# Validation: integrated Source-Agent mode

Validated in the available offline build environment:

- Agent/Brain role configuration parsing and Agent-mode dependency bypass.
- Poll task validation for RSS/Atom/sitemap/Web, interval/URL rejection cases, and rejection of URL userinfo.
- Source-fetch HTTP uses the same DNS/redirect/private-network SSRF protections as Brain research fetches; Brain API connectivity remains a separate client so private Brain URLs still work.
- Document normalization, SHA-256 creation and semantic-hash sanity check.
- Compile checks for Source-Agent store/runner, Brain Source-Inbox worker, Agent HTTP API, UI integration and main role switch.
- Existing Engine/Web packages compile with the new Source-Inbox dependency.
- Source-agent management/inbox reads require the normal Brain API key whenever `BRAIN_API_KEY` is configured; Agent bearer tokens remain restricted to config/heartbeat/ingest.
- `source-agents.js` passes `node --check`.
- `go vet` is run in the temporary Go 1.23 compile copy.
- Patch application and ZIP integrity are checked for the release.

Environment limitation: the project requires Go 1.26 and `modernc.org/sqlite v1.37.1`, while the local runner has Go 1.23 and no network access. As with the preceding releases, project-wide compile/vet validation uses an isolated copy with the compile-only SQLite stub. Consequently the new SQLite Agent/Inbox schema is compile-checked but cannot be exercised against the real modernc SQLite driver in this environment. The shipped `go.mod` remains unchanged at Go 1.26 with the real SQLite dependency.