@arnilo/prism 0.0.14 → 0.0.16

package/docs/review-coverage-2026-07-22-phase-7.md

@@ -1,173 +0,0 @@
-# Review coverage — 2026-07-22 Phase 7
-
-Working evidence for Plan 075 Task 0. Freezes Phase 7 / Release **0.0.12** scope, protocol revisions, primitive ownership, finite limits, OAuth eligibility, threats, tests, docs, and release gates before implementation.
-
-**Evidence frozen:** 2026-07-22. **Prism source:** `f9630a9bd12f299fdf473640e3869eea050b786f`. **Release target:** 0.0.12. **Default test rule:** network-free fakes and protocol fixtures; provider live canaries remain explicit host/operator gates.
-
-## Status legend
-
-| Status | Meaning |
-| --- | --- |
-| `existing` | Current public contract covers the requirement. |
-| `extend` | Owning task adds a generic reusable contract to an existing seam. |
-| `new-package` | New optional workspace package; core remains protocol/UI-free. |
-| `compose` | Existing public primitives suffice; package-local wiring only. |
-| `out-of-scope` | Later phase or deliberately unsupported; must not land in 0.0.12. |
-
-## Frozen product decision
-
-0.0.12 closes **coding-harness P2 interoperability** only: one optional AG-UI package with a stable ACP sibling, one generic streamed durable-resume seam, and a thin coding-focused LLM compaction preset.
-
-**Not in 0.0.12** (do not implement here):
-
-| Deferred or rejected item | Owner / reason |
-| --- | --- |
-| Conversation storage/service, artifacts API, personal-agent UX, device sync | 0.0.13+ product scope. |
-| Enterprise identity, Azure/Bedrock/Vertex, work connectors, policy ledger | 0.0.13+ enterprise scope. |
-| Prism TUI, desktop app, browser UI framework, server route | Host-owned UI; adapter uses Web `Request`/`Response` only. |
-| ACP terminal, filesystem, editor, process, diff, or MCP implementation | Host/editor responsibility; stable sibling maps only shared message/tool/approval lifecycle. |
-| Protocol types or AG-UI/ACP dependencies in `@arnilo/prism` core | Optional package owns protocol dependencies. |
-| Second agent runtime, event daemon, polling worker, UI state database, replay cache | Reuse session/event/ledger/checkpoint seams; no background process. |
-| Raw event passthrough, client-defined executable tools, client state mutation, raw tool args/results, local paths | Default-deny projection boundary. |
-| Anthropic Claude Code or Google Gemini CLI subscription OAuth/token reuse | Current provider terms prohibit third-party subscription credential routing/piggybacking. |
-| Generic OAuth framework or credential-file/CLI scraping | Provider-local supported flow only; current core OAuth seams already suffice. |
-| Observational-memory coding runtime/profile | LLM preset is sufficient; do not add a second coding memory system. |
-
-## Frozen external revisions
-
-| Surface | Frozen reference | Compatibility decision |
-| --- | --- | --- |
-| Prism | [`f9630a9bd12f299fdf473640e3869eea050b786f`](../plans/075-release-0-0-12-coding-harness-interoperability.md) | Existing core/session/server/compaction contracts inventoried below. |
-| Node.js | Release support remains Node 20+ | Optional package uses Web `Request`/`Response`, `ReadableStream`, native abort, and existing bounded SSE patterns; no framework dependency. |
-| AG-UI | `@ag-ui/core` **0.0.57**; [Events](https://docs.ag-ui.com/concepts/events), [Interrupts](https://docs.ag-ui.com/concepts/interrupts), [Serialization](https://docs.ag-ui.com/concepts/serialization), [TypeScript schemas](https://github.com/ag-ui-protocol/ag-ui/tree/main/sdks/typescript/packages/core) | Pin the official schema package. Validate produced events with `EventSchemas`; close active message/tool sequences before `RUN_FINISHED` or `RUN_ERROR`. |
-| ACP | `@agentclientprotocol/sdk` **1.3.0** stable root; [overview](https://agentclientprotocol.com/protocol/overview), [tool calls](https://agentclientprotocol.com/protocol/tool-calls), [TypeScript SDK](https://agentclientprotocol.com/libraries/typescript) | Use stable `session/update` and `session/request_permission` contracts only. Exclude `./experimental/v2`. |
-| OpenAI Codex OAuth | Existing `packages/provider-openai/src/oauth.ts`; [OpenAI provider docs](providers/openai.md) | Existing RFC 7636 PKCE browser/device-code flow is retained, host-invoked, abortable, bounded, and redacted. |
-| Anthropic Claude Code auth/legal | [Authentication](https://docs.anthropic.com/en/docs/claude-code/authentication), [legal and compliance](https://docs.anthropic.com/en/docs/claude-code/legal-and-compliance) | No third-party Claude.ai subscription OAuth adapter: Anthropic directs third-party products to API keys or cloud providers. |
-| Gemini CLI auth/terms | [Authentication](https://github.com/google-gemini/gemini-cli/blob/main/docs/get-started/authentication.mdx), [FAQ](https://github.com/google-gemini/gemini-cli/blob/main/docs/resources/faq.md), [terms/privacy](https://github.com/google-gemini/gemini-cli/blob/main/docs/resources/tos-privacy.md) | No Gemini CLI OAuth adapter or token import: terms prohibit third-party software use of Gemini CLI OAuth; use API key or Vertex instead. |
-
-## Frozen package and API contract
-
-| Decision | Frozen choice |
-| --- | --- |
-| Package | New optional `@arnilo/prism-ag-ui`; it depends on `@arnilo/prism` and pinned protocol packages. `@arnilo/prism` remains dependency-free and protocol-free. |
-| Subpath | `@arnilo/prism-ag-ui/acp` is the only ACP export. It uses the stable ACP SDK root, never the experimental v2 subpath. |
-| Root exports | `createAgUiEventMapper`, `createAgUiHandler`, `createPersistenceAgUiReplay`, and package-local limits/projection types. |
-| ACP exports | `createAcpEventMapper`, `createPrismAcpAgent`. No terminal/filesystem/editor/process/MCP export. |
-| Generic core gap | Add `resumeAgentRunStream()` and `AgentRunLifecycle.resumeStream()`. Both reuse one private resume preparation/CAS path with existing `resumeAgentRun()`; no AG-UI/ACP type enters core. |
-| AG-UI run input | Parse official `RunAgentInput` before host capability resolution. Host rebinds `threadId`/`runId` to authorized session/run ownership; default input selection is final accepted user text only. |
-| AG-UI lifecycle | Map Prism lifecycle/message/tool events to official `RUN_*`, `TEXT_MESSAGE_*`, and `TOOL_CALL_*` schemas. Close open text/tool sequences before terminal events. Map durable suspension to `RUN_FINISHED` with `{ type: "interrupt", interrupts }`; map failure to one `RUN_ERROR`. |
