@arnilo/prism 0.0.12 → 0.0.13

package/docs/providers/azure.md

@@ -0,0 +1,74 @@
+# Azure OpenAI / Foundry
+
+## What it does
+
+`@arnilo/prism-provider-azure` registers an Azure OpenAI / Foundry Chat Completions provider that uses host-supplied Entra workload identity (Bearer) or Azure resource keys (`api-key`). Deployment URLs keep the configured endpoint host (custom subdomain, private endpoint, or VNet FQDN).
+
+## When to use it
+
+Use it for enterprise Azure OpenAI / Foundry deployments with Managed Identity or host token providers. Do not fold this into consumer OpenAI packages. Do not embed static keys in fixtures.
+
+## Inputs / request
+
+```ts
+import { createAzureOpenAIProviderPackage } from "@arnilo/prism-provider-azure";
+
+createAzureOpenAIProviderPackage({
+  endpoint: "https://my-resource.openai.azure.com",
+  deployment: "gpt-4o",
+  apiVersion: "2024-10-21",
+  credential: hostEntraToken, // late-bound
+  authStyle: "bearer",
+  models: [{ provider: "azure", model: "gpt-4o" }],
+});
+```
+
+| Field | Meaning |
+| --- | --- |
+| `endpoint` | Absolute https resource URL; host preserved |
+| `deployment` | Deployment name (defaults to `model.model`) |
+| `apiVersion` | Query `api-version` (default `2024-10-21`) |
+| `credential` | `CredentialValueSource` — Entra token or resource key |
+| `authStyle` | `bearer` (default) or `api-key` |
+
+## Outputs / response / events
+
+Reuses `@arnilo/prism/providers/openai-compatible` streaming events (text, tool deltas, usage, done, redacted errors). Missing credentials fail closed before `fetch`.
+
+## Request/response example
+
+```http
+POST https://my-resource.privatelink.openai.azure.com/openai/deployments/gpt-4o/chat/completions?api-version=2024-10-21
+Authorization: Bearer <entra-token>
+```
+
+## Implementation example
+
+```ts
+const provider = createAzureOpenAIProvider({
+  endpoint: process.env.AZURE_OPENAI_ENDPOINT!,
+  deployment: "gpt-4o",
+  credential: () => entra.getToken("https://cognitiveservices.azure.com/.default").then((t) => t.token),
+});
+```
+
+Opt-in live canaries: inject real `fetch` + host credential behind host CI secrets — no secrets in repo.
+
+## Extension and configuration notes
+
+Register via `createExtensionKernel().load([createAzureOpenAIProviderPackage(...)])`. Pair with `@arnilo/prism-model-router` for residency allow-lists on Azure regions/endpoints.
+
+## Security and performance notes
+
+- No credential prefetch at import; resolve per request.
+- Endpoint host is never rewritten to public DNS.
+- Errors redact credential values via shared transport helpers.
+- No Azure SDK dependency.
+
+## Related APIs
+
+- [OpenAI-compatible provider](openai-compatible.md)
+- [Provider packages](../provider-packages.md)
+- [Model routing](../model-routing.md)
+- [Credential storage](../credential-storage.md)
+- Package README: [`@arnilo/prism-provider-azure`](../../packages/provider-azure/README.md)

