagent-<tool_use_id>` for a synthesized sub-agent terminal | synthetic `turn_id-msg-N`, shared across the sub-messages of one generation; `turn_id-subagent-N` for recovered sub-agent generations | synthetic `turn_id-msg-N`, one per generation | CLI `messageID`; `None` when absent | CLI `responseId`; `None` when absent | synthetic `<turn_id>-msg-0` (exactly one per turn) |
+| `Σ generation + ∪ tool + head + tail ≈ turn duration` | yes [^identity] | yes [^identity] | yes [^identity] | yes [^identity] | yes [^identity] | yes, trivially — one window IS the turn |
+| clock basis for recorded stamps | one `TurnClock` per turn | SDK epoch ms (`_ms_to_dt`) — the subprocess's own clock, unreachable from the host, for BOTH window bounds and tool spans | one `TurnClock` per turn | **MIXED**: window bounds on the host `datetime.now()` (`:362`, `:696`); tool spans on CLI epoch ms (`_epoch_ms_to_dt`, `:406`/`:462`) | one `TurnClock` per turn | raw `datetime.now()` (no `TurnClock` — CE064 does not require one, since there is only one window and no inter-window drift it could correct) |
+| turn bracket (`AgentStartEvent` / `AgentEndEvent`) stamp | the same `TurnClock` (**CE064**) | raw `datetime.now()` — consistent with its epoch-ms bounds | the same `TurnClock` (**CE064**) | raw `datetime.now()` — consistent with its epoch-ms tool spans | the same `TurnClock` (**CE064**) | raw `datetime.now()` — consistent with its own single-window bounds |
+| window built by `timing.py::close_window` | yes | yes | yes | yes | yes | yes |
 
 [^identity]: "yes" is load-bearing, and THREE sensors check it, each seeing
 something the others cannot.
@@ -498,6 +498,13 @@ needed to drive it.
 
 ### Known divergences
 
+- **This page's `delegate` column is a DIFFERENT agent** from the one described
+  in the bullet immediately below. `delegate` (this repo, `AgentKind.DELEGATE`)
+  drives the now-public `@uipath/delegate-sdk` through a first-party Node host;
+  `delegate-sdk` (the bullet below) is an older, UiPath-internal-only agent in
+  the separate `coder_eval_uipath` plugin, driving the non-public
+  `@uipath/delegate-stdio` package. They are not the same code and this page
+  does not claim their timing behavior matches.
 - **Delegate (`delegate-sdk`, out of tree)** records `duration_ms` but no
   execution bounds, so its tool calls cannot be placed on a timeline. Its
   coverage is ~88%. Mirror the Codex change in `coder_eval_uipath`
@@ -733,10 +740,10 @@ Full detail: [Pi](PI.md).
 `tasks/run_limits/` holds one fixture per limit: `max_turns_cap.yaml` asks for more
 sequential work than its cap allows, and `turn_timeout.yaml` runs a command that
 outlives its watchdog. Run either with `--type claude-code` / `--type codex` /
-`--type antigravity` / `--type opencode` / `--type pi` to check a backend against the
-contract above.
+`--type antigravity` / `--type opencode` / `--type pi` / `--type delegate` to check a
+backend against the contract above.
 
 ## Related
 
-- [Claude Code](CLAUDE_CODE.md) · [Codex](CODEX.md) · [Antigravity](ANTIGRAVITY.md) · [OpenCode](OPENCODE.md) · [Pi](PI.md)
+- [Claude Code](CLAUDE_CODE.md) · [Codex](CODEX.md) · [Antigravity](ANTIGRAVITY.md) · [OpenCode](OPENCODE.md) · [Pi](PI.md) · [Delegate](DELEGATE.md)
 - [Task Definition Guide](../TASK_DEFINITION_GUIDE.md) — the full `run_limits` schema
diff --git a/docs/comparison.md b/docs/comparison.md
index c3f624d2b..2a6f56569 100644
--- a/docs/comparison.md
+++ b/docs/comparison.md
@@ -10,7 +10,7 @@ description: >-
 
 **Coder Eval** is an agent-agnostic framework for evaluating AI coding agents and
 their skills. It runs a real agent (Claude Code, OpenAI Codex, Antigravity/Gemini,
-OpenCode, or Pi — one `agent.type` field apart) in a sandbox against declarative YAML
+OpenCode, Pi, or Delegate — one `agent.type` field apart) in a sandbox against declarative YAML
 tasks and scores the files and commands it produces on a weighted 0.0–1.0 scale,
 with cost/token telemetry, an A/B experiment layer, skill-activation checks, and CI
 pass/fail gates.
@@ -25,7 +25,7 @@ in its own documentation; see [Sources](#sources).
 | --- | --- | --- | --- | --- | --- | --- |
 | **What it grades** | Files + commands the agent produced | Whether a patch passes the repo's tests | Skill value on a fixed task set | Agent task success in sandboxes | Model text output | Whatever you wire up |
 | **Task source** | Your own (YAML) | Fixed benchmark (+ collection script) | Fixed (87 tasks / 8 domains) | Your own (framework) + Terminal-Bench 2.0 | Your own (YAML/JSON) + registry | Manual |
-| **Runs a real agent + tools** | ✅ Claude Code, Codex, Antigravity (Gemini), OpenCode, Pi | Runs your patch/scaffold | ✅ multi-harness | ✅ Claude Code, OpenHands, Codex | ❌ grades model output | ❌ |
+| **Runs a real agent + tools** | ✅ Claude Code, Codex, Antigravity (Gemini), OpenCode, Pi, Delegate | Runs your patch/scaffold | ✅ multi-harness | ✅ Claude Code, OpenHands, Codex | ❌ grades model output | ❌ |
 | **Sandboxed & reproducible** | ✅ tempdir / Docker | ✅ Docker | ✅ deterministic verifiers | ✅ Docker + cloud (Daytona/Modal) | — (grades text) | ❌ |
 | **Scoring** | Weighted 0.0–1.0 + thresholds | Pass/fail (tests) | Pass/fail (verifiers) | Task-level | Match / model-graded | ❌ |
 | **A/B experiments (model / tool / prompt)** | ✅ built-in | ❌ | Skills on/off only | — | Compare model versions | ❌ |
diff --git a/docs/index.md b/docs/index.md
index d3fc34ae7..0f1de13e2 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -87,6 +87,7 @@ New here? Start with **[Tutorial 01 — Your First Evaluation](tutorials/01-firs
 | [Antigravity (Gemini)](agents/ANTIGRAVITY.md) | Running the Google Antigravity / Gemini agent |
 | [OpenCode](agents/OPENCODE.md) | Running the OpenCode agent on open-weight models |
 | [Pi](agents/PI.md) | Running the Pi agent on open-weight models |
+| [Delegate](agents/DELEGATE.md) | Running UiPath Autopilot's Delegate agent |
 | [Run-Limit Parity](agents/HARNESS_PARITY.md) | What each run_limits field means on every harness |
 | [A/B Experiments](AB_EXPERIMENTS.md) | Compare models / tools / prompts across the same tasks |
 | [Bring Your Own Dataset](DATASETS.md) | Fan a single task out over a dataset |
diff --git a/docs/llms.txt b/docs/llms.txt
index 9a8adaa68..34498070e 100644
--- a/docs/llms.txt
+++ b/docs/llms.txt
@@ -32,6 +32,7 @@ and A/B plumbing.
 - [Antigravity (Gemini)](https://coder-eval.com/docs/agents/antigravity): Running the Google Antigravity / Gemini agent
 - [OpenCode](https://coder-eval.com/docs/agents/opencode): Running the OpenCode agent on open-weight models
 - [Pi](https://coder-eval.com/docs/agents/pi): Running the Pi agent on open-weight models
+- [Delegate](https://coder-eval.com/docs/agents/delegate): Running UiPath Autopilot's Delegate agent
 - [Run-Limit Parity](https://coder-eval.com/docs/agents/harness-parity): What each run_limits field means on every harness
 - [A/B Experiments](https://coder-eval.com/docs/ab-experiments): Compare models / tools / prompts across the same tasks
 - [Bring Your Own Dataset](https://coder-eval.com/docs/datasets): Fan a single task out over a dataset
diff --git a/evalboard/lib/pricing.generated.ts b/evalboard/lib/pricing.generated.ts
index 73ba6c3d5..0bdc57794 100644
--- a/evalboard/lib/pricing.generated.ts
+++ b/evalboard/lib/pricing.generated.ts
@@ -37,6 +37,9 @@ export const PRICING: Record<string, Pricing> = {
     "claude-sonnet-5": { inputPerMTok: 2.0, outputPerMTok: 10.0, cacheWritePerMTok: 2.5, cacheReadPerMTok: 0.2 },
     "codex-mini-latest": { inputPerMTok: 1.5, outputPerMTok: 6.0, cacheWritePerMTok: 1.5, cacheReadPerMTok: 0.375 },
     "deepseek.v3.2": { inputPerMTok: 0.74, outputPerMTok: 2.22, cacheWritePerMTok: 0.74, cacheReadPerMTok: 0.0 },
+    "gemini-3-1-pro-preview": { inputPerMTok: 2.0, outputPerMTok: 12.0, cacheWritePerMTok: 0.0, cacheReadPerMTok: 0.2 },
+    "gemini-3-5-flash": { inputPerMTok: 1.5, outputPerMTok: 9.0, cacheWritePerMTok: 0.0, cacheReadPerMTok: 0.15 },
+    "gemini-3-6-flash": { inputPerMTok: 1.5, outputPerMTok: 7.5, cacheWritePerMTok: 0.0, cacheReadPerMTok: 0.15 },
     "gemini-3-flash-preview": { inputPerMTok: 0.5, outputPerMTok: 3.0, cacheWritePerMTok: 0.5, cacheReadPerMTok: 0.05 },
     "gemini-3-pro-preview": { inputPerMTok: 2.0, outputPerMTok: 12.0, cacheWritePerMTok: 2.0, cacheReadPerMTok: 0.2 },
     "gemini-3.1-flash-lite": { inputPerMTok: 0.25, outputPerMTok: 1.5, cacheWritePerMTok: 0.25, cacheReadPerMTok: 0.025 },
@@ -48,7 +51,13 @@ export const PRICING: Record<string, Pricing> = {
     "gemini-3.6-flash": { inputPerMTok: 1.5, outputPerMTok: 7.5, cacheWritePerMTok: 1.5, cacheReadPerMTok: 0.15 },
     "gemini-3.7-flash": { inputPerMTok: 1.5, outputPerMTok: 7.5, cacheWritePerMTok: 1.5, cacheReadPerMTok: 0.15 },
     "gemini-3.8-flash": { inputPerMTok: 1.5, outputPerMTok: 7.5, cacheWritePerMTok: 1.5, cacheReadPerMTok: 0.15 },
+    "glm-5-3-flash": { inputPerMTok: 0.15, outputPerMTok: 0.5, cacheWritePerMTok: 0.0, cacheReadPerMTok: 0.03 },
     "gpt-5": { inputPerMTok: 1.25, outputPerMTok: 10.0, cacheWritePerMTok: 1.25, cacheReadPerMTok: 0.125 },
+    "gpt-5-4": { inputPerMTok: 2.5, outputPerMTok: 15.0, cacheWritePerMTok: 15.0, cacheReadPerMTok: 0.25 },
+    "gpt-5-5": { inputPerMTok: 5.0, outputPerMTok: 30.0, cacheWritePerMTok: 30.0, cacheReadPerMTok: 0.5 },
+    "gpt-5-6-luna": { inputPerMTok: 0.2, outputPerMTok: 1.2, cacheWritePerMTok: 0.25, cacheReadPerMTok: 0.02 },
+    "gpt-5-6-sol": { inputPerMTok: 5.0, outputPerMTok: 30.0, cacheWritePerMTok: 6.25, cacheReadPerMTok: 0.5 },
+    "gpt-5-6-terra": { inputPerMTok: 2.0, outputPerMTok: 12.0, cacheWritePerMTok: 2.5, cacheReadPerMTok: 0.2 },
     "gpt-5-codex": { inputPerMTok: 1.25, outputPerMTok: 10.0, cacheWritePerMTok: 1.25, cacheReadPerMTok: 0.125 },
     "gpt-5.1-codex": { inputPerMTok: 1.25, outputPerMTok: 10.0, cacheWritePerMTok: 1.25, cacheReadPerMTok: 0.125 },
     "gpt-5.1-codex-max": { inputPerMTok: 1.25, outputPerMTok: 10.0, cacheWritePerMTok: 1.25, cacheReadPerMTok: 0.125 },
@@ -60,6 +69,9 @@ export const PRICING: Record<string, Pricing> = {
     "gpt-5.6-luna": { inputPerMTok: 0.2, outputPerMTok: 1.2, cacheWritePerMTok: 0.2, cacheReadPerMTok: 0.02 },
     "gpt-5.6-sol": { inputPerMTok: 4.0, outputPerMTok: 20.0, cacheWritePerMTok: 4.0, cacheReadPerMTok: 0.4 },
     "gpt-5.6-terra": { inputPerMTok: 2.0, outputPerMTok: 12.0, cacheWritePerMTok: 2.0, cacheReadPerMTok: 0.2 },
+    "kimi-k2-7-code": { inputPerMTok: 0.95, outputPerMTok: 4.0, cacheWritePerMTok: 0.0, cacheReadPerMTok: 0.19 },
     "moonshotai.kimi-k2.5": { inputPerMTok: 0.72, outputPerMTok: 3.6, cacheWritePerMTok: 0.72, cacheReadPerMTok: 0.0 },
+    "virtuoso-1-5": { inputPerMTok: 0.95, outputPerMTok: 4.0, cacheWritePerMTok: 0.0, cacheReadPerMTok: 0.16 },
+    "virtuoso-2-0": { inputPerMTok: 0.95, outputPerMTok: 4.0, cacheWritePerMTok: 0.0, cacheReadPerMTok: 0.19 },
     "zai.glm-5": { inputPerMTok: 1.2, outputPerMTok: 3.84, cacheWritePerMTok: 1.2, cacheReadPerMTok: 0.0 },
 };
diff --git a/mkdocs.yml b/mkdocs.yml
index d01681d14..c8229386c 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -2,8 +2,8 @@ site_name: Coder Eval
 site_description: >-
   Evaluate and benchmark AI coding agents and their skills — a sandboxed,
   agent-agnostic framework with declarative YAML eval suites for Claude Code,
-  Codex, Antigravity (Gemini), OpenCode and Pi, A/B experiments, weighted scoring,
-  and CI gates.
+  Codex, Antigravity (Gemini), OpenCode, Pi and Delegate, A/B experiments,
+  weighted scoring, and CI gates.
 site_url: https://coder-eval.com/docs/
 repo_url: https://github.com/UiPath/coder_eval
 repo_name: UiPath/coder_eval
@@ -86,6 +86,7 @@ extra:
     agents/ANTIGRAVITY.md: "Running the Google Antigravity / Gemini agent"
     agents/OPENCODE.md: "Running the OpenCode agent on open-weight models"
     agents/PI.md: "Running the Pi agent on open-weight models"
+    agents/DELEGATE.md: "Running UiPath Autopilot's Delegate agent"
     agents/HARNESS_PARITY.md: "What each run_limits field means on every harness"
     AB_EXPERIMENTS.md: "Compare models / tools / prompts across the same tasks"
     DATASETS.md: "Fan a single task out over a dataset"
@@ -117,6 +118,7 @@ nav:
       - Antigravity (Gemini): agents/ANTIGRAVITY.md
       - OpenCode: agents/OPENCODE.md
       - Pi: agents/PI.md
+      - Delegate: agents/DELEGATE.md
       - Run-Limit Parity: agents/HARNESS_PARITY.md
   - Advanced:
       - A/B Experiments: AB_EXPERIMENTS.md
diff --git a/pyproject.toml b/pyproject.toml
index 0c5c79c21..6af77071b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,7 +1,7 @@
 [project]
 name = "coder-eval"
 version = "0.12.4"
-description = "Evaluate, benchmark, and A/B-test AI coding agents (Claude Code, Codex, Gemini/Antigravity, OpenCode, Pi) with sandboxed, reproducible YAML task suites."
+description = "Evaluate, benchmark, and A/B-test AI coding agents (Claude Code, Codex, Gemini/Antigravity, OpenCode, Pi, Delegate) with sandboxed, reproducible YAML task suites."
 readme = "README.md"
 license = "Apache-2.0"
 requires-python = ">=3.13"
@@ -9,7 +9,7 @@ authors = [{ name = "UiPath", email = "coder-eval@uipath.com" }]
 keywords = [
     "ai", "llm", "agent", "coding-agent", "evaluation", "eval", "evals",
     "benchmark", "swe-bench", "claude", "claude-code", "codex", "anthropic",
-    "gemini", "antigravity", "opencode", "pi", "sandbox", "code-generation", "agent-evaluation",
+    "gemini", "antigravity", "opencode", "pi", "delegate", "uipath", "sandbox", "code-generation", "agent-evaluation",
     "llm-evaluation", "llm-eval", "ai-evaluation", "skills-evaluation",
     "claude-skills", "claude-code-skills", "agent-skills", "skillsbench",
     "agent-testing", "llmops",
@@ -44,7 +44,7 @@ dependencies = [
     # mirror anthropic's own bound on it (`httpx2<3,>=2.0.0`).
     "httpx2>=2.12.0,<3.0.0",
     "claude-agent-sdk>=0.2.124",
-    "anyio>=4.13.0",
+    "anyio>=4.14.2",
     "radon>=6.0.1",
     "tqdm>=4.67.3",
     "jmespath>=1.1.0",
@@ -83,6 +83,10 @@ dev = [
 # Optional extra that enables UiPath-specific features:
 #   - the `uipath` Python SDK on the host (handy for local sandbox parity with
 #     tasks that invoke `uv run uipath eval ...`)
+#   - the Delegate agent's home in the packaging metadata (`agent.type: delegate`).
+#     Like `opencode`/`pi` below, its real prerequisite is a Node package
+#     (`npm install @uipath/delegate-sdk`, genuinely public — no token needed),
+#     so nothing new is added to THIS list; it just shares this extra's name.
 # Without this extra, the framework still installs and runs; UiPath-dependent
 # code paths fail at dispatch with a clear hint pointing back here.
 # NOTE: the LLM judge and the prompt `rephrase` mutation route through the
diff --git a/src/coder_eval/agents/__init__.py b/src/coder_eval/agents/__init__.py
index 010f2a9c4..337bb9ff0 100644
--- a/src/coder_eval/agents/__init__.py
+++ b/src/coder_eval/agents/__init__.py
@@ -4,6 +4,7 @@
 from coder_eval.agents.antigravity_agent import AntigravityAgent
 from coder_eval.agents.claude_code_agent import ClaudeCodeAgent
 from coder_eval.agents.codex_agent import CodexAgent
+from coder_eval.agents.delegate_agent import DelegateAgent
 from coder_eval.agents.noop_agent import NoOpAgent
 from coder_eval.agents.opencode_agent import OpenCodeAgent
 from coder_eval.agents.pi_agent import PiAgent
@@ -12,17 +13,23 @@
 
 
 def register_builtins(registry: type[AgentRegistry]) -> None:
-    """Register the built-in agents (Claude/Codex/Antigravity/OpenCode/Pi/NoOp) onto ``registry``.
+    """Register the built-in agents (Claude/Codex/Antigravity/OpenCode/Pi/Delegate/NoOp) onto ``registry``.
 