-| Durable approval | Exact checkpoint `runId`, authorized ownership, interruption, and `expectedVersion` are required. AG-UI resume resolves every pending interrupt in one payload; ACP unknown/cancel/reject choices deny. No side effect is replayed after an ambiguous dispatched tool. |
-| Replay | `createPersistenceAgUiReplay` adapts ownership-scoped `ProductionPersistenceStore.queryEvents({ sessionId, runId, ... })`. It pages durable redacted rows, then attaches to a live bounded subscriber. Delivery is at-least-once across page/live boundary; stable event/message/tool IDs permit client deduplication. Terminal replay never invokes a provider or tool. |
-| Projection | Default deny: tool name/status only; no args, result, progress payload, raw event, local path, frontend tool, or arbitrary state. Host must explicitly provide redaction-safe projectors for any exposed value. |
-| ACP parity | Map assistant chunks, safe tool status, usage, errors, and durable permissions over same projection/limits/ownership contracts. ACP `session/update` does not create a second run runtime. |
-| Coding compaction | `createCodingCompactionStrategy()` lives in `@arnilo/prism-compaction-llm`, wraps `createLlmCompactionStrategy()`, enables existing file-operation retention, and adds coding instructions. It produces normal `kind: "compaction"` entries; raw history remains. |
-| Release graph | Task 8 adds one publishable package (34 → 35) and includes it only in `@arnilo/prism-all`, never `@arnilo/prism-code` or `@arnilo/prism-sdk`. |
-
-## Capability traceability matrix
-
-| Phase 7 roadmap criterion | Existing surface | Minimum gap | Status / owner | Required proof | Docs | Release gate |
-| --- | --- | --- | --- | --- | --- | --- |
-| Provider-authorized subscription OAuth behind existing seams | `OAuthProvider`, `refreshOAuthCredential`, Node OAuth store, OpenAI Codex PKCE/device flow | Support matrix and eligibility gate; no currently eligible Anthropic/Google flow | `compose` / Task 6 | provider registration absence; existing Codex OAuth tests | credential + provider pages | offline + provider-policy review |
-| AG-UI event mapping without core/UI coupling | Redacted ordered `AgentEvent`, session `stream()`/`subscribe()` | Optional mapper over official schemas and projection policy | `new-package` / Task 2 | schema/lifecycle/redaction/limit fixtures | `ag-ui.md`, agent events | offline package test |
-| Host TUI/desktop run, approval, resume, reconnect | Durable run state, `AgentRunLifecycle`, `AgentEventRecord`, `queryEvents`, server SSE limits | Generic streamed durable resume + handler/replay adapter | `extend` / Task 1; `new-package` / Task 3 | CAS/ownership/reconnect/no-rerun/overflow fixtures | runtime, runs, server, security | offline integration |
-| ACP parity where event/tool/approval contracts overlap | Same agent event, interruption, and lifecycle seams | Stable sibling mapper/agent over shared policy | `new-package` / Task 4 | stable SDK type/permission/subpath packed-consumer tests | AG-UI, A2A, security | offline package test |
-| Coding-aware compaction retaining path/diff/check/plan signals | LLM `CompactionStrategy`, file-operation collection, coding checkpoints/check summaries | Thin LLM preset and fixture | `compose` / Task 5 | prompt/redaction/repeated-compaction/conformance fixtures | compaction + coding docs | offline package test |
-| Finite protocol/reconnect/compaction behavior | Server/SSE, subscriber, persistence, compaction limits | Package-local resolved limits plus benchmark | `new-package` / Tasks 2–3; `compose` / Task 5; Task 8 | hostile-input and benchmark schema/budget tests | performance + AG-UI docs | benchmark + `sdk:ready` |
-| No product/UI/enterprise scope creep | Host-owned UI/product boundaries | Explicit negative tests and release guard | `compose` / Tasks 0, 8 | source/package/export scope assertions | review + migration docs | pack/install + diff review |
-
-## Primitive and caller inventory
-
-| Primitive / symbol | Existing contract and callers | Phase 7 disposition |
-| --- | --- | --- |
-| `AgentEvent`, `redactAgentEvent`, `AgentSession.stream()` / `subscribe()` | Core redacted ordered live events; subscriber default queue 1024 and close/drop policies | Reuse. Adapter owns protocol event correlation and projected payload. |
-| `AgentEventRecord`, `RunLedger`, `ProductionPersistenceStore.queryEvents()` | Redacted durable event rows; SQLite/Postgres persistence queries | Reuse for replay only after host ownership binding. Add no event store/cache. |
-| `resumeAgentRun`, `AgentRunLifecycle.resume()` | CAS, exact ownership/ref/session/fingerprint/revision, denial, dispatched-tool ambiguity protection | **Extend once** with streamed resume wrappers used by AG-UI and ACP. |
-| `StoredAgentRunState`, `AgentRunInterruption`, checkpoint store | Redacted versioned pre-side-effect durable state; 256 KiB default / 1 MiB hard | Reuse. Adapter exposes only public interruption/status/version. |
-| `PrismServerLimits` and server SSE handler | Existing Web request/response, abort, bounded stream/event/queue/time controls | Reuse values/pattern; AG-UI remains package-local and does not add server route. |
-| `SecretRedactor`, credential resolver/OAuth store | Exact known-secret redaction; host-owned late-bound credentials/storage | Reuse. Project before transport/persistence; do not scan CLI credentials. |
-| `OAuthProvider`, `refreshOAuthCredential`, `createOAuthCredentialStoreAdapter` | Generic login/refresh/store seam, OpenAI provider implementation | Reuse unchanged. Future provider OAuth stays provider-local and eligibility-gated. |
-| `CompactionStrategy`, LLM preparation/file operations | Standard append semantics; LLM tracks read/modified files and caps summary/provider output | Reuse. Implement preset, not a memory runtime. |
-| Observational-memory strategy | Optional projection/ledger/fold rendering workers | Leave unchanged; no coding profile needed. |
-| Coding checkpoint and named check summaries | Bounded plan/todo/artifact/check references and fixed command checks | Supply coding signals to LLM compaction fixture/instructions; do not expose raw checkpoint/path data by default. |
-
-### Primitive decision
-
-**Authorized generic core extension:** `resumeAgentRunStream()` and `AgentRunLifecycle.resumeStream()` only. The implementation must share resume validation/CAS/dispatch preparation with `resumeAgentRun()` and use the existing bounded event subscriber. Both AG-UI and ACP consume it.