package/docs/providers/bedrock.md

@@ -0,0 +1,72 @@
+# Amazon Bedrock
+
+## What it does
+
+`@arnilo/prism-provider-bedrock` registers an Amazon Bedrock Runtime OpenAI-compatible Chat Completions provider. Hosts supply IAM/IRSA/assumed-role credentials; the package signs requests with SigV4 (no AWS SDK). Region and optional PrivateLink endpoint URLs are preserved.
+
+## When to use it
+
+Use it for enterprise Bedrock access under workload identity. Do not embed long-lived keys in fixtures. Use model-router residency policy to deny disallowed regions.
+
+## Inputs / request
+
+```ts
+import { createBedrockProviderPackage } from "@arnilo/prism-provider-bedrock";
+
+createBedrockProviderPackage({
+  region: "eu-west-1",
+  // endpoint: "https://vpce-….bedrock-runtime.eu-west-1.vpce.amazonaws.com",
+  credential: () => hostAwsCredentials(),
+  models: [{ provider: "bedrock", model: "anthropic.claude-3-haiku-20240307-v1:0" }],
+});
+```
+
+| Field | Meaning |
+| --- | --- |
+| `region` | AWS region for signing + default endpoint |
+| `endpoint` | Optional https PrivateLink / VPC interface base URL |
+| `credential` | `{ accessKeyId, secretAccessKey, sessionToken? }` or async callback |
+| `signRequest` | Optional host SigV4 override |
+
+Default public base: `https://bedrock-runtime.{region}.amazonaws.com` → `/openai/v1/chat/completions`.
+
+## Outputs / response / events
+
+OpenAI-compatible SSE mapped to Prism provider events. Missing credentials fail closed before network I/O.
+
+## Request/response example
+
+```http
+POST https://bedrock-runtime.eu-west-1.amazonaws.com/openai/v1/chat/completions
+Authorization: AWS4-HMAC-SHA256 Credential=…/eu-west-1/bedrock/aws4_request, …
+X-Amz-Security-Token: …
+```
+
+## Implementation example
+
+```ts
+const provider = createBedrockProvider({
+  region: "us-east-1",
+  credential: async () => fromNodeProviderChain()(),
+});
+```
+
+Live canaries stay opt-in behind host credentials; default tests are network-free.
+
+## Extension and configuration notes
+
+Uses Bedrock’s OpenAI-compatible runtime route (not Converse eventstream). Hosts needing Converse-only models should supply a custom provider or AI SDK bridge.
+
+## Security and performance notes
+
+- No AWS SDK; package-local SigV4 only for `bedrock` service.
+- Private endpoint hosts are not rewritten to public DNS.
+- Credential secrets are redacted from provider errors.
+- No credential prefetch at import.
+
+## Related APIs
+
+- [OpenAI-compatible provider](openai-compatible.md)
+- [Model routing](../model-routing.md)
+- [Provider packages](../provider-packages.md)
+- Package README: [`@arnilo/prism-provider-bedrock`](../../packages/provider-bedrock/README.md)

package/docs/providers/google.md

@@ -82,6 +82,7 @@ api.registerProviderPackage(createGoogleProviderPackage({ apiKey: hostKey, model
 
 ## Related APIs
 
+- [Google Vertex AI](vertex.md): enterprise ADC/workload-identity package (separate from this consumer API-key package).
 - [Provider packages](../provider-packages.md): package setup + discovery contract.
 - [Thinking and reasoning](../thinking-and-reasoning.md): portable thinking helpers.
 - [Provider conformance](../provider-conformance.md): network-free assertions.

package/docs/providers/openai-compatible.md

@@ -27,9 +27,11 @@ Options:
 | Field | Type | Purpose |
 | --- | --- | --- |
 | `id` | `string` | Optional provider id. Defaults to `openai-compatible`. |
-| `baseUrl` | `string` | Base API URL; `/chat/completions` is appended. |
+| `baseUrl` | `string` | Base API URL; `/chat/completions` is appended unless `chatCompletionsUrl` is set. |
 | `apiKey` | `CredentialValueSource` | Optional direct/callback/resolver credential source. |
 | `fetch` | `typeof fetch` | Optional fetch implementation for tests or custom hosts. |
+| `chatCompletionsUrl` | `string \| ((request) => string)` | Optional full chat-completions URL override (Azure deployment paths). |
+| `authStyle` | `"bearer" \| "api-key" \| "none"` | Auth header style. Default `bearer`. |
 
 Provider requests use the standard `ProviderRequest` shape: `model`, `messages`, optional `tools`, `metadata`, and `signal`.
 

package/docs/providers/openrouter.md

@@ -188,9 +188,11 @@ cache-read pricing exists), and seeds `compat.reasoning.effort` from
   hidden app identity.
 - Live tests stay opt-in behind `PRISM_LIVE_PROVIDER_TESTS=1` plus fake-safe
   provider-specific env names; default tests are network-free.
+- Enterprise hosts that must gate `compat.openRouterRouting` should wrap selection with `@arnilo/prism-model-router` (`allowOpenRouterRouting`); the OpenRouter adapter itself still passthroughs routing when present on the request.
 