     This is the target of coder-eval's own ``coder_eval.plugins`` entry point, so
     the built-in agents travel the identical discovery path as any third-party
     plugin (see :mod:`coder_eval.plugins`). Importing the agent modules above
     fires their ``@AgentRegistry.register`` decorators; this hook only has to
     ensure those modules are imported, which the package import already did.
+
+    ``delegate`` registers unconditionally, exactly like every sibling agent
+    (``codex``/``antigravity``): its Node/``@uipath/delegate-sdk`` prerequisite
+    is resolved lazily in ``start()``, which raises a clear ``AgentConfigError``
+    if it is missing. There is no conditional-registration gate — that would be
+    a second, ad-hoc dispatch mechanism the registry pattern already replaces.
     """
     # Reference the imported classes so the registration side effect is explicit
     # and a future refactor that drops the top-level imports fails loudly here.
-    _ = (ClaudeCodeAgent, CodexAgent, AntigravityAgent, OpenCodeAgent, PiAgent, NoOpAgent)
+    _ = (ClaudeCodeAgent, CodexAgent, AntigravityAgent, OpenCodeAgent, PiAgent, DelegateAgent, NoOpAgent)
     # The decorators fire on import, but assert anyway: a lazy-import refactor
     # would leave the import-cached modules' decorators un-run, and this fails
     # loudly instead of registering nothing.
@@ -32,6 +39,7 @@ def register_builtins(registry: type[AgentRegistry]) -> None:
         AgentKind.ANTIGRAVITY,
         AgentKind.OPENCODE,
         AgentKind.PI,
+        AgentKind.DELEGATE,
         AgentKind.NONE,
     ):
         if registry.get(kind) is None:
@@ -43,6 +51,7 @@ def register_builtins(registry: type[AgentRegistry]) -> None:
     "AntigravityAgent",
     "ClaudeCodeAgent",
     "CodexAgent",
+    "DelegateAgent",
     "NoOpAgent",
     "OpenCodeAgent",
     "PiAgent",
diff --git a/src/coder_eval/agents/delegate/.gitignore b/src/coder_eval/agents/delegate/.gitignore
new file mode 100644
index 000000000..504afef81
--- /dev/null
+++ b/src/coder_eval/agents/delegate/.gitignore
@@ -0,0 +1,2 @@
+node_modules/
+package-lock.json
diff --git a/src/coder_eval/agents/delegate/delegate_host.mjs b/src/coder_eval/agents/delegate/delegate_host.mjs
new file mode 100644
index 000000000..230664d9a
--- /dev/null
+++ b/src/coder_eval/agents/delegate/delegate_host.mjs
@@ -0,0 +1,153 @@
+// delegate_host.mjs — a stdio JSON-Lines host wrapping @uipath/delegate-sdk's
+// DelegateAgent class, standing in for the internal (non-public)
+// @uipath/delegate-stdio package the framework's UiPath-only sibling used to
+// drive. This host is first-party to coder_eval (there is no vendor-provided
+// equivalent to point at once @uipath/delegate-sdk is the only public piece),
+// so IT defines the wire protocol below rather than reverse-engineering one.
+//
+// See src/coder_eval/agents/delegate_agent.py's module docstring for the
+// Python-side consumer of this exact protocol, and docs/agents/DELEGATE.md
+// for the end-to-end setup story.
+//
+// Usage: node delegate_host.mjs <absolute-path-to-delegate-sdk's-dist/index.mjs>
+//
+// Protocol (newline-delimited JSON, UTF-8, one object per line):
+//
+// stdin (coder_eval -> host):
+//   {"cmd": "init", "options": {...}}          -- forwarded verbatim to DelegateAgent.initialize()
+//   {"cmd": "send", "prompt": str, "sessionId": str|null}
+//   {"cmd": "destroy"}
+//
+// stdout (host -> coder_eval):
+//   {"type": "init_ok"}
+//   {"type": "init_error", "message": str}
+//   {"type": "send_ok", "result": <sendMessage()'s resolved value, or null>}
+//   {"type": "send_error", "message": str}
+//   {"type": "destroy_error", "message": str}
+//   {"type": "protocol_error", "message": str} -- malformed/unknown stdin command; host keeps running
+//   {"type": "fatal", "message": str}          -- unrecoverable; the process exits non-zero right after
+//   {"type": <event.type>, ...event}           -- every DelegateAgent.onEvent() callback,
+//     forwarded with ALL of its own enumerable fields spread onto the line, `type`
+//     included. This host does no filtering or renaming: the SDK's own event
+//     vocabulary (session_start / thinking / message / tool_call / tool_result /
+//     error / done / step / ... at last check) and per-event field names are
+//     whatever the installed @uipath/delegate-sdk version emits. A schema change
+//     on a future SDK release surfaces to the Python side as an unrecognized
+//     `type` string or missing field, never as a silently dropped event.
+//
+// CONFIRMED LIVE (installing @uipath/delegate-sdk@0.1.12 and driving this host
+// against it directly): importing the SDK can itself write a non-JSON diagnostic
+// line to STDOUT before any of this host's own output (observed:
+// "[backendUrl] Module loaded - VITE_USE_CLOUD_URL: ..."), not stderr, so the
+// Python reader must skip a non-JSON stdout line rather than treat it as a
+// protocol violation -- mirroring every other agent's established resilience
+// pattern for interleaved non-JSON CLI notices (see opencode_agent.py's
+// `_handle_line`). This host does not attempt to suppress the SDK's own stdout
+// writes (fragile across SDK versions); the tolerance lives on the read side.
+"use strict";
+
+import { createInterface } from "node:readline";
+import { pathToFileURL } from "node:url";
+
+const sdkEntryPath = process.argv[2];
+if (!sdkEntryPath) {
+  process.stderr.write("delegate_host.mjs: missing required argv[1] (path to delegate-sdk's dist/index.mjs)\n");
+  process.exit(2);
+}
+
+function writeLine(obj) {
+  process.stdout.write(JSON.stringify(obj) + "\n");
+}
+
+let agent = null;
+let initialized = false;
+
+async function handleInit(msg) {
+  const { DelegateAgent } = await import(pathToFileURL(sdkEntryPath).href);
+  agent = new DelegateAgent();
+  agent.onEvent((event) => {
+    try {
+      writeLine({ ...event });
+    } catch (err) {
+      // A non-JSON-serializable event field (e.g. a circular reference) must not
+      // kill the host silently -- surface it as fatal so the Python side sees a
+      // clear crash instead of hanging on a line that will never arrive. Exits,
+      // like every other `fatal` site: the Python side's crash-handling treats
+      // ALL `fatal` messages as "the host is exiting", so this one must too.
+      writeLine({ type: "fatal", message: `event serialization failed: ${err}` });
+      process.exit(1);
+    }
+  });
+  await agent.initialize(msg.options || {});
+  initialized = true;
+  writeLine({ type: "init_ok" });
+}
+
+async function handleSend(msg) {
+  if (!initialized || !agent) {
+    writeLine({ type: "send_error", message: "not initialized -- send {\"cmd\":\"init\"} first" });
+    return;
+  }
+  const result = await agent.sendMessage(msg.prompt, msg.sessionId || undefined);
+  writeLine({ type: "send_ok", result: result ?? null });
+}
+
+async function handleDestroy() {
+  if (agent) {
+    await agent.destroy();
+  }
+  process.exit(0);
+}
+
+const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+
+rl.on("line", (line) => {
+  const trimmed = line.trim();
+  if (!trimmed) return;
+
+  let msg;
+  try {
+    msg = JSON.parse(trimmed);
+  } catch (err) {
+    writeLine({ type: "protocol_error", message: `invalid JSON on stdin: ${err}` });
+    return;
+  }
+
+  const cmd = msg && msg.cmd;
+  if (cmd !== "init" && cmd !== "send" && cmd !== "destroy") {
+    writeLine({ type: "protocol_error", message: `unknown cmd: ${cmd}` });
+    return;
+  }
+
+  const dispatch = cmd === "init" ? handleInit(msg) : cmd === "send" ? handleSend(msg) : handleDestroy();
+  const errorKind = { init: "init_error", send: "send_error", destroy: "destroy_error" }[cmd];
+  dispatch.catch((err) => {
+    writeLine({ type: errorKind, message: String((err && err.message) || err) });
+    // destroy is the teardown path: a failed agent.destroy() must still end
+    // the process, or coder_eval's bounded wait burns its full timeout before
+    // falling back to SIGKILL on every task.
+    if (cmd === "destroy") {
+      process.exit(1);
+    }
+  });
+});
+
+// coder_eval closing stdin (its own exit, or a SIGKILL) must end this process
+// too, or the host -- and the interop child it may have spawned -- outlives it.
+rl.on("close", () => {
+  process.exit(0);
+});
+
+// Both handlers below write a `fatal` line before exiting so the Python side's
+// read loop never hangs waiting for a line that will never arrive -- the
+// original failure mode this design exists to avoid (see
+// .claude/notes/agents.md § Delegate agent).
+process.on("unhandledRejection", (err) => {
+  writeLine({ type: "fatal", message: `unhandled rejection: ${(err && err.message) || err}` });
+  process.exit(1);
+});
+
+process.on("uncaughtException", (err) => {
+  writeLine({ type: "fatal", message: `uncaught exception: ${(err && err.message) || err}` });
+  process.exit(1);
+});
diff --git a/src/coder_eval/agents/delegate/package.json b/src/coder_eval/agents/delegate/package.json
new file mode 100644
index 000000000..eca0995f5
--- /dev/null
+++ b/src/coder_eval/agents/delegate/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "coder-eval-delegate-host",
+  "private": true,
+  "description": "npm install target for the delegate agent's Node prerequisite (@uipath/delegate-sdk). Installing here, or in any ancestor directory, lets coder_eval's ancestor-walk resolver find it with zero configuration.",
+  "type": "module",
+  "dependencies": {
+    "@uipath/delegate-sdk": "^0.1.12"
+  }
+}
diff --git a/src/coder_eval/agents/delegate_agent.py b/src/coder_eval/agents/delegate_agent.py
new file mode 100644
index 000000000..490a40000
--- /dev/null
+++ b/src/coder_eval/agents/delegate_agent.py
@@ -0,0 +1,952 @@
+"""Delegate agent — drives UiPath Autopilot's Delegate agent via a Node subprocess.
+
+The reasoning runs in the UiPath backend; tools (shell, file, Office, PDF) execute
+locally through the SDK's bundled interop process, so file-based success criteria
+work as usual. This agent spawns a first-party Node host this framework ships,
+``agents/delegate/delegate_host.mjs``, wrapping the public ``@uipath/delegate-sdk``
+package's ``DelegateAgent`` class in a newline-JSON stdio protocol — see that
+file's header for the exact wire format.
+
+Prerequisites are documented in ``docs/agents/DELEGATE.md`` and enforced with a
+clear ``AgentConfigError`` at ``start()`` (Node.js, ``npm install
+@uipath/delegate-sdk``, UiPath auth). Deliberate scope reductions versus the
+UiPath-internal sibling agent's more hardened adapter (no multi-generation
+transcript splitting, no WAF/SSE/session-conflict/stall-resend recovery,
+best-effort token-bucket field names marked ``# UNVERIFIED``) and every
+``# UNVERIFIED`` spot's rationale live in one place, not scattered:
+
+Rationale: .claude/notes/agents.md § Delegate agent
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import json
+import logging
+import os
+import shutil
+import signal
+import time
+import uuid
+from collections.abc import Callable
+from datetime import datetime
+from pathlib import Path
+from typing import Any, ClassVar, NoReturn
+
+from coder_eval.agent import Agent
+from coder_eval.errors import AgentConfigError, AgentCrashError, TurnTimeoutError
+from coder_eval.isolation.docker_runner import STDOUT_LINE_LIMIT_BYTES
+from coder_eval.models import (
+    AgentKind,
+    AgentState,
+    ApiRoute,
+    AssistantMessage,
+    CommandTelemetry,
+    ContentBlock,
+    DelegateAgentConfig,
+    ResultSummary,
+    SystemPromptSemantics,
+    TokenUsage,
+    TurnRecord,
+)
+from coder_eval.pricing import calculate_cost
+from coder_eval.streaming.callbacks import StreamCallback, safe_emit
+from coder_eval.streaming.collector import EventCollector
+from coder_eval.streaming.events import (
+    AgentEndEvent,
+    AgentEndStatus,
+    AgentStartEvent,
+    StreamEvent,
+    TextChunkEvent,
+    ToolEndEvent,
+    ToolEndStatus,
+    ToolStartEvent,
+    TurnEndEvent,
+    TurnEndStatus,
+    TurnStartEvent,
+)
+from coder_eval.timing import close_window
+from coder_eval.utils import process_plugins
+
+from .registry import AgentRegistry
+
+
+logger = logging.getLogger(__name__)
+
+# --- Host resolution ---------------------------------------------------------
+
+_HOST_SCRIPT = Path(__file__).parent / "delegate" / "delegate_host.mjs"
+_SDK_ENTRY_REL_PATH = Path("node_modules") / "@uipath" / "delegate-sdk" / "dist" / "index.mjs"
+
+_UNSUPPORTED_FIELDS: tuple[str, ...] = (
+    "allowed_tools",
+    "disallowed_tools",
+    "system_prompt",
+    "system_prompt_file",
+)
+"""Config fields with no Delegate SDK equivalent. ``permission_mode`` is
+deliberately absent: the SDK has no permission-prompt concept, and the field
+always carries a truthy default, so warning on it would be noise every run."""
+
+_STOP_TIMEOUT_SEC = 30.0
+_TERM_GRACE_SECONDS = 5.0
+_INIT_TIMEOUT_SEC = 60.0
+"""Deadline for the init handshake -- otherwise a host hung inside
+``agent.initialize()`` (auth refresh, backend connect) blocks ``start()``
+indefinitely, unlike every turn-scoped read, which is deadline-bounded."""
+_SIGKILL: signal.Signals = getattr(signal, "SIGKILL", signal.SIGTERM)
+
+# The SDK event types this host forwards verbatim that carry model-turn content.
+# `session_start` / `step` / `done` are recognized-but-informational; anything
+# else is logged and ignored rather than silently dropped.
+_TEXT_EVENT_TYPES = frozenset({"thinking", "message"})
+
+
+def _candidate_install_roots() -> list[Path]:
+    """Ancestor-walk search roots: cwd, its ancestors, and home.
+
+    Mirrors Node's own module resolution so an ``npm install`` run in the
+    launch directory, any ancestor, or (where npm lands a package when the cwd
+    has no ``package.json``) home, is found with zero configuration.
+    """
+    cwd = Path.cwd().resolve()
+    roots: list[Path] = [cwd, *cwd.parents]
+    home = Path.home().resolve()
+    if home not in roots:
+        roots.append(home)
+    return roots
+
+
+def _resolve_sdk_entry() -> Path:
+    """Locate the installed ``@uipath/delegate-sdk``'s ``dist/index.mjs``.
+
+    Resolution order: ``DELEGATE_SDK_PATH`` (explicit file path) ->
+    ``DELEGATE_SDK_NODE_MODULES`` (explicit install root, probed exactly) ->
+    ancestor walk from cwd (plus home), so an ``npm install`` anywhere in that
+    chain — including this module's own ``agents/delegate/`` directory, which
+    ships a ``package.json`` naming the dependency — is found automatically.
+
+    Raises:
+        AgentConfigError: no install found anywhere searched.
+    """
+    explicit = os.environ.get("DELEGATE_SDK_PATH")
+    if explicit:
+        path = Path(explicit).expanduser().resolve()
+        if not path.is_file():
+            raise AgentConfigError(
+                f"DELEGATE_SDK_PATH={path} does not point to a file. Point it at "
+                + "@uipath/delegate-sdk's dist/index.mjs."
+            )
+        return path
+
+    root_override = os.environ.get("DELEGATE_SDK_NODE_MODULES")
+    if root_override:
+        path = (Path(root_override).expanduser().resolve() / _SDK_ENTRY_REL_PATH).resolve()
+        if not path.is_file():
+            raise AgentConfigError(
+                f"DELEGATE_SDK_NODE_MODULES={root_override}: @uipath/delegate-sdk not found at {path}. "
+                + "Run `npm install @uipath/delegate-sdk` there, or set DELEGATE_SDK_PATH directly."
+            )
+        return path
+
+    searched: list[Path] = []
+    for root in _candidate_install_roots():
+        candidate = (root / _SDK_ENTRY_REL_PATH).resolve()
+        searched.append(candidate)
+        if candidate.is_file():
+            return candidate
+
+    searched_block = "\n  ".join(str(p) for p in searched)
+    raise AgentConfigError(
+        "@uipath/delegate-sdk not found. Searched the cwd, its ancestors, and home:\n"
+        + f"  {searched_block}\n"
+        + "Run `npm install @uipath/delegate-sdk` (plain, public install — no token needed), "
+        + "e.g. in this framework's own agents/delegate/ directory, or set DELEGATE_SDK_NODE_MODULES "
+        + "to the install root, or DELEGATE_SDK_PATH to the dist/index.mjs file directly. "
+        + "See docs/agents/DELEGATE.md."
+    )
+
+
+def _resolve_bundled_skills_path(plugins: list[dict[str, Any]] | None) -> str | None:
+    """Translate the first ``local`` plugin's ``path`` to the SDK's ``bundledSkillsPath``.
+
+    The SDK expects ``bundledSkillsPath`` to point at ONE directory whose direct
+    children are skill folders — a different shape than ``agents/_skills.py``'s
+    shared resolver, which enumerates individual skill directories for CLIs that
+    take a repeated ``--skill <dir>`` list (OpenCode/Pi). That resolver does not
+    fit here, so this mirrors the coder_eval_uipath sibling's own mapping
+    instead: ``<plugin.path>/skills``, first plugin wins.
+    """
+    expanded = process_plugins(plugins or [], log=logger)
+    if not expanded:
+        return None
+    first = expanded[0]
+    if "path" not in first:
+        logger.warning("delegate: plugin missing 'path' field — skipping: %r", first)
+        return None
+    if len(expanded) > 1:
+        others = [p.get("path", repr(p)) for p in expanded[1:]]
+        logger.warning("delegate: only one plugin is supported; using %s and ignoring: %s", first["path"], others)
+    return str(Path(first["path"]) / "skills")
+
+
+def _parse_usage(raw: Any) -> TokenUsage | None:
+    """Best-effort parse of an event/result's ``usage`` payload into ``TokenUsage``.
+
+    UNVERIFIED: the SDK confirms an ``usage`` field exists on at least some
+    events, but not its internal bucket key names. Tries several plausible
+    spellings (snake_case, as the internal sibling agent's protocol used; and
+    camelCase, in case this layer differs) and falls back to 0 for anything it
+    cannot read, mirroring the project's "warn on drift, never raise" contract.
+    """
+    if not isinstance(raw, dict):
+        return None
+
+    def _int(*keys: str) -> int:
+        for key in keys:
+            value = raw.get(key)
+            if isinstance(value, bool):
+                continue
+            if isinstance(value, int) and value >= 0:
+                return value
+        return 0
+
+    input_tokens = _int("input_tokens", "inputTokens", "uncached_input_tokens")
+    output_tokens = _int("output_tokens", "outputTokens")
+    cache_creation = _int("cache_creation_input_tokens", "cacheCreationInputTokens", "cache_write", "cacheWrite")
+    cache_read = _int("cache_read_input_tokens", "cacheReadInputTokens", "cache_read", "cacheRead")
+    if input_tokens == 0 and output_tokens == 0 and cache_creation == 0 and cache_read == 0:
+        return None
+    return TokenUsage(
+        uncached_input_tokens=input_tokens,
+        output_tokens=output_tokens,
+        cache_creation_input_tokens=cache_creation,
+        cache_read_input_tokens=cache_read,
+    )
+
+
+class _TurnState:
+    """Per-``communicate()`` accumulator.
+
+    One ``AssistantMessage`` per turn (see module docstring's "No
+    multi-generation transcript splitting"), so this is far smaller than the
+    per-round-trip segment machinery a richer transcript would need.
+    """
+
+    def __init__(self, *, task_id: str, iteration: int, user_input: str, model: str | None) -> None:
+        self.task_id = task_id
+        self.iteration = iteration
+        self.user_input = user_input
+        self.model = model
+        self.turn_id = f"delegate-{iteration}"
+        self.started_at = time.monotonic()
+        self.started_dt = datetime.now()
+
+        self.content_blocks: list[ContentBlock] = []
+        self.text_parts: list[str] = []
+        self.tool_use_ids: list[str] = []
+        self.open_tools: dict[str, CommandTelemetry] = {}
+        self.sequence = 0
+        self.message_events = 0
+
+        self.model_used: str | None = model
+        self.session_id: str | None = None
+        self.usage: TokenUsage | None = None
+        self.final_response: str | None = None
+        self.error_message: str | None = None
+        self.max_turns_exhausted = False
+        self.finalized = False
+
+    @property
+    def agent_output(self) -> str:
+        return self.final_response if self.final_response is not None else "".join(self.text_parts)
+
+
+@AgentRegistry.register(AgentKind.DELEGATE, DelegateAgentConfig)
+class DelegateAgent(Agent[DelegateAgentConfig]):
+    """Drives UiPath Autopilot's Delegate agent through a persistent Node host subprocess.
+
+    See module docstring for prerequisites and the deliberate scope reductions
+    versus the UiPath-only sibling plugin's more hardened adapter.
+    """
+
+    # The host streams one event per model/tool step, checked after each.
+    supports_cooperative_stop: ClassVar[bool] = True
+
+    # The Delegate SDK has no CLI-style system-prompt knob to append/replace onto.
+    system_prompt_semantics: ClassVar[SystemPromptSemantics] = "unknown"
+
+    def __init__(
+        self,
+        config: DelegateAgentConfig,
+        route: ApiRoute | None = None,
+        *,
+        task_id: str = "unknown",
+    ) -> None:
+        """Every parameter the agent factory can pass is DECLARED, not absorbed.
+
+        ``route`` is accepted for factory parity and deliberately unused — the
+        Delegate SDK has its own UiPath auth path, not Anthropic-style routing.
+        """
+        self.config = config
+        self.route = route
+        self.task_id = task_id
+        self.working_directory: str | None = None
+        self._env_path_prepend: list[str] = []
+        self._plugin_tools_dir: str | None = None
+        self._session_id: str | None = None
+        self._state = AgentState.WORKING
+
+        self._sdk_entry: Path | None = None
+        self._process: asyncio.subprocess.Process | None = None
+        self._stdout_task: asyncio.Task[None] | None = None
+        self._stderr_task: asyncio.Task[None] | None = None
+        self._stdout_queue: asyncio.Queue[dict[str, Any] | None] = asyncio.Queue()
+        self._stderr_lines: list[str] = []
+
+    # --- lifecycle -----------------------------------------------------------
+
+    async def start(
+        self,
+        working_directory: str,
+        *,
+        env_path_prepend: list[str] | None = None,
+        plugin_tools_dir: str | None = None,
+    ) -> None:
+        if shutil.which("node") is None:
+            raise AgentConfigError(
+                "Node.js was not found on PATH. Install it (https://nodejs.org/), "
+                + "then `npm install @uipath/delegate-sdk`. See docs/agents/DELEGATE.md."
+            )
+        self._sdk_entry = _resolve_sdk_entry()
+
+        ignored = [f for f in _UNSUPPORTED_FIELDS if getattr(self.config, f, None)]
+        if ignored:
+            logger.warning(
+                "delegate: %s set but has no Delegate SDK equivalent — NOT enforced; do not rely on "
+                + "them as a boundary (see docs/agents/DELEGATE.md).",
+                ", ".join(ignored),
+            )
+
+        self.working_directory = working_directory
+        self._env_path_prepend = list(env_path_prepend or [])
+        self._plugin_tools_dir = plugin_tools_dir
+        self._session_id = self.config.session_id or None
+        self._state = AgentState.WORKING
+
+        await self._spawn_and_init()
+
+    async def _spawn_and_init(self) -> None:
+        assert self._sdk_entry is not None, "start() must resolve the SDK entry before spawning"
+        env = dict(os.environ)
+        if self._env_path_prepend:
+            env["PATH"] = os.pathsep.join([*self._env_path_prepend, env.get("PATH", "")])
+        if self._plugin_tools_dir and "PLUGIN_TOOLS_DIR" not in env:
+            env["PLUGIN_TOOLS_DIR"] = self._plugin_tools_dir
+        # Respect an operator's own telemetry choice; only default it off.
+        env.setdefault("DELEGATE_TELEMETRY_DISABLED", "1")
+
+        await self._cancel_drain_tasks()
+        self._stdout_queue = asyncio.Queue()
+        self._stderr_lines = []
+        self._process = await asyncio.create_subprocess_exec(
+            "node",
+            str(_HOST_SCRIPT),
+            str(self._sdk_entry),
+            cwd=str(_HOST_SCRIPT.parent),
+            stdin=asyncio.subprocess.PIPE,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+            env=env,
+            limit=STDOUT_LINE_LIMIT_BYTES,
+        )
+        assert self._process.stdout is not None
+        assert self._process.stderr is not None
+        self._stdout_task = asyncio.create_task(self._drain_stdout(self._process.stdout))
+        self._stderr_task = asyncio.create_task(self._drain_stderr(self._process.stderr))
+
+        init_options = self._build_init_options()
+        await self._send_command({"cmd": "init", "options": init_options})
+        try:
+            ack = await asyncio.wait_for(self._read_until(("init_ok", "init_error")), timeout=_INIT_TIMEOUT_SEC)
+        except TimeoutError as exc:
+            await self._force_kill_host()
+            self._process = None
+            raise AgentConfigError(
+                f"Delegate SDK init did not respond within {_INIT_TIMEOUT_SEC:.0f}s "
+                + "(hung auth refresh or backend connect?)."
+            ) from exc
+        if ack.get("type") == "init_error":
+            raise AgentConfigError(f"Delegate SDK init failed: {ack.get('message', 'unknown error')}")
+
+    def _build_init_options(self) -> dict[str, Any]:
+        options: dict[str, Any] = {
+            "workingDirectory": self.working_directory,
+            "enableComputerUse": self.config.enable_computer_use,
+        }
+        if self.config.model:
+            options["model"] = self.config.model
+        if self.config.effort:
+            options["effort"] = self.config.effort
+        if self.config.project_id:
+            options["projectId"] = self.config.project_id
+        if self.config.session_id:
+            options["sessionId"] = self.config.session_id
+        if self._env_path_prepend:
+            options["shellPathPrepend"] = list(self._env_path_prepend)
+        backend_url = os.environ.get("DELEGATE_BACKEND_URL")
+        if backend_url:
+            options["backendUrl"] = backend_url
+        environment = os.environ.get("DELEGATE_ENV")
+        if environment:
+            options["environment"] = environment
+        auth_token = os.environ.get("AUTH_TOKEN")
+        if auth_token:
+            auth: dict[str, Any] = {
+                "accessToken": auth_token,
+                "tenantId": os.environ.get("TENANT_ID"),
+                "organizationId": os.environ.get("ORG_ID"),
+            }
+            # CONFIRMED LIVE: when `environment` (rather than `backendUrl`) is set,
+            # the SDK resolves the backend URL from THIS auth object's
+            # organizationName/tenantName fields, not from ORG_SLUG/TENANT_SLUG
+            # process.env directly (that pairing is documented only in the SDK's
+            # own error message, aimed at delegate-cli's env-var-driven wrapper —
+            # the SDK class we drive here never reads those two vars itself).
+            org_slug = os.environ.get("ORG_SLUG")
+            tenant_slug = os.environ.get("TENANT_SLUG")
+            if org_slug:
+                auth["organizationName"] = org_slug
+            if tenant_slug:
+                auth["tenantName"] = tenant_slug
+            options["auth"] = auth
+        skills_path = _resolve_bundled_skills_path(self.config.plugins)  # type: ignore[arg-type]
+        if skills_path:
+            options["bundledSkillsPath"] = skills_path
+        return options
+
+    async def stop(self) -> None:
+        await self._teardown_host()
+        self._mark_stopped()
+
+    async def kill(self) -> None:
+        await self._force_kill_host()
+
+    def kill_sync(self) -> None:
+        """SIGKILL the host (watchdog thread; must not await).
+
+        Drops the handle immediately rather than waiting for a reap this
+        synchronous path cannot await: the next ``communicate()`` must
+        respawn, not write a ``send`` into a pipe whose far end is dead or
+        dying.
+        """
+        proc = self._process
+        if proc is not None and proc.returncode is None:
+            with contextlib.suppress(ProcessLookupError, PermissionError):
+                os.kill(proc.pid, _SIGKILL)
+        self._process = None
+
+    async def _force_kill_host(self) -> None:
+        proc = self._process
+        if proc is not None and proc.returncode is None:
+            with contextlib.suppress(ProcessLookupError):
+                proc.kill()
+            with contextlib.suppress(TimeoutError, asyncio.TimeoutError):
+                await asyncio.wait_for(proc.wait(), timeout=_TERM_GRACE_SECONDS)
+
+    async def _cancel_drain_tasks(self) -> None:
+        """Cancel and await the stdout/stderr drain tasks of the CURRENT host, if any.
+
+        Must run before ``_spawn_and_init`` reassigns ``_stdout_task`` /
+        ``_stderr_task`` for a respawn, or the previous host's tasks are
+        dropped uncancelled rather than torn down (they self-terminate on
+        their pipe's EOF either way, but dropping a live task silently is the
+        pattern this project's teardown paths avoid elsewhere).
+        """
+        for task in (self._stdout_task, self._stderr_task):
+            if task is not None:
+                task.cancel()
+                with contextlib.suppress(asyncio.CancelledError, Exception):
+                    await task
+        self._stdout_task = None
+        self._stderr_task = None
+
+    async def _teardown_host(self) -> None:
+        if self._process is not None and self._process.returncode is None:
+            with contextlib.suppress(Exception):
+                await self._send_command({"cmd": "destroy"})
+            with contextlib.suppress(TimeoutError, asyncio.TimeoutError):
+                await asyncio.wait_for(self._process.wait(), timeout=_STOP_TIMEOUT_SEC)
+        await self._force_kill_host()
+        await self._cancel_drain_tasks()
+        self._process = None
+
+    def get_environment_info(self) -> dict[str, Any]:
+        info: dict[str, Any] = {
+            **super().get_environment_info(),
+            "delegate_model": self.config.model,
+        }
+        # None (not a hardcoded "alpha") when unset: _build_init_options forwards
+        # `environment` to the SDK only when the var is actually set, so recording
+        # a fallback here would assert a routing decision the SDK never made.
+        environment = os.environ.get("DELEGATE_ENV")
+        if environment:
+            info["delegate_env"] = environment
+        if self._session_id:
+            info["delegate_session_id"] = self._session_id
+        return info
+
+    # --- the turn --------------------------------------------------------
+
+    async def communicate(
+        self,
+        user_input: str,
+        *,
+        stream_callback: StreamCallback | None = None,
+        timeout: float | None = None,
+        max_turns: int | None = None,
+        should_stop: Callable[[], bool] | None = None,
+    ) -> TurnRecord:
+        if self.working_directory is None:
+            raise RuntimeError("DelegateAgent.start() must be called before communicate()")
+
+        if self._process is None or self._process.returncode is not None:
+            # A prior cooperative stop or crash left no live host: respawn
+            # fresh rather than fail fast. Session-conflict-specific recovery
+            # is deferred (see module docstring); this simpler policy covers
+            # both "the previous turn stopped cleanly" and "it crashed".
+            await self._spawn_and_init()
+
+        self._begin_turn()
+        collector = EventCollector()
+
+        def emit(event: StreamEvent) -> None:
+            collector.on_event(event)
+            if stream_callback is not None:
+                safe_emit(stream_callback, event)
+
+        state = _TurnState(
+            task_id=self.task_id,
+            iteration=self._iteration,
+            user_input=user_input,
+            model=self.config.model,
+        )
+
+        emit(
+            AgentStartEvent(task_id=self.task_id, prompt=user_input, iteration=self._iteration, model=self.config.model)
+        )
+        emit(TurnStartEvent(task_id=self.task_id, turn_id=state.turn_id, model=self.config.model))
+
+        deadline = None if timeout is None else time.monotonic() + timeout
+        stopped_early = False
+        try:
+            await self._send_command({"cmd": "send", "prompt": user_input, "sessionId": self._session_id})
+
+            while True:
+                remaining = None if deadline is None else deadline - time.monotonic()
+                if remaining is not None and remaining <= 0:
+                    await self._timeout_turn(state, collector, timeout or 0.0)
+
+                try:
+                    msg = await self._read_next_message(deadline)
+                except TimeoutError:
+                    # The deadline elapsed WHILE blocked reading, not just at
+                    # the top-of-loop check above -- route through the same
+                    # timeout kernel (kills the host, clears self._process) so
+                    # this is never misreported as a generic AgentCrashError,
+                    # which would leave a "send" in flight on a host the next
+                    # communicate() would wrongly reuse.
+                    await self._timeout_turn(state, collector, timeout or 0.0)
+                if msg is None:
+                    # The stream is closed. Not always because the process
+                    # already exited: _drain_stdout also signals this on a
+                    # buffer-limit overrun or its own unexpected exception,
+                    # where the host can still be alive -- force-kill before
+                    # dropping the handle so the NEXT communicate() respawns
+                    # cleanly instead of orphaning it.
+                    await self._force_kill_host()
+                    self._process = None
+                    self._crash_turn(state, collector, "Delegate host closed its output stream unexpectedly")
+
+                mtype = msg.get("type")
+                if mtype == "send_ok":
+                    self._handle_send_ok(msg, state)
+                    break
+                if mtype == "send_error":
+                    self._crash_turn(state, collector, f"Delegate send failed: {msg.get('message', 'unknown error')}")
+                if mtype == "fatal":
+                    # The host exits right after writing this line (every
+                    # `fatal` site calls process.exit) -- force-kill is then a
+                    # no-op, but stays here to match the EOF branch exactly
+                    # rather than trust that invariant from this side too.
+                    await self._force_kill_host()
+                    self._process = None
+                    self._crash_turn(state, collector, f"Delegate host crashed: {msg.get('message', 'unknown error')}")
+                if mtype in ("protocol_error", "destroy_error"):
+                    logger.warning("delegate: host reported %s: %s", mtype, msg.get("message"))
+                    continue
+
+                self._handle_event(msg, state, emit)
+
+                if max_turns is not None and state.message_events >= max_turns:
+                    state.max_turns_exhausted = True
+                    await self._force_kill_host()
+                    self._process = None  # host abandoned; next turn respawns
+                    break
+                if should_stop is not None and should_stop():
+                    stopped_early = True
+                    await self._force_kill_host()
+                    self._process = None  # host abandoned; next turn respawns
+                    break
+
+            if stopped_early:
+                status = AgentEndStatus.STOPPED_EARLY
+            elif state.max_turns_exhausted:
+                status = AgentEndStatus.MAX_TURNS_EXHAUSTED
+            else:
+                status = AgentEndStatus.COMPLETED
+            self._finalize_turn(state, status, emit)
+            record = collector.build_turn_record()
+            self._end_turn_ok()
+            return record
+
+        except (AgentCrashError, TurnTimeoutError):
+            raise
+        except asyncio.CancelledError:
+
+            def finalize_on_cancel(
+                status: AgentEndStatus, *, crashed: bool = False, crash_reason: str | None = None
+            ) -> None:
+                self._finalize_turn(state, status, emit, crashed=crashed, crash_reason=crash_reason)
+
+            self._finalize_external_cancel(finalize_on_cancel)
+            self._capture_partial_turn(collector)
+            raise
+        except Exception as e:
+            self._crash_turn(state, collector, f"Delegate turn failed: {e!s}", cause=e)
+            raise  # unreachable — _crash_turn is NoReturn
+
+    def _handle_event(self, msg: dict[str, Any], state: _TurnState, emit: Callable[[StreamEvent], None]) -> None:
+        """Dispatch one forwarded SDK event. Never raises on unrecognized shape."""
+        event_type = msg.get("type")
+        session_id = msg.get("sessionId")
+        if isinstance(session_id, str) and session_id:
+            state.session_id = session_id
+            self._session_id = session_id
+        model = msg.get("model")
+        if isinstance(model, str) and model:
+            state.model_used = model
+        usage = _parse_usage(msg.get("usage"))
+        if usage is not None:
+            state.usage = usage
+
+        if event_type in _TEXT_EVENT_TYPES:
+            text = msg.get("content")
+            if isinstance(text, str) and text:
+                state.text_parts.append(text)
+                if event_type == "message":
+                    state.message_events += 1
+                    state.content_blocks.append(
+                        ContentBlock(block_type="text", sequence=len(state.content_blocks), text=text)
+                    )
+                    emit(TextChunkEvent(task_id=self.task_id, turn_id=state.turn_id, text=text))
+                else:
+                    state.content_blocks.append(
+                        ContentBlock(block_type="thinking", sequence=len(state.content_blocks), thinking=text)
+                    )
+        elif event_type == "tool_call":
+            self._handle_tool_call(msg, state, emit)
+        elif event_type == "tool_result":
+            self._handle_tool_result(msg, state, emit)
+        elif event_type == "error":
+            message = msg.get("message") or msg.get("content") or "unknown error"
+            state.error_message = str(message)
+            logger.warning("delegate: SDK reported an error event: %s", state.error_message)
+        elif event_type in ("session_start", "step", "done"):
+            pass  # informational; no telemetry to record
+        else:
+            logger.debug("delegate: unrecognized event type %r", event_type)
+
+    def _handle_tool_call(self, msg: dict[str, Any], state: _TurnState, emit: Callable[[StreamEvent], None]) -> None:
+        # UNVERIFIED: exact id-field spelling.
+        tool_id = str(msg.get("toolId") or msg.get("id") or msg.get("callId") or uuid.uuid4())
+        tool_name = str(msg.get("toolName") or msg.get("tool") or "unknown")
+        parameters = msg.get("input")
+        parameters = parameters if isinstance(parameters, dict) else {}
+        state.sequence += 1
+        telemetry = CommandTelemetry(
+            tool_name=tool_name,
+            tool_id=tool_id,
+            assistant_turn_index=state.message_events,
+            timestamp=datetime.now(),
+            execution_started_at=datetime.now(),
+            parameters=parameters,
+            sequence_number=state.sequence,
+        )
+        state.open_tools[tool_id] = telemetry
+        state.tool_use_ids.append(tool_id)
+        state.content_blocks.append(
+            ContentBlock(block_type="tool_use", sequence=len(state.content_blocks), tool_use_id=tool_id)
+        )
+        emit(ToolStartEvent(task_id=self.task_id, turn_id=state.turn_id, tool=telemetry))
+
+    def _handle_tool_result(self, msg: dict[str, Any], state: _TurnState, emit: Callable[[StreamEvent], None]) -> None:
+        tool_id = str(msg.get("toolId") or msg.get("id") or msg.get("callId") or "")
+        telemetry = state.open_tools.pop(tool_id, None)
+        if telemetry is None:
+            # A result with no matching open call (id mismatch or unknown shape).
+            # Never drop it: synthesize a telemetry row rather than lose the
+            # event.
+            state.sequence += 1
+            telemetry = CommandTelemetry(
+                tool_name="unknown",
+                tool_id=tool_id or str(uuid.uuid4()),
+                assistant_turn_index=state.message_events,
+                timestamp=datetime.now(),
+                sequence_number=state.sequence,
+            )
+        error_text = msg.get("error")
+        output = msg.get("output") if "output" in msg else msg.get("content")
+        completed = datetime.now()
+        telemetry.execution_completed_at = completed
+        if telemetry.execution_started_at is not None:
+            telemetry.duration_ms = (completed - telemetry.execution_started_at).total_seconds() * 1000
+        if error_text:
+            status = ToolEndStatus.ERROR
+            telemetry.result_status = "error"
+            telemetry.error_message = str(error_text)
+        else:
+            status = ToolEndStatus.OK
+            telemetry.result_status = "success"
+        if isinstance(output, str):
+            telemetry.result_summary = output
+        elif output is not None:
+            # A dict/list result must not be silently dropped -- serialize
+            # rather than lose it (CE043: stored whole, never truncated).
+            telemetry.result_summary = json.dumps(output)
+        else:
+            telemetry.result_summary = None
+        emit(ToolEndEvent(task_id=self.task_id, turn_id=state.turn_id, tool=telemetry, status=status))
+
+    def _handle_send_ok(self, msg: dict[str, Any], state: _TurnState) -> None:
+        result = msg.get("result")
+        if isinstance(result, str):
+            state.final_response = result
+        elif isinstance(result, dict):
+            response = result.get("response") or result.get("content")
+            if isinstance(response, str):
+                state.final_response = response
+            session_id = result.get("sessionId")
+            if isinstance(session_id, str) and session_id:
+                state.session_id = session_id
+                self._session_id = session_id
+            usage = _parse_usage(result.get("usage"))
+            if usage is not None:
+                state.usage = usage
+            model = result.get("model")
+            if isinstance(model, str) and model:
+                state.model_used = model
+
+    def _close_open_tools(self, state: _TurnState, emit: Callable[[StreamEvent], None]) -> None:
+        for tool_id, telemetry in list(state.open_tools.items()):
+            telemetry.result_status = "unknown"
+            emit(
+                ToolEndEvent(
+                    task_id=self.task_id, turn_id=state.turn_id, tool=telemetry, status=ToolEndStatus.UNRESOLVED
+                )
+            )
+            del state.open_tools[tool_id]
+
+    def _finalize_turn(
+        self,
+        state: _TurnState,
+        status: AgentEndStatus,
+        emit: Callable[[StreamEvent], None],
+        *,
+        crashed: bool = False,
+        crash_reason: str | None = None,
+    ) -> None:
+        if state.finalized:
+            return
+        state.finalized = True
+        self._close_open_tools(state, emit)
+
+        usage = state.usage or TokenUsage()
+        if not usage.is_empty():
+            cost = calculate_cost(
+                state.model_used or self.config.model or "",
+                uncached_input_tokens=usage.uncached_input_tokens,
+                output_tokens=usage.output_tokens,
+                cache_creation_tokens=usage.cache_creation_input_tokens,
+                cache_read_tokens=usage.cache_read_input_tokens,
+            )
+            if cost is not None:
+                usage = usage.model_copy(update={"total_cost_usd": cost})
+
+        messages = []
+        if state.content_blocks:
+            completed = datetime.now()
+            # Single generation window for the whole turn (see module docstring's
+            # "No multi-generation transcript splitting"): tiles from the turn's
+            # own start, since there is no prior emission to tile from.
+            started, generation_ms = close_window(mark=state.started_dt, now=completed)
+            messages.append(
+                AssistantMessage(
+                    started_at=started,
+                    completed_at=completed,
+                    generation_duration_ms=generation_ms,
+                    content_blocks=state.content_blocks,
+                    tool_use_ids=list(state.tool_use_ids),
+                    input_tokens=usage.uncached_input_tokens,
+                    output_tokens=usage.output_tokens,
+                    cache_creation_tokens=usage.cache_creation_input_tokens,
+                    cache_read_tokens=usage.cache_read_input_tokens,
+                    model=state.model_used,
+                    message_id=f"{state.turn_id}-msg-0",
+                )
+            )
+
+        emit(
+            TurnEndEvent(
+                task_id=self.task_id,
+                turn_id=state.turn_id,
+                status=TurnEndStatus(status.value),
+                tokens=usage if not usage.is_empty() else None,
+            )
+        )
+        emit(
+            AgentEndEvent(
+                task_id=self.task_id,
+                status=status,
+                usage=usage,
+                iteration=state.iteration,
+                user_input=state.user_input,
+                agent_output=state.agent_output,
+                model_used=state.model_used,
+                assistant_turn_count=max(state.message_events, 1) if not crashed else state.message_events,
+                messages=messages,
+                num_turns=None if crashed else max(state.message_events, 1),
+                max_turns_exhausted=state.max_turns_exhausted,
+                result_summary=ResultSummary(
+                    is_error=crashed,
+                    subtype=status.value,
+                    stop_reason=None,
+                    result=crash_reason or state.error_message,
+                ),
+                crashed=crashed,
+                crash_reason=crash_reason,
+                duration_seconds=time.monotonic() - state.started_at,
+            )
+        )
+
+    def _crash_turn(
+        self, state: _TurnState, collector: EventCollector, message: str, *, cause: BaseException | None = None
+    ) -> NoReturn:
+        def finalize(status: AgentEndStatus, *, crashed: bool = False, crash_reason: str | None = None) -> None:
+            self._finalize_turn(
+                state,
+                status,
+                lambda e: collector.on_event(e),
+                crashed=crashed,
+                crash_reason=crash_reason,
+            )
+
+        try:
+            self._finalize_and_raise_crash(finalize, message, cause=cause)
+        finally:
+            self._capture_partial_turn(collector)
+
+    async def _timeout_turn(self, state: _TurnState, collector: EventCollector, timeout: float) -> NoReturn:
+        await self._force_kill_host()
+        # Drop the handle so the NEXT communicate() respawns rather than reuse
+        # a killed process (or, worse, a "send" still nominally in flight).
+        self._process = None
+
+        def finalize(status: AgentEndStatus, *, crashed: bool = False, crash_reason: str | None = None) -> None:
+            self._finalize_turn(
+                state,
+                status,
+                lambda e: collector.on_event(e),
+                crashed=crashed,
+                crash_reason=crash_reason,
+            )
+
+        try:
+            self._finalize_and_raise_timeout(finalize, timeout)
+        finally:
+            self._capture_partial_turn(collector)
+
+    # --- wire I/O --------------------------------------------------------
+
+    async def _send_command(self, command: dict[str, Any]) -> None:
+        if self._process is None or self._process.stdin is None:
+            raise RuntimeError("Delegate host is not running")
+        self._process.stdin.write((json.dumps(command) + "\n").encode("utf-8"))
+        await self._process.stdin.drain()
+
+    async def _read_next_message(self, deadline: float | None) -> dict[str, Any] | None:
+        """Read the next queued host message, or raise ``TimeoutError`` past ``deadline``."""
+        timeout = None if deadline is None else max(0.0, deadline - time.monotonic())
+        return await asyncio.wait_for(self._stdout_queue.get(), timeout=timeout)
+
+    async def _read_until(self, accepted_types: tuple[str, ...]) -> dict[str, Any]:
+        while True:
+            msg = await self._stdout_queue.get()
+            if msg is None:
+                # As in communicate()'s loop: the host may still be alive
+                # (a buffer overrun or drain exception, not necessarily exit).
+                await self._force_kill_host()
+                self._process = None
+                tail = "\n".join(self._stderr_lines[-20:]) or "(no stderr captured)"
+                raise AgentCrashError(f"Delegate host exited before responding. stderr tail:\n{tail}")
+            if msg.get("type") in accepted_types:
+                return msg
+            if msg.get("type") in ("protocol_error", "fatal"):
+                logger.warning("delegate: host reported %s during init: %s", msg.get("type"), msg.get("message"))
+
+    async def _drain_stdout(self, stream: asyncio.StreamReader) -> None:
+        try:
+            while True:
+                try:
+                    line = await stream.readline()
+                except (asyncio.LimitOverrunError, ValueError) as exc:
+                    logger.error("delegate: a stdout line exceeded the buffer limit: %s", exc)
+                    self._stderr_lines.append(f"[host] stdout line exceeded buffer limit: {exc}")
+                    await self._stdout_queue.put(None)
+                    return
+                if not line:
+                    await self._stdout_queue.put(None)
+                    return
+                raw = line.decode("utf-8", "replace").strip()
+                if not raw:
+                    continue
+                try:
+                    obj = json.loads(raw)
+                except json.JSONDecodeError:
+                    # The SDK itself can write a non-JSON diagnostic line to
+                    # stdout at import time (confirmed live) — skip, don't crash.
+                    logger.debug("delegate: skipping non-JSON stdout line: %s", raw[:200])
+                    continue
+                if isinstance(obj, dict):
+                    await self._stdout_queue.put(obj)
+        except BaseException:
+            logger.exception("delegate: stdout drain failed")
+            await self._stdout_queue.put(None)
+            raise
+
+    async def _drain_stderr(self, stream: asyncio.StreamReader) -> None:
+        try:
+            while True:
+                try:
+                    line = await stream.readline()
+                except (asyncio.LimitOverrunError, ValueError):
+                    continue
+                if not line:
+                    return
+                text = line.decode("utf-8", "replace").rstrip()
+                if text:
+                    self._stderr_lines.append(text)
+                    logger.debug("delegate[stderr]: %s", text)
+        except Exception:
+            logger.exception("delegate: stderr drain failed")
diff --git a/src/coder_eval/models/__init__.py b/src/coder_eval/models/__init__.py
index 02648225e..89badf6d8 100644
--- a/src/coder_eval/models/__init__.py
+++ b/src/coder_eval/models/__init__.py
@@ -11,6 +11,7 @@
     BaseAgentConfig,
     ClaudeCodeAgentConfig,
     CodexAgentConfig,
+    DelegateAgentConfig,
     LocalPluginConfig,
     NoneAgentConfig,
     OpenCodeAgentConfig,
@@ -239,6 +240,7 @@
     "BaseAgentConfig",
     "ClaudeCodeAgentConfig",
     "CodexAgentConfig",
+    "DelegateAgentConfig",
     "LocalPluginConfig",
     "NoneAgentConfig",
     "OpenCodeAgentConfig",
diff --git a/src/coder_eval/models/agent_config.py b/src/coder_eval/models/agent_config.py
index 5b74a746b..82088ca0e 100644
--- a/src/coder_eval/models/agent_config.py
+++ b/src/coder_eval/models/agent_config.py
@@ -393,6 +393,62 @@ class PiAgentConfig(BaseAgentConfig):
     )
 