-
-**Authorized new package:** `@arnilo/prism-ag-ui`, including its `./acp` sibling and package-local mapper, handler, replay, SSE, projection, and limit code.
-
-**Authorized package-local composition:** `createCodingCompactionStrategy()` in `@arnilo/prism-compaction-llm`; provider support documentation/negative guards.
-
-**Rejected:** protocol types in core; UI framework/server route; new runtime/store/worker; generic OAuth abstraction; observational-memory coding runtime; client-controlled tools/state; raw event passthrough; Claude/Gemini CLI credential reuse.
-
-## Frozen finite limits and charging points
-
-**Rule:** adapter validates every incoming selector/body/count before resolving a session, invoking resume, querying replay, or subscribing. It checks every outgoing projected field before enqueue/serialization. Task 2/3 must implement these exact defaults and hard caps; they may tighten a default but must not raise a hard cap without updating this page, tests, and docs.
-
-| Resource | Default / hard cap | Charge/check point | Failure/cleanup owner |
-| --- | ---: | --- | --- |
-| Request body | 64 KiB / 1 MiB | Before AG-UI parse | Task 3 returns bounded client error. |
-| Input messages | 128 / 1,024 | Before host input resolver | Task 3 rejects; never silently truncates user intent. |
-| Input text or one content value | 64 KiB / 1 MiB | Before message projection/host resolver | Task 3 rejects. |
-| Frontend tools / frontend state mutation | 0 / 0 | Before session/run lookup | Task 3 rejects unless a later scope revises this freeze. |
-| Replay cursor | 4 KiB / 16 KiB | Before durable query | Task 3 rejects malformed/oversized cursor. |
-| Replay page rows | 100 / 500 | Before `queryEvents` | Task 3 pages; never full-scans. |
-| Outbound projected event | 64 KiB / 1 MiB | Before SSE/ACP enqueue | Tasks 2–4 close/fail safely; do not split JSON. |
-| Outbound text, tool display, state snapshot | 64 KiB / 1 MiB | Before schema serialization | Tasks 2–4 omit/truncate only with explicit bounded marker. |
-| Tool args/results/progress payload | 0 / 0 by default | Projection | Tasks 2–4 omit. Any later host projector remains inside outbound-event cap. |
-| Error detail | 8 KiB / 64 KiB | Before protocol error event | Tasks 2–4 redact and truncate. |
-| Stream events / aggregate bytes | 10,000 / 100,000; 10 MiB / 64 MiB | Before each enqueue | Task 3 closes stream with bounded terminal error. |
-| Subscriber queue | 128 / 4,096 | Existing `SubscribeOptions` passed by adapter | Tasks 1/3 use `overflow: "close"`; no hidden queue. |
-| Request/run wall time | 120 s / 30 min | Adapter-owned abort signal | Task 3 aborts/cleans up; background completion is explicit host policy only. |
-| Coding compaction output | reuse 16,384 / 131,072 tokens; error 1 KiB / 8 KiB | Existing LLM strategy | Task 5 adds no provider call or unbounded parser. |
-
-The request/event/aggregate/queue/time values intentionally match existing `@arnilo/prism-server` defaults and hard caps. Replay page and cursor values reuse bounded persistence/MCP conventions. The `0 / 0` tool/state rows are a capability denial, not a zero-length serialization limit.
-
-**Forbidden:** unbounded replay, polling, background queue, raw tool payload forwarding, arbitrary client state patch, local path disclosure, auto OAuth refresh timer, CLI credential scan, second compaction call, or hard-cap increase.
-
-## OAuth eligibility matrix
-
-| Provider surface | 0.0.12 status | Allowed auth | Explicitly prohibited / absent | Future eligibility evidence |
-| --- | --- | --- | --- | --- |
-| OpenAI Codex | supported existing flow | `createOpenAICodexOAuthProvider`; host-invoked browser/device code, PKCE, abort, refresh/store seam | automatic login, ambient credential discovery | Existing protocol/abort/refresh/redaction/store tests remain required. |
-| Anthropic provider | API key only | Host-supplied `apiKey` | `createAnthropicSubscriptionOAuthProvider`, Claude Code credential file/token import, Claude.ai subscription routing | Provider-published third-party authorization plus exact flow/scopes, terms review, network-free fixtures. |
-| Google provider | API key only | Host-supplied `apiKey`; Vertex remains later enterprise scope | `createGeminiCliOAuthProvider`, Gemini CLI credential/token import | Provider-published third-party authorization plus exact flow/scopes, terms review, network-free fixtures. |
-
-A future provider-local subscription adapter requires all of: explicit provider permission for third-party products; exact authorize/token/refresh documentation; abort and expiry behavior; PKCE/state where required; bounded request/response handling; token/code/error redaction; durable store round trip; no import/setup network; protocol conformance; legal review. Until then absence is correct behavior, not a missing stub.