 ## Related APIs
 
+- [Model routing](../model-routing.md): optional allow-list/residency/budget/circuit facade and OpenRouter routing gate.
 - [Provider packages](../provider-packages.md): `defineProviderPackage`,
   `ModelConfig`/`compat`, cache policy, caller-gated discovery.
 - [Thinking and reasoning](../thinking-and-reasoning.md): `applyThinkingLevel`

package/docs/providers/vertex.md

@@ -0,0 +1,71 @@
+# Google Vertex AI
+
+## What it does
+
+`@arnilo/prism-provider-vertex` registers a Vertex AI OpenAPI-compatible Chat Completions provider authenticated with host ADC / workload identity tokens. It is intentionally separate from `@arnilo/prism-provider-google` (consumer Gemini API keys).
+
+## When to use it
+
+Use it for GCP enterprise Vertex deployments with Application Default Credentials or workload identity federation. Do not use the consumer Google package for Vertex auth semantics.
+
+## Inputs / request
+
+```ts
+import { createVertexProviderPackage } from "@arnilo/prism-provider-vertex";
+
+createVertexProviderPackage({
+  projectId: "my-gcp-project",
+  location: "europe-west1",
+  credential: () => hostAdcAccessToken(),
+  models: [{ provider: "vertex", model: "google/gemini-2.0-flash-001" }],
+});
+```
+
+| Field | Meaning |
+| --- | --- |
+| `projectId` | GCP project |
+| `location` | Vertex location / region |
+| `endpoint` | Optional full https OpenAPI base (private/custom); otherwise location-scoped default |
+| `credential` | Bearer access token source (ADC / WIF) |
+
+Default base: `https://{location}-aiplatform.googleapis.com/v1/projects/{project}/locations/{location}/endpoints/openapi`.
+
+## Outputs / response / events
+
+OpenAI-compatible SSE → Prism provider events. Missing ADC token fails closed before `fetch`.
+
+## Request/response example
+
+```http
+POST https://europe-west1-aiplatform.googleapis.com/v1/projects/my-gcp-project/locations/europe-west1/endpoints/openapi/chat/completions
+Authorization: Bearer <adc-token>
+```
+
+## Implementation example
+
+```ts
+const provider = createVertexProvider({
+  projectId: "my-gcp-project",
+  location: "us-central1",
+  credential: async () => (await GoogleAuth.getAccessToken()),
+});
+```
+
+## Extension and configuration notes
+
+`@arnilo/prism-provider-google` remains API-key Gemini (`generativelanguage.googleapis.com`) and must not register Vertex OAuth/ADC. Load this package explicitly for Vertex.
+
+## Security and performance notes
+
+- No Google Cloud SDK dependency in the package.
+- Custom/private endpoint hosts are preserved.
+- Tokens redacted from errors; no import-time credential prefetch.
+- Pair with model-router residency allow-lists on `location`.
+
+## Related APIs
+
+- [Google Gemini (consumer)](google.md)
+- [OpenAI-compatible provider](openai-compatible.md)
+- [Provider packages](../provider-packages.md)
+- [Model routing](../model-routing.md)
+- Package README: [`@arnilo/prism-provider-vertex`](../../packages/provider-vertex/README.md)