 
+class DelegateAgentConfig(BaseAgentConfig):
+    """Delegate agent configuration (UiPath Autopilot's Delegate agent).
+
+    Drives a Node host subprocess this framework ships (``agents/delegate/delegate_host.mjs``)
+    that wraps the public ``@uipath/delegate-sdk`` npm package's ``DelegateAgent`` class in a
+    stdio JSON-Lines protocol. The SDK's reasoning runs in the UiPath backend; its tools
+    (shell, file, Office, PDF) execute locally through a bundled interop process, so file-based
+    success criteria work as usual. See ``docs/agents/DELEGATE.md``.
+
+    ``allowed_tools`` / ``disallowed_tools`` / ``system_prompt`` / ``system_prompt_file``
+    have no Delegate SDK equivalent and are warned about, not enforced, at ``start()``.
+    ``setting_sources`` is not inherited at all (it is Claude-Code-only, declared on
+    ``ClaudeCodeAgentConfig``, not ``BaseAgentConfig``), so setting it here is a plain
+    validation error rather than a silent no-op. ``permission_mode`` is silently ignored
+    (the SDK has no permission-prompt concept). ``plugins`` skills ARE injected (first
+    plugin's ``<path>/skills`` wins).
+    """
+
+    type: Literal[AgentKind.DELEGATE]  # type: ignore[assignment]
+
+    effort: str | None = Field(
+        default=None,
+        description=(
+            "Reasoning-effort tier forwarded to the backend as-is (documented values: "
+            "low/medium/high/xhigh/max). Not validated against a closed set here — the SDK "
+            "itself ignores a value it does not recognize, and a strict Literal would reject a "
+            "tier a future SDK release adds."
+        ),
+    )
+    project_id: str = Field(
+        default="",
+        description=(
+            "Client-side wiki-routing key (never sent to the backend). Empty means session-scoped "
+            "wiki state under a server-assigned session id instead of a stable project directory."
+        ),
+    )
+    session_id: str = Field(
+        default="",
+        description=(
+            "Pins the Delegate SDK session id used when a turn omits one, for deterministic "
+            "wiki-path routing. Unlike project_id this IS a backend entity: a pinned id skips "
+            "session creation, so it must be one the backend accepts. project_id takes precedence."
+        ),
+    )
+    enable_computer_use: bool = Field(
+        default=False,
+        description=(
+            "Forwarded as the SDK's enableComputerUse. False (the default, and NOT the SDK's own "
+            "default of True) drops screenshots/window-list/focused-element/UI-automation tools "
+            "only — file, shell, Office and PDF tools are unaffected. Kept off by default because "
+            "this is a headless eval harness: True requires macOS Accessibility/Screen-Recording "
+            "grants that a CI runner does not have, and throws unconditionally on Linux."
+        ),
+    )
+
+
 class NoneAgentConfig(BaseAgentConfig):
     """No-op ("agentless") agent configuration.
 