-
-## Threat and authority matrix
-
-| Boundary | Trusted authority | Untrusted input | Mandatory control | Default / unsupported |
-| --- | --- | --- | --- | --- |
-| AG-UI thread/run IDs | Host `authorize` and session/run resolver | Client `threadId`, `runId`, cursor | Rebind to exact ownership/session/run; validate checkpoint version | Cross-owner replay/resume unsupported. |
-| Resume/approval | Durable checkpoint + host policy | Resume payload/permission result | Exact run/interruption/version; all open interrupts addressed; CAS before side effect | Partial, stale, unknown, or ambiguous resumes fail. |
-| Event/replay payload | Runtime redactor + host projection | Messages, tool events, ledger rows | Redact then allow-list/project/cap before transport | Raw events/paths/args/results/state unsupported. |
-| Client tools/state | Host tool registry/session state | `RunAgentInput.tools`, state, custom fields | Reject before agent lookup | Client cannot grant capabilities or mutate backend state. |
-| ACP permissions | Host permission policy + checkpoint | ACP option/outcome | Only known allow-once/reject selection maps to exact resume; unknown/cancel denies | Allow-always persistence is not added in 0.0.12. |
-| OAuth | Provider terms + host credential ownership | OAuth code/token/CLI credential files | Explicit authorized flow, bounded calls, redaction, host store | Claude/Gemini CLI subscription credential use unsupported. |
-| Compaction | Existing LLM redactor/limits/provider | Paths, diffs, command/check output, previous summary | Existing serialization/redaction/caps; retain signal summary only | Full diff/transcript retention and second memory runtime unsupported. |
-
-## Validation matrix for Task 0
-
-| Check | Frozen assertion |
-| --- | --- |
-| Traceability | Every Phase 7 roadmap criterion has one primary Task 1–8 owner; 0.0.13+ conversations/artifacts/enterprise identity have none. |
-| Protocol revisions | `@ag-ui/core@0.0.57`; `@agentclientprotocol/sdk@1.3.0` stable root; official AG-UI schemas validate mapped events. |
-| Primitive reuse | Only streamed durable resume is a generic core extension with two consumers; all AG-UI/ACP types stay optional-package-local. |
-| Lifecycle | `RUN_FINISHED` closes text/tool lifecycle; durable suspension is interrupt outcome; terminal replay never reruns work. |
-| Finite resources | All request/event/page/queue/text/tool/state/error/time caps above are enforced; no polling/daemon/unbounded scan. |
-| Security | Ownership before data, exact-version approvals, default-deny projection, redaction before transport, and no frontend capability grant. |
-| OAuth policy | OpenAI Codex remains only subscription OAuth; Anthropic/Google register API key only and expose no forbidden factory. |
-| Coding compaction | One LLM preset reuses file operations/standard entries/redaction/caps; raw session history stays intact. |
-
-## Documentation and release ownership
-
-- Task 0: this evidence page, `docs/index.md`, and `docs.test.ts` regression guard.
-- Task 1: generic streamed durable resume; runtime/events/public-contract docs.
-- Tasks 2–4: optional AG-UI/ACP mapper, handler/replay, and stable sibling; AG-UI/security/A2A docs.
-- Task 5: coding LLM compaction preset and docs.
-- Task 6: OAuth support-matrix docs and absence guards.
-- Task 7: canonical docs, examples, migration, package metadata/navigation.
-- Task 8: 0.0.12 graph, benchmark, pack/install, supply-chain, dry-run publish, and roadmap completion evidence.
-
-No public implementation API changes land in Task 0. This page, `roadmap.md` Phase 7, and Plan 075 are authoritative until implementation; later tasks may tighten defaults but cannot widen scope, raise hard caps, add protocol types to core, add a background worker/store, or enable unsupported subscription OAuth without updating this evidence, tests, docs, and plan.

package/docs/review-coverage-2026-07-23-phase-8.md

@@ -1,245 +0,0 @@
-# Review coverage — 2026-07-23 Phase 8
-
-Working evidence for Plan 076 Task 0. Freezes Phase 8 / Release **0.0.13** scope, package names, primitive ownership, finite limits, external revisions, threats, tests, docs, and release gates before implementation.
-
-**Evidence frozen:** 2026-07-23. **Prism source:** `5b21f78cde6c4f3c9e7760f153c4bd8670d104e4`. **Release target:** 0.0.13. **Default test rule:** network-free fakes, CLI fake executables, and protocol fixtures; cloud/provider/tenant live canaries remain explicit host/operator gates.
-
-## Status legend
-
-| Status | Meaning |
-| --- | --- |
-| `existing` | Current public contract covers the requirement. |
-| `extend` | Owning task adds a generic reusable contract to an existing seam. |
-| `new-package` | New optional workspace package; core stays free of product/cloud/CLI SDKs. |
-| `compose` | Existing public primitives suffice; package-local wiring only. |
-| `out-of-scope` | Later phase or deliberately unsupported; must not land in 0.0.13. |
-
-## Frozen product decision
-
-0.0.13 closes **enterprise identity, policy/audit, model governance, enterprise-cloud providers, server deployment seams, persistence lifecycle hooks, and least-privilege Microsoft 365 / Google Workspace connectors** only.