package/docs/public-contracts.md

@@ -15,7 +15,8 @@ Current contract groups:
 - Extensions/middleware: `ExtensionLifecycleEventName`, `ExtensionEvent`, `Extension`, `ExtensionAPI`, `MiddlewareHookName`, `Middleware`, `MiddlewareNext`, `MiddlewareRegistry`
 - Configuration/manifests: `ConfigProvider`, `ConfigLayer`, `ConfigLoadContext`, `PrismManifest`, `ManifestContributionDeclaration`, `ManifestResourceDeclaration`, `ManifestContributionKind`
 - Stores/resources/settings/credentials/compaction/retry/cache helpers: `SessionEntry`, `SessionStore`, `StoreFactory`, `Resource`, `ResourceLoader`, `ResourceLoadContext`, `SettingsProvider`, `CredentialRequest`, `Credential`, `CredentialResolver`, `CompactionStrategy`, `CompactionContext`, `CompactionResult`, `CompactionOptions`, `CompactionMiddlewarePayload`, `CompactionEntryData`, `DefaultCompactionStrategyOptions`, `RetryPolicy`, `RetryContext`, `RetryDecision`, `RetryOptions`, `RetryMiddlewarePayload`, `DefaultRetryPolicyOptions`, `CacheUsageReport`, `sanitizeCacheKey`, `mapCacheRetention`, `applyCacheControl`, `cacheHitRate`, `cacheSavings`, `cacheUsageReport`
-- Production persistence (adapter-facing): `ProductionPersistenceStore`, `CheckpointStore`, `CheckpointKey`, `CheckpointSaveInput`, `CheckpointRecord`, `CheckpointQuery`, `LeaseStore`, `LeaseKey`, `LeaseAcquireInput`, `LeaseClaimInput`, `LeaseRecord`, `PersistencePage`, `PersistenceQuery`, `OwnershipScope`, `SessionRecord`, `SessionQuery`, `BranchRecord`, `BranchQuery`, `SessionEntryQuery`, `RunRecord`, `RunQuery`, `RunFeedbackRecord`, `RunFeedbackStore`, `RunFeedbackQuery`, `AgentEventRecord`, `AgentEventQuery`, `ToolCallRecord`, `ToolCallQuery`, `UsageRecord`, `UsageQuery`, `AgentDefinitionRecord`, `AgentDefinitionQuery`, `RetentionPolicy`, `RetentionPolicyQuery`, `MigrationRecord`, `MigrationQuery`
+- Production persistence (adapter-facing): `ProductionPersistenceStore` (optional `lifecycle`), `CheckpointStore`, `CheckpointKey`, `CheckpointSaveInput`, `CheckpointRecord`, `CheckpointQuery`, `LeaseStore`, `LeaseKey`, `LeaseAcquireInput`, `LeaseClaimInput`, `LeaseRecord`, `PersistencePage`, `PersistenceQuery`, `OwnershipScope`, `SessionRecord`, `SessionQuery`, `BranchRecord`, `BranchQuery`, `SessionEntryQuery`, `RunRecord`, `RunQuery`, `RunFeedbackRecord`, `RunFeedbackStore`, `RunFeedbackQuery`, `AgentEventRecord`, `AgentEventQuery`, `ToolCallRecord`, `ToolCallQuery`, `UsageRecord`, `UsageQuery`, `AgentDefinitionRecord`, `AgentDefinitionQuery`, `RetentionPolicy`, `RetentionPolicyQuery`, `MigrationRecord`, `MigrationQuery`, `PersistenceLifecycleStore`, `LegalHoldRecord`, `TenantQuota`
+- Identity: `Principal`, `AgentIdentity`, `IdentityVerifier`, `assertIdentityActive`, `narrowIdentity`, `ownershipFromIdentity`, `assertIdentityMatchesOwnership`, `assertIdentityPropagation`, `identityTelemetryAttributes`, `resolveRunIdentity`, `IdentityError`, identity limit constants
 
 ## When to use it
 
@@ -165,6 +166,7 @@ Important request shapes:
 | `CacheUsageReport` | Numeric cache diagnostics from normalized `Usage`: read/write tokens, hit rate, estimated savings, and optional currency. |
 | `AgentDefinitionRecord` / `AgentDefinitionQuery` | Versioned agent-definition snapshot and filters. Does not store credentials or provider instances. |
 | `RetentionPolicy` / `RetentionPolicyQuery` | Retention policy and filters: age, entry count, byte limits, archive store, applied kinds. |
+| `PersistenceLifecycleStore` / `LegalHoldRecord` / `TenantQuota` | Optional hold/retention apply/export/quota capability on `ProductionPersistenceStore.lifecycle`. |
 | `MigrationRecord` / `MigrationQuery` | Applied migration record and filters. |
 
 ## Outputs / response / events

package/docs/release-and-install.md

@@ -2,15 +2,19 @@
 
 ## What it does
 
-Prism is published as one core package, twenty-eight first-party capability packages, and six pure-manifest family/profile packages. This page describes how they are packed, what each tarball contains, how to install them, the required `@arnilo/prism` peer dependency, the release workflow, and the offline test budget.
+Prism is published as one core package, thirty-four first-party capability packages, and six pure-manifest family/profile packages (**41** publishable manifests total). This page describes how they are packed, what each tarball contains, how to install them, the required `@arnilo/prism` peer dependency, the release workflow, and the offline test budget.
 