@@ -421,6 +477,7 @@ class NoneAgentConfig(BaseAgentConfig):
     | AntigravityAgentConfig
     | OpenCodeAgentConfig
     | PiAgentConfig
+    | DelegateAgentConfig
     | NoneAgentConfig,
     Field(discriminator="type"),
 ]
diff --git a/src/coder_eval/models/enums.py b/src/coder_eval/models/enums.py
index 6baa96dba..cb3b6398a 100644
--- a/src/coder_eval/models/enums.py
+++ b/src/coder_eval/models/enums.py
@@ -150,6 +150,7 @@ class AgentKind(StrEnum):
     ANTIGRAVITY = "antigravity"
     OPENCODE = "opencode"
     PI = "pi"
+    DELEGATE = "delegate"
     NONE = "none"  # Agentless / system task — no coding agent runs; success criteria do all the work.
     UNKNOWN = "unknown"  # Used when agent type cannot be determined (e.g., task loading failure)
 
diff --git a/src/coder_eval/pricing.py b/src/coder_eval/pricing.py
index 0e4d2fc1b..0c9ddd6fe 100644
--- a/src/coder_eval/pricing.py
+++ b/src/coder_eval/pricing.py
@@ -35,6 +35,30 @@ class ModelPricing:
     per_request_billing: bool = False
 
 
+# Models the Delegate agent serves, under the SDK's own hyphenated ids -- a
+# dict of its own (not inlined into _PRICING) so DELEGATE_MODEL_IDS below can
+# be derived rather than hand-copied. gpt-5-4/5-5/5-6-sol's rates are NOT typos
+# -- see .claude/notes/agents.md § Delegate agent pricing before "fixing" them.
+_DELEGATE_PRICING: dict[str, ModelPricing] = {
+    "virtuoso-1-5": ModelPricing(0.95, 4.0, 0.0, 0.16),
+    "virtuoso-2-0": ModelPricing(0.95, 4.0, 0.0, 0.19),
+    "gemini-3-5-flash": ModelPricing(1.50, 9.0, 0.0, 0.15),
+    "gemini-3-6-flash": ModelPricing(1.50, 7.50, 0.0, 0.15),
+    "gemini-3-1-pro-preview": ModelPricing(2.0, 12.0, 0.0, 0.20),
+    "gpt-5-4": ModelPricing(2.50, 15.0, 15.0, 0.25),
+    "gpt-5-5": ModelPricing(5.0, 30.0, 30.0, 0.50),
+    "gpt-5-6-sol": ModelPricing(5.0, 30.0, 6.25, 0.50),
+    "gpt-5-6-terra": ModelPricing(2.0, 12.0, 2.50, 0.20),
+    "gpt-5-6-luna": ModelPricing(0.20, 1.20, 0.25, 0.02),
+    "kimi-k2-7-code": ModelPricing(0.95, 4.0, 0.0, 0.19),
+    "glm-5-3-flash": ModelPricing(0.15, 0.50, 0.0, 0.03),
+}
+
+DELEGATE_MODEL_IDS: frozenset[str] = frozenset(_DELEGATE_PRICING)
+"""Model ids the Delegate agent serves, for a test/doc that needs the real set
+rather than a second hand-copied literal that could drift from ``_DELEGATE_PRICING``."""
+
+
 _PRICING: dict[str, ModelPricing] = {
     # Fable 5.1 (and Mythos 5.1) price cache hits at 0.025x input, not the 0.1x
     # every other Claude model uses. Fable 5 pays $1 on the identical $10 base.
@@ -123,6 +147,7 @@ class ModelPricing:
     "moonshotai/kimi-k3": ModelPricing(3.0, 15.0, 3.0, 0.30, per_request_billing=True),
     "z-ai/glm-5.2": ModelPricing(0.966, 3.036, 0.966, 0.1932, per_request_billing=True),
     "deepseek/deepseek-v4-pro": ModelPricing(1.030776, 2.061552, 1.030776, 0.085898, per_request_billing=True),
+    **_DELEGATE_PRICING,
 }
 
 
diff --git a/tasks/delegate/fizzbuzz_delegate.yaml b/tasks/delegate/fizzbuzz_delegate.yaml
new file mode 100644
index 000000000..2b1d86f6a
--- /dev/null
+++ b/tasks/delegate/fizzbuzz_delegate.yaml
@@ -0,0 +1,24 @@
+task_id: "fizzbuzz_delegate"
+description: "Classic FizzBuzz implementation, run through the Delegate agent."
+initial_prompt: "Write a Python script named fizzbuzz.py that prints the numbers from 1 to 30, one per line. For multiples of 3 print 'Fizz' instead of the number, for multiples of 5 print 'Buzz', and for multiples of both print 'FizzBuzz'. Then run it with: python fizzbuzz.py"
+tags: [smoke, basic, pure-python, delegate]
+
+run_limits:
+  expected_turns: 5
+  task_timeout: 600
+
+agent:
+  type: "delegate"
+  model: "virtuoso-1-5"
+  enable_computer_use: false
+
+success_criteria:
+  - type: "file_exists"
+    path: "fizzbuzz.py"
+    description: "The file fizzbuzz.py must be created."
+  - type: "run_command"
+    command: "python fizzbuzz.py"
+    timeout: 10
+    expected_stdout: "FizzBuzz"
+    stdout_match: "contains"
+    description: "Output must contain FizzBuzz for multiples of 15."
diff --git a/tasks/delegate/hello_date_delegate.yaml b/tasks/delegate/hello_date_delegate.yaml
new file mode 100644
index 000000000..a299d5bba
--- /dev/null
+++ b/tasks/delegate/hello_date_delegate.yaml
@@ -0,0 +1,32 @@
+task_id: "hello_date_delegate_smoke_test"
+description: "Smoke-test the Delegate agent harness: create and run a small Python script."
+initial_prompt: "Create a Python file named app.py in the current working directory that prints 'Hello, Delegate!' on one line, and today's date in YYYY-MM-DD format on the next line. Use the datetime module. Then run the script with: python app.py"
+# No `smoke-pass`: that tag routes a task into the CI E2E bucket, which has no
+# UiPath auth or @uipath/delegate-sdk install. Run this task locally (or in a
+# job that provisions both) instead.
+tags: [smoke, basic, pure-python, delegate]
+
+run_limits:
+  expected_turns: 5
+  task_timeout: 600
+
+agent:
+  type: "delegate"
+  # Pin a model your tenant+environment actually serves; the framework's
+  # inherited default is a Claude id the Delegate backend may not have
+  # deployed. virtuoso-1-5 is the Delegate SDK's own default.
+  model: "virtuoso-1-5"
+  enable_computer_use: false
+
+success_criteria:
+  - type: "file_exists"
+    path: "app.py"
+    description: "The file app.py must be created."
+  - type: "file_contains"
+    path: "app.py"
+    includes: ["Hello, Delegate!", "datetime"]
+    description: "The script must contain the required string and import."
+  - type: "run_command"
+    command: "python app.py"
+    timeout: 10
+    description: "The script must execute successfully."
diff --git a/tests/lint/agent_roster_parity.py b/tests/lint/agent_roster_parity.py
index 388a0009f..06df1fb38 100644
--- a/tests/lint/agent_roster_parity.py
+++ b/tests/lint/agent_roster_parity.py
@@ -47,6 +47,7 @@
     "antigravity": ("Antigravity", "Gemini"),
     "opencode": ("OpenCode",),
     "pi": ("Pi",),
+    "delegate": ("Delegate",),
 }
 
 
diff --git a/tests/test_agent_golden_master.py b/tests/test_agent_golden_master.py
index 0438f10ab..122731273 100644
--- a/tests/test_agent_golden_master.py
+++ b/tests/test_agent_golden_master.py
@@ -236,6 +236,10 @@ async def test_pi_reconciliation_invariant(scenario, tmp_path):
 _NO_GOLDEN_COVERAGE: dict[AgentKind, str] = {
     AgentKind.NONE: "agentless backend — runs no model, streams nothing",
     AgentKind.UNKNOWN: "sentinel for an undeterminable type — never registered",
+    # SDK event field shapes UNVERIFIED against a live backend; a snapshot built
+    # on guessed names would pin the guess as "correct". See delegate_agent.py.
+    # Rationale: .claude/notes/agents.md § Delegate agent
+    AgentKind.DELEGATE: "field shapes UNVERIFIED against a live backend — see delegate_agent.py",
 }
 
 
diff --git a/tests/test_custom_lint.py b/tests/test_custom_lint.py
index be986fa87..46cf50f9c 100644
--- a/tests/test_custom_lint.py
+++ b/tests/test_custom_lint.py
@@ -4546,13 +4546,13 @@ def test_catches_the_opencode_regression(self):
         # The exact historical gap: a surface listing three of the four harnesses.
         from tests.lint.agent_roster_parity import missing_agents_in
 
-        three_of_four = "runs Claude Code, Codex, Antigravity (Gemini), or Pi in a sandbox"
+        three_of_four = "runs Claude Code, Codex, Antigravity (Gemini), Pi, or Delegate in a sandbox"
         assert missing_agents_in(three_of_four) == ["opencode"]
 
     def test_model_name_counts_as_naming_the_antigravity_row(self):
         from tests.lint.agent_roster_parity import missing_agents_in
 
-        assert missing_agents_in("Claude Code, Codex, Gemini, OpenCode, and Pi") == []
+        assert missing_agents_in("Claude Code, Codex, Gemini, OpenCode, Pi, and Delegate") == []
 
     def test_short_name_is_not_satisfied_by_a_substring(self):
         # The matcher is word-boundary anchored, so the 2-char "Pi" row is NOT
diff --git a/tests/test_delegate_agent.py b/tests/test_delegate_agent.py
new file mode 100644
index 000000000..118737879
--- /dev/null
+++ b/tests/test_delegate_agent.py
@@ -0,0 +1,451 @@
+"""Unit tests for :class:`coder_eval.agents.delegate_agent.DelegateAgent`.
+
+The Node host is never spawned for real: ``asyncio.create_subprocess_exec`` is
+patched with a fake process whose stdout/stderr are pre-scripted byte lines and
+whose stdin captures every write for assertion, mirroring this repo's existing
+CLI-agent test convention (see ``tests/test_opencode_agent.py``).
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+from typing import Any
+
+import pytest
+
+from coder_eval.agents import delegate_agent as agent_module
+from coder_eval.agents.delegate_agent import DelegateAgent, _resolve_sdk_entry
+from coder_eval.agents.registry import AgentRegistry, create_agent
+from coder_eval.errors import AgentConfigError, AgentCrashError, TurnTimeoutError
+from coder_eval.models import AgentKind, DelegateAgentConfig
+from coder_eval.streaming.events import AgentEndEvent, AgentEndStatus, AgentStartEvent
+
+
+def _line(obj: dict[str, Any]) -> bytes:
+    return (json.dumps(obj) + "\n").encode("utf-8")
+
+
+class _FakeStreamReader:
+    def __init__(self, lines: list[bytes], *, hang_after: bool = False) -> None:
+        self._lines = list(lines)
+        self._hang_after = hang_after
+
+    async def readline(self) -> bytes:
+        if self._lines:
+            return self._lines.pop(0)
+        if self._hang_after:
+            # Never resolves -- for exercising a timeout that elapses WHILE
+            # blocked reading, not just the loop's own top-of-iteration
+            # pre-check.
+            await asyncio.Event().wait()
+        return b""
+
+
+class _FakeStdin:
+    def __init__(self) -> None:
+        self.written: list[dict[str, Any]] = []
+        self.closed = False
+
+    def write(self, data: bytes) -> None:
+        self.written.append(json.loads(data.decode("utf-8").strip()))
+
+    async def drain(self) -> None:
+        return None
+
+    def close(self) -> None:
+        self.closed = True
+
+
+class _FakeProcess:
+    def __init__(
+        self, stdout_lines: list[bytes], stderr_lines: list[bytes] | None = None, *, hang_after: bool = False
+    ) -> None:
+        self.stdin = _FakeStdin()
+        self.stdout = _FakeStreamReader(stdout_lines, hang_after=hang_after)
+        self.stderr = _FakeStreamReader(stderr_lines or [])
+        self.returncode: int | None = None
+        self.pid = 4242
+        self._killed = False
+
+    async def wait(self) -> int:
+        while self.returncode is None:
+            await asyncio.sleep(0.01)
+        return self.returncode
+
+    def kill(self) -> None:
+        self._killed = True
+        self.returncode = -9
+
+    def terminate(self) -> None:
+        self.kill()
+
+
+@pytest.fixture
+def patch_exec(monkeypatch: pytest.MonkeyPatch):
+    """Patch ``create_subprocess_exec`` to return a fake process fed ``stdout_lines``."""
+
+    def _install(
+        stdout_lines: list[bytes], stderr_lines: list[bytes] | None = None, *, hang_after: bool = False
+    ) -> _FakeProcess:
+        proc = _FakeProcess(stdout_lines, stderr_lines, hang_after=hang_after)
+
+        async def fake_exec(*args: Any, **kwargs: Any) -> _FakeProcess:
+            return proc
+
+        monkeypatch.setattr(asyncio, "create_subprocess_exec", fake_exec)
+        monkeypatch.setattr("shutil.which", lambda _name: "/usr/local/bin/node")
+        monkeypatch.setattr(agent_module, "_resolve_sdk_entry", lambda: agent_module._HOST_SCRIPT)
+        return proc
+
+    return _install
+
+
+def _config(**overrides: Any) -> DelegateAgentConfig:
+    return DelegateAgentConfig(type=AgentKind.DELEGATE, **overrides)
+
+
+async def _started_agent(
+    patch_exec, stdout_lines: list[bytes], tmp_path, **config_kwargs
+) -> tuple[DelegateAgent, _FakeProcess]:
+    proc = patch_exec([_line({"type": "init_ok"}), *stdout_lines])
+    agent = DelegateAgent(_config(**config_kwargs), task_id="t1")
+    await agent.start(str(tmp_path))
+    return agent, proc
+
+
+class TestResolveSdkEntry:
+    def test_explicit_path_env_var(self, tmp_path, monkeypatch):
+        entry = tmp_path / "index.mjs"
+        entry.write_text("export const DelegateAgent = class {};")
+        monkeypatch.setenv("DELEGATE_SDK_PATH", str(entry))
+        assert _resolve_sdk_entry() == entry.resolve()
+
+    def test_explicit_path_missing_file_raises(self, tmp_path, monkeypatch):
+        monkeypatch.setenv("DELEGATE_SDK_PATH", str(tmp_path / "nope.mjs"))
+        with pytest.raises(AgentConfigError, match="does not point to a file"):
+            _resolve_sdk_entry()
+
+    def test_node_modules_override(self, tmp_path, monkeypatch):
+        monkeypatch.delenv("DELEGATE_SDK_PATH", raising=False)
+        monkeypatch.setenv("DELEGATE_SDK_NODE_MODULES", str(tmp_path))
+        entry = tmp_path / "node_modules" / "@uipath" / "delegate-sdk" / "dist" / "index.mjs"
+        entry.parent.mkdir(parents=True)
+        entry.write_text("export const DelegateAgent = class {};")
+        assert _resolve_sdk_entry() == entry.resolve()
+
+    def test_node_modules_override_missing_raises(self, tmp_path, monkeypatch):
+        monkeypatch.delenv("DELEGATE_SDK_PATH", raising=False)
+        monkeypatch.setenv("DELEGATE_SDK_NODE_MODULES", str(tmp_path))
+        with pytest.raises(AgentConfigError, match="not found"):
+            _resolve_sdk_entry()
+
+    def test_no_config_and_not_found_raises_with_search_list(self, tmp_path, monkeypatch):
+        monkeypatch.delenv("DELEGATE_SDK_PATH", raising=False)
+        monkeypatch.delenv("DELEGATE_SDK_NODE_MODULES", raising=False)
+        monkeypatch.chdir(tmp_path)
+        monkeypatch.setattr(os, "getcwd", lambda: str(tmp_path))
+        with pytest.raises(AgentConfigError, match="Searched the cwd"):
+            _resolve_sdk_entry()
+
+
+class TestStart:
+    async def test_missing_node_is_actionable(self, monkeypatch, tmp_path):
+        monkeypatch.setattr("shutil.which", lambda _name: None)
+        agent = DelegateAgent(_config())
+        with pytest.raises(AgentConfigError, match=r"Node\.js was not found"):
+            await agent.start(str(tmp_path))
+
+    async def test_init_ok_completes_start(self, patch_exec, tmp_path):
+        agent, proc = await _started_agent(patch_exec, [], tmp_path)
+        assert agent.working_directory == str(tmp_path)
+        sent = proc.stdin.written[0]
+        assert sent["cmd"] == "init"
+        assert sent["options"]["workingDirectory"] == str(tmp_path)
+
+    async def test_init_error_raises_agent_config_error(self, patch_exec, tmp_path):
+        patch_exec([_line({"type": "init_error", "message": "backendUrl is required"})])
+        agent = DelegateAgent(_config())
+        with pytest.raises(AgentConfigError, match="backendUrl is required"):
+            await agent.start(str(tmp_path))
+
+    async def test_eof_during_init_raises_crash(self, patch_exec, tmp_path):
+        patch_exec([])  # EOF immediately
+        agent = DelegateAgent(_config())
+        with pytest.raises(AgentCrashError):
+            await agent.start(str(tmp_path))
+
+    async def test_effort_and_project_id_forwarded(self, patch_exec, tmp_path):
+        _agent, proc = await _started_agent(patch_exec, [], tmp_path, effort="high", project_id="proj-1")
+        options = proc.stdin.written[0]["options"]
+        assert options["effort"] == "high"
+        assert options["projectId"] == "proj-1"
+
+    async def test_enable_computer_use_default_false(self, patch_exec, tmp_path):
+        _agent, proc = await _started_agent(patch_exec, [], tmp_path)
+        assert proc.stdin.written[0]["options"]["enableComputerUse"] is False
+
+    async def test_shell_path_prepend_forwarded(self, patch_exec, tmp_path):
+        proc = patch_exec([_line({"type": "init_ok"})])
+        agent = DelegateAgent(_config())
+        await agent.start(str(tmp_path), env_path_prepend=["/mocks/bin"])
+        assert proc.stdin.written[0]["options"]["shellPathPrepend"] == ["/mocks/bin"]
+
+    async def test_unsupported_fields_warn(self, patch_exec, tmp_path, caplog):
+        import logging
+
+        caplog.set_level(logging.WARNING)
+        await _started_agent(patch_exec, [], tmp_path, system_prompt="be nice")
+        assert any("has no Delegate SDK equivalent" in r.message for r in caplog.records)
+
+    async def test_auth_token_forwards_ids_but_not_slugs_by_default(self, patch_exec, tmp_path, monkeypatch):
+        monkeypatch.setenv("AUTH_TOKEN", "tok-1")
+        monkeypatch.setenv("TENANT_ID", "tenant-guid")
+        monkeypatch.setenv("ORG_ID", "org-guid")
+        monkeypatch.delenv("ORG_SLUG", raising=False)
+        monkeypatch.delenv("TENANT_SLUG", raising=False)
+        _agent, proc = await _started_agent(patch_exec, [], tmp_path)
+        auth = proc.stdin.written[0]["options"]["auth"]
+        assert auth == {"accessToken": "tok-1", "tenantId": "tenant-guid", "organizationId": "org-guid"}
+
+    async def test_org_and_tenant_slug_forwarded_into_auth(self, patch_exec, tmp_path, monkeypatch):
+        """Regression test: the SDK's `environment` resolution reads
+        organizationName/tenantName off the `auth` object it's given, NOT
+        ORG_SLUG/TENANT_SLUG from process.env directly (confirmed live against
+        the installed @uipath/delegate-sdk) -- so these two env vars must be
+        translated into `auth` fields here, or `environment: "alpha"` fails
+        init with "--env alpha needs org/tenant slugs" even with a valid
+        AUTH_TOKEN/TENANT_ID/ORG_ID triple.
+        """
+        monkeypatch.setenv("AUTH_TOKEN", "tok-1")
+        monkeypatch.setenv("TENANT_ID", "tenant-guid")
+        monkeypatch.setenv("ORG_ID", "org-guid")
+        monkeypatch.setenv("ORG_SLUG", "my-org")
+        monkeypatch.setenv("TENANT_SLUG", "my-tenant")
+        _agent, proc = await _started_agent(patch_exec, [], tmp_path)
+        auth = proc.stdin.written[0]["options"]["auth"]
+        assert auth == {
+            "accessToken": "tok-1",
+            "tenantId": "tenant-guid",
+            "organizationId": "org-guid",
+            "organizationName": "my-org",
+            "tenantName": "my-tenant",
+        }
+
+
+class TestCommunicate:
+    async def test_happy_path_text_and_tool(self, patch_exec, tmp_path):
+        events = [
+            _line({"type": "thinking", "content": "let me think"}),
+            _line({"type": "message", "content": "here is my answer"}),
+            _line({"type": "tool_call", "toolName": "Bash", "toolId": "tool-1", "input": {"command": "ls"}}),
+            _line({"type": "tool_result", "toolId": "tool-1", "output": "file.txt"}),
+            _line({"type": "send_ok", "result": {"response": "here is my answer", "sessionId": "sess-1"}}),
+        ]
+        agent, proc = await _started_agent(patch_exec, events, tmp_path)
+        record = await agent.communicate("do something")
+
+        assert record.agent_output == "here is my answer"
+        assert not record.crashed
+        assert len(record.commands) == 1
+        assert record.commands[0].tool_name == "Bash"
+        assert record.commands[0].result_status == "success"
+        sent = proc.stdin.written[1]
+        assert sent == {"cmd": "send", "prompt": "do something", "sessionId": None}
+        # Session id from send_ok is remembered for the NEXT turn.
+        assert agent._session_id == "sess-1"
+
+    async def test_send_error_raises_crash(self, patch_exec, tmp_path):
+        events = [_line({"type": "send_error", "message": "network blip"})]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        with pytest.raises(AgentCrashError, match="network blip"):
+            await agent.communicate("hi")
+        assert agent.pending_turn is not None
+        assert agent.pending_turn.crashed is True
+
+    async def test_fatal_raises_crash(self, patch_exec, tmp_path):
+        events = [_line({"type": "fatal", "message": "uncaught exception: boom"})]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        with pytest.raises(AgentCrashError):
+            await agent.communicate("hi")
+
+    async def test_eof_mid_turn_raises_crash(self, patch_exec, tmp_path):
+        agent, _ = await _started_agent(patch_exec, [], tmp_path)
+        with pytest.raises(AgentCrashError, match="closed its output stream"):
+            await agent.communicate("hi")
+
+    async def test_non_json_stdout_line_is_skipped_not_fatal(self, patch_exec, tmp_path):
+        events = [
+            b"[backendUrl] Module loaded - VITE_USE_CLOUD_URL: undefined\n",
+            _line({"type": "send_ok", "result": "done"}),
+        ]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        record = await agent.communicate("hi")
+        assert record.agent_output == "done"
+
+    async def test_tool_error_marks_error_status(self, patch_exec, tmp_path):
+        events = [
+            _line({"type": "tool_call", "toolName": "Bash", "toolId": "t1", "input": {}}),
+            _line({"type": "tool_result", "toolId": "t1", "error": "command not found"}),
+            _line({"type": "send_ok", "result": "done"}),
+        ]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        record = await agent.communicate("hi")
+        assert record.commands[0].result_status == "error"
+        assert record.commands[0].error_message == "command not found"
+
+    async def test_orphaned_tool_call_is_force_closed(self, patch_exec, tmp_path):
+        events = [
+            _line({"type": "tool_call", "toolName": "Bash", "toolId": "t1", "input": {}}),
+            _line({"type": "send_ok", "result": "done"}),
+        ]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        record = await agent.communicate("hi")
+        assert record.commands[0].result_status == "unknown"
+
+    async def test_cooperative_stop_ends_cleanly(self, patch_exec, tmp_path):
+        events = [
+            _line({"type": "message", "content": "partial"}),
+            _line({"type": "message", "content": "more"}),
+        ]
+        agent, proc = await _started_agent(patch_exec, events, tmp_path)
+        calls = {"n": 0}
+
+        def should_stop() -> bool:
+            calls["n"] += 1
+            return calls["n"] >= 1
+
+        record = await agent.communicate("hi", should_stop=should_stop)
+        assert not record.crashed
+        assert proc._killed  # host abandoned, not resumed
+        assert agent._process is None  # dropped so the next turn respawns
+
+    async def test_cooperative_stop_then_next_turn_respawns_and_completes(self, patch_exec, tmp_path):
+        events = [_line({"type": "message", "content": "partial"})]
+        agent, _proc = await _started_agent(patch_exec, events, tmp_path)
+
+        await agent.communicate("hi", should_stop=lambda: True)
+
+        patch_exec([_line({"type": "init_ok"}), _line({"type": "send_ok", "result": "resumed cleanly"})])
+        record = await agent.communicate("hi again")
+        assert record.agent_output == "resumed cleanly"
+        assert record.crashed is False
+
+    async def test_should_stop_not_polled_means_full_completion(self, patch_exec, tmp_path):
+        events = [_line({"type": "send_ok", "result": "done"})]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        record = await agent.communicate("hi")
+        assert record.agent_output == "done"
+
+    async def test_wall_clock_timeout_raises_and_kills(self, patch_exec, tmp_path):
+        agent, _proc = await _started_agent(patch_exec, [], tmp_path)
+
+        # timeout=0.0: the loop's own top-of-iteration pre-check fires before
+        # any read is attempted, so this pins the deterministic, "already past
+        # the deadline" arm exactly (not a race against a real read).
+        with pytest.raises(TurnTimeoutError):
+            await agent.communicate("hi", timeout=0.0)
+        assert agent._process is None  # dropped so the next call respawns
+
+    async def test_timeout_elapsing_mid_read_still_raises_turn_timeout_error(self, patch_exec, tmp_path):
+        """The deadline can also elapse WHILE blocked in `_read_next_message`
+        (inside `asyncio.wait_for`), not just at the loop's own pre-check --
+        this must still surface as `TurnTimeoutError`, not a generic
+        `AgentCrashError`, and must still drop the host handle so the next
+        turn respawns cleanly instead of reusing a host with a "send" left
+        in flight (a real bug found and fixed in review: it used to fall
+        through to the generic crash path and leave the process alive)."""
+        patch_exec([_line({"type": "init_ok"})], hang_after=True)
+        agent = DelegateAgent(_config(), task_id="t1")
+        await agent.start(str(tmp_path))
+
+        with pytest.raises(TurnTimeoutError):
+            await agent.communicate("hi", timeout=0.1)
+        assert agent._process is None
+
+        # A fresh host is spawned for the NEXT turn -- no cross-wiring with
+        # the abandoned "send" from the timed-out one.
+        patch_exec([_line({"type": "init_ok"}), _line({"type": "send_ok", "result": "clean turn"})])
+        record = await agent.communicate("hi again")
+        assert record.agent_output == "clean turn"
+
+    async def test_max_turns_exhausted(self, patch_exec, tmp_path):
+        events = [
+            _line({"type": "message", "content": "one"}),
+            _line({"type": "message", "content": "two"}),
+        ]
+        agent, _proc = await _started_agent(patch_exec, events, tmp_path)
+        record = await agent.communicate("hi", max_turns=1)
+        assert record.max_turns_exhausted is True
+
+    async def test_communicate_before_start_raises(self):
+        agent = DelegateAgent(_config())
+        with pytest.raises(RuntimeError, match="start"):
+            await agent.communicate("hi")
+
+    async def test_respawns_after_crash_on_next_turn(self, patch_exec, tmp_path):
+        agent, _ = await _started_agent(patch_exec, [], tmp_path)
+        with pytest.raises(AgentCrashError):
+            await agent.communicate("hi")
+        await agent.discard_pending_turn()
+
+        # A fresh host is spawned for the retry.
+        patch_exec([_line({"type": "init_ok"}), _line({"type": "send_ok", "result": "recovered"})])
+        record = await agent.communicate("hi again")
+        assert record.agent_output == "recovered"
+
+    async def test_emits_exactly_one_start_and_end_event(self, patch_exec, tmp_path):
+        events = [_line({"type": "send_ok", "result": "done"})]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        seen: list[Any] = []
+
+        class _Recorder:
+            def on_event(self, event: Any) -> None:
+                seen.append(event)
+
+        record = await agent.communicate("hi", stream_callback=_Recorder())
+        assert sum(isinstance(e, AgentStartEvent) for e in seen) == 1
+        assert sum(isinstance(e, AgentEndEvent) for e in seen) == 1
+        end = next(e for e in seen if isinstance(e, AgentEndEvent))
+        assert end.status == AgentEndStatus.COMPLETED
+        assert record.crashed is False
+
+
+class TestStop:
+    async def test_stop_sends_destroy_and_marks_finished(self, patch_exec, tmp_path):
+        agent, proc = await _started_agent(patch_exec, [], tmp_path)
+        await agent.stop()
+        assert proc.stdin.written[-1] == {"cmd": "destroy"}
+        assert agent.pending_turn is None
+
+
+class TestKill:
+    def test_kill_sync_signals_running_process(self, patch_exec, tmp_path, monkeypatch):
+        killed: list[tuple[int, int]] = []
+        monkeypatch.setattr(os, "kill", lambda pid, sig: killed.append((pid, sig)))
+        agent = DelegateAgent(_config())
+        proc = _FakeProcess([])
+        agent._process = proc  # type: ignore[assignment]
+        agent.kill_sync()
+        assert killed and killed[0][0] == proc.pid
+        # Dropped so the NEXT communicate() respawns rather than write into a
+        # pipe whose far end this sync path cannot wait to confirm is dead.
+        assert agent._process is None
+
+    def test_kill_sync_noop_without_process(self):
+        agent = DelegateAgent(_config())
+        agent.kill_sync()  # must not raise
+
+
+class TestRegistration:
+    def test_registered_as_delegate(self):
+        registration = AgentRegistry.get("delegate")
+        assert registration is not None
+        assert registration.agent_class is DelegateAgent
+        assert registration.config_class is DelegateAgentConfig
+
+    def test_create_agent_dispatches(self):
+        cfg = _config()
+        agent = create_agent(AgentKind.DELEGATE, cfg)
+        assert isinstance(agent, DelegateAgent)
diff --git a/tests/test_delegate_agent_config.py b/tests/test_delegate_agent_config.py
new file mode 100644
index 000000000..19a13281c
--- /dev/null
+++ b/tests/test_delegate_agent_config.py
@@ -0,0 +1,68 @@
+"""Phase 1: ``DelegateAgentConfig`` model + ``AgentKind.DELEGATE`` enum member.
+
+Registry-dispatch coverage (``parse_agent_config(type="delegate")`` returning a
+``DelegateAgentConfig``) lives in ``tests/test_delegate_agent.py`` — it needs
+Phase 2's registration. Here we exercise the model directly.
+"""
+
+from __future__ import annotations
+
+import pytest
+from pydantic import ValidationError
+
+from coder_eval.models import AgentConfig, AgentKind, DelegateAgentConfig
+
+
+def test_agentkind_delegate_value():
+    assert AgentKind.DELEGATE == "delegate"
+
+
+def test_importable_from_models():
+    # `from coder_eval.models import DelegateAgentConfig` must succeed (CE001).
+    assert DelegateAgentConfig.__name__ == "DelegateAgentConfig"
+
+
+def test_validates_and_defaults():
+    cfg = DelegateAgentConfig(type="delegate")
+    assert cfg.type == AgentKind.DELEGATE
+    assert cfg.effort is None
+    assert cfg.project_id == ""
+    assert cfg.session_id == ""
+    assert cfg.enable_computer_use is False
+
+
+def test_round_trips_through_model_dump():
+    cfg = DelegateAgentConfig(
+        type="delegate",
+        model="virtuoso-1-5",
+        effort="high",
+        project_id="invoice-approval",
+        session_id="abc-123",
+        enable_computer_use=True,
+    )
+    restored = DelegateAgentConfig.model_validate(cfg.model_dump())
+    assert restored == cfg
+    assert restored.model == "virtuoso-1-5"
+    assert restored.effort == "high"
+    assert restored.project_id == "invoice-approval"
+    assert restored.session_id == "abc-123"
+    assert restored.enable_computer_use is True
+
+
+def test_effort_accepts_any_string_including_future_tiers():
+    # Deliberately permissive: the SDK ignores an unrecognized value, so a
+    # strict Literal here would reject a tier a future SDK release adds.
+    assert DelegateAgentConfig(type="delegate", effort="ultra-max").effort == "ultra-max"
+
+
+def test_unknown_extra_field_rejected():
+    with pytest.raises(ValidationError):
+        DelegateAgentConfig(type="delegate", not_a_field=1)  # type: ignore[call-arg]
+
+
+def test_member_of_discriminated_union():
+    from pydantic import TypeAdapter
+
+    adapter = TypeAdapter(AgentConfig)
+    cfg = adapter.validate_python({"type": "delegate", "model": "virtuoso-1-5"})
+    assert isinstance(cfg, DelegateAgentConfig)
diff --git a/tests/test_delegate_agent_live.py b/tests/test_delegate_agent_live.py
new file mode 100644
index 000000000..257cee557
--- /dev/null
+++ b/tests/test_delegate_agent_live.py
@@ -0,0 +1,141 @@
+"""Live integration tests for DelegateAgent.
+
+Hit a real Delegate backend through a real Node subprocess; skipped by default,
+only run with ``pytest -m live``. Needs Node + a real ``@uipath/delegate-sdk``
+install, UiPath auth (``AUTH_TOKEN``/``TENANT_ID``/``ORG_ID`` or a saved login),
+a backend (``DELEGATE_ENV``/``DELEGATE_BACKEND_URL``), and optionally
+``DELEGATE_MODEL``.
+
+Also the mechanism for empirically confirming this agent's ``# UNVERIFIED``
+field-name guesses (see ``.claude/notes/agents.md`` § Delegate agent) against a
+real payload — a failure here is the first place to check them.
+"""
+
+import os
+import shutil
+from pathlib import Path
+
+import pytest
+
+from coder_eval.agents.delegate_agent import DelegateAgent, _resolve_sdk_entry
+from coder_eval.errors import AgentConfigError
+from coder_eval.models import AgentKind, parse_agent_config
+
+
+_live = pytest.mark.live
+
+
+def _have_prerequisites() -> bool:
+    if shutil.which("node") is None:
+        return False
+    try:
+        _resolve_sdk_entry()
+    except AgentConfigError:
+        return False
+    has_auth = bool(os.getenv("AUTH_TOKEN")) or (Path.home() / ".aria" / "sdk-auth.json").is_file()
+    has_backend = bool(os.getenv("DELEGATE_ENV") or os.getenv("DELEGATE_BACKEND_URL"))
+    return has_auth and has_backend
+
+
+_skip_reason = "Live Delegate tests need Node + @uipath/delegate-sdk + UiPath auth + a backend"
+pytestmark = [_live, pytest.mark.skipif(not _have_prerequisites(), reason=_skip_reason)]
+
+
+def _make_agent() -> DelegateAgent:
+    config = parse_agent_config(
+        type=AgentKind.DELEGATE,
+        model=os.getenv("DELEGATE_MODEL", "virtuoso-1-5"),
+        enable_computer_use=False,
+    )
+    return DelegateAgent(config, task_id="delegate-live")
+
+
+@_live
+async def test_delegate_live_produces_text(tmp_path):
+    """A trivial prompt returns assistant text and a completed TurnRecord."""
+    agent = _make_agent()
+    await agent.start(str(tmp_path))
+    try:
+        record = await agent.communicate(
+            "Reply with exactly the word PONG and nothing else.",
+            timeout=120,
+        )
+    finally:
+        await agent.stop()
+
+    assert record.crashed is False
+    assert record.agent_output.strip()
+    assert "pong" in record.agent_output.lower()
+
+
+@_live
+async def test_delegate_live_runs_shell_command_captured_as_telemetry(tmp_path):
+    """A shell command shows up in TurnRecord.commands."""
+    agent = _make_agent()
+    await agent.start(str(tmp_path))
+    try:
+        record = await agent.communicate(
+            "Run the shell command `echo coder-eval-live` and report its output.",
+            timeout=120,
+        )
+    finally:
+        await agent.stop()
+
+    assert record.crashed is False
+    assert record.commands, "expected at least one command in telemetry"
+
+
+@_live
+async def test_delegate_live_edits_file_and_records_telemetry(tmp_path):
+    """A file edit shows up on disk and the turn records command telemetry."""
+    agent = _make_agent()
+    await agent.start(str(tmp_path))
+    try:
+        record = await agent.communicate(
+            "Create a file named hello.txt in the current directory containing the text 'hi'.",
+            timeout=120,
+        )
+    finally:
+        await agent.stop()
+
+    assert record.crashed is False
+    assert (tmp_path / "hello.txt").exists(), "agent did not create the file"
+    assert record.commands, "expected command telemetry for the file creation"
+
+
+@_live
+async def test_delegate_live_two_turns_reuse_session(tmp_path):
+    """A second communicate() call reuses the SDK session established by the first."""
+    agent = _make_agent()
+    await agent.start(str(tmp_path))
+    try:
+        first = await agent.communicate("Remember the number 42. Reply OK.", timeout=120)
+        assert first.crashed is False
+        second = await agent.communicate(
+            "What number did I ask you to remember? Reply with just the number.", timeout=120
+        )
+    finally:
+        await agent.stop()
+
+    assert second.crashed is False
+    assert "42" in second.agent_output
+
+
+@_live
+async def test_delegate_live_token_usage_populated(tmp_path):
+    """Token usage is captured from the SDK and attached to the TurnRecord.
+
+    If this fails while the turn otherwise completes, the `_parse_usage`
+    UNVERIFIED bucket-name guesses in delegate_agent.py are the first thing
+    to check against the real payload.
+    """
+    agent = _make_agent()
+    await agent.start(str(tmp_path))
+    try:
+        record = await agent.communicate("Say hello.", timeout=120)
+    finally:
+        await agent.stop()
+
+    assert record.crashed is False
+    assert record.token_usage is not None
+    assert record.token_usage.output_tokens > 0
diff --git a/tests/test_delegate_agent_registration.py b/tests/test_delegate_agent_registration.py
new file mode 100644
index 000000000..ab95a6b53
--- /dev/null
+++ b/tests/test_delegate_agent_registration.py
@@ -0,0 +1,65 @@
+"""Registration and pricing self-consistency tests for the Delegate agent.
+
+Registry dispatch (`AgentRegistry.get`, `create_agent`) is exercised in
+`tests/test_delegate_agent.py::TestRegistration`; this file covers what that
+one doesn't: `parse_agent_config` end-to-end dispatch, and the pricing
+table's self-consistency (mirroring coder_eval_uipath's pinned-dollar
+pattern, which exists specifically to catch a positional cache_write/
+cache_read transposition that a self-consistency check against a model's
+own input rate alone would not).
+"""
+
+from __future__ import annotations
+
+from coder_eval.models import DelegateAgentConfig, parse_agent_config
+from coder_eval.pricing import DELEGATE_MODEL_IDS, calculate_cost
+
+
+# Every id in DELEGATE_MODEL_IDS, paired with its (input+output, cache_write)
+# dollar figures at 1M tokens each -- pinned independently of pricing.py so a
+# transposed constructor argument still fails this test even though it would
+# leave calculate_cost self-consistent against the model's own input_per_mtok.
+EXPECTED_USD_PER_MTOK: dict[str, tuple[float, float]] = {
+    # model: (input + output, cache_write)
+    "virtuoso-1-5": (0.95 + 4.0, 0.0),
+    "virtuoso-2-0": (0.95 + 4.0, 0.0),
+    "gemini-3-5-flash": (1.50 + 9.0, 0.0),
+    "gemini-3-6-flash": (1.50 + 7.50, 0.0),
+    "gemini-3-1-pro-preview": (2.0 + 12.0, 0.0),
+    "gpt-5-4": (2.50 + 15.0, 15.0),
+    "gpt-5-5": (5.0 + 30.0, 30.0),
+    "gpt-5-6-sol": (5.0 + 30.0, 6.25),
+    "gpt-5-6-terra": (2.0 + 12.0, 2.50),
+    "gpt-5-6-luna": (0.20 + 1.20, 0.25),
+    "kimi-k2-7-code": (0.95 + 4.0, 0.0),
+    "glm-5-3-flash": (0.15 + 0.50, 0.0),
+}
+
+
+def test_parse_agent_config_dispatches_to_delegate():
+    cfg = parse_agent_config(type="delegate", model="virtuoso-1-5")
+    assert isinstance(cfg, DelegateAgentConfig)
+    assert cfg.model == "virtuoso-1-5"
+
+
+def test_expected_models_match_delegate_model_ids_exactly():
+    """Forces a new DELEGATE_MODEL_IDS entry to add its own pinned figures
+    here, rather than silently going unverified -- unlike a hand-copied
+    literal, DELEGATE_MODEL_IDS is derived from pricing.py itself, so this
+    genuinely fails the moment a row is added to _DELEGATE_PRICING without a
+    matching entry here."""
+    assert set(EXPECTED_USD_PER_MTOK) == DELEGATE_MODEL_IDS
+
+
+def test_every_model_priced_for_input_and_output():
+    for model, (expected_io, _) in EXPECTED_USD_PER_MTOK.items():
+        cost = calculate_cost(model, 1_000_000, 1_000_000)
+        assert cost == expected_io, f"{model}: expected ${expected_io} for input+output, got {cost}"
+
+
+def test_every_model_priced_for_cache_write():
+    """Catches a positional cache_write/cache_read transposition that
+    test_every_model_priced_for_input_and_output cannot see."""
+    for model, (_, expected_write) in EXPECTED_USD_PER_MTOK.items():
+        cost = calculate_cost(model, 0, 0, cache_creation_tokens=1_000_000)
+        assert cost == expected_write, f"{model}: expected ${expected_write} for cache-write, got {cost}"
diff --git a/tests/test_timing_identity_contract.py b/tests/test_timing_identity_contract.py
index 1a479acc6..094321984 100644
--- a/tests/test_timing_identity_contract.py
+++ b/tests/test_timing_identity_contract.py
@@ -239,6 +239,42 @@ def now(tz: Any = None) -> datetime:  # type: ignore[override]
         return at(_SteppedDatetime.at_ms)
 