-
-**Not in 0.0.13** (do not implement here):
-
-| Deferred or rejected item | Owner / reason |
-| --- | --- |
-| Conversation storage/service, artifact co-work review API, personal memory consent UX, channel/device adapters | 0.0.14+ product scope. |
-| Studio, hosted cloud, managed observability, visual workflow editor, broad Slack/Teams chat catalog | Demand-gated 0.1.x control-plane / product layer. |
-| Local Office `.docx`/`.xlsx`/`.pptx` executable, SDK, wrapper, protocol, or runtime package | Product boundary; hosts may use external skills/tools. |
-| User authentication database or identity provider inside Prism | Host/application owns auth; Prism accepts host-verified identity only. |
-| Mandatory global policy engine, KMS, WORM store, queue broker, or container orchestrator | Host-replaceable seams; at most one reference adapter per seam. |
-| Model-controlled M365/GWS command strings, generic Graph/Discovery requests, CLI login, tenant-admin commands, debug/telemetry dumps, credential-store access | Injection / over-privilege / secret-leakage risk. |
-| Advertising Teams/Planner/To Do or Docs/Sheets/Slides as universal parity | Capability-gated only; Outlook/Gmail/calendar/files/tasks are the 0.0.13 common denominator. |
-| Folding Azure/Bedrock/Vertex into consumer Anthropic/Google packages | Enterprise workload-identity and region/private-endpoint semantics differ. |
-| Redis/SQS/other queue adapters by default | **Task 5 deferred:** no measured Postgres polling bottleneck recorded; keep coordinator poll path. |
-| Putting work connectors or enterprise-cloud SDKs into `@arnilo/prism-code` / `@arnilo/prism-sdk` | Profiles stay lean; enroll only in `@arnilo/prism-all` unless size/adoption review revises this freeze. |
-
-## Frozen external revisions
-
-| Surface | Frozen reference | Compatibility decision |
-| --- | --- | --- |
-| Prism | [`5b21f78cde6c4f3c9e7760f153c4bd8670d104e4`](../plans/076-release-0-0-13-enterprise-identity-policy-governance-work-connectors.md) | Existing ownership/credential/permission/provider/server/persistence/lease seams inventoried below. |
-| Node.js | Release support remains Node 20+ | Optional packages use Web `Request`/`Response`, `execFile`, abort, and existing bounded patterns; no framework dependency. |
-| Microsoft Entra Agent ID | [Governing Agent Identities](https://learn.microsoft.com/en-us/entra/id-governance/agent-id-governance-overview); [What are agent identities?](https://learn.microsoft.com/en-us/entra/agent-id/what-are-agent-identities) | Informs `Principal`/`AgentIdentity` sponsor/owner/delegation/scope/expiry vocabulary. Prism does **not** embed Entra; hosts verify tokens/claims and supply identity context. |
-| CLI for Microsoft 365 | [CLI for Microsoft 365 docs](https://pnp.github.io/cli-microsoft365/); npm `@pnp/cli-microsoft365`; GitHub `pnp/cli-microsoft365` | Host-installed execution adapter only. Prism ships hard-coded typed `execFile` argument templates; never `m365 login`, setup, tenant-admin, or model-built argv. |
-| Google Workspace CLI | [googleworkspace/cli](https://github.com/googleworkspace/cli); npm `@googleworkspace/cli` (`gws`) | Host-installed execution adapter only. Discovery-dynamic surface is **not** exposed to models; Prism allow-lists typed operations, forces JSON/NDJSON parse bounds, disables interactive auth/debug from Prism. |
-| Azure OpenAI / Foundry Entra auth | [Entra ID authentication for Azure OpenAI / Foundry Models](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/managed-identity) | Host supplies late-bound workload credential callback (Managed Identity / token provider). No static keys in fixtures. |
-| Azure private network | [Configure virtual networks for Foundry Tools](https://learn.microsoft.com/en-us/azure/ai-services/cognitive-services-virtual-networks) | Preserve custom subdomain / private-endpoint / VNet semantics on package config; do not rewrite endpoints. |
-| Amazon Bedrock IAM | [Identity and access management for Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html) | Host supplies AWS credential callback (IRSA / instance role / assumed role). Package never embeds long-lived keys. |
-| Amazon Bedrock PrivateLink | [Interface VPC endpoints for Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html) | Preserve region + optional VPC endpoint override; fail closed if residency policy rejects region. |
-| Google Vertex / ADC | [Authenticate to Vertex AI (generative)](https://cloud.google.com/vertex-ai/generative-ai/docs/start/authenticate); [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials) | Host supplies ADC/workload credential callback. Separate from `@arnilo/prism-provider-google` consumer API-key package. |
-| OpenRouter routing metadata | Existing `openRouterRouting` compat fields; [OpenRouter provider docs](providers/openrouter.md) | Router may honor metadata only when policy/allow-list/residency permit; never bypass governance. |
-
-## Frozen package and API contract
-
-| Decision | Frozen choice |
-| --- | --- |
-| Core identity | Add `Principal`, `AgentIdentity`, `IdentityVerifier`, `assertIdentityActive`, `narrowIdentity` (names may alias but semantics frozen). Extend `OwnershipScope`; no identity database in core. |
-| Policy package | New optional `@arnilo/prism-policy` with evaluator + decision ledger + cursor export; redacted/evidence-ref payloads only. |
-| Model router | New optional `@arnilo/prism-model-router` as `ProviderResolver`-compatible facade over allow-list/residency/budget/rate/circuit/fallback. |
-| Enterprise cloud providers | New optional `@arnilo/prism-provider-azure`, `@arnilo/prism-provider-bedrock`, `@arnilo/prism-provider-vertex`. Keep `@arnilo/prism-provider-anthropic` and `@arnilo/prism-provider-google` separate. |
-| Work connectors | New optional `@arnilo/prism-work-tools` with subpaths `./microsoft365` and `./google-workspace` only. |
-| Server | Extend `@arnilo/prism-server` with optional health/readiness, host auth/rate-limit adapter hooks, graceful drain, event replay helpers, and worker/coordinator deployment contracts over existing leases. |
-| Persistence lifecycle | Extend existing `RetentionPolicy` / production persistence seams with apply/delete/legal-hold/export hooks, optional host KMS/envelope callback, tenant quotas, and extension allow-list/signature policy. |
-| Idempotency | Add a narrow generic side-effect `IdempotencyStore` (or equivalent) consumed by both connector subpaths; reuse session `idempotencyKey` patterns for inspiration, not as the connector store. |
-| Profile manifests | New packages enroll in `@arnilo/prism-all` only. `@arnilo/prism-code` and `@arnilo/prism-sdk` stay free of work connectors and enterprise-cloud SDKs. |
-| Release graph | Task 10 versions the graph to **0.0.13** and adds six publishable packages (**35 → 41** manifests: root + 40 under `packages/`). |
-| Queues | Absent by default. Task 5 may add a queue adapter only with measured Postgres polling/load evidence recorded in Plan 076 Compromises/Further Actions and this page. |
-
-### Frozen package names and subpaths
-
-```text
-@arnilo/prism-policy
-@arnilo/prism-model-router
-@arnilo/prism-provider-azure
-@arnilo/prism-provider-bedrock
-@arnilo/prism-provider-vertex
-@arnilo/prism-work-tools
-@arnilo/prism-work-tools/microsoft365
-@arnilo/prism-work-tools/google-workspace
-```
-
-## Capability traceability matrix
-
-| Phase 8 roadmap criterion | Existing surface | Minimum gap | Status / owner | Required proof | Docs | Release gate |
-| --- | --- | --- | --- | --- | --- | --- |