 Core package:
 
 - `@arnilo/prism` — the runtime, contracts, registries, streaming events, CLI (including `prism init`), and the `/docs` hub. `files`: `dist` (with `!dist/__tests__` and `!dist/**/*.map` negations), `docs`, `templates`, `CHANGELOG.md`. `bin`: `prism` -> `dist/cli.js`. `sideEffects`: `["dist/cli.js"]`.
 
-First-party workspace packages (each has non-optional `@arnilo/prism@0.0.12` peer and `sideEffects: false`; RAG also peers on memory, and server also peers on workflows):
+First-party workspace packages (each has non-optional `@arnilo/prism@0.0.13` peer and `sideEffects: false`; RAG also peers on memory, and server also peers on workflows):
 
 - `@arnilo/prism-provider-anthropic`, `@arnilo/prism-provider-google`, `@arnilo/prism-provider-openai`, `@arnilo/prism-provider-openrouter`, `@arnilo/prism-provider-kimi`, `@arnilo/prism-provider-zai`, `@arnilo/prism-provider-opencode-go`, `@arnilo/prism-provider-neuralwatt` — provider adapters.
+- `@arnilo/prism-provider-azure`, `@arnilo/prism-provider-bedrock`, `@arnilo/prism-provider-vertex` — optional enterprise-cloud adapters (Entra/IAM/ADC; separate from consumer Anthropic/Google).
+- `@arnilo/prism-policy` — optional policy-decision ledger and cursor-paginated audit export.
+- `@arnilo/prism-model-router` — optional model governance router (allow-list, residency, budgets, circuits, fallbacks) over `ProviderResolver`.
+- `@arnilo/prism-work-tools` — optional identity-scoped M365/GWS connectors (`./microsoft365`, `./google-workspace`); host-pinned CLI argv only.
 - `@arnilo/prism-provider-ai-sdk` — optional AI SDK `LanguageModelV4` adapter; included by the provider and all umbrellas.
 - `@arnilo/prism-compaction-llm` — optional LLM-backed compaction strategy.
 - `@arnilo/prism-compaction-observational-memory` — optional source-backed observational memory.
@@ -42,9 +46,9 @@ Family/profile packages (pure manifests, no code or `dist`; ship `README.md` and
 - `@arnilo/prism-code` — base + coding-agent + coding-security + MCP; providers and persistence remain explicit choices.
 - `@arnilo/prism-sdk` — base + workflows + MCP + Node credentials + OpenTelemetry; providers and persistence remain explicit choices.
 - `@arnilo/prism-evals` remains optional and network-free by default; model judges are host callbacks and live credentialed gates run separately. `examples/evaluation-gate.ts` demonstrates non-zero threshold gating.
-- `@arnilo/prism-all` — every first-party package: code + SDK + providers + persistence + evals + memory/RAG + server + supervisor + web tools + browser. Installation alone activates no network/listener, telemetry, database, memory, evaluation, delegation, MCP, shell, filesystem, or browser capability.
+- `@arnilo/prism-all` — every first-party package: code + SDK + providers + persistence + evals + memory/RAG + server + supervisor + web tools + browser + Phase 8 optional policy/router/enterprise providers/work-tools. **0.0.13** enrolls `@arnilo/prism-policy`, `@arnilo/prism-model-router`, `@arnilo/prism-provider-azure`, `@arnilo/prism-provider-bedrock`, `@arnilo/prism-provider-vertex`, and `@arnilo/prism-work-tools` in the umbrella only. Installation alone activates no network/listener, telemetry, database, memory, evaluation, delegation, MCP, shell, filesystem, or browser capability.
 
-Profile footprint snapshot (Node 24/npm 11, lockfile graph, 2026-07-19): `base` reaches 6 first-party packages and one external dependency root (Ajv); `code` reaches 10 and three (Ajv, MCP SDK, diff); `sdk` reaches 11 and three (Ajv, MCP SDK, keyring); `all` reaches all 35 first-party manifests; AG-UI adds only its protocol SDK dependencies while native database drivers remain all-profile-only. Native database drivers stay out of base/code/sdk; both appear only in all.
+Profile footprint snapshot (Node 24/npm 11, lockfile graph, 2026-07-19): `base` reaches 6 first-party packages and one external dependency root (Ajv); `code` reaches 10 and three (Ajv, MCP SDK, diff); `sdk` reaches 11 and three (Ajv, MCP SDK, keyring); `all` reaches **41** first-party manifests after Phase 8 optional packages ship (graph bump Task 10); AG-UI adds only its protocol SDK dependencies while native database drivers remain all-profile-only. Native database drivers stay out of base/code/sdk; both appear only in all.
 