 
+def _delegate_turn(monkeypatch: pytest.MonkeyPatch) -> Turn:
+    """One tiled window covering the whole turn (the delegate agent builds no
+    per-round-trip segments — see ``.claude/notes/agents.md`` § Delegate agent),
+    with a real head (dispatch before ``_TurnState`` is constructed) and tail
+    (published after the last flush)."""
+    from coder_eval.agents import delegate_agent as delegate_module
+    from coder_eval.agents.delegate_agent import DelegateAgent, _TurnState
+    from coder_eval.models import DelegateAgentConfig
+
+    monkeypatch.setattr(delegate_module, "datetime", _SteppedDatetime)
+    agent = DelegateAgent(DelegateAgentConfig(type=AgentKind.DELEGATE), task_id="t")
+    commands: list[CommandTelemetry] = []
+    messages: list[TranscriptMessage] = []
+
+    def emit(e: Any) -> None:
+        if isinstance(e, ToolEndEvent):
+            commands.append(e.tool)
+        elif isinstance(e, AgentEndEvent):
+            messages.extend(e.messages)
+
+    _SteppedDatetime.at_ms = 500  # dispatch before the turn state exists: head
+    state = _TurnState(task_id="t", iteration=1, user_input="go", model="m")
+
+    _SteppedDatetime.at_ms = 700
+    agent._handle_tool_call({"type": "tool_call", "toolId": "c1", "toolName": "bash", "input": {}}, state, emit)
+    _SteppedDatetime.at_ms = 1200
+    agent._handle_tool_result({"type": "tool_result", "toolId": "c1", "output": "ok"}, state, emit)
+    _SteppedDatetime.at_ms = 1800
+    agent._handle_event({"type": "message", "content": "done"}, state, emit)
+
+    _SteppedDatetime.at_ms = 2000  # last flush: the single window closes here
+    agent._finalize_turn(state, AgentEndStatus.COMPLETED, emit)
+
+    return Turn(started_ms=0.0, ended_ms=2200.0, messages=messages, commands=commands)
+
+
 def _opencode_turn(monkeypatch: pytest.MonkeyPatch) -> Turn:
     """The same two-window shape, driven through OpenCode's step stream."""
     from coder_eval.agents import opencode_agent as opencode_module
@@ -572,6 +608,10 @@ def test_opencode_buckets_tile_the_turn(monkeypatch: pytest.MonkeyPatch):
     assert_identity_closes(_opencode_turn(monkeypatch))
 
 
+def test_delegate_buckets_tile_the_turn(monkeypatch: pytest.MonkeyPatch):
+    assert_identity_closes(_delegate_turn(monkeypatch))
+
+
 def test_antigravity_buckets_tile_the_turn():
     assert_identity_closes(_antigravity_turn())
 
diff --git a/uv.lock b/uv.lock
index 190beab33..eab96aad5 100644
--- a/uv.lock
+++ b/uv.lock
@@ -171,14 +171,15 @@ wheels = [
 
 [[package]]
 name = "anyio"
-version = "4.13.0"
+version = "4.15.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "idna" },
+    { name = "typing-extensions", marker = "python_full_version < '3.15'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/19/14/2c5dd9f512b66549ae92767a9c7b330ae88e1932ca57876909410251fe13/anyio-4.13.0.tar.gz", hash = "sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc", size = 231622, upload-time = "2026-03-24T12:59:09.671Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a9/d2/f4d173e22df740bc37b1db102b386ba719b66e95b0f0d751f556b387e6d2/anyio-4.15.1.tar.gz", hash = "sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94", size = 276966, upload-time = "2026-09-05T10:42:39.44Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/da/42/e921fccf5015463e32a3cf6ee7f980a6ed0f395ceeaa45060b61d86486c2/anyio-4.13.0-py3-none-any.whl", hash = "sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708", size = 114353, upload-time = "2026-03-24T12:59:08.246Z" },
+    { url = "https://files.pythonhosted.org/packages/12/b8/4bd346e22b28902df4d651910f5242c28d84e4a5c2435ca5c3f797ed7e2e/anyio-4.15.1-py3-none-any.whl", hash = "sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101", size = 132079, upload-time = "2026-09-05T10:42:37.923Z" },
 ]
 
 [[package]]
@@ -534,7 +535,7 @@ uipath = [
 [package.metadata]
 requires-dist = [
     { name = "anthropic", specifier = ">=1.0.0,<2.0.0" },
-    { name = "anyio", specifier = ">=4.13.0" },
+    { name = "anyio", specifier = ">=4.14.2" },
     { name = "azure-monitor-opentelemetry-exporter", specifier = ">=1.0.0b30,<1.1.0" },
     { name = "bandit", extras = ["toml"], marker = "extra == 'dev'", specifier = ">=1.9.4" },
     { name = "claude-agent-sdk", specifier = ">=0.2.124" },
@@ -3077,11 +3078,11 @@ wheels = [
 
 [[package]]
 name = "typing-extensions"
-version = "4.15.0"
+version = "4.16.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/cc/6253133b5bb138fc3306cebfbda2c520f545d36b5be2c7255cc528bb45d6/typing_extensions-4.16.0.tar.gz", hash = "sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5", size = 113555, upload-time = "2026-07-02T08:40:05.92Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
+    { url = "https://files.pythonhosted.org/packages/49/d3/b8441a820a491ddfc024b0b0cf0393375b75ea13866d9c66727e54c2fc80/typing_extensions-4.16.0-py3-none-any.whl", hash = "sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8", size = 45571, upload-time = "2026-07-02T08:40:04.659Z" },
 ]
 
 [[package]]

From 52ea5602173741462bcb59c6bf0984fd2d1b75fa Mon Sep 17 00:00:00 2001
From: Akshaya Shanbhogue <akshaya.shanbhogue@uipath.com>
Date: Mon, 21 Sep 2026 21:18:41 -0700
Subject: [PATCH 2/3] fix(agents): address PR #191 code review findings on the
 Delegate agent

Fixes the review's blockers and most non-blocking findings:

- Crash/timeout turns now fan out ToolEnd(UNRESOLVED)/TurnEnd/AgentEnd to the
  caller's stream_callback (not the EventCollector only), and every mid-turn
  crash path force-kills the host so a retry can never reuse a live host's
  stale queue.
- Spawn the Node host in its own process group and SIGKILL the group on
  force-kill, so the SDK's bundled interop process is reaped instead of
  orphaned.
- _parse_usage warns instead of silently returning None on an unrecognized
  usage shape; added tests for the bucket spellings, model/cost wiring, and
  crash/timeout streaming.
- A transient init-handshake timeout on a mid-run respawn now raises the
  retryable AgentCrashError instead of the non-retryable AgentConfigError.
- Fixed the non-hermetic SDK-resolution test (patched cwd but not
  Path.home()), which passed only for developers who had NOT installed the
  SDK as documented.
- CI: the live-tests job now fails loudly (not silently green) on a missing
  secret outside a fork PR, runs tests/test_delegate_agent_live.py under
  -m live with an "actually ran" assertion, keeps ROPC credentials out of
  curl's argv, derives DELEGATE_ENV from the same dispatch input the token
  mint uses, and the diagnostic script never gates the real run it exists to
  explain.
- Removed dead _TurnState attributes, narrowed an over-broad exception
  suppression, fixed the Node host's process.exit() truncating its own
  `fatal` line under backpressure, added DELEGATE_-namespaced env var
  fallbacks, and closed the delegate/USER_GUIDE/EXTENDING/default.yaml
  roster-doc gaps (with CE047 extended to catch a future one).

Deliberately not touched: the pricing table's hyphenated/dotted twin
divergence (already documented in .claude/notes/agents.md as a known,
pre-existing state, not something to silently "fix" by picking a number),
docker-driver support for the new agent (a real feature addition, not a
review fix), and the ROPC OAuth scope list / lockfile+npm-ci switch (both
touch the CI job that was just brought to green; left as-is to avoid
re-breaking it without a live run to verify against).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .env.example                                  |  12 +-
 .../scripts/diagnose_delegate_token_claims.py |  13 +-
 .github/workflows/pr-checks.yml               | 120 ++++++++---
 docs/EXTENDING.md                             |   3 +-
 docs/USER_GUIDE.md                            |   3 +-
 docs/agents/DELEGATE.md                       |  10 +-
 evalboard/app/_components/harness-badge.tsx   |   9 +
 experiments/default.yaml                      |   2 +-
 .../agents/delegate/delegate_host.mjs         |  23 ++-
 src/coder_eval/agents/delegate_agent.py       | 191 +++++++++++++-----
 src/coder_eval/models/agent_config.py         |  10 +-
 tests/lint/agent_roster_parity.py             |   3 +
 tests/test_delegate_agent.py                  | 119 ++++++++++-
 tests/test_delegate_agent_config.py           |   4 +-
 tests/test_timing_identity_contract.py        |   2 +-
 15 files changed, 416 insertions(+), 108 deletions(-)

diff --git a/.env.example b/.env.example
index 50cfa31c6..cb67f4953 100644
--- a/.env.example
+++ b/.env.example
@@ -97,12 +97,20 @@ LOG_TO_FILE=false  # Set to true to enable file logging
 # (wins over DELEGATE_ENV when both are set).
 # DELEGATE_BACKEND_URL="https://cloud.uipath.com/<org>/<tenant>/delegate_"
 #
-# Auth: either the token triple below, or a prior `delegate-sdk`/`delegate-cli`
+# Auth: either the token set below, or a prior `delegate-sdk`/`delegate-cli`
 # login that wrote ~/.aria/sdk-auth.json (read by the Node host itself, not
-# by coder_eval).
+# by coder_eval). Each var also accepts a DELEGATE_-namespaced spelling
+# (DELEGATE_AUTH_TOKEN, DELEGATE_TENANT_ID, ...), checked first -- prefer that
+# spelling in a shared environment, since the bare names collide with what
+# other tooling (npm, Vault, Terraform) commonly exports.
 # AUTH_TOKEN="..."
 # TENANT_ID="..."
 # ORG_ID="..."
+# With DELEGATE_ENV (not DELEGATE_BACKEND_URL) also set these two -- the
+# human-readable org/tenant names, not the GUIDs above -- or init fails with
+# "--env alpha needs org/tenant slugs". See docs/agents/DELEGATE.md.
+# ORG_SLUG="..."
+# TENANT_SLUG="..."
 