-| Authenticated `Principal` / `AgentIdentity` with tenant, sponsor/owner, delegated actor, scopes, credential refs, issued/expiry, revocation; immutable propagation | `OwnershipScope`, server `authorize`→ownership, run/tool/workflow ownership fields, OTel attributes | Core identity types + verifier seam + propagation asserts | `extend` / Task 1 | expired/revoked/wrong-tenant/widen-scope denial; MCP/A2A/server/tool/workflow/telemetry carry refs without secrets | `agent-identity.md`, host-security, public-contracts | offline core + package tests |
-| Policy-decision ledger allow/deny/modify/approval + WORM export without unrestricted payloads | `GuardrailDecision`, `PermissionPolicy`, tool_approval interruption, run feedback immutability, redaction | Optional policy package + redacted store/export | `new-package` / Task 2 | attribution, version mismatch fail-closed, export pagination, payload rejection | `policy-and-audit.md` | offline package test |
-| Model governance allow-list/residency/routing/fallback/circuit/retry/budget/rate + diagnostics | `ProviderResolver`, `ProviderRequestPolicy`, OpenRouter routing metadata, run budgets | Optional model-router facade + diagnostics | `new-package` / Task 3 | deny-before-call matrix; diagnostic redaction; OpenRouter gated by policy | `model-routing.md`, openrouter | offline package test |
-| Azure / Bedrock / Vertex enterprise adapters with workload identity + region/private-endpoint | Provider package conformance, `CredentialResolver`, OpenAI-compatible patterns where applicable | Three provider packages + host credential callbacks | `new-package` / Task 4 | MI/IRSA/ADC mocks; region preserved; consumer Anthropic/Google unchanged | `providers/azure.md`, `bedrock.md`, `vertex.md` | offline + gated live canaries |
-| Server health/readiness, auth/rate-limit adapters, drain, replay, worker/coordinator | `createPrismHandler`, authorize/ownership, leases/fencing, SSE/resume, `queryEvents` | Optional health/drain/replay/deployment helpers | `extend` / Task 5 | multi-process failover/drain/replay; unauthorized detail denial; queues absent by default | `server.md`, performance | offline multi-process fixtures |
-| M365 + GWS identity-scoped tools (mail/calendar/files/tasks); Teams/Planner/To Do and Docs/Sheets/Slides capability-gated | `ToolDefinition`, tool approval, web-tools subpath pattern, coding-security `execFile` bounds | `@arnilo/prism-work-tools` subpaths + typed templates | `new-package` / Task 7 (M365), Task 8 (GWS) | fake CLI argv injection/schema/JSON bounds; capability mismatch; least scopes | `work-tools.md`, `work-connectors.md` | offline package test + gated tenant canaries |
-| Draft-then-approve mutations; idempotent retries via operation/draft/resource IDs + concurrency tokens | tool_approval interruption, session `idempotencyKey`, checkpoints | Connector draft store + side-effect idempotency store | `extend` + `new-package` / Task 7, Task 8 | duplicate retry no-op; stale ETag fail; send only after approval | work-tools docs | offline fixtures |
-| Hard-coded CLI `execFile` templates only; no model command/login/admin/debug/credential access | coding-security sandbox `execFile`, credential redaction | Package-local template registry + isolated config dirs | `compose` / Task 7, Task 8 | forbidden argv/env denial; credentials never in argv/model context | work-connectors, credential-storage, host-security | offline hostile argv tests |
-| Retention/deletion/legal-hold/export, optional KMS/envelope, extension allow-list/signature, tenant quotas | `RetentionPolicy`, feedback delete, credentials-node envelope crypto, extension kernel trust | Persistence lifecycle + extension signature/allow-list + quota hooks | `extend` / Task 6 | hold blocks delete; unsigned extension deny; quota contention; key rotation mock | database-persistence, host-security, extensions | offline store + extension tests |
-| Bounded performance for identity/policy/router/connectors/deployment | Existing server/web-tools/persistence limits | Frozen caps below + benchmarks | `compose` / Tasks 1–8, 10 | hostile overflow; network-free benchmarks | performance, review page | `sdk:ready` + benchmark |
-| Narrow optional contracts; no mandatory control plane | Product boundaries; profile packaging | Package/profile guards | `compose` / Tasks 0, 9–10 | pack graph 41; prism-code/sdk free of connectors/cloud SDKs | release-and-install, migration | pack/install + diff review |
-| Security fail-closed: verified identity, narrow delegation, late-bound creds, least privilege, approvals, share/attachment/residency policy | host-security checklist, redaction, permission/trust | Threat matrix enforcement in owning tasks | `compose` / all tasks | negative tests per threat row | host-security + task docs | security review before publish |
-
-## Primitive and caller inventory
-
-| Primitive / symbol | Existing contract and callers | Phase 8 disposition |
-| --- | --- | --- |
-| `OwnershipScope` (`tenantId`/`accountId`/`userId`) | Persistence records, tools, agents, server authorize result, workflows, leases | **Extend** with authenticated identity context that still projects to ownership; never replace ownership checks. |
-| `CredentialResolver` / OAuth store / credentials-node envelope | Late-bound secrets; encrypted vault/keychain | Reuse. Enterprise cloud + connectors resolve via host callbacks; secrets never in CLI argv or model context. |
-| `PermissionPolicy` / `TrustPolicy` | Tool/extension/resource checks | Reuse at connector and extension boundaries; optional policy package may record decisions. |
-| `ProviderRequestPolicy` / `ProviderResolver` | Provider request mutation and model→provider resolution | Reuse. Model-router wraps resolver; request policies remain chainable. |
-| Guardrails + `tool_approval` interruption | `createSecureAgent`, agent loop durable suspend | Reuse for connector mutation approvals; do not invent a second approval runtime. |
-| Run ledger / feedback / `AgentEventRecord` | Durable redacted run evidence | Reuse for attributable diagnostics refs; policy ledger stays separate schema. |
-| Checkpoints / leases | Durable interruption and multi-process fencing | Reuse for drain/worker/coordinator and connector draft durability where applicable. |
-| `RetentionPolicy` (+ query on production stores) | Stored policy rows; limited apply semantics today | **Extend** with apply/delete/legal-hold/export/quota hooks. |
-| Server `authorize` → ownership | `@arnilo/prism-server` every route | **Extend** optional health/rate-limit/drain/replay; ownership still only from authorize. |
-| OTel / observability package | Span/metric export | Propagate identity refs as redacted attributes; no secret material. |
-| Supervisor / A2A / MCP | Delegation and remote tool bridges | Accept verified identity; refuse cross-tenant widening. |
-| coding-security `execFile` / sandbox bounds | Sandbox FS/shell | Pattern reuse for CLI adapters (typed args, caps, kill); not a coding-workspace dependency for work-tools. |
-| web-tools subpath packaging | `@arnilo/prism-web-tools/{brave,exa,firecrawl}` | Copy packaging pattern for work-tools subpaths. |
-| Session `idempotencyKey` | Session append dedup | Inspiration only; connectors need a side-effect idempotency store keyed by identity+operation. |
-
-### Primitive decision
-
-**Authorized generic core extensions (each needs ≥2 consumers):**
-
-1. Authenticated identity contracts + attach/assert/narrow helpers (consumers: server, tools, workflows, MCP, A2A, telemetry, connectors, providers/router).