 Each code package's `files` array is `["dist", "!dist/__tests__", "!dist/**/*.map", "README.md", "CHANGELOG.md"]`; `README.md`, `LICENSE`, and `CHANGELOG.md` ship in every code-package tarball, the core tarball also ships the `docs/` directory, and family/profile tarballs ship `README.md` + `CHANGELOG.md` + `package.json`.
 
@@ -191,6 +195,74 @@ Optional live smoke tests stay separate from SDK readiness because they require
 PRISM_LIVE_PROVIDER_TESTS=1 npm run test --workspaces --if-present
 ```
 
+### 0.0.13 publish handoff
+
+**Decision: GO after operator prerequisites below.** Phase 8 enterprise identity, policy/audit, model governance, Azure/Bedrock/Vertex providers, server deployment seams, persistence schema v5 lifecycle hooks, and M365/GWS work connectors. The exact 0.0.13 graph has **41 manifests**. Phase 8 optional packages (`@arnilo/prism-policy`, `@arnilo/prism-model-router`, enterprise providers, `@arnilo/prism-work-tools`) enroll in `@arnilo/prism-all` only; `@arnilo/prism-code` and `@arnilo/prism-sdk` stay lean. no Office package, 0.0.14 conversation/artifact services, internal auth DB, or Redis/SQS queue adapter ships. Clean protected-branch CI, signed commit/tag, npm authentication, OIDC attestation, protected live canaries, and actual publication remain operator/workflow prerequisites.
+
+```bash
+git diff --check
+npm ci
+npm run sdk:ready
+node scripts/benchmark-0.0.13.mjs
+node --test scripts/benchmark-0.0.13.test.mjs
+npm run release:check -- --version 0.0.13 --allow-untagged --report /tmp/prism-0.0.13-preflight.json
+git tag -s v0.0.13 -m "Prism 0.0.13"
+git verify-tag v0.0.13
+git push origin v0.0.13
+```
+
+The tag workflow publishes only through `npm run release:publish -- --version "${GITHUB_REF_NAME#v}" --resume --report release-artifacts/publish-report.json`. Re-run failed jobs for the same tag; registry state is the resumable journal. `npm audit signatures --json --include-attestations` and artifact checksums remain post-publish operator checks.
+
+#### Rollback limitations
+
+npm publication is immutable: partial publication is a resume case, and confirmed defects require deprecation plus a fixed version rather than rollback.
+
+Package set (41):
+
+```text
+@arnilo/prism
+@arnilo/prism-ag-ui
+@arnilo/prism-browser
+@arnilo/prism-coding-agent
+@arnilo/prism-coding-security
+@arnilo/prism-compaction-llm
+@arnilo/prism-compaction-observational-memory
+@arnilo/prism-credentials-node
+@arnilo/prism-evals
+@arnilo/prism-mcp
+@arnilo/prism-memory
+@arnilo/prism-model-router
+@arnilo/prism-observability-opentelemetry
+@arnilo/prism-policy
+@arnilo/prism-all
+@arnilo/prism-base
+@arnilo/prism-code
+@arnilo/prism-compaction
+@arnilo/prism-providers
+@arnilo/prism-sdk
+@arnilo/prism-provider-ai-sdk
+@arnilo/prism-provider-anthropic
+@arnilo/prism-provider-azure
+@arnilo/prism-provider-bedrock
+@arnilo/prism-provider-google
+@arnilo/prism-provider-kimi
+@arnilo/prism-provider-neuralwatt
+@arnilo/prism-provider-openai
+@arnilo/prism-provider-opencode-go
+@arnilo/prism-provider-openrouter
+@arnilo/prism-provider-vertex
+@arnilo/prism-provider-zai
+@arnilo/prism-rag
+@arnilo/prism-server
+@arnilo/prism-session-store-postgres
+@arnilo/prism-session-store-sqlite
+@arnilo/prism-supervisor
+@arnilo/prism-tool-validator-json-schema
+@arnilo/prism-web-tools
+@arnilo/prism-work-tools
+@arnilo/prism-workflows
+```
+
 ### 0.0.12 publish handoff
 
 **Decision: GO after operator prerequisites below.** Phase 7 coding-harness interoperability ships the optional `@arnilo/prism-ag-ui` root/`./acp` adapter, shared durable resume stream, coding compaction preset, and provider-authorized OAuth boundary. The exact 0.0.12 graph has 35 manifests. `@arnilo/prism-ag-ui` is included by `@arnilo/prism-all` only; `@arnilo/prism-code` and `@arnilo/prism-sdk` remain free of AG-UI/ACP dependencies. no Office package, 0.0.13 conversations/artifacts/enterprise identity APIs, or Anthropic/Gemini subscription OAuth adapter ships. Clean protected-branch CI, signed commit/tag, npm authentication, OIDC attestation, protected live provider/Docker/Playwright/PostgreSQL/keychain gates, and actual publication remain operator/workflow prerequisites.
@@ -531,8 +603,8 @@ npm publication is not transactional and published versions are immutable. Parti
 