 # Usage Telemetry (anonymous; on by default).
 # Disable entirely:
diff --git a/.github/scripts/diagnose_delegate_token_claims.py b/.github/scripts/diagnose_delegate_token_claims.py
index db0cb607d..496db2d9c 100644
--- a/.github/scripts/diagnose_delegate_token_claims.py
+++ b/.github/scripts/diagnose_delegate_token_claims.py
@@ -22,7 +22,10 @@
 
 def _decode_claims(payload: str) -> dict[str, object]:
     padded = payload + "=" * (-len(payload) % 4)
-    return json.loads(base64.urlsafe_b64decode(padded))
+    decoded = json.loads(base64.urlsafe_b64decode(padded))
+    if not isinstance(decoded, dict):
+        raise SystemExit(f"token payload is {type(decoded).__name__}, not a JSON object")
+    return decoded
 
 
 def _print_verdict(claims: dict[str, object], candidates: list[str], expected: str, label: str) -> None:
@@ -43,4 +46,10 @@ def main() -> None:
 
 
 if __name__ == "__main__":
-    main()
+    # Advisory only: never let a diagnostic failure (a malformed argv, a
+    # missing EXPECTED_* var) gate the real `coder-eval run` this step exists
+    # to help explain, rather than mask.
+    try:
+        main()
+    except Exception as exc:
+        print(f"claims diagnostic unavailable: {exc}")
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 3082dc67a..502f7141d 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -1144,8 +1144,9 @@ jobs:
     # wrapping the public @uipath/delegate-sdk against a real UiPath backend. Runs on
     # every PR/push like the other live-test jobs (codex-live-tests, byoa-live-tests)
     # now that the DELEGATE_ROPC_* secrets are provisioned; the presence-check gate
-    # below stays as a safety net so an accidental secret removal skips cleanly
-    # instead of failing a required check. Auth is minted fresh each run via the
+    # below skips cleanly ONLY on a fork PR (no secrets available there) and fails
+    # loudly on a same-repo run with a missing secret, matching the other live jobs.
+    # Auth is minted fresh each run via the
     # OAuth2 Resource Owner Password Credentials (ROPC) grant — the same
     # `grant_type=password` flow documented in coder_eval_uipath/eval_runner/CI_DESIGN.md
     # and implemented in coder_eval_uipath/eval_runner/scripts/ci/refresh-auth.sh —
@@ -1176,15 +1177,30 @@ jobs:
           DELEGATE_TENANT_ID: ${{ secrets.DELEGATE_TENANT_ID }}
           DELEGATE_ORG_SLUG: ${{ secrets.DELEGATE_ORG_SLUG }}
           DELEGATE_TENANT_SLUG: ${{ secrets.DELEGATE_TENANT_SLUG }}
+          # A fork PR (this job's own `if:` skips the whole job for those) is the
+          # only case a missing secret is expected -- everywhere else, silently
+          # reporting success having run nothing is exactly the failure a required
+          # check exists to catch, so a same-repo run with a rotated/dropped secret
+          # fails loudly instead.
+          IS_FORK_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
         run: |
-          if [ -z "$DELEGATE_ROPC_CLIENT_ID" ] || [ -z "$DELEGATE_ROPC_CLIENT_SECRET" ] || \
-             [ -z "$DELEGATE_ROPC_USERNAME" ] || [ -z "$DELEGATE_ROPC_PASSWORD" ] || \
-             [ -z "$DELEGATE_ORG_ID" ] || [ -z "$DELEGATE_TENANT_ID" ] || \
-             [ -z "$DELEGATE_ORG_SLUG" ] || [ -z "$DELEGATE_TENANT_SLUG" ]; then
+          missing=""
+          for name in DELEGATE_ROPC_CLIENT_ID DELEGATE_ROPC_CLIENT_SECRET DELEGATE_ROPC_USERNAME \
+                      DELEGATE_ROPC_PASSWORD DELEGATE_ORG_ID DELEGATE_TENANT_ID \
+                      DELEGATE_ORG_SLUG DELEGATE_TENANT_SLUG; do
+            if [ -z "${!name}" ]; then
+              missing="$missing $name"
+            fi
+          done
+          if [ -z "$missing" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          elif [ "$IS_FORK_PR" = "true" ]; then
             echo "present=false" >> "$GITHUB_OUTPUT"
-            echo "Delegate ROPC secrets not configured — skipping the live run."
+            echo "Delegate ROPC secrets not available on a fork PR — skipping the live run."
           else
-            echo "present=true" >> "$GITHUB_OUTPUT"
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::error::Delegate ROPC secrets missing on a same-repo run:$missing"
+            exit 1
           fi
 
       - name: Set up Python 3.13
@@ -1252,16 +1268,29 @@ jobs:
           # alpha scope list so this mint is provably not narrower than the one
           # already validated there.
           SCOPES="openid profile email offline_access ConversationalAgents AutopilotForEveryone Orchestrator OrchestratorApiUserAccess StudioWebBackend"
-          response=$(curl -sS -L --connect-timeout 15 --max-time 60 -X POST "${UIPATH_URL}/identity_/connect/token" \
+          # The POST body is built here and piped to curl on stdin (--data-binary
+          # @-), never passed as a --data-urlencode argv value: argv (unlike
+          # stdin) is world-readable via /proc/<pid>/cmdline to any other process
+          # on this self-hosted runner for the life of the request, and
+          # CLIENT_SECRET/CE_PASSWORD are durable credentials, not the ~1h token.
+          body=$(jq -rn \
+              --arg client_id "$CLIENT_ID" \
+              --arg client_secret "$CLIENT_SECRET" \
+              --arg username "$CE_USERNAME" \
+              --arg password "$CE_PASSWORD" \
+              --arg acr_values "tenant:${ORG_ID}" \
+              --arg scope "$SCOPES" \
+              '"grant_type=password" +
+               "&client_id=" + ($client_id|@uri) +
+               "&client_secret=" + ($client_secret|@uri) +
+               "&username=" + ($username|@uri) +
+               "&password=" + ($password|@uri) +
+               "&acr_values=" + ($acr_values|@uri) +
+               "&scope=" + ($scope|@uri)')
+          response=$(printf '%s' "$body" | curl -sS -L --connect-timeout 15 --max-time 60 -X POST "${UIPATH_URL}/identity_/connect/token" \
               -H "Content-Type: application/x-www-form-urlencoded" \
               -H "x-uipath-internal-accountid: ${ORG_ID}" \
-              --data-urlencode "grant_type=password" \
-              --data-urlencode "client_id=${CLIENT_ID}" \
-              --data-urlencode "client_secret=${CLIENT_SECRET}" \
-              --data-urlencode "username=${CE_USERNAME}" \
-              --data-urlencode "password=${CE_PASSWORD}" \
-              --data-urlencode "acr_values=tenant:${ORG_ID}" \
-              --data-urlencode "scope=${SCOPES}")
+              --data-binary @-)
 
           if err=$(echo "$response" | jq -e -r '.error // empty') && [ -n "$err" ]; then
               echo "ROPC token request failed: $(echo "$response" | jq -r '.error_description // .error')" >&2
@@ -1283,7 +1312,12 @@ jobs:
         # DELEGATE_ORG_ID/DELEGATE_ORG_SLUG secrets used to build the backend
         # URL -- a mismatch here (not a coder_eval bug) is what a live run's
         # "Account id does not match" 401 from the connections_ API points at.
+        # continue-on-error: this step is advisory -- its own script already
+        # catches and reports unexpected input, but a step failure must still
+        # never gate the real `coder-eval run` below that it exists to help
+        # explain, not mask.
         if: steps.gate.outputs.present == 'true'
+        continue-on-error: true
         env:
           ACCESS_TOKEN: ${{ steps.ropc.outputs.access_token }}
           EXPECTED_ORG_ID: ${{ secrets.DELEGATE_ORG_ID }}
@@ -1304,15 +1338,14 @@ jobs:
         if: steps.gate.outputs.present == 'true'
         env:
           DELEGATE_SDK_NODE_MODULES: ${{ github.workspace }}/src/coder_eval/agents/delegate
-          DELEGATE_ENV: alpha
+          DELEGATE_ENV: ${{ github.event.inputs.delegate_uipath_env || 'alpha' }}
           AUTH_TOKEN: ${{ steps.ropc.outputs.access_token }}
           TENANT_ID: ${{ secrets.DELEGATE_TENANT_ID }}
           ORG_ID: ${{ secrets.DELEGATE_ORG_ID }}
-          # The SDK's --env resolution needs human-readable slugs alongside the
-          # GUIDs above (a bare AUTH_TOKEN/TENANT_ID/ORG_ID triple isn't enough
-          # for `environment: "alpha"` to resolve a backend URL) — these are
-          # read straight from process.env by the SDK itself, not plumbed
-          # through DelegateAgent's init options.
+          # Forwarded into `auth.organizationName` / `auth.tenantName` by
+          # DelegateAgent._build_init_options (see .claude/notes/agents.md §
+          # Delegate agent) — needed alongside the GUIDs above whenever
+          # `environment` (rather than `backendUrl`) resolves the backend.
           ORG_SLUG: ${{ secrets.DELEGATE_ORG_SLUG }}
           TENANT_SLUG: ${{ secrets.DELEGATE_TENANT_SLUG }}
         run: .venv/bin/coder-eval run tasks/delegate/fizzbuzz_delegate.yaml --run-dir runs/delegate-live
@@ -1326,10 +1359,45 @@ jobs:
 
           results = list(Path("runs/delegate-live").rglob("task.json"))
           assert results, "no task.json written"
-          data = json.loads(results[0].read_text())
-          status = str(data.get("final_status", "")).lower()
-          assert "success" in status or "pass" in status, f"expected PASS, got final_status={data.get('final_status')}"
-          print("Live Delegate run PASSED:", data.get("final_status"))
+          for path in results:
+              data = json.loads(path.read_text())
+              assert data.get("final_status") == "SUCCESS", (
+                  f"{path}: expected SUCCESS, got final_status={data.get('final_status')}"
+              )
+              print(f"Live Delegate run PASSED ({path}):", data.get("final_status"))
+          PY
+
+      - name: Run Delegate live unit tests (assert PASS)
+        if: steps.gate.outputs.present == 'true'
+        env:
+          DELEGATE_SDK_NODE_MODULES: ${{ github.workspace }}/src/coder_eval/agents/delegate
+          DELEGATE_ENV: ${{ github.event.inputs.delegate_uipath_env || 'alpha' }}
+          AUTH_TOKEN: ${{ steps.ropc.outputs.access_token }}
+          TENANT_ID: ${{ secrets.DELEGATE_TENANT_ID }}
+          ORG_ID: ${{ secrets.DELEGATE_ORG_ID }}
+          ORG_SLUG: ${{ secrets.DELEGATE_ORG_SLUG }}
+          TENANT_SLUG: ${{ secrets.DELEGATE_TENANT_SLUG }}
+        run: |
+          mkdir -p tmp
+          .venv/bin/pytest tests/test_delegate_agent_live.py \
+            -m live -n0 -v --tb=short --strict-markers -ra \
+            --junit-xml=tmp/junit-delegate-live.xml
+
+      - name: Assert Delegate live tests actually ran (not silently skipped)
+        if: steps.gate.outputs.present == 'true'
+        run: |
+          python3 - <<'PY'
+          import sys, xml.etree.ElementTree as ET
+          root = ET.parse("tmp/junit-delegate-live.xml").getroot()
+          suites = [root] if root.tag == "testsuite" else root.findall("testsuite")
+          total = sum(int(s.get("tests", 0)) for s in suites)
+          skipped = sum(int(s.get("skipped", 0)) for s in suites)
+          errors = sum(int(s.get("errors", 0)) for s in suites)
+          failures = sum(int(s.get("failures", 0)) for s in suites)
+          passed = total - skipped - errors - failures
+          print(f"delegate-live passed={passed} skipped={skipped} errors={errors} failures={failures}")
+          if passed < 1:
+              sys.exit("Live Delegate tests reported zero PASSED tests (missing prerequisite / silent skip?)")
           PY
 
       - name: Upload Delegate live-test artifacts on failure
diff --git a/docs/EXTENDING.md b/docs/EXTENDING.md
index 401380d96..842146747 100644
--- a/docs/EXTENDING.md
+++ b/docs/EXTENDING.md
@@ -286,7 +286,8 @@ The base package ships **no** plugin rates; only the built-in table.
 
 - [Claude Code](agents/CLAUDE_CODE.md) · [Codex](agents/CODEX.md) ·
   [Antigravity](agents/ANTIGRAVITY.md) · [OpenCode](agents/OPENCODE.md) ·
-  [Pi](agents/PI.md) — the built-in agents, each registered via this same SPI
+  [Pi](agents/PI.md) · [Delegate](agents/DELEGATE.md) — the built-in agents,
+  each registered via this same SPI
 - [Task Definition Guide](TASK_DEFINITION_GUIDE.md) — the criterion catalogue
 - [CLAUDE.md](https://github.com/UiPath/coder_eval/blob/main/CLAUDE.md) — architecture
   and extension points in depth
diff --git a/docs/USER_GUIDE.md b/docs/USER_GUIDE.md
index 5099a63cf..dda76b661 100644
--- a/docs/USER_GUIDE.md
+++ b/docs/USER_GUIDE.md
@@ -39,7 +39,7 @@ coder-eval run tasks/hello_date.yaml --stream full  # live LLM output
 | `-D path=value` / `--set` | Override any resolved task-config field (`agent`/`run_limits`/`sandbox` roots), e.g. `-D run_limits.max_turns=30 -D agent.permission_mode=plan -D agent.sdk_options.effort=high`. Repeatable; schema-validated. This is the way to set permission mode, turn/timeout limits, token/USD budget caps, tools, plugins, and SDK options. |
 | `--model, -m` | Shorthand alias for `-D agent.model=…` (e.g., `claude-sonnet-5`) |
 | `--driver` | Shorthand alias for `-D sandbox.driver=…` (`tempdir` or `docker`) |
-| `--type, -T` | Override agent type for all tasks (`claude-code`, `codex`, `antigravity`, `opencode`, `pi`, or a plugin kind). |
+| `--type, -T` | Override agent type for all tasks (`claude-code`, `codex`, `antigravity`, `opencode`, `pi`, `delegate`, or a plugin kind). |
 | `--repeats` | Run each `(task, variant)` N times (≥1); overrides experiment/variant `repeats:`. See [Replicates](#replicates). |
 | `--resume` | Resume an interrupted run: skip tasks already finalized in `--run-dir` and run the rest, folding prior results into `run.json`. Requires `--run-dir`. See [Resuming a run](#resuming-a-run). |
 | `--allow-host-grading` | `--resume` only. Grade an executed-but-ungraded `driver: docker` row on this host instead of in a container of the task's own image (the default); the row is stamped `graded_on_host`. Rejected without `--resume`, since a fresh `run` grades inside the driver the task asks for. |
@@ -429,6 +429,7 @@ Set these in `.env` (copy from `.env.example`).
 | `BEDROCK_SMALL_MODEL` | No | Cross-region Bedrock small/fast model ID |
 | `CODEX_API_KEY` / `CODEX_BASE_URL` / `CODEX_MODEL` / `CODEX_API_VERSION` | For Codex | Codex agent auth & endpoint routing — see [Codex Agent Guide](agents/CODEX.md#endpoint-routing). |
 | `GEMINI_API_KEY` / `ANTIGRAVITY_MODEL` | For Antigravity | Antigravity (Gemini) agent auth & model — see [Antigravity Agent Guide](agents/ANTIGRAVITY.md#setup). |
+| `DELEGATE_ENV` / `DELEGATE_BACKEND_URL` / `AUTH_TOKEN` / `TENANT_ID` / `ORG_ID` / `ORG_SLUG` / `TENANT_SLUG` / `DELEGATE_SDK_NODE_MODULES` / `DELEGATE_SDK_PATH` | For Delegate | Delegate agent backend routing, auth & SDK install location — see [Delegate Agent Guide](agents/DELEGATE.md#setup). |
 | `UIPATH_PLUGIN_MARKETPLACE_DIR` | No | Conventional base directory for local plugins. Not special-cased by the framework: **any** `$VAR` / `${VAR}` referenced in a plugin `path` is expanded from the environment, so a plugin path like `$UIPATH_PLUGIN_MARKETPLACE_DIR/my-plugin` resolves against this variable. (An undefined variable in a plugin path logs a warning.) |
 | `PLUGIN_TOOLS_DIR` | No | A *separate* mechanism from the above: the canonical `node_modules/@uipath` directory used to pin UiPath CLI plugin discovery (not path substitution). When unset, the sandbox auto-derives it from the resolved `uip` binary. |
 | `CODER_EVAL_REMEDIATE_HOME_PLUGINS` | No | **DESTRUCTIVE.** Truthy deletes `$HOME/node_modules/@uipath` at sandbox setup to clear sibling-task pollution on dedicated eval hosts. Off by default; do **not** enable on developer workstations. |
diff --git a/docs/agents/DELEGATE.md b/docs/agents/DELEGATE.md
index 40050643c..ae097f7cc 100644
--- a/docs/agents/DELEGATE.md
+++ b/docs/agents/DELEGATE.md
@@ -44,7 +44,7 @@ To override the auto-search, set **one** of:
 
 Either:
 
-- **Environment token** — `AUTH_TOKEN`, `TENANT_ID`, `ORG_ID` env vars. Confirmed live: when `DELEGATE_ENV` (rather than `DELEGATE_BACKEND_URL`) resolves the backend, also set `ORG_SLUG` and `TENANT_SLUG` (the human-readable org/tenant names, not the GUIDs above) — the SDK's `environment` resolution reads `organizationName`/`tenantName` off the `auth` object passed to `initialize()`, not off `process.env` directly (its own error message's "set ORG_SLUG and TENANT_SLUG env vars" advice describes the separate `delegate-cli` wrapper's behavior, not this SDK class), so this agent forwards them into `auth.organizationName`/`auth.tenantName` itself. Without them, init fails with `--env alpha needs org/tenant slugs`. Skip both by setting `DELEGATE_BACKEND_URL` directly instead.
+- **Environment token** — `AUTH_TOKEN`, `TENANT_ID`, `ORG_ID` env vars (each also accepts a `DELEGATE_`-namespaced spelling — `DELEGATE_AUTH_TOKEN`, `DELEGATE_TENANT_ID`, `DELEGATE_ORG_ID` — checked first, since the bare names collide with what other tooling like npm/Vault/Terraform commonly exports). Confirmed live: when `DELEGATE_ENV` (rather than `DELEGATE_BACKEND_URL`) resolves the backend, also set `ORG_SLUG` and `TENANT_SLUG` (or `DELEGATE_ORG_SLUG`/`DELEGATE_TENANT_SLUG`; the human-readable org/tenant names, not the GUIDs above) — the SDK's `environment` resolution reads `organizationName`/`tenantName` off the `auth` object passed to `initialize()`, not off `process.env` directly (its own error message's "set ORG_SLUG and TENANT_SLUG env vars" advice describes the separate `delegate-cli` wrapper's behavior, not this SDK class), so this agent forwards them into `auth.organizationName`/`auth.tenantName` itself. Without them, init fails with `--env alpha needs org/tenant slugs`. Skip both by setting `DELEGATE_BACKEND_URL` directly instead.
 - **Saved login** — a prior `delegate-sdk` `runLoginFlow` / `delegate-cli login` that wrote `~/.aria/sdk-auth.json`. The Node host reads this itself (via the SDK's own `loadAndRefreshAuth()`) when no `AUTH_TOKEN` is supplied — this agent does not parse that file in Python, so auth-freshness logic lives in exactly one place. This path already carries the slugs, so `ORG_SLUG`/`TENANT_SLUG` aren't needed.
 
 ## Usage
@@ -61,7 +61,9 @@ coder-eval run tasks/delegate/hello_date_delegate.yaml --type delegate --model v
 agent:
   type: delegate
   model: virtuoso-1-5
-  effort: high        # low | medium | high | xhigh
+  effort: high        # low | medium | high | xhigh | max
+  project_id: invoice-approval  # client-side wiki-routing key; None means session-scoped wiki state
+  session_id: abc-123           # pins the SDK session id a turn omits; project_id takes precedence
   enable_computer_use: false   # default; screen tools off, file/shell/Office/PDF unaffected
   plugins:
     - type: local
@@ -75,6 +77,8 @@ success_criteria:
 
 `enable_computer_use` defaults to `false` — this is a headless eval harness: `true` requires macOS Accessibility/Screen-Recording grants a CI runner does not have, and the SDK throws unconditionally on Linux when it's enabled. File, shell, Office and PDF tools are unaffected either way.
 
+`project_id` and `session_id` both route the SDK to a "wiki" — its per-project/per-session persistent scratch state. `project_id` is client-side only (never sent to the backend) and picks a stable directory; leaving it unset falls back to session-scoped state under a server-assigned session id instead. `session_id`, unlike `project_id`, IS a backend entity: pinning one skips session creation, so it must be an id the backend already accepts — do not guess one.
+
 ### Skills
 