-2. Side-effect `IdempotencyStore` contract (consumers: M365 + GWS; optional future connectors).
-3. Retention/legal-hold/export/quota persistence hooks (consumers: sqlite + postgres production stores; memory may unsupported/explicit).
-4. Extension allow-list / signature policy seam on the extension kernel (consumers: host loaders + contribution discovery).
-
-**Authorized new packages:** `@arnilo/prism-policy`, `@arnilo/prism-model-router`, `@arnilo/prism-provider-azure`, `@arnilo/prism-provider-bedrock`, `@arnilo/prism-provider-vertex`, `@arnilo/prism-work-tools` (`./microsoft365`, `./google-workspace`).
-
-**Authorized package/server extensions:** health/drain/replay/deployment helpers on `@arnilo/prism-server`; optional KMS/envelope callback wiring via credentials-node patterns without forcing cloud KMS SDKs into core.
-
-**Rejected:** auth DB; control plane; Office packages; model-controlled CLI; merging enterprise cloud into consumer Anthropic/Google; mandatory queues; putting connectors/cloud SDKs into `prism-code`/`prism-sdk`; protocol/UI frameworks in core.
-
-## Frozen finite limits and charging points
-
-**Rule:** validate every untrusted field before persistence, provider call, CLI spawn, or export enqueue. Owning tasks may tighten defaults but must not raise hard caps without updating this page, tests, and docs.
-
-### Identity / policy
-
-| Resource | Default / hard cap | Charge/check point | Failure/cleanup owner |
-| --- | ---: | --- | --- |
-| Scopes per identity | 64 / 256 | Before verify/narrow/attach | Task 1 rejects. |
-| One scope string | 128 B / 512 B | Before verify/narrow | Task 1 rejects. |
-| Identity metadata map | 4 KiB / 16 KiB | Before persistence/telemetry attach | Task 1 omits/rejects; never stores secrets. |
-| Credential reference string | 256 B / 2 KiB | Before attach | Task 1 rejects; never expands to secret. |
-| Policy decision record | 8 KiB / 64 KiB | Before ledger append | Task 2 rejects unrestricted payloads. |
-| Evidence ref / reason | 1 KiB / 8 KiB each | Before append/export | Task 2 truncates with marker or rejects. |
-| Policy export page | 100 / 500 | Before export cursor read | Task 2 pages; no full scan. |
-| Identity/policy CPU path | sync O(fields); 0 network in core helpers | Before tool/provider work | Tasks 1–2 fail closed locally. |
-
-### Model router
-
-| Resource | Default / hard cap | Charge/check point | Failure/cleanup owner |
-| --- | ---: | --- | --- |
-| Resolve attempts (including fallbacks) | 3 / 8 | Before each provider resolve | Task 3 stops; emits attributable deny. |
-| Concurrent circuit keys retained | 1,024 / 16,384 | Before circuit state insert | Task 3 evicts oldest or rejects new key. |
-| Diagnostics record | 8 KiB / 64 KiB | Before audit/telemetry | Task 3 redacts; no secrets/raw prompts. |
-| Token/cost budget fields | finite non-negative; host units | Before provider call | Task 3 denies when exhausted. |
-| Rate-limit window memory | per identity+model key; capped with circuit keys | Before admit | Task 3 denies with retry hint bounded. |
-
-### Work connectors (per tool invocation)
-
-| Resource | Default / hard cap | Charge/check point | Failure/cleanup owner |
-| --- | ---: | --- | --- |
-| Pagination pages | 20 / 100 | Before next-page CLI/API call | Task 7 / Task 8 stop with partial+cursor or error. |
-| Items per page / aggregate items | 50 / 500; 200 / 2,000 | Before parse/accumulate | Task 7 / Task 8 reject/truncate with marker. |
-| Request/response body | 256 KiB / 2 MiB | Before spawn/parse | Task 7 / Task 8 kill/reject. |
-| Attachment / file bytes | 5 MiB / 25 MiB; 10 MiB / 50 MiB | Before upload/download/scan | Task 7 / Task 8 deny; scan hook required for inbound. |
-| CLI stdout/stderr capture | 2 MiB / 16 MiB | While reading pipes | Task 7 / Task 8 abort process. |
-| Process wall time | 60 s / 10 min | Spawn abort signal | Task 7 / Task 8 kill process tree best-effort. |
-| Concurrent CLI processes / identity | 2 / 8 | Before spawn | Task 7 / Task 8 queue-reject. |
-| Retries for idempotent ops | 2 / 4 | Before retry | Task 7 / Task 8 require idempotency key. |
-| Rate / cost counters | finite host ceilings | Before mutation | Task 7 / Task 8 deny. |
-| Operation/draft/idempotency key | 256 B / 2 KiB | Before store write | Task 7 / Task 8 reject. |
-
-### Server deployment / persistence lifecycle
-
-| Resource | Default / hard cap | Charge/check point | Failure/cleanup owner |
-| --- | ---: | --- | --- |
-| Health/readiness response | 4 KiB / 64 KiB; no tenant payloads by default | Before serialize | Task 5 redacts. |
-| Drain admit cutoff | 30 s / 5 min | After drain flag | Task 5 rejects new admits; in-flight use existing timeouts. |
-| Replay page rows / cursor | 100 / 500; 4 KiB / 16 KiB | Before `queryEvents` | Task 5 pages; authorize+ownership required. |
-| Publish/capacity concurrent runs | reuse server 16 / 256 | Existing handler | Task 5 documents; does not raise hard caps. |
-| Tenant quota counters | finite host ceilings per resource class | Before persist/spawn | Task 6 denies with attributable reason. |
-| Envelope/KMS payload | reuse credentials-node envelope file caps (4 MiB / 16 MiB) | Before encrypt/decrypt | Task 6 rejects; host KMS timeout bounded (60 s hard). |
-
-**Forbidden:** unbounded CLI output, model-built argv, credential-in-argv, unrestricted policy payload store, uncapped router fallback loops, raising hard caps silently, default queue broker, Office binary packaging.