 ## Extension and configuration notes
 
-- **Required `@arnilo/prism` peer.** Every first-party code package declares a non-optional `@arnilo/prism@0.0.12` peer (`peerDependenciesMeta` must not mark `@arnilo/prism` optional; other peers such as `playwright-core` may be optional). The range stays pinned to `0.0.12` for the current 0.x release and will widen to `^1.0.0` at the 1.x stable release. Inside the workspace each package also declares `"@arnilo/prism": "file:../.."` in `devDependencies` so `npm install` resolves the peer locally; that devDependency is stripped from consumer installs and is not a runtime dependency.
-- **Public access.** All 35 manifests (29 code packages + 6 family/profile packages) declare `"publishConfig": { "access": "public" }`; the publisher also passes `--access public` explicitly because scoped packages otherwise default to restricted on first publish.
+- **Required `@arnilo/prism` peer.** Every first-party code package declares a non-optional `@arnilo/prism@0.0.13` peer (`peerDependenciesMeta` must not mark `@arnilo/prism` optional; other peers such as `playwright-core` may be optional). The range stays pinned to `0.0.13` for the current 0.x release and will widen to `^1.0.0` at the 1.x stable release. Inside the workspace each package also declares `"@arnilo/prism": "file:../.."` in `devDependencies` so `npm install` resolves the peer locally; that devDependency is stripped from consumer installs and is not a runtime dependency.
+- **Public access.** All 41 manifests (35 code packages + 6 family/profile packages) declare `"publishConfig": { "access": "public" }`; the publisher also passes `--access public` explicitly because scoped packages otherwise default to restricted on first publish.
 - **Map retention knob.** Source maps are emitted locally but stripped from tarballs by `!dist/**/*.map`. Removing that `files` negation ships maps in releases (larger tarballs, better consumer stack traces).
 - **Release workflow.** `.github/workflows/release.yml` has six jobs. `verify` runs network-free SDK readiness on Node 24; `node20-compat` builds/imports every public root `exports` default target on Node 20 for declared `engines.node >=20` (docs examples need Node >=22.6 native TypeScript stripping); `postgres-integration` uses `pgvector/pgvector:pg16`; `supply-chain` runs high-severity audit, SPDX/license policy, and tracked-source secret scanning; and tag-only `codeql-release` runs SAST. Tag-only `publish` needs all five gates, preserves clean exact-tag/version/topological publication, and alone receives `NPM_TOKEN`, `id-token: write`, and `attestations: write`. Before npm publish it packs all current tarballs, generates checksums plus SPDX, scans unpacked public artifacts, creates GitHub attestations for tarballs and SBOM, then retains artifacts for 30 days. Registry state remains the resumable journal. Local `npm run release:dry-run` remains network-free SDK readiness; local PostgreSQL coverage is `PRISM_TEST_POSTGRES_URL=... npm run test:postgres`.
 - **Adding a package.** New workspace packages are picked up automatically by `npm run build --workspaces`, `npm test --workspaces`, `npm run pack:dry-run`, the packaging guard (`src/__tests__/packaging.test.ts`), and the install-smoke test (`src/__tests__/install-smoke.test.ts`) via the workspace glob; add the package to both tests' config arrays for explicit per-package assertions.