[bitifirefly]

Changes

• Add an explicit LangChain application backend alongside the unchanged Dify path, with administrator configuration and a dedicated text/streaming/history UI.
• Add protected conversation/run bindings, atomic submission deduplication, shared admission limits, server-side result snapshots and idempotent history saving.
• Enforce user/application ownership and live access checks, block generic writes to managed messages, redact upstream configuration and safely project the verified AG-UI subset.
• Keep unsupported cancellation, files, frontend tools and stream resumption disabled; document the service contract and failure boundaries.

Validation

• Isolated Dev: full Jest suite, root/API/shared TypeScript, scoped ESLint and Prettier, architecture/i18n/content guards, shared/API/Web production builds.
• Fresh and incremental PostgreSQL migrations; multi-API authorization, concurrency, disconnection and persistence regression tests.
• Real Agent two-turn/tool/history probe; deterministic Dify affected-path regression.
• Publication and source credential scans before push. No deployment-owned addresses, tokens, accounts, model configuration or internal work logs are included.

Rollout

After integration, freeze the remote develop SHA and run independent candidate automation plus manual acceptance. Existing services are not switched by this PR. This is not a production deployment or version release.