-
-## Work-connector capability freeze
-
-| Workload | 0.0.13 status | Notes |
-| --- | --- | --- |
-| Outlook / Gmail search, read, draft, approved send | supported common denominator | Draft durable before send; external-recipient policy fail closed. |
-| Calendar list/create/update | supported common denominator | Idempotent create/update with provider concurrency tokens. |
-| OneDrive/SharePoint / Drive files search/read/upload/move/share | supported common denominator | Share external targets policy-gated; attachment caps apply. |
-| Tasks list/create/complete | supported common denominator | Provider-specific task systems mapped to shared result shapes where possible. |
-| Teams / Planner / To Do | capability-gated optional | Not advertised as universal parity; absent capability → explicit unsupported. |
-| Docs / Sheets / Slides cloud ops | capability-gated optional | Same; no local Office execution implied. |
-| CLI login / setup / tenant-admin / debug / credential export | unsupported from Prism | Host may run outside Prism; tools must deny if invoked. |
-| Generic Graph or Discovery passthrough | unsupported | Hard-coded templates only. |
-
-## Threat and authority matrix
-
-| Boundary | Trusted authority | Untrusted input | Mandatory control | Default / unsupported |
-| --- | --- | --- | --- | --- |
-| Identity claims | Host `IdentityVerifier` | Caller headers/body identity fields | Verify before attach; expiry/revocation/tenant checks | Caller-asserted identity unsupported. |
-| Delegation | Parent verified identity | Requested child scopes | `child.scopes ⊆ parent.scopes`; tenant immutable | Scope widening / tenant swap unsupported. |
-| Credentials | Host resolver / workload callback / CLI config dir | Model text, tool args, env dumps | Late-bound resolve; never argv/model/context; per-identity isolated config | Credential discovery from model unsupported. |
-| Policy decisions | Host policy + ledger | Action/resource context | Redact; store evidence refs; version pin | Unrestricted prompt/tool body in ledger unsupported. |
-| Model routing | Allow-list + residency + budgets | Model id, OpenRouter metadata | Deny before provider call on miss/exhaustion | Bypass router via metadata unsupported when policy attached. |
-| Cloud providers | Host workload identity | Endpoint/region overrides | Preserve private-endpoint/region; mock-only offline | Static keys in repo/fixtures unsupported. |
-| Server health/replay | Authorize + ownership | Health query detail flags, replay cursors | Minimal health by default; ownership-scoped replay | Anonymous tenant dump unsupported. |
-| Connector CLI | Hard-coded templates + host binary pin | Model-suggested command/args | `execFile` argv from template only; version/schema validate at start | Model command, login, admin, debug unsupported. |
-| Mutations | Durable draft + tool_approval + idempotency store | Retry storms, stale ETags | Draft→approve→send; concurrency token; dedupe | Blind send/share/delete unsupported. |
-| Attachments / shares | Host scan + recipient policy | Files, external recipients | Cap bytes; scan hook; external deny-by-default | Unscanned inbound / open external share unsupported. |
-| Extensions | Allow-list + signature policy | Unsigned packages | Fail closed when policy enabled | Unsigned load when enterprise policy on unsupported. |
-| Retention / legal hold | Host hold + retention policy | Delete requests | Hold blocks delete/export rules per policy | Silent purge under hold unsupported. |
-
-## Validation matrix for Task 0
-
-| Check | Frozen assertion |
-| --- | --- |
-| Traceability | Every Phase 8 roadmap Functional/Performance/Code Quality/Security criterion has one primary Task 1–10 owner; 0.0.14 conversations/artifacts/channels/devices and 0.1.x Studio/control-plane have none. |
-| Package names | Exact names/subpaths listed above; 35 → 41 manifests at release; new packages only in `prism-all`. |
-| Primitive reuse | Only identity, side-effect idempotency, retention/hold/export/quota, and extension signature/allow-list are authorized generic core/extension gaps; each needs ≥2 consumers. |
-| CLI boundary | M365/GWS adapters are hard-coded templates via `execFile`; no model-controlled command surface. |
-| Cloud separation | Azure/Bedrock/Vertex packages distinct from consumer Anthropic/Google. |
-| Finite resources | All identity/policy/router/connector/deployment caps above are enforced by owning tasks. |
-| Security | Host-verified identity, narrow delegation, late-bound credentials, draft-then-approve, fail-closed residency/share/attachment/extension/hold policy. |
-| Queues | **Deferred after Task 5:** no Redis/SQS adapter. Postgres/`createWorkflowCoordinator` checkpoint polling remains default; revisit only with measured polling/load evidence. |
-
-
-## Documentation and release ownership
-
-- Task 0: this evidence page, `docs/index.md`, and `docs.test.ts` regression guard.
-- Task 1: identity contracts + propagation docs (`agent-identity.md` and cross-links).
-- Task 2: `@arnilo/prism-policy` + `policy-and-audit.md`.
-- Task 3: `@arnilo/prism-model-router` + `model-routing.md`.
-- Task 4: azure/bedrock/vertex provider packages + provider docs.
-- Task 5: server deployment seams + `server.md` / performance notes.
-- Task 6: retention/KMS/quotas/extension signature docs + persistence/security pages.
-- Task 7: `@arnilo/prism-work-tools/microsoft365` + shared work-tools contracts.
-- Task 8: `@arnilo/prism-work-tools/google-workspace` + shared result-shape parity docs.
-- Task 9: canonical docs, examples, migration, index navigation.
-- Task 10: 0.0.13 graph, benchmarks, pack/install, supply-chain, dry-run publish, roadmap completion evidence.
-
-No public implementation API changes land in Task 0. This page, `roadmap.md` Phase 8, and Plan 076 are authoritative until implementation; later tasks may tighten defaults but cannot widen scope, raise hard caps, add Office packages, embed an auth DB/control plane, expose model-controlled CLI, merge enterprise cloud into consumer Anthropic/Google, or enable default queues without updating this evidence, tests, docs, and plan.