 A `plugins:` entry with `type: local` and a `path` is mounted as `<path>/skills` (the Delegate SDK's `bundledSkillsPath`, which expects one directory whose direct children are skill folders). If more than one plugin is configured, the first wins and a warning is logged.
@@ -173,7 +177,7 @@ Live integration tests (drive a real `@uipath/delegate-sdk` install against a re
 uv run pytest -m live tests/test_delegate_agent_live.py
 ```
 
-CI runs the same kind of check as a manually-dispatched `delegate-live-tests` job in
+CI runs the same kind of check as the `delegate-live-tests` job in
 [`pr-checks.yml`](../../.github/workflows/pr-checks.yml): it mints a fresh access
 token via the OAuth2 Resource Owner Password Credentials (ROPC) grant against a
 dedicated bot user, then runs `tasks/delegate/fizzbuzz_delegate.yaml` end to end and
diff --git a/evalboard/app/_components/harness-badge.tsx b/evalboard/app/_components/harness-badge.tsx
index 4c788e32a..0de72aff5 100644
--- a/evalboard/app/_components/harness-badge.tsx
+++ b/evalboard/app/_components/harness-badge.tsx
@@ -33,6 +33,15 @@ const HARNESS_LOGO: Record<string, { src: string; label: string; short: string }
         label: "Delegate · UiPath",
         short: "Delegate",
     },
+    // coder_eval's own built-in Delegate agent (`agent.type: delegate`) — a
+    // distinct `AgentKind` from the coder_eval_uipath plugin's `delegate-sdk`
+    // above, so it needs its own key or it falls through to raw gray text
+    // (same fallback treatment pi gets below, matching that precedent).
+    delegate: {
+        src: "/uipath.png",
+        label: "Delegate · UiPath",
+        short: "Delegate",
+    },
 };
 
 // Short human label for a harness id ("Claude Code"), for selectors and prose.
diff --git a/experiments/default.yaml b/experiments/default.yaml
index b9469a4bd..28bde5aed 100644
--- a/experiments/default.yaml
+++ b/experiments/default.yaml
@@ -40,7 +40,7 @@ defaults:
 
   agent:
     # Agent type. Built-in kinds: claude-code, codex, antigravity, opencode, pi,
-    # none (plus any plugin-registered kind). claude-code is the run-wide default.
+    # delegate, none (plus any plugin-registered kind). claude-code is the run-wide default.
     type: claude-code
 
     # Permission mode for agent actions:
diff --git a/src/coder_eval/agents/delegate/delegate_host.mjs b/src/coder_eval/agents/delegate/delegate_host.mjs
index 230664d9a..8cde1e972 100644
--- a/src/coder_eval/agents/delegate/delegate_host.mjs
+++ b/src/coder_eval/agents/delegate/delegate_host.mjs
@@ -55,8 +55,8 @@ if (!sdkEntryPath) {
   process.exit(2);
 }
 
-function writeLine(obj) {
-  process.stdout.write(JSON.stringify(obj) + "\n");
+function writeLine(obj, callback) {
+  process.stdout.write(JSON.stringify(obj) + "\n", callback);
 }
 
 let agent = null;
@@ -74,8 +74,7 @@ async function handleInit(msg) {
       // clear crash instead of hanging on a line that will never arrive. Exits,
       // like every other `fatal` site: the Python side's crash-handling treats
       // ALL `fatal` messages as "the host is exiting", so this one must too.
-      writeLine({ type: "fatal", message: `event serialization failed: ${err}` });
-      process.exit(1);
+      writeLine({ type: "fatal", message: `event serialization failed: ${err}` }, () => process.exit(1));
     }
   });
   await agent.initialize(msg.options || {});
@@ -141,13 +140,19 @@ rl.on("close", () => {
 // Both handlers below write a `fatal` line before exiting so the Python side's
 // read loop never hangs waiting for a line that will never arrive -- the
 // original failure mode this design exists to avoid (see
-// .claude/notes/agents.md § Delegate agent).
+// .claude/notes/agents.md § Delegate agent). The exit happens from the write's
+// own callback, not the next statement: stdout is a pipe here, so
+// process.stdout.write() is asynchronous, and process.exit() called before it
+// flushes can drop this exact line -- degrading the Python side's crash
+// message to the generic "closed its output stream unexpectedly".
 process.on("unhandledRejection", (err) => {
-  writeLine({ type: "fatal", message: `unhandled rejection: ${(err && err.message) || err}` });
-  process.exit(1);
+  writeLine({ type: "fatal", message: `unhandled rejection: ${(err && err.message) || err}` }, () =>
+    process.exit(1)
+  );
 });
 
 process.on("uncaughtException", (err) => {
-  writeLine({ type: "fatal", message: `uncaught exception: ${(err && err.message) || err}` });
-  process.exit(1);
+  writeLine({ type: "fatal", message: `uncaught exception: ${(err && err.message) || err}` }, () =>
+    process.exit(1)
+  );
 });
diff --git a/src/coder_eval/agents/delegate_agent.py b/src/coder_eval/agents/delegate_agent.py
index 490a40000..bc3a6ec52 100644
--- a/src/coder_eval/agents/delegate_agent.py
+++ b/src/coder_eval/agents/delegate_agent.py
@@ -29,10 +29,12 @@
 import signal
 import time
 import uuid
+from collections import deque
 from collections.abc import Callable
 from datetime import datetime
 from pathlib import Path
 from typing import Any, ClassVar, NoReturn
+from urllib.parse import urlparse
 
 from coder_eval.agent import Agent
 from coder_eval.errors import AgentConfigError, AgentCrashError, TurnTimeoutError
@@ -79,7 +81,7 @@
 _HOST_SCRIPT = Path(__file__).parent / "delegate" / "delegate_host.mjs"
 _SDK_ENTRY_REL_PATH = Path("node_modules") / "@uipath" / "delegate-sdk" / "dist" / "index.mjs"
 
-_UNSUPPORTED_FIELDS: tuple[str, ...] = (
+_UNSUPPORTED_CONFIG_FIELDS: tuple[str, ...] = (
     "allowed_tools",
     "disallowed_tools",
     "system_prompt",
@@ -103,6 +105,18 @@
 _TEXT_EVENT_TYPES = frozenset({"thinking", "message"})
 
 
+def _env(bare_name: str) -> str | None:
+    """Read a ``DELEGATE_``-namespaced auth var, falling back to the bare name.
+
+    coder_eval controls these names (it forwards the values into the SDK's
+    ``auth`` object; the SDK never reads process.env itself), so the bare
+    spellings (``AUTH_TOKEN``, ``TENANT_ID``, ...) collide with names other
+    tooling (npm, Vault, Terraform) commonly exports. The namespaced spelling
+    is checked first; the bare one stays for delegate-cli compatibility.
+    """
+    return os.environ.get(f"DELEGATE_{bare_name}") or os.environ.get(bare_name)
+
+
 def _candidate_install_roots() -> list[Path]:
     """Ancestor-walk search roots: cwd, its ancestors, and home.
 
@@ -217,6 +231,8 @@ def _int(*keys: str) -> int:
     cache_creation = _int("cache_creation_input_tokens", "cacheCreationInputTokens", "cache_write", "cacheWrite")
     cache_read = _int("cache_read_input_tokens", "cacheReadInputTokens", "cache_read", "cacheRead")
     if input_tokens == 0 and output_tokens == 0 and cache_creation == 0 and cache_read == 0:
+        if raw:
+            logger.warning("delegate: usage payload matched none of the known bucket spellings: %r", sorted(raw))
         return None
     return TokenUsage(
         uncached_input_tokens=input_tokens,
@@ -234,11 +250,9 @@ class _TurnState:
     per-round-trip segment machinery a richer transcript would need.
     """
 
-    def __init__(self, *, task_id: str, iteration: int, user_input: str, model: str | None) -> None:
-        self.task_id = task_id
+    def __init__(self, *, iteration: int, user_input: str, model: str | None) -> None:
         self.iteration = iteration
         self.user_input = user_input
-        self.model = model
         self.turn_id = f"delegate-{iteration}"
         self.started_at = time.monotonic()
         self.started_dt = datetime.now()
@@ -251,7 +265,6 @@ def __init__(self, *, task_id: str, iteration: int, user_input: str, model: str
         self.message_events = 0
 
         self.model_used: str | None = model
-        self.session_id: str | None = None
         self.usage: TokenUsage | None = None
         self.final_response: str | None = None
         self.error_message: str | None = None
@@ -303,7 +316,8 @@ def __init__(
         self._stdout_task: asyncio.Task[None] | None = None
         self._stderr_task: asyncio.Task[None] | None = None
         self._stdout_queue: asyncio.Queue[dict[str, Any] | None] = asyncio.Queue()
-        self._stderr_lines: list[str] = []
+        self._stderr_lines: deque[str] = deque(maxlen=200)
+        self._pgid: int | None = None
 
     # --- lifecycle -----------------------------------------------------------
 
@@ -321,7 +335,7 @@ async def start(
             )
         self._sdk_entry = _resolve_sdk_entry()
 
-        ignored = [f for f in _UNSUPPORTED_FIELDS if getattr(self.config, f, None)]
+        ignored = [f for f in _UNSUPPORTED_CONFIG_FIELDS if getattr(self.config, f, None)]
         if ignored:
             logger.warning(
                 "delegate: %s set but has no Delegate SDK equivalent — NOT enforced; do not rely on "
@@ -332,7 +346,7 @@ async def start(
         self.working_directory = working_directory
         self._env_path_prepend = list(env_path_prepend or [])
         self._plugin_tools_dir = plugin_tools_dir
-        self._session_id = self.config.session_id or None
+        self._session_id = self.config.session_id
         self._state = AgentState.WORKING
 
         await self._spawn_and_init()
@@ -349,7 +363,7 @@ async def _spawn_and_init(self) -> None:
 
         await self._cancel_drain_tasks()
         self._stdout_queue = asyncio.Queue()
-        self._stderr_lines = []
+        self._stderr_lines.clear()
         self._process = await asyncio.create_subprocess_exec(
             "node",
             str(_HOST_SCRIPT),
@@ -360,7 +374,11 @@ async def _spawn_and_init(self) -> None:
             stderr=asyncio.subprocess.PIPE,
             env=env,
             limit=STDOUT_LINE_LIMIT_BYTES,
+            # Own session/process group, so a force-kill can killpg the SDK's
+            # bundled interop child too. POSIX-only knob; harmless False elsewhere.
+            start_new_session=os.name == "posix",
         )
+        self._pgid = self._process.pid if os.name == "posix" else None
         assert self._process.stdout is not None
         assert self._process.stderr is not None
         self._stdout_task = asyncio.create_task(self._drain_stdout(self._process.stdout))
@@ -401,12 +419,12 @@ def _build_init_options(self) -> dict[str, Any]:
         environment = os.environ.get("DELEGATE_ENV")
         if environment:
             options["environment"] = environment
-        auth_token = os.environ.get("AUTH_TOKEN")
+        auth_token = _env("AUTH_TOKEN")
         if auth_token:
             auth: dict[str, Any] = {
                 "accessToken": auth_token,
-                "tenantId": os.environ.get("TENANT_ID"),
-                "organizationId": os.environ.get("ORG_ID"),
+                "tenantId": _env("TENANT_ID"),
+                "organizationId": _env("ORG_ID"),
             }
             # CONFIRMED LIVE: when `environment` (rather than `backendUrl`) is set,
             # the SDK resolves the backend URL from THIS auth object's
@@ -414,13 +432,14 @@ def _build_init_options(self) -> dict[str, Any]:
             # process.env directly (that pairing is documented only in the SDK's
             # own error message, aimed at delegate-cli's env-var-driven wrapper —
             # the SDK class we drive here never reads those two vars itself).
-            org_slug = os.environ.get("ORG_SLUG")
-            tenant_slug = os.environ.get("TENANT_SLUG")
+            org_slug = _env("ORG_SLUG")
+            tenant_slug = _env("TENANT_SLUG")
             if org_slug:
                 auth["organizationName"] = org_slug
             if tenant_slug:
                 auth["tenantName"] = tenant_slug
             options["auth"] = auth
+        # list[LocalPluginConfig] is not list[dict[str, Any]] under list invariance.
         skills_path = _resolve_bundled_skills_path(self.config.plugins)  # type: ignore[arg-type]
         if skills_path:
             options["bundledSkillsPath"] = skills_path
@@ -446,6 +465,7 @@ def kill_sync(self) -> None:
             with contextlib.suppress(ProcessLookupError, PermissionError):
                 os.kill(proc.pid, _SIGKILL)
         self._process = None
+        self._sweep_pgid()
 
     async def _force_kill_host(self) -> None:
         proc = self._process
@@ -454,6 +474,23 @@ async def _force_kill_host(self) -> None:
                 proc.kill()
             with contextlib.suppress(TimeoutError, asyncio.TimeoutError):
                 await asyncio.wait_for(proc.wait(), timeout=_TERM_GRACE_SECONDS)
+        self._sweep_pgid()
+
+    def _sweep_pgid(self) -> None:
+        """SIGKILL the host's process group (POSIX only), reaping any orphaned child.
+
+        The host itself is already killed by ``proc.kill()``/``os.kill`` above;
+        this additionally reaps the SDK's bundled interop process
+        (``UiPath.Aria.ComputerUse.Api``) if it outlived the host, mirroring
+        ``opencode_agent.py``'s ``_sweep_process_groups``.
+        """
+        if os.name == "posix" and self._pgid is not None:
+            with contextlib.suppress(ProcessLookupError, PermissionError, OSError):
+                os.killpg(self._pgid, _SIGKILL)
+        self._pgid = None
+
+    def _stderr_tail(self) -> str:
+        return "\n".join(list(self._stderr_lines)[-20:]) or "(no stderr captured)"
 
     async def _cancel_drain_tasks(self) -> None:
         """Cancel and await the stdout/stderr drain tasks of the CURRENT host, if any.
@@ -464,10 +501,16 @@ async def _cancel_drain_tasks(self) -> None:
         their pipe's EOF either way, but dropping a live task silently is the
         pattern this project's teardown paths avoid elsewhere).
         """
+        # Narrowed to cancellation alone (mirrors isolation/docker_runner.py's
+        # same cancel-then-await teardown) so a genuine KeyboardInterrupt /
+        # SystemExit -- or a CancelledError delivered to the CALLER during
+        # this same await -- still propagates instead of being swallowed.
+        # _drain_stdout/_drain_stderr already log and handle their own
+        # non-cancellation failures internally.
         for task in (self._stdout_task, self._stderr_task):
             if task is not None:
                 task.cancel()
-                with contextlib.suppress(asyncio.CancelledError, Exception):
+                with contextlib.suppress(asyncio.CancelledError):
                     await task
         self._stdout_task = None
         self._stderr_task = None
@@ -487,11 +530,19 @@ def get_environment_info(self) -> dict[str, Any]:
             **super().get_environment_info(),
             "delegate_model": self.config.model,
         }
-        # None (not a hardcoded "alpha") when unset: _build_init_options forwards
-        # `environment` to the SDK only when the var is actually set, so recording
-        # a fallback here would assert a routing decision the SDK never made.
+        if self.config.effort:
+            info["delegate_effort"] = self.config.effort
+        if self.config.enable_computer_use:
+            info["delegate_enable_computer_use"] = True
+        # DELEGATE_BACKEND_URL wins over DELEGATE_ENV when both are set (see
+        # _build_init_options/docs/agents/DELEGATE.md), so recording delegate_env
+        # here too would assert a routing decision the SDK never made. Host only
+        # (never the full URL, which can carry embedded credentials).
+        backend_url = os.environ.get("DELEGATE_BACKEND_URL")
         environment = os.environ.get("DELEGATE_ENV")
-        if environment:
+        if backend_url:
+            info["delegate_backend_url_host"] = urlparse(backend_url).hostname
+        elif environment:
             info["delegate_env"] = environment
         if self._session_id:
             info["delegate_session_id"] = self._session_id
@@ -516,7 +567,14 @@ async def communicate(
             # fresh rather than fail fast. Session-conflict-specific recovery
             # is deferred (see module docstring); this simpler policy covers
             # both "the previous turn stopped cleanly" and "it crashed".
-            await self._spawn_and_init()
+            try:
+                await self._spawn_and_init()
+            except AgentConfigError as exc:
+                # Node/the SDK install were already validated once in start();
+                # a failure respawning mid-run is a transient backend/auth
+                # hiccup, not a missing prerequisite -- make it retryable
+                # instead of ending the task outright.
+                raise AgentCrashError(str(exc)) from exc
 
         self._begin_turn()
         collector = EventCollector()
@@ -527,7 +585,6 @@ def emit(event: StreamEvent) -> None:
                 safe_emit(stream_callback, event)
 
         state = _TurnState(
-            task_id=self.task_id,
             iteration=self._iteration,
             user_input=user_input,
             model=self.config.model,
@@ -546,7 +603,7 @@ def emit(event: StreamEvent) -> None:
             while True:
                 remaining = None if deadline is None else deadline - time.monotonic()
                 if remaining is not None and remaining <= 0:
-                    await self._timeout_turn(state, collector, timeout or 0.0)
+                    await self._timeout_turn(state, collector, emit, timeout or 0.0)
 
                 try:
                     msg = await self._read_next_message(deadline)
@@ -557,7 +614,7 @@ def emit(event: StreamEvent) -> None:
                     # this is never misreported as a generic AgentCrashError,
                     # which would leave a "send" in flight on a host the next
                     # communicate() would wrongly reuse.
-                    await self._timeout_turn(state, collector, timeout or 0.0)
+                    await self._timeout_turn(state, collector, emit, timeout or 0.0)
                 if msg is None:
                     # The stream is closed. Not always because the process
                     # already exited: _drain_stdout also signals this on a
@@ -565,24 +622,30 @@ def emit(event: StreamEvent) -> None:
                     # where the host can still be alive -- force-kill before
                     # dropping the handle so the NEXT communicate() respawns
                     # cleanly instead of orphaning it.
-                    await self._force_kill_host()
-                    self._process = None
-                    self._crash_turn(state, collector, "Delegate host closed its output stream unexpectedly")
+                    await self._abandon_host_and_crash(
+                        state, collector, emit, "Delegate host closed its output stream unexpectedly"
+                    )
 
                 mtype = msg.get("type")
                 if mtype == "send_ok":
                     self._handle_send_ok(msg, state)
                     break
                 if mtype == "send_error":
-                    self._crash_turn(state, collector, f"Delegate send failed: {msg.get('message', 'unknown error')}")
+                    # Reuse of a live host after a recoverable `send_error` is
+                    # not attempted: force-kill so the next communicate() always
+                    # respawns onto a fresh queue rather than risk consuming a
+                    # stale onEvent callback the SDK fires after this rejection.
+                    await self._abandon_host_and_crash(
+                        state, collector, emit, f"Delegate send failed: {msg.get('message', 'unknown error')}"
+                    )
                 if mtype == "fatal":
                     # The host exits right after writing this line (every
                     # `fatal` site calls process.exit) -- force-kill is then a
                     # no-op, but stays here to match the EOF branch exactly
                     # rather than trust that invariant from this side too.
-                    await self._force_kill_host()
-                    self._process = None
-                    self._crash_turn(state, collector, f"Delegate host crashed: {msg.get('message', 'unknown error')}")
+                    await self._abandon_host_and_crash(
+                        state, collector, emit, f"Delegate host crashed: {msg.get('message', 'unknown error')}"
+                    )
                 if mtype in ("protocol_error", "destroy_error"):
                     logger.warning("delegate: host reported %s: %s", mtype, msg.get("message"))
                     continue
@@ -591,13 +654,11 @@ def emit(event: StreamEvent) -> None:
 
                 if max_turns is not None and state.message_events >= max_turns:
                     state.max_turns_exhausted = True
-                    await self._force_kill_host()
-                    self._process = None  # host abandoned; next turn respawns
+                    await self._abandon_host_after_loop_exit()
                     break
                 if should_stop is not None and should_stop():
                     stopped_early = True
-                    await self._force_kill_host()
-                    self._process = None  # host abandoned; next turn respawns
+                    await self._abandon_host_after_loop_exit()
                     break
 
             if stopped_early:
@@ -624,7 +685,12 @@ def finalize_on_cancel(
             self._capture_partial_turn(collector)
             raise
         except Exception as e:
-            self._crash_turn(state, collector, f"Delegate turn failed: {e!s}", cause=e)
+            # The host may or may not still be alive (e.g. a BrokenPipeError
+            # from a dead stdin) -- force-kill so a retry always respawns
+            # rather than write into, or read stale events from, this host.
+            await self._force_kill_host()
+            self._process = None
+            self._crash_turn(state, collector, emit, f"Delegate turn failed: {e!s}", cause=e)
             raise  # unreachable — _crash_turn is NoReturn
 
     def _handle_event(self, msg: dict[str, Any], state: _TurnState, emit: Callable[[StreamEvent], None]) -> None:
@@ -632,7 +698,6 @@ def _handle_event(self, msg: dict[str, Any], state: _TurnState, emit: Callable[[
         event_type = msg.get("type")
         session_id = msg.get("sessionId")
         if isinstance(session_id, str) and session_id:
-            state.session_id = session_id
             self._session_id = session_id
         model = msg.get("model")
         if isinstance(model, str) and model:
@@ -739,7 +804,6 @@ def _handle_send_ok(self, msg: dict[str, Any], state: _TurnState) -> None:
                 state.final_response = response
             session_id = result.get("sessionId")
             if isinstance(session_id, str) and session_id:
-                state.session_id = session_id
                 self._session_id = session_id
             usage = _parse_usage(result.get("usage"))
             if usage is not None:
@@ -840,37 +904,56 @@ def _finalize_turn(
             )
         )
 
+    async def _abandon_host_after_loop_exit(self) -> None:
+        """Force-kill after ``max_turns``/cooperative-stop; next turn respawns."""
+        await self._force_kill_host()
+        self._process = None
+
+    async def _abandon_host_and_crash(
+        self,
+        state: _TurnState,
+        collector: EventCollector,
+        emit: Callable[[StreamEvent], None],
+        message: str,
+    ) -> NoReturn:
+        """Force-kill the current host, drop the handle, and crash the turn.
+
+        Shared by every mid-``communicate()`` failure kernel that must not let
+        the NEXT ``communicate()`` reuse this host: reuse risks writing a
+        ``send`` into a dead pipe, or consuming an ``onEvent`` callback the SDK
+        fires after this failure as the retry's own result.
+        """
+        await self._force_kill_host()
+        self._process = None
+        self._crash_turn(state, collector, emit, f"{message}. stderr tail:\n{self._stderr_tail()}")
+
     def _crash_turn(
-        self, state: _TurnState, collector: EventCollector, message: str, *, cause: BaseException | None = None
+        self,
+        state: _TurnState,
+        collector: EventCollector,
+        emit: Callable[[StreamEvent], None],
+        message: str,
+        *,
+        cause: BaseException | None = None,
     ) -> NoReturn:
         def finalize(status: AgentEndStatus, *, crashed: bool = False, crash_reason: str | None = None) -> None:
-            self._finalize_turn(
-                state,
-                status,
-                lambda e: collector.on_event(e),
-                crashed=crashed,
-                crash_reason=crash_reason,
-            )
+            self._finalize_turn(state, status, emit, crashed=crashed, crash_reason=crash_reason)
 
         try:
             self._finalize_and_raise_crash(finalize, message, cause=cause)
         finally:
             self._capture_partial_turn(collector)
 
-    async def _timeout_turn(self, state: _TurnState, collector: EventCollector, timeout: float) -> NoReturn:
+    async def _timeout_turn(
+        self, state: _TurnState, collector: EventCollector, emit: Callable[[StreamEvent], None], timeout: float
+    ) -> NoReturn:
         await self._force_kill_host()
         # Drop the handle so the NEXT communicate() respawns rather than reuse
         # a killed process (or, worse, a "send" still nominally in flight).
         self._process = None
 
         def finalize(status: AgentEndStatus, *, crashed: bool = False, crash_reason: str | None = None) -> None:
-            self._finalize_turn(
-                state,
-                status,
-                lambda e: collector.on_event(e),
-                crashed=crashed,
-                crash_reason=crash_reason,
-            )
+            self._finalize_turn(state, status, emit, crashed=crashed, crash_reason=crash_reason)
 
         try:
             self._finalize_and_raise_timeout(finalize, timeout)
@@ -898,7 +981,7 @@ async def _read_until(self, accepted_types: tuple[str, ...]) -> dict[str, Any]:
                 # (a buffer overrun or drain exception, not necessarily exit).
                 await self._force_kill_host()
                 self._process = None
-                tail = "\n".join(self._stderr_lines[-20:]) or "(no stderr captured)"
+                tail = self._stderr_tail()
                 raise AgentCrashError(f"Delegate host exited before responding. stderr tail:\n{tail}")
             if msg.get("type") in accepted_types:
                 return msg
diff --git a/src/coder_eval/models/agent_config.py b/src/coder_eval/models/agent_config.py
index 82088ca0e..ad3cb90f0 100644
--- a/src/coder_eval/models/agent_config.py
+++ b/src/coder_eval/models/agent_config.py
@@ -422,15 +422,15 @@ class DelegateAgentConfig(BaseAgentConfig):
             "tier a future SDK release adds."
         ),
     )
-    project_id: str = Field(
-        default="",
+    project_id: str | None = Field(
+        default=None,
         description=(
-            "Client-side wiki-routing key (never sent to the backend). Empty means session-scoped "
+            "Client-side wiki-routing key (never sent to the backend). None means session-scoped "
             "wiki state under a server-assigned session id instead of a stable project directory."
         ),
     )
-    session_id: str = Field(
-        default="",
+    session_id: str | None = Field(
+        default=None,
         description=(
             "Pins the Delegate SDK session id used when a turn omits one, for deterministic "
             "wiki-path routing. Unlike project_id this IS a backend entity: a pinned id skips "
diff --git a/tests/lint/agent_roster_parity.py b/tests/lint/agent_roster_parity.py
index 06df1fb38..9ea4b997e 100644
--- a/tests/lint/agent_roster_parity.py
+++ b/tests/lint/agent_roster_parity.py
@@ -76,6 +76,9 @@ def _pyproject_marketing_text(text: str) -> str:
     ("mkdocs.yml", "the docs-site description (search results, link previews)", _mkdocs_site_description),
     (".github/pages-stub/index.html", "the coder-eval.com root stub", _whole_file),
     ("pyproject.toml", "the PyPI description and keywords", _pyproject_marketing_text),
+    ("docs/USER_GUIDE.md", "the --type list and env-var table a user actually configures from", _whole_file),
+    ("experiments/default.yaml", "the always-loaded default layer's agent.type comment", _whole_file),
+    ("docs/EXTENDING.md", "the 'See also' built-in agent list", _whole_file),
 )
 
 
diff --git a/tests/test_delegate_agent.py b/tests/test_delegate_agent.py
index 118737879..3f3b0cb0a 100644
--- a/tests/test_delegate_agent.py
+++ b/tests/test_delegate_agent.py
@@ -84,7 +84,11 @@ def terminate(self) -> None:
 
 @pytest.fixture
 def patch_exec(monkeypatch: pytest.MonkeyPatch):
-    """Patch ``create_subprocess_exec`` to return a fake process fed ``stdout_lines``."""
+    """Patch ``create_subprocess_exec`` to return a fake process fed ``stdout_lines``.
+
+    Also stubs ``os.killpg`` so the agent's process-group sweep can never signal
+    a real group whose id happens to collide with the fake pid.
+    """
 
     def _install(
         stdout_lines: list[bytes], stderr_lines: list[bytes] | None = None, *, hang_after: bool = False
@@ -97,6 +101,9 @@ async def fake_exec(*args: Any, **kwargs: Any) -> _FakeProcess:
         monkeypatch.setattr(asyncio, "create_subprocess_exec", fake_exec)
         monkeypatch.setattr("shutil.which", lambda _name: "/usr/local/bin/node")
         monkeypatch.setattr(agent_module, "_resolve_sdk_entry", lambda: agent_module._HOST_SCRIPT)
+        # raising=False: os.killpg does not exist on Windows, where the sweep is a
+        # no-op -- the stub must still install so the fixture works on every platform.
+        monkeypatch.setattr(os, "killpg", lambda pgid, sig: None, raising=False)
         return proc
 
     return _install
@@ -146,6 +153,9 @@ def test_no_config_and_not_found_raises_with_search_list(self, tmp_path, monkeyp
         monkeypatch.delenv("DELEGATE_SDK_NODE_MODULES", raising=False)
         monkeypatch.chdir(tmp_path)
         monkeypatch.setattr(os, "getcwd", lambda: str(tmp_path))
+        # A real npm install under the developer's actual home directory must
+        # not make this test flaky -- pin every search root to tmp_path.
+        monkeypatch.setattr(agent_module, "_candidate_install_roots", lambda: [tmp_path])
         with pytest.raises(AgentConfigError, match="Searched the cwd"):
             _resolve_sdk_entry()
 
@@ -411,6 +421,82 @@ def on_event(self, event: Any) -> None:
         assert end.status == AgentEndStatus.COMPLETED
         assert record.crashed is False
 
+    @pytest.mark.parametrize(
+        ("usage_payload", "expected_input", "expected_output"),
+        [
+            ({"input_tokens": 10, "output_tokens": 5}, 10, 5),
+            ({"inputTokens": 10, "outputTokens": 5}, 10, 5),
+            ({"uncached_input_tokens": 10, "output_tokens": 5}, 10, 5),
+        ],
+    )
+    async def test_usage_bucket_spellings_populate_token_usage(
+        self, patch_exec, tmp_path, usage_payload, expected_input, expected_output
+    ):
+        events = [_line({"type": "send_ok", "result": {"response": "done", "usage": usage_payload}})]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        record = await agent.communicate("hi")
+        assert record.token_usage is not None
+        assert record.token_usage.uncached_input_tokens == expected_input
+        assert record.token_usage.output_tokens == expected_output
+
+    async def test_usage_all_zero_is_none_and_warns(self, patch_exec, tmp_path, caplog):
+        events = [_line({"type": "send_ok", "result": {"response": "done", "usage": {"weird_bucket": 3}}})]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        with caplog.at_level("WARNING"):
+            record = await agent.communicate("hi")
+        assert record.token_usage is None
+        assert any("usage payload matched none" in r.message for r in caplog.records)
+
+    async def test_model_and_cost_wired_into_record(self, patch_exec, tmp_path):
+        events = [
+            _line(
+                {
+                    "type": "send_ok",
+                    "result": {
+                        "response": "done",
+                        "model": "virtuoso-1-5",
+                        "usage": {"input_tokens": 1_000_000, "output_tokens": 1_000_000},
+                    },
+                }
+            )
+        ]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        record = await agent.communicate("hi")
+        assert record.model_used == "virtuoso-1-5"
+        assert record.token_usage is not None
+        assert record.token_usage.total_cost_usd == pytest.approx(0.95 + 4.0)
+
+    async def test_send_error_delivers_end_events_to_stream_callback(self, patch_exec, tmp_path):
+        events = [_line({"type": "send_error", "message": "network blip"})]
+        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        seen: list[Any] = []
+
+        class _Recorder:
+            def on_event(self, event: Any) -> None:
+                seen.append(event)
+
+        with pytest.raises(AgentCrashError):
+            await agent.communicate("hi", stream_callback=_Recorder())
+        assert sum(isinstance(e, AgentStartEvent) for e in seen) == 1
+        assert sum(isinstance(e, AgentEndEvent) for e in seen) == 1
+        end = next(e for e in seen if isinstance(e, AgentEndEvent))
+        assert end.crashed is True
+
+    async def test_timeout_delivers_end_events_to_stream_callback(self, patch_exec, tmp_path):
+        patch_exec([_line({"type": "init_ok"})], hang_after=True)
+        agent = DelegateAgent(_config(), task_id="t1")
+        await agent.start(str(tmp_path))
+        seen: list[Any] = []
+
+        class _Recorder:
+            def on_event(self, event: Any) -> None:
+                seen.append(event)
+
+        with pytest.raises(TurnTimeoutError):
+            await agent.communicate("hi", timeout=0.05, stream_callback=_Recorder())
+        assert sum(isinstance(e, AgentStartEvent) for e in seen) == 1
+        assert sum(isinstance(e, AgentEndEvent) for e in seen) == 1
+
 
 class TestStop:
     async def test_stop_sends_destroy_and_marks_finished(self, patch_exec, tmp_path):
@@ -437,6 +523,28 @@ def test_kill_sync_noop_without_process(self):
         agent = DelegateAgent(_config())
         agent.kill_sync()  # must not raise
 
+    @pytest.mark.skipif(os.name != "posix", reason="process-group teardown is POSIX-only by design")
+    def test_kill_sync_sweeps_process_group(self, monkeypatch):
+        monkeypatch.setattr(os, "kill", lambda pid, sig: None)
+        killpg_calls: list[tuple[int, int]] = []
+        monkeypatch.setattr(os, "killpg", lambda pgid, sig: killpg_calls.append((pgid, sig)))
+        agent = DelegateAgent(_config())
+        proc = _FakeProcess([])
+        agent._process = proc  # type: ignore[assignment]
+        agent._pgid = proc.pid
+        agent.kill_sync()
+        assert killpg_calls == [(proc.pid, agent_module._SIGKILL)]
+        assert agent._pgid is None
+
+    async def test_force_kill_host_sweeps_process_group(self, patch_exec, tmp_path, monkeypatch):
+        agent, proc = await _started_agent(patch_exec, [], tmp_path)
+        killpg_calls: list[tuple[int, int]] = []
+        monkeypatch.setattr(os, "killpg", lambda pgid, sig: killpg_calls.append((pgid, sig)))
+        await agent._force_kill_host()
+        assert proc._killed
+        if os.name == "posix":
+            assert killpg_calls == [(proc.pid, agent_module._SIGKILL)]
+
 
 class TestRegistration:
     def test_registered_as_delegate(self):
@@ -449,3 +557,12 @@ def test_create_agent_dispatches(self):
         cfg = _config()
         agent = create_agent(AgentKind.DELEGATE, cfg)
         assert isinstance(agent, DelegateAgent)
+
+
+def test_host_script_ships_with_the_package():
+    """Every test above patches the fixture to return ``_HOST_SCRIPT`` without
+    ever checking the file exists on disk -- a build-config change that dropped
+    it from the wheel would surface only as a runtime MODULE_NOT_FOUND inside a
+    live run, never here.
+    """
+    assert agent_module._HOST_SCRIPT.is_file()
diff --git a/tests/test_delegate_agent_config.py b/tests/test_delegate_agent_config.py
index 19a13281c..d1bdb4f14 100644
--- a/tests/test_delegate_agent_config.py
+++ b/tests/test_delegate_agent_config.py
@@ -26,8 +26,8 @@ def test_validates_and_defaults():
     cfg = DelegateAgentConfig(type="delegate")
     assert cfg.type == AgentKind.DELEGATE
     assert cfg.effort is None
-    assert cfg.project_id == ""
-    assert cfg.session_id == ""
+    assert cfg.project_id is None
+    assert cfg.session_id is None
     assert cfg.enable_computer_use is False
 
 
diff --git a/tests/test_timing_identity_contract.py b/tests/test_timing_identity_contract.py
index 094321984..f2548d72b 100644
--- a/tests/test_timing_identity_contract.py
+++ b/tests/test_timing_identity_contract.py
@@ -260,7 +260,7 @@ def emit(e: Any) -> None:
             messages.extend(e.messages)
 
     _SteppedDatetime.at_ms = 500  # dispatch before the turn state exists: head
-    state = _TurnState(task_id="t", iteration=1, user_input="go", model="m")
+    state = _TurnState(iteration=1, user_input="go", model="m")
 
     _SteppedDatetime.at_ms = 700
     agent._handle_tool_call({"type": "tool_call", "toolId": "c1", "toolName": "bash", "input": {}}, state, emit)

From 9ae4705a78d4205fc83c890a31c738f6295e9552 Mon Sep 17 00:00:00 2001
From: Akshaya Shanbhogue <akshaya.shanbhogue@uipath.com>
Date: Tue, 22 Sep 2026 09:04:29 -0700
Subject: [PATCH 3/3] fix(agents): Delegate token usage was silently zero on
 every live turn
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test_delegate_live_token_usage_populated failed live (crashed=False, real
text/tool output, token_usage=None): _parse_usage was never even reached
with a dict, because it was looking in the wrong place entirely.

Confirmed by reading the installed @uipath/delegate-sdk's bundled
dist/index.mjs directly: sendMessage() always resolves to a plain string,
never an object, and no event forwarded through agent.onEvent() ever
carries a `usage` field. The SDK's per-turn token accounting lives only in
its internal store, reachable through DelegateAgent.getLastTurnUsage()
(and the session id through getSessionId()) -- called nowhere in this
agent before now.

- delegate_host.mjs: call both getters right after sendMessage() resolves
  and attach them to the send_ok message (usage, sessionId).
- delegate_agent.py: _handle_send_ok reads them off send_ok's own top
  level instead of a nonexistent nested result dict. _parse_usage now
  reads the getter's real (confirmed, not guessed) shape --
  promptTokens/completionTokens/promptTokensCached/cacheCreationTokens --
  computing uncached_input_tokens = promptTokens - promptTokensCached
  (promptTokens is the OpenAI-style total, promptTokensCached the
  cache-read subset).
- Updated tests to the real send_ok shape and confirmed bucket names.
- .claude/notes/agents.md § Delegate agent records the finding so it
  isn't re-litigated as a guess next time.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .claude/notes/agents.md                       | 20 +++++
 .../agents/delegate/delegate_host.mjs         | 21 ++++-
 src/coder_eval/agents/delegate_agent.py       | 84 ++++++++++---------
 tests/test_delegate_agent.py                  | 44 ++++++----
 4 files changed, 112 insertions(+), 57 deletions(-)

diff --git a/.claude/notes/agents.md b/.claude/notes/agents.md
index 6e6a08ab8..12de3f84d 100644
--- a/.claude/notes/agents.md
+++ b/.claude/notes/agents.md
@@ -809,6 +809,26 @@ own env-var-driven bootstrapping, not the `DelegateAgent` class itself, which we
 against a real backend). `tests/test_delegate_agent.py::TestStart::test_org_and_tenant_slug_forwarded_into_auth`
 pins it. Passing `DELEGATE_BACKEND_URL` directly instead of `DELEGATE_ENV` skips this whole path.
 
+**Token usage comes from two getters called after `sendMessage()` resolves, not from any event or the
+resolved value itself — confirmed by reading the installed SDK's bundle, not by guessing.** A first
+pass guessed at a flat `usage` dict carried on the resolved `sendMessage()` value or on a forwarded
+event, tried several plausible snake_case/camelCase bucket-name spellings, and silently returned zero
+tokens every turn against a real backend (`tests/test_delegate_agent_live.py::test_delegate_live_token_usage_populated`
+failed live: `record.crashed is False`, real text/tool output, `token_usage=None`). Reading
+`node_modules/@uipath/delegate-sdk/dist/index.mjs` directly settled it: `sendMessage()` always resolves
+to a plain string (never an object), and no event this host forwards via `agent.onEvent()` ever carries
+a `usage` field — the SDK's own internal event vocabulary has no `"usage"` member (that name IS used
+internally, but only inside the SDK's own Zustand store reducer that updates its "Token usage" UI
+panel, never re-emitted through the public `onEvent` bus). The only way to reach it is
+`DelegateAgent.getLastTurnUsage(sessionId?)` (defaults to the just-used session), so
+`delegate_host.mjs`'s `handleSend` calls it — and `getSessionId()` — right after `sendMessage()`
+resolves, and attaches both to the `send_ok` message itself. That getter's shape, read straight off the
+SDK's own `setUsage` store action, is `{promptTokens, completionTokens, promptTokensCached,
+cacheCreationTokens, turnTokenUnits, contextBreakdown}` — `promptTokens` is the TOTAL input token count
+(OpenAI-style, cached + uncached), `promptTokensCached` the cache-READ subset of it, so
+`_parse_usage` computes `uncached_input_tokens = promptTokens - promptTokensCached`. This is now
+CONFIRMED, not a guess, so `_parse_usage`'s docstring no longer marks it `# UNVERIFIED`.
+
 ### Delegate agent pricing
 
 Delegate-served models are keyed under the SDK's own hyphenated ids (e.g. `gpt-5-6-terra`) in
diff --git a/src/coder_eval/agents/delegate/delegate_host.mjs b/src/coder_eval/agents/delegate/delegate_host.mjs
index 8cde1e972..0999faad2 100644
--- a/src/coder_eval/agents/delegate/delegate_host.mjs
+++ b/src/coder_eval/agents/delegate/delegate_host.mjs
@@ -21,7 +21,13 @@
 // stdout (host -> coder_eval):
 //   {"type": "init_ok"}
 //   {"type": "init_error", "message": str}
-//   {"type": "send_ok", "result": <sendMessage()'s resolved value, or null>}
+//   {"type": "send_ok", "result": <sendMessage()'s resolved string, or null>,
+//     "usage": <agent.getLastTurnUsage()'s result, or null>,
+//     "sessionId": <agent.getSessionId()'s result, or null>}
+//     -- usage/sessionId are read from these two getters AFTER sendMessage()
+//     resolves, not from the resolved value itself (a plain string) or from
+//     any forwarded event: CONFIRMED (reading the installed SDK's bundled
+//     source) that no event this host forwards ever carries a `usage` field.
 //   {"type": "send_error", "message": str}
 //   {"type": "destroy_error", "message": str}
 //   {"type": "protocol_error", "message": str} -- malformed/unknown stdin command; host keeps running
@@ -88,7 +94,18 @@ async function handleSend(msg) {
     return;
   }
   const result = await agent.sendMessage(msg.prompt, msg.sessionId || undefined);
-  writeLine({ type: "send_ok", result: result ?? null });
+  // CONFIRMED (reading @uipath/delegate-sdk@0.1.12's bundled dist/index.mjs):
+  // sendMessage() resolves to a plain string (the final response text) --
+  // never an object -- and no event this host forwards via agent.onEvent()
+  // ever carries a `usage` field. The SDK's own per-turn token accounting is
+  // internal state, reachable only through these two getters, called here
+  // once the turn (and the backend's own internal "usage" store update) has
+  // settled. Guarded with typeof, not called unconditionally: an older/newer
+  // SDK build that drops either method must degrade to "no usage this turn",
+  // never crash the host.
+  const usage = typeof agent.getLastTurnUsage === "function" ? agent.getLastTurnUsage() : null;
+  const sessionId = typeof agent.getSessionId === "function" ? agent.getSessionId() : null;
+  writeLine({ type: "send_ok", result: result ?? null, usage: usage ?? null, sessionId: sessionId ?? null });
 }
 
 async function handleDestroy() {
diff --git a/src/coder_eval/agents/delegate_agent.py b/src/coder_eval/agents/delegate_agent.py
index bc3a6ec52..05e65d747 100644
--- a/src/coder_eval/agents/delegate_agent.py
+++ b/src/coder_eval/agents/delegate_agent.py
@@ -11,9 +11,9 @@
 clear ``AgentConfigError`` at ``start()`` (Node.js, ``npm install
 @uipath/delegate-sdk``, UiPath auth). Deliberate scope reductions versus the
 UiPath-internal sibling agent's more hardened adapter (no multi-generation
-transcript splitting, no WAF/SSE/session-conflict/stall-resend recovery,
-best-effort token-bucket field names marked ``# UNVERIFIED``) and every
-``# UNVERIFIED`` spot's rationale live in one place, not scattered:
+transcript splitting, no WAF/SSE/session-conflict/stall-resend recovery) and
+every remaining ``# UNVERIFIED`` spot's rationale live in one place, not
+scattered:
 
 Rationale: .claude/notes/agents.md § Delegate agent
 """
@@ -206,39 +206,46 @@ def _resolve_bundled_skills_path(plugins: list[dict[str, Any]] | None) -> str |
 
 
 def _parse_usage(raw: Any) -> TokenUsage | None:
-    """Best-effort parse of an event/result's ``usage`` payload into ``TokenUsage``.
-
-    UNVERIFIED: the SDK confirms an ``usage`` field exists on at least some
-    events, but not its internal bucket key names. Tries several plausible
-    spellings (snake_case, as the internal sibling agent's protocol used; and
-    camelCase, in case this layer differs) and falls back to 0 for anything it
-    cannot read, mirroring the project's "warn on drift, never raise" contract.
+    """Parse the SDK's per-turn usage payload (from ``getLastTurnUsage()``) into ``TokenUsage``.
+
+    CONFIRMED (reading the installed ``@uipath/delegate-sdk@0.1.12``'s bundled
+    ``dist/index.mjs``): no event this host forwards ever carries a ``usage``
+    field -- the SDK's per-turn token accounting lives only in its internal
+    store, reachable through ``DelegateAgent.getLastTurnUsage()``, which
+    ``delegate_host.mjs`` calls after ``sendMessage()`` resolves and attaches
+    to the ``send_ok`` message as ``usage``. That getter's shape, from the
+    SDK's own ``setUsage`` store action: ``{promptTokens, completionTokens,
+    promptTokensCached, cacheCreationTokens, turnTokenUnits,
+    contextBreakdown}``. ``promptTokens`` is the TOTAL input token count
+    (cached + uncached, OpenAI-style); ``promptTokensCached`` is the
+    cache-READ subset of it, so ``uncached = promptTokens - promptTokensCached``.
+    Falls back to 0 for anything absent (e.g. before the backend's first
+    internal usage report), mirroring the project's "warn on drift, never
+    raise" contract -- a future SDK release renaming one of these fields
+    degrades to zero tokens for that bucket, not a crash.
     """
     if not isinstance(raw, dict):
         return None
 
-    def _int(*keys: str) -> int:
-        for key in keys:
-            value = raw.get(key)
-            if isinstance(value, bool):
-                continue
-            if isinstance(value, int) and value >= 0:
-                return value
-        return 0
-
-    input_tokens = _int("input_tokens", "inputTokens", "uncached_input_tokens")
-    output_tokens = _int("output_tokens", "outputTokens")
-    cache_creation = _int("cache_creation_input_tokens", "cacheCreationInputTokens", "cache_write", "cacheWrite")
-    cache_read = _int("cache_read_input_tokens", "cacheReadInputTokens", "cache_read", "cacheRead")
-    if input_tokens == 0 and output_tokens == 0 and cache_creation == 0 and cache_read == 0:
+    def _int(key: str) -> int:
+        value = raw.get(key)
+        if isinstance(value, bool):
+            return 0
+        return value if isinstance(value, int) and value >= 0 else 0
+
+    prompt_total = _int("promptTokens")
+    prompt_cached = _int("promptTokensCached")
+    output_tokens = _int("completionTokens")
+    cache_creation = _int("cacheCreationTokens")
+    if prompt_total == 0 and output_tokens == 0 and prompt_cached == 0 and cache_creation == 0:
         if raw:
             logger.warning("delegate: usage payload matched none of the known bucket spellings: %r", sorted(raw))
         return None
     return TokenUsage(
-        uncached_input_tokens=input_tokens,
+        uncached_input_tokens=max(prompt_total - prompt_cached, 0),
         output_tokens=output_tokens,
         cache_creation_input_tokens=cache_creation,
-        cache_read_input_tokens=cache_read,
+        cache_read_input_tokens=prompt_cached,
     )
 
 
@@ -795,22 +802,21 @@ def _handle_tool_result(self, msg: dict[str, Any], state: _TurnState, emit: Call
         emit(ToolEndEvent(task_id=self.task_id, turn_id=state.turn_id, tool=telemetry, status=status))
 
     def _handle_send_ok(self, msg: dict[str, Any], state: _TurnState) -> None:
+        # CONFIRMED (reading the installed SDK's bundled source):
+        # sendMessage()'s resolved value is always a plain string, never an
+        # object -- `usage`/`sessionId` are NOT nested under it. delegate_host.mjs
+        # instead reads them off `getLastTurnUsage()`/`getSessionId()` after
+        # sendMessage() resolves and attaches them to this message's own
+        # top level (see delegate_host.mjs's wire-protocol header comment).
         result = msg.get("result")
         if isinstance(result, str):
             state.final_response = result
-        elif isinstance(result, dict):
-            response = result.get("response") or result.get("content")
-            if isinstance(response, str):
-                state.final_response = response
-            session_id = result.get("sessionId")
-            if isinstance(session_id, str) and session_id:
-                self._session_id = session_id
-            usage = _parse_usage(result.get("usage"))
-            if usage is not None:
-                state.usage = usage
-            model = result.get("model")
-            if isinstance(model, str) and model:
-                state.model_used = model
+        session_id = msg.get("sessionId")
+        if isinstance(session_id, str) and session_id:
+            self._session_id = session_id
+        usage = _parse_usage(msg.get("usage"))
+        if usage is not None:
+            state.usage = usage
 
     def _close_open_tools(self, state: _TurnState, emit: Callable[[StreamEvent], None]) -> None:
         for tool_id, telemetry in list(state.open_tools.items()):
diff --git a/tests/test_delegate_agent.py b/tests/test_delegate_agent.py
index 3f3b0cb0a..436243ed2 100644
--- a/tests/test_delegate_agent.py
+++ b/tests/test_delegate_agent.py
@@ -251,7 +251,7 @@ async def test_happy_path_text_and_tool(self, patch_exec, tmp_path):
             _line({"type": "message", "content": "here is my answer"}),
             _line({"type": "tool_call", "toolName": "Bash", "toolId": "tool-1", "input": {"command": "ls"}}),
             _line({"type": "tool_result", "toolId": "tool-1", "output": "file.txt"}),
-            _line({"type": "send_ok", "result": {"response": "here is my answer", "sessionId": "sess-1"}}),
+            _line({"type": "send_ok", "result": "here is my answer", "sessionId": "sess-1"}),
         ]
         agent, proc = await _started_agent(patch_exec, events, tmp_path)
         record = await agent.communicate("do something")
@@ -422,45 +422,57 @@ def on_event(self, event: Any) -> None:
         assert record.crashed is False
 
     @pytest.mark.parametrize(
-        ("usage_payload", "expected_input", "expected_output"),
+        ("usage_payload", "expected_uncached_input", "expected_output", "expected_cache_read", "expected_cache_write"),
         [
-            ({"input_tokens": 10, "output_tokens": 5}, 10, 5),
-            ({"inputTokens": 10, "outputTokens": 5}, 10, 5),
-            ({"uncached_input_tokens": 10, "output_tokens": 5}, 10, 5),
+            ({"promptTokens": 10, "completionTokens": 5}, 10, 5, 0, 0),
+            ({"promptTokens": 10, "completionTokens": 5, "promptTokensCached": 4}, 6, 5, 4, 0),
+            (
+                {"promptTokens": 10, "completionTokens": 5, "promptTokensCached": 4, "cacheCreationTokens": 3},
+                6,
+                5,
+                4,
+                3,
+            ),
         ],
     )
     async def test_usage_bucket_spellings_populate_token_usage(
-        self, patch_exec, tmp_path, usage_payload, expected_input, expected_output
+        self,
+        patch_exec,
+        tmp_path,
+        usage_payload,
+        expected_uncached_input,
+        expected_output,
+        expected_cache_read,
+        expected_cache_write,
     ):
-        events = [_line({"type": "send_ok", "result": {"response": "done", "usage": usage_payload}})]
+        events = [_line({"type": "send_ok", "result": "done", "usage": usage_payload})]
         agent, _ = await _started_agent(patch_exec, events, tmp_path)
         record = await agent.communicate("hi")
         assert record.token_usage is not None
-        assert record.token_usage.uncached_input_tokens == expected_input
+        assert record.token_usage.uncached_input_tokens == expected_uncached_input
         assert record.token_usage.output_tokens == expected_output
+        assert record.token_usage.cache_read_input_tokens == expected_cache_read
+        assert record.token_usage.cache_creation_input_tokens == expected_cache_write
 
     async def test_usage_all_zero_is_none_and_warns(self, patch_exec, tmp_path, caplog):
-        events = [_line({"type": "send_ok", "result": {"response": "done", "usage": {"weird_bucket": 3}}})]
+        events = [_line({"type": "send_ok", "result": "done", "usage": {"weird_bucket": 3}})]
         agent, _ = await _started_agent(patch_exec, events, tmp_path)
         with caplog.at_level("WARNING"):
             record = await agent.communicate("hi")
         assert record.token_usage is None
         assert any("usage payload matched none" in r.message for r in caplog.records)
 
-    async def test_model_and_cost_wired_into_record(self, patch_exec, tmp_path):
+    async def test_cost_wired_into_record_for_configured_model(self, patch_exec, tmp_path):
         events = [
             _line(
                 {
                     "type": "send_ok",
-                    "result": {
-                        "response": "done",
-                        "model": "virtuoso-1-5",
-                        "usage": {"input_tokens": 1_000_000, "output_tokens": 1_000_000},
-                    },
+                    "result": "done",
+                    "usage": {"promptTokens": 1_000_000, "completionTokens": 1_000_000},
                 }
             )
         ]
-        agent, _ = await _started_agent(patch_exec, events, tmp_path)
+        agent, _ = await _started_agent(patch_exec, events, tmp_path, model="virtuoso-1-5")
         record = await agent.communicate("hi")
         assert record.model_used == "virtuoso-1-5"
         assert record.token_usage is not None